There is a number in the latest cyber research that should stop every business owner and board member in their tracks. The time between a vulnerability being discovered and a working exploit being used against you has collapsed from weeks, sometimes months, down to hours. In some documented cases, minutes.
We have spent years telling clients that the fundamentals buy you time. Patch on a sensible cycle, run an annual penetration test, keep an eye on the alerts. That advice was never wrong, but the ground it rested on has shifted. The assumption underneath all of it was that attackers needed time, skill and patience to turn a flaw into a breach. Frontier AI has quietly removed most of that requirement.
This is not a prediction about something coming in a few years. It is happening now, and the people who pay attention to the data are already changing how they operate.
[ Insert chart here: "The window to patch has collapsed" (time-to-exploit-collapse.png). Median time from disclosure to exploitation, falling from 63 days in 2018 to hours in 2026. Sources: Mandiant M-Trends; Cloud Security Alliance / Zero Day Clock. ]
In November 2025, Anthropic disclosed that it had detected and disrupted what it assessed with high confidence to be a Chinese state-sponsored espionage campaign. The detail that matters is not the attribution. It is how the attack ran. The group used an AI agent to carry out roughly 80 to 90 per cent of the operation on its own, across about 30 high-value targets including technology firms, financial institutions and government agencies. The AI handled reconnaissance, vulnerability discovery, exploit development, credential harvesting, lateral movement and data exfiltration. Humans only stepped in for a handful of strategic decisions. The attackers got past the model's safeguards by breaking the work into small, innocent-looking tasks and dressing the whole thing up as defensive security testing.
That was with a publicly available coding agent, months ago.
Then in April 2026, Anthropic announced Claude Mythos, a frontier model so capable at finding and exploiting software flaws that the company decided not to sell it. There is a common misreading of this that is worth clearing up, because a sharp reader will pick at it. Mythos is not available to the public, and it is not sitting in the hands of criminals. It is locked behind a vetted consortium called Project Glasswing, given only to around 50 critical infrastructure providers, vendors and open source maintainers so they can find and fix their own bugs before anyone else does.
So why does a model you cannot buy matter to your business? Three reasons.
First, it proves the ceiling. Mythos found thousands of zero-day vulnerabilities across every major operating system and browser, including bugs that had survived decades of human review. One example, a flaw in the wolfSSL library, would have let an attacker forge TLS certificates across billions of connected and industrial devices. The point is not the headline count. It is that a single system, with a single prompt and no hand-holding, can now do what used to take a skilled research team weeks.
Second, capability proliferates. Mythos is the most extreme example, not the only one. Open source autonomous hacking tools already top bug bounty leaderboards. Public frontier models are being classified by their own makers as high risk for cyber misuse. What sits behind a consortium today shows up in cheaper, open-weight models within a year, and those are the ones attackers will use.
Third, every patch is a blueprint. When Glasswing partners ship fixes for the bugs Mythos found, those patches are public. AI can read a patch, work out exactly what it fixed, and build an exploit for everyone who has not patched yet. As of the first month of the project, less than one per cent of the vulnerabilities Mythos surfaced had been patched. That is a very large window, and it is open right now.
When Australian regulators react inside a few weeks of a vendor announcement, it is worth noticing.
On 30 April 2026, APRA wrote to every bank, insurer and superannuation trustee it oversees, calling for a "step change" in how they manage AI-related cyber risk. The letter named Anthropic Mythos directly and said plainly that governance, risk management and operational resilience are not keeping pace with the speed and complexity of the threat. APRA flagged board literacy gaps, over-reliance on vendor summaries, weak post-deployment monitoring and supplier concentration as specific failures it observed across the sector.
ASIC followed with its own open letter to financial services licensees, and its message was blunt: do not wait for perfect clarity to act on the threat from new AI models. ASIC reinforced, through its case against FIIG Securities, that cyber risk management has to be demonstrably effective and proportionate to the size and complexity of the business. In other words, "we were getting around to it" is not a defence a board wants to be relying on.
The most useful document of the lot, and the one we point clients to, came from the Australian Signals Directorate. On 9 April 2026, two days after the Mythos announcement, the ASD published practical guidance on frontier models and their impact on cyber security. It is short, technology-agnostic and refreshingly free of hype. Its core message lines up with everything above: the cost and skill needed to find and exploit vulnerabilities is falling steadily, organisations should expect a higher tempo of patches, and the answer is to harden the basics aggressively while there is still time.
That is the backdrop. Now the part that matters for you.
Most Australian businesses we assess are running a security model built for a slower world. It usually looks something like this. A vulnerability scanner runs on a schedule. Patches go out on a monthly cycle, often with a testing window that adds another week or two. A penetration test happens once a year, produces a PDF, and the findings get worked through over the following quarter. Detection and response, if it exists at all, runs at the speed a human analyst can read alerts.
Every one of those assumptions is now broken.
An annual snapshot tells you almost nothing about your exposure for the other 51 weeks, especially when new exploitable flaws are being discovered continuously. A monthly patch cycle with a two-week test window is a multi-week head start handed to an attacker who needs hours. A human-paced SOC cannot triage, correlate and contain at the speed an automated attack moves. The model is not slightly behind. It is built around a tempo that no longer exists.
This is not a reason to panic, and it is not a reason to rip everything out. The fundamentals still work. They just need to run faster, more often, and with the same AI leverage the attackers are using. Here is where we would focus.
This is the biggest shift, so it goes first. Vulnerability scanning, patch management and an annual penetration test are three separate things, and businesses often confuse them. A scanner tells you which known issues exist. Patch management closes them. A penetration test tells you whether someone can actually chain weaknesses together to reach something that matters. None of those, on their own or on an annual basis, keeps up anymore.
AI-led penetration testing is a different discipline. It runs continuously rather than once a year, it reasons about how flaws combine into a real attack path the way a human tester does, and it does so at machine speed and scale. Used well, it lets you find the exploitable path through your environment before an attacker's AI finds it for them. The ASD has explicitly encouraged organisations to turn these same frontier model capabilities inward to strengthen their own systems, and the broader CISO community is building this into a permanent function rather than a yearly event.
To be clear, this does not replace skilled human testers. Annual human-led testing still has its place for depth, business logic, social engineering and the judgement a model does not have. The change is that it can no longer be the only testing you do. Think of the annual engagement as a deep audit and the continuous AI testing as the thing that watches the gap in between.
Following on from that, if your compliance obligations or your own assurance still rest on a single yearly penetration test, that is now a minimum baseline rather than evidence that you are covered. Pair it with continuous testing, and make sure the human engagement is scoped to do what humans are still better at, rather than re-running checks a machine can do constantly.
For anything facing the internet, the target should be remediation within 48 hours, automated wherever you can manage it. Painful as that is operationally, the alternative is leaving the exact window open that AI-driven attacks are built to exploit.
The ASD goes further still, and it is worth knowing where the guidance is heading. Its advice is to adopt a "patch every day" mentality, to apply patches regardless of severity rating because low-severity flaws are exactly what AI chains together into serious ones, and to revisit how long you spend testing patches before deployment. That means more frequent patch and outage windows, and a higher tolerance for the disruption they cause, because the disruption of a breach is far worse. For organisations that struggle with this, moving suitable workloads to reputable software-as-a-service providers shifts much of the patching burden off your plate entirely.
When you cannot assume you will patch in time, the next line of defence is making sure a single compromise does not become a full business outage. That is what Zero Trust is for. The principles the ASD points to are "never trust, always verify" and "assume breach", delivered through a modern, defensible, layered architecture rather than a flat network with a hard shell and a soft centre.
In practice that means real network segmentation so an attacker who gets in cannot move sideways across everything, egress filtering to stop data leaving and to choke off attacker tooling, and phishing-resistant multi-factor authentication on every privileged account. None of this is new. What has changed is that segmentation has gone from good hygiene to the primary control limiting how much damage any one exploit can do.
You cannot match a machine-speed attack with a part-time, business-hours, human-only monitoring setup. A capable Security Operations Centre, running around the clock with detection engineering and the authority to contain threats quickly, is no longer a luxury for large enterprises. For most mid-sized Australian businesses, a third-party SOC or MDR service is the realistic way to get that capability without building a 24/7 team in-house.
One caution that APRA made a point of: your suppliers are part of your attack surface. If you outsource detection and response, validate that the provider's own security and resilience hold up. The same goes for any managed service that has access to your environment.
Encryption is the control that limits what an attacker can actually do with the access they gain. Data encrypted properly at rest and in transit is far less useful to whoever steals it. The wolfSSL certificate-forgery flaw Mythos found is a sharp reminder that the cryptographic layer itself is a target, so this is not a set-and-forget item. Use modern, well-maintained algorithms and libraries, keep them current, manage your keys properly, and retire weak or ageing cryptography on the same urgency as anything else. Strong encryption turns a catastrophic data breach into a contained, recoverable incident.
Unsupported systems do not get patches, which means in this environment they are permanently exploitable the moment a flaw is found, and flaws are being found at a pace we have never seen. The ASD is direct about this: remove or replace software that vendors no longer support. Every end-of-life box on your network is now a standing invitation. If you have been carrying technical debt because retiring a system is expensive or inconvenient, that calculation has changed. The cost of keeping it is now higher than the cost of replacing it.
A plan you have never rehearsed is a document, not a capability. Given that incidents are likely to come more often, and potentially several at once, your response needs to be fast and practised. Run tabletop exercises, and specifically rehearse the scenario the research community is warning about: multiple high-severity incidents hitting in the same week. Pre-authorise containment actions so your team is not waiting on a sign-off while an automated attack runs. The goal has shifted from preventing every incident, which is no longer realistic, to detecting and containing fast enough that an incident does not become a disaster. Measure yourself on how quickly you can get back to normal operations, not just on how many attacks you blocked.
Beyond the core list, a handful of supporting moves make everything above work better.
Know what you have. You cannot patch, segment or defend a system you do not know exists. An accurate, current asset inventory, including internet-facing systems and the software components inside them, is the foundation the rest sits on. This is one of the tasks AI is good at accelerating, so there is no excuse for an out-of-date picture.
Fix your governance speed. APRA's whole letter is, in effect, about boards and executives not moving fast enough. If approving a new defensive tool takes three months of committee cycles, you have a governance problem that is now a security problem. Build a faster path for onboarding defensive technology, and make sure your board has enough literacy to challenge the risk properly rather than nodding along to a vendor slide.
Use AI on your own side. The same capabilities that worry us are available to defenders too. Ask an agent to review your code before it ships. Use AI to keep your inventory current and to accelerate triage. The asymmetry the attackers enjoy only holds if defenders refuse to pick up the same tools.
None of this is comfortable to read, and we are not going to dress it up. The economics of attacking have shifted in the attacker's favour, and that shift is permanent. But this is not the first time the industry has faced a systemic problem with a hard deadline, and we have met those before through coordinated, disciplined effort rather than panic.
The businesses that come through this well will not be the ones with the biggest budgets. They will be the ones that stopped treating security as an annual event and started running it as something continuous, fast and resilient by design. Most of the controls that matter are ones you have heard of for years. What has changed is that "we will get to it" is no longer an option, and the window to act on your own terms is shrinking by the week.
If you want a clear-eyed assessment of where your environment sits against this new tempo, that is exactly the kind of work we do. The first step is usually simpler than people expect: work out what is exposed to the internet, confirm how fast you could actually patch it, and find out whether anyone could chain their way through it before you would even notice.
.png)
.png)
