For years, application security operated on a relatively predictable cadence. Vulnerabilities were disclosed, teams triaged them by severity, and the critical ones were fixed first. But with the advances of AI, most notably Anthropic’s Claude Mythos, that world is gone.
Code volume is exploding as teams use AI to generate applications at a pace security teams can’t keep up with. Time-to-exploit is collapsing from days to hours. Attackers can use AI to chain together low-severity vulnerabilities into real attack paths, and that means “just fix the critical ones” is no longer a viable strategy.
Attackers are gaining an asymmetric advantage, which is a key reason why Anthropic restricted use of Mythos. The only way to restore symmetry is to use a hybrid security approach—with both traditional scans and AI—to find, prioritize, and fix risk faster than adversaries can exploit it. Here’s how.
Want to listen or watch instead? Check out our on-demand webinar on this topic
Start with the fundamentals
A solid AppSec strategy includes shifting left, static analysis, software composition analysis (SCA), policy-driven scanning, and automation. These make up the foundation that everything else depends on. If the fundamentals aren’t in place, AI layered on top just generates more noise, faster. But to keep up today, fundamentals must be paired with intelligence and speed.
Know what to fix first
Most AppSec programs suffer from too many findings, and identifying which ones to fix first is a struggle. Compounding the problem, Mythos can find vulnerabilities that humans have missed for years, and it does so faster than ever before.
This is why prioritization has to get smarter. Traditional severity ratings tell you how bad a vulnerability could be, but they don’t tell you whether it matters in your environment.
Reachability analysis changes that conversation. Instead of simply flagging that an open source component has a vulnerability, it can tell you whether that vulnerability has been invoked in a vulnerable method. That’s a stronger signal since it distinguishes between theoretical risk and exploitable risk.
Risk scoring takes it a step further by weighting issues based on context that reflects your situation. It provides important information such as whether a CVE is on the CISA KEV list, is reachable, or in an application that is internet-facing or handles sensitive information.
For example, an internal app with a high-severity finding may carry less real risk than a public-facing app containing sensitive information with a medium-severity finding. Good risk scoring captures that nuance, and it can be customized to reflect your priorities, not a generic formula.
Watch: See three critical imperatives organizations need to address to remain secure in the era of AI-powered software development.
Quiet the noise with AI triage
Even with smart prioritization, false positives can eat developer bandwidth and erode trust in security tooling.
AI triage addresses this directly by running findings through large language models (LLMs) to determine whether an issue is real or a false positive. It also gives developers clear, actionable feedback instead of another ticket to investigate. The value is in the hours of developer time you reclaim by not chasing ghosts.
Read more on Mythos: What Anthropic’s Project Glasswing means for software builders
Go from finding to fixing
Here’s where the old model breaks down completely. Waiting on a developer to manually fix every issue isn’t sustainable. It’s not fast enough for the volume of code being generated, and it’s certainly not fast enough to keep pace with shrinking time-to-exploit.
The answer is agentic workflows that don’t just identify problems but close them. Think of it as a find-and-fix loop.
- A vulnerability is detected.
- An AI agent generates a fix.
- That fix is instrumented automatically and validated to confirm it worked.
- The code is rescanned.
The whole cycle happens without a human writing a single line of remediation code. This applies across the board (SCA and static analysis alike), and it can work with automated fix pull requests right in the platforms developers already use, instrumented by policy, without manual intervention.
Importantly, those fix pull requests place a human developer in the loop, right in their native tools, reviewing the merge before any code is changed.
Think like a human, at scale
What makes agentic security genuinely powerful isn’t just automation, it’s context. A human reviewer doesn’t look at code in a vacuum. They bring knowledge of the application’s architecture, threat model, design documents, and business logic. They can reason about it.
That’s the promise of a context store. It can feed design documents, threat models, and architecture reviews into the platform, so AI triage and code analysis behave the way a human would, but at a scale no human team could ever reach.
The result is a secure code review that can catch business logic flaws and emerging vulnerability classes that traditional, rules-based static analysis simply misses.
Fight fire with fire
LLM-powered code analysis paired with traditional AppSec tools is only one side of the equation. Attackers usually don’t start with source code; they probe running applications, chain behaviors, and look for exploitable paths.
That’s why the most advanced programs add an adversarial lens, using penetration testing agents to validate which weaknesses are actually exploitable and likely to matter in the real world. Done well, this scales a critical practice that has long been constrained by scarce expertise, high cost, and limited capacity.
Critically, agents can share intelligence, so code analysis can identify vulnerabilities and pen testing can validate them. That closed loop (find, validate, fix, rescan) is what it looks like when you can point AI at your applications the same way attackers can.
Empower the developer to be the front line
All this has to meet developers where they work. That means instrumenting security directly into the coding agent.
When an AI assistant generates code or pulls in a dependency, rapid SCA and static analysis tools run in near real time, issues are triaged and prioritized, and the coding agent is guided to generate, validate, and rescan fixes within its own loop.
Guardrails define how the coding agent should operate and the boundaries it should stay within. This is where the biggest shifts are still ahead.
Unleash the power of a hybrid security model
It’s tempting to assume the answer is to throw an LLM at every scan. But that is cost-prohibitive in both time and token expense, and it doesn’t produce better outcomes.
The better approach is the hybrid security model. Use deterministic, rules-based scanning where it’s fast and effective, and use AI where it adds genuine intelligence, like with triage, contextual prioritization, code review, fix generation, and validation.
Orchestrating these capabilities together, with AI applied strategically rather than indiscriminately, is what makes the model sustainable.
Don’t lose sight of the fundamentals
The fundamentals of AppSec haven’t changed. What’s changed is the speed and scale at which they need to operate. Attackers are faster, code volume is exploding, and maintaining visibility is harder than ever.
The teams that stay ahead will be the ones that use AI as a closed loop underpinned by context that helps it process information the way a security team does.
That’s what it means to be Mythos-ready. Not just keeping up with the volume of risk but getting ahead of it.
