Editor's note: this blog post is based on a live conversation between UiPath TrustOps security leaders Kevin Mooney (Field CISO, Americas), Marco Eggerling (Field CISO, International), Cosmin Radu (Head of Security Engineering), and Valentin Lupu (Security PMO Lead).
What Mythos revealed about enterprise security, and what comes after it
There has been a flood of interest and news around Anthropic’s large language model (LLM) for cybersecurity, Mythos, ever since the company announced it and subsequently announced that it is unsafe for unrestricted release. Mythos, GPT-Cyber, and similar LLMs work by reviewing source code to find insecure patterns in code. Similar to using LLMs and coding agents to write code, using them to find vulnerabilities yields a significant volume that may not be the highest quality.
No one asks, "did you anticipate this coming?"
Yes, in fact, UiPath started more than a year and a half before Mythos was released.
How vulnerabilities get found—and missed
The majority of enterprises use vulnerability scanners that follow a simple flow. They scan a system for the software it contains and compare the name of the software and its version to a list of known common vulnerabilities and exposures (CVEs), most commonly the United States (U.S.) National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology (NIST) and MITRE.
This is a very broad, non-specific approach to security. It is commonly used because it is relatively easy to implement and effective, so long as there is sufficient IT staff to keep up with the patching and a good strategy to implement such patches without downtime. There is a high likelihood that this strategy patches vulnerabilities that are not actually individually creating direct risk for an organization, though, and more likely that vulnerabilities are only exploitable by an attacker chaining multiple vulnerabilities to get through many layers of defense.