The introduction of new AI models, like Anthropic’s Mythos, opens up a new frontier for cybersecurity. 

Once, it took a skilled team dedicated time and effort to identify exploitable weaknesses in an operational technology (OT) system, such as those that run power networks, water treatment plants, and transport infrastructure. Now, Mythos and similar models can autonomously scan for these vulnerabilities in a far shorter amount of time and at a much greater scale. 

For asset owners, the time between the discovery of a vulnerability and the implementation of a solution represents a window of opportunity for cyber criminals and other bad actors. 

It’s a race against time for industrial systems, as the consequences of cyberattacks on this operational technology can impact regions or entire countries. 

As AI models like Mythos accelerate the discovery of vulnerabilities in these systems, organisations responsible for critical infrastructure need to strengthen how they prioritise risk, build resilience and prepare for response and recovery.

In the world of IT cybersecurity, particularly among corporate enterprises and especially financial systems, automated patching is used to close that gap as quickly as possible. But most OT assets can’t use the same approach.

Any updates must observe the sensitivity around critical infrastructure, as OT systems are often a part of safety-critical systems or involve some form of safety integrity classification. That means careful testing, extensive reviews from independent third parties, and official approvals.

Because of the critical role these systems play in safety, reliability and continuity of service, many organisations restrict implementing patches to timeframes that align with other updates, dependent on specific regulatory standards in their sector. While these safeguards are essential, the increased delay makes the window of opportunity for cyberattacks wider in OT.

New AI models will make this an even bigger liability, one that must be handled urgently, mainly through vulnerability management. To keep up with the rapid pace, organisations must prioritise resilience, recovery, and engineering-led cybersecurity.

Organisations should begin by identifying where their OT environments are most exposed, which systems are the most operation-critical, and how they would respond if those systems were disrupted. This includes reviewing connected and externally accessible systems, assessing dependencies across systems, and clarifying how risk propagates through operations. 

From there, response and recovery plans should be thoroughly tested and clearly understood. Operations, engineering, safety, and cybersecurity teams should align around a shared approach, with defined roles and realistic execution steps.

Given the widening gap between vulnerability identification and mitigation, organisations must assume that a cybersecurity incident will occur at some point and prepare accordingly. One of the best proactive measures an organisation can take is conducting a targeted assessment or simulated crisis scenario in their specific environment. These measures, often known as “scenario exercising” or “Red Teaming/Blue Teaming”, help test decision-making, expose gaps in coordination, and improve readiness under real-world conditions.

AI-enabled tools like Mythos are accelerating how quickly vulnerabilities are identified and potentially exploited across all networks. In OT environments, the ability to respond will continue to operate under crucial safety measures. This is a widening gap that organizations must learn to manage, as it’s impossible to eliminate.

The advantage will go to the organizations that understand their level of exposure, prioritize what matters most, and prepare to act when disruption occurs. That means moving beyond awareness to readiness through targeted assessments, clear response plans, and realistic scenario testing.