Anthropic’s Mythos has intensified a problem that vulnerability management programs were already struggling to contain: too many vulnerabilities and not enough clarity about which ones matter.

What changes with Mythos — and the AI-based class of vulnerability discovery systems it represents — is the speed at which software flaws can be found and exploited.

That speed raises a more immediate question for defenders: Which vulnerabilities require action?

Anthropic has pointed to one method. In guidance tied to its work on AI-accelerated offense, the company recommended using the Exploit Prediction Scoring System (EPSS), a probabilistic model developed by the data scientists behind Empirical Security, and published through FIRST, as a way to triage vulnerabilities as discovery increases.

According to Anthropic, “Patching the KEV [CISA’s Known Exploited Vulnerabilities catalog] list first, and then everything above a chosen EPSS threshold will help you turn thousands of open CVEs into a manageable queue.”

“EPSS uses the same probabilistic models that weather forecasters do,” Michael Roytman, co-founder and CTO of Empirical Security and one of the original EPSS authors, told CSO. “The forecast is which vulnerabilities are likely to be exploited somewhere on the internet in the next 30 days.”

Roytman added, “We don’t deal with rain by constantly having an umbrella over our heads. We have predictive models that tell us whether we should or should not bring an umbrella.”

Ed Bellis, CEO of Empirical Security, told CSO that Anthropic’s recommendation stood out because of who made it, not because EPSS is new. According to Bellis, it was the first time, to his knowledge, that a large language model provider had explicitly endorsed a probabilistic, purpose-built model for vulnerability prioritization.

A system already under strain

Mythos arrives as the vulnerability ecosystem is already under strain.

Most recently, the volume of new vulnerabilities forced NIST to scale back enrichment of its National Vulnerability Database (NVD) to only certain CVEs. The NVD enriches vulnerability reports with CVSS scores, which are developed by FIRST, while EPSS provides a separate estimate of exploitation likelihood.

“The fact that they’re [NIST] narrowing down the vulnerabilities that they are going to focus on [for CVSS] is because it’s all human-driven,” Bellis said. EPSS, by contrast, is machine-driven and can be applied across all CVEs, with scores published daily.

“It’s machine-driven, and it’s a machine learning model that ultimately scores that vulnerability,” Bellis added. “The average vulnerability management practice today is not thinking about it from a machine-learning, data-driven perspective, but they could be.”

According to the Zero Day Clock, the mean time to exploit a vulnerability after it’s been discovered is going to reach one hour this year, and only one minute by 2028, down from 2.3 years in 2018.

Security leaders weigh promise versus reality

Security vendors are increasingly incorporating EPSS scores into their systems.

According to Roytman, EPSS has been incorporated into more than 120 security vendors’ products, including CrowdStrike, Cisco, Palo Alto Networks, Qualys, and Tenable platforms.

“I do not think other CISOs realize how broadly EPSS has been adopted, but that adoption is great news for the industry,” James Robinson, CISO at Netskope, told CSO.

“EPSS, when applied to [software flaws], is an essential step in being able to know if this exploitable vulnerability applies to your implementation or operation,” he said, adding that “the role that EPSS can play in identifying non-CVE vulnerabilities identified from Mythos and other upcoming models is extremely useful.”

Aaron Weismann, CISO at Main Line Health, welcomed the faster discovery of vulnerabilities but questioned whether the guidance translates to sectors such as healthcare, telling CSO, “It’ll be interesting to see how actionable those recommendations are for critical infrastructure — like healthcare, utilities, government, and others — where immediate and automated patching can be challenging due to the prevalence of legacy hardware and software.”

Not all defenders embrace the concept of EPSS or even CVSS to address the rapid discovery of vulnerabilities.

“To be direct: Both CVSS and EPSS are fundamentally outdated in the ‘Mythos’ era and require a complete rethink,” Ramy Houssaini, chief cyber solutions officer of Cloudflare, told CSO. “EPSS relies on lagging, 30-day historical data, but AI has collapsed the time-to-exploit into mere minutes. Instead of waiting for a predictive score to prioritize human-speed patching, organizations must shift to real-time defense.”

Exposure management will extend beyond CVEs

While most of the analysis of the power of Mythos to discover vulnerabilities has centered on common applications to which CVEs can be applied, its discoveries will most likely reveal millions of other vulnerabilities that don’t meet this definition. “A similar process is happening across clouds and applications, where there is no common enumerator across those applications,” Empirical Security’s Roytman said.

“My application looks very different than yours, even if it’s written in the same language,” he added. “So, when we think about that probabilistic modeling expanding to all of exposure management, which might be a bigger problem than just CVEs themselves, we have to think about building local predictive models for applications, clouds, configurations, misconfigurations, and that is another exercise in taking advantage of the existing security tooling and building small, purpose-built models rather than having humans do the manual triage work.”

In short, Mythos and competing AI models will soon be able to find millions and millions of vulnerabilities that will not fit into the CVE model. “We see enterprises all the time that might have tens of millions of open instances of vulnerabilities, let alone the sheer volume of those classes of flaws that they’re going to discover on the AI front,” Bellis said.

“This is a problem, but the sky is not falling,” Roytman said. “There are methods for managing it.”