New Playbooks For a Zero-Window Era

When patching isn’t fast enough, NDR helps contain the next era of threats.

If you’ve been tracking advancements in AI, you know the exploit window, the short buffer that organizations relied on to patch and protect after a vulnerability disclosure, is closing fast.

Anthropic’s new model, Claude Mythos, and its Project Glasswing, showed that finding exploitable vulnerabilities and subtle cracks in your defenses in operating systems and browsers — work that once took experts weeks — can now be done in minutes with AI. As a result, the patch window of opportunity is now near-zero. The situation is so critical that Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell recently convened an urgent meeting with the CEOs of major U.S. financial institutions to discuss the implied risks. The takeaway was straightforward: surging AI capabilities have upended risk profiles, with profound implications for institutional stability and integrity across industries. 

Mythos also highlights the gap between discovery and remediation. It easily surpassed human expertise, solving a complex corporate network simulation that would have taken more than 10 hours of expert programming skill. Its discoveries also found problems in decades-old software that had been missed in thousands of security reviews. 

From Mythos to the assume-breach era

Mythos isn’t the only AI model capable of finding vulnerabilities this quickly. Other parties have found them using more basic LLMs. 

If your company uses any type of software, you should assume that software probably contains thousands of these unknown vulnerabilities, just waiting to be exploited by AI-assisted discovery. This is not a failure of your security team; rather, it’s the structural consequence of 30 years of accumulated software complexity meeting a leap in offensive AI capability. 

Now that near-zero exploit windows are the norm, “patch faster” or “patch better” are no longer enough. Security teams will need new playbooks, based on an assume-breach model: breaches will happen, and detecting them as they occur and containing them at scale will be paramount. These outcomes are decided in real time, on the network.

How to bring an assume-breach model into everyday operations

The assume-breach model has three operational requirements, each of which uses automated methods designed to collapse time to containment:

1. Detect post-breach behavior before a threat escalates across your enterprise 
2. Reconstruct the complete attack chain as soon as possible
3. Contain threats rapidly to limit their blast radius

In practice, this method of containment requires:

Visualizing containment as the scoreboard

Prioritize reducing mean-time-to-contain (MTTC) to limit damage while maintaining your watch over detection and response metrics (MTTD and MTTR). As AI accelerates exploitation and reshapes attack methods, the importance of speed in pinpointing, containing, and resolving threats increases. Compressing MTTC starts with real-time, comprehensive network visibility. With it, SOCs can detect post-breach behavior, determine the blast radius, and disrupt events before they spread further.

Monitoring for AI-favored techniques

Autonomous AI attacks increasingly use sophisticated techniques to evade detection, including living-off-the-land (LOTL) methods that conceal malicious activity within legitimate tools and processes. Network Detection and Response (NDR) platforms play a crucial role in identifying these subtle indicators of compromise. They do this by continuously monitoring network traffic for unusual behavior. Signs of such activity might appear as unusual SMB admin shares, NTLM where Kerberos is expected, or new RDP/WMI/DCOM pivots, all of which can signify lateral movement across your network.