Why the Vulnpocalypse Fails the FAIR Risk Test

Anthropic’s announcement of Claude Mythos Preview in early April sent shockwaves through the tech and cybersecurity communities.

Since then, security professionals, government officials, regulators and business leaders have all raised an alarm. The concern shared by many is that Mythos Preview proves that AI models have become so sophisticated that they are capable of autonomously discovering and weaponizing zero-day vulnerabilities at previously unseen levels¹.

And as you’d expect from the cybersecurity community, given our love for dramatic and exciting labels, the term Vulnpocalypse is now being used to refer to the uneasy scenario where advanced AI accelerates vulnerability discovery and exploitation at a rate that outpaces efforts to patch them.

The Vulnpocalypse

It’s a known fact that the cyber industry has historically used fear and hyperbole to grab headlines and force reactions, but the concerns around the Vulnpocalypse have merit.

Since the release of Mythos Preview, there have been reports that thousands of high and critical severity vulnerabilities have been discovered across major operating systems, widely used browsers and the open-source projects that underpin critical internet infrastructure.

The numbers are genuinely concerning and warrant attention and discussion.

• We’ve had Mozilla reporting a ten fold increase in Firefox vulnerabilities between release 150 and 148². They’ve directly attributed 271 of those vulnerabilities to Mythos.
• Anthropic has indicated that scans of over a thousand open-source projects have resulted in more than 6,200 estimated high and critical findings being identified³.
• Cloudflare, one of the users of Mythos Preview, announced that they found 2,000 vulnerabilities, 400 of which were rated either high or critical⁴.

Much of these disclosures are the result of Project Glasswing, Anthropic’s collaborative effort along with key tech partners to get ahead of the Vulnpocalypse. Glasswing is intended to be a a defensive shield of sorts to give organizations early visibility so they can remediate flaws before AI-driven exploit capabilities fall into the wrong hands.

Looking at the available data and reporting, it’s hard to argue against the growing consensus that our entire vulnerability discovery, disclosure, and remediation model is broken.

Prior to this, the traditional bottleneck for many software providers was the struggle to find vulnerabilities before they could be weaponized. Now AI has completely shifted the bottleneck to not being able to fix them fast enough. This shift forces us to completely rethink exploitation timelines, disclosure windows, patch cycles, and remediation workflows in a way we have avoided for some time.

While a coordinated industry-wide response is being developed and refined, it will take time, and in the meantime organizations should start redesigning their patch management systems for a world where an AI can surface thousands of critical bugs in a matter of weeks.

But as much as vulnerability discovery on this scale might be unprecedented and requires a reaction, I believe many are conflating the genuine concern around the Vulnpocalypse with the idea that there will be a genuine across the board dramatic increase in risk exposure.

I’m not ruling out an increase in risk, but the Vulnpocalypse is exactly the kind scenario where decision makers should be putting aside reactions based on emotion and applying structured risk models.

Yes, the operational implications are real and some changes should be made immediately, but I don’t believe much of the anxiety and alarm we’re seeing survives serious data-driven analysis, the kind that boards and executives actually need to make strategic decisions.

Decomposing the hype

For the vast majority of organizations, the Vulnpocalypse is unlikely to be the existential threat many are framing it as. It may be more practical to look at it as a risk optimization problem.

Solving that problem requires us to look past scary headlines and break down how a sharp spike in vulnerabilities would actually impact risk exposure and influence financial loss. The major challenge here though is that risk is a widely misunderstood concept in the cybersecurity community and unless we address this misunderstanding, it impairs any useful analysis.

I prefer to think of risk as a function of two things: how often a loss event occurs and how much it costs when it does.

On the frequency side, the equation is driven by who is likely to act against you, how capable they are relative to your defenses, and how often they try.

On the magnitude side, the key factors are what assets you own and what is the cost when they are compromised. Here we are looking at variables like asset value, data volume, downtime duration, and regulatory exposure.

One of the most critical takeaways when decomposing risk like this is that vulnerability count appears nowhere as a primary variable and this is a fact that is omitted or underappreciated in much of the analysis on the Vulnpocalypse.

Many are making the assumption that more vulnerabilities automatically equals more risk. Some are assuming an almost linear relationship. Neither of these things is necessarily true.

Yes, vulnerabilities are inputs that must be considered, but their impact on actual exposure is highly dependent on who is trying to exploit them, whether they are even exploitable in your specific environment, and what is at stake if they succeed.

Treating a vulnerability count as a risk measurement, which is exactly what the panic over the Vulnpocalypse does, is like treating a hospital’s critical patient count as a mortality rate. We need to be careful that the numbers we use as proxies are not misinforming us.

It is exactly for this reason that I rely on the Factor Analysis of Information Risk (FAIR) model. FAIR not only provides a structured approach to risk analysis but it also forces a level of quantitative specificity that much of the narrative around the Vulnpocalypse avoids.

While this isn’t the only way to reason about the problem, decomposing the threat this way allows us to see precisely which risk variables are shifting, which ones are being overhyped, and where our defense lines are actually under pressure.

In the sections below, I walk through the Vulnpocalypse claim variable by variable.

Does the spike increase how often you get hit?

Any conversation about the frequency of a cyber risk event comes down to two main things: how often does a threat actor make contact with your environment (i.e. contact frequency), and once they do, how likely are they to act (i.e. probability of action)?

Contact frequency is driven by attacker motivation, targeting economics and the perceived opportunity from making contact. None of this depends on how many vulnerabilities have been catalogued.

If we assume threat actors to be rational economic actors, which they are despite the way they are widely portrayed, then they will continue targeting organizations the same way they always have. For most companies, being targeting is driven by market presence, sector reputation, and the path of least resistance.

The sudden existence of 6,200 newly documented open-source vulnerabilities does not suddenly make your organization more visible or more attractive. Vulnerability discovery does not automatically create increased demand for exploitation.

The second half of the frequency equation, probability of action, which is the likelihood that an attacker follows through once contact is made, does have the potential to shift marginally. Due to the sheer volume of new vulnerabilities, attackers may eventually develop exploits that they believe have a higher likelihood of success, leading to increased confidence and action.

Even so, attacker economics is certain to be the major determinant. Most adversaries do not optimize for novelty. Reliable and convenient exploits will continue to be prioritized for some time.

A proven exploit against an unpatched CVE from 2020 is objectively more attractive to most threat actors than a freshly documented vulnerability that requires validation, weaponization, and operational testing before it can be deployed reliably.

While new AI-generated findings will undoubtedly expand an attacker’s options, many will defer to their old favorites for the foreseeable future. This reality reinforces the case for basic cyber hygiene.

Interestingly, the most defensible projection resulting from the AI discovery spike isn’t a higher volume of attacks across the board. Instead, we are likely to see fewer but more targeted, higher-quality attacks from sophisticated threat actors who are already capable of operationalizing novel findings quickly.

What this means in statistical terms, is a shift in the shape of our loss distribution.

Rather than expecting a massive surge in daily threat events, organizations should consider the probability of a “fatter tail“, one where the baseline remains largely steady but is punctuated by rare, highly severe, and incredibly precise attacks.

The potential distinction here is significant as it steers us toward a very different governance response than the default panic of “more vulnerabilities means more threat events, so patch faster.” Instead of treating this like a never ending sprint to patch everything, it raises the importance of resilience against highly targeted strikes.

Does it make attackers more capable?

Vulnpocalypse conversations around attacker capability are where the most unexamined assumptions are made. The commonly made fatal flaw is treating all threat actors as a monolith.

Based on the FAIR model, Threat actor capability (TCAP) is a function of their knowledge, resources, skill, organization, and persistence. Attackers exist on a wide spectrum ranging from low-skilled actors who are easily resisted, to elite groups capable of penetrating the most heavily protected environments⁵.

When we decompose how the Vulnpocalypse shifts this spectrum, the reality looks vastly different depending on who we are looking at:

Threat Actor Tier	Existing Bottleneck	The AI/Mythos Impact
Top-Tier (State-Sponsored / Advanced APTs)	None They have always had the infrastructure to weaponize novel findings and quickly convert them into reliable exploits.	Operational Efficiency They won’t become dramatically more capable, but they will move faster, lower their operational costs, and scale their success rates.
Mid-Tier (Ransomware affiliates / Organized crime)	Operational Capability Exploit development, validation, evasion, and sustained campaign management have traditionally impacted scalability/expansion.	Negligible (For Now) Improved vulnerability intelligence does not fix a lack of operational infrastructure.

As the Cloud Security Alliance points out, “the history of automated vulnerability research is long, predating large language models by decades“. What this tells us is that the threat actors at the upper end of the spectrum, the apex predators, did not need Mythos to find and weaponize zero-days.

For mid-tier actors, things are different and finding a vulnerability has rarely been the primary constraint. The major barrier to entry here is the complex engineering required to safely weaponize bugs without crashing the target system or triggering endpoint detection before attacker objectives can be met.

Threat actors with improved vulnerability intelligence but limited operational capability will remain constrained by the capability deficit. A useful way to look at this – handing a competent home cook a list of exotic ingredients doesn’t make them a Michelin star chef.

There still is though, one specific scenario that justifies the Vulnpocalypse panic regarding capability but until recently it has largely gone unaddressed by most commentators.

If AI developments move past predominantly discovery and begin meaningfully lowering the skill level required for exploit development and automated weaponization, the equation changes. If an LLM can reliably write stable exploit code, bypass endpoint protections, and package all of this for a mid-tier actor, then we have a massive problem. Similar to the shift we saw with ransomware-as-a-service, this would democratize elite capabilities, allowing mid-tier actors to punch far above their weight class.

Fortunately, this is a distinct, measurable boundary and a scenario we can actively monitor for, threat-model, and test against, rather than just panicking over raw vulnerability counts.

Does it degrade your defenses?

Analyzing whether the Vulnpocalypse actually degrades an organization’s defenses can be incredibly useful but the true impact is much narrower than it might initially appear, and it largely depends on the type of software being targeted.

As alarming as a tenfold increase in application vulnerabilities sounds, it is unlikely to change the baseline security posture of most entities, in most scenarios, against most threat actors.

That is a heavily qualified statement, but the logic is sound.

Systemic defenses like network segmentation, conditional access, behavior-based detection, and egress filtering will not magically degrade just because a browser that previously had 27 documented vulnerabilities now has 271. While a massive spike in application flaws expands an attacker’s options for initial access, it does not meaningfully help them with lateral movement or exfiltration. In a well-designed Zero Trust environment, a compromised browser endpoint is still heavily restricted. An attacker would remain trapped by micro-segmentation, unable to pivot deeper into the network.

This same logic applies to specific threat models. If there is clear evidence that the actors most interested in a particular sector habitually favor extortion via ransomware, vulnerabilities that allow significant ERP process abuse (e.g., procure-to-pay) will not suddenly degrade the network-level controls meant to disrupt the ransomware related TTPs favored by the primary threat actor of concern.

As a result, the most relevant question is not how many vulnerabilities exist, but does the influx fundamentally alter the relationship between threat actor capability and resistance strength?

For the vast majority of software flaws, the answer is no. This makes more sense when we divide the vulnerability influx into two distinct categories:

Treating the entire influx of AI discovered bugs as if every single one has the dangerous, control degrading properties of a security tool bypass is a massive analytical error.

And as far as publicly available reporting suggests, the overwhelming majority of the thousands of new findings are predominantly application-level flaws and not critical security control weaknesses. From the defenders point of view, it also helps that successfully exploiting security tool vulnerabilities still skews heavily toward top-tier actors who possess the existing operational maturity to weaponize them.

Ultimately, when we accept that the strength of a system is based on its structural design and not the unrealistic expectation that every single piece of software must be flawless, we realize that cybersecurity is an engineering and architectural discipline and that a knee-jerk reaction to a spike in vulnerabilities is not a risk response.

Does it increase what you stand to lose?

The magnitude of a financial loss from a cyber incident is almost entirely independent of how the attacker got in.

Once a successful compromise occurs, the actual cost is driven by internal variables:

• asset value,
• the volume of compromised data,
• the duration of downtime,
• regulatory penalty thresholds, and
• notification costs.

These are functions of what you own and how you choose to run your business rather than the tool the attacker used.

A ransomware event that encrypts your core systems produces roughly the same loss magnitude whether initial access came from a four year old unpatched CVE, a stolen VPN credential, or a shiny new AI discovered zero-day.

It’s important too to keep in mind that there are loss drivers in the cyber domain that are both independent of the attack method and have been set long before Mythos came into play. A good example here are regulatory penalty structures, which are almost never adjusted based on attacker sophistication and also reputational damage which does not rely heavily on which particular CVE was exploited.

The clear exception here though are scenarios where vulnerabilities specifically enable extended dwell time.

If a novel vulnerability allows an attacker to remain undetected for months, that longer runway can result in a much broader collection of sensitive data or a deeper, more catastrophic system compromise.

In scenarios where an attacker prioritizes noisy rapid extraction, this is a non issue, but for scenarios such as long-term espionage or data-harvesting operations where the objective is to stay hidden, dwell time directly drives loss magnitude up.

But as we established in the previous section, the only vulnerabilities capable of granting this kind of extended invisibility belong to the security tooling and OS-monitoring layer and not the flood of standard application-layer findings currently dominating the headlines. For the vast majority of the Vulnpocalypse bugs, what you stand to lose remains exactly the same.

The governance question raised by the Vulnpocalypse

There are two responses to an AI discovery spike and it is clear that the cyber profession continues to conflate them. The operational response, which demands higher volume patch pipelines, improved disclosure timelines and triage tooling that weights exploitability over raw severity, is legitimate. These are genuine engineering problems worth solving, but the strategic governance response is almost entirely absent.

Once we accept that vulnerability count is not a significant risk variable and that frequency and magnitude are functions of who’s targeting you, how capable they are relative to your architecture, and what you stand to lose, the boardroom question changes. It stops being “how many vulnerabilities do we have and how fast are we patching them” and becomes “does this fundamentally alter the relationship between our defenses and the realistic capabilities of the actors who target us, and how would we know?”

That’s a fundamentally harder question, and it’s harder because vulnerability counts are visible and threat modeling isn’t. It’s much easier for a headline number to draw attention and fit a panic cycle. A more focused and localized assessment that maps threat actor capability to actual resistance strength does not get the same airtime.

What is particularly telling is that the vulnerabilities Mythos surfaced existed before it scanned for them. For many, the risk was already there, or it wasn’t. If an organization at this point still can’t determine which category they fit into with a high degree of confidence, that’s the governance problem the Vulnpocalypse actually exposed and patching faster won’t fix it.

References

1. What is Claude Mythos and what risks does it pose? – BBC ↩︎
2. The zero-days are numbered – Mozilla ↩︎
3. Project Glasswing: An initial update – Anthropic ↩︎
4. Project Glasswing: what Mythos showed us – Cloudflare ↩︎
5. The Open Group Standard, Risk Analysis (O-RA) Ver 2.1 ↩︎
6. US government directive to suspend access to Fable 5 and Mythos 5 ↩︎