What every CEO asks their CISO before vacation. Because while you’re gone, Mythos lands.
Anthropic’s Claude Mythos preview is rolling out this summer. By August it will be in attacker hands. The CSA / SANS Mythos-Ready Security Program, signed by 40+ named CISOs including Jen Easterly, Bruce Schneier, Heather Adkins, Rob Joyce, calls it the most significant offensive AI capability shift the industry has seen. Your security team gets it back to back with vacation season.
Before you sign off on vacation, ask your CISO these five questions. Make them answer with evidence, not assumption.
The rest of this briefing tells you what good answers look like, what stopping the spread actually means as a managed strategy, and how one week on-site (SHERPA) tells you concretely where you stand, without committing you to anything beyond the conversation.
You can’t stop the breach.
You can stop the spread.
The five questions on page 1 are the conversation. Pages 3 through 7 are what good answers look like. You’ve already paid for the tools. You’ve already hired the talent. You’ve already passed last year’s audit. None of that stops what’s coming. AI-driven adversaries have compressed time-to-exploit from weeks to hours – as the CSA / SANS Mythos-Ready Security Program (April 2026) documents in detail. NIS2 is in active enforcement; regulators, investors, and boards increasingly expect organizations to demonstrate effective cybersecurity governance; both create meaningful accountability for the executive team. The next breach is no longer a question of if. The only question you actually control is how far it spreads. This briefing describes what stopping the spread looks like as a strategy, how it’s operationalized as a managed service on the controls you already own, and how the first stretch of runway is one week on-site.
What stopping the spread actually looks like
Stopping the spread isn’t a product. It’s a strategy with three layers, embedded as a culture, operationalized through the controls you already own. The layers go in this order; each one is the foundation for the next.
11 Mythos-Ready actions. 8 delivered today. 3 honest answers.
In April 2026, 40+ named CISOs, including Easterly, Schneier, Adkins, Joyce, Reavis, Venables, published 11 priority actions for surviving AI-accelerated vulnerability discovery. The table below maps each one to how it’s delivered as part of MDR Preventâ„¢ today. Eight directly. Two with your engineering team. One through our partner ecosystem. Every claim is defensible, every cell is honest about who owns what.
| # | Priority Action | Sev. | ON2IT Delivery | How |
|---|---|---|---|---|
| PA1 | Point Agents at code & pipelines | CRIT | Partial | LLM-driven code review via AUXO + partner ecosystem; full VulnOps is the roadmap (see PA11). |
| PA2 | Require AI agent adoption | CRIT | Advise | SHERPA Week sets the customer’s adoption policy and security guardrails for coding agents. |
| PA3 | Defend your agents | CRIT | Delivers | Agents become a Protect Surface in ZT Step 1; Kipling policy in ZT Step 4 bounds tools, blast-radius, and escalation. |
| PA4 | Innovation & acceleration governance | CRIT | Delivers | SHERPA Week convenes security, legal, and engineering on-site with an ON2IT CISO + Enterprise Consultant. |
| PA5 | Prepare for continuous patching | CRIT | Delivers | 24×7 GSOC triages disclosure waves; AUXO orchestrates change without breaking ZT policy. |
| PA6 | Update risk models & reporting | CRIT | Delivers | SHERPA Week reframes board metrics around containment + recovery; GSOC produces the evidence stream. |
| PA7 | Inventory & reduce attack surface | HIGH | Delivers | ZT Step 1 (DAAS / Protect Surface) and Step 2 (Transaction Flows): the methodology was built for this. |
| PA8 | Harden your environment | HIGH | Delivers | MDR Prevent™ Configuration pillar + ZT Steps 3–4: segmentation, egress filtering, phishing-resistant MFA, Kipling policy. |
| PA9 | Build a deception capability | HIGH | Partial | Behavioral monitoring + IOC enrichment in GSOC; native canary / honey-token tooling not yet productized. |
| PA10 | Build an automated response capability | HIGH | Delivers | MDR Preventâ„¢ Expert IR pillar + AUXO SOAR + pre-authorized GSOC playbooks. Customer reference: <2 hrs MTTC. |
| PA11 | Stand up VulnOps | CRIT | Partner | Continuous AI-driven vulnerability discovery delivered through the ON2IT partner ecosystem; integrated into the customer’s MDR Preventâ„¢ posture. |
MDR Preventâ„¢ – three pillars do the heavy lift
The Mythos-Ready briefing repeats one message: harden, contain, respond at machine speed. That is exactly how MDR Preventâ„¢ is built. The three pillars below sit inside AUXOâ„¢’s six management layers (Strategy, Policy, Architecture, Engineering, Operations, Assurance) so the same Zero Trust language is spoken in the boardroom, the change ticket, and the GSOC.
Configuration
Hardening the platform: segmentation, egress filtering, phishing-resistant MFA, secrets rotation, dependency lockdown, software minimization.
Zero Trust Policy
The Kipling Method applied to every Protect Surface, including AI agents as a new asset class. Bounds blast-radius before exploitation, not after.
Expert Incident Response
24×7 GSOC, Netherlands-sovereign, AUXO-orchestrated. Pre-authorized containment playbooks execute at machine speed; humans handle the calls humans must own.
Zero Trust 5 steps: the operating sequence
Kindervag’s five-step methodology is not a marketing framing. Each step satisfies specific priority actions; the sequence is what makes the program executable rather than aspirational.
- Step 1: Define the Protect Surface (DAAS)Identify the data, assets, applications, and services that matter most, including coding agents and other AI systems as a new asset class.satisfies PA7 · feeds PA3
- Step 2: Map transaction flowsTrace how the Protect Surface actually talks to the rest of the environment. Without this, segmentation is a guess.supports PA7 · enables PA8
- Step 3: Architect the Zero Trust environmentPlace enforcement points where flows demand them. This is where deep segmentation and egress filtering land, both named explicitly in the Mythos-Ready briefing.satisfies PA8
- Step 4: Create Zero Trust policy (Kipling Method)Who, what, when, where, why, how: for every flow, including agent-to-tool and agent-to-data calls. This is how PA3 (“Defend Your Agents”) is operationalized.satisfies PA3 · PA8
- Step 5: Monitor and maintain (GSOC)24×7 detection, response, patch orchestration. Pre-authorized containment turns “human-speed defense vs machine-speed offense” from a slogan into a service-level commitment.satisfies PA5 · PA10 · partial PA9
Four numbers. Not one of them is cost-of-breach.
Cost-of-breach figures describe the bill. The bill arrives after the news cycle does. What matters before that is what you actually control: whether the fire starts, how far it spreads, what you can prove while it’s happening, and how fast it stops.
You can’t stop the fire from starting. You can stop it from spreading. The four numbers below describe exactly that.
See AUXOâ„¢ live. Thirty minutes.
Your board is asking. Your auditor is asking. The SEC’s cyber disclosure rules are asking. NIS2 competent authorities are asking. They all want the same answer: are you in control of your security posture right now?
Most organizations answer with a policy document, a slide, or last quarter’s audit. Documents describe intent. They don’t describe state. AUXOâ„¢ does. Every protect surface visible in real time, with traffic flows, policy drift, MTTD and MTTR. Thirty minutes. We’ll walk one of your protect surfaces with you. You’ll see what live posture looks like.
“The next breach isn’t a question of if. It’s a question of how far it spreads, and whether the answer fits in a paragraph or in an 8-K.” — ON2IT, June 2026
One week. On-site. You’ll know exactly where you stand, and you’ll already be moving.
SHERPA Onboarding Week is how we start. An ON2IT CISO and Enterprise Consultant come to you for five working days. We walk your stack, map your protect surfaces, find your exposures, and stand up a live AUXOâ„¢ view of your environment before the week is out. You don’t leave with a report. You leave with a strategy, an exposure list, and momentum: exactly what your CEO needs to sign Question 5 with a Yes.
The summer window matters. Mythos preview is rolling out this season. NIS2 first audit deadline is 30 June. Senior consulting capacity is limited each quarter. Earlier requests get earlier slots.
