It’s an important question across industries forced by Mythos. What actually happens when vulnerability discovery scales faster than our ability to deal with it?
CVE Discovery Constrained by Humans
To date CVE discovery has been constrained by human effort. Even the strongest of researchers hit a ceiling at a few dozen meaningful findings per year. Large programs might collectively produce a few hundred; and across the entire ecosystem, around 25–30k CVEs per year globally are found. That number has always felt big, but it has been limited by how much human attention exists.
What Mythos changes is not just speed, but surface area. That’s because it doesn’t think in single vulnerabilities, it thinks in paths.
Running the Numbers Quickly Gets Uncomfortable
If you take a step back and run even a simple model, the implications get uncomfortable quickly.
For example, a modest Glasswing-style setup might have 25 contributors, each historically capable of finding approximately 30 legitimate vulnerabilities per year. That’s 750 vulnerabilities annually in this human model. Adding in AI assistance, even conservatively assuming a 5x productivity gain, that brings things to 25 × 30 × 5 = 3,750 vulnerabilities discovered per year.
Being more aggressive on the assumptions – say 50 contributors, slightly higher baseline productivity, and a 10x AI multiplier – starts creeping up to a five-figure annual discovery rate. That’s not a rounding error against the global CVE pool. That’s a material shift in the total volume of known vulnerabilities.
The System Is Bottlenecked – But Not at Discovery
People assume that more discovery leads to more security, but in reality that’s not what happens. That’s because the system is not bottlenecked at discovery – it’s bottlenecked everywhere else.
A vulnerability must be validated, reported, triaged, accepted, patched, released, and then deployed into real environments before it’s considered a CVE. Even in best-case scenarios, upstream projects take days just to publish fixes, then organizations take weeks or months to roll them out. The Log4j curve showed us that even after ten days less than half the internet was patched.
Fixes lag even if discovery scales from 750 to 3,750 annually. For example, perhaps 60% of discovered issues are CVE-worthy and maybe 70% of those eventually get fixed upstream in a reasonable timeframe. That moves the earlier example of 3,750 discoveries down to approximately 2,200 CVEs and there are 1,500 actual fixes.
That gap, the difference between what is known and what is remediated, is the real risk. And Mythos is widening that gap.
Chained Vulnerability Discovery Creates A Different Category of Threat
The other shift that is important is chained vulnerability discovery. Humans are good at finding individual bugs, but much worse at identifying how those bugs become multi-step exploit paths. A typical human-discovered chain might involve two or three vulnerabilities, and even those are relatively rare.
Mythos operates differently. It doesn’t stop at “this is a buffer overflow.” It asks “what does this enable next?” and then keeps going. We’re witnessing exploit paths with 10 or more steps. That’s not just an incremental delta; it’s a different category of capability.
When you consider the combinatorics, the number of possible chains grows exponentially with the number of individual vulnerabilities. When discovery scales, chain discovery doesn’t scale linearly – it explodes. A few thousand vulnerabilities can represent millions of viable paths through a system, most of which will never be addressed by humans.
A few thousand vulnerabilities doesn’t represent a few thousand risks – it represents potentially millions of viable paths through a system. That has two immediate consequences:
On the one hand, severity distribution becomes more dynamic. CVEs today are labeled critical, high, medium, and low, and those labels are considered as relatively stable. Most vulnerabilities fall into medium and low categories, with a small percentage classified as critical. But chaining changes that. A “medium” vulnerability in an exploit chain can ultimately become critical in context. Mythos doesn’t care about the common vulnerability scoring system (CVSS), it cares about outcomes.
On the other hand, exploitation has become more automated. The same system that discovers chains can operationalize them. Discovery, chaining, and exploitation can compress into a single continuous process.
The result is a world where discovery is accelerating, chaining is amplifying impact, and exploitation is now more automated, all while fixes still move at human speed.
How to Succeed in This Environment
If your model is still “find and patch,” the math doesn’t work. You cannot triage, prioritize, and remediate your way out of a system where vulnerability discovery is scaling super linearly and exploit development is being automated. The only feasible path is to reduce the problem space itself – and there are a variety of approaches available today.
If you can eliminate up to 99.9% of vulnerabilities with curated and hardened images, you not only reduce your attack surface, you eliminate the number of possible exploit paths. Starting from curated images that remove the vast majority of known vulnerabilities enables you to inherit fixes for a huge portion of the CVE landscape without having to address them individually.
And if that system continuously tracks new CVE disclosures and pulls in fixes as they become available, you no longer need to try to manually keep pace with discovery. Such an approach absorbs that change automatically, while your exposure remains constrained by design.
That doesn’t make the problem disappear. New vulnerabilities will still be discovered and chains will still exist. But defending a system with 100 potential entry points versus 1,000 is not incremental – it’s existential when you consider how these chains form.
The Internet Is About to Get More Secure and Less Secure at the Same Time
Mythos is going to make the Internet both more secure and less secure at the same time. It will be more secure because we will know about far more vulnerabilities, far earlier. But things are less secure because knowing is not the same as fixing, and attackers have access to the same capabilities.
We are about to learn whether our current security models were ever designed for a world like this. If the gap between discovery and remediation is where risk lives, the only defensible solution is one that starts from a smaller, cleaner surface.
Join our LinkedIn group Information Security Community!
