Navigating the post-Mythos era: Why Zero Trust is no longer optional

By Volker Rath, Field CISO APAC, Cloudflare

The cybersecurity landscape has reached a critical inflection point. Frontier models, such as Anthropic Mythos, are currently dominating security conversations, signalling a profound shift in adversarial capabilities. As artificial intelligence becomes deeply integrated into the hacker’s toolkit, organisations must reckon with a stark new reality: our traditional, perimeter-based protective controls are fundamentally weakened.

To survive this “post-Mythos” era, security teams cannot rely on iterative improvements. Instead, we must question the status quo, work backward from a baseline of weakened controls, and embrace a rigorous Zero Trust architecture.

The new reality: Automated and weaponised AI

The integration of advanced AI models into cybercrime has dramatically increased adversarial firepower. Security teams are no longer just fighting human adversaries; they are fighting fully automated, highly sophisticated systems.

This evolution has transformed the threat landscape in several distinct ways:

• Expanded cyber arsenals: Adversaries now possess an increased arsenal of cyber weapons, including a higher volume of zero-day vulnerabilities and ready-to-use exploit code.
• Hyper-automated phishing: Attackers can now deploy fully automated phishing capabilities—spanning vishing, smishing, quishing and other variants—across all communication channels simultaneously.
• End-to-end automation: The entire cyber kill chain can now be fully automated. While AI hasn’t changed the fundamental steps of the kill chain, it has made the execution exponentially more effective and rapid.
• The analyst burnout crisis: This wave of sophisticated, automated attacks threatens to overwhelm traditional security operations. As a result, security analyst burnout has become an escalating risk for organisations globally.

Given this unbroken trend of a fast-evolving threat landscape, there is an absolute sense of urgency for organisations to adapt.

Shifting the paradigm: The physical world analogy

Because of AI, we must assume that our protective controls across network, identity, and application security are inherently less effective than they used to be. To understand how to respond, we can look to the physical world.

If you could no longer fully trust your external doors and window locks, you wouldn’t simply buy a slightly better lock. You would start locking doors inside the house, implement internal cameras and establish rapid-response patrols that kick out the bad guys in no time.

The exact same approach applies to IT infrastructure. In the digital realm, this strategy is codified as Zero Trust (as defined in NIST SP 800-207). To build true cyber resilience, organisations must operate under a permanent, assumed state of compromise.

Implementing an effective Zero Trust framework requires a hyper-focus on four core pillars:

• Minimising the blast radius at the network and identity levels.
• Implementing trust-based authentication mechanisms and continuous verification.
• Continuous monitoring and anomaly detection.
• Automated incident response capabilities.

Pillar 1: Minimising the blast radius

Since the dawn of AI, the average breakout time – the window between an attacker’s initial entry and when they begin to move laterally or elevate credentials – has plummeted from days to just 60 minutes. In fact, security companies increasingly observe breakout times as short as 60 seconds.

To restrict an attacker’s movement within these compressed timelines, organisations must shrink the blast radius across two distinct planes:

Network-level controls: Network segmentation and Zero-Trust Network Access (ZTNA) controls are vital to stopping lateral movement. The distinct advantage of ZTNA is that it utilises an access proxy to hide the underlying network from the user. If an attacker cannot see the network, they cannot use vulnerability scanners against those hidden systems, effectively neutralising a massive portion of their attack surface.

Identity-level controls: Static, long-lasting credentials are an open invitation for both human attackers and automated bots, providing prolonged access that is incredibly difficult to detect. To secure identity, organisations must enforce Zero Trust access controls using non-phishable multi-factor authentication (MFA), creating a robust barrier against privilege escalation. Furthermore, all access must strictly adhere to the principle of least privilege, backed by regular access policy reviews – particularly for systems housing sensitive data.

Pillar 2: Trust-based authentication and continuous verification

True Zero Trust does away with static, persistent access permissions. Instead, it requires the continuous verification of multiple contextual trust factors. When an identity requests access, the system must evaluate a combination of credentials, MFA status, device type, device health, geographic location, and other behavioural attributes.

Once evaluated, access should only ever be granted via short-lived access tokens. Every single session must require a new trust verification, ensuring that the identity’s activities are actively and continuously monitored throughout the duration of their access.

Pillar 3: Continuous monitoring and exploiting the AI’s Achilles’ heel

Most organisations have already deployed some level of security monitoring, often relying on Security Information and Event Management (SIEM) systems to detect known threats across broad data sources. However, generic threat detection is no longer sufficient against sophisticated actors and AI-powered bots.

To catch these advanced threats, organisations must exploit a unique Achilles’ heel: sophisticated threat actors are often too thorough. Because AI-driven tools operate with such rigorous efficiency, their overly thorough approach is highly likely to trigger specialised deception solutions, such as honeypots and canaries. Additionally, when threat actors use compromised credentials for the first time, they rarely know the exact layout of the target environment; they are forced to “look around”.

By closely monitoring and flagging benign but highly suspicious discovery events in production accounts, security teams can catch sophisticated attackers early in the execution phase.

Pillar 4: Fighting fire with fire through automated responses

With attackers utilising highly automated capabilities, security teams are bound to face cognitive overload. Modern adversaries do not just employ sophisticated tactics; they also intentionally deploy “smoke bombs” – spurious alerts and distractions designed to keep security teams busy looking at the wrong systems.

To keep security teams afloat, automated triage and incident response playbooks are a strict necessity. Fortunately, while AI poses a massive new threat, it also provides the exact solution required to tip the scales back in favour of defence.

Conclusion: Raising the security bar

The post-Mythos era demands a rapid departure from legacy security strategies. Fortunately, many of the core mechanisms required by Zero Trust can be considered low-hanging fruit – offering rapid risk reduction at a relatively low cost. By strictly limiting the blast radius, continuously verifying trust, monitoring for subtle anomalies, and automating response workflows, organisations can significantly raise the security bar. Implementing Zero Trust is the definitive pathway to achieving acceptable, long-term cyber resiliency in an AI-driven world.

Security leaders must “change gears” and actively use AI to automate incident response processes, vulnerability management, threat hunting, and threat modelling. This immense potential to revolutionise cyber defences can be unlocked through agile methodologies, active experimentation, and vibe coding.