Since Mythos arrived a few months ago, security leaders have been fielding a version of the same question from their boards: are we protected in a world where adversaries use models like this? Shahar Peled, co-founder and CEO of Terra Security, put that question directly to CJ Moses, CISO of Amazon, on the debut episode of the AI Native Cybersecurity Podcast.
Moses answered as a strategist. “I’d say that the impact is real. And it’s not going away,” he said. The organizations that thrive will be the ones that change their operating model and the way they measure success, not the ones that simply work harder at old routines.
Not a One-Time Event
Moses said a misunderstanding persists in some security circles and especially in boardrooms: the belief that Mythos represents a single spike, and that once the backlog of newly discovered vulnerabilities is cleared, operations can return to normal. CVE volume rose roughly tenfold in the quarter after release, and that is not a wave that recedes.
His framing is direct: “the latest AI is the best and greatest that you’ll ever have, but it’s also the worst because the next one’s gonna be better.” Another step change is always coming. Responding to this moment by surging headcount or doing more of the same patching work leaves an organization permanently behind. “So this is the new way of doing business,” Moses said.
A Different Operating Model
In practice, that means AI-driven patching, faster CI/CD pipelines with security scanning built into each iteration, continuous penetration testing to verify that fixes actually hold, and intelligence to determine what needs attention right now. At Amazon, telemetry from MadPot, the company’s honeypot infrastructure, helps set those priorities.
The stakes are concrete. In one case observed through MadPot, an attacker went from initial intrusion to full lateral movement across every accessible system in 12 minutes and 42 seconds.
Two Kinds of Decisions
Moses applied a long-standing Amazon decision framework to the question of where AI should act on its own. Two-way door decisions can be reversed quickly with limited blast radius, so they can move fast. One-way door decisions carry large impact and cannot be undone, so they warrant a different level of scrutiny.
Letting AI handle the two-way doors frees human experts to focus on the one-way doors, keeping a person in the loop exactly where judgment counts most.
Respond, Do Not React
Moses drew a sharp line between reacting and responding. “Reacting is essentially hair on fire,” he said, and that kind of scramble can paralyze a business. The better path is measured: “you need to be enablers, you need to respond, and the response that’s prudent is the one that’s best for the business, and that is mitigating the threat while enabling the business to move forward.” He pointed to Amazon’s faster, AI-enabled CI/CD pipeline as an example of protection and progress advancing together.
Rewriting the Scorecard
For decades, security programs have reported success by counting vulnerabilities and CVEs. Moses called that metric exactly wrong. His forecast for the next 12 months: “The measure of a good security program won’t be how many vulnerabilities you found.”
The figure that will matter is exposure time, which Moses calls mean time to defense: the interval between a vulnerability being found and being patched or otherwise mitigated. “Sometimes patching isn’t the only way,” he noted, pointing to blocking and isolation as other ways to close the window. Amazon is already acting on that view. “There’s a small group of us at Amazon that have decided this is what the future brings,” Moses said.
The Leader Behind the View
Moses brings unusual depth to these questions. He joined Amazon in December 2007, served as Consumer CISO and AWS CISO, and became CISO of Amazon in September 2023, where he oversees integrated security across more than 148 business units. Earlier, he led technical analysis of intrusion efforts at the FBI’s Cyber Division and served as a Special Agent with the Air Force Office of Special Investigations.
For executives preparing their next board presentation, the episode offers a clear reframe. The most valuable answer to the Mythos question is not a count of what has been found. It is evidence of how quickly the organization closes the gap.