When Mythos launched a few months ago, security leaders at critical infrastructure organizations needed a practical answer to a pressing question: what does this mean for the systems we protect? For Ryan Hebert, Head of Information Security Assurance at Intercontinental Exchange (ICE), the answer came from 30 days of hands-on testing. He shared what he learned on the AI Native Cybersecurity Podcast, hosted by Shahar Peled, co-founder and CEO of Terra Security.
His conclusion is measured and confident. Frontier models are powerful discovery tools, and an organization with strong fundamentals is well positioned to put them to work. That view carries weight from the leader responsible for assurance at the parent company of the New York Stock Exchange, where operational stability is paramount. “It’s pretty important to me as the cybersecurity representative that the reason the stock market is down is not us,” Hebert said, explaining why every finding is weighed carefully before action is taken.
Thirty Days With Project Glasswing
Because ICE operates critical infrastructure, it gained access to Project Glasswing. The team had 30 days and used them to test all of its most critical applications. The findings were plentiful, and none of them called for alarm. “Nothing gave me pause for concern that we couldn’t handle,” Hebert said. There was no need to escalate to the executive floor, double the staff, or pay for a million more tokens. Instead, the findings became material for threat modeling, which the team is still working through. “I think the doom and gloom is a little overstated at this point,” he said.
Findings Need Context
Hebert agrees that the offensive capabilities of these models are real, and that they find a great deal. The value comes from what happens next. He recommends running the models again against the source code to help with threat modeling and flow context, mapping how each finding connects to the network, and building a mermaid chart to see which issues can actually chain into a critical risk. He also suggested targeted microagents, noting that sometimes the right instruction is to have an agent perform only five steps in a chain and report back. Over time, he expects the models to get better at assembling the full chain on their own.
Where Automated Remediation Stands
ICE is working toward automatic pull requests that fix issues without breaking applications, and Hebert believes the industry will get there with time and effort. For now, he sees a developer and an AppSec practitioner as essential validators, since every large enterprise carries complexity a model cannot fully see. “Everyone has tech debt,” he noted, along with acquired systems and varied infrastructure across the business. That reality is why context, not raw output, determines whether a suggested fix is safe to deploy in production.
In some cases, Hebert said, the best path may be using AI processing power to rewrite an application from the ground up on a configuration and infrastructure base the team already knows and trusts, rather than issuing a long list of tickets. ICE is building some of these capabilities internally and is open to working with partners such as Terra as the technology matures. Peled agreed that the challenge combines technology and education, and described it as difficult but doable with the right context and collaboration.
Core Controls Win the Day
Hebert’s central message was direct: “core cybersecurity controls will still win the day if you are very strong in those avenues.” In practice, that means a red-team-first strategy, whether person-led or agentic, paired with a bug bounty program. It means working with operations teams to ensure MFA and SSO are in place, using whitelisting and web application firewalls on web applications, and maintaining strong ingress and egress controls with monitoring and detection. It also means continuing to build detections in existing EDR and EPP tools. Peled was emphatic about the value of that guidance. “The last 90 seconds of this podcast are liquid gold,” he said.
Building on a Solid Base
For Hebert, frontier models add to an existing defense rather than replace it. Organizations can use AI agents to surface a large list of raw findings, place those findings in the context of how they could actually be exploited, and use that knowledge to strengthen the controls already in place. Approached that way, the arrival of more capable models becomes an opportunity to reinforce fundamentals. As Hebert summarized his position on the current landscape, “it means that we’re in a safe state right now, in my opinion.”