Schrödinger's Vulnerabilities: What Mythos Actually Broke in Cyber Insurance

There's a quote making the rounds in the post-Mythos cyber insurance discourse: "With AI, the gap between vulnerability, discovery or and exploitation has collapsed from months to minutes. What happens to historical frequency data as a predictor of forward-looking events? This becomes insufficient. It's not working." That quote is attributed to Tracey-Lee Kus, chief executive at Aon’s Global Broking Centre, when she spoke in April at a cyber risk conference.

The critique of historical frequency data is correct. The framing around it misses the actual mechanism.

The vulnerabilities Anthropic surfaced through Mythos didn't appear in April 2026. Some had been sitting in production code for decades. The bugs existed last year, the year before, and the year before that. What changed isn't the population of vulnerabilities. What changed is who can see them, how fast, and at what cost.

Underwriters tend to read this as a frequency problem. It looks more like an observability problem dressed up as one.

The Schrödinger framing

Here's where the right metaphor lands: a large class of latent vulnerabilities now sits in a kind of Schrödinger's cat state. They exist. We know they exist. We have strong indirect evidence — Anthropic's technical preview, the Project Glasswing coordinated disclosure pipeline, twelve of the largest infrastructure companies on the planet quietly patching things. For the rest of the market, the specific bugs remain confirmed-to-exist and unspecified-in-detail.

Call it what it is: information asymmetry. A privileged set of organizations holds the catalog. Everyone else holds the inference. Until the patches ship and the advisories drop, no defender outside the coalition can act on any specific bug, because no defender outside the Glasswing coalition knows what the specific bug is.

The defender's epistemic state is genuinely bifurcated. That's the actual disruption. AI didn't create new vulnerabilities. AI collapsed the discovery half of the vulnerability lifecycle from a slow, distributed, semi-public process into a fast, concentrated, partially-private one.

Cost moves, doesn't disappear

When detection stops being the bottleneck, the cost migrates rather than vanishes.

Remediation was always the expensive half of vulnerability management. Patch testing, regression risk, downtime windows, configuration drift, the long tail of unpatchable systems running someone's grandma's accounts payable software — that's where security budgets actually go. AI made none of that easier. It just moved more work into that bucket, faster than most organizations can absorb.

For insurers, this matters because severity is governed by remediation lag, not discovery speed. The question isn't "how fast did the attacker find the bug?" The question is how long the window was between disclosure and patch deployment in your insured's environment, and what was reachable from that window.

That's measurable. It's also exactly the data that annual questionnaires don't capture, because they were designed for a world where the attacker side moved at human speed.

Where I'd push back on myself

Two things I want to be honest about.

First, the one-time-glut theory. I think Mythos represents a step function, and that the catch-up period reaches a new equilibrium once defensive AI tooling and coordinated disclosure pipelines absorb the backlog. I think that. I can't prove it. If frontier capability keeps compounding faster than defensive deployment can keep up, the glut isn't a one-time event; it's the new baseline. The honest position is that this is a directional bet, not a settled point.

Second, the "we can't do anything about them en masse" line overstates the defender's predicament. What breaks is CVE-driven vulnerability management. Patch-the-known stops working against bugs you can't see. Defense-in-depth doesn't require knowing the specific vulnerability. Network segmentation, behavioral endpoint detection and response (EDR), identity hygiene and blast radius reduction — these work against unknown exploits. Traditional vulnerability management breaks down. Defense doesn't.

That distinction matters when underwriters start asking insureds what they're doing about Mythos-class risk, because the right answer isn't a list of CVEs patched. The right answer is a posture that holds up against an exploit you've never seen before.

What this means for the underwriting model

The frequency-data critique is right that historical loss data is a poor predictor of forward risk in this regime. The deeper issue is that the entire model of pricing cyber risk based on a once-a-year snapshot of self-attested controls was already breaking before Mythos. Mythos just made the failure mode obvious.

The replacement isn't more questionnaires. It's continuous, verifiable evidence of control efficacy, measured against the things that actually drive severity. Patch latency. Identity hygiene. Segmentation depth. Incident response time. The boring operational signals that determine whether a known vulnerability becomes an uneventful Tuesday or a board-level incident.

The vulnerabilities are in the box. The cat is in the box. We don't get to open the box on our schedule anymore. The underwriting model that survives this transition is the one that prices the box, not the cat.