1,000 Fixes a Month, and It Won’t Save You, The Only Winning Move Is Not to Be Reachable

Microsoft has released the largest Patch Tuesday in its history: fixes for 570 vulnerabilities, including three zero-days—two already exploited in attacks—and 141 remote code execution flaws.  

Microsoft may be the most dramatic example, but it is not the only one. Since Anthropic introduced Mythos Preview on April 7, 2026, Microsoft’s monthly Patch Tuesday count rose from 120 vulnerabilities in May to 200 in June and a record 570 in July—a 375% increase in two months. Google’s major Chrome releases followed a similar pattern: 126 security fixes on May 5 jumped to 429 on June 2, an increase of approximately 240%, followed by another 433 fixes on June 30. Adobe’s monthly vulnerability count more than doubled as well, rising from 52 vulnerabilities in May to 123 in June—a 137% increase. These figures do not establish that Mythos found these vulnerabilities (although I believe these are of direct result of Mythos and similar models), but they illustrate how many vulnerabilities exist (a lot more for sure) and that we will forever be in a chase a step behind them to really solve for the issue they create an organization must think in a containment mindset. 

Five hundred and seventy vulnerabilities in a single month should also force us to ask a harder question: What happens when finding vulnerabilities scales faster than our ability to fix them? 

Anthropic says its Mythos Preview model has already found thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser. As these capabilities improve and proliferate, both defenders and attackers will gain the ability to discover vulnerabilities at a speed and scale that human security teams cannot match. 

Microsoft’s record Patch Tuesday may be an early indication of that future: AI discovers more flaws, vendors disclose more flaws, and security teams receive an ever-growing list of systems that must be tested and patched immediately. 

The traditional security model tells CISOs to run faster. The better answer is to change the race. 

The Vulnerability Is Only the Entry Point 

A vulnerability does not usually create a companywide outage by itself. It gives an attacker an initial foothold. 

The attacker still needs to move from that compromised browser, laptop, server, identity, or application to the systems that matter: domain controllers, databases, production environments, backup infrastructure, cloud control planes, and operational technology. 

That is where lateral movement turns an isolated security incident into a business crisis. 

Zero Networks’ 2026 Lateral Movement Exposure Report analyzed 54 trillion activities across 312 live enterprise environments. The findings reveal how much freedom attackers typically inherit after that first compromise: 

• 80% of enterprise servers are reachable from anywhere inside the network
• 87% accept inbound RDP or SSH connections from broad internal sources 
• 78.7% are reachable over SMB or WinRM
• 43.2% of internal authentication still relies on NTLM
• A single compromised host can reach 85% of internal systems on the first hop

That last number should concern every CISO. It means an attacker may not need a sophisticated multistage campaign to cross the environment. In many enterprises, the first compromised machine already has a pathway to nearly everything else. 

This is the real danger behind the growing number of vulnerabilities. AI is creating more ways in, while enterprise networks still provide too many ways across. 

Detection and Response Cannot Carry the Security Model 

For years, organizations have built security architectures around a familiar sequence: 

• An attacker exploits a vulnerability. 
• Security tools identify suspicious activity. 
• The SOC investigates the alerts. 
• Responders determine what happened. 
• The organization contains the attacker before material damage occurs. 

Detection and response remain necessary. CISOs still need EDR, SIEM, threat intelligence, incident response, and strong vulnerability management. 

But these capabilities are becoming less useful as the primary control because the model depends on defenders having enough time. AI is compressing that time. 

Attackers can use automation to identify exposed systems, test credentials, enumerate network pathways, and move through trusted administrative protocols. RDP, SMB, SSH, WinRM, and RPC are not inherently malicious. They are the same tools administrators and applications use every day, which makes malicious use harder to distinguish quickly from legitimate activity. 

Our research found that more than 70% of enterprise threat activity travels over SMB, RDP, WinRM, and RPC.  

That creates a fundamental disadvantage for a detection-first strategy: the SOC must identify malicious intent inside traffic the business already trusts, investigate it, and respond before the attacker reaches a critical system. 

At machine speed, that is a dangerous bet. 

The new model should not assume the organization will detect every important action in time. It should assume: 

• Some vulnerabilities will remain unpatched. 
• Some zero-days will be exploited before disclosure. 
• Some identities and credentials will be compromised. 
• Some malicious activity will look legitimate. 
• Some alerts will arrive after the attacker has begun moving. 
• Human responders will not always act before automated attackers. 

The architecture must contain the attack even when those assumptions prove true. 

Build an Architecture That Does Not Care About the Next 100 Vulnerabilities 

No organization can become literally immune to software vulnerabilities. But it can become resistant to their blast radius. Imagine that an attacker exploits an unknown Chrome or Windows vulnerability on an employee laptop tomorrow. 

The first question should not be: Will our SOC detect it? 

The first question should be: What can that laptop reach? 

Can it initiate RDP or SSH connections to servers? Can it access file shares over SMB? Can an attacker use stolen credentials over WinRM or RPC? Can it reach a domain controller, backup system, production database, or critical cloud workload? 

In too many environments, the answer is yes. 

A containment-first architecture changes that answer. It continuously identifies legitimate communication, removes unnecessary pathways, closes privileged ports by default, and requires identity verification when users or agents request high-risk access. 

The 5-Step Practical CISO Checklist 

1. Measure the actual blast radius 

Start with evidence, not architecture diagrams. 

Select a representative employee device, server, privileged identity, cloud workload, and operational asset. Determine which systems each one can actually reach and over which ports and protocols. 

Ask: 

• Can a typical endpoint reach critical servers? 
• Which administrative protocols remain broadly open? 
• Can one compromised credential unlock multiple environments? 
• Is there a direct pathway from user devices to critical assets? 
• How many systems are reachable on the first hop? 

A vulnerability score tells you how serious a flaw might be. A blast-radius assessment tells you how serious it is in your business. 

2. Close unnecessary east-west pathways 

Most internal access exists because nobody has removed it—not because the business requires it. Microsegmentation drastically reduces pathways there by the blast radius and almost eliminates the chance of something unpatched to be exploited. 

Identify and eliminate connections created by flat network designs, legacy configurations, permissive firewall rules, and operational convenience. 

Allow the communications the business needs. Deny everything else. 

Do not wait for the next vulnerability announcement to decide that employee laptops should never have been able to reach production servers. 

3. Protect privileged protocols at the moment of access 

RDP, SMB, SSH, WinRM, and RPC create powerful administrative pathways. They also give attackers the ability to expand a small foothold rapidly. 

Keep privileged ports closed until legitimate access is requested. Require just-in-time identity verification for unexpected human or AI-agent access while allowing known machine-to-machine communications to continue. 

Identity based Microsegmentation help to only open certain ports as needed after strong validation such as MFA.

4. Make containment independent of detection 

Test whether controls stop lateral movement even when the organization has not yet identified the initial compromise. 

Assume: 

• The endpoint tool missed the exploit. 
• The credentials appear valid. 
• The attacker uses legitimate administrative tools. 
• The SOC has not opened an incident. 
• The vulnerability has no available signature. 

Then determine how far the attacker can travel. 

Detection should provide visibility and context. It should not be the only thing standing between one infected laptop and a companywide outage. 

5. Replace SOC-speed metrics with resilience metrics 

Mean time to detect and mean time to respond still matter, but they do not tell the board whether the business can withstand an AI-speed attack. 

Add metrics such as: 

• Percentage of critical assets protected from unnecessary access. 
• Percentage of privileged pathways closed by default. 
• Percentage of servers reachable from standard user devices. 
• Number of verified pathways to critical systems. 
• First-hop reachability from a compromised endpoint. 
• Time required to isolate a workload or environment. 
• Reduction in attack paths over time. 

The central board-level metric should be simple: 

How much of the business can one compromised asset disrupt? 

6. Prepare a credible answer for the board

Boards will increasingly ask: 

What happens when AI finds an exploitable vulnerability before we can patch it? 

“We expect to detect the attack” is no longer a sufficient answer. 

A stronger answer is: 

We know which systems a compromised asset could reach. We have removed unnecessary pathways, restricted privileged protocols, verified high-risk access, and limited the blast radius before the attack begins. 

That is a measurable statement of resilience. 

7. Prioritize vulnerabilities by reachable impact

CISOs should continue patching aggressively, but CVSS scores alone cannot determine business risk. 

Prioritize remediation using: 

• Active exploitation. 
• Internet exposure. 
• Asset criticality. 
• Privilege available on the affected system. 
• Systems reachable from that asset. 
• Existing containment controls. 
• Potential impact on uptime, revenue, safety, and operations. 

A critical vulnerability on a contained asset may create less business exposure than a lower-rated flaw on a workstation that can reach 85% of the environment. 

Start With the Mythos Readiness Pack 

We created the Mythos Readiness Pack to help CISOs translate this new model into practical action. 

The pack helps organizations determine whether their current architecture can contain attacks accelerated by systems such as Mythos. It includes: 

• A Breach Map Tool that exposes the pathways an attacker could use to move from an initial compromise to critical systems. 
• A board briefing deck that enables CISOs to benchmark and walk through their own resilience posture and AI exposure - ready to present as their own. 
• An AI threat brief that explains to a board the best AI strategy is one that doesn't chase AI threats - it contains them. 

This is not another vulnerability scan. 

It does not produce a longer list of defects for an already overloaded team to remediate. It answers the question traditional vulnerability management leaves unresolved: 

What can an attacker do after exploiting one of them? 

Stop Racing. Start Containing. 

Microsoft and Google deserve credit for finding and fixing vulnerabilities before more attackers can exploit them. Organizations should deploy those fixes as quickly and safely as possible. 

But patching 570 vulnerabilities every Patch Tuesday cannot become the blueprint for the future. 

Mythos and frontier models that follow it will find more flaws. Attackers will automate more of the attack chain. Security teams will receive more signals, more patches, more exposure data, and less time to make decisions. 

CISOs cannot hire enough people or buy enough detection tools to win that race indefinitely. 

The answer is an architecture that expects vulnerabilities, assumes compromise, and prevents the attacker from turning initial access into business disruption. The answer is called Microsegmentation. No matter what happens, the business is always up and running. 

Build one where the next 1,000 vulnerabilities cannot become the next crisis.