Mythos and Daybreak: What Boards Are Asking and What to Actually Do About It

Summary

AI models like Mythos and Daybreak can find vulnerabilities faster than any team can patch them, and boards want to know what to do about it. In this webinar, Zero Networks Field CTOs Chris Boehm and Albert Estevez argue the only winning move is to make detection and patch speed irrelevant. That means containing first, closing privileged ports, governing AI agents like employees, and measuring mean time to containment instead of mean time to detect.

Key takeaways

• Boards are asking new questions. How do we stop attacks built on AI-found vulnerabilities? What would a breach cost, and can you prove our investment reduces it? What AI is running inside our organization, and who controls it?
• You can't out-patch infinite discovery. Patching everything immediately breaks business systems, especially OT and legacy. Racing the exploit window fails too: mean time to exploit is already under seven days and heading toward minutes. The only option left is containment by design.
• Close privileged ports and open them with MFA. By Albert's estimate, about 75% of internal attacks use four ports: RDP, SSH, WinRM, and RPC. Closing them in one click makes the vulnerabilities behind them unreachable.
• Govern AI agents like employees. Give agents their own identities, apply least privilege, and see shadow AI before it spreads. An agent that only needs to read a database shouldn't be able to wipe it.
• Measure mean time to containment. Zero Networks' breach map shows how far a user or machine could reach with and without microsegmentation, in one example a 90% reduction, so teams can prove the blast radius shrank.

Speakers: Chris Boehm, Field CTO, Zero Networks · Albert Estevez, Field CTO, Zero Networks 

Moderator: Hello, everyone, and welcome to today's webinar, Mythos and Daybreak: What Boards Are Asking and What to Actually Do About It. For some quick housekeeping, please note that all attendees are in listen-only mode. We encourage you to interact with us through the Q&A or the chat window on the right side of your screen. We hope to have enough time at the end of our thirty-minute session to answer any questions you may have. But if for some reason we don't, we, of course, will get back to you offline and after the event. And with that, we'll hand it over to our speakers and let them kick us off.

Who are the speakers?

Chris Boehm: Hey, everyone. Uh, thank you for joining us today. We're gonna be talking about Mythos and Daybreak, and what boards are actually looking at and asking about today. If it's, if you're like me, or Albert that's on here — which I'm about to introduce in just a second — you've been hearing this question and seeing this across the field, across every company, because AI is making a traction, whether it's good or bad, and that's exactly what we're hoping to talk about. So let us do a quick introduction. I'll let Albert do his introduction, then I'll introduce myself. Albert, I'd love to hear all helpful about you.

Albert Estevez: Thank you. Thank you, Chris. So I'm Albert Estevez. I'm the current field CTO at Zero Networks. One of the two. We are the other one. And I've been in the company for almost two years already. And before that, I spent, like, fourteen years at Palo Alto Networks as an advanced product manager, doing different projects, like, uh, post-quantum cryptography, Palo Alto solutions, or microsegmentation.

Chris Boehm: Yeah. Uh, thank you, Albert. Thank you. Um, so my name is Chris Boehm. I am one of two field CTOs at Zero Networks as well. I've been here for about a year and a few months. Uh, it — time flies when you're having so much fun. And then, uh, where I started, I started in state and local government. Um, most people see I did some enterprise time. I joined a small company called Microsoft. I was there for about eight years. Um, and then after Microsoft, I joined this, uh, just-went-IPO company called SentinelOne. I was their field CISO for about three years. And then I joined this amazing company called Zero Networks to solve the problem that everyone else is having issues with. So, uh, now you've learned our history, I'm gonna jump into the next steps of what we are doing and what this presentation is all about.

What are Mythos and Daybreak?

Chris Boehm: So what is Mythos and Daybreak? Well, if you haven't been paying attention to the news, and you haven't been enjoying all the articles and posting and social media, uh, slams of this product, uh, or these products out there today, uh, these are two frontier early models that are out there that is so cutting edge that they can't even sell it or offer it to companies. They're only — they're keeping it contained behind a wall. Now, why this is — one of the prime examples that Mythos, or Anthropic, brought up was they found 300-plus vulnerabilities on a single, uh, issue for Firefox, which is a well-known — it's been around since I can't, I can't even — twenty-plus years, maybe thirty? Shoot. I don't know. No. I need it.

Albert Estevez: Don't, don't count them. Don't count them.

Chris Boehm: Yeah. I was like, now, now I'm thinking about my own age. But anyways, uh, it's been around for quite some time, and they found hundreds of vulnerabilities very quickly. Uh, Daybreak is the other scenario that's open, uh, ran by OpenAI. But one of the key things that got the attention of both of these models was the fact that it was sponsored by some of the top companies in the world. And I mean, top 50 companies in the world were saying, hey, this is so cutting edge. Um, we're backing it, and we've embedded it. So it got a lot of attention very quickly and sprawled very quickly across the market of, okay, who are these models, and what are they doing? Because there's that — find thousands of vulnerabilities that take very little time to discover, but then they have to be released to the wild. So the concern is, okay, how do I stay atop this patch management in these OPRA operations across the market?

What are boards asking about Mythos?

Chris Boehm: So, like, one of the questions, uh, we're hearing is — uh, and maybe as the audience, please feel free to answer this — uh, what questions are you getting right now from the board and other team members? I'm gonna ask Albert this, because he's the, the guy that I'm talking to right now, uh, in this session. Albert, what are you hearing when it comes to this, uh, concern?

Albert Estevez: So one of the, the, the most, you know, clear question is, as a company, how do we stop, you know, this type of attacks inside our network? How Mythos will impact in our infrastructure? Is it — what it's not the most common asks that I get. And I visit customers. And probably you are, you are appealing the same way.

Chris Boehm: I'm hearing the same thing. Uh, one, first off, if you're not a company that's utilizing some kind of agentic AI and AI, you're kinda behind. That's the first mindset: I'm doing AI modernization. And then the next thing is, now that these newer research-level frontier models are coming out, when it comes to, uh, these, uh, just databases of finding all these cybersecurity vulnerabilities, how do I prevent my company to, to stay on top of that? Because what if an attacker got it? That's the, that's where my mindset goes. If I can get it — but what about an attacker? What if they gained access to this? And second is, how do I patch faster than I am today without bringing down my business? Which most companies, if I gave them, here's 10,000 patches you have to do in, uh, now, they're gonna, they're gonna freak out. That's a lot of patches in a very short period of time, and they don't have a quick answer to that. So, uh, that's exactly the kind of questions companies are coming to me. I'm asking, what is this thing called microsegmentation? Which, uh, just as a, uh, I guess, is a preemptive conversation. That's exactly what Zero Networks is offering you today. So, kind of questions I'm hearing: uh, what are his Mythos in Daybreak? I kinda answered that for you. Uh, there is a, uh, unbudgeted board mandate: go secure us against Mythos.

Albert Estevez: Yeah.

Chris Boehm: If AI can find vulnerabilities in our environment at warp speed, how do we protect ourselves? Same thing. Um, what would a breach cost us? And can you prove our investment is actually reducing that number? Because, again, you're hearing these conversations about investing into AI. Well, you keep investing more and more and more. Are we actually getting our money's worth of investing into that? Do we have a zero-tolerance policy for downtime and disruption? I would say most companies have a risk assessment saying, we accept some risk about downtime. We don't want it, but there is that risk of. That's why no one offers a 100% uptime, even cloud providers today. And what AI is running inside our organization, and how are we controlling it? It is interesting when you ask companies this, because there is a lot of aspects that they are unaware of. Uh, heck, there's even applications you've been using that are using AI that you may not even have known. Oh, which AI model is being utilized, what does it hit company policy, and so on and so forth.

Why can't patching keep up?

Chris Boehm: So, uh, the, this is kind of the problem: is that patch cycle. Uh, Microsoft patches thousands of CVEs a year. If, if you've ever seen, like, how many CVEs per my a product. I, I used to work at Microsoft. Heck, half of our executive team at Zero Networks used to work at Microsoft and Palo Alto and all these big companies. Patching is not new to most of us at this company, and I'm sure not to you who's listening on this conversation. Um, teams plan change windows. Usually, it's weeks in advance. Well, what if that change window says, hey, I have these eight patches that have to be, you know, the critical? They need to go in as fast as possible, and then here's the list of other ones. Now you heard there's 10,000 you have to do, uh, to — and, and because you just — we just found them through this model. So can you — are you planning to handling this? By the way, some companies I've heard, they're like, oh, we'll just double our patching team. Well, you were doing maybe 20 to 40. You think that's gonna solve it? We'll, we'll see. Regression testing. This is another one. I mean, usually, you go through, you validate, you look at all your OS models. You're doing the same thing that our software — like us as a company — are doing for you as a customer. We're validating everything we do across every operating system, and then we say, okay, it's good, here's a patch. So you're gonna do the same thing. Okay, here's a patch. Is it gonna break anything across our company and bring down our business? Which is the last one, is downtime risk. So this is kind of the problem that we're running into today when it comes to, uh, scope, and with each business that's trying to fit, uh, solve the Mythos problem, I should say.

How fast do attacks move now?

Chris Boehm: Uh, so what actually breaks? Uh, here's just a simple model of what's being utilized today. There is some information from CrowdStrike and other things. I've kinda noted them on the bottom: IBM cost analysis report. But with AI acceleration, this is exactly what we're seeing the shift go into. Uh, we're seeing the quickest lateral movement took twenty-seven seconds. That was based on CrowdStrike's initial analysis of last year — not this year, last year. That's a very quick lateral movement. For those who don't know what lateral movement is: I got onto, let's just say, my laptop. They saw there's another machine on my network. They moved over to that other machine. That's how fast it took, twenty-seven seconds. Then they got in comp—, they compromised the environment with less than an hour, which is very fast. That means now they push something malicious and gain a foothold into my environment. They exfiltrated data in slightly over an hour. And then, unfortunately, this is the scary numbers that people throw out: is there was over a $400,000,000,000 yearly downtime cost for Fortune 2,000 companies. Not, not, not over — first, Fortune 2,000 companies, global enterprises — which is, it just, this number keeps getting bigger and bigger. And then the last one is, how fast can you recover? And it usually is relatively slow in, in comparison to how fast the attack can occur.

Why does detection still fail?

Chris Boehm: So, detection and everything. This is, this slide, it, it might seem a little overwhelming because there's a bunch of nineties on there. But the main thing is, look at the average company. Usually, most company, companies say that they can detect most things. You have your EDR. You have your top security models out there. Today, we detect most things. No worries. We go to the next step. Most of it is, uh, false — we don't have very many false positives. We actually have fine-tuned it. We correlate it. We catch most things. Again, 90%. Our security team is staffed twenty-four seven. We're fully covered most of the time. Right? And there's, you know, normal people issues that happen. Then the analyst has all the perfect skills. Everyone has the perfect analyst. That's why we all — we have so many analysts. We have specialists in everything. On our teams, the analyst has plenty of time. Almost every time, I've never heard an analyst tell me, um, they, that they're, they're almost too bored now today. This is sarcasm at this moment in time. And then the last part is, the responses are getting faster and faster. So the problem is, is even though all these criterias are there, and we usually have the right teams, we still have the problem. We're not blocking, uh, we're not preventing, and we're allowing these attacks to go through, even though we have most of what's necessary. So from a best-case probability perspective, we still have an issue down the, the chain, which is the standard stack of most cybersecurity companies today. I'm gonna hand this over to Albert, um, and I'm gonna let him drive this section going forward, and then we'll kind of circle back to me at the end of this presentation.

What are your options when AI finds thousands of vulnerabilities?

Albert Estevez: Sure. So let's keep moving. So now we have three options, because we, we all agree that AI will accelerate, you know, that to show all the things that you were not fixing in your infrastructure for the last fifteen years. AI will show them and find them really quick. And it, that will lead you to two scenarios and one only option that we can, uh, take. Like, uh, in the oceana. Right? So if now, as Chris was mentioning, Mythos, they, they will find thousands and thousands of vulnerabilities. So you have the option that we're gonna, we're gonna patch. So I wanna fix this phone and get infrastructure. You, you have the option A. It will be, okay, let's patch immediately. And knowing now that all the risks that we, we, we will face, because, as we state, now we are not getting a patch that contains, like, hundreds of bugs. It contains thousands, or maybe hundreds of thousands, of bug fixes in the same patch. So it's almost impossible, you know, to do this really quickly. So it will take, uh, to do, uh, some, some time to, to really understand what will be the impact. Then you have OT or legacy systems, so you cannot always make any, any change there. Uh, so networks that they are working, uh, they are running your business, and stopping them into our cost, you know, uh, a business impact. So you need to fully program this in advance. So getting this avalanche of, you know, bug fixing, it's not going to, going to work.

So then, in the, or, option B, you have a gateway time period. So if we know, and we all agree, that AI will add a lot of velocity and, you know, and finding and generating the exploits related to those vulnerabilities — so we know that today, the mean time to exploit is less than seven days, but then in the, in the near future, it will be minutes after they discover. You know? So that means that the time that usually the companies take to identify these vulnerabilities, and see that there is exploit, and someone is trying to do something, engage you, it was hundred eighty days. These are what is telling you as well. So that between now and you back is discovered, the exploit is out there, and you try to find the time to patch, to stop, you know, and do what you need to do. There's no way that, you know, you, you will, you will win against the, the bad actors. So you will always be late.

So the only option that we see — that's why we are here — is we need to make the speed of the detection and remediation be totally irrelevant. How? So by changing how we, you know, how, how do, how we do things in, in the, in the, in the infrastructure. So we need to be sure that we built an infrastructure that prevents the lateral movement by, by design. So then, if everything is locked down, right, it doesn't matter how fast you will discover new vulnerabilities, or how fast you need to be patching them, because the thing is that your system will not allow any new connection that is not already, you know, uh, in the system allowed. So let's start thinking, and contain first, you know. Make your systems, uh, reliable by, by design.

Chris Boehm: 100%.

Why is containment the off switch?

Albert Estevez: So the same thing. So let's reiterate here. Right? So we cannot out-patch Mythos or Daybreak. One, because discovery is infinite now. So we can find thousands or even millions of new vulnerabilities every day. Okay? And the patching time that we have, it's finished. So it's impossible that we will catch up, you know, digest all those patches while the data — the new patch is not generating a business impact with your application. It's going to be really hard, even if we try to do prioritization. It is one of the, the aspects that, you know, the industry is trying to promote now. Okay? So from these thousands of patches, which, which ones they will apply only to you? Let's try to only apply them. But even doing that, it will always be late, you know, because now the time that, uh, the AI needs to generate exploit, it will always be faster than the time that you need to prioritize to the, the, the, the window time to apply the patch. So there is no way that we are gonna win if we keep playing the, the cat and mouse, you know, uh, catch-up. Yeah. So containment is the, is the lever. So it's the only piece that we can use to really prevent these, you know, attacks to happen, is because making those attacks irrelevant in your network. So if, uh, if we are able to really generate security policies, they will lock down who can talk with you at the identity level. Okay? So we need to have a solution which is identity-anchored. Uh, for us, Asia, identity-based microsegmentation is the only way that we can achieve this and make this, you know, new AI capabilities totally, uh, irrelevant in your infrastructure. So stop running.

Chris Boehm: I mean, if, if you think about it from the perspective of a, a security practitioner, you can, you completely understand that. Because if you look at it from a — let's just say a standard SQL database, that's usually the, the test one I can think of. And it has the keys. So it's usually something, everything for that application or your inference, like, whatever it is. It's usually pretty important. That's why you have database. So if it can't even access it, even if there was a 100 vulnerabilities that were discovered today, it wouldn't matter. And that's, that's exactly what Albert's getting at, is if you actually contain and isolate appropriately, the, the patches won't make a big difference, because you can go and you can hit your standard channels and make test, do all your testing and validate. But until it really matters later, and for you to patch it, versus being in the fear of, well, what if they just released a thousand of them tomorrow? No. We need to increase our patch management cycle and potentially cause business outages. You don't have to do that now if you actually isolated it appropriately.

Albert Estevez: And, and even more so. Right? So when you really start bringing security policies, you know, to really control on closed ports, those ports that maybe they expose vulnerabilities now, they will not be open twenty-four seven, you know, to everybody. So they will be the only responses to some specific users or assets that they are the only ones that they can see that application, hence, the vulnerability. But, you know, the, the chances that your legitimate user will exploit the vulnerability, they are much less, you know, than exposing to the whole community, uh, to do maybe bad things at some point. So let's, let's keep talking, like, okay, what is bringing AI here to the equation? And as we say, it accelerates discovery. It accelerates attack. So as we say it already, is containment is the off switch. Okay? So let's see different examples of what, what will happen, uh, that, or if AI, you know, made them get — I can move faster, like Mythos, explorer attack, and velocity.

Chris Boehm: Sorry. Thank you. That was my bad.

Albert Estevez: You were so excited.

Chris Boehm: I was too excited.

How do you contain shadow AI and AI agents?

Albert Estevez: So, so right now, again, so Mythos can, you know, uh, find thousands of, you know, uh, vulnerabilities. It's like you have a, a huge team of people, hackers, working in parallel against you all day long. Okay? So in our case, how we stop chasing, uh, and we start containing, so we can protect, you know, uh, the, your assets and your revenue and the uptime of the company, because we try to lock down everything before, you know, any of these attacks land in your infrastructure.

So shadow AI expands the surface. So this is something that you probably seen in your infrastructure. So, or you find a way to really, you know, uh, govern the AI in your infrastructure, or your users will start using AI by themselves. Because nobody can stop, you know, the, the use of AI today, because everybody sees a benefit of using AI. So you need to put, you know, policies in your, in your company, like how, what tools we give to our employees to enhance their capabilities and be more efficient, and be sure that you govern those tools. Okay? Don't let users to start using because you don't provide the tools. That will be a thing that — a mistake that we see many, many, many times in different companies. So from the Zero Networks standpoint, what we have there, the, the tools to really, you know, see them, know before it spreads. So we can identify who is using what, from where, and then we can even generate security policies to prevent those, uh, or help you to sanction some AI, AI tools that we want to utilize — Claude — but you don't want anybody using, uh, OpenAI. So we can generate, you know, the security policies to, to be sure that nobody uses an unsanctioned AI, AI software.

And then AI agents, for sure. So every day, we see more and more and more agents used. Even there are companies that they are adding those agents as part of their Active Directory as new employees, so they treat these agents as employees. And this is the right thing to do as well. You know? Because if you want to govern a, a, a agent like they, they were employees, you need to apply least privilege and really provide an identity for them. So don't allow your users to impersonate — uh, so the agents will impersonate the users, so you, and you don't know who is doing what, if it's the human that you hired, or if it's the agent that it's getting crazy and doing bad stuff. So we need to be sure that your users, they have their identity. They can do their rights, uh, the things they can do. And the agents who did it, we need to be sure that we apply this thing: these agents, where we, who they can communicate, and what are the, the right leverage on the applications that they want to, to use, to avoid things like we see in the field. Like, oh, I, I allow my AI agent, you know, to, to get data from the database, and just as a silent, my database has zero entries, because the AI agent decided to remove them all. So why your AI agent can't write in your database? That should be first question that you should ask. Cool.

How does Zero Networks stop AI-accelerated attacks?

Albert Estevez: Okay. So after everything that we were saying, how we can help you to get an answers? Okay? So how we are solving the patch problem, for example, that we spend some amount of time, uh, discussing, is we have, you know, a solution that allows you in no time to really block the access to all those ports that they don't need to be open twenty-four seven. Like, for example, privileged ports. You know, those, those ports that your administrators, they need to do, you know, every word, the word that they need to do every single day, that is communicating with this machine remotely. I want to run this script through in the WinRM or PowerShell. Right? So the typical port that an administrator we utilize are the exactly the same ones that we see that 75%, more or less, of all the attacks that we identified in an internal network, all of them, they were using four ports, which is our, you know, uh, privileged ports, like RDP, SSH, WinRM, and RPC. K? Imagine that we can, in no time, in one single click, close the access to those ports. They don't need to be open, you know, which means now that, as I said before, the vulnerabilities associated with those ports, now they are local. So nobody can get access, nobody can exploit them, nobody can bring any credentials and try to use it, because those ports are closed behind a policy in the local server.

Then, um, let's talk about another type of attack that probably they, they will sound familiar to you. Like, imagine that Mythos is finding a new, you know, an Apache flaw in your corporate browser, drive-by download, drive-by exploit, lands in your, uh, finance laptop. Now what? Right? So it's something that we put a lot of effort in at Zero Networks when we talk with customers, is we try to tell them to change their mindset, so embrace the breach. So it's going to happen regardless that how much money you're investing in prevention. K? At some point, you will be breached. So then, host in a network contains it. So, as I said, so we can really apply, you know, security policies from the financial assets to be sure that you can talk only your, you know, peer, you know, so nobody can try to do or pivot to a different machine by using RDP, SSH, WinRM, or anything, because all those paths are closed. Okay?

So, assume compromise, so it's the attack. So a coding agent on a developer workstation gets prompt-injected and start probing internal API. In the majority of the networks, this will try to find different endpoints in your infrastructure that they will serve APIs. You know, in our case, after, you know, you are segmented or microsegmented through Zero Networks, this application can only communicate with these two assets, you know, with these two ports. There is no endpoints available. You know, you cannot scan, uh, the entire infrastructure finding vulnerabilities, because everything is closed. So, again, contained by default. K? You cannot discover or communicate with other parts that, um, that they were not previously, uh, allowed to, to you. And then we bring the identity piece. So we try to identify, okay, this is a human person. This is a non-human person. He's trying to communicate with this port. Oh, let's be sure that this is a human. Let's send him an MFA. You know? Stuff like that is easily, uh, can be done by our solution.

And then we have a couple more attacks, like supply chain CVEs. But you, you can imagine that these are all the same. So you cannot exploit which is closed. You cannot move laterally if you don't have the options to move laterally, because nobody will allow you to communicate with other machines, you know, unless that is existing a security policy that enables you to add the side of, of that path. And then the last one, uh, if, if we detect, you know, a trusted backup service account, we brought elevated permissions, to start behaving normally [abnormally], trying to communicate with servers inside this normal pattern. So we, we can learn from all the identities in your infrastructure, so we can generate security policies to be sure that these identities can only be using this type of logon types, and they can only communicate between these two servers through those ports and nothing else. So there is not — I don't need to spend CPU and time finding bad behaviors, because we only allow this behavior, and we check the identity, and everything is under control. So that reduces the amount of, you know, bad things that you need to catch over the good things, that is a waste of time and money.

Chris Boehm: Yeah. I mean, I, I completely agree, Albert. Uh, obviously, I'm here. I believe in this, uh, mindset, because then it just kind of simplifies the necessary evils that you don't have to deal with, because we're isolating it already. Um, I mean, the main concept here is, is just like Albert mentioned, the, the failure rate is going up higher and higher because of all the things that are happening in this market. But if you reimagine that and say, hey, what if we just close everything? You know, no vulnerabilities really matter to us. It's simple. It's automated. Um, it doesn't actually break our production business and operations, because it's learned based on how my environment works. This is essentially a custom environment behavioral analysis, and tailored to you, every customer that we work with. And then it reduces the complexity, because we even learn what things change over time. For the example of, well, this might be new, this might be different. And we've been, uh, having great positive feedback with over 400 different customers that are utilizing, uh, Zero Networks today. So the main thing is, is we're trying to take off that burden of understanding how your ecosystem works, including that new agentic AI, LLMs, and we make it an easier design for you as a business, because you don't have to figure it out. We figure it out for you, and we, and then we contain it, isolated for you. Um, it kind of — exactly what Albert has been talking about. Uh, we're seeing all AI in your environment. It doesn't matter what it is, because it's — we use, we use localized context information. We see which applications you're using an LLM, AI. We can see agentic communications. Then we can see the full data flow maps for you. And you can say, hey, based on what I can see, based on this identity and user access, this is exactly how far I can, uh, access your environment, and what it's communicating to externally. And then we govern agents just like we govern employees. I, I love how Albert said it. It is very true. Each agent is almost being treated like a new employee, which makes sense. You're hiring, essentially — you're building out a new profile to say, solve this problem for me, like you would hire an employee. Now here's your credentials, access, everything you need. Here's what licenses you need, so on and so forth. And then, boom. Now we can make it easier for you. So we're trying to drive our customers in that direction, saying, look, here's your identity, and here's your asset that it communicates to, like your Windows machine or server, and, and so on and so forth, your cloud workloads. Here's what it's all communicating to. This is all it should communicate to. And if it goes outside that bubble, you should be notified. Like, this, this is not normal. So you're not chasing random things. You actually can see what's happening in your environment and be on top of it before it occurs.

Albert Estevez: Yeah. Or we prevented that to happen. Right? So we think we do it right, so they definitely cannot move from the guidelines that you just put.

Chris Boehm: Oh, I'm right. Yeah. That's exactly right, which hits the shadow AI conversation. So if you have these type of conversations pop up with your peers, your executive leadership, your board, and whoever it is you're talking to, this is exactly what we're solving. We're solving the shadow AI. You won't have shadow AI. We, we see everything. You — agent access, we know what the agent has access to today. We provide that for you, and we isolate it for you, all automatically, while you have a human user input of saying, wait a minute, why does this agent have access to everything in our environment? That, that's not — that shouldn't be that way. LLM protection: we provide that automatically, with single click, as Albert mentioned. It's not, well, we have to go through everything and check each machine and do each patch. No. It's a single-click operation, and we'll push it across everything in your infrastructure. And that's agentless, by the way. We don't even require an agent to be on every machine. And then the main thing, of course, which microsegmentation is known for, is stopping the spread of lateral movement, because it doesn't exist with microsegmentation. We literally isolate every single user identity and asset in your environment for you, which is something that is strongly unique from automated scale at Zero Networks. So we enforce, other — and others observe. That's the main thing that is kinda hit on this slide.

How do you prove microsegmentation is working?

Chris Boehm: This one right here is just a concept that we, we — it's not a concept. It actually — we're actually releasing it today. I'm, I, I — it's real today now. Uh, it's something we've been working on for quite some time. And it's — customers have asked us, well, how can we actually prove the difference of what you're doing? That's the problem with microsegmentation. When it's working well, you don't even notice it. That's the, that's the beautiful part of microsegmentation. So we have created a, a breach map. What this means is you can click on — let's just say my laptop, or me as a user — and you click on and say, what do I have access to without Zero Networks? I have access to all these cloud workloads, application visibility. Like, the list goes on and on and on, because I may be a super user in my environment. Well, with Zero Networks, it narrows it down and says, here's the things that they are using, and this is all they have access to, which you can see as a, just a simple example, reduces it by 90% because of my privileges I've been given access to. Now, that's just a, a simple example. It could even be down to point nine percent. It just depends on the use case and user and what's access — what I have access to today. So as a beautiful point of view, it's a simple way of showing what microsegmentation is doing for you, where it's being utilized, and how you can visually see it. And that's what customers are asking for: is how can I see how far my blast radius is, with or without Zero Networks? What have I actually accomplished? And we've solved this for our customers today with this breach map.

Why measure mean time to containment?

Chris Boehm: So, the metrics that matter. This is what we're talking to customers about. I've been in multiple cybersecurity jobs. I'm used to the mean time to detection, mean time to response, mean time to — there's, you know, all these term terminologies. We have our new — and we're, no, I'm just kidding. This is actually what we're measuring on: is the mean time to containment. Uh, so instead of actually — if something gains on the machine and sprawls, like ransomware, or an agentic agent, or whatever you wanna call it, how fast can you contain and isolate? Your blast radius reduction? Uh, so I just showed you: how far could it go, lateral movement, what is the scope there, and how — if my business was taken down, how much of my business, and does it — can I prove that my uptime of majority of my business will be there? That's what we're measuring, versus, hey, I see a lot of alerts, I see a lot of incidents, I'm trying to respond at a certain period of time. What if you don't have to respond, because it's been already contained and isolated as itself? So that's the main thing we're measuring here. Uh, Albert, do you have a feedback on here?

Albert Estevez: No. I agree. So I talk with many customers, you know, and, you know, like, a year ago, they were all talking about mean time to detect, mean time to —

Chris Boehm: Yeah. To respond.

Albert Estevez: And I will say, okay, mean time to be hacked. You know? What is the time?

Chris Boehm: Yes. So —

Albert Estevez: And the always —

Chris Boehm: A mean time to something.

Albert Estevez: Yes. So, so changing the mindset to contain first, so mean time to contain, which it means that, okay, is my business can keep running? So the time must be the time of my, of my business, you know, can be up while even I'm receiving the attack. Right? So it's not, it's my network ready that I'm receiving an attack, but that we will not impact in my business. This is what the, the CEO or the CIO, they care. You know? Not how long it will take to identify something, that by the time that you have the response, you are in the news already.

Who uses Zero Networks at scale?

Chris Boehm: 100, 100%. Um, I, I, we wanted to show this in here. We're very proud of our customers and partners. I wish we can show all of them, but, obviously, we don't have the time. This one is just a simple example, uh, which is not a simple company, if you're not aware of MSC, the Mediterranean Shipping Company. If you've ever gone on a cruise, or you ever gone to a port or terminal or something, you will see these containers with MSC all over the place. And you're gonna be like, woah, I never, I never realized how many of these are out there. They still do one-fifth of all shipping across the globe. Uh, they're an active customer with Zero Networks. They have been for quite some time. They have hundreds of multifactor authentication requests from us, like, through authorization a day, um, and we're providing full segmentation for a company of this size. So that's just something to show a scale. It, it's not these teeny tiny companies or the biggest companies. We actually do it for small law firms to, um, military factory companies. The, the list goes on and on. And we're size-to-scale product for any kind of company size and scale.

Albert Estevez: Yeah. We've changed the number of the boats to Kubernetes now. You know? Pungent containers.

Chris Boehm: That's so funny. That's, that's a pretty nerdy joke right there. Uh, anyways, we're, we're — we love to, to be working with all of you. We love to show you more. We can only show much, show so much in a quick period of time. Uh, we would generally wanna help you and see you, so please reach out to us. We have a business impact analysis. We have multiple documentations for you to just look at and analyze, if you like to learn more about Zero Networks and how we're helping your business stay more secure and keep it up and running. So I would highly encourage this. And like I mentioned, the blast radius tool is now launched. So that's something that we can offer to our customers. Um, if you wanna see that, please reach out. Um, me or Albert, or anybody on our team, will be more than happy to talk you through it and show it. Um, thank you again for joining our webinar, and I hope you learned something new about, uh, where Mythos is causing disruption in our market.

Albert Estevez: Thank you, everybody. Bye.