From Zero-Day to Zero-Hour, How Cyber Defence Lost Time

With the announcement of Anthropic’s Claude Capybara, codenamed Mythos, this signals a decisive shift in cyber risk. This is not simply a better tool; it is the first of what has been warned of for some time, a machine that compresses the distance between vulnerability discovery and exploitation to near zero. Where defenders once relied on time in days or weeks between disclosure and attack, that buffer is now collapsing into hours. This relegates Zero-Day exploits to Zero-Hour and the digital economy psychology will need to shift in lockstep.

The consequence is stark. Cyber attacks are no longer artisanal exercises conducted by skilled specialists; they are becoming industrial processes. AI can now scan vast codebases, identify weaknesses, generate exploits and iterate attacks with relentless efficiency. The barrier to entry falls, while the scale and speed of threat rise simultaneously. An example of which I postulated last year – A Very Real Breach Symphony.

More concerning still is the asymmetry this creates. Attackers need only succeed once. Defenders must be right every time, continuously. In a world of AI-driven attack capability, that imbalance becomes structural rather than situational.

The real shift, however, is philosophical. Cybersecurity can no longer be anchored in periodic assurance or reactive controls. It must evolve into continuous, machine-speed validation of systems, code and behaviour.

If AI can find vulnerabilities at scale, failure to remediate becomes negligence Boards will be held accountable for patch latency, known exposure windows and tardiness in AI-enabled threat preparedness.

For cyber consulting, this is not a productivity gain; it is an inversion of value. When an AI can enumerate critical flaws across an estate in minutes, the marginal value of human-led discovery collapses. The uncomfortable truth emerges, the Cyber industry has not been selling answers, it has been selling time. The value shifts from scarcity of human expertise driving worth to an abundance of AI-generated insight, where value now lies not in finding vulnerabilities but in independently asserting and continuously proving resilience against them.

Mythos does not break cybersecurity. It simply exposes what was already true, we were relying on time as a control and time has just run out.