When AI finds everything, the trick is knowing which vulnerabilities matter

What Mythos revealed about enterprise security, and what comes after it

Editor's note: this blog post is based on a live conversation between UiPath TrustOps security leaders Kevin Mooney (Field CISO, Americas), Marco Eggerling (Field CISO, International), Cosmin Radu (Head of Security Engineering), and Valentin Lupu (Security PMO Lead).

There has been a flood of interest and news around Anthropic’s large language model (LLM) for cybersecurity, Mythos, ever since the company announced it and subsequently announced that it is unsafe for unrestricted release. Mythos, GPT-Cyber, and similar LLMs work by reviewing source code to find insecure patterns in code. Similar to using LLMs and coding agents to write code, using them to find vulnerabilities yields a significant volume that may not be the highest quality.

This has raised many questions aimed at software vendors about how they are responding and what they are doing to change their security program to handle the expected flood of new findings.

No one asks, "did you anticipate this coming?"

Yes, in fact, UiPath started more than a year and a half before Mythos was released.

How vulnerabilities get found—and missed

The majority of enterprises use vulnerability scanners that follow a simple flow. They scan a system for the software it contains and compare the name of the software and its version to a list of known common vulnerabilities and exposures (CVEs), most commonly the United States (U.S.) National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology (NIST) and MITRE.

Naturally, after finding vulnerabilities, the typical response would be to patch to a non-vulnerable version or contact the vendor to obtain a patch.

This is a very broad, non-specific approach to security. It is commonly used because it is relatively easy to implement and effective, so long as there is sufficient IT staff to keep up with the patching and a good strategy to implement such patches without downtime. There is a high likelihood that this strategy patches vulnerabilities that are not actually individually creating direct risk for an organization, though, and more likely that vulnerabilities are only exploitable by an attacker chaining multiple vulnerabilities to get through many layers of defense.

Most findings are noise. That’s the real problem.

Want the full conversation? Watch the complete 20-minute discussion with UiPath TrustOps security leaders, where Kevin Mooney, Marco Eggerling, Cosmin Radu, and Valentin Lupu go deeper on what LLM-powered vulnerability discovery means for enterprise security.

Vulnerabilities can be found by specific mechanisms like static application security testing (SAST) and penetration testing that find an insecure pattern in software processing and proof that exploitation is possible. That insecure pattern might be widespread, or it might only exist in a very small part of a much larger library, platform, or operating system.

Disclosed vulnerabilities sometimes have detailed descriptions indicating the functionality in the piece of software that is flawed (sometimes they do not). Regardless of the level of detail in the description, most vulnerability scanners only look at whether the software matches the vulnerable version in the vulnerability database and ignore everything else.

A security researcher finds a vulnerability in one function of a library that is exploitable. They report it. It gets scored and rated according to the most severe impact. Great…but what if that function is disabled by default? Or what if default settings block the exploit?

The same vulnerability can carry very different severities depending on where it lives, how it is used, and how it is configured; it is why Linux distributors like Red Hat and Debian publish their own scoring rather than take the database at face value. The most famous example of this is probably CVE-2020-19909, where the common open-source utility, curl, was issued a CVE scoring 9.8. Such a score is normally reserved for vulnerabilities that allow for remote takeovers of systems with little effort, but this was not the case at all. Exploitation was done at the command line by an authorized user using intended functionality.

Many cybersecurity practitioners agree that CVE-2020-19909 really should not have been a valid vulnerability to begin with (or, at the very least, one with a very low score). While it was eventually reduced to 3.3, this took time and effort by the maintainer and was initially rejected by MITRE.

Context is everything

It can be used to surface what I would like to call 'dormant vulnerabilities'—vulnerabilities that might have been missed in the past.

Cosmin Radu, Head of Security Engineering, UiPath

Vulnerability scanners work like this because parsing the description text and the explanations provided by vendors that may include a piece of software as part of their platform is extremely difficult…or at least it used to be.

For UiPath, by using both robotic process automation (RPA) to grab data in a programmatic routine and generative AI agents to understand the vulnerability explanation text, this difficult challenge became a working solution using our own tools. This automated solution is combined with a suite of tools to perform vulnerability scanning and exploitability analysis on a continuous basis, where security LLMs like Mythos and its successors can be easily added as additional sources of data.

UiPath built this before the question was asked

We saw the need to go beyond what modern vulnerability scanners were capable of; to go beyond what even an enterprise suite of vulnerability scanners across our software development lifecycle (SDLC) were capable of performing.

The result became a pluggable system combining all the best-in-class tooling, orchestrated by UiPath agentic AI and RPA software to provide near-real-time risk analysis of the true risk a vulnerability presents to our customers in the context of our products. Married with an agentic AI threat-hunting detection system to ingest the threats that are just being discovered, vulnerabilities found by LLMs are triaged quickly and accurately. If you’re curious to learn more about this, stay tuned, our team will tell the complete story in an upcoming article.

The effect is something profound: a flexible platform that cuts through the noise of vulnerabilities and provides a near-real-time view of vulnerabilities across all UiPath products with a common vulnerability scoring system (CVSS) score that reflects the actual severity.

This means that security and engineering teams can prioritize the real risks while allowing vulnerabilities that are already mitigated to wait for patch updates. UiPath customers who send scan reports can receive detailed information on the mitigation already in place, backed entirely by the standard CVSS framework but also with the complete metrics of base, temporal, and environmental scoring to see a far more accurate picture of the risk it poses to them.

When a threat drops, minutes matter

Enhancing the accuracy of triage is only half the problem, though. The other half is speed.

When a new threat is disclosed, our AI SOC can go from that announcement to triage across our entire IT and product landscape, to opening tickets, and opening full investigations in minutes rather than hours. How we built it, and how it runs on our own environment will be detailed in a future write-up.

This is where it starts, not where it ends. The cybersecurity automation solutions we're making available to customers are the leading edge of what the UiPath TrustOps team already runs on itself, with more capabilities reaching customers soon.

The fundamentals haven’t changed. The speed has.

With each new wave of innovation in finding vulnerabilities in software, there is a period where the world must adapt. Cybersecurity-focused LLMs like Mythos and GPT-Cyber represent a challenge for many today, but so did fuzzing, penetration testing, and many other techniques when they were first introduced. In time, these become part of the detection stack used in defense (as they have in UiPath) and the industry evolves.

Ultimately, the evolution of generative AI to be used in finding vulnerabilities in code accelerates the speed at which enterprises and in particular software vendors need to work, but it does not change the need for fundamental good security practices.

Reducing the attack surface by removing unnecessary code, building a strong cadence for quickly applying security patches, and holding development teams accountable for following good security coding practices are all still fundamentals that every enterprise should employ.

So, what should you do?

What should an enterprise do in response to all of this?

In the words of Douglas Adams, “don’t panic.”

While Mythos certainly represents an evolution of finding vulnerabilities, it is not a pending apocalypse. The fundamentals of implementing secure defaults, secure baselines, applying security updates, and implementing security measures in accordance with your risk profile remain true.

IT professionals and security teams will need to accelerate their response activities. They will also need to dig deeper when investigating threats and vulnerabilities to really understand the impact if they cannot speed up the time to patch. Using automation and agentic AI can accelerate this process and reduce the toil on teams, if their enterprise is ready to adopt it.

Like any technology, though, it is important to consider the secure implementation of a solution to address a problem lest it become a problem itself.

UiPath is here to help and welcomes the opportunity to walk you through our solutions and how our AI-powered orchestration and automation offerings can accelerate enterprise processes from security to IT to business.