Predict, Don't Enumerate

Michael Roytman · rss · 2026-06-04 Reader 🖥️

AI-Driven Vulnerability Discovery Mythos

Now that AI makes vulnerability discovery effectively unbounded, security programs survive only by replacing severity-based enumeration with predictive, context-aware prioritization — and Anthropic's endorsement of EPSS is the external permission CISOs have been waiting for to make that shift official.

practical · argumentative — The piece argues for a concrete shift in CISO practice: replace severity-based enumeration with probabilistic prioritization. It mounts a theoretical case (density of bugs, knowing vs pointing machines) only to motivate specific action items (rewrite SLAs, change board metrics, invest in telemetry, fix compliance dialogue, restaff).

Structure

Part	Role
Lead — Anthropic's five-word EPSS endorsement inside an April 2026 security-ops guide	Hook + authority anchor: a frontier AI lab endorsing a non-LLM predictive model is the news peg that lets a long-running practitioner consensus become quotable.
'The quiet consensus' — vuln volume has been machine-scale since at least 2015; EPSS usable since 2021; 120+ vendors embed it	Establishes that the recommended practice is not novel; what was missing was external cover, not technology.
'Why prediction, stated plainly' — Geer's 2014 sparse-vs-dense question, Spring's halting-problem framing, recent AI-discovered decades-old bugs in OpenBSD/FFmpeg, Mythos as 10x findings catalyst	Theoretical justification: density is now empirically settled, so enumeration cannot terminate; severity scoring is a human-scale tool for a machine-scale problem.
'Pointing machines and knowing machines' — Geer & Aitel's Lawfare distinction, the dog/bite analogy	Provides vocabulary that reframes hazard vs risk; positions predictive models as the path to 'knowing'.
'Global isn't local' — EPSS sees the internet, not your assets, controls, or exposure	Concession + escalation: the recommended public tool is necessary but insufficient.
'What a local knowing machine actually requires' — train on CMDB, topology, reachability, controls, on-site telemetry, remediation history	Specifies the missing layer and frames local context as defenders' only asymmetric advantage against attacker LLMs.
'The policy shifts that actually matter' — rewrite SLAs, change board metrics, invest in telemetry, fix compliance, staff for the bottleneck	Concrete action list — the practical payoff that the entire theoretical scaffolding has built toward.
Coda — 'None of this requires a new product'	Removes the budgetary objection and assigns responsibility to CISO leadership, not vendor procurement.

Key terms

EPSS (Exploit Prediction Scoring System) AI-Driven Vulnerability Discovery
A statistical, non-LLM predictive model that, given a CVE and global exploitation signals, returns probability of exploitation in the next 30 days. Treated as the canonical public example of a 'knowing machine'.
Pointing machine AI-Driven Vulnerability Discovery
A system (most current scanners + LLM bug-finders) that enumerates and names possible vulnerabilities without understanding their environmental risk.
Knowing machine AI-Driven Vulnerability Discovery
A predictive system that understands how code behaves in a particular environment and recognizes the context that turns a hazard into a risk.
Hazard vs risk AI-Driven Vulnerability Discovery
Hazard = a flaw that could theoretically be exploited. Risk = a flaw that can be weaponized reliably in this environment, against these controls, through this traffic. Bugs are abundant; weaponizable bugs against a given target are rare.
Machine-scale AI-Driven Vulnerability Discovery
A problem regime where finding counts (hundreds of thousands to millions per month) structurally exceed human remediation capacity, making any human-scaled prioritization scheme self-defeating.
Local context
The organization-specific data — asset inventory, application topology, reachability, deployed controls, on-site telemetry, remediation history — that converts a global probability into an enterprise-specific risk score and that attackers cannot have.
Exploitability-weighted exposure over time
The proposed replacement board metric: aggregate risk weighted by probability of exploitation, tracked longitudinally, paired with predicted-vs-observed exploitation as a calibration line.
Mythos Mythos
Anthropic's forthcoming model, used here as a stand-in for an order-of-magnitude expansion of AI-discovered vulnerabilities over the next 24 months — the forcing function that makes the shift non-optional.
CVSS AI-Driven Vulnerability Discovery
A severity-scoring framework that survives only because of regulatory inertia (PCI, HIPAA, breach-notification rules); easy to grade against, but uncorrelated with real exploitation.
Security-data engineer
A role oriented toward closing the feedback loop between prioritization and observed exploitation; the staffing answer to the bottleneck moving from scanning to deciding/measuring.

Propositions

explicitcorroboratedVulnerability management is now a machine-scale signal-to-noise problem that human-scale severity grading cannot solve.conf: high
supports ←GitLab 19.2 Puts AI Agents to Work on the Security Backlog · p4 — Assigning an AI reviewer to flag and severity-rate logic-flaw findings is a practical industry response to vulnerability management becoming a machine-scale signal-to-noise problem human-scale grading can't solve.
explicitSoftware vulnerabilities are dense, not sparse — there are always more undiscovered flaws in any sufficiently complex deployed system.conf: high
explicitA bug is a hazard; only environmental context (controls, exposure, telemetry) makes it a risk.conf: high
explicitAnthropic's endorsement of EPSS is significant because frontier LLM labs almost never recommend purpose-built predictive models over their own LLMs.conf: high
explicitEPSS, while necessary, is insufficient — a global model cannot price local exposure.conf: high
explicitPairing better detection (LLM pointing machines) with faster remediation without local prioritization increases churn and waste rather than reducing risk.conf: high
supportsProject Glasswing: what Mythos showed us · p13 — Independently argues that faster remediation without local prioritization increases churn rather than reducing risk, matching Cloudflare's case against two-hour patch SLAs.
explicitLocal environmental context is defenders' only structural asymmetric advantage over attackers (including attackers wielding LLM tooling).conf: high
explicitSeverity-bucketed SLAs are now actively harmful, not just suboptimal.conf: high
explicitBoard reporting that counts findings in severity buckets is managing to the wrong metric; exploitability-weighted exposure over time is correct.conf: high
explicitThe bottleneck in security programs has shifted from finding bugs to deciding which bugs matter and measuring whether decisions were correct.conf: high
extendsAssessing Claude Mythos Preview's cybersecurity capabilities · p9 — Generalizes the human-validation bottleneck from open-source disclosure to all security programs: the constraint is deciding which bugs matter, not finding them.
explicitCompliance regimes (CVSS, PCI, HIPAA) lag behind operational best practice and must be renegotiated in writing with auditors now.conf: high
explicitThe shift to probabilistic, context-aware vulnerability management requires CISO leadership, not new vendor products.conf: high
implicitAI's defensive value lies in prediction and contextualization, not in further enumeration; LLMs are the wrong technology for the prioritization layer even though they expand the discovery problem.conf: high
refinesAssessing Claude Mythos Preview's cybersecurity capabilities · p6 — Conditions the defenders-win-eventually claim: AI's defensive value lies in prediction and local contextualization, not in further enumeration of bugs.
implicitAuthority migration matters: practitioner consensus only becomes institutionally actionable when an external authority (here Anthropic) ratifies it.conf: high
explicitMost organizations already possess the data inputs needed for a local knowing machine; the obstacle is integration and political will, not data acquisition.conf: high
explicitCalibration (predicted vs observed exploitation) is the missing instrument; without the feedback loop, prioritization decays into permanent uncalibrated guessing.conf: high
explicitA small, efficient, context-rich team can move risk more than a large, high-volume remediation team.conf: high
implicitThe frame 'AI in security' should be split: AI for discovery (offense-advantaged) versus AI/statistics for prioritization (defense-advantaged when local).conf: medium

Arguments

Severity-only prioritization (CVSS) must be replaced by probabilistic prioritization. strength: high

Explicit premises:

Finding volume is now machine-scale and growing.
Vulnerabilities are dense — enumeration cannot terminate.
CVSS severity is uncorrelated with actual exploitation.
Predictive models (EPSS) exist, are public, and are widely embedded.

Implicit premises:

Action threshold should be set at expected-loss reduction, not at theoretical worst-case.
Auditors and boards will accept a probabilistic story if a CISO leads with it.

Inferences:

Any framework whose primary axis is severity (not probability × exposure) is structurally unfit and should be retired, not patched.

Anthropic's EPSS recommendation legitimizes a shift practitioners have already made. strength: high

Explicit premises:

Frontier labs usually recommend LLMs.
Anthropic recommended a non-LLM predictive model for the prioritization step.
Auditors and boards have blocked the shift by demanding 'external justification'.

Implicit premises:

An AI vendor's recommendation carries more compliance weight in 2026 than a security vendor's.
The bottleneck for change was political/institutional rather than technical.

Inferences:

CISOs should cite Anthropic's guidance directly in compliance dialogues — the citation itself is part of the intervention.
Other frontier labs may follow; expect normative pressure on auditors to update CVSS-anchored controls.

Local context, not global prediction, is the defensive frontier of the next decade. strength: high

Explicit premises:

EPSS sees the internet but not your environment.
Two identical CVEs can have risk profiles orders of magnitude apart depending on exposure and controls.
Most organizations already have the input data.

Implicit premises:

Attackers, even AI-equipped ones, cannot replicate defender-side telemetry and topology data.
Defender-side data integration is feasible without new acquisitions.

Inferences:

Vendor offerings that wrap global EPSS without ingesting customer-side context are leaving the asymmetric advantage on the table.
The next CISO hire is a data engineer, not another analyst.

LLM-based bug-finding without probabilistic prioritization will make security programs worse, not better. strength: high

Explicit premises:

Pointing machines + faster remediation = more churn and waste.
Agent tokens cost money; remediation has breakage cost.
Mythos-class models will multiply findings by 10x in 24 months.

Implicit premises:

Remediation capacity grows slower than discovery capacity.
Cost of unnecessary remediation is non-trivial and includes engineering opportunity cost, not just dollars.

Inferences:

Adopting LLM-based bug-finding before installing a local knowing machine is net-negative.
There is a window where AI-augmented programs underperform legacy programs that simply ignore the new findings.

The bottleneck in security programs has shifted from detection to decision and calibration. strength: high

Explicit premises:

Findings already exceed capacity; finding more does not help.
Feedback loops on predicted vs observed exploitation are mostly absent.
Job descriptions still reflect a detection-bottleneck era.

Implicit premises:

Prioritization is a learnable, improvable system, not a one-time policy decision.
Without measurement, prioritization quality is unobservable and therefore undefendable.

Inferences:

Vendor metrics that emphasize detection breadth are now mis-aligned with buyer value.
MSSPs/managed-detection firms whose pricing is per-finding face structural margin pressure.

Narratives

The CISO who privately stopped treating every 9.8 CVSS as an emergency in 2019 but still keeps CVSS in her report.
→ Embodies the 'private consensus, public compliance theater' gap — supports the proposition that the change needed is institutional cover, not technique.
A 27-year-old bug in OpenBSD and a 16-year-old bug in FFmpeg that five million fuzzing runs missed, discovered by AI.
→ Concrete evidence settling Geer's 2014 sparse-vs-dense question on the dense side; supports the dismissal of enumeration as a terminating strategy.
Children learn to point and name 'dog' but pointing does not tell you whether it bites.
→ Carries the hazard-vs-risk distinction in a single image; supports the case for knowing machines without requiring formal argument.
Two identical 9.8 CVEs — one exposed to the internet behind a WAF that doesn't inspect the relevant protocol, one on an internal system with a single authenticated service account.
→ Operationalizes 'global isn't local' — supports the proposition that even a probability-aware global model leaves orders-of-magnitude risk variance untouched.
Geer's 2014 Black Hat keynote question, returned to in 2025 with Aitel.
→ Frames the article as an 11-year intellectual arc finally resolving — supports the rhetorical claim that the shift is overdue, not novel.
Spending 'a king's ransom in agent tokens' fixing vulnerabilities that were never dangerous.
→ Anchors the cost argument against naive LLM remediation pipelines in a tangible (and 2026-flavored) cost metaphor.

Questions addressed

✅ Are software vulnerabilities sparse or dense — i.e., can enumeration plus patching ever finish?
Dense. AI-driven discovery has empirically settled what Geer could not in 2014.
✅ If enumeration cannot terminate, what is the right action threshold?
Probability of exploitation × asset exposure, above a threshold tied to team capacity and risk tolerance.
✅ Why has the predictive approach not been adopted despite being technically available since 2021?
Lack of external authoritative cover (auditors, MRM, boards). Anthropic's recommendation supplies it.
✅ Where is AI's defensive value highest — discovery or prioritization?
Prioritization, via predictive models grounded in local context; LLMs amplify the discovery problem rather than solve the defensive one.
✅ How should boards measure security program effectiveness?
Exploitability-weighted exposure over time, paired with a predicted-vs-observed exploitation calibration line.
⭕ How should compliance regimes be updated to permit probabilistic prioritization?
Author urges CISOs to engage auditors 'now, in writing' but does not propose specific framework language or a model audit response.
⭕ Who owns and updates a local knowing machine — the security team, the platform team, an outside vendor?
Implies security-data engineers but does not address build-vs-buy, governance, or model-risk-management of the predictive model itself.
⭕ What happens when attackers gain access to defender-side context (insider, compromise, public-sector leaks)?
Author asserts local context is an asymmetric advantage but does not address its fragility.

Gaps

incompleteNo treatment of model risk management for the predictive model itself. If EPSS or a local knowing machine becomes the action-trigger, it inherits MRM scrutiny (drift, bias, calibration, explainability). The author critiques CVSS compliance inertia but does not engage the parallel inertia that 'models making security decisions' will trigger inside the same MRM/audit teams he's asking CISOs to renegotiate with.
Read next: FIRST EPSS calibration studies; SR 11-7 / OCC model-risk frameworks applied to security tooling; recent work on operationalizing AI governance for cyber decisions (NIST AI RMF crosswalks with vulnerability management).
incompleteAsymmetric-advantage claim under-defended. Local context is asserted as defenders' 'perhaps the only' asymmetric advantage, but attackers routinely acquire defender-side context via reconnaissance, insiders, prior compromises, and now AI-assisted OSINT. The argument needs a falsifiability condition: under what compromise of defender context does the predictive advantage collapse?
Read next: Threat-intel literature on adversary recon; red-team write-ups on environment learning; emerging work on AI-augmented OSINT against enterprise estates.
incompleteNo engagement with the political economy of the scanner/RBVM vendor base. 120+ vendors embed EPSS but largely sell on finding-volume. The piece prescribes a shift that undercuts their current product KPIs without naming that incentive conflict or how a CISO survives a renewal negotiation under the new metric.
Read next: RBVM vendor positioning analyses; Gartner/IDC RBVM market notes 2024-2026; CISO procurement post-mortems.
incompleteMythos and the '10x findings in 24 months' projection are presented as forcing function but uncited; treated as known. For a piece whose authority move is 'a frontier lab said X', the empirical claim about future discovery rates deserves either Anthropic's source or independent grounding.
Read next: The cited Anthropic April 2026 security-ops guide in full; recent AI-discovered vulnerability disclosure datasets; CISA KEV growth-rate analyses.
incompleteLocal knowing machine implementation is described at the inputs layer (CMDB, telemetry, controls) but not at the modeling layer. What kind of model? Trained how, evaluated how, retrained on what cadence? The piece tells CISOs to build something it does not specify enough to procure or staff against, beyond hiring a 'security-data engineer'.
Read next: Academic literature on enterprise-local exploit prediction; case studies from organizations (Kenna/Cisco, ZeroFox, etc.) that have shipped contextualized scoring; MLOps patterns for security telemetry.
illogicalMild tension: the piece both leans on Anthropic's authority to dislodge CVSS and warns that LLM detection without local prioritization is net-negative — yet does not address that Anthropic is simultaneously the producer of the LLM bug-finder (Mythos) it is warning about. The recommendation is treated as disinterested expertise when it could equally be read as supplier-side risk mitigation.
Read next: Conflict-of-interest analyses of frontier-lab safety/security guidance; comparison with cloud-provider 'shared responsibility' framings that similarly externalize risk to customers.
incompletePublic-sector and small-org perspective absent. The prescriptions assume a CISO with CMDBs, MRM teams, board reporting cadences, and audit relationships. The 80% of organizations without those structures — and which still face Mythos-class discovery volume via shared CVEs — get no treatment.
Read next: CISA small-business cybersecurity guidance; municipal/SLED security maturity studies; managed-defense economics for under-resourced orgs.

Closes gaps elsewhere

Assessing Claude Mythos Preview's cybersecurity capabilities · g2 — Addresses the defender's-dilemma asymmetry: defenders need not patch everything; exploitability prediction plus local environmental context is a structural defender advantage that survives AI-scale discovery.

Predict, Don't Enumerate

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Closes gaps elsewhere

Related documents