Notifications
Clear all
Topic starter
02/08/2026 11:48 am
TL;DR: AI models will speed up attack workflows, but their effectiveness depends on deep system context, according to Aikido’s analysis of Mythos and 1,000 real-world AI penetration tests. The defender advantage still comes from source code, runtime visibility, and internal logic, not raw model capability.
NHIMG editorial — based on content published by Aikido: The cybersecurity doomerism around Mythos doesn't match what we see on the ground
Questions worth separating out
Q: What breaks when AI security testing lacks source code context?
A: Testing tools without source code context miss the relationships between control flow, dependency behaviour, and identity-linked access.
Q: Why do service accounts matter so much in application security?
A: Service accounts often define how one component trusts another, which means they can open or close the attack path.
Q: How do you know if AI-assisted testing is actually improving security coverage?
A: You know it is working when the findings change with added context, not just with model size.
Practitioner guidance
- Map security testing to context depth Classify your testing coverage by whether each workflow has source code, runtime telemetry, dependency data, and identity context.
- Extend NHI visibility into application runtime Track where API keys, tokens, and service account credentials are used in production rather than only where they are stored.
- Use whitebox results to prioritise control fixes Move the deepest findings from whitebox testing into remediation queues for access boundaries, dependency trust, and privilege scope.
What's in the full article
Aikido's full blog post covers the operational detail this post intentionally leaves for the source:
- The Mythos-Ready checklist that translates the article’s argument into a practical security workflow.
- The examples Aikido uses to compare whitebox and greybox AI penetration testing in more detail.
- The operational guidance on using static and dynamic analysis together to improve security findings.
- The source article’s specific framing around attacker context, defender visibility, and application security priorities.
👉 Read Aikido's analysis of Mythos, attacker context, and appsec risk →
AI model context and appsec: are attackers really gaining the edge?
Explore further
02/08/2026 12:58 pm
Context is the real security control. The article correctly rejects the idea that model capability alone determines attacker advantage. In practice, security outcomes depend on whether the defender has source code, runtime telemetry, and identity context that attackers do not. That is why application security, NHI governance, and agentic AI controls increasingly converge around visibility rather than raw detection breadth. Practitioners should treat context as a first-class control surface.
A question worth separating out:
Q: What is the difference between greybox and whitebox security testing?
A: Greybox testing uses limited internal knowledge, while whitebox testing has access to source code and deeper system detail. Whitebox is better for finding structural issues, trust boundary failures, and identity-linked weaknesses. Greybox remains useful for simulating less informed attackers, but it should not be the only basis for risk decisions.
👉 Read our full editorial: AI model context matters more than attacker hype in appsec
