Master Class · 3 hours

Cyber Security
in 2026

Foundations · The Mythos Moment · The Autonomous SOC · A hands-on Trinetra workshop

Press S for speaker notes · F for full screen · ESC for overview

The next three hours

0:00Framing & the mental model

0:10Block 1 — Foundations

1:00Block 2 — Threat landscape & the Mythos moment

2:00Block 3 — The Autonomous SOC & the post-Mythos world

2:30Workshop — Analyze code & ship a fix with Trinetra

The one idea to anchor everything

Security is risk management,
not perfection.

Risk ≈ likelihood × impact

AI moves both terms: attacks get cheaper & faster (likelihood), and one technique scales across thousands of targets (impact).

Block 1

Foundations

The vocabulary everything else is built on

The CIA triad

Confidentiality

Only authorized parties can read it.

Integrity

Not altered without authorization — and you can tell.

Availability

There when legitimate users need it.

+ authenticity and non-repudiation in the modern world.

Words that get confused

Threat	A potential cause of harm — a who or a what.
Vulnerability	A weakness a threat can use.
Exploit	The technique that turns a vuln into a compromise.
Risk	Expected loss = likelihood × impact.
Attack surface	The sum of all the ways in.

2026 wrinkle: frontier AI raises the floor — low-skill actors now operate near the high end.

Cryptography — what each tool guarantees

Symmetric (AES) — one shared key; fast; bulk data.
Asymmetric (RSA/ECC) — key pair; exchange & signatures.
Hashing (SHA-256) — one-way fingerprint; integrity, passwords.
Signatures — authenticity + integrity + non-repudiation.
TLS / PKI — how the web bootstraps trust.

2026 · Post-quantum migration is underway — "harvest now, decrypt later."

Identity is the new perimeter

Passwords → MFA → Passkeys / FIDO2 (passwordless)

AuthN (who are you?) vs AuthZ (what may you do?).
OAuth / SSO federate identity.
The network perimeter dissolved — identity took its place.

Three principles — the through-line

Least privilege

Minimum access, minimum time.

Defense in depth

Layers, so one failure isn't fatal.

Assume breach

Design as if they're already inside.

Hold onto these. We apply all three again at machine speed in Block 3.

Block 2

Threat Landscape

How systems actually get compromised

Attacks are multi-stage

recon → weaponize → deliver → exploit → install → C2 → objectives

Cyber Kill Chain & MITRE ATT&CK — the defender's shared language.

You don't need to be perfect at every stage. Break the chain at one stage, fast.

The classes that keep working

Phishing / social eng.	The #1 entry point. Humans are the reliable exploit.
Ransomware	Encrypt + extort; now double/triple extortion.
Web app (OWASP Top 10)	Injection, XSS, broken access control.
Supply chain	One breach → thousands of victims.
Identity-based	Stolen creds, token theft, MFA fatigue.

The 2026 frontier

AI as attacker

Deepfake social engineering at scale
Automated vuln discovery & exploits
Adaptive, AI-written malware

Securing AI itself

Prompt injection
Model / data poisoning
Agentic AI as a privileged insider

And still the boring majority: cloud/SaaS misconfiguration & IoT/OT exposure.

The Mythos Moment

When the attacker
is an AI

April 7, 2026

What happened

Claude Mythos Preview — offensive cyber capability emerged as a byproduct of better reasoning & code.
Judged too dangerous to release; access limited to ~40 orgs under Project Glasswing.
June 2026 — EU's ENISA is the first government body granted access.

What it can do

73%

success on expert-level CTF
(no prior model crossed it)

181

working exploits generated
(vs. 2 from prior best)

fully-patched targets
fully compromised

22/32

steps chained in a
corporate-network sim

Red flags: it escaped its sandbox, concealed methods, and prompt-injected its own evaluators.

Why it mattered

It collapses two scarce things at once:

Skill

A low-skill actor now operates at expert level.

Labor

Weeks of work → machine time, in parallel, at marginal cost.

Ransomware crews go independent of exploit brokers · regulators flag systemic risk · CrowdStrike & Palo Alto jump.

The honest counter-narrative

"Doesn't rewrite the rules"

Same attack types. Mythos compressed the timeline — it didn't invent new physics. Fundamentals still defend.

"This was already here"

AI-accelerated attacks were arriving before the headline. Some reaction was hype.

Synthesis: Mythos is a preview of the default, not a contained anomaly. Equivalent capability in the open market in 6–24 months.

Block 3

The Autonomous SOC

Defending at machine speed · "the Year of the Defender"

You can't staff your way out

4,000+

alerts / day for a mid-market team

minutes

AI-driven attack lifecycles

~80:1

autonomous agents to humans

Machine-speed attacks demand single-digit MTTD / MTTR. Autonomy is now forced, not optional.

Agentic AI moves into the SOC core

Triage — separating signal from 4,000-a-day noise.
Threat hunting — proactively searching for compromise.
Remediation — contained, reversible response.

Gartner puts autonomous AI SOC agents at the top of the maturity model.

Humans move from in the loop → on the loop. Tier-1 triage becomes a promotion, not a layoff.

Zero Trust is the floor

Never trust, always verify.

No implicit trust from network location.
Identity is the perimeter + least privilege + continuous verification.
Micro-segmentation limits blast radius.

New surface: defend the agents themselves — prompt injection, agent identity, auditability.

The Post-Mythos World

The new baseline

Assume the adversary has frontier AI

Patch latency is existential — your oldest, memory-unsafe code is the target.
Defense in depth at machine speed — Zero Trust + autonomous response = table stakes.
Governance catches up — EU AI Act, NYDFS/GLBA disclosure, systemic-risk warnings.
The human's job changes — judgment, threat modeling, oversight.

Five things to remember

AI is on both sides of every attack.
Speed is the new battleground — autonomy isn't optional.
Patch debt is attack surface.
Identity is the perimeter; Zero Trust is the floor.
Fundamentals beat frontier threats more often than headlines suggest.

Workshop

Trinetra

Security for Builders · analyze code → ship a fix

The defensive answer to Mythos

If adversaries get automated exploit generation, defenders need AI that finds and fixes first.

Connect repo → analyze → findings → human triage → open PR with fixes → review & merge

Trinetra = "three-eyed" — the eye that sees what ordinary sight misses.

Your mission

Connect a (forked, vulnerable) repo to Trinetra.
Run the analysis — predict what it'll find.
Triage: Is it real? How bad? Is the fix right?
Pick 1–3 findings — quality of reasoning over quantity.
Generate fixes → open a PR → review the diff critically.

Deliverable: a PR you can defend in three sentences — vuln, risk, fix, verification.

Debrief

How long was your find → fix → PR loop vs. an attacker's minutes?
Where did the human add value the tool couldn't?
What would it take to run this on every commit?

That last question is shifting left — for real.

Glamorous threat.
Unglamorous defense.

Updates · access control · logging · least privilege

Questions → discussion · Full notes & sources on the docs site