We’ve recently seen multiple public examples of how frontier models are changing the face of cyber. The United Kingdom’s AI Security Institute (AISI) reported that both Claude Mythos Preview and GPT-5.5 have significantly surpassed the already-accelerating pace at which AI systems are completing autonomous cybersecurity tasks – they’re doing more in a month than previous models could do in half a year. Palo Alto Networks reported similar findings in its testing, coming to the conclusion that the latest models are extraordinarily capable at finding vulnerabilities and, importantly, changing them into critical exploit paths in near-real-time.
What both AISI and Palo Alto Networks are saying is that frontier models are finding vulnerabilities before teams can patch them. And if the models’ developers can’t keep them from behaving this way, weaponizing frontier models could be a game-changing capability for adversaries.
To confront this new challenge, security teams must establish Zero Trust architectures that focus on containment, resilience and behavior-based improvement so that regardless of what happens in an environment, organizations can protect their most valuable asset: their data.
Containment: Preventing Large-Scale Movements in an Exploit
Containment is not only about preventing lateral movements on a network. It's also about preventing north-south traffic and blocking movements from one network to the next. The frontier model movements disclosed and described in recent headlines involved models moving from a testing sandbox, then onto a network more broadly, and then onto the open Internet.
This is where the “zero” in Zero Trust comes in. You need data protections in place even in testing and development environments. You have to look at what's coming in and what's going out – everywhere. You have to look inside your environment at how data is passed back and forth and how it moves. It's like treating every firearm as loaded. You have to treat every environment as if it's compromised. That’s the bedrock of Zero Trust and the cornerstone of a sound containment strategy.
Resilience: Fighting Through an Event and Emerging Stronger
Like a boxer in a prizefight, today’s cyber teams must focus on withstanding the hit, learning from it and modifying their approach to withstand the next one. Just as no heavyweight, welterweight or featherweight fighter would enter the ring expecting to avoid punches entirely, cyber teams must expect that they’ll be hit – especially in today’s landscape being shaped by frontier models.
Zero Trust helps to protect mission-critical data from exploits. Teams can begin by understanding what data is most critical to the mission, categorizing it and triaging a Zero Trust strategy that prioritizes keeping it secure. Aligning data to the mission creates an inherent understanding that Zero Trust is not a one-and-done implementation. The mission will always evolve; so, too, will the data needs of the mission. This dictates what data is most important and necessitates a constant evaluation of your security posture.
Behavior-Based Improvement: Turning Continuous Learnings into Dynamic Cyber Posture Enhancements
Following an event – and even during it – cyber teams would be well-served to observe the hits they’re taking and make adjustments. Zero Trust creates an avenue to make access rules that are based on the observed behaviors of adversarial actors and to change things based on shifts in your environment. Again, like a boxer in a fight, your strategy may change after the first punch is thrown. You can't have a brittle, inflexible cyber architecture. It has to be agile enough to change if and when the environment changes, to be more protective against certain types of exploits, or with certain monitoring or credentialing.
Moreover, it doesn't even have to be your own “punch” that compels a shift. Headlines about other exploits, information-sharing across industries or from agencies to mission partners should all alert us to both the warnings and the opportunities for improving our cyber defenses.
At GDIT we see all the time how important containment, resilience and behavior-based improvement are. We built our Everest Zero Trust offering to be modular, interoperable and with AI-based capabilities that expands to its utility.
Looking ahead, there are going to be more and more frequent developments around frontier models and their impact on cybersecurity. The best thing teams can do today is to drive the kind of containment, resilience and behavior-based strategies that Zero Trust was made for.
