Every few months a headline suggests that attacks have changed overnight. In April 2026 it was Anthropic’s Claude Mythos Preview. The company said the model could find and exploit software vulnerabilities better than all but the most skilled people, and set up Project Glasswing with AWS, Apple, Google, Microsoft, CrowdStrike, Palo Alto Networks, the Linux Foundation and others to help secure critical software.
There will be another headline next quarter, and one after that. The lesson does not change with them: there is no such thing as 100% security.
The Gap That Matters Is Shrinking
Attack tools are improving, and so is automation. The real change is not that a model can do impressive things in a lab. It is that the distance between “possible in theory” and “usable in practice” keeps getting shorter.
For a defender that distance is the time available to patch. When it shrinks from months to weeks, or from weeks to days, a team that patches once a quarter is no longer just slow. It is exposed.
Security Is a Habit, Not a Purchase
Security is not something you buy once, install once, document once and then assume is handled. It is an operating discipline. It lives in visibility, patching speed, access control, monitoring, backups, training, incident response and plain good engineering.
The organisations that handle it well are rarely the ones promising perfection. They are the ones that react faster, reduce exposure earlier and recover with less chaos when something does get through.
Three Realistic Goals
- Harder to break. Fewer systems and plugins exposed, updates applied quickly, strong authentication on every admin account, and no access that nobody uses.
- Faster to detect. Monitoring and alerts that a named person actually reads and acts on.
- Quicker to recover. Backups that have been restored at least once, and a short written plan for who does what when something goes wrong.
Anyone selling “complete protection” is selling comfort, not security. No vendor, internal team, stack or policy can honestly promise it. What they can do is raise the cost of an attack, reduce the damage when one succeeds and make recovery less painful.
What We Would Do First
- List every system, plugin, integration and admin account, and who owns each one.
- Set a patching rhythm measured in days for critical updates, not in quarters.
- Turn on multi-factor authentication for every admin, hosting and domain account, and remove old accounts.
- Put monitoring in place with alerts that go to a person, not to a shared inbox nobody reads.
- Restore a backup to a test environment and time how long it takes.
- Write a one-page incident plan: who decides, who calls whom, who talks to customers.
None of this is exciting. It is also where most real incidents are won or lost.
What It Means for You
The useful question is not whether you are safe. It is how fast you would notice, and how much it would hurt. This is the work behind Sentinel, our managed security service. If you want us to look at where your website or shop stands, book a 20-minute call. If you are in good shape, we will tell you.