For Cybersecurity Awareness Month, Michael Lawrence, Marketing Director at Dahua Technology, pictured, examines how AI is changing vulnerability discovery – and why effective cybersecurity depends not only on prevention, but also resilience throughout the supported product lifecycle.ย
In April 2026, Claude Mythos found a vulnerability in OpenBSD that had survived 27 years of human review. This was a striking discovery for an operating system that has long had a reputation for security. That a vulnerability could remain hidden for nearly three decades in such closely scrutinised software is a reminder of the challenge facing the technology industry. If even mature and extensively reviewed systems can have undiscovered weaknesses, is preventing vulnerabilities enough to keep users secure?
AI changes the landscape
The development of increasingly capable AI systems has significant implications for cybersecurity. On the positive side, systems like Claude Mythos can help identify vulnerabilities that would otherwise remain undiscovered. โMythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser,โ Anthropic said on April 7. Anthropicโs testing found that Mythos could identify and exploit zero-day vulnerabilities in major operating systems and web browsers. In some cases, it produced exploits in hours that expert penetration testers estimated would have taken weeks to develop. However, there is another side to this development. The same technology that makes it easier for security researchers to identify vulnerabilities could make similar capabilities available to cybercriminals. The result is likely to be a cybersecurity environment in which vulnerabilities can be discovered – and potentially exploited – faster than many organisations are prepared to respond. ย ย
Security beyond prevention
Cybersecurity has traditionally focused on prevention and manufacturers have therefore invested in secure product design, code reviews, penetration testing and regular software updates. These measures remain essential, but the OpenBSD example shows that even extensive scrutiny cannot guarantee that every vulnerability will be found. Software is inherently complex. Products can contain millions of lines of code as well as open-source components and third-party libraries, creating dependencies whose risk profiles can change as new vulnerabilities and attack techniques emerge. OpenBSD itself says its security team has been auditing code since 1996, carrying out โa comprehensive file-by-file analysis of every critical software componentโ. It also notes that code can be audited several times by different people, as new types of security problems emerge. For us at Dahua, there is an important lesson here. Prevention remains fundamental to cybersecurity, but it cannot be the end of the story. Effective cybersecurity also requires the capability to identify, assess and address new risks as they emerge. For our customers, this means security should not be viewed only at the point when a product is purchased.
What should customers look for?
How a manufacturer manages security throughout the product lifecycle – including how it communicates security updates, support periods and end-of-life plans – matters too. Customers cannot reasonably be expected to inspect the source code behind every product they procure or deploy. They need to be able to trust that manufacturers have the systems and expertise to identify and respond to new threats after products have been installed. At Dahua, this is why we focus on vulnerability response as an important part of our wider approach to cybersecurity.
Questions to ask
We have a dedicated Product Security Incident Response Team (PSIRT), responsible for receiving, handling and publicly disclosing security vulnerabilities related to our products and solutions. Our team monitors cyber security incidents globally and provides 24/7 emergency response services. We have also developed our vulnerability management process in compliance with ISO/IEC 30111, which addresses vulnerability handling and remediation, and ISO/IEC 29147, which provides requirements and recommendations for vulnerability disclosure. For customers considering any technology supplier, these are useful questions to ask. Does the manufacturer have a dedicated security team? Is there a clear route for researchers and customers to report concerns? Are security advisories published and updates made available when action is required? The practical benefit is that security does not end at installation. There is an established process through which potential problems can be reported, assessed and addressed over the supported lifetime of a product.
A shared responsibility
Manufacturers are not the only organisations with a role to play. Integration partners, and installers also play an important part in ensuring that that security updates are installed, manufacturer advisories are monitored and products are appropriately configured and maintained. A manufacturer can identify a vulnerability and provide a fix, but effective cybersecurity depends on action across the wider ecosystem. At Dahua, we therefore see cybersecurity as an ongoing relationship between manufacturers, customers, partners and the wider security community. Claude Mythos finding a vulnerability overlooked during 27 years of human review offers a glimpse of how AI could change cyber security. Used defensively, these tools could help find and fix weaknesses that might otherwise remain hidden. In the wrong hands, they could also make those weaknesses easier to exploit.
From prevention to resilience
For us, the take-away is that prevention matters less. It is that prevention must be backed by resilience – the people, processes and capabilities needed to identify, assess and respond when new risks emerge. For customers, this changes what good cybersecurity practice looks like. Security at the point of purchase remains important, but so does the support available throughout the lifetime of a product. As AI makes vulnerabilities easier to find, customers should look not only at whether a product is secure today, but at what its manufacturer is doing to help keep it secure tomorrow.
