Deep|Glasswing/Mythos: AI-Native Cyber Capability Drives a Reshaping of the Cybersecurity Value Chain and Sector Divergence

Executive Summary

On June 2, Anthropic expanded Project Glasswing to nearly 200 partners. We do not view this as a simple expansion of a frontier-model pilot. Rather, we see it as an important signal that AI-native cyber capability is beginning to enter real-world enterprise and critical-infrastructure security workflows.

In industry terms, models such as Claude Mythos Preview are likely to push the marginal cost of vulnerability discovery another step lower, while shifting the center of gravity in cybersecurity from "finding vulnerabilities" toward later-stage, more closed-loop workflows such as validation, prioritization, remediation, response, and governance.

We expect this to drive more pronounced dispersion within the cybersecurity group. Vendors with platform breadth, cross-domain telemetry, enterprise workflows, remediation loops, and security-operations control points should be better positioned to capture the incremental value created by this technology shift. By contrast, companies whose business models still depend on traditional vulnerability scanning, low-end SAST, point AppSec scanners, or commoditized SOAR automation could face the dual pressure of functional commoditization and multiple compression.

At the public company level, we are more constructive on platform vendors capable of supporting an end-to-end security loop, including PANW, MSFT, CRWD, GOOGL, and CYBR. Conversely, QLYS, TENB, RPD, and parts of the lower-end AppSec / SAST tooling market should be viewed with caution, as their medium-term narratives could come under pressure.

I. Event Background: Glasswing Is Moving From Capability Validation to Controlled Scaled Deployment