The Observability Gap in the Mythos-class Era

Imagine a town that invested in the fastest fire response in the world. Bigger engines, rapid dispatch and crews that can be rolling in seconds. But when fires begin to happen, you discover the thing nobody wanted to talk about when the trucks were purchased: Some buildings aren't on the city map, some of them have no smoke detectors, and dispatch has no way to tell a hospital from a garden shed.

This is the position a lot of enterprises are quietly in right now. Asset inventories and CMDBs are immature; many applications are not instrumented for telemetry collection; and IT operations teams don't know the interdependencies between applications and infrastructure systems. 

Here are the uncomfortable questions I put to you

1. Do you know all of what you own across the enterprise?
2. Are you effectively monitoring it?
3. Do you know how it is supposed to work, be configured and what good actually looks like for it?

Because every modern security priority silently assumes the answer is yes. Continuous Threat Exposure Management assumes it. Exploit prioritization assumes it. Agentic AI remediation assumes it. The platforms in this space typically assume that clean data is flowing in from known systems and the signal-to-noise is good.

When I work with clients developing agentic AIOps strategies, I use WWT's framework of four pillars: Observability (comprehensive visibility), AI Reasoning (reasoning on top of that visibility), Deterministic Automation (governed execution/responses) and Data Foundation (sources of truth, config intent, criticality, prioritization). The market, and a lot of the Mythos conversation, is heavily weighted toward pillar three, with some of pillar two. Pillars one and four, Observation and Data Foundation, tend to be treated as assumptions. They are not assumptions. They are the map and the smoke detectors for your response teams. You must know what you own, how it's supposed to be configured, how it should perform and when to be alerted when something is wrong before any downstream analysis or response works.

Furthermore, Mythos just raised the stakes and shortened the clock. The industry is quickly moving from vulnerability management to exploitability management. Cybersecurity teams and IT operations teams must be able to connect the exploitability of systems to their associated blast radius and business impact. This will be the key to making sure your trucks respond to the most urgent fires.  

To the cyber defenders

Review our security practice's recommended themes for a new era security playbook outlined in Defending at the Speed of AI.  "Strengthening the Foundation" is theme number one.  

If your scanner finds a new endpoint, can your operational teams tell you the blast radius and associated business impact? Don't assume your scanning tool eliminates the need to collaborate with the IT Operations team. Operations owns IT assets, services, application dependencies, business impact and operational risk. Thus, they're accountable for delivering this capability. Your scanner is a discovery tool for exactly one job: What is vulnerable right now. It can tell you a server has a particular CVE. It cannot tell you whether that server is supposed to exist, who owns it, what it's supposed to communicate with, whether it's tier-one or a forgotten test box or what its blast radius is if it falls. That is a completely different problem. It's the enterprise asset-truth problem, and it lives in the domains of observability and IT governance, not in a scan result. 

Going even a step further, do your operations teams have tools that allow you to pull that information programmatically at machine speed? Your agentic AI security capabilities can only respond as fast as the data they have access to. If critical operational context still requires manual collection or validation, those manual steps become the bottleneck, limiting the speed and effectiveness of your automated response.

To the IT folks who keep the lights on

If your enterprise is still fighting for budget to gain comprehensive visibility across the environment (and most are), there is no world in which the security team's asset picture is fully trued up. The gap between both security and IT operations inventories isn't a data-hygiene annoyance. That gap is an attack surface.  It's the set of buildings that aren't on anyone's map and exactly where an adversary can grab a quiet foothold. 

As the cybersecurity teams look to employ more novel tools to protect the enterprise, you must provide the maps and get the smoke detectors installed. And if you still think that having some infrastructure automation capabilities would be a nice-to-have, think again; they're mandatory now. When your enterprise gets a compromised system (not if, but when), do you really think your infrastructure team's response can keep up with an adversarial AI agent at work? 

Another conversation I consistently have with organizations is about the pain and cost of observability tools and logging storage. Everyone wants to shrink storage footprints and reduce tool costs; frankly, they should. Optimization matters and fiscal responsibility matters. But observability and logging aren't just an operational expense to be minimized; they also serve your security defense strategy. Telemetry and tools provide the critical context that security depends on, and in ways that are a part of that same investment. And if you're still on the fence on spending more for observability and logging, sit with this question: As security complexity grows and AI consumes more data, do you honestly expect your logging data needs to shrink?

Conclusion

I keep coming back to the telemetry pipeline and a source of truth as a security concern, not just an operations one. The operations and security teams must have a shared understanding of the current environment, including asset inventory, telemetry, configuration intent, baseline behavior, exposure and blast radius. If you glean anything from this article, remember, you cannot defend an estate you do not understand and cannot see.