.png)
TL;DR
- IBM's 2025 Cost of a Data Breach Report found a tested incident response plan saves $2.66 million per breach, more than any other single control, including detection speed itself. Strategy beats speed.
- Firefly's Mythos campaign argues frontier AI is making prevention-based security obsolete. This piece treats that as Firefly's stated position and checks it against independently reported breach-cost and governance data instead.
- NIST CSF 2.0's six functions split cleanly into two groups: Protect and Detect reduce the odds of an incident; Govern, Identify, Respond, and Recover determine what happens once one gets through. Most security budgets still lean hard on the first group.
- Organizations with zero-trust architecture, tested incident response plans, extensive AI/automation, and law enforcement engagement in place together see breach costs below $2 million, less than half the $4.44 million global average.
- Firefly's Governance dashboard and CRPM turn "are we exposed" from a periodic audit question into a continuously scored one, the practical mechanism behind a governance-first posture rather than just the argument for one.
Security strategy has spent the last two decades leaning heavily on one bet: that with enough firewalls, patching discipline, and endpoint controls, most attacks could be stopped before they started. That bet was never fully sound; security has always talked about defense in depth, but budgets, headcount, and vendor pitches have overwhelmingly followed prevention. IBM's own 2025 research makes the strain visible: AI adoption inside security organizations is outpacing the governance built to manage it, and shadow AI usage alone now adds an average of $670,000 to the cost of a breach.
This piece looks at what happens to a prevention-heavy strategy once the threat side of the equation gets faster, using real breach-cost and governance data rather than any single vendor's framing. Part of what's driving that shift is a specific claim now circulating in security marketing: that Claude Mythos, Anthropic's frontier-tier model, has made prevention-based security strategy obsolete on its own. This piece treats that claim as a starting question rather than a conclusion and lays out what a cloud security strategy built for an AI-accelerated threat landscape actually looks like in practice.
What Firefly's Mythos Campaign Actually Argues
Firefly's campaign around Project Glasswing argues that Claude Mythos, Anthropic's frontier-tier model, has made prevention-based security strategy fundamentally obsolete, framing the question as no longer "can we stop a breach" but "how fast can we recover from one." A companion piece on this site looked specifically at the zero-day discovery claims behind that argument and how they hold up against independently documented data; this piece isn't repeating that breakdown, the short version is that the underlying trend (AI accelerating vulnerability discovery, and defenders losing ground on the discovery-to-exploitation timeline) is real and independently documented, even where Firefly's own specific figures for what Claude Mythos found during Project Glasswing remain unverified marketing claims rather than audited findings.
The strategic question worth focusing on is less whether that one campaign's numbers are exactly right and more whether the strategic conclusion holds up against real data: does a security posture built primarily around prevention still make sense? The next two sections answer that from two different angles, first the framework, then the cost data.
Why Protect and Detect Alone No Longer Cover the Risk
NIST CSF 2.0 organizes cyber resilience work into six functions, and they split naturally into two groups with very different jobs.
A strategy budget weighted almost entirely toward Protect and Detect is, in effect, a bet that odds-reduction alone is sufficient. That bet gets harder to justify as the odds themselves shift, and Govern's elevation to a standalone function in CSF 2.0 specifically reflects that shift: a resilience plan nobody at the leadership level has funded, tested, or holds accountable doesn't function as resilience, regardless of how good the underlying technical controls are. A deeper breakdown of this framework, including how to translate its abstract language into enforceable technical controls, is covered in this site's guide to cyber resilience frameworks.
What Actually Reduces Breach Cost, According to Real Data
IBM's 2025 Cost of a Data Breach Report, based on more than 6,485 breaches and interviews with over 34,000 security and business leaders, is one of the largest datasets available on this exact question, and the findings cut directly against a prevention-only strategy. The global average breach cost was $4.44 million in 2025 (down 9% from 2024, and $10.22 million in the US specifically), with the average breach lifecycle sitting at 241 days, a nine-year low but still the better part of a year.
The single biggest cost reducer in the dataset isn't a prevention control at all; it's whether an organization has a tested plan for what happens after something gets through. Organizations with all four of these controls in place together saw breach costs fall below $2 million, less than half the global average, and breaches contained within 200 days cost $1.88 million less on average than those that dragged past it. None of these four controls are about stopping an attacker from getting in. They're about what an organization can already prove, before an incident, about how it will respond once one does.
Governance as the New Security Perimeter
If Protect and Detect alone don't cover the risk, and the highest-value controls in the cost data are about response readiness rather than prevention, the practical question becomes what an organization can actually build a defensible strategy around. For cloud infrastructure specifically, that answer increasingly centers on governance: knowing what's running, whether it's compliant with policy, and whether that policy is continuously enforced rather than checked periodically.
Policy-as-code is the mechanism that makes this operational rather than aspirational. A Guardrail evaluating every Terraform plan against a defined rule, rather than a document someone reads once a quarter, is what turns "we have a policy against public S3 buckets" into something actually true at any given moment:
package firefly.guardrails.public_access
deny[msg] {
resource := input.resource_changes[_]
resource.type == "aws_s3_bucket_public_access_block"
resource.change.after.block_public_acls == false
msg := sprintf("S3 bucket %v allows public ACLs, violating baseline access policy before this plan is permitted to apply", [resource.address])
}This is the practical version of "governance as perimeter". Instead of trying to out-patch an attacker whose discovery timeline keeps shrinking, the organization controls what's allowed to exist in its own environment in the first place, checking every single change rather than waiting for the next audit cycle.
Building a Posture That Assumes Compromise
The IBM data above makes a specific case: readiness after compromise saves more than marginal prevention improvements do. Building for that requires three things working together, not as separate initiatives but as one connected posture.
Blast-radius limits restrict what a single compromised credential or misconfigured workflow can actually reach, the infrastructure equivalent of not keeping every valuable thing in one unlocked room. A Resource Rule enforcing this might look like:
package firefly.guardrails.blast_radius
deny[msg] {
resource := input.resource_changes[_]
resource.type == "aws_iam_role_policy_attachment"
resource.change.after.policy_arn == "arn:aws:iam::aws:policy/AdministratorAccess"
not resource.change.after.tags.BreakGlass
msg := sprintf("Role %v is being attached AdministratorAccess without a BreakGlass exception tag, exceeding standard blast-radius policy", [resource.address])
}Immutable recovery paths ensure that whatever a compromised credential can reach, the recovery mechanism itself sits outside that reach, so the same compromise that takes down production can't also take down the way back from it.
Continuous evidence replaces the point-in-time audit screenshot with a timestamped, tamper-evident record of every policy check, violation, and fix, so "we're compliant" and "we're prepared" are both answerable on demand rather than reconstructed under pressure during an actual incident or a surprise audit.
How Firefly's CRPM Supports This Posture Shift
Firefly's Governance dashboard is the practical home for the shift this piece is arguing for. Built-in policy categories (NIST, CIS, SOC 2, PCI DSS, HIPAA, and a dedicated Resiliency category) score compliance continuously against live infrastructure, not against a snapshot from the last audit cycle, and each violation carries severity, the specific assets affected, and a live compliance percentage rather than a static checklist entry.
Cloud Resilience Posture Management (CRPM) is specifically the scoring layer behind this: it evaluates the environment against resiliency-blocking configurations, the kinds of gaps that turn a routine incident into a prolonged one, and surfaces a resilience posture score that functions the same way the IBM cost data argues a tested incident response plan does, proof, checked continuously, rather than an assumption tested for the first time during a real breach.
For teams that want a governance answer without opening the dashboard, AI SRE handles queries like "which of our production workloads would fail a zero-trust access review right now," cross-referencing Inventory, Governance, and Event Center in a single response, turning a question that used to require manually pulling three separate reports into something checkable on demand, during a board review, an audit prep cycle, or an actual incident.
Where Should You Start With This
Checking whether the highest-value controls from the IBM data (a tested incident response plan, zero-trust boundaries, continuous governance evidence) actually exist today is a better starting point than debating how fast AI-assisted attacks might get. See how Firefly's Governance dashboard scores that readiness against a live environment, and read Firefly's own framing of the Mythos campaign directly to weigh its specific claims for yourself.
FAQs
What is the biggest factor in reducing data breach costs?
According to IBM's 2025 Cost of a Data Breach Report, a tested incident response plan is the single largest cost reducer, saving an average of $2.66 million per breach, more than detection speed, AI and automation, or zero-trust architecture individually.
Why isn't prevention-only security sufficient anymore?
Prevention controls (Protect and Detect in NIST CSF terms) reduce the odds of an incident but don't determine what happens once one gets through. Breach-cost data shows that response readiness, tested plans, zero trust, and continuous governance save more money than incremental prevention investment at this point.
What does "assume compromise" mean in practice?
It means building blast-radius limits so a single compromised credential can't reach everything, keeping recovery paths immutable and outside what a compromised environment can touch, and maintaining continuous, timestamped evidence of policy compliance rather than relying on periodic audits.
What does Claude Mythos have to do with cloud security strategy?
Firefly's marketing argues that Claude Mythos, Anthropic's frontier-tier model, has made prevention-based security strategy obsolete and that recovery speed is the more defensible strategic focus. These are Firefly's own stated claims about a program called Project Glasswing; specific figures cited in the campaign aren't independently verified.
How does Firefly's CRPM support a governance-first strategy?
CRPM continuously scores an environment against resiliency-blocking configurations and compliance policies across frameworks like NIST, SOC 2, and PCI DSS, turning governance from a periodic audit exercise into a live, checkable posture score, with AI SRE and Event Center providing on-demand answers and a timestamped evidence trail behind it.
Is zero-trust architecture worth the investment?
IBM's 2025 data found organizations with zero-trust architecture saved an average of $1.76 million per breach compared to those without it, one of the four largest cost-reduction factors identified in the report, alongside tested incident response plans, AI/automation use, and law enforcement involvement.
.avif)
.avif)
.webp)
.webp)
