What happens when cyber vulnerabilities can be discovered and exploited faster than your organization can safely deploy a patch?
In this episode of Let’s Solve IT!, Matt Brown welcomes back Gavin Guttersen, NetApp CISO, to discuss how AI-powered cyber models are transforming the threat landscape. They explore why traditional patching timelines may no longer be fast enough, how years of accumulated security debt are increasing organizational risk, and why the long-standing expectation of zero downtime may need to be reconsidered.
You’ll hear:
- How AI is dramatically lowering the barrier to entry for cyber attackers
- Why vulnerabilities that once took weeks to exploit can now be weaponized in minutes
- How security debt and aging infrastructure increase business risk
- Why faster patching can create operational risk and unexpected downtime
- How to identify the systems, applications, and data your business cannot afford to lose
- Why limiting the potential blast radius is critical when preventing every breach is unrealistic
- How IT, security, system owners, and business leaders should share responsibility for cybersecurity decisions
- What organizations can do in the short, mid, and long term to prepare for AI-accelerated threats
The question is no longer whether an attacker will get in. It’s whether your organization knows what matters most and is prepared to minimize the impact when a breach occurs.
You are not alone. Let’s Solve IT.
Learn More
IT case studies | NetApp
Connect with us!
https://www.linkedin.com/in/cmattbrown
https://www.linkedin.com/in/gaving
Gavin Gutterson on AI cyber models: why zero downtime is becoming a security risk
Episode overview
In this episode of "Let's Solve IT!," host Matt Brown talks with Gavin Gutterson, NetApp's CISO, about how AI-powered cyber models have changed the calculus around uptime and patching. Gavin Gutterson explains that a model called Mythos, along with competing AI cyber models racing to outpace each other, can now identify critical vulnerabilities in decades-old platforms and generate working exploits "in a matter of minutes." Gavin Gutterson states plainly: "This is just the beginning. This is the very, very tip of the iceberg."
The main argument from Gavin Gutterson centers on a shift in IT's core assumption. IT organizations have always prioritized always-on availability, patching systems on a 30-day cycle after testing in subproduction environments. Gavin Gutterson argues that this timeline no longer works when AI can create exploits in hours, and he raises a direct question for IT leaders: how do you patch in 30 minutes when your process was built for 30 days?
Gavin Gutterson also introduces "security debt" as the security equivalent of technical debt: outdated, unpatched systems (Gavin Gutterson cites Windows 98 as a real example still running inside NetApp for regression testing) that accumulate risk over time. Gavin Gutterson's recommended response involves three levers: cleaning up old systems, adding compensating controls around systems that cannot be patched, and limiting the "blast radius" when, not if, a bad actor gains access.
Key takeaways
The following takeaways summarize the guidance Gavin Gutterson shared for IT and security leaders managing AI-accelerated cyber risk.
- AI cyber models, including Mythos, can find critical vulnerabilities and build exploits for them in minutes, a process that previously took bad actors months.
- Mythos is not the only AI cyber model driving this shift; Gavin Gutterson describes multiple models "playing leapfrog with each other," each improving over the last.
- Traditional patching cycles (30 days, with testing in subproduction before deployment to production) cannot keep pace with AI-generated exploits that emerge in hours.
- Security debt describes the accumulation of outdated, unpatched systems in an environment, and Gavin Gutterson equates it directly with technical debt.
- Organizations should decommission any system not required for business operations, then clean up what remains, according to Gavin Gutterson's recommended approach.
- Three risk-management levers exist for every organization: clean up existing systems, add controls around systems that cannot be patched, and limit the blast radius when a breach occurs.
- Not every system requires the same protection level; Gavin Gutterson distinguishes between systems tied to an "extinction level event" for the business and lower-priority systems.
- Security ownership belongs to whoever owns the system or environment (marketing, customer support, or any other business unit), not solely to the security or IT team.
- Leadership, not IT alone, bears responsibility for balancing uptime against security risk, because Gavin Gutterson frames this as a business decision.
- Gavin Gutterson's top three pieces of advice for fellow CISOs: don't over-rotate, inventory the problem before acting, and communicate with leadership in business terms.
Topics and themes
This episode covers the operational and organizational impact of AI-accelerated cyberattacks, framed around patching speed, security debt, and risk ownership.
- AI cyber models and exploit generation: how models like Mythos identify vulnerabilities and build exploits in minutes rather than months.
- Patching velocity versus operational risk: the conflict between rapid-response patching and the standard subproduction-to-production testing process.
- Security debt versus technical debt: outdated, unpatched systems as a growing liability, illustrated by legacy platforms like Windows 98.
- Zero-downtime paradigm under pressure: whether always-on availability remains realistic given the current threat landscape.
- Risk tolerance and extinction-level events: identifying which systems absolutely cannot go down versus which systems carry lower priority.
- Blast radius limitation: reducing the scope of damage a bad actor can cause after gaining access, rather than assuming breaches can be fully prevented.
- Security ownership across business units: the distinction between who sets security policy and who executes it within their own environment.
- Leadership accountability: framing uptime-versus-security tradeoffs as business decisions rather than purely technical ones.
Notable quotes
- "Had you asked me that three months ago, my answer would've been 100% different than it would be today." (01:22)
- "Something that might've taken a bad act for months in the past was now being accomplished in literally a matter of minutes." (01:41)
- "Oh, this is just the beginning. This is the very, very tip of the iceberg. Everybody is going to keep leapfrogging." (03:28)
- "If I've got something that's end of life, close to end of life, considering coming up on end of life, I need to be getting rid of it as rapidly as possible." (03:28)
- "It is not good enough now to patch things once a month, once a quarter, once a year, not when the bad actors can create an exploit in a matter of hours. Those days are gone." (08:12)
- "There are two or three things that I would consider an extinction level event. Things that absolutely cannot ever happen to this company. So I would start by focusing on those things and making sure that you absolutely protect that, limit that blast radius." (09:01)
AI cybersecurity, zero downtime, security debt, technical debt, AI cyber models, vulnerability management, patch management, cyber risk, operational risk, cyber resilience, legacy systems, security hygiene, blast radius, ransomware, data security, risk management, CISO, business continuity, enterprise security, responsible AI, NetApp, Gavin Guttersen, Let’s Solve IT
