Mythos-Ready Application Security Checklist

All cloud, SaaS, infra & AI agent surfaces documented. SBOMs generated for all builds.

Third-party libraries reviewed. Known high-severity CVEs in open-source dependencies flagged.

MCP servers, LLM integrations, agentic workflows added to scope, not just traditional endpoints.

Current mean time to patch critical vulnerabilities documented. Target: under 24 hrs for critical, internet-facing issues.

Incident response plans updated for multi-vector, AI-assisted attack scenarios, not just single-CVE events.

Phishing-resistant MFA enforced, least-privilege access confirmed, secrets rotation current, extended to repos and git history: branch protection, mandatory PR review, and no leaked credentials in history.

Clear policy for what proprietary source code can be shared with AI coding tools. Vendor data-retention terms reviewed.

Tester maps multi-step attack paths across identity, app, infra, not isolated vulnerabilities.

Engagement uses AI tooling to surface vuln classes automated scanners and humans miss.

Mean time to detect (MTTD) and contain (MTTC) actively measured during simulated attack sequences.

Project Glasswing vendor patches reviewed. Confirm your stack has absorbed the latest disclosure wave.

Outbound traffic controls tested. Data exfiltration paths mapped and validated.

If AI agents or LLM pipelines are in scope, tested for unsanctioned actions and privilege escalation.

Vulnerabilities prioritised by exploitability and chain potential, not just CVSS score in isolation.

Critical, internet-facing: patch within 24 hrs. High: 7 days. No quarterly maintenance-window exceptions.

Detection and containment times documented. Used to update board-level risk metrics going forward.

All flagged third-party library vulnerabilities triaged and patched. SBOMs updated to reflect current state.

The natural next step after your first pentest: a dedicated secure code review, not just automated scanning, for hardcoded secrets, injection flaws, and business-logic gaps.

Secure code review vulnerabilities remediated and revalidated. Confirms fixes hold before the next engagement cycle.

Playbooks revised based on attack paths found. Multi-simultaneous zero-day scenarios explicitly covered.

Continuous cadence confirmed. Point-in-time testing is insufficient in an AI-accelerated threat environment.