What we built, how the components fit, what an agent actually does, what the policy gate prevents, and what ninety days inside your environment looks like. Written for engineering leaders who want to understand the system before they sign for it.
Next-Era LLC · v0.2 · keys: ↓ F T ?
Order-of-magnitude figures that frame the operating reality. These are the constants every solution in this space must respect.
The reason this becomes a fabric-and-agents problem rather than a "buy more analyst seats" problem.
AI tools diff vendor patches against unpatched binaries and reconstruct vulnerabilities in hours. Open-source codebases get audited at scale. Cost of discovery: collapsed.
Public proof-of-concept exploits arrive within days. Ransomware operators automate target selection straight from CISA KEV. Cost of exploitation: collapsed.
Same analyst headcount. Same change-advisory boards. Same scarce OT maintenance windows. Cost of response: unchanged. This is now the binding constraint.
A change in shape, not just speed. The legacy pipeline is human-relay; the fabric is machine-orchestrated with humans at named gates.
Scanner → Ticket → Triage
→ CAB → Window planning
→ Tech → Reboot → Verify
→ Manually log evidence
Scanner → Agent fabric
→ Signed handoffs
→ Policy gate
→ Executor / OT veto path
→ Verifier → Closed
The word does a lot of work in trade press. Here it has a precise, bounded definition. Reassuring rather than alarming.
Drives FSM. Dispatches specialists. Claude Opus 4.7.
Qualys · Tenable · Wiz · Claroty · Nozomi · Dragos
NVD · KEV · EPSS · PSIRTs · ICS-CERT
Vendor fix + reliability score 0–1
CMDB join · dependency graph · BIP
Historical failure rate · window · canary
Veto on OT / CCS. NIST 800-82r3 + IEC 62443.
Steps · order · approvals · rollback
Ansible · SCCM · Tanium · Panorama · OT-native
Rescan · health · exploit retest
TSA · NIST · IEC evidence units
Beyond CVE flow · EOL · sprawl · shadow IT
Qualys reports CVE-2026-XXXXX on asset corp-fileserver-042. Canonical VulnerabilityFinding emitted. Trace ID assigned.
KEV=true · EPSS=0.81 · exploit_in_wild=true. Microsoft KB located. PatchReliabilityScore=0.94.
BusinessImpactProfile: criticality=High · 17 downstream · regulated. ChangeRiskScore=0.18 · canary peer available.
6-step plan with rollback. Tool: sccm. Window: 02:00–06:00 nightly canary ring. Approval scope: security.
Criticality ≤ High but auto-apply caps at Medium → routes to single_approval. Plan enters AWAITING_APPROVAL.
SCCM pushes the KB. Rescan confirms. Evidence units emitted under NIST CSF RS.MI-01 and TSA SD §3.D.
You hold veto rights on any action touching
an OT-zone asset or a Critical Cyber System.
Default to refusing direct patches.
Propose compensating controls instead:
· industrial firewall ACL tightening
· IPS signature (virtual patch)
· monitored isolation
Schedule firmware updates only inside a
planned maintenance window with dual
approval and a tested rollback recorded.class OTSafetyRequest:
vuln_id: str
asset_id: str
asset_env: "IT" | "OT" | "DMZ"
is_ccs: bool
patch: Patch | None
impact: BusinessImpactProfile
risk: ChangeRiskScoreveto: bool — defaults true for OT/CCSrationale: str — auditor-readablecompensating_controls: [...]scheduled_for: datetime — next windowrequires_approval: ["security", "ot_operations"]security AND ot_operations Approval rowsThe agents propose. The policy disposes. The seven default rules are visible, versioned, and overridable per-tenant under change control.
| Rule ID | Condition | Decision |
|---|---|---|
SG-POL-001 | Critical Cyber System change request | dual_approval (security + ot_operations) + open window + validated rollback · else deny |
SG-POL-002 | Any OT-zone asset | dual_approval · OT Safety Officer sign-off required |
SG-POL-003 | IT asset · criticality ≤ Medium · reliability ≥ 0.85 · canary peer · window open · rollback valid | auto_apply |
SG-POL-004 | Default IT remediation | single_approval (security) |
SG-POL-005 | Tool target outside allowlist | deny — no exfiltration to non-allowlisted destinations |
SG-POL-006 | Rollback plan missing or fails dry-run validation | deny — reversibility required |
SG-POL-007 | Active change blackout window | deny — blackouts honored regardless of severity |
The chronological record an engineer reads to debug is the same record an auditor reads to assess control coverage. Generated, not assembled.
trace_id: 01HF9N3K7Z4Q8M2R5T1V6W9Y8X · CVE-2026-19110 · mcr-ruggedcom-east-014
[16:42:01] scanner_liaison INGEST Normalized from claroty. CVSSv3=9.6.
[16:42:02] threat_intel ENRICH KEV=true · EPSS=0.84 · ransomware_associated=true.
[16:42:03] patch_hunter HUNT Siemens fix 5.7.0 located. Reliability 0.91.
[16:42:04] impact_analyst IMPACT Asset env=OT zone=PTC-Wayside is_ccs=true downstream=23.
[16:42:05] change_risk RISK Score 0.62 · canary required · failure rate 0.18.
[16:42:06] ot_safety_officer VETO Asset is CCS in OT zone. NIST 800-82r3 §6.2 and IEC
62443-2-3 require change inside maintenance window
with dual approval. Proposing compensating controls.
[16:42:06] ot_safety_officer CONTROL acl: tighten Industrial Firewall ACL between Corp DMZ
and PTC-Wayside zone. deny default. log denies.
[16:42:06] ot_safety_officer CONTROL ips_signature: deploy on Cisco Firepower in alert+block
mode after 30-minute alert-only soak.
[16:42:06] ot_safety_officer SCHEDULE Firmware update scheduled for next OT maintenance
window: 2026-06-04 01:00 UTC.
[16:42:07] remediation_planner PLAN 3-step compensating-control plan. Status AWAITING_APPROVAL.
Required: security + ot_operations.
signature: HMAC-SHA256:7c4e9a1f3b...8d2e0f · ledger tamper-evidentEverything to this point fires when a CVE drops. Inventory Insights runs continuously on the full estate and surfaces risk that no scanner has yet reported.
OS / software below the supported security baseline. e.g. Windows Server 2022 build < 20348.2700.
OT vendors below recommended minimum. Siemens RUGGEDCOM < 5.7.0 · Wabtec WIU < 3.2.0.
Same vendor + product running ≥3 distinct versions across the estate. Multiplies CVE response cost.
Critical Cyber Systems flagged but lacking a documented owner in CMDB. TSA SD 1580 §3.B violation.
The pilot stands up alongside everything you already run. Connectors are read-only on the source side; only the Executor agent writes — and only through tools you already operate.
Mythal runs in a dedicated tenant — SaaS or single-VM on-prem appliance. Read-only into your scanners and CMDB. Write only through the patch tools your team already operates, gated by OPA policy and your approvers.
┌─────────────────────────────────────────────────────────────────────┐ │ YOUR ENVIRONMENT │ │ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ Qualys │ │ Defender │ │ Claroty │ ← scanners │ │ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ (read-only) │ │ │ read-only │ │ │ │ ▼ ▼ ▼ │ │ ┌───────────────────────────────────────────────────┐ │ │ │ Mythal Tenant (your VPC or on-prem) │ │ │ │ Postgres · Redis · Agent fabric · Policy gate │ │ │ └─────────────────────────┬─────────────────────────┘ │ │ │ │ │ ┌────────────────┼────────────────┐ │ │ ▼ ▼ ▼ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ SCCM │ │ Panorama │ │ Claroty SRA │ ← patch tools │ │ │ (you) │ │ (you) │ │ (you) │ (you operate) │ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ ServiceNow │ │ Splunk │ │ Archer │ ← ITSM/SIEM/GRC │ │ │ (you) │ │ (you) │ │ (you) │ (we feed) │ │ └─────────────┘ └─────────────┘ └─────────────┘ │ └─────────────────────────────────────────────────────────────────────┘
A bounded engagement designed to produce an internal advocate and a measurable result before any commercial discussion.
Pilot scope. Roughly 2,000 IT assets and 100 OT assets is enough surface for a complete demonstration of the closed loop and the veto path. Production roll-out scales the same pattern.
Stand up in 30. Operate for 30. Auditor + broker walkthrough in the last 30. Joint go / no-go decision at day 90. No commercial commitment until you say green.
We want the evidence package validated against your auditor's expectations and the attestation reviewed against your renewal cycle. Both unlock measurable year-one ROI ($1.2–2.4M premium relief at typical Class I scale).