Ep. 12 - Is zero downtime becoming your biggest cybersecurity risk?

What happens when cyber vulnerabilities can be discovered and exploited faster than your organization can safely deploy a patch?

In this episode of Let’s Solve IT!, Matt Brown welcomes back Gavin Guttersen, NetApp CISO, to discuss how AI-powered cyber models are transforming the threat landscape. They explore why traditional patching timelines may no longer be fast enough, how years of accumulated security debt are increasing organizational risk, and why the long-standing expectation of zero downtime may need to be reconsidered.

You’ll hear:

How AI is dramatically lowering the barrier to entry for cyber attackers Why vulnerabilities that once took weeks to exploit can now be weaponized in minutes How security debt and aging infrastructure increase business risk Why faster patching can create operational risk and unexpected downtime How to identify the systems, applications, and data your business cannot afford to lose Why limiting the potential blast radius is critical when preventing every breach is unrealistic How IT, security, system owners, and business leaders should share responsibility for cybersecurity decisions What organizations can do in the short, mid, and long term to prepare for AI-accelerated threats

The question is no longer whether an attacker will get in. It’s whether your organization knows what matters most and is prepared to minimize the impact when a breach occurs.

You are not alone. Let’s Solve IT.

Learn More IT case studies | NetApp

Connect with us! https://www.linkedin.com/in/cmattbrown https://www.linkedin.com/in/gaving

Gavin Gutterson on AI cyber models: why zero downtime is becoming a security risk Episode overview In this episode of "Let's Solve IT!," host Matt Brown talks with Gavin Gutterson, NetApp's CISO, about how AI-powered cyber models have changed the calculus around uptime and patching. Gavin Gutterson explains that a model called Mythos, along with competing AI cyber models racing to outpace each other, can now identify critical vulnerabilities in decades-old platforms and generate working exploits "in a matter of minutes." Gavin Gutterson states plainly: "This is just the beginning. This is the very, very tip of the iceberg." The main argument from Gavin Gutterson centers on a shift in IT's core assumption. IT organizations have always prioritized always-on availability, patching systems on a 30-day cycle after testing in subproduction environments. Gavin Gutterson argues that this timeline no longer works when AI can create exploits in hours, and he raises a direct question for IT leaders: how do you patch in 30 minutes when your process was built for 30 days? Gavin Gutterson also introduces "security debt" as the security equivalent of technical debt: outdated, unpatched systems (Gavin Gutterson cites Windows 98 as a real example still running inside NetApp for regression testing) that accumulate risk over time. Gavin Gutterson's recommended response involves three levers: cleaning up old systems, adding compensating controls around systems that cannot be patched, and limiting the "blast radius" when, not if, a bad actor gains access. Key takeaways The following takeaways summarize the guidance Gavin Gutterson shared for IT and security leaders managing AI-accelerated cyber risk.

AI cyber models, including Mythos, can find critical vulnerabilities and build exploits for them in minutes, a process that previously took bad actors months.

Mythos is not the only AI cyber model driving this shift; Gavin Gutterson describes multiple models "playing leapfrog with each other," each improving over the last.

Traditional patching cycles (30 days, with testing in subproduction before deployment to production) cannot keep pace with AI-generated exploits that emerge in hours.

Security debt describes the accumulation of outdated, unpatched systems in an environment, and Gavin Gutterson equates it directly with technical debt.

Organi