Claude Mythos: Key Capabilities and What It Means for Cybersecurity

What Is Claude Mythos? 

Claude Mythos is a powerful artificial intelligence model made by Anthropic that is restricted from the general public because it can easily find and use cybersecurity flaws. In addition, the model provides strong capabilities in areas such as software engineering, scientific research, and complex knowledge work. Anthropic introduced Mythos as a model tier above its Opus family, reflecting a substantial increase in capabilities.

Unlike Anthropic’s broadly available Claude models, Mythos models have generally been restricted to vetted organizations because of their advanced capabilities in sensitive domains. Mythos access is provided primarily through initiatives and trusted-access programs such as Project Glasswing, intended for cyberdefenders and critical infrastructure organizations.

Claude Mythos capabilities and benchmarks:

• Autonomous zero-day discovery in open-source code: Mythos independently found vulnerabilities across major operating systems and browsers.
• Exploit generation in the Firefox JavaScript engine test: Mythos Preview achieved an 85.2% combined exploit and register-control success rate, compared with 7.6% for the previous model generation.
• Context window and output limits: Mythos supports a 1 million-token context and 128,000-token output.

Project Glasswing:

• Anthropic created Project Glasswing to share Mythos safely.
• Only select tech companies and organizations get access.
• Trusted partners include Microsoft, Apple, and NVIDIA, as well as security vendors like Palo Alto, Crowdstrike, and Checkmarx.
• These groups use Mythos to scan critical software and fix security bugs before bad actors find them.

Claude Mythos Model Versions and Release Timeline 

Claude Mythos Preview and the March 2026 Leak

Claude Mythos first became publicly known in March 2026 after unpublished Anthropic materials were inadvertently exposed through a misconfigured content management system. Fortune reported on March 26 that the publicly accessible material included draft information about an unreleased model called Claude Mythos. Anthropic subsequently acknowledged that it was testing a new general-purpose model with early-access customers.

Anthropic formally announced Claude Mythos Preview on April 7, 2026, alongside Project Glasswing, an initiative intended to give major technology companies, critical infrastructure providers, open-source organizations, and other cyberdefenders early access to advanced AI cybersecurity capabilities.

Mythos Preview was a general-purpose frontier model rather than a model exclusively designed for security. However, Anthropic found that its improved coding and agentic capabilities also made it exceptionally capable at vulnerability research. The company reported that the model could autonomously identify, reproduce, and in some cases develop exploits for previously unknown software vulnerabilities.

Claude Mythos 5 and Claude Fable 5

Anthropic released Claude Mythos 5 and Claude Fable 5 on June 9, 2026. Mythos 5 was the production successor to Mythos Preview, with improvements across areas including cybersecurity, biology, healthcare, coding, and general knowledge work.

Claude Fable 5 and Mythos 5 were based on the same underlying model. The main difference was their safety configuration. Fable 5 included safeguards that restricted certain advanced cybersecurity and biological capabilities, making it suitable for broader availability. Mythos 5 provided selected organizations with reduced cybersecurity restrictions so they could perform defensive activities such as vulnerability research and security testing.

Subsequent Releases

In September, 2026, Anthropic introduced the first follow-on release of Claude Mythos 5.1 and Claude Fable 5.1. As with the previous generation, the two products use the same underlying model but operate with different safeguards and access policies. To learn about current releases, see the official Claude Mythos and Claude Fable pages.

What Is Project Glasswing? 

Project Glasswing is an Anthropic-led initiative that gives vetted organizations access to advanced AI for defensive cybersecurity. Participants use Claude Mythos to find software vulnerabilities, support remediation, and develop practices for managing AI-generated security findings.

• Goals and defensive use rules: Glasswing aims to strengthen cyberdefenders through authorized vulnerability research and exploit validation. Access is restricted, use is limited to cybersecurity, and Anthropic monitors for prohibited or potentially harmful activity.
• Sharing findings and disclosing vulnerabilities: Participants are encouraged to exchange security practices, while Anthropic publishes aggregate research. Individual vulnerabilities are validated and privately reported to maintainers, with technical disclosure delayed to allow remediation; some undisclosed findings receive cryptographic commitments.
• Security vendor participation: Founding partners CrowdStrike and Palo Alto Networks evaluated Mythos Preview for enterprise defense and software vulnerability discovery. Checkmarx joined the program in September 2026, focusing on application security research, vulnerability detection, and sharing lessons with the security community.
  For a closer look at how Claude’s own security model works and where the gaps are, see Claude AI Security: Risks, Security Gaps, and How to Overcome Them.

Claude Mythos Capabilities and Benchmarks

Claude Mythos is designed as a general-purpose frontier model, but Anthropic’s testing has shown particularly strong capabilities in software engineering and cybersecurity.

Autonomous Zero-Day Discovery in Open Source Code

One of Mythos Preview’s most significant capabilities was autonomously finding previously unknown vulnerabilities in real open-source software. Anthropic tested the model using an agentic environment in which Claude received access to a project’s source code and executable environment and was given a relatively simple instruction to find a security vulnerability. The model could independently inspect the code, form hypotheses, run the software, use debugging tools, test potential vulnerabilities, and produce a report with reproduction steps and a proof of concept.

Anthropic reported that Mythos Preview identified zero-day vulnerabilities across major operating systems and web browsers, including vulnerabilities that had existed unnoticed for many years. The oldest example disclosed by Anthropic was a 27-year-old vulnerability in OpenBSD. The model also found vulnerabilities involving cryptographic libraries, operating-system components, virtual-machine software, and browser engines.

Exploit Generation: Results From the Firefox JavaScript Engine Test

Anthropic also tested whether Claude could go beyond discovering vulnerabilities and turn them into working exploits. One of its primary evaluations used vulnerabilities in the JavaScript engine from Firefox 147 that had subsequently been patched in Firefox 148.

Claude Opus 4.6 had previously demonstrated very limited exploit-development capability in this test. When Anthropic repeated the evaluation with Mythos Preview, the model produced working exploits 181 times and achieved register control, a significant intermediate step toward arbitrary code execution, in another 29 attempts. Anthropic’s system card reports an 85.2% combined success rate for Mythos Preview on this test (compared to 7.6% for Opus 4.6).

Context Window, Output Limits, and Knowledge Cutoff

As of the time of this writing, Claude Mythos supports a 1 million-token context window, allowing the models to process large codebases, extensive technical documentation, security logs, research material, and other long inputs within a single context. It also supports up to 128,000 output tokens, enabling long code-generation, analysis, and agentic workflows without requiring responses to be divided into small segments.

Claude Mythos accepts text and image inputs and produces text output. It uses adaptive thinking that is always enabled, with Anthropic setting high effort as the default. The knowledge cutoff differs between Mythos generations. Claude Mythos 5 had a reliable knowledge training-data cutoff of January 2026. Claude Mythos 5.1 advanced both to June 2026.

Specifications are the same for Claude Fable, because the underlying AI model is the same across the two models.

Claude Mythos and Fable Pricing 

Here is a summary of pricing for Clause Mythos and Fable as of the time of this writing. Pricing is subject to change, refer to Anthropic’s official model pricing page for up-to-date information.

• Usage-based pricing: Claude Mythos pricing is measured per million tokens. Production versions of Mythos cost $10 per million input tokens and $50 per million output tokens.
• Prompt caching rates: A five-minute cache write costs $12.50 per million tokens, a one-hour cache write costs $20 per million tokens, and cache reads cost $0.25 per million tokens.
• Batch API discount: Anthropic offers a 50% discount on standard input and output token pricing for eligible batch workloads.
• Shared pricing with Fable models: Mythos 5 and 5.1 share their respective pricing with the corresponding Fable models because each Mythos/Fable pair uses the same underlying model with different safety configurations.
• Project Glasswing usage credits: Anthropic committed $100 million in model usage credits to Project Glasswing and additional participants during the research-preview period.

Reactions and Criticism of Claude Mythos 

Responses From Cybersecurity Experts and the Security Industry

Security companies participating in Project Glasswing have generally confirmed that Mythos represents a significant increase in AI-assisted cybersecurity capability. Palo Alto Networks reported that its testing showed frontier models could identify vulnerabilities and turn them into potential exploit paths rapidly. The company has argued that defenders need to adopt similarly advanced AI capabilities because attackers are also gaining access to increasingly capable models.

Other security organizations have emphasized that Mythos is most effective when combined with established security expertise rather than treated as an autonomous replacement for security teams. Tenable conducted more than 500 hours of testing with Mythos Preview, using approximately 40 billion tokens across source-code analysis, exploit development, binary reverse engineering, threat modeling, and dynamic testing.

Tenable found that only a portion of findings became meaningful exposures after experts considered factors such as reachability, exploitability, and existing defensive controls. The company therefore emphasized the importance of purpose-built agentic harnesses, high-quality context, and experienced human reviewers.

Independent Testing Results

External testing has provided evidence that Mythos’s cybersecurity capabilities are substantial. The UK’s AI Security Institute evaluated Mythos Preview on capture-the-flag challenges and simulated attack environments. On the institute’s expert-level CTF tasks, which earlier models had struggled to complete, Mythos Preview achieved a reported success rate of 73%.

The institute also tested the model on more complex multi-stage attack scenarios. Mythos demonstrated the ability to perform long sequences of actions across simulated corporate environments, including reconnaissance, exploitation, privilege escalation, and movement through network infrastructure. 

However, the test environments were designed to measure maximum capability rather than reproduce every constraint found in a production network. They did not necessarily include active defenders, comprehensive security tooling, or realistic consequences for generating alerts.

Government Imposition of Export Controls

Claude Mythos also became the subject of an unusual U.S. government intervention shortly after Mythos 5 and Fable 5 were released. On June 12, 2026, the U.S. Department of Commerce imposed an export-control license requirement covering access to the two models by foreign nationals, including foreign nationals located within the United States and foreign-national Anthropic employees.

According to Anthropic, because the company did not have a reliable mechanism for verifying every user’s nationality in real time, it responded by suspending access to Fable 5 and Mythos 5 for all users rather than attempting to selectively restrict foreign nationals. 

The restrictions were lifted on June 30, 2026, following negotiations between Anthropic and the U.S. Department of Commerce. The agreement required Anthropic to strengthen Fable 5’s safeguards against cybersecurity misuse and cooperate with the government on safety testing. Anthropic restored global access to Fable 5 on July 1, while Mythos 5 access was gradually reintroduced. The episode ended after nearly three weeks, but it established a precedent for government intervention in the availability of frontier AI models.

What Claude Mythos Means for Application Security 

With the introduction of Mythos-class AI models, application security has entered what is being called the “Mythos era”. Let’s review how these new technologies are impacting the roles, risks, and everyday activities of application security teams.

Checkmarx’s own analysis frames this directly: “What Mythos exposed had been true for years: the code was already compromised, the governance was already absent, and the window between vulnerability and exploit was already shrinking. Mythos simply demonstrated that it could be closed.”

Shorter Time From Vulnerability Disclosure to Working Exploit

One of the clearest implications of Mythos is the potential collapse of the traditional window between publication of a security patch and development of a working exploit. Once a vendor releases a patch, an attacker can compare the vulnerable and corrected versions to determine what changed, identify the underlying vulnerability, and attempt to create an exploit. This technique, known as patch diffing, previously required specialized reverse-engineering expertise and could take days or weeks, but Mythos can achieve it in less than an hour.

This significantly changes the assumptions behind patch management. Historically, organizations could often expect at least some time between vulnerability disclosure and widespread weaponization. With sufficiently capable AI models, the technical work required to understand a patch and create a proof-of-concept exploit can occur almost immediately. 

Bottom line: Application security teams consequently need to treat high-risk disclosures as potential exploitation events from the moment a patch becomes public.

Checkmarx’s own 2026 Future of Application Security research reached the same conclusion independently: “Mythos-class models collapse the window between a vulnerability existing and a working exploit being available from months to minutes. Hope was already a shaky strategy. It is now a categorically bad one.”

Larger Vulnerability Backlogs and the Remediation Gap

Claude Mythos also demonstrates that improving vulnerability discovery does not automatically improve application security. During the first weeks of Project Glasswing, Anthropic and approximately 50 partners used Mythos Preview to identify more than 10,000 high- or critical-severity vulnerabilities. Several participating organizations reported that their vulnerability discovery rates increased by more than tenfold.

The result was a new bottleneck. Instead of being limited primarily by the ability to find vulnerabilities, organizations became constrained by their ability to validate findings, determine which vulnerabilities were genuinely exploitable, coordinate disclosures, develop patches, test fixes, and deploy those fixes safely.

The gap is visible in Anthropic’s open-source disclosure effort. By August 26, 2026, Anthropic had disclosed 2,300 vulnerabilities across 392 open-source projects, but it was aware of patches for only 421 of those findings.

This finding is consistent with Checkmarx’s own research tracking the same shift: “The vulnerability backlog is now growing from both sides… frontier AI models are uncovering thousands of previously unknown vulnerabilities in production software and expanding the backlog faster than existing remediation processes can drain it.

This does not necessarily mean maintainers ignored the remaining vulnerabilities: remediation can require significant engineering work, compatibility testing, coordinated releases, and downstream deployment. 

Bottom line: AI-assisted discovery can create a remediation workload substantially larger than existing security teams and maintainers are prepared to process.

Related content: Read our guide to the vulnerability remediation process

AI-Generated Code as a Growing Source of Vulnerabilities

AI is simultaneously increasing the amount of software that organizations produce. Coding assistants and autonomous development agents can generate features, modify existing applications, add dependencies, and create entire pull requests significantly faster than traditional development processes. This can increase developer productivity, but it also means that security teams may need to review a much larger volume of new code.

Checkmarx’s Future of Application Security research reported that AI-generated code accounted for approximately 49% of production code among surveyed organizations. The same research found widespread developer adoption of AI coding tools but much lower adoption of security controls that operate continuously while developers write code.

AI-generated code should not be assumed to be inherently vulnerable, but it can reproduce familiar application-security problems such as injection vulnerabilities, broken access controls, insecure data handling, hardcoded credentials, outdated dependencies, and unsafe cryptographic implementations. AI systems can also introduce newer development risks, including hallucinated package dependencies and agentic workflows that automatically install packages or execute generated commands.

Bottom line: AI generated code also contributes to massive growth in the number of vulnerabilities detected in production systems.

Legacy Code and Systems That Cannot Be Patched Quickly

The impact of Mythos is particularly significant for legacy applications. Anthropic’s research found serious vulnerabilities that had remained unnoticed in mature software for many years, including a 17-year-old remote-code-execution vulnerability in FreeBSD and a vulnerability in OpenBSD that had existed for approximately 27 years.

Legacy applications frequently contain large amounts of old code that have never undergone modern security testing. They may also depend on unsupported libraries, operating systems, proprietary components, or fragile integrations that make upgrading difficult. Advanced AI vulnerability research can expose weaknesses in these systems much faster than organizations can modernize them.

Even when a patch is available, immediate deployment may not be realistic. NIST notes that organizations commonly delay patches because updates require testing, consume operational resources, or risk disrupting critical systems and services. These challenges are particularly important in environments where software cannot tolerate downtime or where an operating-system or dependency upgrade could break the application running on top of it.

As Checkmarx’s research puts it: “With Mythos-class models capable of discovering and exploiting vulnerabilities in minutes regardless of age or severity, the traditional practice of prioritizing by criticality score breaks down. Every unpatched vulnerability, whether legacy or new, is now a potential zero-day.”

Bottom line: Organizations need compensating controls while permanent remediation is developed. Depending on the application, these can include network segmentation, isolating vulnerable systems, restricting external access, or virtual patching.

Best Practices for Addressing Vulnerability Overload and Defending Applications Against Mythos-Class Threats 

Scan First-Party and AI-Generated Code Continuously in the CI/CD Pipeline

Security testing should be part of everyday development rather than a final check before deployment. Integrating automated checks into pull-request, build, and release workflows helps teams identify vulnerabilities before they reach production. These checks should cover application code, dependencies, exposed secrets, and other relevant risks. 

AI-generated code requires the same scrutiny as manually written code because coding agents can introduce changes faster than reviewers can evaluate them. This approach aligns with NIST’s Secure Software Development Framework, which recommends integrating security throughout the development lifecycle.

Organizations building audit-ready AI coding governance should also see AI Coding Assistants with Audit Trails and Security Governance: Top 8 Options.

Higher-risk applications also benefit from scheduled, repository-wide analysis that examines older code and interactions beyond individual changes.

Action items:

• Integrate pipeline security checks: Run SAST, SCA, and secret scanning at pull-request, build, and release stages, with additional tests suited to the application.
• Apply controls to AI-generated code: Automatically scan changes from coding agents and return actionable findings for correction before developers approve the pull request.
• Define security release gates: Block releases for validated, high-risk findings and require documented approval, compensating controls, and expiration dates for exceptions.
• Schedule full-repository scans: Analyze complete repositories regularly to uncover vulnerabilities in unchanged code and security flaws involving interactions between components.

Secure Open Source Dependencies and the Software Supply Chain

An application’s security depends on more than the code its developers write. Open-source libraries, frameworks, container images, build tools, and package registries all contribute to its attack surface. Transitive dependencies can introduce vulnerabilities several layers beyond the packages a team directly selects. 

Continuous software composition analysis helps identify these components and match them against known vulnerability information. Accurate inventories and trusted sourcing practices also support faster investigation when a component becomes compromised or vulnerable. Because new vulnerabilities emerge after deployment, dependency security must remain an ongoing operational responsibility rather than a build-time exercise.

Action items:

• Inventory all dependencies: Maintain an accurate SBOM or equivalent inventory covering direct and transitive packages, container images, and relevant build components.
• Automate vulnerability monitoring: Run SCA in CI/CD and continuously monitor deployed software for newly disclosed vulnerabilities affecting its dependencies.
• Control dependency sources: Prefer approved repositories, verify package provenance and integrity where supported, and restrict unnecessary access to untrusted sources.
• Protect build infrastructure: Limit CI/CD permissions, safeguard signing credentials, and verify build artifacts before publishing or deploying them.
• Prepare rapid dependency updates: Assign component owners and establish tested procedures for upgrading, replacing, or temporarily disabling vulnerable dependencies.

Prioritize Findings by Exploitability and Business Context

AI-assisted vulnerability discovery can produce findings faster than teams can validate and remediate them. As discovery accelerates, investigation and patching can become the primary bottlenecks. Severity scores provide a useful starting point, but they do not fully describe an organization’s actual risk. 

Teams should also assess whether vulnerable code is reachable, attacker-controlled input can trigger it, and existing controls meaningfully limit exploitation. Business context matters because similar technical flaws can have very different consequences across applications. Combining these signals helps direct limited remediation capacity toward vulnerabilities most likely to cause significant harm.

Action items:

• Evaluate practical exploitability: Assess code reachability, attacker-controlled inputs, required privileges, deployment configuration, and the effectiveness of existing mitigations.
• Incorporate threat intelligence: Increase priority when reliable exploits are available, active exploitation is reported, or exposure makes exploitation especially likely.
• Map business impact: Consider asset criticality, sensitive data access, application privileges, service availability, and downstream systems affected by a compromise.
• Create risk-based queues: Combine severity, exploitability, exposure, and business impact into actionable priorities, with clear ownership and remediation deadlines.
• Reassess priorities continuously: Update findings when deployments, exploit availability, threat intelligence, or compensating controls change the underlying risk.

Automate Triage and Remediation With AI Security Agents

Advanced AI can accelerate offensive vulnerability analysis, increasing pressure on defenders who rely entirely on manual workflows. AI security agents can help by investigating findings, explaining vulnerable code paths, and proposing targeted fixes. When supplied with repository context and reachability information, these tools can reduce repetitive analysis and prepare remediation pull requests. 

Their output should nevertheless be treated as a proposal rather than proof that a vulnerability is resolved. Security changes can alter application behavior, introduce regressions, or fix only the visible symptom. Effective automation therefore combines machine-speed assistance with bounded permissions, repeatable validation, and accountable human review.

Action items:

• Automate initial investigation: Use agents to correlate findings with code context, assess reachability, and summarize evidence supporting or challenging the reported vulnerability.
• Generate reviewable fixes: Have remediation agents propose narrowly scoped changes and explain how each change addresses the underlying security issue.
• Constrain agent permissions: Use isolated environments and least-privilege access; require approval for sensitive operations and prevent untrusted repository content from authorizing actions.
• Validate proposed changes: Rerun security scans, regression tests, and vulnerability-specific tests to confirm the fix works without introducing new problems.
• Preserve human accountability: Require appropriate developer or security review before merging, with stronger approval requirements for high-impact applications and changes.
  For a deeper look at where human review belongs in AI-driven security workflows, see Human-in-the-Loop Cybersecurity: Designing HITL Controls for AI and AppSec.”

Set Faster Remediation SLAs for Critical and Internet-Facing Vulnerabilities

AI-assisted exploit development can compress the time between vulnerability disclosure and practical exploitation. Patch information may help attackers identify vulnerable code while defenders are still preparing a rollout. Remediation deadlines should therefore reflect exposure and exploitability rather than severity alone. Internet-facing remote code execution, authentication bypasses, and actively exploited vulnerabilities warrant the fastest response tier. 

Established guidance, including applicable CISA deadlines, provides a baseline but may not match the urgency of every threat. Organizations should maintain rapid-response procedures that support accelerated patching or immediate containment when their most exposed assets are at risk.

Action items:

• Define exposure-based SLAs: Set remediation targets using exploitability, internet exposure, active exploitation, asset criticality, and the consequences of compromise.
• Establish an emergency tier: Assign the shortest deadlines to exposed remote code execution, authentication bypasses, and other vulnerabilities presenting an immediate, credible threat.
• Prepare rapid deployment procedures: Maintain emergency approval paths, targeted testing, staged deployment options, monitoring, and rollback plans for urgent security updates.
• Apply interim containment: When patching cannot happen immediately, restrict access, disable affected functionality, or apply validated mitigations while tracking residual risk.
• Track deadlines and exceptions: Monitor SLA performance, meet applicable mandatory deadlines, and require accountable approval and expiration dates for remediation exceptions.

Preparing for Mythos-Class Threats with Checkmarx

Mythos-class models change the economics of application security in two ways. Attackers with similar capabilities can find unknown flaws and turn newly released patches into working exploits within hours, so a vulnerability that slips past detection is no longer a near-miss but an active risk. At the same time, AI-scale discovery floods security teams with findings, making triage and remediation the new bottleneck. 

Preparing for this environment means detecting more real vulnerabilities before release, separating attackable risk from noise, and getting fixes merged faster. Checkmarx addresses each of these steps within a single platform.

Checkmarx Fusion is a hybrid scanning architecture within the Checkmarx One application security platform. It combines deterministic, rules-based scanning with several curated frontier AI models that analyze code in parallel. Its Findings Analysis Engine reconciles the results into a single, verified set of findings. 

Findings flow into Checkmarx One, where Triage Assist prioritizes them by attackability and Remediation Assist turns them into review-ready fixes. This helps AppSec teams find more real vulnerabilities, cut through scanner noise, and shorten the time between detection and a deployed fix.

Key capabilities of Checkmarx Fusion and Triage & Remediation Assist:

• Hybrid deterministic and AI detection: Depending on the language, a rules-based or AI-based engine runs first, and several curated frontier AI models are layered on top. Each model approaches the code differently, surfacing logic-based flaws and vulnerabilities with no known rule or prior CVE, including in AI-generated code and in languages that rules-based tools do not cover.
• High-fidelity results with fewer false positives: The Findings Analysis Engine removes false positives and deduplicates findings into one clean output. Checkmarx reports an F1 score of 0.74 for Fusion in SAST, compared with 0.64 for Next-Gen SAST and roughly 0.20 for query-based SAST, with 60–70% fewer false positives than standalone AI scanning.
• Consistent results at a predictable cost: Fusion runs a bounded, curated set of Checkmarx-validated models rather than open-ended frontier API calls, so repeated scans return the same answer. Teams can choose higher- or lower-cost models according to their needs, avoiding token bills that compound across every commit.
• Portfolio-scale scanning: Fusion can scan an entire project portfolio in a single operation, with results organized by project and comparable across codebases. Incremental scanning re-scans only new and changed code, so scans get faster over time.
• Attackability-based triage: Triage Assist classifies eligible SAST and SCA findings as False Positive, Acceptable Risk, or Action Required based on reachability, exploitability, policy, and code context. Automated triage rules keep the backlog current so teams focus on the issues that materially reduce exposure.
• Review-ready remediation: Remediation Assist turns prioritized risks into remediation guidance in Checkmarx One. For supported GitHub projects, it surfaces AI triage verdicts in pull requests and generates fix PRs for review. Nothing merges automatically, and developers stay accountable for final changes.
• Unified risk view and measurable impact: Fusion findings are scored and prioritized in Checkmarx One alongside every other signal in the portfolio. AI Assist Usage Analytics tracks adoption, developer time saved, and remediation activity. Checkmarx reports up to 95% faster MTTR and 65%+ of findings fixed on the first attempt.
  These results matter because, as this article covers above, rising discovery volume without matching remediation capacity is exactly what turns AI-accelerated detection into a growing backlog rather than a safer outcome.
• Expanding scan coverage: SAST is available now in Fusion, with Secrets Detection, IaC, API Security, and DAST being added on the same architecture. Fusion runs in CI/CD and pull request workflows on Checkmarx One.

Learn more about Checkmarx Fusion and Checkmarx Triage & Remediation Assist.