Questions we get from CTOs, CISOs and boards.

Mythos Safe means a product has been tested against the capabilities that frontier AI models such as Claude Mythos demonstrated in 2026: finding and exploiting vulnerabilities autonomously, at scale, for a few dollars per run. A Mythos Safe product has plain-English security rules that are tested on every release.

MATT is the AI Security Supervisor by Mattersec Labs. It runs the ExploitOps loop for software products: an audit that tests them against 1,700+ attack patterns the way AI-enabled attackers would, fixes made with the customer's own engineering team, and continuous assurance after that.

Mattersec Labs introduced the term and the practice in 2026, after benchmarking twelve frontier models on 406 CVE-grounded tasks with SecLens and securing the first organisations against the exploits those models made possible. It differs from traditional security practice in scale and continuity: the rules a product has to hold are written down in plain English, then re-proven against the live product on every release across 1,700+ attack patterns and six categories, with the fix and the check that keeps each rule holding owned by the same loop.

CTOs, CISOs and founders of public software products, especially those with self-serve signup, AI features or agents in production, and those answering SOC 2, ISO 27001 or enterprise vendor reviews.

A penetration test is typically one consultant for one week, once a year, producing a report. An AI security audit uses researchers plus the same models attackers use, produces merged fixes, and leaves behind rules that are re-tested on every release.

For the audit: read access to your repository (GitHub is enough to start), a test login to the product and a short walkthrough of what it does. We read source code and architecture; production data, secrets and customer records stay out of scope, so nothing sensitive is touched. Continuous assurance then runs on your release cycle, and teams that want wider coverage can run MATT on developer machines as well.

Fifteen minutes to a first answer on the discovery call, three weeks to merged fixes and written rules, then continuous assurance on every release if you choose it.

Identity and access, spend and resource abuse, data exposure, automation and fraud, availability, and AI-written and agentic code. Each traces to at least one public incident in 2026.

Yes. Every rule maps to the control it satisfies, and evidence is generated from live test results, which shortens audits and vendor questionnaires.

You start with a 15-minute discovery call with a MATT co-founder to understand your product and whether there is a real need. If there is, a scoped ExploitOps Review follows with the research team; if not, there is no next step to sell you.

Mattersec Labs Inc. is a Delaware company that works from San Francisco, Dubai and Bangalore, and with customers wherever they are.