181×
Firefox exploits in a single autonomous run, including 14 previously unknown Zero-Days. The predecessor found 2 exploits in a comparable run.
anthropic.com/glasswing
Anthropic Mythos · April 2026 · Threat Landscape
Mythos changed the rules.
Mythos changed the rules.
Now it matters how you harden your platform.
An AI model finds in hours what attackers previously needed months for, and competitor models will follow within 6 to 18 months. The answer is not yet another scanner but the platform itself: continuously hardened, auditably automated, durably standardized. The Secure Platform Automation Suite (SPAS) by lennlay delivers this state as a platform capability, including Linux, Windows, JBoss EAP, IIS, Tomcat, Container, and Kubernetes; additional platform families available on request.
Linux
Windows
JBoss EAP
IIS
Tomcat
Container
Kubernetes
01 · Threat Landscape
Not "another AI tool." A shift in the attack vector.
On April 9, 2026, Anthropic released the autonomous security research tool Project Glasswing, based on the Claude Mythos model. The documented results change the premise under which platform security has been understood until now.
90×
Improvement over the predecessor model. Autonomous exploit development through to a working proof-of-concept without human follow-up.
anthropic.com/glasswing
6-18Mo.
According to Gartner's forecast, competitor models (OpenAI, Google DeepMind, Meta, Chinese labs) will reach Mythos capability levels within this window.
Gartner · Competitive Forecast
14days
Deadline under the KRITIS-Dachgesetz (Critical Infrastructure Act) for the structured initial report of a significant security incident. Full report within 72 hours.
KRITIS-Dachgesetz · NIS2UmsuCG
What this situation means operationally for your platform is covered in the Architecture Brief
02 · Paradigm Shift
From the patch cycle to continuous platform hardening.
When AI models deliver new CVEs in hours instead of months, the annual pentest is generally no longer sufficient as the sole form of evidence. Hardening becomes a runtime function of the platform. Here is the shift in concrete terms.
Old World · before Mythos
Reactive, periodic, manual
- × Quarterly or annual pentest as compliance evidence
- × Hardening as a one-off project; implemented once, then drift
- × CVE response via ticket system; MTTR in weeks to months
- × Tools as primary external communication (scanners, SIEM)
- × Audit evidence through document collection and spreadsheets
- × Platform knowledge locked in the heads of a few specialists
New World · from Mythos onward
Continuous, automated, auditable
- ✓ Continuous Baseline Enforcement & Drift Detection
- ✓ Hardening as code; versionable, reproducible, rollback-capable
- ✓ CVE response pipeline-driven; MTTR in hours
- ✓ Platform perspective; modules as external communication
- ✓ Audit evidence generated automatically from the platform
- ✓ Platform knowledge in Collections and Baselines, not in heads
03 · SPAS Reference Architecture
Seven core capabilities on two levels.
SPAS is not a tool, not a scanner, not a SaaS. It is a reference architecture with a principles framework that transitions platform hardening from a project discipline into a pipeline-driven operational state. The value comes from reproducibility, evidence, and governance.
Operational Core · 01-04
The operational core continuously applies policies to the platform: Policy → Golden Image → Deployment → Verification.
01
Security Standards, Baselines, and Policies
Machine-readable Baselines from CIS, STIG, BSI, and customer-specific requirements, stored as versioned machine-readable Baselines. Customer hardening policies are incorporated and built in.
02
Golden Images and Platform Baselines
Verified, reproducible system images as the defined starting state for all deployments. Every artifact is signed, versioned, and has a traceable derivation from upstream to production.
03
Automation, Deployment, and Platform Integration
Pipeline-driven delivery into existing infrastructure. For legacy VMs: Ansible Collections and CI/CD pipelines. For containers and Kubernetes: ArgoCD, Flux, or comparable GitOps tools.
04
Compliance Checks and Reporting
Continuous scans with automatically generated audit evidence. Deviation from the target state creates a ticket and enters the structured report. Audit evidence is generated during operations, not two weeks before the audit.
Governance · 05-07
Governance (05-07) makes the impact path auditable and controllable. It is only reliable when the core (01-04) runs continuously.
05
Documentation, Traceability, and Auditability
Every change creates an audit entry. Every exception from the target state is recorded with justification and expiry date. The audit report is generated from platform data, not from an Excel collection.
06
Lifecycle and Update Management
Support end dates, versions, CVE status, and migration paths are attributes on the asset, not knowledge in people's heads. The end-of-support date appears in the dashboard; the migration pipeline is visible.
07
Drift Detection and Enforcement
Drift is detected and reported. Automatic Enforcement by risk profile: directly applicable for container clusters; controlled restart within the change window for mission-critical middleware.
04 · JBoss in Focus
The first deployment: Secure JBoss EAP Platform Automation.
JBoss EAP carries mission-critical business applications in many DACH enterprises and simultaneously faces lifecycle, compliance, and support pressure. That is precisely where platform automation delivers the highest leverage: audit-capable Baselines, reusable Collections, continuous hardening.
lennlay-Policy
Baselines out-of-the-box
Ansible
lennlay.jboss Collection
< 4h
MTTR target for critical CVEs
NIS2
audit-capable from the platform
05 · Product Architecture
Platform families & modules in the SPAS portfolio.
The suite covers platform families typical in regulated environments. Modules are independently deployable and built on shared core capabilities.
Recommended
Middleware
Secure JBoss EAP Platform Automation
Audit-capable Baselines, Ansible Collections, lifecycle management for mission-critical middleware.
Middleware
Secure Tomcat Platform Automation
Hardened Tomcat Baselines for web frontends and application servers in legacy architectures.
Operating System
Secure Linux Platform Automation
CIS/STIG-compliant RHEL, SLES, and Debian Baselines with continuous Enforcement.
Operating System
Secure Windows Platform Automation
Windows Server hardening with DSC/Ansible integration and audit-capable compliance reporting.
Web Platforms
Secure IIS Platform Automation
IIS hardening for classic .NET stacks, lifecycle management included.
Container
Secure Container Platform Automation
Image Baselines, runtime Enforcement, SBOM integration for Docker and Podman-based environments.
Orchestration
Secure Kubernetes Platform Automation
Cluster Baselines, policy-as-code, Drift Detection, equally applicable to on-prem and cloud K8s.
Pipeline
Upcoming
OpenShift · NGINX · Apache · Java Runtime
Further platform modules are in preparation and follow the same principles framework.
06 · Entry Path
From platform check to production module.
Free platform check, two-day onboarding workshop, then modular entry. Timelines vary with legacy depth, platform breadth, and approval processes; the outlined weeks are a reliable orientation framework.
0
Step 0
Platform Check
15-30 min. online. Assess platform landscape, compliance pressure, and SPAS fit. Free, no pitch.
—
Pre-Stage · 2 days
Onboarding Workshop
2 lennlay experts. Assessment of platform landscape, working practices, automation maturity. Output: a reliable entry proposal.
1
Week 1
Scoping & Baseline Selection
Refine platform inventory, fix compliance targets, define shared target state.
2
Week 2
Module Adaptation
Baselines tailored to the customer environment, Collections versioned (where Ansible is in use), test stage set up.
3–4
Week 3-4
Rollout & Audit Report
Production rollout against defined cluster set. Drift Detection active. Automated compliance report.
07 · Frequently Asked Questions
What platform owners are asking now.
Is this not just "another security tool" with a different name?
No. SPAS is a platform perspective, not a tool. We integrate existing security infrastructure, scanners, SIEM, compliance platforms, and deliver the operational automation layer that makes these tools durably auditable and effective. The customer value is created at the platform level, not the tool level.
We already have Ansible automation. What changes?
Ansible is the engine, not the vehicle. SPAS delivers audit-capable Collections, curated Baselines (CIS, lennlay standards), integrated Drift Detection, and organizational process logic. Your existing Ansible infrastructure continues to be used, with clear platform semantics layered on top.
How does this relate to NIS2UmsuCG and the KRITIS-Dachgesetz (Critical Infrastructure Act)?
NIS2UmsuCG has been in effect since December 2025; the KRITIS-Dachgesetz (Critical Infrastructure Act) was adopted by the Federal Council on March 6, 2026. Both require continuous vulnerability monitoring, documented vulnerability processes, and evidence of attack detection, in some cases subject to mandatory review every three years. Management is responsible for implementation and can be held personally liable for violations; fines reach up to 10 million euros or 2 percent of global annual revenue. SPAS modules deliver the automated implementation including evidence generation.
Why the focus on JBoss EAP first?
In many DACH enterprises, JBoss EAP carries mission-critical business applications. Lifecycle pressure (support end dates), compliance requirements, and tight coupling to core applications make it the deployment target with the highest leverage. Further platform modules follow a clear roadmap: Linux, Windows, Container, Kubernetes.
Do we need cloud infrastructure for this?
No. SPAS is designed to work equally on-prem, in private cloud, and in hybrid setups. For highly regulated environments this is a requirement, not an option.
What does a realistic first step look like?
Platform check: 15 to 30 minutes online, no pitch. We assess together which platforms are under pressure, where the compliance action is required, and whether SPAS is a fit. Book directly via the button below. Next step: two-day onboarding workshop with two lennlay experts, on-site or remote, flat fee 4.900 EUR. No sales theater; we work at operations level.
What changes if we do nothing now?
NIS2UmsuCG has been in effect since December 2025 with a mandatory proof requirement for continuous vulnerability monitoring. The KRITIS-Dachgesetz (Critical Infrastructure Act) has been federal law since March 2026. Organizations that cannot demonstrate a documented, continuous process in the next audit cycle do not risk an abstract warning; they risk a finding in the audit report that will escalate internally. In parallel, the attacker time window is shifting from months to hours. The Architecture Brief provides the reference framework for establishing this process in a structured way, before the first real CVE run across your platform.
Next Step
Architecture Brief: Platform Hardening in the Mythos Era.
The preparation window until Mythos-class models appear on the attacker side is 6 to 18 months. Those who request it now begin the internal assessment with a worked reference framework rather than a blank page.
13-page PDF written for CISOs, platform leads, and IT governance. No signup for newsletters or marketing flows; only the brief.
- 01 Mythos changed the rules: threat model and regulatory context p. 3-4
- 02 Seven core capabilities: foundation flow and governance p. 5-8
- 03 Compliance mapping: NIS2UmsuCG, KRITIS-Dachgesetz, BSI IT-Grundschutz p. 9-10
- 04 JBoss EAP: all seven core capabilities in deployment p. 11-12
- 05 Entry path: platform check through production module p. 13
Response typically within one business day. No follow-up call without prior agreement. The brief is sent without a marketing sequence. Business email addresses only, processed in compliance with GDPR.
Prefer to talk directly? In the platform check we clarify in 15 to 30 minutes which platforms are under pressure, where compliance action is required, and whether SPAS is a fit. No sales meeting, no 40-slide agenda.
Schedule platform check