The “Mythos” Reality: Why the Patching Treadmill Just Broke

If you follow me, you know that I’ve been diving deep into the “Mythos” of digital repression: the belief that we can somehow contain, recall, or suppress a digital threat once it’s been unleashed. The research is in, and my conclusion is sobering: Digital technology cannot be repressed. In the OT world, we’ve been living in a collective fantasy. We’ve treated security like a game of Whack-A-Mole, believing that if we just “patch” fast enough, we can stay ahead.

Patching is a dead strategy.

Here’s three reasons why:

1. The Myth of the “Recall”

In the physical world, if a valve is faulty, you replace it. In the digital world, once a vulnerability (or the tool to exploit it) is discovered, it is immortal. The “Mythos” research proves that even when “fixes” are released, the original exploit remains in the wild, perfected by AI, and accessible to anyone with a laptop. You aren’t patching a hole; you’re trying to stop a flood with a screen door.

2. Legacy Security is Part of the Problem

The most dangerous realization? It’s not just your PLCs and HMIs that are vulnerable; it’s the very “security” products you bought to protect them.

• Your legacy VPNs? Vulnerable. Your traditional firewalls? Full of holes. Your “jump boxes”? Primary targets. We are seeing a massive surge in attackers targeting the defensive layer itself. Patching your legacy security stack is like trying to fix a wooden shield while it’s already on fire.

Fortibleed anyone?

3. The Math Simply Doesn’t Work

Over 25,000 new vulnerabilities are discovered every year. In a complex manufacturing or utility environment, the downtime required to patch every “critical” CVE would result in zero productivity.

The hard truth: If your security strategy depends on your ability to update software faster than a nation-state can find a bug, you have already lost.

The Shift: From “Patching” to “Invisibility”

If we accept that digital threats cannot be repressed and that everything has vulnerabilities, then the only logical move is to hide the target.

We have to move beyond the “Patch-and-Pray” model and embrace Network Cloaking.

• Don’t patch the door; make the door invisible.
• Don’t trust the user; move to true Passwordless MFA.
• Don’t rely on legacy stacks; adopt software-defined perimeters that don’t have a public IP to attack.

The mouse has the cheese, and it has taken over the house. It’s time to stop trying to catch it and start changing the locks.