I find it interesting that the cyber LLMs like GPT-5.4-Cyber* and Mythos** corroborate this. They are not particularly trained to identify vulnerabilities. They are (more or less) fine-tuned versions of general purpose models that remove the cyber refusals. In other words, they are simply excellent developers learning security on the job.

* "..we are fine-tuning our models specifically to enable defensive cybersecurity use cases, starting today with a variant of GPT‑5.4 trained to be cyber-permissive: GPT‑5.4‑Cyber." https://openai.com/index/scaling-trusted-access-for-cyber-defense/

** "We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. " https://red.anthropic.com/2026/mythos-preview/

#cybersecurity #hiring #mythos #gpt54cyber #openai #anthropic

To be an effective security engineer, you need both systems expertise and security expertise. However, for most complex systems (Eg: Mobile, servers, PCs), it is a lot easier and quicker to train a systems expert in security than a security expert in systems. There are some exceptions, of course, such as cryptanalysis and formal methods. You will know when you have an exception case.

#cybersecurity #hiring #mythos #gpt54cyber #openai #anthropic