Global – October 15, 2026 -- The main constraint on cyber defense is moving from vulnerability discovery to organizational decision speed, according to CGI's Pierre Le Calvez, as frontier models such as Anthropic's Claude Mythos and OpenAI's GPT-5.6 Sol advance.
Approval delays outpace detection in security operations
In a blog titled "Defending at the speed of frontier AI: Lessons from the Fable shutdown and what to do in the next 60 days," Le Calvez argues that AI-assisted tools now surface vulnerabilities within minutes and clarify their impact within hours. The delays now sit in approval processes, competing business priorities, resource constraints and fragmented ownership rather than inside the security operations center.
Resilient organizations share five operating traits
The blog lists the characteristics of resilient organizations:
- Clear visibility into critical systems and dependencies
- Defined ownership and known decision-makers
- Coordination across technology, security, operations and business teams
- Regular testing of response processes
- A clear understanding of operational bottlenecks
Such organizations act quickly without sacrificing governance, a balance that matters more as threat timelines compress.
Boards press executives on AI oversight and third-party risk
Dependence on external software providers, cloud platforms, open-source components and AI services creates new operational risk. Boards are asking how to govern AI adoption, maintain human oversight, manage AI-related third-party risk and decide quickly while staying accountable. Le Calvez says the most effective organizations are evolving existing risk, security and resilience frameworks rather than building new governance structures.
Defensive AI targets detection, code review and remediation priority
Defensive AI is already used for threat detection, vulnerability analysis, code review, incident investigation and remediation prioritization. Le Calvez stresses that the aim is faster, better-informed decisions rather than full autonomy, with human judgment and accountability intact.
His recommended fundamentals are reducing unnecessary exposure, strengthening identity controls, improving visibility, accelerating remediation, testing response plans, understanding dependencies and modernizing legacy environments where the risk justifies investment.