When Anthropic’s Mythos model and Project Glasswing demonstrated that AI could identify software vulnerabilities at machine speed, the security community took notice. But the most important insight from Mythos wasn’t about discovery speed. It was about everything that happens after discovery, and how unprepared most organizations are to manage it.
For mainframe security practitioners, this isn’t abstract. It’s operational.
What Mythos Actually Revealed
The conversation following Mythos focused heavily on how fast AI can find things. That’s understandable. But for anyone who has worked alongside mainframe security teams, the more urgent question is what happens next.
Security teams are already overwhelmed. In most large enterprises, the volume of findings, configuration alerts, patch advisories, and compliance gaps exceeds what teams can realistically triage without tooling. That’s before AI accelerates the discovery pipeline.
What Mythos revealed is a structural mismatch. AI can generate findings at a pace that far outstrips traditional defensive processes. But the workflows for validating those findings, assessing real exploitability, prioritizing remediation, and documenting decisions for audit haven’t kept pace.
Discovery is only the first step. Is a finding exploitable in your specific environment? Does it affect a system covered by a compensating control? Who approves the response? How do you document the decision for your next DORA or PCI DSS review? AI is accelerating both the discovery problem and the decision-making problem simultaneously. Without a governance framework to manage how AI operates within security workflows, organizations risk creating a faster, louder version of the same challenge they already face.
Why the Mainframe Can’t Be a Blind Spot
Mainframes have long benefited from security through complexity. Deep institutional knowledge, specialized skills, and the relative obscurity of z/OS internals provided an informal layer of protection. That’s worth significantly less than it used to be.
AI removes the historical barriers to mainframe reconnaissance. An attacker using AI-powered tooling doesn’t need prior mainframe expertise to probe RACF settings, identify configuration weaknesses, or test for known vulnerability patterns. The specialized knowledge that once protected these environments through obscurity is increasingly something AI can approximate from publicly available research and documentation.
The challenge isn’t simply that AI is making discovery faster. It’s that many organizations are still struggling with basic visibility across their environments. According to Rocket Software’s 2026 Mainframe AI Study, conducted by Hanover Research, 84% of financial services IT leaders say they struggle to correlate incidents across mainframe, distributed, and cloud environments. At the same time, 46% say they need stronger governance controls and approval workflows before they are comfortable trusting AI in production.
Those findings highlight an uncomfortable reality. Organizations are being asked to respond to AI-accelerated threats while still piecing together signals from disconnected systems and relying on workflows that weren’t designed for machine-speed discovery. As AI shortens the time between finding a potential issue and acting on it, visibility and governance become inseparable. Security teams can’t effectively manage what they can’t see, and they can’t safely automate what they can’t govern.
These aren’t uniquely mainframe problems. They’re the same incident correlation, access management, patch assurance, and operational control challenges security teams face across every platform. The difference is that mainframe environments have often been excluded from the continuous monitoring, automated validation, and modern governance practices that are becoming standard elsewhere. AI-powered threats are making that gap increasingly difficult to ignore.
Why Agentic AI Changes the Governance Conversation
Historically, most AI tools security teams have relied on have been advisory. A SIEM flags anomalies. A vulnerability scanner ranks findings. A configuration tool reports drift. In each case, a human reviews the output and decides what to do. The AI informs. The human acts.
Agentic AI changes that dynamic. An agentic AI system can gather information across systems, invoke tools, coordinate multi-step workflows, and recommend or initiate actions. Consider what that means in practice: an agentic AI investigating unusual RACF activity could query multiple data sources, correlate findings across identity management systems and audit logs, identify a privilege escalation pattern, and surface a recommended response, without waiting for a human to initiate each step.
That’s genuinely useful. It’s also where governance stops being optional.
When AI can read data, oversight is important. When AI can potentially act on systems, oversight becomes a prerequisite. Who authorized that action? Under what policy? What approval workflow applies? How is this logged for your next audit? These are the same questions you’d ask about a privileged user, and the answers need to be just as rigorous, if not more so.
Don't miss these other great articles
Guardrails and Governance Are Different Things
These two concepts are often conflated. They shouldn’t be.
Guardrails influence AI behavior, and they shape what a model will say or recommend. Governance establishes authority, it determines whether an action is permitted at all. A system can have strong guardrails and still operate without the access controls, approval workflows, and audit trails that governance requires.
For security teams working under DORA, PCI DSS, or NIST requirements, that distinction matters. Regulators won’t ask whether your AI had guardrails. They’ll ask who was accountable, what policies applied, and whether decisions can be explained and evidenced.
Governance as a Security Requirement
Effective agentic AI governance in mainframe environments rests on five pillars that map directly to operational control disciplines mainframe security teams have applied to privileged users for decades.
- Access Governance defines what systems and data an AI agent can reach. An AI investigating a RACF anomaly should have read access to the data it needs, and nothing broader. Apply the same least-privilege principles to AI agents that you’d apply to any privileged account, however least-privilege becomes at invocation time calculation, and must consume context that no static profile can hold.
- Policy Governance establishes the rules under which AI actions are permitted. For higher-risk operations such as modifying a security configuration, disabling an account, escalating a finding to an incident, defined approval workflows should apply. Some organizations are implementing a dedicated governance layer between AI reasoning and system execution, called a policy decision point, which determines dynamic contextual provisioning. Rather than allowing an AI agent to act directly on a recommendation, this layer evaluates whether the proposed action is within policy and whether it can be logged in a way that satisfies audit requirements. PlanGuard™, used within Rocket® EVA™, is one example of this enforcement approach in practice.
- Identity & Authorization Governance determines how an AI agent is identified, authorized, and represented when interacting with enterprise systems. Unlike traditional service accounts, agentic systems shouldn’t operate with broad standing privileges. Instead, organizations should increasingly prefer just-in-time, purpose-built identities that are created or scoped for a specific task, transaction, or workflow and retired when that work is complete. The challenge is that authorization decisions can no longer rely entirely on static roles or profiles. Whether an action should be permitted may depend on factors such as the requesting user, the system being accessed, the sensitivity of the data involved, the operational context, the time of day, or whether an incident has been declared. In other words, the authorization decision must move to invocation time and incorporate context that no static entitlement model can fully capture. This is why many modern agentic architectures incorporate a policy decision point (PDP) that evaluates identity, context, risk, and policy before issuing a minimally scoped credential or authorization token. Rather than granting an AI agent permanent access, the system grants only the permissions required for that specific action, for that specific period of time, under those specific conditions.
- Data Governance ensures that sensitive information handled during AI-driven workflows stays within approved environments, particularly relevant when data includes identity records, transaction logs, or anything subject to PCI DSS or GDPR controls.
- Operational Governance keeps humans accountable for consequential decisions and ensures every AI-driven action is traceable. This dimension is most directly relevant to DORA, which requires financial institutions to demonstrate that operational processes, including AI-assisted ones, are auditable and subject to meaningful human oversight.
Governance in Practice
The practical value of governed AI comes from its ability to accelerate analysis and correlation without removing the human judgment regulated environments require.
A security analyst investigating after-hours access from a privileged account still needs to query RACF logs, cross-reference job scheduling records, review recent access changes, and assess whether the behavior is anomalous. A governed AI agent can do that correlation in minutes and surface a structured summary, not a decision, but the information needed to make one faster.
Similarly, governed AI can continuously compare configurations against defined baselines and flag drift before the next audit, verify actual patch installation status across multi-LPAR environments, and correlate signals across disparate operational tools that human analysts would take significantly longer to connect. Rocket® EVA™ is designed to support exactly this kind of work, governed agentic operations that accelerate investigation while keeping every action auditable and within defined policy boundaries.
In all of these scenarios, the AI is doing analytical work. Humans remain accountable for what follows.
The Compliance Dimension
Regulatory frameworks are engaging directly with AI governance requirements, and mainframe-heavy industries are among the most exposed. DORA’s requirements for auditability and incident reporting now extend to AI-assisted workflows. PCI DSS access control and logging requirements apply to any AI system touching in-scope environments. NIST’s AI Risk Management Framework provides structured guidance on transparency, accountability, and human oversight for high-stakes applications.
The common thread is that AI effectiveness isn’t sufficient on its own. Security leaders need to demonstrate that AI-driven decisions are explainable, that systems are not only auditable, but that the record created is part of a tamper-evident, hash chained audit trail, and that accountability remains with identifiable humans operating within defined policies. Governance is no longer just a technical requirement. It’s a compliance requirement, and one that will grow more specific as regulators gain direct experience with production AI deployments.
Governance Is What Separates AI Hype From AI Value
Mythos changed how the industry thinks about vulnerability discovery. What it really surfaced is a decision-making challenge that’s been building for years: security teams are operating processes designed for a threat environment that no longer exists.
Governance is becoming a security capability in its own right. It’s not a constraint on AI adoption, it’s what makes AI adoption sustainable in environments where the systems involved are too consequential to leave ungoverned. Platforms like Rocket EVA and its PlanGuard enforcement layer are early examples of how organizations are beginning to address this on the mainframe.
The organizations that think carefully about these questions now, before AI adoption outpaces the structures needed to manage it, will be better positioned not just in security outcomes, but in their ability to demonstrate compliance and maintain the trust of auditors, regulators, and the customers who depend on the systems they protect.
0 Comments