Everything You Should Know Before Mythos Arrives | Nebulock, Damien Lewke
In a Nutshell
Damien Lewke argues that Mythos and similar AI tools have collapsed the talent gap in cyber attacks, letting just two people with a GPU automate reconnaissance, targeting, and exploitation against any organization. The result is a massive expansion of threat actors beyond nation-states and elite groups to everyday hackers who can now blend into normal activity and move laterally undetected. Nebulock was founded to close the defender gap by providing contextual, cross-tool threat hunting that spots these hidden sequences before they become breaches.
These notes were generated by AI and may contain inaccuracies.
Mythos changes the balance of power in cyber. Two people in a GPU who with enough conviction can target a company. Mythos is not existentially scary. Mythos is what security professionals have been saying for years. The real question is what comes after Mythos and whether organizations are ready for it. There is a unique window of time where defenders understand what is coming and have the ability to adapt technology. The critical question is whether defenders can adjust as quickly as the attackers can.
Damien Lewke is the founder and CEO of Nebulock. Nebulock is a contextual security platform that looks at all existing security tools and finds potential threats hidden between the layers. The company raised a $25 million Series A led by First Mark with participation from Bain Capital Ventures, Decibels, Zetta Venture Partners, and Step Function.
Damien discovered his passion on his first day as an intern at Northrop Grumman. He started his career in the DoD building out cyber ops and threat hunting teams before joining CrowdStrike after the Series C and staying through and after the IPO. His first job in the DoD involved working full-time while attending grad school at night to earn a master's in aerospace systems engineering. That experience taught him that showing up and doing your best day in and day out is more important than being a hero every single day.
Damien runs a thousand miles a year. The discipline is about showing up and doing your best at 10:30 in the morning on a Tuesday in February the same way you would on a Friday morning when everything is going great. He gained experience in network security at Palo Alto Networks and in managed detection and response, running the AI detection security research product teams at Arctic Wolf. He also spent time at MIT writing a graduate dissertation at the Computer Science and AI Lab.
Two problems led Damien to start Nebulock. First, as an operator he saw that customers at Arctic Wolf and the 1,200-person security operations center had already invested in best-of-breed tools yet were still getting compromised. Different point solutions to specific problems were not solving how breaches occur. The approach required rethinking everything from first principles.
Two years ago, his thesis was that adversaries would use AI to automate tailored access operations. They would automate the entire lifecycle of targeting an enterprise, compromising it, achieving their objective, and slipping out undetected. Those two problems led to the creation of Nebulock: democratizing the most high-leverage activity in security to all organizations regardless of size, skill set, or budget in a way that is flexible and integrates with existing systems.
The power distribution has already happened. AI has enabled productivity for developers and allowed both attackers and defenders to up-level themselves. The key distinction is between elite AI engineering and elite security judgment. Elite security judgment and gut instinct take a decade or more to build and belong to a very small subset of people.
Mythos allows a script kiddie to do things that used to be reserved for a very elite group. The actual power convergence means the talent gap has collapsed to a subscription model. This impacts individuals first, then companies, and ultimately nation-states. US Cyber Command is already using AI as part of its components. The broader existential question is what happens when the citizen hacker gets access to a Mythos-level model, because they are not governed by geopolitics and rules of engagement.
The number of potential threat actors is dramatically increasing. The landscape has shifted from a few score highly sophisticated groups to two people in a GPU who with enough conviction can target a company. Earlier-stage companies are now being targeted, as seen in recent breaches at growth-stage companies like Vercel. When more people can execute these attacks, there will be greater indication and greater veracity of threats.
Damien reached a point in early 2024 where he quit his job to focus on this problem. He asked himself whether he could try to solve this problem and make zero dollars doing it. The answer was yes, and that conviction confirmed he was ready. Nebulock now partners with organizations from the Fortune 500 to growth-stage security companies like Cribl.
As a founder, the obsession must be with the problem, not the solution. The team is built to help design the solution, and the market validates the idea, but the founder must fall in love with the problem. The problem was so pervasive that Damien realized he had to do his absolute best and show up day in and day out. Early market discovery validated the thesis and allowed the company to build what exists today.
No matter how right or wrong the world tells you that you are about the idea you are pursuing as an entrepreneur, the key is having conviction and continuing to back yourself up with that conviction.
Cyber attackers are targeting normal people, not just governments or the Fortune 100. They can remotely access a Google Workspace account, access elements of Google Drive, and work their way onto systems. They can move laterally and access critical cloud resources because their activity looks completely normal. These are the hardest cases because in isolation they show green-flag activity. Only when you step back and look at the sequence of events and the context of their actions can you spot a glaring red flag.
About ten years ago, cyber attackers behaved in obviously bad ways. Attackers now try to blend in. They log in at normal hours and steal usernames and passwords so activity does not look suspicious. The challenge is distinguishing legitimate behavior from compromised behavior by examining the actual sequence of actions.
Everything described can now be done by one person. A team is no longer required. If you draw an axis across the cyber kill chain (reconnaissance, targeting, exploitation, persistence, lateral movement, and action on objectives), AI has already automated the first three core components, and humans are being orchestrated on the last part.
On a cost axis, reconnaissance is basically $0. Writing a phishing email is also very cheap. Vulnerability exploitation is getting significantly cheaper. Establishing persistence is relatively cheap. Lateral movement and achieving the objective still require a human and are more expensive. A human plus an agent can get there together, but a human is still needed. The first four components are basically automated.
As attackers move to machine speed, defenders have the opportunity to move to machine speed as well. The core thread Damien observed was that defenders were always one step behind attackers. In the DoD, operations had to occur with the information available without knowing everything the adversary could do. At CrowdStrike, that approach scaled effectively on the endpoint, but the endpoint was only part of the enterprise puzzle. At Palo Alto Networks, the network was only part of the puzzle. At Arctic Wolf, best-of-breed solutions could only solve problems as well as the existing tools allowed, and responses were always reactive.
Attackers were always one step ahead because defenders were reacting to alerts instead of proactively leaning into how threat actors might be getting around systems. That gap prompted the creation of Nebulock.
Threat hunting is analogous to cybersecurity operations in the same way a fire marshal differs from a smoke detector. An alert system is the smoke detector: it alerts when something bad has happened. A threat hunter is the fire marshal who goes into a building before the fire and points out risks or risk areas that might be impacted should there be a fire.
Threat hunting operates under the assumption that a breach has occurred and that an attacker is within the environment. Three key indicators show compromise:
- There will be slow but consistent exfiltration of data that looks much like backup behavior, such as all desktop files being uploaded to a personal Google Drive.
- Activity will occur outside the scope of the initial role, such as a marketing intern accessing financial information.
- Some form of persistence mechanism will appear, such as a remote management tool being installed or the multiplication of accounts, including service accounts opened by a human user.
Nebulock exists as a contextual security platform that looks at all existing security tools and finds potential threats hidden between the layers. Cybersecurity is quickly becoming an existential question: not whether something bad will happen, but what to do when something bad happens. The key reality to accept is that at some point a threat actor will target any organization. That is not fear-mongering; it is the reality of a world where the democratization of cyber attacks exists.
AI is not going to catastrophically destroy everything in security. AI is here both to create and to solve challenges for network defenders. The sky is not falling. The real concern is inaction: failing to see the warning signs and doing nothing. There is a rare window to act. That thesis is exactly why Nebulock exists: to democratize the highest-leverage activity of finding bad activity before it becomes a persistent breach and giving that capability back to organizations.
One thing founders often overlook is the distinction between the business person and the person. Having a personal support network is really important. Damien's dad serves as a mentor because he understands him deeply and reminds him to show up as his truest self rather than hyper-optimizing to be just Damien the CEO. Instead, he shows up as Damien the person, Damien the founder, and Damien who wants to build an environment where people can thrive, grow, and do their best work.
Keep EO in your library
Save the videos and channels worth coming back to, and find them again in one place.
