On October 14, Bank of America CEO Brian Moynihan told CNBC the bank brought on 1,000 contractors in Q2 to patch software flaws surfaced by frontier AI models, including Anthropic's Mythos. Those contractors are still there, working alongside roughly 3,000 internal staff already assigned to the same effort. Moynihan put the Q3 bill for this work, combined with anti-money-laundering fixes, at "a couple hundred million plus."
I respect transparency. Bank of America is one of the first major U.S. companies to put a headcount and a dollar figure on what AI-driven discovery costs. Shares fell as much as 8% that day. Every CISO and CFO should expect to see their own version of that number.
On the same earnings call, the bank said its roughly 130 internal AI projects are expected to save $300 million this year and $700 million in 2027. AI is cutting the bank's operating costs while raising its security costs.
Discovery just outran remediation
AI did not create these flaws. Some sat in internal and vendor code for decades. What changed is that discovery now runs at machine speed, while patching still runs at human speed. Reported scans have flagged more than 23,000 issues in a single pass, and patch windows that used to be weeks are now days.
When the finding rate rises and the fixing rate stays flat, most organizations respond the way they always have: they add people. That works if you are one of the largest banks in the world with a $13.5B technology budget. It does not work for the rest of the Fortune 2000.
Moynihan expects remediation costs to decline once the backlog is worked through. I hope he is right, but I would not plan a budget around it. Models keep improving, each new release scans the same code again and finds more, and vendor code changes every week. Discovery is now continuous.
That raises a different question: do all of those findings need a human? In my experience, almost never.
Fix what an attacker can reach
A vulnerability only matters if an attacker can get to it. Most cannot be reached: they sit behind segmentation, firewall rules, or controls that break the path long before anyone touches the vulnerable asset. CVSS scores and exploit feeds do not see that. Your network topology does.
At Astelia, we model the real network: every route, rule, and control between an attacker's entry point and your critical assets. That turns a list of findings into a short list of real attack paths. In one analysis, a backlog of 2.53 million vulnerabilities reduced to 185 exploitable attack paths. Across our TEI assessments, deterministic reachability removes roughly 98.9% of the backlog from the urgent queue.
That lets a small team work on the few issues an attacker can use, instead of hiring hundreds of contractors to work all of them.
What the TEI assessment looks like
We run a total economic impact assessment with every customer before they buy. The pattern is consistent: triage labor drops by two orders of magnitude, and the savings outpace the cost of the platform. Three representative profiles, using annual triage effort only:
Assumptions: 15 minutes to triage and validate each finding, $55 per analyst hour, 2,000 hours per FTE, 98.9% of the backlog removed as unreachable.
These figures are conservative. They leave out reduced breach exposure, retired overlapping tools, avoided OT downtime, and the 30% annual backlog growth most teams face. Even so, the financial services profile frees the equivalent of more than 30 analysts. That is the work Bank of America is staffing with people today.
Prioritize before you hire
AI-driven discovery is not slowing down. Mythos-class models will reach more organizations, and attackers will get comparable tools. The volume of findings will keep climbing.
Security leaders can scale headcount to match the finding rate, or scale precision so the team only works what is reachable. Before approving a single remediation contractor, ask:
- Which of these findings sit on a real path to a critical asset?
- What are we spending today to triage the ones that do not?
- Can we prove that answer to the board with our own network data?
If you cannot answer those today, I would be glad to run a TEI assessment on your environment and show you the number.
Source: CNBC, "Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos," October 14, 2026.
