From the Palo Alto Networks edition of November 7, 2026
Computer Weekly: Palo Alto Networks CIO says two-thirds of flaws found with frontier AI had no CVE and that attack-path chaining is the bigger surprise
Computer Weekly / Informa TechTarget (interview with Palo Alto Networks CIO Meerah Rajavel) · Independent technology journalism / enterprise cybersecurity · Interview conducted at Singapore International Cyber Week; global vendor claims with Asia-Pacific customer commentary
- Publisher
- Computer Weekly
- Original publication
- Computer Weekly, 6 Nov 2026 1:45, by Aaron Tan, Informa TechTarget
- Source retrieved
- 2026-11-08
What happened
On Nov. 6, 2026 Computer Weekly published an interview with Palo Alto Networks CIO Meerah Rajavel, conducted on the sidelines of Singapore International Cyber Week the previous month. Rajavel said two-thirds of the vulnerabilities Palo Alto has uncovered using frontier AI models had never been disclosed as CVEs, so organisations can no longer simply prioritise which known flaws to patch first. She said Palo Alto was a launch partner of Anthropic's Project Glasswing, which provided access to the unreleased Claude Mythos Preview model, and that 'the thing that shocked us was how good it was in devising attack paths' by chaining vulnerabilities. She said the company has seen a threefold rise in attackers launching AI-enabled or autonomous attacks in the past few months; cited a Unit 42 investigation in which an attacker used AI agents to string together over 50 techniques and breach a complex enterprise network in under 10 hours; and cited Unit 42's 2026 Global incident response report that the fastest cases needed only 72 minutes from first access to data exfiltration. She argued some business-critical or older systems cannot take rolling updates, making virtual patching, zero trust and attack-surface management necessary; described Prisma AIRS (spelled 'Prisma Airs' in the article) as checking agent artefacts for goal tampering and conducting continuous red teaming; and said Palo Alto routes LLM interactions through a gateway and uses MCP proxies so agents do not connect to MCP servers directly. She warned that 'AI security is sitting on top of the base layer' of zero trust and endpoint security. She said Singapore's Cyber Security Agency has written to boards of critical information infrastructure owners urging them to review defences in light of frontier AI — a statement the article does not independently document.
Why it matters
Rajavel explicitly frames the problem for critical-infrastructure operators (automatic containment with a human fixing the root cause) and notes a Singapore government board-level push on frontier AI, which is transferable as an international signal rather than a U.S. mandate. Interpretation: state, local, public-health and higher-education teams that cannot patch legacy or safety-critical systems quickly, and that are connecting coding or operations agents to MCP servers, can use this interview as a discovery prompt for unpatchable assets, AI inventories and gateway controls. The two-thirds, threefold and 72-minute figures are vendor-attributed and should not be treated as SLED-measured outcomes. Transferability limits: the interview is global/APAC commentary, not a U.S. agency evaluation of Prisma AIRS.
Evidence and measured results
Opened the full Computer Weekly article dated 6 Nov 2026 1:45. Recorded attributed claims, product descriptions, the Glasswing/Mythos context, the Unit 42 case and report citations, virtual-patching and MCP-proxy guidance, the base-layer caution, and the CSA Singapore statement. No methods table or independent dataset is provided.
Limitations and uncertainty
Independent reporting of vendor claims, not an audit. Quantitative figures are unsourced beyond attribution to Rajavel or Unit 42. Interview date is 'last month' (October 2026) at SICW; publication date is Nov. 6. Prisma product name is informal in the article. CSA board letter is not linked. No SLED customer results.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Organisations that only rank known CVEs may miss undisclosed flaws and novel attack paths that frontier models can find and chain, according to the CIO interviewed here.
- Stakeholders
- CISO
- CIO
- Board or audit committee
- SOC leadership
- OT or facilities owners of unpatchable systems
- Discovery questions
- Which business-critical or legacy systems cannot take rolling security updates?
- Where are coding or operations agents allowed to call MCP servers directly?
- What share of recent incidents involved AI-enabled attacker tooling, based on your own telemetry?
- Has leadership received any board-level guidance comparable to the CSA Singapore letter Rajavel described?
- Value hypothesis
- Interpretation: an inventory of unpatchable systems plus MCP/LLM gateway controls could shrink attack paths the CIO says CVE patching alone will not close, but this article does not measure that benefit.
- Potential engagement
- A time-boxed workshop to inventory unpatchable assets, AI/MCP connections and current virtual-patching coverage.
- Unsupported claims
- Independent verification of the two-thirds no-CVE figure
- A guaranteed reduction to the cited 72-minute exfiltration window
- That Prisma AIRS or MCP proxies will reproduce Glasswing findings in a SLED tenant
Pre-sales engineering
Role takeaway
- Fit
- Fits organisations that already operate next-generation firewalls or are evaluating Prisma AIRS runtime and MCP gateway controls, especially where some systems cannot be patched quickly.
- Architecture and integration
- Rajavel describes network-level virtual patching, attack-surface management, a security-first LLM gateway covering first- and third-party apps and agents, and MCP proxies so agents do not connect to MCP servers directly.
- Prerequisites
- Inventory of AI deployments and MCP servers
- List of systems that cannot accept rolling patches
- Existing network inspection point capable of virtual patching if that control is chosen
- Constraints
- No detection-rate or latency data in the article
- Product description is vendor-narrated through a journalist
- Interview predates publication by about a month
- Security
- The cited risks are undisclosed vulnerabilities, chained attack paths, goal tampering of agents, and direct MCP connections; the article does not test whether Prisma AIRS stops those behaviors.
- Proof of value
- Confirm whether an MCP proxy actually intercepts a test agent connection in the customer's lab
- Map one unpatchable system and show whether virtual patching signatures would cover a relevant exploit class
- Compare the customer's AI-asset inventory with what security tools currently see
Delivery
Role takeaway
- Work
- Facilitate an AI-use and unpatchable-asset inventory, document current gateway or proxy paths, and draft autonomy-versus-human-approval rules for high-risk agent actions.
- Dependencies
- Application and developer owners of MCP servers
- Network or firewall team for virtual patching
- Governance owners for autonomy thresholds
- Ownership
- The CISO or CIO should own the runtime AI-governance decision; network security would own virtual patching; application teams own MCP connections.
- Skills and adoption
- Analysts and developers need a shared definition of which agent actions may run autonomously, matching the article's critical-infrastructure versus insurance examples.
- Governance checkpoints
- Unpatchable-asset list reviewed by operations and security
- MCP direct-connect exceptions approved in writing
- Board or executive briefing distinguishes Rajavel's attributed claims from tenant-measured results
- Acceptance criteria
- Proposed: written inventory of AI applications and MCP servers in one business unit
- Proposed: documented proxy or direct-connect status for each listed MCP server
- Proposed: named owner and compensating control for each system that cannot be patched on a rolling cycle
- Risks
- Treating interview statistics as contractual performance targets
- Adding an AI gateway while leaving endpoint and zero-trust basics weak, contrary to Rajavel's own caution
- Over-weighting an unverified foreign regulator letter as if it were a U.S. requirement
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Defenders who accept Rajavel's model would place virtual patching in front of unpatchable systems, maintain attack-surface visibility including where AI is deployed, and interpose an LLM/MCP gateway so agents do not connect directly to MCP servers. These are architectural recommendations from a vendor interview, not a reference design with measured latency or block rates.
Governance
Who approves, reviews and stays accountable for outcomes?
Rajavel argues organisations should evaluate AI risk and set runtime guardrails for what may operate autonomously based on business risk, using critical-infrastructure containment and insurance-claim thresholds as examples. The CSA Singapore board letter, if accurately described, moves frontier-AI defence from an IT discussion to board oversight — attributed, not independently verified here.
Security and privacy
What data, permissions and controls need testing?
The interview's security claim is that frontier models both find undisclosed vulnerabilities and chain them, while attackers use AI agents at machine speed (over 50 techniques in under 10 hours in one cited Unit 42 case; 72 minutes to exfiltration in the fastest cited report cases). Prisma AIRS is described as checking agent artefacts against goal tampering. None of those detection claims is independently tested in the article.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Runtime governance that requires a human for high-risk actions, as in Rajavel's critical-infrastructure example, creates an on-call and exception-handling load that understaffed SLED SOCs must plan for. The article does not discuss accessibility of the consoles themselves.
Procurement
What should contracts, pricing and exit terms secure?
Buyers should treat Prisma AIRS, virtual patching and MCP gateway features as items to prove in a scoped evaluation, not as capabilities whose effectiveness is established by this interview. The article offers no pricing, licensing or FedRAMP detail.
Operating model
Which teams own the service once it runs?
Rajavel describes two simultaneous demands: defending against frontier-AI-powered attacks at machine speed and adopting AI for productivity without exposing the organisation. Interpretation: operating models that leave AI governance only in IT, rather than with executives, would be out of step with the board-level framing she attributes to CSA Singapore.
Publication history
- 2026-11-07Palo Alto Networks · Issue 092 resources
Stable resource ID: computerweekly-panw-cio-rajavel-frontier-ai-flaws-no-cve-20261106