
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Guide
This guide is for owners and directors of companies with a few dozen to a few hundred employees. They want to start using AI but not to spend money on a project that delivers nothing. We show how to choose your first process, how to work out how much it is worth spending on it and how to plan the first 90 days. At the end you will find questions to ask vendors and signs that it is better to wait.

Most failed starts begin with a tool rather than a problem. The company buys licences because “everyone has AI now”, or commissions a big build because a vendor gave an impressive presentation. A few months later, nobody can say what has improved.
Below are the three scenarios we see most often. Each of them costs money and, worse still, puts the team off trying again.
A good first process is one that is repeated many times a week and takes up the time of people who could be doing something more valuable. It must also be measurable before and after implementation. Otherwise you will not be able to tell a real effect from an impression.
Make a list of the five to ten tasks your team complains about most. Then score each one against the criteria in the table below. Start with the one that meets the most criteria, even if it is not the most impressive.
| Criterion | Check question | Warning sign |
|---|---|---|
| Frequency | Is the process repeated at least a few dozen times a week? | It happens once a month |
| Repeatability | Do most cases look similar? | Every other case is “special” |
| Digital data | Is the information in emails, files or a system? | Key knowledge exists only in one person’s head |
| Measurability | Can you count the number of cases, handling time and number of errors? | Nobody knows how long it takes today |
| Impact of mistakes | Can an error be caught before it reaches the customer? | A mistake means a contractual penalty or losing a customer |
| Process owner | Does someone know the process and have time to lead it? | “Let the IT person deal with it” |

In most service, trading and manufacturing companies, the candidates for a first process are similar. They are the places where people do a lot of reading, retyping and answering repetitive questions.
For documents, bear KSeF in mind. Since 1 April 2026, most invoices from Polish suppliers have arrived through KSeF, Poland’s National e-Invoicing System, as structured data. Having AI read PDFs therefore makes sense mainly for foreign invoices, receipts, contracts and orders.
In the table below, we also note for each area what stays with people. This matters when you estimate savings, because AI rarely takes over the whole job.
| Area | What AI does | What stays with people | What to watch out for |
|---|---|---|---|
| Customer enquiries (email, form, chat) | Identifies the topic, checks order status, drafts a reply | Approving replies, unusual cases and complaints | A customer-facing chatbot must say it is AI (Article 50 of the AI Act) |
| Documents (contracts, orders, invoices from outside KSeF) | Reads the data, compares it with the order, flags discrepancies | Decisions on discrepancies and unusual documents | Scan quality and the number of different document layouts |
| Quotes and requests for quotation | Collects data from the request, picks items from the price list, writes a first draft of the quote | Price, discount, terms and final wording | Whether the price list and product descriptions are up to date |
| Internal knowledge (procedures, instructions) | Answers employees’ questions based on company documents | Keeping the source documents up to date | Several versions of the same procedure in different folders |
Not every process needs an implementation project. Often an off-the-shelf tool and well-prepared instructions for the team are enough. Configuration or a build is only needed when AI has to use data from your own systems.
For example, if your company already has Microsoft 365, start with the free Copilot Chat included in the subscription. Give the paid Copilot Business first to a few people who work most with documents and email. After two or three months, check who is really using it.
The levels in the table below can be combined. Many companies start with the first and move to the second for the process that proved most promising.
| Level | Example | When it is enough | Limitations |
|---|---|---|---|
| 1. Off-the-shelf tool for employees | Microsoft 365 Copilot, the business version of ChatGPT | Writing, summarising, analysing individual documents | Does not change the process; results depend on people’s habits |
| 2. Configuration on an existing platform | An agent in Copilot Studio connected to SharePoint, an automation in Power Automate | A repeatable process using data from Microsoft 365 and one or two other systems | Needs well-organised data and someone to maintain the solution |
| 3. Custom-built solution | An AI agent connected to the ERP and CRM, with its own rules | A business-critical process that off-the-shelf tools cannot handle | Highest upfront cost and more responsibility for maintenance |

Your first AI project is not meant to transform the whole company. It is meant to prove, on one process, that the change pays off.
The answer does not come from the vendor’s price list but from the cost of your process. Work it out before your first conversation about a quote. Then you will see straight away whether the proposed amount has a chance of paying back.
Take a hypothetical distribution company with 60 employees. Its customer service team receives 40 emails a day, and replying to one takes 5 minutes on average. That is 200 minutes a day, or about 3.3 hours – about 830 hours a year over 250 working days.
Assume that AI drafts the replies and cuts handling time by 40%. The team gets back about 330 hours. At a fully loaded hourly cost of PLN 60, that is about PLN 20,000 a year.
This amount is the upper limit for the solution’s annual cost if it is to pay back in the first year. If a quote is clearly higher, you have three options: narrow the scope, choose a cheaper level from the previous section or look for a process on a larger scale.
We describe the full list of cost components and the return on investment (ROI) formula in a separate guide on AI budgets. Here, one rule is enough: measure the current state carefully, and be cautious with your assumptions about savings.
Ninety days is a sensible horizon for a first pilot. It is long enough to launch a solution on one process and collect a few weeks of measurements. It is also short enough that any loss will not shake the company’s budget.
The breakdown below is indicative. With a simple off-the-shelf tool, implementation is quicker; with an ERP integration, it may take longer.
A vendor that understands mid-sized companies will answer the questions below specifically and in writing. Vague answers such as “it depends on your specifics” with no further explanation are a warning sign.
Ask all bidders the same questions and put the answers side by side in one table. You will see differences in approach faster than in the prices alone.
Even a well-chosen process can be spoiled by the way the project is run. These three mistakes are the ones we see most often in small and mid-sized companies. Each can be avoided with a single decision before you start.
The first mistake is tackling several processes at once. The team is overloaded, the budget is spread thin, and no process works well enough for people to like it. One process done properly is worth more than five done halfway.
The second mistake is having no one accountable on the business side. If the project is run only by the IT person or the vendor, after six months nobody is asking for improvements and the tool falls out of use. The project should be owned by the department manager who stands to gain from the change.
The third mistake is springing it on the team. Employees who learn about AI from an email saying “from tomorrow we are using a new tool” assume the worst. Talk to them two or three weeks before the launch: what will change, what stays their responsibility and what their day will look like.
In many companies AI is already in use – it is just that nobody decided it should be. Employees paste the content of emails or contracts into free tools on personal accounts. That data can end up outside the company’s control.
That is why it is worth writing short rules alongside your first project. One or two pages are enough: which tools we use, which data we do not paste in and who checks the results before they go to a customer.
This is also a way to meet the requirement in Article 4 of the AI Act, which since 2 February 2025 has required measures to build employees’ knowledge of AI. The law does not require every company to have a formal AI policy, but written rules and a short training session are the simplest way to show that the company has taken care of it.
An honest assessment sometimes leads to the conclusion that AI is not the best use of money right now. If you recognise any of the situations below in your company, remove the obstacle first and come back to the subject in a few months.
On the other hand, a good signal to start is when the team complains about specific, repetitive tasks, or customers complain about how long they wait for a quote. The situations in which it is better to wait are listed below.
Related topics in the knowledge base
FAQ
Questions business owners usually ask after their first conversation about AI.
About this page
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will go through your list of processes, identify a candidate for a pilot and help you work out what it costs today. We prepare an implementation quote only after that conversation.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.