
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Expert article
This article is for owners and management boards of mid-sized companies who keep hearing that AI will take people’s jobs and do not know what to do about it. We show where the bigger risk to the company lies, how Poland compares with the rest of the EU, and which processes it makes sense to start with. At the end you will find a plan for the first 90 days.

The question “will AI take people’s jobs?” comes up at every conference. For a mid-sized company, the answer is usually: it will take over some tasks, but rarely whole jobs. An accountant is still needed, but no longer has to re-key data from documents.
It is also only fair to say that some roles will change. If someone spends most of the day re-keying data between systems, their work will look different. A company that keeps quiet about this will quickly lose its team’s trust.
However, a change in the scope of work does not have to mean redundancies. Many companies use the time freed up to serve more customers or to take on tasks they previously did not have the people for. That is a decision for the management board, not for technology.
A bigger threat than job losses is losing customers to a company that serves them faster. Response speed has mattered for a long time. In a study described in Harvard Business Review in 2011, contact within an hour gave nearly 7 times the chance of a meaningful conversation compared with contact an hour later.
These figures predate the AI era, but they show the mechanism. If a competitor replies to an enquiry within an hour and you reply after two days, some customers will never even hear about your offer.
Take two hypothetical wholesalers with 60 employees each, a similar product range and similar prices. In the first, a salesperson prepares a quote manually, checking stock levels and price lists in three systems. In the second, AI gathers this data and prepares a draft, which the salesperson checks and sends.
The second company does not need better people or lower prices. It wins because its quote reaches the customer first and is complete. Below are three areas where this difference shows most often.

Eurostat data shows that Polish companies use AI much less often than the EU average. In 2025, roughly one company in twelve in Poland did so, compared with one in five across the EU. The table below sets out the key figures.
There is a simple reason for the big gap between large and small companies. Large organisations have IT departments and budgets for first projects. Smaller companies more often wait for the tools to become simpler – and that is exactly what is happening now.
For a mid-sized Polish company, this is an opportunity rather than a verdict. In many industries, AI is not yet standard. Those who implement it sensibly now are building an advantage that competitors will have to catch up with.
| Group | Share of companies | Year |
|---|---|---|
| All companies in the EU | 19.95% | 2025 |
| All companies in the EU | about 13.5% | 2024 |
| Companies in Poland | 8.36% | 2025 |
| Large companies in the EU | 55.03% | 2025 |
| Small companies in the EU | 17% | 2025 |
In practice, AI in a mid-sized company handles three kinds of work. The first is reading documents and extracting data from them, e.g. from orders, contracts or shipping documents. The second is answering questions from customers or employees based on company procedures and price lists.
The third kind is running repetitive processes. Instead of thirty emails between departments, a request goes through set steps, and AI prepares the data for the decision. A person still decides, but does not waste time gathering information.
AI makes mistakes, so important documents must be checked by a person. A well-designed process allows for this from the start. Below are examples of tasks that mid-sized companies most often find worth handing over to AI.

Customers do not know whether you work with AI. They only know who replied first and whether the reply was any good.
Do not start with the question “where can we use AI?”. Start by asking where the company loses the most time every day and where customers wait longest. Department managers know the answers, not tool vendors.
It is worth assessing each candidate process against the four criteria in the table below. The best process to start with is one that scores well on the first three criteria and has a low cost of error.
Choose two, or at most three, processes. More at once scatters the team’s attention and makes it harder to judge what really worked.
| Criterion | Check question | Good candidate |
|---|---|---|
| Number of repetitions | How many times a week is this task repeated? | Dozens or hundreds of times |
| Working time | How many minutes does one repetition take? | Several minutes or more, mainly spent searching and re-keying |
| Impact on the customer | Is the customer waiting for the result of this work? | Yes, e.g. for a quote or a reply |
| Cost of error | What happens if the AI makes a mistake? | The error is easy to catch before sending |
Employees who learn about automation from a general email assume the worst. Their resistance then does not stem from dislike of technology, but from a lack of information about what will change in their work.
It is best to start by talking to the people who carry out the process. Ask which tasks they find most tiresome and where they most often make mistakes. People are more willing to accept a tool they helped to design.
Say plainly what the company will do with the time freed up. If you are not planning redundancies, say so. If someone’s scope of work will change, plan training before the tool goes into use.
A first AI implementation often fails to deliver for reasons that have nothing to do with technology. The mistakes below recur regardless of industry and company size.
Most of them can be avoided before you even sign a contract with a vendor. It is enough to agree on a success measure, a person responsible and a way of checking the results.
It is worth treating the first implementation as a pilot with a decision at the end. The plan below assumes one process and one team. The pace depends on how many systems need connecting and how well organised the data is.
After 90 days you should have figures, not impressions. If the effect is weaker than expected, it is usually enough to improve the process or the data rather than abandon the whole idea.
Related topics in the knowledge base
FAQ
The questions owners of mid-sized companies ask most often when considering their first AI implementation.
About this page
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation we will go through your candidate processes, assess them against the criteria in this article and point to the one best suited to a first pilot.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.