
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Guide
This guide is for leaders and managers looking for an external company to implement AI who want to compare candidates fairly, not by who gives the best presentation. You get 10 assessment criteria, questions for the first meeting, a list of warning signs and the clauses worth having in the contract.

Companies doing very different things all operate under the banner of “AI implementation”. Before you start comparing proposals, work out which kind you need. The table below shows the four most common types, with their strengths and weaknesses.
A mid-sized company without its own AI team is usually best served by a supplier that combines advice with delivery. ALGORCOMP belongs to this group, which is all the more reason for us to encourage you to assess us against the same criteria as everyone else.
| Type of supplier | Strength | Risk | When it fits |
|---|---|---|---|
| Tool vendor or reseller | Knows its own product best | Proposes its product whether or not it solves your problem | You know exactly which tool you need |
| Software development company | Can build almost any solution | Will not design the process or lead the change in your team | You have a finished design and your own project manager |
| Consultancy | Strong analysis and strategy | Delivery goes to another team that does not know the context | You need a strategy and will choose the delivery partner separately |
| Implementation company combining advice and delivery | One team from process analysis to go-live | May favour the tools it specialises in | You have no AI team of your own and want one party to be accountable |
Score each candidate on a scale of 1–5 for each criterion in the list below. Before scoring, decide which criteria will rule a supplier out with a score of 1–2, regardless of the total. For most companies, these will be data security and verifiable references.
The first two criteria usually separate candidates the most. Everyone has a website full of AI slogans these days, but not everyone has working implementations in similar companies.

The first meeting should not be a demonstration of what AI can do. A good supplier will ask more questions than you: about the process, the data, the exceptions and how you measure results today. If the meeting turns into a monologue about technology, that is valuable information.
The answers to the questions in the list below quickly show whether a supplier has real implementation experience. Pay particular attention to the second question, because answering it honestly takes courage.
Some signs deserve to be taken seriously however attractive the proposal is. The strongest of them: the supplier cannot name projects that are not worth doing. A partner who will do “everything” usually cannot tell a cost-effective automation from an impressive demo.

A good AI supplier will tell you sooner what is not worth doing than promise to do everything.
You send the request for proposal (RFP) to three to five candidates after the first meetings. It should give suppliers enough information to prepare a realistic proposal, not a general presentation.
A few pages are usually enough. An overly long and detailed request puts off the best suppliers, who can pick and choose, and says little about what really matters.
The most common mistake when assessing proposals is comparing only price and timing. The cheapest proposal can turn out the most expensive in its consequences, because it leaves out data preparation, testing or maintenance. A simple table with weightings, agreed before the proposals are opened, helps.
The table below shows a hypothetical comparison of two proposals. Supplier B is cheaper and gets the top score for cost, but loses because of a weaker fit with the problem, a less experienced team and weaker data protection. The weighted score is the sum of each weighting multiplied by its score. For supplier A: 0.25 × 4 + 0.2 × 3 + 0.2 × 4 + 0.15 × 4 + 0.2 × 3 = 3.6.
A proposal without a list of risks should put you on your guard. Every AI implementation has risks, and a supplier who cannot see them will not be prepared for them.
| Criterion | Weighting | Supplier A | Supplier B |
|---|---|---|---|
| Fit with the problem described in the RFP | 25% | 4 | 3 |
| Realistic plan, budget and list of risks | 20% | 3 | 3 |
| Experience of the specific people on the team | 20% | 4 | 3 |
| Security and data protection | 15% | 4 | 3 |
| Cost and contract terms | 20% | 3 | 5 |
| Weighted score | 100% | 3.6 | 3.4 |
Instead of signing a contract for the whole implementation straight away, commission a paid pilot from the finalist. It is sometimes called a proof of concept. It is a short project on one process and real data that tests both the solution and the working relationship with the supplier.
A pilot only makes sense if the result can be assessed. Before it starts, write down what you will count as success, for example “AI correctly extracts data from at least 9 out of 10 documents in the test sample”. Choose figures that fit your own process.
Be wary of very cheap pilots. They are often a demonstration of a ready-made solution on sample data, not a test on your documents and exceptions. We have listed the elements of a well-designed pilot below.
A contract for an AI implementation differs from a typical software contract. The solution uses models that their makers change, and data that belongs to you. The clauses below protect you from the most common disputes.
Related topics in the knowledge base
FAQ
Questions that management boards usually ask while choosing an AI implementation partner.
About this page
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will explain how we work, answer the questions on this list and help you judge whether your process is suitable for a pilot. We will prepare a detailed quotation after that conversation.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.