
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Guide
This guide is for management boards and managers who want employees to find answers in procedures, contracts or manuals more quickly. We explain without jargon how RAG works, when it makes sense and when something simpler will do. We also use an example to show what it costs and what needs to be prepared before launch.

An ordinary AI chat answers from what it learned from public texts. It does not know your price list, procedures or supplier contracts. Asked about them, it guesses or answers in generalities.
RAG works like an employee who checks the files before answering. The system first searches the company’s documents for a few passages that match the question. Then the language model – the program that writes the answers – composes an answer from them and points to the source document.
As a result, a new document is available as soon as it is added to the collection. There is no need to retrain the model, and every answer can be checked against its source.
For example, an engineer asks in Microsoft Teams about the permissible dimensional tolerance for a particular product. The assistant finds the right process sheet and gives the value with a link to the document. Our case study of a knowledge assistant for production engineers shows how this works in practice.
RAG pays off when people often look for answers in a large collection of documents that change. When there are few questions or only a handful of documents, a simpler solution is enough.
RAG is often confused with further training a model on your own data (fine-tuning). Fine-tuning changes how the model writes, but it does not guarantee that it will give a current fact. For questions about procedures, price lists and contracts, RAG works better, because you only need to swap the document.
The table below helps you match the solution to the situation.
| Situation | What to choose | Why |
|---|---|---|
| A few to a dozen or so documents, occasional questions | Uploading the files to an AI chat, or a good search engine | All the material fits into a single query to the model |
| Hundreds or thousands of documents in SharePoint, frequent questions from employees | An off-the-shelf tool: Microsoft Copilot or an agent in Copilot Studio | Document search is built in and permissions work straight away |
| Documents in several systems, e.g. the ERP, the document workflow system and a network drive | A custom-built solution, e.g. on the Azure AI Search service in the Microsoft cloud | The sources need to be connected and access rules designed |
| Questions that require calculation, e.g. “how much did we sell in Q3?” | A report or data model in Power BI, not RAG | RAG searches text; it does not add up tables |
| The model should adopt the company’s style and vocabulary, not facts | Fine-tuning the model | RAG supplies knowledge but does not change the way the model writes |

In Microsoft’s off-the-shelf tools, most of these elements work without your involvement. In a custom-built solution, each one is a separate design decision. Below we describe them in the order a document passes through them.
Most quality problems arise in the first two steps. If a table in a PDF is badly converted to text, no model will fix it later.
For most mid-sized companies working in Microsoft 365, the sensible order is an off-the-shelf tool on one set of documents first, and only then, if needed, a custom build. A custom solution gives more control, but it has to be maintained for years.
The prices in the table are vendors’ list prices from October 2026; for Microsoft, with annual billing. Check the current price list before you decide.
| Option | For whom | How you pay | Limitations |
|---|---|---|---|
| Microsoft Copilot with a Microsoft 365 Copilot licence | Companies that keep their documents in SharePoint, OneDrive and Teams | USD 30 per user per month; the Business version is USD 21 for organisations with up to 300 users | It searches everything the user has access to – harder to limit it to “official” documents only |
| An agent in Copilot Studio | An assistant for one department, e.g. quality or HR, available in Teams | Credits bought for the whole organisation, or pay-as-you-go | You choose the sources, but there are limits on their number and on file size |
| Azure AI Search and an AI model | Many data sources, custom access rules | A fee for search service capacity plus model usage; there is a free tier for testing (50 MB) | Requires developers’ work and ongoing maintenance |
| The popular PostgreSQL database with the free pgvector extension | Companies with their own IT team that already use PostgreSQL | No licence fees; you pay for the server and the work | Maintenance and security are entirely your responsibility |
| A cloud vector database, e.g. Pinecone | Custom-built solutions with a large number of documents | Free plan up to 2 GB; Standard plan with a minimum charge of USD 50 a month | Data goes to yet another provider – a data processing agreement (DPA) is needed |

RAG will not fix an outdated procedure – it will just quote it faster and with more conviction.
Let us show the costs for a hypothetical company that wants to give employees access to 20,000 documents averaging 5 pages. An AI model counts text in tokens, which are fragments of words. Let us cautiously assume 1,000 tokens per page, because Polish text splits into more tokens than English.
The whole collection is therefore 20,000 × 5 × 1,000 = 100 million tokens. At USD 0.13 per million tokens, the one-off conversion into a searchable form costs USD 13, or USD 2 with the cheaper model. You will pay the same again to reprocess everything, e.g. after changing the model.
Questions also need processing, but this costs next to nothing. 200 questions a day of 50 tokens each over 22 working days gives 220,000 tokens, or about USD 0.03 a month.
A bigger item is the model that writes the answers. With each question you send the passages found, e.g. five of 500 tokens each, about 3,000 tokens in total. Per month, that is 4,400 questions × 3,000 = 13.2 million tokens, which you multiply by the current price of the chosen model.
The biggest cost has no price in any price list. It is the time of the people who choose the documents, remove old versions, sort out permissions and check the answers. The table below brings all the components together.
| Component | When you pay | Order of magnitude |
|---|---|---|
| Converting 100 million tokens of text into a searchable form | Once, and again when the model changes | USD 2–13 |
| Processing questions | Monthly | Under USD 1 |
| Vector database or search service | Monthly | From a free plan for small collections to capacity-based fees |
| Model that writes the answers | Monthly | 13.2 million tokens × the model’s price |
| Licences for an off-the-shelf tool, if you choose one instead of building | Monthly or annually | E.g. USD 21 or USD 30 per user per month |
| Work on documents, permissions and testing | At the start and with every major change | Depends on the state of the documents – usually the largest item |
The quality of answers depends more on the documents than on the choice of AI model. The list below is the minimum worth doing before launch.
These steps are useful even without AI. An ordinary search engine will also search a well-organised set of procedures faster.
Before launch, prepare a set of several dozen questions that employees really ask. For each one, record the answer approved by the owner of the collection.
Assess three things separately: whether the system found the right document, whether the answer matches it, and whether the assistant admits it does not know when the answer is not in the documents.
The last point is the most important. An assistant that says “I could not find this in the documents” is safer than one that always gives some answer. In Copilot Studio, you can switch off answers that are not based on sources.
Repeat the test after every change: a new model, new documents, a different way of splitting the text. Providers regularly retire older models, so you will face such a change sooner or later.
The assistant should not show employees more than they can see in their own folders. Microsoft’s off-the-shelf tools check the permissions of each person signed in through Microsoft Entra ID. In a custom-built solution, you have to design and test this yourself.
For services outside Microsoft 365, find out in which region the data is stored and whether the provider uses it to train models. If the documents contain personal data, you need a data processing agreement.
If the assistant is to answer customers, from 2 August 2026 it must tell them they are talking to AI. This is an obligation under Article 50 of the AI Act, not just good practice.
Related topics in the knowledge base
FAQ
Questions management boards and managers ask after their first conversation about a knowledge assistant.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will identify a starting set of documents, assess whether an off-the-shelf Microsoft tool is enough and tell you what to prepare before launch.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.