I know I'll get downvoted for this, but here goes. I was in a position to see some of the mythos derived results early. In my organization everyone was running around with their hair on fire. I asked whether or not any of the vulnerabilities mythos found were also found with existing static analysis tools. The result was blinkblink "what are static analysis tools?"
I'm not saying mythos didn't find anything new, but several people who should have known better were not using SAST/DAST tools to find potential vulnerabilities before pushing their code into the great unknown. One person I talked to said they didn't bother because GitHub automatically runs SAST tools against pull requests. I looked. Their CICD pipeline had no such tool configured. I'm pretty sure it's more appropriate to say GitHub CAN run SAST/DAST tools, if you configure it, but it won't run SAST/DAST tools by default.
This was a very small sample, but I wonder how common this type of confusion is.
I'm not saying mythos didn't find anything new, but several people who should have known better were not using SAST/DAST tools to find potential vulnerabilities before pushing their code into the great unknown. One person I talked to said they didn't bother because GitHub automatically runs SAST tools against pull requests. I looked. Their CICD pipeline had no such tool configured. I'm pretty sure it's more appropriate to say GitHub CAN run SAST/DAST tools, if you configure it, but it won't run SAST/DAST tools by default.
This was a very small sample, but I wonder how common this type of confusion is.