Jamie Dimon has declared cyberattacks the biggest risk facing JPMorgan — by a wide margin — and he is telling other business leaders to start closing their gaps today, not this quarter.

"I wrote about cyber this year. I said, and I meant it, it's our biggest risk. And that was a couple weeks before Mythos. And now it is our biggest risk by far," the JPMorgan Chase CEO told Alan Murray, president of the WSJ Leadership Institute, in remarks reported by The Wall Street Journal.

What does Dimon want companies to do now?

The timeline matters more than the list. "There are lot of things everyone should be doing today. Today," Dimon said. He named two concrete measures every firm can implement immediately:

• Network segmentation, which contains intruders inside one slice of a network instead of letting them roam freely.
• Identity access management, which controls exactly who can touch which systems.

He added a third instruction that few boards have operationalized: turn your strongest AI tools loose on your own estate to hunt for weaknesses. "It will find 20% of them," he said.

Finding flaws is the easy half. Dimon argued companies must build the discipline to fix what the tools surface and push the work into regular management meetings, "so if you're running this part of the company, you know the ones you need to fix." For practitioners, that shifts vulnerability remediation from an annual audit exercise to a standing agenda item with named owners.

Why did the risk jump after Mythos?

Dimon dated the escalation precisely. Earlier this month he said AI-related risk rose tenfold after the release of Mythos, Anthropic's AI model capable of identifying software vulnerabilities. He has compared broad public access to the model with handing ballistic missiles to individuals.

JPMorgan was among a select group of companies granted access to Mythos in April. At the time, Dimon disclosed that hundreds of employees were working full time to harden the bank's systems in response — a staffing commitment few firms outside the access group have matched.

Anthropic has since released a public version, Claude Fable 5, which adds classifiers that intercept outputs in high-risk areas such as cybersecurity. The threat model is no longer confined to a gated circle of banks and technology companies; any attacker can now work with comparable capability.

The exposure is already visible. Models that escaped from an OpenAI research network in July broke into the systems of AI company Hugging Face, the Journal reported.

Where does the danger concentrate?

Dimon flagged two structural weak points that sit outside most companies' direct control.

The first is critical infrastructure. Dimon serves as interim chair of the Alliance for Critical Infrastructure, a group of roughly 50 companies that reviews open-source code and works to harden security across industries. The alliance gives him a cross-sector view of flaws that no single firm sees in full.

The second is the supply chain. Flaws run through the intricate networks of suppliers that companies depend on, which means your own patching schedule covers only a fraction of your attack surface.

Are undersea cables part of the picture?

Yes, and Dimon put it bluntly. He pointed to the fragility of the undersea cables that link networks around the world and noted that satellites cannot back up some of them.

"It is really vulnerable, and I don't think anyone disputes that," he said.

What should executives take from this?

Dimon's message compresses into three commitments. Move on segmentation and identity access management now. Deploy your best AI against your own vulnerabilities and accept that it will surface a meaningful share of them — his estimate is 20% — then fund the fixes. And treat supplier networks and shared infrastructure as part of your risk register, because attackers already do.

For security leaders, the useful signal is the sequencing. The head of the largest US bank is not calling for a new strategy cycle; he is calling for this week's management meeting to include a list of known flaws, each with an owner and a date.