The Board Room

Deep dives

1. 01

   Your AI Agent Infrastructure Has No Security Foundation — RSAC 2026 Just Made That Official

   The Category Just Crystallized

   RSAC 2026 wasn't a trade show this week — it was a coordinated industry admission that agentic AI has outrun its governance infrastructure. Google, Cisco, Palo Alto Networks, and the Cloud Security Alliance simultaneously launched AI agent security products and frameworks. Cisco's Duo Agentic Identity treats AI agents as full identities with policy enforcement. Palo Alto's Prisma AIRS 3.0 unifies agent security across identity, posture, and runtime. The CSA launched an entire nonprofit — CSAI — for the 'agentic control plane.' When four players converge on the same problem in the same week, you're watching a market category crystallize.

   Whoever owns your NHI governance layer will have a gravity pull on your broader security architecture. This is a platform decision masquerading as a security tool purchase.

   The Protocol Layer Is Broken by Design

   The most alarming finding: MCP — Anthropic's Model Context Protocol, increasingly the standard for connecting AI agents to tools — has no versioning, content hashing, or approval-time snapshots. A malicious MCP server can silently rewrite a tool's description and behavior between the moment a user approves it and the moment the agent executes it. Neither Datadog nor LangSmith can detect this because they record what was called, not whether it matched what was authorized. This creates direct compliance gaps under HIPAA, SOC 2, and EU AI Act Article 12.

   Compounding this, XM Cyber mapped eight validated attack vectors in AWS Bedrock where a single over-privileged identity can hijack agents, strip guardrails, poison prompts, and exfiltrate data — all without triggering a redeployment. The cloud AI security conversation needs to shift urgently from model security to permissions and integration security.

   Autonomous AI Bots Are Already Attacking Your Supply Chain

   Step Security revealed that an AI bot ('hackerbot-claw') systematically compromised Trivy's CI/CD pipeline, stole Personal Access Tokens, and pushed malicious code to GitHub Actions, DockerHub images, and VS Code extensions — hitting Microsoft, DataDog, and CNCF projects simultaneously. Aqua Security detected the compromise and rotated secrets, but acknowledged the process 'wasn't atomic and attackers may have been privy to refreshed tokens.' The attack recurred on March 19 and March 22.

   Separately, a former deputy national security advisor confirmed that AI crossed from accelerating known attacks to generating novel exploits in 2026 — new tactics and techniques that don't appear in any historical threat database. Sysdig's Langflow research showed a critical RCE was exploited within 25 hours of disclosure, with attackers building working exploits from the advisory description alone.

   The Social Engineering Threat Model Inverted

   Mandiant M-Trends data reveals a complete inversion: vishing now accounts for 11% of investigated incidents while email phishing collapsed from 22% (2022) to 6%. Organizations still over-indexed on email security are deploying capital against a shrinking threat. Meanwhile, a systemic Microsoft OAuth device authentication exploit is granting attackers 90-day persistent access that bypasses MFA entirely, with hundreds of businesses already compromised.

   ---

   The connecting thread: your AI agent strategy and your security strategy must be unified under single executive governance this quarter. The NHI platform choice is being made now, and it will have the same gravity as your cloud platform choice had a decade ago.

   What to do

   1. →

      Commission an NHI audit by end of Q2 — map every AI agent, service account, and non-human identity in your environment and assess governance gaps against RSAC frameworks

      NowVendor landscape is crystallizing; platform decisions made this quarter will lock in architecture for years
   2. →

      Mandate SHA-256 hashing at MCP approval time and pre-execution verification for all MCP-based agent deployments within 30 days

      NowMCP's zero-integrity design is being actively exploited and no vendor has shipped a fix yet
   3. →

      Establish sub-24-hour patching SLA for CVSS 9.0+ vulnerabilities with compensating controls within 4 hours of disclosure

      NowLangflow exploitation timeline proves traditional patch windows are structurally inadequate
   4. →

      Rebalance security budget from email-centric controls toward voice channel authentication and vishing detection by next budget cycle

      This sprintMandiant data shows email phishing share dropped 73% while vishing surged 83% — investment should follow threat
2. 02

   Enterprise SaaS Is Splitting on AI Agent Access — And Anthropic Can Bypass Both Sides

   The New Competitive Axis

   A new fault line is dividing enterprise software: open vs. closed on AI agent access. The split is already visible across platforms you likely depend on:

   Platform	Posture	Strategy
   GitHub	Open	Agent-friendliness drives adoption and ecosystem lock-in through usage
   Figma	Open	Betting value transcends the interface layer
   Slack/Salesforce	Curated	12 MCP partners (OpenAI, Anthropic, Cursor, Perplexity) with rate limits — the app store playbook
   Workday	Monetized	Planning to charge for AI agent access — 'agent access as a product'
   WhatsApp/LinkedIn	Closed	Security justification partially covers business model protection

   This is the most consequential enterprise software dynamics shift since the API economy. The 'security' justification for restriction is partially legitimate — Workday holds sensitive HR and financial data — but the pattern of restricting broad access while building first-party agent tools and planning to charge for third-party access reveals business model protection is equally motivating.

   The Computer-Use Wildcard

   Here's what should keep every SaaS CEO awake: Anthropic's computer-use Claude operates at the screen level — clicking buttons, navigating menus, reading data — exactly as a human contractor would. If Claude can operate any application through its GUI, then MCP restrictions, API rate limits, and curated partner programs become irrelevant. The agent simply uses the software the way a human would.

   Any monetization strategy premised on controlling a protocol-level chokepoint has a shrinking half-life when the alternative is a screen-level bypass.

   Anthropic shipped this from acquisition to product in four weeks via the Vercept deal — a velocity that compresses the window for competitors to respond. The strategic implication for enterprise SaaS: the smart play isn't gatekeeping, it's making your platform so valuable at the data and workflow layer that customers want to connect agents through official channels because the experience is dramatically better than screen-scraping.

   Procurement Implications Are Immediate

   The emerging pattern mirrors what happened with API availability a decade ago. Arcade.dev's ToolBench ranking — biased though it may be — is a leading indicator that 'agent accessibility score' will appear on enterprise RFP checklists within a year. For your organization right now:

   • Your vendor selection today determines your automation ceiling tomorrow
   • Lock agent access terms into contracts before vendors like Workday finalize their pricing models
   • Evaluate computer-use agents (Claude, OpenClaw) as a hedge against platform gatekeeping
   • Products without clean, well-documented APIs become second-class citizens in an agent-orchestrated workflow

   The companies that audit their stack now, negotiate agent access terms into contracts, and build orchestration capabilities across open and closed platforms will have a decisive operational advantage over those that discover this dynamic in 2027.

   What to do

   1. →

      Audit your enterprise software stack for AI agent openness by end of Q2 — map which critical systems are open, restricted, or closed, and identify workflow bottlenecks

      This sprintAgent accessibility is becoming a procurement criterion within 12 months; you need the map before renewal cycles
   2. →

      Negotiate AI agent access terms into all enterprise software contracts during next renewal window

      This quarterTerms set now will lock in before vendors like Workday finalize monetized agent access pricing
   3. →

      Evaluate Claude computer-use and similar capabilities as a hedging strategy against platform gatekeeping before Q3

      This quarterScreen-level agent bypass makes MCP restrictions strategically futile in the medium term — you need optionality
   4. →

      If you operate a SaaS platform: convene a strategy session this month to define your agent access posture — open, curated, or monetized — before the market decides for you

      This sprintThe bifurcation is happening now; indecision is the worst positioning
3. 03

   3.3% Copilot Penetration Just Killed the Distribution Thesis — Here's What OpenAI Is Building Instead

   The Number That Changes Everything

   The most devastating data point in AI this week: Microsoft has 15 million Copilot paying seats on a 450 million commercial customer base — 3.3% penetration. Microsoft had every structural advantage: the install base, the enterprise relationships, the bundling power, the OpenAI partnership. And it hasn't worked. This is the strongest evidence yet that distribution moats do not transfer to AI products. Users adopt AI when it genuinely transforms their workflow, not when it's bundled. This is a product quality problem, not a distribution problem.

   The consumer numbers tell the same story. ChatGPT's 440M DAU holds ~80% of the top-four market. Microsoft Copilot at 6M DAU has been surpassed by Claude at 9M — despite Claude being nowhere near a consumer-focused product. Meanwhile, Microsoft's Azure AI platform head (Eric Boyd) defected directly to Anthropic. This is not turnover; this is institutional decay in the divisions that matter most.

   OpenAI's Three-Pronged Response

   OpenAI is executing a rapid strategic pivot with three simultaneous moves:

   1. Advertising: Hired Dave Dugan (10+ year Meta ad sales exec) as VP of Global Ad Solutions. Criteo partnership with $50K-$100K entry packages. Expanding ads to all US free-tier users imminently. ChatGPT has 900M weekly active users but only ~5% pay — the subscription ceiling is confirmed.
   2. PE financial engineering: Guaranteeing 17.5% minimum returns to PE firms (TPG, Advent) through JV structures, in exchange for deploying AI across portfolio companies. This bypasses the traditional enterprise sales motion entirely — AI stack decisions get made at the LP level, not the CTO level.
   3. Superapp consolidation: Fidji Simo's internal memo acknowledges too many products were degrading quality. ChatGPT, Codex, and Atlas are merging into a single desktop application — driven explicitly by Claude Code's competitive pressure on developer mindshare.

   An ad-supported AI assistant has fundamentally different alignment than a subscription-supported one — the former optimizes for engagement, the latter for task completion. Enterprise buyers need to understand this distinction.

   The Critical Vulnerability

   Early advertisers literally cannot prove ChatGPT ads work. Conversational AI is a fundamentally different advertising surface than feed-based social media or search. Intent signals are different. Attention patterns are different. OpenAI's expansion to all free-tier users addresses the impression volume problem but not the attribution problem. If OpenAI cracks conversational advertising, it creates a trillion-dollar category. If it can't, the $17B 2026 revenue target has a structural weakness.

   Meanwhile, the PE JV terms raise questions. The analysis from multiple sources is blunt: no healthy business offers 17.5% guaranteed returns. Whether that assessment is fully fair or not, the signal is clear — OpenAI's capital needs are outrunning conventional sources. Combined with IPO risk disclosures that flag Microsoft dependency as material risk, this is a company whose strategic priorities are being reshaped by capital burn in ways that will affect product direction and pricing within quarters.

   ---

   For enterprises: any architecture that assumes OpenAI and Microsoft will remain aligned is building on a fault line. Multi-vendor AI strategies are now a fiduciary obligation, not a luxury.

   What to do

   1. →

      Stress-test your AI GTM strategy against the 3.3% distribution failure — if you're bundling AI into existing products, model a scenario where penetration plateaus at 3-5% and build a response plan by Q3

      This sprintThe largest distribution moat in enterprise software proved nearly worthless for AI adoption — your bundling assumptions need validating
   2. →

      Audit all OpenAI and Azure-OpenAI dependencies and develop multi-vendor contingency architecture by end of Q2

      This sprintOpenAI's own IPO documents flag Microsoft dependency as material risk; your chain-of-dependency risk compounds from there
   3. →

      If in a PE portfolio, engage sponsors immediately on the OpenAI JV offer to negotiate terms or preserve AI vendor optionality

      NowPE-level AI stack decisions bypass CTO authority entirely — act before it's decided for you
   4. →

      Monitor OpenAI ad product rollout and model competitive impact on your pricing if ChatGPT capabilities become ad-subsidized

      This quarterIf OpenAI successfully subsidizes AI access through ads (like Google did with search), every subscription-based AI product faces pricing pressure within 18-24 months
4. 04

   AI Breaks Through to the Physical World — Edge Computing, Hardware Design, and the $100B Manufacturing Bet

   The Edge AI Memory Wall Just Fell

   Liquid AI published the most significant on-device AI result to date: a 1.2B-parameter model running at 70 tokens/second on a Samsung Galaxy S25 CPU in just 719MB of total memory. For comparison, Meta's Llama 3.2 1B consumes 524MB in KV cache alone at the same context length — before loading model weights. At 128K tokens, Llama hits 2GB. On a phone, that's game over.

   The model isn't the story. STAR — Liquid AI's automated architecture search system — is the strategic asset. STAR encodes neural network architectures as hierarchical genomes and evolves them using multi-objective optimization against actual hardware performance on physical devices. When Qualcomm ships a new Snapdragon, STAR re-evolves. This is a compounding capability, not a static product.

   What STAR discovered is strategically uncomfortable: it completely rejected every state-space model variant (Mamba, S4, Mamba-2) for edge deployment. The SSM hype cycle, which positioned these as the transformer's successor, collides directly with the empirical result that boring depthwise convolutions paired with sparse attention outperform every SSM configuration on phone hardware.

   When capable models run on-device at zero marginal inference cost, the highest-volume API calls migrate to the edge — hollowing out the volume base that makes cloud inference economics work.

   AI Foundation Models for Physics

   Arena Physica (Founders Fund-backed) is launching a foundation model for electromagnetic field design claiming 18,000x simulation speedups and 10x cost reduction for phased arrays. The US Navy reportedly lacks counter-drone radar at scale because Raytheon charges nearly a billion dollars per ship-based system. AI-generated hardware designs are producing 'alien geometries' that outperform human designs — the AlphaGo moment for physical engineering. Critically, analog silicon doesn't need bleeding-edge TSMC fabs, reducing geopolitical supply chain risk.

   Capital Is Following the Thesis

   Jeff Bezos raising $100B to buy and automate manufacturing companies is the strongest signal that the smart money believes AI's largest near-term value creation isn't in building new AI products but in making physical-world businesses dramatically more efficient. The SpaceX/Tesla/xAI TERAFAB joint venture — the largest chip fab ever at 1TW/year — creates a vertically integrated AI competitor (compute + distribution + connectivity + models) unlike anything the market has seen.

   For strategic planning: the pattern of 'AI foundation model for [physics domain]' will repeat across fluid dynamics, thermodynamics, acoustics, and materials science. Organizations that build integration muscle for AI-generated physical designs now will compound that advantage. Those that wait will find themselves in the position of companies that dismissed cloud computing in 2008.

   What to do

   1. →

      Reassess your cloud inference cost model this quarter — model the margin impact of capable on-device AI pulling routine queries off your API within 18 months

      This quarterLiquid AI's 719MB model at 70 tok/s on a phone means the volume base underpinning cloud inference economics faces erosion from below
   2. →

      Evaluate Liquid AI as a strategic partner or acquisition target — STAR (the architecture search platform) is the asset, not any single model

      This quarterA system that automatically re-optimizes architectures for new hardware is a compounding moat that outlasts any model generation
   3. →

      Commission a competitive analysis of AI-for-physics opportunities in your domain if you operate in defense, telecom, semiconductors, or industrial manufacturing

      This quarterArena Physica's EM model is the beachhead; fluid dynamics, thermodynamics, and materials science follow the same pattern
   4. →

      Review your AI investment thesis for physical-world bias — ensure it isn't over-indexed on software productivity at the expense of manufacturing and infrastructure opportunities

      WatchBezos's $100B fund signals the smartest capital in the world believes AI-for-atoms is the larger value creation opportunity