The Board Room

Deep dives

1. 01

   Software Creation Hit Zero — And Apple Just Declared War on What Comes Next

   The Structural Reversal

   From 2016 to 2024, new App Store submissions declined 48% — a slow, unmistakable consolidation of mobile software around established players. That eight-year structural advantage evaporated in 12 months. Q1 2026 saw 235,800 new apps submitted, an 84% year-over-year explosion directly attributable to Claude Code (broadly available since May 2025) and OpenAI Codex (October 2025). This isn't developers getting faster — it's an entirely new class of builder entering the market, people who have never written code creating production applications through natural language prompts.

   Apple's Structural Exclusion

   Apple removed the vibe coding app 'Anything' from the App Store around April 3, following a phased escalation: blocking updates in late March, then full removal. The enforcement isn't about one app — it's about Guideline 2.5.2, which prohibits apps from introducing functionality not reviewed by Apple. AI code generation tools, by definition, create novel code at runtime. There is no technical workaround that preserves both Apple's review model and the core value of these tools. Apple has structurally excluded an entire product category from iOS.

   Apple isn't blocking a bad app. It's defending a business model — $99/year developer fees and 15-30% revenue share — against tools that let anyone build apps without entering Apple's ecosystem at all.

   Where Sources Converge — and Where They Diverge

   Three independent analyses agree that value is migrating from creation to distribution. When software creation costs approach zero, defensibility shifts to data moats, network effects, brand trust, and distribution control. The pattern matches desktop publishing, cloud computing, and social media — each commoditized a creation layer and shifted value to whoever controlled access to audiences.

   Where sources diverge is on what happens next. One analysis frames this as a strategic opening for Google Play — if Android welcomes vibe coding while Apple blocks it, we could see a developer migration that reshapes mobile for the first time in a decade. Another emphasizes the content glut risk: 235,800 new apps won't all find users, creating a discovery crisis where curation becomes the binding constraint. A third highlights Amazon's AI chat ads — yielding data but few sales — as evidence that creation capability doesn't automatically translate to commercial outcomes.

   The Competitive Calculus

   If your company is a platform: the app flood could be an ecosystem boon. Invest in curation and discovery. If your company competes on features: a vibe-coded competitor can now replicate 80% of your feature set in weeks. Your moat must shift to proprietary data, customer relationships, and integration depth. If you're a potential acquirer: vibe coding startups facing existential iOS risk have validated technology and cratered valuations — the buy window is open now.

   ---

   What This Means for Your Portfolio

   Every product line needs a 'vibe code stress test': model what happens when a zero-code competitor ships 80% of your functionality in weeks. Products that survive that test have real moats. Products that don't need to be rebuilt around data, distribution, or trust — or divested before the competition arrives.

   What to do

   1. →

      Conduct a 'vibe code stress test' across every product line — model what happens when a competitor replicates 80% of features in weeks

      This sprintThe 84% App Store surge is accelerating, not plateauing; competitors are already being built
   2. →

      Accelerate web-first and PWA distribution capabilities as a hedge against App Store gatekeeping

      This sprintApple's phased escalation signals more removals coming — any AI product generating dynamic code on iOS is at risk
   3. →

      Evaluate acquisition or partnership opportunities with vibe coding startups now facing iOS exclusion

      This quarterValidated technology + cratered valuations from distribution loss = asymmetric deal opportunity
   4. →

      Monitor Google Play's response to vibe coding apps over the next 60 days

      WatchGoogle's posture determines whether Android becomes the default home for AI-native development tools — a potential ecosystem realignment
2. 02

   The SaaS Extinction Window — 30% Drawdowns + Capital Physics = Generational M&A Moment

   Three Forces Colliding Simultaneously

   Salesforce, ServiceNow, and Snowflake each dropped approximately 30% in Q1 2026. Microsoft fell 23% despite hitting what its own leadership called an 'audacious' Copilot sales target. These aren't random drawdowns — they're three forces compressing at once, creating a window that will close by year-end.

   Force 1: The Market Is Pricing In AI Agent Substitution

   The SaaS selloff isn't a valuation reset — it's the market pricing in category obsolescence. AI agents can increasingly perform the workflows that traditional SaaS platforms were built to facilitate. The 84% vibe coding explosion is the supply-side confirmation: building software is getting dramatically cheaper, meaning value migrates from the code to the data, distribution, and relationships surrounding it. If your company is a SaaS provider, you have roughly 18 months to transform into an AI-native platform or face acquisition at distressed multiples.

   Force 2: Mega-IPOs Are Creating Forced Liquidation

   SpaceX, OpenAI, and Anthropic are all planning 2026 public debuts. Their combined capital requirements exceed what the IPO market can absorb. Fund managers are already liquidating incumbent tech positions to build allocation room — that's why Microsoft can hit targets and still lose a quarter of its cap. This is capital physics, not sentiment.

   OpenAI's own CFO Sarah Friar doesn't think the company is ready for a 2026 IPO, and the CEO of AGI deployment is on medical leave. The timeline may slip — extending the overhang but also widening the acquisition window for those who move while others wait.

   Force 3: $124B in Weekly AI Funding Is Reshaping Capital Allocation

   OpenAI's $122B round, backed by Amazon, NVIDIA, SoftBank, and Microsoft, anchored a week that saw $124B+ in total AI funding. This isn't a fundraise — it's infrastructure buildout on the scale of early telecom. Mistral is building its own NVIDIA-powered data center near Paris (operational Q2 2026). The capital requirements to compete at the infrastructure layer now exceed what any startup or mid-cap can assemble.

   ---

   The Strategic Contradiction Worth Noting

   Here's the tension that should sharpen your thinking: $124B flows into AI infrastructure the same week research shows smaller models matching frontier performance. Holo3 beats GPT-5.4 at 1/10th the cost. Google's TurboQuant cuts inference memory 6x without retraining. Simpler agent architectures outperform complex ones. If these findings hold at production scale, the capital moat thesis — whoever spends the most wins — faces a fundamental challenge. The companies being acquired at 30% discounts may actually be closer to the right cost structure than the ones burning $124B.

   The Window

   Q2–Q3 2026 presents a generational buying opportunity. Distressed SaaS companies' enterprise customer bases are worth far more than current market caps suggest — provided the acquirer has AI capability to transform the product. The window closes when IPO pressure subsides, a mega-acquirer moves first, or SaaS names stabilize. First movers will define the next era.

   What to do

   1. →

      Accelerate M&A screening of distressed midsize SaaS companies — identify 3-5 targets where customer base value exceeds current market cap by 2x+

      NowThe 30% drawdown window will close when IPO pressure subsides or a mega-acquirer moves first; first movers get the best assets
   2. →

      Stress-test your capital structure against a scenario where SpaceX/OpenAI/Anthropic IPOs absorb all available tech capital in H2 2026

      This sprintIf you need to raise in H2 2026, the capital environment will be significantly tighter than your models assume
   3. →

      Benchmark your production AI workloads against smaller models (Gemma 4, Holo3, task-specific fine-tunes) — quantify potential savings

      This sprintYou're likely overpaying 5-10x for frontier API calls on tasks that don't require frontier capability; the savings fund your strategic bets
   4. →

      Reframe Q2 earnings narrative around demonstrable AI monetization metrics with hard numbers

      This quarterThe market is ignoring operational execution — Microsoft hit targets and lost 23%; you need to force the AI ROI conversation with proof points
3. 03

   Update: Iran Crosses the Kinetic Threshold — Your Cloud Infrastructure Is Now a Military Target

   From Cyber to Kinetic: A Category Shift

   Friday's briefing covered Handala's wiper attack on Stryker — a destructive cyberattack targeting a medtech company by geopolitical alignment. This week, the escalation jumped categories entirely. Iran's IRGC designated 18 US tech companies as military targets, attached a specific date and time, and then actually struck AWS's Bahrain region (me-south-1). There are disputed reports of an Oracle facility hit in the UAE. This is no longer cyber risk. This is state military action against the physical infrastructure hosting your workloads.

   Your business continuity plans almost certainly don't model for kinetic attacks on cloud provider infrastructure. If you have customer-facing workloads or SLAs that depend on Middle East regions — or if your providers do — you need to understand your exposure this week, not this quarter.

   Why This Is Different

   The distinction between cyber and kinetic is not academic — it changes every dimension of the risk calculus:

   • Recovery time: A cyberattack can be patched; a physically destroyed data center takes months to rebuild
   • Insurance coverage: Most cyber insurance policies explicitly exclude acts of war; check your coverage
   • Cascading effects: AWS is reportedly scrambling to recover capacity in me-south-1; this may affect capacity allocation globally as workloads redirect
   • Personnel risk: Government cloud contracts now carry physical risk premiums, changing the economics of an entire market segment

   The Compounding Risk

   This escalation arrives simultaneously with CISA facing $361M–$707M in budget cuts during an active military conflict. The federal civilian cybersecurity coordination agency is being defunded precisely when state-sponsored attacks are intensifying. This creates a structural vacuum that commercial providers will need to fill — and that your organization cannot rely on federal coordination to close.

   ---

   Assess and Act

   For most organizations, the immediate action is audit and contingency, not panic. Map your exposure to Middle East cloud regions, review DR plans that assume only cyber threat models, and verify insurance coverage for acts of war. For companies with government contracts, model the impact of rising risk premiums on contract economics. The second-order effect — if tech companies face escalating physical risks from government work, the risk premium for government cloud contracts goes up — will reshape the public sector cloud market within quarters.

   What to do

   1. →

      Map your cloud infrastructure footprint for Middle East exposure — identify all workloads, data residency, and SLAs dependent on me-south-1 or adjacent regions by end of this week

      NowAWS Bahrain was actually struck; recovery timelines are unknown; you need to know your exposure before the next escalation
   2. →

      Review insurance coverage for acts of war and kinetic infrastructure destruction — most cyber policies have exclusions

      This sprintThe distinction between cyber and kinetic materially changes coverage; policy terms were written for a world that no longer matches reality
   3. →

      Update disaster recovery plans to include kinetic scenarios for any region within 1,000 miles of active military conflict

      This quarterDR plans assuming only cyber threats are structurally incomplete — the threat model expanded permanently this week
   4. →

      Monitor US government cloud contract risk premiums and assess impact on any public sector business

      WatchPhysical risk to tech infrastructure will increase the cost of government cloud work — factor this into contract renewals and bids