The Board Room

Deep dives

1. 01

   DeepSeek on Huawei Chips: The Most Consequential AI Supply Chain Threat Since Export Controls

   Jensen Huang's public alarm about DeepSeek is not corporate posturing — it's a CEO watching Nvidia's most durable competitive advantage face its first credible threat. DeepSeek is actively rewriting its core code for Huawei's CANN framework, preparing to run its V4 multimodal model on the Ascend 950PR chip. If it runs competitively, the cascade effects are severe.

   If China's leading AI lab can build frontier models without American chips, US export controls lose their strategic teeth — and every company that assumed Nvidia infrastructure was the only game in town needs a Plan B.

   Why This Is Different From Previous China Chip Narratives

   Previous attempts to build non-CUDA AI stacks failed because the software ecosystem was too shallow. DeepSeek is the first frontier-class lab committing engineering resources to making a non-Nvidia stack work at the model level, not the research level. The CUDA flywheel — where developers build on CUDA because everything else is inferior, which makes CUDA more dominant — faces a scenario where a top-tier model proves you can cross the moat. That proof point changes the calculus for every other lab and every government evaluating chip sovereignty.

   Second-Order Effects to Model

   • US export controls as leverage: If Ascend 950PR proves sufficient for frontier training, the primary policy instrument the US uses to maintain AI leadership loses efficacy. The geopolitical implications extend beyond tech into trade negotiations and alliance structures.
   • Nvidia's market share: The 95%+ GPU dominance era doesn't end overnight, but the perception of inevitability cracks — and perception drives infrastructure procurement decisions 12-18 months out.
   • Multi-vendor AI infrastructure: The Cerebras IPO filing further confirms investors see room for multiple AI chip players. Your infrastructure team should be testing portability assumptions now, not after a market shift forces it.
   • Talent and knowledge flow: DeepSeek's engineering effort creates institutional knowledge about non-CUDA optimization that will diffuse across China's AI ecosystem, compounding the threat over time.

   What Makes This Actionable Now

   DeepSeek V4 hasn't shipped yet — this is still a developing scenario. But the planning window is now, not after results are published. Companies that audit chip dependencies, test model portability across frameworks, and build vendor-diversification clauses into infrastructure contracts this quarter will be positioned. Those that wait for V4 benchmarks will be reacting from behind.

   ---

   The convergence with AI startup valuations decoupling from fundamentals — Cursor at $50B, DeepSeek's first outside round at $10B, a 4-month-old company raising $500M at $4B — suggests that capital markets are pricing in a world with multiple viable AI hardware ecosystems. Whether that's prescient or premature, your infrastructure strategy should hedge for both outcomes.

   What to do

   1. →

      Commission a scenario analysis on AI infrastructure resilience assuming DeepSeek V4 runs competitively on Huawei Ascend 950PR — model vendor relationship impacts by end of Q3

      This sprintV4 results will arrive within quarters; planning must precede publication
   2. →

      Audit all AI model deployments for CUDA hard-dependencies and identify portability gaps within 60 days

      This sprintFramework lock-in is invisible until you test it — and switching costs increase with every model fine-tuned on vendor-specific infrastructure
   3. →

      Add vendor-diversification clauses to any AI infrastructure contracts renewing in the next 6 months

      This quarterContract terms set today determine flexibility in 2027 when the multi-vendor reality may be unavoidable
2. 02

   Your AI Workloads Are Uninsured — The Structural Risk Shift Nobody Briefed the Board On

   While the industry debates AI model capabilities, insurance carriers are quietly withdrawing from AI risk entirely. Cyber and E&O policies are now excluding AI workloads, citing the unpredictability of AI outputs. This is not a premium increase — it's a categorical refusal to transfer AI risk, and it changes the financial calculus for every AI deployment at scale.

   Your organization is now self-insuring every AI-related liability, potentially without realizing it. The downstream implications — internal risk quantification, mandatory governance tooling, board-level deployment oversight — are profound.

   Three Converging Risk Vectors

   1. Insurance withdrawal: Carriers exempting AI from coverage creates unquantified balance-sheet exposure. Every AI product, every AI-assisted decision, every customer-facing model output now sits on your company's risk without a transfer mechanism.
   2. Machine-speed attacks: Sub-30-second attacker timelines create an 'AI parity window' — defenders who don't automate at equivalent speed fall permanently behind. SOC automation moves from modernization to survival.
   3. Shadow AI visibility gap: CISOs report they cannot see what AI is running across their organizations. You can't insure, govern, or secure what you can't see — and the speed at which teams deploy AI outpaces every traditional governance framework.

   The Mythos Reality Check

   Anthropic's Claude Mythos is being framed as a 'structural cybersecurity shift' that will compress exploit windows. But VulnCheck's counter-analysis found only 1 confirmed CVE tied to Project Glasswing — a hype-to-evidence ratio that should give pause. The strategic implication: invest in faster patching and automated detection, not AI-specific silver-bullet defenses. Current AI offensive capabilities amplify speed and scale of existing attack patterns rather than generating genuinely novel exploits.

   The Market Opportunity Inside the Risk

   The AI governance and observability tooling market is forming in real time. Whoever solves AI asset discovery and continuous governance captures the foundation layer beneath all future AI security spending. This is the highest-conviction market signal in today's security intelligence — not the headline-grabbing offensive capabilities, but the mundane, essential visibility infrastructure that makes everything else possible.

   ---

   The convergence matters: uninsurable risk + machine-speed attacks + invisible AI deployments = a market inflection reshaping cybersecurity budgets over 24-36 months. Position now, before the next wave of AI incidents forces reactive spending at premium prices.

   What to do

   1. →

      Audit all cyber and E&O insurance policies for AI workload exclusions and quantify uninsured exposure — brief the board within 30 days

      NowMany policies already contain exclusions that haven't been surfaced to leadership; the liability is accruing in real time
   2. →

      Fast-track SOC automation investments targeting sub-minute detection-to-response cycles within 18 months

      This quarterSub-30-second attacker timelines make manual SOC operations structurally unviable; the parity window is closing
   3. →

      Launch an AI asset discovery initiative — catalog every AI model, API integration, and shadow AI deployment across the organization within 90 days

      This sprintInsurance, governance, and security all require visibility that most organizations currently lack
   4. →

      Evaluate the AI governance tooling market for strategic investment or partnership — first movers in AI observability will capture a foundational layer

      This quarterThe tooling market is nascent; early positioning yields outsized returns as regulatory and insurance pressures drive demand
3. 03

   The AI Coding Productivity Mirage — Hard Data Says You're Scaling Technical Debt, Not Output

   The first large-scale empirical study on AI coding tool productivity just landed, and the numbers should stop every engineering leader mid-stride. Waydev's analysis across 50 companies employing 10,000+ engineers reveals a devastating gap between perception and reality.

   Metric	Reported	Actual	Gap
   Code acceptance rate	80-90%	10-30%	3-8x
   Basis	Initial commit	Post-revision churn	—
   Implication	Productivity gain	Technical debt	—

   Companies scaling AI coding adoption based on acceptance-rate metrics are systematically accumulating technical debt while believing they're increasing productivity.

   Why the Gap Exists

   The vanity metric — initial acceptance rate — measures whether a developer clicks accept on AI-generated code. The real metric measures whether that code survives review, revision, and production deployment. The 3-8x gap means that for every 10 AI-generated code blocks accepted, only 1-3 actually make it to production unmodified. The rest require human revision, debugging, or rewriting — work that doesn't show up in the productivity dashboards being presented to boards.

   The Cursor Paradox

   This data emerges in the same week that Cursor is raising at a $50B valuation from Thrive and a16z. Either the smart money has visibility into productivity improvements the Waydev data doesn't capture, or we're watching a classic late-cycle pattern where capital formation outpaces value creation. The emergence of 'tokenmaxxing' culture — measuring AI compute consumption as a proxy for productivity — is the engineering equivalent of measuring effort instead of output.

   The Harness > Model Thesis

   Separately, empirical evidence now validates that simple scaffolding dramatically outperforms complex agent frameworks. Anthropic's own leaked Claude Code harness uses simple planning constraints that outperform 'fancy AI scaffolds.' A dramatic test showed Qwen3-8B going from 0/507 to 33/507 on agentic benchmarks with scaffolding alone — no model improvement. This has direct capital allocation implications: if your teams are building elaborate multi-agent orchestration, they're likely over-engineering. Redirect investment toward simpler, better-designed harnesses with strong planning constraints.

   ---

   The corrective action isn't to abandon AI coding tools — it's to replace vanity metrics with production-survival metrics and to audit whether your teams are building complexity where simplicity wins.

   What to do

   1. →

      Replace AI coding acceptance-rate metrics with revision-churn-adjusted productivity measures in all engineering dashboards within 60 days

      This sprintBoards are making investment decisions on 3-8x inflated metrics; the correction needs to happen before the next planning cycle
   2. →

      Audit your AI scaffolding/orchestration layer — redirect investment from complex multi-agent frameworks toward simpler harnesses with planning constraints

      This quarterEmpirical data from Anthropic's own production system and independent benchmarks shows simpler architectures outperform; complexity is compounding cost without delivering returns
   3. →

      Run a controlled 30-day measurement of AI code that survives to production unmodified vs. code requiring human revision across your top 3 engineering teams

      This sprintYou need your own organization's real number before the next board presentation on AI productivity