The Board Room

Deep dives

1. 01

   Your Defensive Stack Just Became a Glass Box — The 18-Month Architecture Bet

   The Premise That Broke

   For fifteen years the defensive stack rested on a single assumption: understanding your endpoint agent cost more than bypassing it for most adversaries. That assumption did not survive this week. TrustedSec ran LLMs against five commercial EDR products and found the same architectural pattern in every one of them: YARA-style rules, behavioral logic, allowlists, prefilters, Lua scripting engines that surrender after a single decryption pass, and local ML classifiers. Work that used to require a skilled reverser and several weeks now takes days with AI assistance. The economics of attacking the agent have inverted.

   The security model of the defensive stack was built on the premise that the cost of understanding the agent exceeded the value of bypassing it. That premise is no longer true for a growing share of the threat population.

   The Capability Discontinuity

   Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, benchmarks built specifically to test autonomous end-to-end offensive cyber capability. Mythos and GPT-5.5-cyber both achieved full network takeover, not merely persistence. That sits above a trend line in which AI cyber task completion was already doubling every few months. A PraisonAI vulnerability was weaponized within 4 hours of disclosure. A patch SLA measured in days is now an exposure window measured in days.

   The Government Signal

   Congress is holding closed-door Mythos demos and routing access through NSA rather than CISA. The choice tells you which mission Washington considers priority. Offensive advantage sits above civilian defense, and the private sector is on its own for the defensive application for several years. The same hearings mark the leading edge of a federal buying cycle, not a protective umbrella.

   The Compounding Problem

   A reasonable skeptic would say one week of disclosures is not a trend. The reasonable skeptic should look at the rest of the week. An 18-year undetected RCE in NGINX's rewrite module sits in nearly every modern web application. Five AI infrastructure tools were added to CISA's Known Exploited Vulnerabilities catalog, among them LiteLLM, Ollama, and OpenClaw. Foxconn lost 8TB of confidential designs from Apple, Google, Intel, and Nvidia through a single contract manufacturer breach. The attack surface widened in the same week the defensive model became transparent.

   ---

   Where Detection Actually Lives Now

   The architectural bet for the next 18 months is not subtle. Detection logic moves above the endpoint, and Identity, network telemetry, and behavioral analytics become the compensating controls. Organizations still treating the endpoint agent as the load-bearing control will discover what that means when the control becomes transparent to an adversary holding the same AI tools the vendor used to build it. Mozilla's 271-bug result against curl's 1 CVE with the same models settles the argument. The variable is the harness, not the model. Anyone with target-specific scanning infrastructure now gets real security outcomes. Everyone else is buying the slide that used to be the strategy.

   What to do

   1. →

      Commission a red team exercise specifically targeting your EDR with AI-assisted reverse engineering — scope 4 weeks, report to board

      NowEvery day without understanding your actual detection gap is a day adversaries are exploiting it. The 5-product uniformity finding means your specific vendor is almost certainly vulnerable.
   2. →

      Rewrite patch SLAs: 72 hours maximum for critical internet-facing vulnerabilities, 24 hours for actively exploited

      This sprintThe 4-hour weaponization window means your current 7-30 day cadence creates guaranteed exposure windows. Asset inventory and mitigation authority are the binding constraints.
   3. →

      Establish an AI Security function as a distinct organizational capability with dedicated leadership by end of Q3

      This quarterSANS is formalizing AI Security as a discipline. LiteLLM, Ollama, and AI gateways are being exploited in the wild before most enterprises have inventoried them. This cannot be absorbed by existing AppSec.
   4. →

      Audit all AI infrastructure tooling adopted by engineering teams — inventory every LLM gateway, model registry, and agent framework in production

      Now5 CISA KEV additions in AI tooling means your teams likely deployed these without security review. The adoption curve ran ahead of the governance curve.
2. 02

   Anthropic's 80x Demand Spike — What It Means for Your Compute Strategy and Vendor Posture

   The Numbers That Force a Conversation

   Anthropic planned for ten-times growth and got 80x. That is a company operating at roughly 12% of required capacity for extended stretches. Revenue moved from $9B to $30B+ ARR in approximately four months, and the company is now raising at a $900B+ valuation, above OpenAI's $854B mark in March. The honest description is the fastest enterprise software displacement on record, executed by a vendor that was technically unable to serve the demand it was capturing.

   A provider that planned for 10x and got 80x was operating at roughly 12% of required capacity. Developers on the platform were getting degraded service without disclosure. The productivity gains measured in that period are understated against what adequate provisioning would deliver.

   xAI's Concession: Compute Is Now a Financial Instrument

   A reasonable skeptic would point out that Elon Musk has publicly called Anthropic "misanthropic and evil" and would not lease them anything. The reasonable skeptic now has to explain xAI agreeing to lease 220,000 GPUs (45% of Colossus 1) to exactly that company. Grok never reached meaningful traction and trails open-source models in developer surveys, and the lease revenue almost certainly exceeds what Grok could generate from the same silicon. The consequence is that the population of viable frontier labs is contracting while excess infrastructure migrates onto the lease market, which will reshape compute economics over the next 12-18 months.

   The Enterprise Budget Problem

   ServiceNow's CDIO disclosed they blew their entire annual Anthropic budget by May. The root cause is structural rather than accidental. Anthropic does not offer SLAs, does not provide usage telemetry, and has no comment on enterprise budget blowouts. That is not a startup growing too fast. It is a deliberate choice to optimize capability over enterprise readiness, and ServiceNow is already building the workaround (AI Control Tower) and reselling it to other enterprises.

   The Supply-Side Lock-Up

   Cerebras priced its IPO at $56B fully diluted (16% above the raised range, 70% first-day pop), underwritten by OpenAI's $20B procurement commitment. Nebius reports a 4:1 demand-to-supply ratio with 684% revenue growth. Microsoft has committed $100B+ to OpenAI infrastructure. The compute supply curve is being negotiated in private, in blocks of $10B and up. The optionality most infrastructure plans quietly assumed — that capacity would be available at some price — is the line item being deleted.

   ---

   The Procurement Paradox

   The vendors competing hardest for enterprise workloads are the same ones unable to reliably serve them. Anthropic and OpenAI are both running aggressive displacement campaigns, with OpenAI offering two months free Codex to enterprise switchers, while capacity-driven degradation recurs across providers. The defensible posture is dual-provider with a thin abstraction layer, not because either vendor is bad, but because the vendor that cannot serve a workload next quarter may not be the same vendor that could not serve it this quarter.

   What to do

   1. →

      Audit all AI model consumption spend vs. budget with per-team attribution — report findings to CFO within 30 days

      NowServiceNow blew their annual budget in 5 months. Without telemetry from Anthropic, your teams may be on the same trajectory without visibility.
   2. →

      Evaluate multi-year compute commitments — model the cost of 12-month lock-in vs. spot pricing exposure and present options to board next meeting

      This sprintCompute is being pre-sold in $10B+ blocks. The marginal buyer arriving in 2027 gets compute but not 2025 terms. The window for favorable contracts is closing.
   3. →

      Build or acquire a thin model abstraction layer enabling provider swap within 48 hours for production workloads

      This quarterThe 80x spike proves demand forecasting inside labs is unsolved. Capacity degradation will recur across vendors for at least 4 more quarters.
   4. →

      Negotiate aggressive terms with both Anthropic and OpenAI during the current subsidy window — take displacement offers from both sides simultaneously

      This sprintBoth vendors are paying customers to switch. The window is approximately 6 months before lock-in calcifies and sticker price becomes the price.
3. 03

   The Agent Execution Layer Is Being Claimed — SAP, ServiceNow, and the $150B Collision

   The Collision That Forces a Decision

   SAP and ServiceNow have stopped pretending they sell different products. Both now pitch themselves as the execution layer where AI agents touch systems of record and commit writes. A reasonable skeptic would call this marketing overlap and move on. The reasonable skeptic is missing what agents actually require, which is one authoritative place to reconcile state. Two authoritative places is zero. The integration middleware industry of the last decade exists precisely because no buyer wanted to settle that question. Agents settle it for them.

   Two Incompatible Architectures

   Dimension	SAP	ServiceNow
   Approach	Vertical Knowledge Graph	Headless Action Fabric via MCP
   Moat thesis	Own agents are contextually superior inside SAP data	Open to any agent via protocol standard
   Strongest where	Process IS the transaction (O2C, R2R)	Workflow across systems (connective tissue)
   Investment signal	€100M AI fund	MCP server adoption at enterprise scale

   The Value Migration Is Quantified

   a16z estimates $150B+ of go-to-market value migrating from the CRM system of record to the AI orchestration layer. The evidence is concrete. One enterprise customer is running 80% fewer human seats with 83% higher total spend and 20+ agents running. Anthropic captures 61% of AI spend through expensive reasoning. Google captures 38% of volume through cheap throughput. The model is the commodity. The orchestration layer is where switching costs accumulate: workflows, permissions, tool integrations, institutional memory.

   A model can be swapped in an afternoon. An agent graph wired into twelve internal systems cannot. That asymmetry is what makes 59% agentic traffic a leading indicator, not a lagging one.

   The Governance Vacuum

   Organizations racing to deploy agents have not staffed the governance function for the tool sprawl agents produce. 81% of AI agents bypass legacy bot detection. Nobody yet owns the inventory of which agents can call which systems on whose behalf. That question is decorative until something goes wrong, at which point it becomes load-bearing. When business units deploy autonomous agents without governance, the worst case is unaudited decisions in finance, supply chain, and customer data, with regulatory exposure that follows.

   ---

   The Pricing Inflection

   Seat-based pricing is structurally breaking, and the vendors already know it. SAP is not charging per-seat for autonomous finance agents. ServiceNow's headless architecture implies consumption-based pricing on agent API calls. Intercom rebranded entirely to 'Fin' and declared the agent IS the company. The board-deck version of the question is whether to model consumption scenarios this quarter. The complete version is whether to model them now or explain to customers in two quarters why they are paying for seats their agents made redundant.

   What to do

   1. →

      Conduct an 'agent readiness' audit: Can third-party AI agents discover, invoke, and orchestrate your platform's workflows without a human UI? Report by end of Q3.

      This quarterBeing bypassed is not the same as being disrupted. If agents route around your platform rather than through it, you lose distribution permanently.
   2. →

      Stand up an AI governance function with authority over tool/vendor rationalization before Q3 budgeting begins

      This sprintThe 81% bot bypass rate means ungoverned agents making autonomous decisions is not a future problem — it's happening now with no organizational owner.
   3. →

      Model per-action/per-outcome pricing scenarios for your revenue if agents replace human seat consumption — present to leadership by July

      This quarter80% seat reduction + 83% spend increase is a working demonstration. Customers will ask why they're paying for redundant seats.
   4. →

      Evaluate MCP integration as a strategic investment for your platform — build or integrate MCP server capabilities this quarter

      This quarterServiceNow adopting MCP as the agent communication standard pulls the ecosystem toward that protocol. Being outside it means being invisible to agents.
4. 04

   The AI Liability Regime Is Being Written Now — Your 18-Month Window to Shape or Be Shaped

   Three Venues, One Outcome

   The AI liability architecture is being settled in three rooms at once. Courts are running active cases that could impose enormous penalties on developers for user misuse. Congress is hosting a bureaucratic fight between ODNI and Commerce over who evaluates models pre-release. Policy shops are drafting frameworks, with a16z putting $115.5M into 2026 midterm spending behind a comprehensive liability blueprint. The firms most exposed to the outcome are largely absent from the drafting rooms. This is the same pattern that produced GDPR.

   The Fork in the Road

   The question is binary. Does AI liability follow platform treatment, the Section 230 analogy in which developers are not liable for downstream use, or product-manufacturer treatment, strict liability for harm from outputs. These are not adjacent regimes. They are different businesses with different cost structures.

   • Platform treatment: Open-source remains viable, startups can compete, liability sits with deployers.
   • Product liability: The market consolidates around whoever has the deepest litigation reserves. Open-source becomes uninsurable. Incumbents prefer this regime because it prices out challengers.
   • Safe harbor: Audits, transparency reports, and best-practices adherence become a shield, and table stakes regardless of which regime wins.

   Deep pockets prefer strict liability for the same reason they prefer any rule that prices out the challenger.

   Why This Quarter Matters

   Courts are deciding cases now, before any legislative framework exists. The likely sequence is precedent-setting rulings arriving before comprehensive federal law, producing a patchwork of judicial standards. The White House fight between ODNI, whose pre-release evaluation amounts to a licensing regime in all but name, and Commerce, whose CAISI agreements remain voluntary, will resolve in quarters, not years. a16z sitting on the White House tech council with Marc Andreessen while deploying $115.5M into midterms means the venture class is spending real political capital to shape defaults.

   ---

   The Open-Source Dependency

   A reasonable skeptic would argue that liability rules will land somewhere sensible and that open-source will adapt. The skeptic is half right. If developer liability for downstream use becomes the standard, the economic logic of releasing open-source models stops working. No rational actor open-sources a model that generates unbounded liability. Product strategies quietly assuming continued access to open weights carry an unpriced dependency on regulatory outcomes the P&L does not show. The supply chain restructures toward proprietary models and a handful of providers.

   What to do

   1. →

      Commission a legal exposure audit of your AI products against three competing liability frameworks (absolute, safe harbor, user-liability presumption) — deliver to board within 60 days

      This quarterCourts are creating precedent now. Understanding financial exposure under each scenario is prerequisite to any informed strategy.
   2. →

      Begin building audit-ready AI governance infrastructure — model cards, safety testing documentation, incident reporting — that would satisfy proposed safe harbor requirements

      This quarterSafe harbor mechanisms will be table stakes regardless of which regime wins. Starting now is cheaper than retrofitting after rules harden.
   3. →

      Evaluate open-source AI dependencies and develop contingency plans for a world where open-source model availability contracts

      WatchProduct strategies built on open-weight access carry unpriced regulatory risk. The contingency costs nothing to plan and is expensive to improvise.
   4. →

      Engage policy coalitions advocating federal preemption — join the industry voice before a16z's preferred framework becomes the default without your input

      This quarterThe window to influence is measured in quarters. Firms not at the table live under rules written by firms that are.