The Board Room

Deep dives

1. 01

   Your Security Stack Failed on Three Axes This Week — Architecture Response Required

   The Convergence

   The frame to use this week is architecture, not budget. The security operating model built over the past decade no longer describes the threat environment it was purchased to defend against, and the gap is now visible across endpoint detection, AI routing infrastructure, and offensive tooling at the same time.

   The cost curve on reverse engineering a commercial endpoint agent has collapsed in a way the defensive stack's threat model never priced in.

   Layer 1: Endpoint Detection Becomes Transparent

   TrustedSec ran LLMs against five commercial EDR products and found the same internals across all five: YARA-style rules, behavioral logic, allowlists, prefilters, scripted engines (some readable as Lua after a single decryption pass), and local ML classifiers. Work that used to require a skilled reverser and weeks of effort now takes days with AI assistance. The category was running on security-through-obscurity, and the obscurity just left.

   Layer 2: AI Infrastructure Under Active Exploitation

   CISA added LiteLLM, Ollama, and OpenClaw to the Known Exploited Vulnerabilities catalog, which means adversaries are already targeting AI routing infrastructure in production. A Raspberry Pi honeypot dressed as an AI stack was indexed by Shodan in 3 hours and absorbed 113,000 attacks per month. The AI tooling layer went from experiment to production without the security review traditional enterprise software gets on the way in.

   Layer 3: Offensive AI Crosses the Discontinuity

   Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, with full network takeover rather than mere persistence. Congress is holding closed-door demos and routing access through NSA rather than CISA, which signals offensive and intelligence priorities over civilian defense. Microsoft's MDASH found 16 exploitable flaws in a single Patch Tuesday using multi-model AI, and the PraisonAI framework was exploited 4 hours after disclosure.

   ---

   The Compound Effect

   Each layer compounds the others. An adversary with transparent EDR visibility, AI-speed exploit development, and access to unpatched AI infrastructure tools is operating against an attack surface measured in hours rather than months, not the one the current security posture was calibrated for. The NGINX 18-year RCE, present since 2008 and affecting nearly every modern web application, shows how long a latent defect waits for the discovery economics to reach it.

   Defenders are still patching on a monthly cycle while attackers have compressed exploit development from months to hours, which means the window between disclosure and exploitation is now shorter than most enterprise change-control processes.

   What to do

   1. →

      Commission red team exercise specifically using AI-assisted reverse engineering against your EDR within 30 days

      NowThe TrustedSec finding means your EDR's detection logic is readable — you need to know what an AI-equipped attacker sees before they show you
   2. →

      Conduct emergency inventory of all AI infrastructure tools (LiteLLM, Ollama, model registries, AI gateways) by end of week

      NowThese are in CISA's KEV catalog — they're being exploited today and most orgs adopted them without security review
   3. →

      Rewrite patch SLAs from 30-day to 72-hour for internet-facing critical vulns by end of Q3

      This sprint4-hour exploit windows render traditional patch cadences the exposure window, not the response window
   4. →

      Invest in compensating controls above the endpoint — identity, network telemetry, behavioral analytics — as the new load-bearing detection layer

      This quarterThe EDR assumed obscurity bought time. Compensating controls are what work when the endpoint agent is transparent
2. 02

   The True Capital Scale of AI Just Became Visible — Compute Is Being Financialized

   The Numbers That Changed This Week

   The financial architecture of AI became legible this week through a court filing and a lease deal whose competitive logic does not survive scrutiny. The IPO print in between simply confirmed what the other two already implied:

   • Microsoft → OpenAI: $100B committed by June 2026 (revealed via Musk lawsuit), with $30B in direct revenue against it. OpenAI committed another $280B to Microsoft servers going forward.
   • Cerebras IPO: $56B fully diluted, priced 16% above the raised range, 70% first-day pop. Backstopped by a $20B procurement commitment from OpenAI.
   • xAI → Anthropic: 220,000 GPUs (45% of Colossus 1) leased to a competitor Musk publicly called 'misanthropic and evil.' Financial logic overwhelmed competitive logic.
   • Anthropic: $30B ARR, up from $9B roughly four months ago. Raising at $900B+ valuation.
   • Fervo Energy: $10B+ IPO, shares jumped 33%. Google contracted option for 3GW (≈60 data centers).

   When Elon Musk leases 45% of his compute to the competitor he publicly calls misanthropic and evil, financial logic has overwhelmed competitive logic. Compute now behaves like a financial instrument, not a strategic moat.

   What This Means for Vendor Strategy

   The xAI lease is the structurally significant signal of the week. It confirms that Grok never achieved meaningful traction, because lease revenue from Colossus almost certainly exceeds what Grok itself could generate from those GPUs. The population of viable frontier labs is contracting, and excess infrastructure is moving onto the lease market. That could meaningfully alter compute economics for enterprises over the next 12-18 months.

   A reasonable skeptic would file Anthropic's capacity admission as an operations footnote. The skeptic would be wrong. 80x demand growth against 10x planning means Anthropic operated at roughly 12% of required capacity for extended periods, and developers received degraded service without disclosure. The productivity gains measured during that window are understated against what adequate provisioning would have produced.

   The Concentration Paradox

   Fewer than five entities can play at the $100B level: Microsoft/OpenAI, Google, Amazon, Meta, and the Nvidia ecosystem. But within that constraint, the vendor hierarchy is demonstrably unstable. Anthropic quadrupled enterprise share while OpenAI grew 0.3%. The window for extracting favorable multi-vendor terms is open now, while both sides are still competing for lock-in.

   What to do

   1. →

      Evaluate multi-year compute commitments this quarter — model cost of 12-month lock-in versus spot pricing exposure against a 4:1 demand ratio

      This sprintCapacity is being pre-sold in $10B+ blocks. The marginal buyer arriving in 2026 will not get 2024 terms.
   2. →

      Negotiate aggressively with both Anthropic and OpenAI during this 6-month subsidy window while both compete for enterprise lock-in

      This sprintAnthropic's IPO-driven margin pressure and OpenAI's displacement campaign create a collision neither can cushion long. Window closes around year-end.
   3. →

      Build a thin model abstraction layer enabling provider swap within 48 hours

      This quarterThe hierarchy that most strategies assume is stable changed in one quarter. xAI's lease proves even competitors' compute can become available. Architecture must survive hierarchy instability.
   4. →

      Explore whether GPU capacity financialization creates procurement advantages via lease-market access

      This quarterIf xAI is leasing to Anthropic, secondary compute markets are forming. Early participants set the terms.
3. 03

   The Execution Layer War Just Started — Four Platforms Made Incompatible Claims in Seven Days

   The Collision

   The interesting question used to be which model an enterprise should standardize on. That question is settled. The question now is which platform agents call through when they act on a user's behalf, and four of the largest technology platforms answered it in the same week with architectures that do not compose.

   Platform	Strategy	Architecture Bet
   SAP	€100M fund + Knowledge Graph	Vertical integration — own agents are contextually superior inside SAP's data universe
   ServiceNow	Action Fabric via MCP servers	Open interoperability — any agent talks to ServiceNow via standard protocol
   Apple	App Store agent framework + fee gates	Distribution control — agents that spawn sub-apps require Apple approval and 30% cut
   Google	Gemini Intelligence on Android	OS-level agent platform — 3B+ devices, ships summer 2026 on flagship hardware

   Amazon moved the same direction with Buy for Me, an agent that completes purchases on third-party sites from inside Amazon's surface. A reasonable reading is that this is a convenience feature. The more useful reading is that it is a claim on the transaction layer of the open web.

   Why This Forces a Decision

   Vercel's production telemetry shows 59% of all AI API tokens are now agentic workloads. The interface layer of software is unbundling from the application layer underneath it. The a16z thesis puts $150B of GTM value migrating from CRM systems of record to the AI orchestration layer above them.

   Agents that act across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places.

   The SAP and ServiceNow collision is the one that forces the enterprise decision. SAP's claim is strongest where the process is the transaction: order to cash, record to report. ServiceNow's claim is strongest where the process is the workflow across systems, the connective tissue that was never going to live in an ERP. Most enterprises have both shapes today. The run-both instinct will not survive contact with agents that need to commit writes.

   The Platform Tax Problem

   Apple is not entering the AI game. It is setting the rules for the surface where consumer AI interactions happen, and framing agent sub-spawning as both a safety risk and a revenue leak. For any company shipping AI agents on iOS, that is a new constraint layer on product economics, not a footnote. Google's 97%+ Android share in markets like India means Gemini Intelligence ships as a default rather than a choice. Products that are technically API-addressable but sit outside the default agent's routing table will be bypassed without anyone noticing they were bypassed.

   What to do

   1. →

      Conduct an agent-readiness audit — determine whether third-party AI agents can discover, invoke, and orchestrate your platform's workflows without a human UI

      This sprintServiceNow adopting MCP as the standard pulls the ecosystem toward that protocol. Products not agent-addressable get routed around, not disrupted.
   2. →

      Decide whether SAP or ServiceNow owns your execution layer for the processes that cannot stop — this sets 3 years of licensing leverage

      This quarterThe vendor on the integration side of the line will spend three years explaining why the line was drawn wrong. Draw it deliberately.
   3. →

      Model Apple's likely agent fee/approval structure into iOS product unit economics before WWDC

      This sprintApple is gating agent sub-spawning as both a safety and revenue mechanism. The teams that assumed Apple would stay out of the agent layer are rewriting architecture docs now.
   4. →

      Evaluate MCP server capabilities as a strategic investment for your platform roadmap

      This quarterServiceNow legitimized MCP at enterprise scale. Being MCP-addressable is becoming the minimum for agent discoverability.
4. 04

   Enterprise AI Spending Is Running Without Guardrails — And the Liability Clock Is Ticking

   The Budget Problem

   ServiceNow's CDIO disclosed that the company blew its full-year Anthropic budget by May. The cause is structural rather than accidental. Anthropic offers no SLAs, no usage telemetry, and no predictable pricing to enterprise customers, which is a deliberate choice: they are optimizing for model capability over enterprise readiness. ServiceNow's response was to build AI Control Tower internally and then sell it to other enterprises. That is not partnership. That is the market routing around a vendor deficiency.

   The problem generalizes. Every major AI vendor — Google, OpenAI, Anthropic — now concedes they cannot deploy without expensive forward-deployed engineering teams at $300-500K loaded cost per FDE. If meaningful deployment takes 5-10 of them, the true cost of an AI program is 3-5x the model fees. Most board-approved investment envelopes do not reflect that math.

   The Data Foundation Gap

   Only 15% of organizations have adequate data foundations for agentic AI. The remaining 85% are spending millions to tens of millions building agents on data that was never governed for autonomous decision-making. A practitioner survey of 334 data professionals found that 95.2% cite organizational problems — training, ownership, requirements clarity — versus 4.8% citing tooling gaps. This is not a category of problem money solves.

   A dashboard tolerates a dirty field. A human analyst routes around it. An agent executing a chain of decisions acts on it, then acts on what it just did, and the error compounds through the chain until someone notices the invoice went to the wrong entity.

   The Liability Framework Forming Now

   a16z published what is, on honest reading, the most comprehensive lobbying blueprint the AI industry has produced on liability. The core proposal is user-liability defaults with damages caps. A reasonable skeptic would point out that lobbying documents rarely become law on the lobbyist's terms. The reasonable skeptic is correct, but is answering the wrong question. Courts are already deciding cases that could impose strict liability on developers for downstream user misuse before any legislative framework exists. Precedent-setting rulings will arrive before comprehensive federal law, and a patchwork of judicial standards will set the ceiling the legislation eventually negotiates against.

   If developer liability becomes the default, open-sourcing a model becomes an uninsurable risk. Product strategies that quietly assume continued access to open weights are carrying an unpriced dependency on regulatory outcomes the P&L does not show.

   The Duolingo Warning

   Duolingo quantified what others will not. At scale, AI-generated output runs ~20% unusable and requires human QC. Their blanket AI mandate produced performative adoption: the metrics climbed while the underlying work did not. The mandate was walked back.

   What to do

   1. →

      Conduct immediate audit of all AI model consumption spend vs. budget with per-team and per-use-case attribution

      NowServiceNow is a sophisticated tech company and blew its budget by May. Your teams are likely in similar positions without visibility.
   2. →

      Renegotiate AI vendor contracts to include SLAs, committed pricing tiers, and usage telemetry requirements before next renewal

      This sprintOperating without SLAs or telemetry from a vendor charging enterprise rates is a governance failure that becomes a board-level conversation after the first material overage.
   3. →

      Commission agentic AI readiness audit focused on data quality, lineage, and governance maturity across top 3 AI investment areas

      This quarter85% of orgs lack foundations. The discovery will be framed as a tooling failure when it's actually an ownership failure. Better to know now than after agents reach production.
   4. →

      Begin building audit-ready AI governance infrastructure (model cards, safety docs, incident protocols) that would satisfy proposed safe harbor requirements

      This quarterCourts are deciding liability cases now. Safe harbor requires documentation that takes quarters to build. Starting after the ruling is starting too late.