The Board Room

Deep dives

1. 01

   The Org Design Reckoning: Your AI ROI Is Trapped in Your Org Chart

   The Diagnosis Is Now Consensus

   Three independent intelligence streams this week converge on a single, uncomfortable conclusion: enterprise AI's failure to deliver ROI is an organizational problem, not a technology problem. Palantir CEO Alex Karp declared on national television that enterprises are getting 'no value' from AI spend. The Turing Post's market analysis concludes 'no AI-native enterprises exist yet' despite billions invested. And Martin Ford's updated labor framework reveals that employees are already capturing AI productivity gains individually — finishing work faster and keeping the slack time — while organizations pay pre-AI costs for post-AI output.

   The productivity revolution came from the organizational redesign, not from the technology itself. Your company is almost certainly in the shaft-and-belt phase right now.

   The Electrification Analogy Is Precise

   When factories adopted electric motors, they mounted them where steam engines had been — centrally, driving the same shaft-and-belt system. Productivity barely moved for a generation. The breakthrough came when managers distributed motors throughout the facility, enabling entirely new layouts optimized for workflow rather than proximity to power. Ford's research identifies the exact same dynamic today: AI tools adopted bottom-up by individuals, bolted onto legacy workflows, producing marginal gains that disappear into invisible employee slack time.

   The headcount consolidation mechanism — three similar roles merging into one or two once management formally reorganizes — hasn't triggered in most enterprises. This creates a paradox: AI capability is abundant, but value capture requires top-down workflow redesign that most organizations aren't even attempting.

   Why This Becomes a Board Problem in 30 Days

   Karp's public 'no value' declaration isn't casual commentary — it's positioning ahead of Q2 earnings season. If CFOs across the Fortune 500 echo this sentiment on earnings calls, expect rapid reallocation from 'AI experimentation' budgets to 'AI outcome' budgets. The Turing Post analysis adds that pilot failure rates exceed 80% precisely because enterprises can't make their own processes legible to machines — decades of hidden workflows, political routines, and institutional habits resist automation by default.

   The Two Displacement Mechanisms

   • Substitution: AI doing what employees do — compresses existing markets, invites price competition
   • Self-service enablement: Customers route around employees entirely ($5 AI legal review vs. $500 human review) — creates new markets at 100x lower price points

   The growth multiples live in enablement, not substitution. If your product roadmap makes employees faster, you're playing the smaller game. If it makes customers self-sufficient, you're creating new demand pools.

   The Verification Imperative

   As AI flywheels become production reality — systems that generate, test, and refine their own work — the failure mode isn't 'AI gives a bad answer.' It's AI systematically optimizing toward the wrong objective and compounding the error before anyone notices. The company that owns the verification layer for agentic AI will occupy the same strategic position Datadog occupies for cloud infrastructure: essential, sticky, and margin-rich. Verification infrastructure must precede AI autonomy, not follow it.

   What to do

   1. →

      Audit where AI tools are already in use without formal authorization — measure output velocity changes vs. 12 months ago. Complete within 3 weeks.

      NowYou're paying pre-AI costs for post-AI output right now. The productivity gain exists but is invisible to management.
   2. →

      Select 2-3 functions and redesign workflows assuming AI handles 60% of task volume — not 'add AI to existing process' but 'design from zero.' Launch pilots by end of Q3.

      This sprintThe companies that redesign first lock in structural cost advantages. This is a 12-18 month window before the market forces restructuring on laggards.
   3. →

      Evaluate verification/observability infrastructure as a strategic build-or-buy decision. Present options to leadership within 45 days.

      This quarterFlawed metrics in closed-loop AI systems compound errors at machine speed. Verification is the binding constraint on safe autonomy.
   4. →

      Stress-test workforce planning: model what happens when AI automates the top of the skill ladder first, not the bottom.

      This quarterThe automation filter is predictability × verifiability, not blue-collar vs. white-collar — this inverts traditional assumptions about who's safe.
2. 02

   Microsoft's Frontier Company: Your SI Renegotiation Window Is Open Now

   The Consulting Pyramid Is Collapsing

   Microsoft deploying 6,000 engineers and $2.5B under a dedicated 'Frontier Company' banner for enterprise AI integration isn't a services experiment. It's the platform vendor eliminating the systems integrator layer entirely. The logic is structural: if AI standardizes 80% of integration work, the platform vendor wins because they control both the product roadmap and the implementation playbook.

   Deloitte's consultants aren't being dramatic when they say 'our model is finished.' The consulting pyramid works because firms charge senior rates for work staffed by juniors. When AI performs the junior work, the pyramid collapses into a very expensive flat line of senior advisors competing on relationship capital alone.

   The Buyer's Leverage Has Never Been Stronger

   For any technology executive spending $50M+ annually on SI engagements, this is the quarter to renegotiate. Three forces create simultaneous buyer leverage:

   1. Microsoft is offering a direct alternative to traditional SIs — at platform-native pricing, not billable-hour pricing
   2. Your SI partners are scared — their junior analyst pipeline (their margin engine) is being automated
   3. The Turing Post analysis confirms the value layer is moving to 'organizational AI infrastructure' — tooling that makes enterprises machine-legible — which platforms deliver better than consulting armies

   The Talent Pipeline Crisis Is Real

   This connects to a deeper structural problem that multiple sources flagged independently. If AI does the work that used to train juniors, how do you develop the next generation of senior practitioners? Research shows AI causes learning loss in students. The hedge fund signal (F40) confirms expert knowledge not in training data retains massive value — but the apprenticeship path to creating that expertise is being destroyed.

   This isn't a consulting industry problem — it's an organizational design problem that will hit every knowledge-work enterprise within 2-3 years.

   What This Means for Your Vendor Strategy

   Dimension	Traditional SI	Microsoft Frontier
   Pricing model	Billable hours / T&M	Platform-aligned outcome pricing
   Integration depth	Vendor-agnostic (in theory)	Microsoft-native stack priority
   Junior leverage	Collapsing (AI replaces juniors)	AI-first from design
   Lock-in risk	Low (switching possible)	High (deeper platform dependency)
   Speed advantage	Weeks to staff	Immediate capacity

   The trade-off is clear: faster, cheaper AI integration in exchange for deeper Microsoft platform dependency. For organizations already committed to the Microsoft stack, this is straightforward. For multi-cloud or hybrid environments, use Microsoft's entry as leverage in SI negotiations without necessarily switching.

   What to do

   1. →

      Audit all SI/consulting engagements over $5M for AI transformation work. Flag contracts expiring in next 6 months for immediate renegotiation using Microsoft's competitive entry as leverage.

      NowSIs are scared and Microsoft is offering alternatives. Power dynamic has shifted to buyers this quarter — this window is temporary.
   2. →

      Request a briefing from Microsoft on Frontier Company capabilities for your next major AI integration initiative — use as competitive pressure even if you don't switch.

      This sprintHaving a credible alternative on the table transforms every SI negotiation from cost-plus to competitive bid.
   3. →

      Design an internal apprenticeship model that accounts for AI-automated entry-level work. Task HR leadership with a proposal within 60 days.

      This quarterThe talent pipeline that creates your future senior practitioners is breaking. The org that solves this builds an enduring competitive moat.
3. 03

   PolinRider: 108-Package Supply Chain Campaign Demands Immediate Response

   This Is Not a Hacker — It's a Production Line

   North Korea's PolinRider campaign published 108 malicious packages across four ecosystems simultaneously: npm, Go modules, Packagist (PHP), and Chrome extensions. The volume and cross-platform coordination signals automated tooling for package creation, identity spoofing, and ecosystem seeding. Any engineering organization relying on developer judgment ('just review what you install') is operating with 2019 assumptions against 2026 threats.

   The Kill Chain Completes with Bad Epoll

   CVE-2026-46242 — the 'Bad Epoll' Linux kernel vulnerability — allows any unprivileged user to gain root on Linux servers, desktops, and Android devices. The strategic implication is devastating when combined with supply chain poisoning: a single compromised dependency gives initial foothold → Bad Epoll immediately escalates to full system compromise. The fix exists, but patching velocity is the real question.

   Any initial foothold gained via a poisoned package can be immediately escalated to full system compromise. Your patching velocity for kernel-level CVEs is now a board-reportable metric.

   Additional Threat Signals

   • Avalon framework: Previously unknown modular malware with ransomware capabilities, explicitly designed to bypass signature-based detection. If your last major security architecture investment relied on known-bad detection, you have a gap.
   • Armored Likho: New threat actor targeting power infrastructure across Russia, Brazil, and Kazakhstan — critical infrastructure targeting proliferating beyond the US/China/Russia triangle.
   • FatFs vulnerabilities: Millions of embedded/IoT devices affected with near-impossible remediation paths.

   The Investment Decision Is Straightforward

   Supply chain security tooling with CI/CD integration — Socket, Snyk, JFrog, or equivalent — is no longer a 'nice to have' evaluation. The threat has matured from opportunistic to industrial. The cost of a single successful supply chain compromise (lateral movement, data exfiltration, ransomware) dwarfs the tooling investment by orders of magnitude. Additionally, the convergence with AI coding tools (Saturday's intelligence flagged Claude Code running malicious code from GitHub links) means AI-accelerated development is AI-accelerated attack surface expansion unless supply chain controls are embedded in the pipeline.

   What to do

   1. →

      Validate CVE-2026-46242 (Bad Epoll) patching status across all Linux infrastructure and Android device fleet. Target complete coverage within 72 hours.

      NowUnprivileged-to-root on every Linux/Android system. Combined with supply chain attacks, this completes the kill chain from dependency to full compromise.
   2. →

      Mandate supply chain security tooling in CI/CD pipelines — move from evaluation to procurement decision within 2 weeks if not already deployed.

      Now108 packages across 4 ecosystems is industrial-scale. Developer judgment cannot scale against automated supply chain poisoning.
   3. →

      Measure and report actual kernel-level patching velocity to the board — this is now a governance metric, not just an ops metric.

      This sprintIf the answer to 'how fast do we patch critical kernel CVEs?' is 'weeks,' you're operating with unacceptable exposure windows against nation-state actors.
   4. →

      Review security architecture for behavioral/EDR coverage — confirm you can detect Avalon-style multi-stage attacks that bypass signature-based tools.

      This quarterAvalon was built to defeat known-bad detection. If your last major security investment was in that paradigm, the architecture has a strategic gap.