The Board Room

Deep dives

1. 01

   Your Model Vendor Is Now Your Competitor — Decode the War Before You Re-Sign

   Read the coordinated CEO messaging as competitive positioning, not customer advocacy. Microsoft lacks a frontier model and wants enterprises anchored to Azure's dedicated instances; Salesforce runs on the very models it attacks; Palantir's data-integration thesis dies if labs match it natively. All three face existential exposure to labs moving up the stack — the 'knowledge leakage' warning is a weapon, but the threat it describes is real.

   The evidence is a pattern: Cursor built booming traffic on Claude — Anthropic shipped Claude Code. Partners validated legal and design use cases — Anthropic launched competing features. OpenAI merged ChatGPT, Codex, and a website builder into one workspace, attacking Notion, Vercel, and Squarespace in a single release, while JetBrains made Codex its default agent. Your success on their platform is their product roadmap, and validation-to-cannibalization timelines are compressing.

   Second-Order Effects

   Microsoft and Amazon are building a toll booth as privacy-preserving intermediaries — capturing margin and the customer relationship while commoditizing the labs into interchangeable APIs. The stack is bifurcating into vertically integrated providers and modular architectures with substitution layers. Deep single-provider integration is now a wager your provider won't enter your market — odds deteriorating.

   The Decision

   1. Map every product and feature built on Anthropic or OpenAI models; flag use cases those providers plausibly enter within 12–18 months.
   2. 'We use a good model well' is not a moat — only proprietary data, workflow depth, or network effects that survive model substitution qualify.

   In this AI stack, the platform you build on is the competitor studying your traction data.

   What to do

   1. →

      Renegotiate all enterprise AI agreements this quarter to add data-isolation audit rights, non-compete clauses on your market segment, and exit terms triggered by provider vertical integration

      This quarterContract leverage exists now — providers need enterprise revenue to fund the platform war; it evaporates once they enter your category
   2. →

      Cap any single model provider at 40% of product-portfolio dependency and stand up an abstraction layer enabling sub-24-hour model swaps

      This quarterMicrosoft's in-housing move proves even $13B partnerships don't survive model parity — concentration risk is demonstrably unhedged
2. 02

   Model Spend Is the New Cloud Bill — Orchestration and Evals Are the Margin

   The week's most instructive data point is a paradox: Cognition switched Devin to a model costing 2x more per token — total bill down, quality up. Architectural optimization (task decomposition, eliminating redundant calls) now outweighs per-token pricing as the primary cost lever. Meanwhile identical TypeScript workloads cost 73% more on one vendor than another, and an estimated 80% of enterprise token spend is waste. This is 2018 cloud economics replaying: most organizations can't see token spend at task-level granularity, let alone efficiency.

   Where does durable advantage live once models commoditize? Evaluation infrastructure. Roughly 99% of AI revenue concentrates in coding for a mechanical reason — code has built-in evals (it compiles, it passes tests). Legal, finance, ops, and strategy don't, so agents stall there. Whoever builds credible domain-specific eval frameworks becomes the trust layer for their vertical — a moat that survives every model generation.

   Second-Order Effects

   Layer	Trajectory	Your posture
   Model access	Commoditizing (7:1 open-weight cost gap)	Rent, route, never depend
   Orchestration	Consolidating fast (/goal shipped by 3 vendors in 3 weeks)	Build competency, avoid deep lock-in
   Evals + proprietary data	Wide open	Own outright

   Caveat: open-weight routing carries new geopolitical exposure — Beijing is weighing export controls on the Chinese open-source models now carrying a quarter of routed traffic.

   The Decision

   Stop paying for model intelligence as if it were scarce; invest in the evaluation and routing layer that decides which intelligence is good enough.

   What to do

   1. →

      Commission a token-economics audit by end of quarter — map spend by vendor, model, and task type, and quantify open-weight substitution for commodity workloads

      This quarterA 7:1 cost differential on a third of workloads is a structural margin gap competitors are already banking
   2. →

      Fund a proprietary eval framework for your core business domain before a competitor's becomes the industry standard

      This quarterEvals are the bottleneck blocking AI revenue outside coding — whoever defines 'good enough' in a domain owns its trust layer
3. 03

   The Pentagon Just Vaporized a $7B Compliance Market Overnight

   The structural failure was always visible: 100 certified assessors for 100,000 contractors is a mathematical impossibility, and the Pentagon's own research showed the $7B annual cost burden was driving contractors out of the defense industrial base. Five years of vendor roadmaps, positioning, and revenue forecasts built on CMMC's inevitability entered hospice this week — days after CMMC was assumed to be the enforcement channel for the DOD's post-quantum mandate. The enforcement vehicle itself is now frozen.

   The deeper shift: compliance-driven security spending — the GRC segment's engine for a decade — is being structurally undermined in the US. The replacement demand driver is fear, and it's well-founded: Russia's attack on Poland's grid left 500,000 without heat, a kinetic-harm demonstration landing exactly as the US withdraws CISA election support and softens its posture. The gap between threat reality and mandated defense is the widest in years.

   Second-Order Effects

   • State-level greenfield: Secretaries of State now name the federal government a primary threat; states need everything CISA provided — threat intel, IR playbooks, coordination — on state procurement vehicles before November 2026.
   • European escalation: Coordinated EU sanctions against FSB Center 16 and GRU leadership will carry budget; US vendors with EU presence get an ideal entry window created by American withdrawal from allied security leadership.
   • Messaging pivot: 'Certification readiness' is dead; sell 'continuous security posture against demonstrated adversaries.'

   The Decision

   Compliance mandates just stopped being a reliable demand engine — sell to fear that's real, in markets Washington abandoned.

   What to do

   1. →

      Pressure-test every revenue forecast and vendor relationship tied to CMMC-driven demand within 30 days, modeling both full cancellation and a 'CMMC-lite' reform scenario

      NowThe 60-day cancellation window means 2027 planning assumptions built on mandatory certification are already invalid
   2. →

      Stand up a state/local government motion targeting election security and state cyber autonomy this quarter, and scope EU critical-infrastructure partnerships in parallel

      This quarterBoth markets are greenfield, threat-motivated, and time-boxed — states buy before November 2026, and EU budgets follow this sanctions cycle
4. 04

   Destruction or Reallocation? The AI Spending Signal Your Board Will Misread

   Today's intelligence holds a genuine contradiction to resolve before your next board meeting. One read: IBM's collapse is the first demand-destruction signal — clients spending less on AI-adjacent services under ROI scrutiny. The competing read: violent reallocation — finite IT budgets sacrificing everything non-AI-critical to fund infrastructure, with legacy vendors as raid victims. The distinction sets strategy: destruction means tighten AI investment; reallocation means anything 'important but not AI-critical' in your revenue is the next budget raided.

   Evidence favors reallocation with an accountability overlay. Enterprise AI procurement is shifting to measured-ROI purchasing — longer cycles, harder business cases — while investors punish the spend side. The rotation into capex-light AI beneficiaries and out of picks-and-shovels names says the market wants AI exposure without balance-sheet risk. Apple's playbook — recycling cancelled-project ML into edge silicon, capturing the premium without hyperscaler capex — is what's being rewarded.

   Second-Order Effects

   The macro loop tightens: AI infrastructure demand is now cited as a driver of core inflation at 3.4%, putting a rate hike on the table at the Fed's July 28–29 meeting (39–45% market odds). The AI boom is manufacturing its own cost-of-capital headwind. Locked-in infrastructure costs plus free cash flow win that scenario; leveraged spenders get repriced.

   The Decision

   1. Classify every revenue line 'AI-critical / AI-adjacent / raidable' and defend or reposition the third category now.
   2. Convert AI marketing from capability claims to measured-ROI evidence — the buyer's procurement gate changed this quarter.

   The market stopped paying for AI ambition this week; it pays only for AI proof — on your income statement and your customers'.

   What to do

   1. →

      Run an emergency revenue-exposure analysis identifying what percentage of your book sits in workloads customers could redirect to AI infrastructure, and build retention plays for the top three exposed lines

      NowBudget raids arrive in quarters, not years, and without warning — the reallocation is customer-driven, not vendor-signaled
   2. →

      Stress-test your AI investment thesis against a simultaneous 50bps rate hike and 12-month capex-winter scenario before the July 28-29 Fed meeting

      NowIf the hike lands, cost of capital and investor patience shift within days; the thesis must survive both or be resized