The Board Room

Microsoft Proved the Negative

Microsoft's Copilot rationalization is the most instructive strategic signal in enterprise AI this quarter. A company with unlimited frontier-model access, 400 million Office users, and effectively unlimited capital concluded that broad AI distribution destroys value. Customer feedback produced the phrase 'functionally useless.' The earnings call confirmed that inference costs drag margins. Eighty-one distinct products were in flight. Nadella's sequence was consolidation under one executive (Andreou), then killing everything that failed both a customer-value test and a unit-economics test.

If breadth-first AI feature sprawl does not work inside the largest software distribution on earth, the question of whether it works inside a smaller one answers itself.

The Structural Margin Gap

A reasonable skeptic would call this a maturity problem that scale resolves. The skeptic is wrong, and the numbers say so. BVP puts AI company gross margins at 50-60% against 80-90% for traditional SaaS. Reasoning models consume 10-100x the tokens of the prior generation for the same user-visible answer. OpenAI's 1,000x cost reduction over 14 months was eaten by its own model advances. Per-token cost falls. Tokens consumed per task rise faster. A company shipping AI on every surface is running thirty margin-negative line items to fund the one that pays for itself.

The Opposite Bet Is Working

Anthropic's shift to per-result pricing, charging for outcomes rather than tokens, is the structural alternative. It works because the agents complete the work, with a 90% autonomy target for Claude Code, which makes the vendor's eat-the-cost risk acceptable. Focused 365 Copilot, the part Microsoft is keeping, grew paying users 33%. Narrow, high-value surfaces where customers pay on purpose outperform broad feature spray by every measure that matters in year two.

Portfolio Implications

Every AI feature shipped on inference without corresponding willingness-to-pay is a standing cost against non-existent revenue. The audit is straightforward. Map every AI-powered feature to customer-perceived value and to inference cost. Anything that fails both tests is a margin leak that compounds with scale. Microsoft absorbed it for 18 months. Most organizations cannot absorb it for one quarter.

The era of competing everywhere with undifferentiated AI is over. Microsoft proved it does not work with infinite resources, which is useful to know before spending finite ones.

The Numbers That Changed

Three data points landed this week, and taken together they rewrite the economics of defense rather than nudging them:

• $30-$150 per codebase for AI-powered zero-day discovery (IronCurtain framework, open-weight models)
• 95% success rate for autonomous red team agents achieving domain dominance in under 6 minutes (Dreadnode Ares benchmark)
• 271 vulnerabilities found in Firefox, a mature and well-maintained project, in a single Mythos pass

The defender's side of the ledger reads differently. 55-day average remediation against 135 new CVEs per day leaves a running deficit of roughly 7,400 unpatched vulnerabilities at any given moment. Human-speed processes do not close that arithmetic.

When the attacker's economics and the attacker's clock are both on the same side of the ledger, and the defender's procurement cycle is still measured in quarters, the gap is structural, not operational.

The Model-Agnostic Problem

A reasonable skeptic would argue that restricting frontier models still buys time. The reasonable skeptic is already behind the evidence. Niels Provos has shown that older, widely available models with expert orchestration replicate frontier findings, and the UK AI Security Institute found GPT-5.5 (broadly available) may outperform Mythos (restricted) on cybersecurity tasks. Any security strategy that relies on attacker capability being gated by model access is pricing against a world that ended this quarter.

What Changed in Cloud Detection

The attack surface has migrated from exploits to abuse of legitimate APIs. The Mini Shai-Hulud worm crossed npm, PyPI, and Packagist in 48 hours, compromising official SAP and PyTorch Lightning packages. AWS Bedrock AgentCore's S3 access creates bidirectional C2 channels that AWS calls intended behavior. Traditional monitoring architectures are structurally blind to this class of attack, and language diversity in the stack no longer delivers security heterogeneity.

The Strategic Response

Google's VRP restructuring is the leading indicator worth watching. Rewards are dropping for bugs AI can find (commoditized) and rising for hardware exploitation and complex chains (up to $1.5M for Titan M2). The value is migrating from discovery to exploitation prevention and runtime protection. Security spend has to move off incremental improvement of legacy detection and toward AI-native defense that operates at machine speed, because the alternative is a budget defending last quarter's perimeter against this quarter's economics.

GitHub's 85% Uptime and the Agent Load Miss

GitHub's measured uptime fell to 85%, which works out to two or three hours of downtime a day. CTO Vlad Fedorov attributed the shortfall to AI agent load being 'much bigger than expected' and disclosed that GitHub revised its scaling target from 10x to 30x in four months. A single developer running Claude Code or Codex now generates the load previously associated with 10-50 developers. Agents run flat around the clock, parallelize aggressively, ignore rate-limit etiquette, and convert failed requests into more requests rather than backing off.

This Is a GitHub Failure, Not an Industry Condition

GitLab, Bitbucket, Vercel, Linear, Railway, and Sentry are absorbing equivalent AI-driven growth without catastrophic reliability failures. Google's SRE teams were preparing for 10x code increases in July 2025, a full year before GitHub's crisis became public. The gap between Google's anticipation and GitHub's surprise is the cleanest available read on which organizations internalized agent-era scaling and which are reacting to it.

Mitchell Hashimoto, HashiCorp founder and 18-year GitHub user, publicly declared it 'unfit for professional work.' That is less a single defection than a permission structure for enterprise procurement conversations that were previously unthinkable.

The Mirror Problem: Portfolio Products Under Agent Load

The harder question is whether products shipped from the same portfolio are architected for the equivalent 30x load explosion. The customers running agents against GitHub are the customers running agents against every other API they touch. A platform that passes the GitHub dependency audit and fails the 'can our own product handle agent traffic' audit has simply moved the outage from a vendor's status page to its own.

Agent Traffic Is a Different Traffic Class

• No diurnal pattern — load is flat 24/7
• Aggressive retry behavior — failed requests multiply rather than queue
• High parallelization — one user generates 10-50x historical load
• No rate-limit politeness — agents hit limits then spawn parallel paths

Every platform sitting in the AI-agent consumption chain was built against human usage patterns. Most will meet the new profile the same way GitHub did: by degrading first and re-architecting second. The strategic question is which products get re-architected before the load arrives and which get re-architected after. The two paths do not cost the same, and they do not look the same to customers twelve months from now.

The security overlay compounds the problem. A critical vulnerability allowing full repository access via git push overlapped with the reliability failures, creating compound risk that should trigger immediate enterprise security review for any on-premises GitHub Enterprise deployment.