The Board Room

The Defensive Moat Was Obscurity. It's Gone.

TrustedSec pointed five LLMs at five commercial EDR products and discovered that all five are built the same way: YARA-style rules, behavioral logic, allowlists, prefilters, Lua-readable scripted engines, and local ML classifiers. The reverse engineering work that used to consume a skilled human for weeks now resolves in days with AI assistance. A reasonable skeptic would say this is one research shop and one method. The reasonable skeptic is correct. What the skeptic does not explain is why the entire endpoint security category was priced on obscurity in the first place, or why the cost of stripping that obscurity just fell by roughly an order of magnitude.

The trend line confirms the direction. Anthropic's Mythos became the first model to clear both UK AISI end-to-end simulated attack ranges, including autonomous full network takeover. OpenAI's GPT-5.5-cyber cleared one of the two. Both results sit above what was already an exponential curve in AI cyber task completion, which the UK AISI describes as doubling every few months.

The Exploitation Window Has Collapsed to Hours

A PraisonAI vulnerability was weaponized within 4 hours of disclosure. In the same window, Microsoft's MDASH system, running 100+ coordinated AI agents, surfaced 16 exploitable flaws in a single Patch Tuesday. SANS noted that AI infrastructure tools — LiteLLM, Ollama, OpenClaw — now appear on CISA's Known Exploited Vulnerabilities catalog. Adversaries are targeting the AI routing layer that most organizations adopted without security review.

A patch window measured in months because attackers needed months is now a patch window measured in months because procurement needs months. The attacker side moved. The defender side did not.

The Compensating Controls That Matter

The security model that priced in endpoint-agent obscurity as bought time has to be replaced with one that assumes the endpoint is transparent to a growing share of adversaries. The controls that earn their seat for the next 18 months are these:

• Identity and blast radius — segmentation that limits what a compromised endpoint can reach
• Network telemetry — detection above the endpoint layer, where the agent no longer provides cover
• Behavioral analytics — correlation across signals the attacker cannot observe from the endpoint alone
• Recovery time measured in hours — architecture that assumes breach and optimizes for restoration

Palo Alto Networks' AI-driven scanning has already surfaced dozens of serious vulnerabilities across 130+ products. The same capability arriving in ransomware hands inside 12-18 months is the base case, not the tail. The Foxconn breach, with 8TB exfiltrated from Apple, Google, Intel, and Nvidia designs, says the supply chain hits are already landing at exactly the sites where AI hardware IP concentrates.

Three Platforms, Three Architectures, One Quarter

The enterprise software industry has, for once, agreed on the question, if not the answer. The next control point is the surface through which AI agents execute. SAP launched a €100M fund built around a vertically integrated Knowledge Graph, on the theory that owning the data universe makes its own agents contextually better than anyone else's. ServiceNow went the opposite direction and adopted MCP, the Model Context Protocol, as its standard for how agents talk to the platform. Apple, predictably, is preparing to gate agent distribution through the App Store and extend the 30% fee into the agent economy.

These three bets are not reconcilable, and the positioning decision lands this quarter, not next year.

59% of AI Traffic Is Already Agentic

Vendor-published data deserves the usual discount, but the direction is hard to argue with. Vercel's production telemetry across 200K+ teams shows that more than half of AI API usage is now agents taking actions, not humans having conversations. a16z puts the number on the revenue side at $150 billion of go-to-market value migrating from traditional CRM to the AI orchestration layer, which is the kind of figure a venture firm produces and which is also probably directionally right. Google ships Gemini Intelligence on Android this summer with 97%+ market share in the relevant geographies, which makes the OS itself the agent surface whether anyone wanted that outcome or not.

Agents that act across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places.

The Pricing Model Breaks Simultaneously

The Lemkin data point is the one to remember when the architecture conversation drifts back to abstractions: 80% fewer human seats, 83% higher total spend, 20+ agents running. Seat-based pricing cannot survive a world in which agents replace the humans those seats were sold to. SAP is already pricing around workflow execution rather than per-seat licensing. ServiceNow's headless architecture implies consumption-based pricing on agent API calls. The revenue model and the platform architecture turn out to be the same decision wearing two hats.

The 81% agent bot bypass rate is the part the security teams have been quietly aware of for a year. Every WAF, CAPTCHA, and rate-limiting system built on behavioral patterns fails against agents that mimic human interaction, because that is what they were trained to do. The control point question and the security question converge on the same surface, which is the part most board decks still treat as separate.

80x Against a 10x Plan

Anthropic has conceded it grew 80x against a planned 10x, which is another way of saying it ran at roughly 12% of required capacity for extended stretches. Developers in that window got degraded service, rate limits, and quite possibly lower-quality model responses without disclosure. ServiceNow's CDIO has said publicly that the company blew its full-year Anthropic budget by May, and is now building AI Control Tower to sell the workaround to other enterprises. That is not a vendor partnership. That is the market routing around a vendor deficiency.

The operational consequence is the part most executives are underweighting. Any engineering organization with production dependencies on Anthropic was taking degraded output for months. Productivity gains measured against that baseline are understated against what adequate provisioning would deliver.

xAI Concedes the Frontier Race

When Elon Musk, who publicly called Anthropic "misanthropic and evil," agrees to lease them 220,000 GPUs (45% of Colossus), the financial logic has overwhelmed the competitive logic. Grok never reached meaningful B2B or B2C traction. The lease revenue almost certainly exceeds what Grok could generate from those same GPUs. The population of viable frontier labs is contracting, and excess infrastructure is moving to the lease market.

A provider that planned for 10x and got 80x was operating at roughly 12% of required capacity. The productivity gains measured in that period are very likely understated against what adequate provisioning would deliver.

The Cost Governance Vacuum

Anthropic does not offer SLAs, does not provide usage telemetry, and has no comment when enterprise customers publicly describe budget blowouts. Every major AI player is now admitting that deployment is human-intensive. Google is hiring hundreds of Forward Deployed Engineers. OpenAI acquired a 150-person consulting firm. ServiceNow and Salesforce are building FDE teams of their own. A program that needs 5-10 FDEs at $300-500K loaded cost each carries a true cost 3-5x the model fees.

The Market Structure Is Not What It Was

The numbers do most of the arguing. Anthropic: $30B ARR, raising at $900-950B, 120x growth in 24 months. Cerebras IPO at $56B with a 70% first-day pop. Microsoft has committed $100B+ to OpenAI. Nebius growing 684% with a 4:1 demand ratio. GPU supply is a financial instrument first and a strategic moat second. The firms shipping AI on schedule are the ones that locked capacity 12-18 months ago. Everyone else is operating at a structural handicap that does not resolve on its own.

Three Frameworks, One 18-Month Window

The AI liability question is being settled in three places at once: the courts, Congress, and the regulatory agencies. The venture ecosystem has noticed, which is why it is spending $115.5M in 2026 midterm political donations on the outcome. a16z has published what amounts to the industry lobbying blueprint, with user-liability defaults and damages caps as the headline asks. Agree with the framework or not. The posture of the firms writing it is what determines compliance cost in 2028.

The competing regimes do not produce variations on the same business. They produce different businesses.

Courts Are Moving Before Congress

Active litigation against general-purpose AI tools could impose substantial penalties on developers for downstream user misuse well before any legislative framework exists. The likely sequence is precedent-setting rulings first, comprehensive federal law second, and a patchwork of judicial standards that subsequent legislation works around rather than replaces. Firms not watching those dockets are not managing the exposure.

The ODNI vs. Commerce Fight Sets the Rules

Inside the administration, the intelligence community wants a center inside ODNI for pre-release evaluation of frontier models. That is a licensing regime in everything but name. Commerce's alternative is voluntary agreements through CAISI, which preserves speed-to-market. A reasonable skeptic would call the difference cosmetic. The reasonable skeptic is wrong. An IC-led regime means release gating and classified compliance. A Commerce-led regime means disclosure obligations that are expensive but navigable. Those are not the same business model.

If developer liability for downstream use becomes the standard, the economic logic of releasing an open-source model stops working. No rational actor open-sources a model that generates unbounded liability for every downstream application.

Most product strategies in market today quietly assume continued access to open-weight models. That assumption is an unpriced dependency on regulatory outcomes the P&L does not show. The competitive moat for the next five years is the quality of the audit trail, the defensibility of the evaluation process, and the contractual allocation of residual risk with upstream vendors. The decision made in the next eighteen months sets the cost structure for the decade after.