The Board Room

EDR opacity, provenance, and patch windows all failed the same test

The reasonable skeptic will read this week's news as three unrelated stories that happen to land together. The reasonable skeptic is half right. The stories are unrelated in target. They are not unrelated in cause: AI compressed the cost of understanding defensive systems faster than defenders could refresh their obscurity. Each of the three invalidates a line item that most organizations still carry on the budget as a working control.

The security model of the defensive stack was built on the premise that the cost of understanding the agent exceeded the value of bypassing it. That premise is no longer true for a growing share of the threat population.

Layer 1: Endpoint Detection Is Now Transparent

TrustedSec ran LLMs against five commercial EDR products and found identical architectural patterns across all five: YARA-style rules, behavioral logic, allowlists, prefilters, scripted engines readable as Lua after a single decryption pass, and local ML classifiers. Work that required a skilled reverse engineer and weeks of effort now completes in days. The population of attackers capable of this expanded by an order of magnitude, and the refresh cycle on bypass techniques is measured in days rather than quarters.

Layer 2: Full Network Takeover Achieved

The UK AISI confirmed that Anthropic's Mythos completed both of AISI's hardest simulated attack ranges, a first. OpenAI's GPT-5.5-cyber completed one. These models find and chain exploits in something close to real time, outperforming a trend line in which AI cyber task completion was already doubling every few months. This is a capability discontinuity, not a continuation. Security equities are up 20% YTD, which is the market beginning to price this in and almost certainly underpricing it.

Layer 3: Supply Chain Trust Anchors Are Forgeable

The TeamPCP/Shai-Hulud framework forges Sigstore provenance by extracting OIDC tokens from CI/CD runner memory. The verification chain the industry adopted specifically to prevent supply chain attacks is now itself an attack surface. A PraisonAI vulnerability was weaponized 4 hours post-disclosure. The exploit window has collapsed below what any traditional patch cadence can cover.

The Defensive Roadmap

The compensating controls that survive this quarter are the ones that do not depend on the endpoint being opaque: identity, network telemetry, and behavioral analytics above the endpoint. The architectural bet made this quarter about where detection lives is the bet that matters in two years. Teams that keep treating the endpoint agent as the load-bearing control will discover what load-bearing means when the control becomes transparent.

Microsoft's MDASH, deploying 100+ coordinated AI agents for vulnerability discovery, shows the direction. AI-versus-AI security is the only posture that scales against AI-speed offense. Any budget still funding endpoint-agent renewals as the primary detection line item, rather than reweighting toward identity and network telemetry, was written for last quarter's threat surface.

Four Platforms Made the Same Bet in the Same Week

SAP, ServiceNow, Apple, and Google each told the market, in the same quarter, that the UI-centric era is winding down. The surface that matters is no longer the one a human touches. It is the API an agent calls. The contest is not which model wins. The contest is which platform every agent has to pass through to act on the real world.

Agents that act across finance, HR, IT, and procurement need one authoritative place to reconcile state. Two authoritative places is zero authoritative places.

Two Competing Architectures

ServiceNow adopting MCP as the standard for Action Fabric pulls the ecosystem toward that protocol. SAP building a vertically integrated Knowledge Graph makes its own agents contextually superior inside SAP's data universe. Both can win in different segments at the same time.

The Platform Gatekeepers Move

Apple is inserting itself at the agent layer on iOS. The filings address agents that "spin up smaller apps on the spot after Apple has already approved the parent app," which is Apple saying, in lawyer prose, that agent sub-spawning is a safety risk and a revenue leak at the same time. Google ships Gemini Intelligence this summer on 3B+ devices, which turns apps into infrastructure and the agent into the interface.

The consequence for any product is that if the agent mediates intent, discovery, pricing power, and the customer relationship migrate one layer up. a16z estimates $150B of GTM value is migrating away from the traditional CRM toward the AI orchestration layer.

The Decision This Quarter

A reasonable skeptic would say it is too early to declare the orchestration layer the prize, and that vendor positioning in one quarter is not destiny. The reasonable skeptic is correct on the timing and wrong on the geometry. The question is whether the platform is building the orchestration layer that other people's agents pass through, or becoming the commodity infrastructure underneath someone else's agent. Those are not the same business. They do not produce the same multiples. The window is 12-18 months, and after it closes, agent orchestrators route around the platform rather than through it.

The Numbers That Should Be on Your CFO's Desk

ServiceNow's CDIO disclosed publicly that the company blew its full-year Anthropic budget by May. Anthropic, for its part, conceded it grew 80x against a planned 10x, which is another way of saying the provider ran at roughly 12% of the capacity its own customers required, silently degrading service while invoices kept clearing. The frame matters more than the anecdote. This is the structural condition of enterprise AI in mid-2026, not one vendor having a bad quarter.

We are in the equivalent of cloud computing circa 2014: powerful capabilities, wildly unpredictable economics, and a governance vacuum that creates real financial exposure.

The Cost Is 3-5x What the Budget Shows

Every serious model provider — Google, OpenAI, Anthropic — now concedes that the model alone does not deploy itself. Google is hiring hundreds of forward-deployed engineers. OpenAI acquired a 150-person consulting firm. ServiceNow and Salesforce are standing up their own FDE teams. At a loaded cost of $300-500K per FDE, and 5-10 of them required for a meaningful deployment, the true program cost lands at 3-5x the model fees. That is the denominator boards approving AI envelopes are not yet using.

The Data Foundation Gap

85% of organizations lack adequate data foundations for agentic AI and are spending in the millions to tens of millions regardless. A survey of 334 practitioners found only 4.8% said they needed better tools. The remaining 95.2% asked for training, clearer requirements, more time, and dedicated data ownership. The skeptic will say this is the usual practitioner complaint. The skeptic is partly right and entirely missing the point: this is not a tooling gap, it is an organizational one, and tooling budgets do not close it.

The Compute Economics Are Shifting Underneath

xAI is leasing 220,000 GPUs (45% of Colossus) to Anthropic, the same competitor Musk publicly called "misanthropic and evil." When that trade clears, GPU supply has become a financial instrument first and a strategic moat second. Training efficiency is compounding in the same direction: 2-3x from token superposition, 360x from elastic post-training, 17x from data curation. The build-versus-buy math on custom models is being repriced every quarter.

The Governance Response

ServiceNow's CDIO is already building an AI Control Tower and selling it to other enterprises. That is not partnership. That is the market routing around a vendor deficiency. Anthropic does not offer SLAs, does not provide usage telemetry, and had no comment on the budget blowout. The strategic posture is unambiguous: Anthropic is betting model performance will override governance concerns. This quarter's bet sets up next quarter's procurement review, and the enterprise market may decide it disagrees.