The Board Room

The clause that turns a strike into your loss

The paperwork matters more than the munitions here. Cloud master agreements and cyber policies carry act-of-war and physical-destruction exclusions written against storms, fires and fibre cuts. A strike on a Gulf facility triggers those, not service credits, and the loss sits with you while the reinsurer argues intent for a year. Region selection is a foreign-policy judgement now, and almost no availability-zone diagram scores it.

Risky Business, alone in today's set, reports Iran struck AWS facilities in Bahrain and the UAE twice in 2026, with threats extending to further US technology firms. One newsletter is thin ground for a claim that size, so confidence is medium. The contract exposure holds even if the count is wrong. The risk is not one region going dark. It is a correlated outage no disaster-recovery test has simulated, arriving with a diplomatic cause and no restore path. Two of the regions serving Europe, the Middle East and Africa sit inside that judgement.

Liability steepens in Seoul and Brussels, flattens in Washington

Korea's consumer agency ordered Coupang to compensate every affected user $70 across more than 37 million people, roughly $2.6 billion implied. Whether it is ever paid matters less than the template, and templates travel. US telcos and Republican lawmakers pushed an appellate rehearing to unwind the FCC's expanded breach rules, and it is ENISA, not CISA, publishing the secure-by-design playbook engineers can implement.

A skeptic would call alignment to the European baseline expensive theatre. A loss model calibrated to US notification norms under-invests in security engineering and under-reserves for liability at once. Aligning upward buys every market simultaneously, and part of the estate is already built that way.

The adversary spends everything for one token

Storm-2945, the Russian SVR subgroup Microsoft attributes this campaign to, spends heavily for one token. DNS hijacking at WiFi gateways, ClickFix lures, malware Microsoft names CornFlake RAT and CocoShell, the FruitStone command-and-control panel: all of it steals Entra device codes and OAuth tokens to bypass multi-factor authentication. Microsoft says gateways at "all sorts of organizations" were hit, not just hotels. The GRU's APT28 ran the same playbook through MikroTik and TP-Link routers. Convergence by two rival services is doctrine, and doctrine does not get taken down.

Disabling the device-code authentication flow is a conditional-access change measured in days, still enabled in most tenants, and it ends the payoff of a campaign running since May. Detection weighted to network and endpoint while identity telemetry goes unqueried leaves the vault open.

The lever the West held is eroding

The Information reports that China has moved to mass production of homegrown DUV lithography tools. Export controls at that node were the primary Western lever over Chinese fabrication capacity. Any three-year plan embedding constrained Chinese capacity is weaker than it looks, and that assumption hides in compute cost curves and in supplier moats. State capability is now setting variables procurement has treated as fixed.

Why a flat index is the dangerous condition

The mechanism is dispersion, not calm. The spread between the VIX and VIXEQ — index-level implied volatility against the average implied volatility of individual constituents — is unusually wide, which means violent single-stock moves are cancelling each other out at the index level. Risk did not leave the building. It redistributed onto individual names.

Two consequences land inside the operating plan rather than the market commentary. The comparables anchoring a valuation, private marks, RSU values and financing assumptions are drawn from the cohort that absorbed the damage, not from the index that looked composed. And there is no beta cushion left: one miss now moves a single name alone, which promotes guidance discipline from an IR chore to a capital-markets capability.

The historical rhyme deserves to be held loosely. Berkshire returned +3.5% against the S&P 500's +19.5% over the trailing year, echoing 1999's -18.9% against +23.0%. What followed was 2000–2003 at +53.7% against -19.2% for the index. The stock tip is the useless half of that. The useful half is that equity-funded expansion was unavailable for three years to anyone who had not already funded it.

The people checking your numbers now have datasets

In the same week, Hunterbrook used government utility meter data across four regions to argue that a $60 billion fuel-cell company's efficiency, output and lifespan fall short of what it told investors — after the stock rose roughly 1,000% in a year on the promise of powering AI data centres faster than the grid. Canary Data surfaces undisclosed executive departures by diffing corporate leadership webpages. Pelican Way traced a rare-earth flagship asset to a $20,024 bankruptcy sale.

A reasonable skeptic would note that the outlet publishing that research is affiliated with a fund holding disclosed short positions in two of the names, and would be right to say so. The meter records are still the meter records. What has changed is that narrative attacks are now faster, better resourced, and financially motivated to maximise price impact on the day of publication. Most crisis-comms playbooks were written for journalists, not for counterparties with a position. Every quantitative claim about uptime, efficiency, benchmark performance or customer counts is now falsifiable by someone who profits from falsifying it.

Vendor governance is a leading indicator, not gossip

That last row is the one worth internalising. SpaceX fell 36% in July after its post-listing surge, and the retail private fund carrying a fifth of its book in it sets its own marks against a prior worst month of -0.48%. Private valuations are the last number to move, and moving late does not make them true. The tradeoff is a difficult conversation about employee liquidity expectations this quarter against a worse one when someone else's revision arrives next quarter.

What actually failed in the Waymo stop

The autonomy stack worked. The car drove correctly. What failed was a human decision path nobody had written down. An operator watching a live in-cabin video feed judged gel pellets to be a firearm, escalated to police who ran a high-risk traffic stop, remotely immobilised the vehicle, and then told the passengers the stoppage was a mechanical issue to keep them seated until officers arrived. The teenagers were released without arrest. Morning Brew also reports operators checking in over cabin speakers on sleeping riders and calling young-looking passengers to verify their age.

The tempting reading is that this is a robotaxi problem. It is not. The same authority sits inside every company shipping a remotely overridable system: support tooling that can terminate a session, admin consoles that can freeze an account, agent supervisors who can intervene mid-transaction. Almost none have documented who holds it, what triggers it, what gets logged, and what the customer is told. The misrepresentation, not the escalation, is the sentence that gets read aloud in a hearing. Continuous monitoring is defensible when disclosed and indefensible when discovered, which makes disclosed-monitoring terms worth more now than after a regulator or a competitor forces them.

The reliability metric on the dashboard may be buying silence

Running alongside it is a sharp counter-consensus argument: trying to reduce incident count makes the system less reliable, and the correct target is more incidents handled well. The reasoning is that engineers control the numerator. Put incident count in a target or a bonus and the result is not fewer incidents. It is fewer declarations, later detection, and thinner post-incident learning, while the measured line improves. A reasonable skeptic would file this under contrarian talking point. Practitioners flagged it as one of the strongest arguments in the set, and practitioner resonance is how metric norms actually shift.

The tradeoff worth naming is that this is not an engineering fix. It is a metric-design and compensation fix, which puts it on an executive desk rather than the SRE lead's. Customer-impact minutes and time-to-mitigate replace it, with declaration rate reported as a signal-health indicator where up is good.

The postmortem is now an audited artifact

Spotify published a postmortem authored by four named engineers on its worst content-ingestion and podcast-video failure. Separately, The Pragmatic Engineer covered creators quitting Spotify Podcasts over reliability and fact-checked Spotify's published timeline against observable evidence. The outage was an engineering event. The audit of the outage narrative is a governance event, and that is the one that changes executive behaviour.

Transparency is now asymmetric. Publishing well buys durable trust. Publishing an over-favourable timeline manufactures a second incident with a longer tail than the first. Reconciling external comms against telemetry before publication costs almost nothing, and the absence of that gate is a board-level exposure. One caveat on the surrounding discourse: four of seven curated reliability items were vendor-authored, so prescriptive guidance is category positioning until a non-vendor source validates it. Both threads converge regardless. The exposure is the undocumented human decision, not the automation everyone is worried about.