We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Boom's engine program now has a second business: power for AI data centers
On YC's podcast, Blake Scholl described how Boom Supersonic found its first revenue product. Utilities couldn't supply enough power for AI, hyperscalers had started building their own plants, and there was a multi-year backlog for turbines. Scholl texted Sam Altman, a day-one Boom investor, asking whether he'd want a 40 MW gas turbine. Altman answered "as many as you could make as fast as you can make them" . Remove the thrust fan and add a turbine and generator, and the jet engine produces 42 MW. Scholl pitches these as modular "blade servers of energy": about 24 units make a gigawatt, deployable in N+1 arrays .
Scholl said that before this, Boom was keeping engine development going almost "paycheck to paycheck." The turbine plan let it raise "a bunch of money," and he expects turbine revenue next year . His point about hard-tech financing is worth noting. These companies aren't necessarily more capital-intensive over their lifetime. They are more capital-intensive up to the first proof point, because they can't prove product-market fit by shipping .
Separately, Scholl credits AI-built internal tools for Boom's small headcount. In his account, a turbomachinery design tool lets one engineer do in real time what used to take 100 engineers six months, and another tool auto-generates 65% of the aircraft structure. He says a team of 50 built the boomless supersonic airplane and 150 built the full-scale turbine . Late in the period, Scholl said he is arranging a buyout of Scott Galloway's Boom shares after Galloway called for an execution .
After the midterms, data-center politics is reaching credit markets
TechCrunch's Equity hosts noted that almost every ballot measure to speed up data-center construction failed. They described opposition that crosses party lines and is driven by NDAs, secrecy and water use . OpenAI responded with a "compute campus" blueprint that drops NDA requirements . The hosts also said Wall Street has stopped rewarding data-center spending, which adds financial pressure to the political one . One Reddit post says progressive lawmakers want a national moratorium. It also says ING is trying to sell about $500M of data-center loans, including debt tied to a New Mexico Stargate site . Treat both as unverified signals.
This matters because power and permitting now look like the binding constraint, not GPUs. That favors owners of power assets, like Boom's turbine business, over projects that depend on new grid connections.
Capital: faster rounds, harder debt, and arguments over exits
- Compute and debt. The investor guest on Invest Like the Best said portfolio companies routinely need help finding compute. Many large neoclouds won't do deals under $200M . The guest counts 80–90 "neolabs" that have raised $1–5B. One spends a $1B round on a single training run and plans to raise $5B more . In the guest's view, the real constraint is debt, often 5–10x the equity raised, and borrowing costs are rising after the neocloud selloff . Some VCs now fund companies with compute instead of cash .
- Deal dynamics. Firms that miss a primary round now pay 3–5x for secondary shares sold alongside it. The guest also reports 2021-style behavior: offers changed or pulled soon after being made . Fast growers usually come with a catch: thin margins, customer concentration, annualized data sales, or usage-based revenue .
- Where the guest sees opportunity. The best-case benchmark for an outcome has moved from $10B (2016) to $100B (2021) to $1T now. The guest expects maybe two or three more trillion-dollar companies, "not 40 more" . The suggested source of returns is great founders in markets nobody is watching yet. Example: BCI startup Conduit. Its head-worn device reportedly read intended text with 80% accuracy and now has 30,000 hours of training data. Once BCI became popular, its round drew 13 term sheets .
- An acquirer's view. Salesforce's John Somorjai called valuations "way too high." He said 1% or fewer companies go public and the pool of buyers is tiny above $10B, so "there will be a reckoning" . He is skeptical of AI-native CRM startups such as Lightfield and Monaco . His most enthusiastic answers were about robotics, where Salesforce Ventures backs Figure, Physical Intelligence and Zipline .
- Sentiment snapshots. Per Bloomberg, Anthropic IPO buyers now see the valuation as low as $1.1T . Jason Calacanis called this irrelevant until earnings start to drive the price . Dylan Patel asked why Baseten is worth more than Nebius, and Nathan Benaich agreed . A widely shared GP quote said a $15M-revenue company "can't raise" and Series A now requires "10-10-5" growth . Martin Casado pushed back: fundraising outcomes vary a lot, he said, but no legitimate GP decides on ARR or growth alone .
AI speeding up AI R&D, and a policy fight over "RSI"
METR's report on Anthropic, based on internal data including benchmark scores for unreleased models, found AI is speeding up research. METR says AI can't yet make the most important training contributions on its own . A press summary quotes "roughly two years of historical progress over the last year," mostly from AI assistance, with signs that fully autonomous contributions will grow . Anthropic redacted heavily and promises its own analysis against its Responsible Scaling Policy in the coming weeks .
Politically, Rep. Casar posted "Ban RSI" (recursive self-improvement). Casado argued that loose use of the term is what invites such proposals, since many technologies feed on themselves without being RSI .
In a separate safety result, OpenAI reported that Astra completed 10% of hidden rubric items when tasks were framed as safety research, versus 16% when framed as capabilities work. OpenAI says it doesn't know why and found no evidence of strategic intent .
Agents in production
- Vercel (via SaaStr). Its support agent handles 93% of cases. Lead qualification went from 10 people to 1 in six weeks, at under $5K a year in infrastructure and tokens .
- Domu (YC S24). It says its agents collect $186 in buy-now-pay-later debt for every $100 human teams collect. Its customers include four of the five largest US BNPL companies and three top-10 US banks. It recently raised a $15M Series A .
- Quest. Ex-Google founder Vincent Nallatamby, who started Google's Jules and Stitch agents, raised a $6M pre-seed in seven days. Quest is now positioned as an ambient personal agent .
- Aside Computer Use. It launched on Mac and Windows, claiming it is 2.7x faster with 65% fewer tokens than Codex, based on its own internal evals .
Security, robotics, space and models
- a16z on cybersecurity. a16z argues AI made exploits cheap while patching stayed slow. Median full remediation is 43 days, and only 26% of known-exploited vulnerabilities get fully fixed . It lists six startup openings: live fixes, an AI first responder, per-request access checks for people and their agents, proven backup recovery, an install gateway for packages and agent tools, and managed security for organizations without security teams .
- Hugging Face robotics. It reports nearly 100K public robotics datasets (up 48%) and 30K+ robotics models (up 41%). It expects to sell 50K+ of its open-source robots this year. LeRobot has passed 1M downloads .
- Google in orbit. A satellite carrying four TPUs ran Gemma 4 on board and returned an answer to a prompt sent from the ground. Commentators called it a "hello world," with thermal and radiation problems still largely unsolved. The next test is two satellites talking to each other .
-
Model releases.
- Google Research's Muir is a linear-attention design that streams 10M tokens using a 25 MB state. For comparison, a 1.3B Transformer needs 2.1 TB of KV cache at that length .
- Ant Ling released Ling-3.2-flash, a multimodal MoE with 560B total and 25B active parameters and a 1M-token context window .
- Boson AI's Higgs Realtime Duplex is a voice model that listens and talks at the same time. It is closed-weight, and API access is waitlisted .
- Venture’s best-case outcome anchor has shifted from $10B when the investor started in 2016, to $100B around 2021, to $1T now; the investor expects only 2–3 more trillion-dollar companies, not 40. Rounds and follow-ons are moving faster than ever, with investors who miss primary allocations seeking parallel secondary access; offers are also being changed, pulled, or renegotiated, echoing 2021 deal behavior, while the guest says today’s companies show stronger product value, adoption, and faster product-market fit.
- The investor argues early-stage alpha can come from backing strong founders in non-obvious markets before they become consensus opportunities. Conduit illustrates the approach: its head-worn BCI model reportedly understood users’ thoughts before they typed with 80% accuracy; the company later had 30,000 hours of human training data, and after BCI drew wider attention, its round was highly oversubscribed with 13 term sheets.
- AI growth needs financial-quality checks: companies growing 10–20x year over year may still have low or negative margins, concentrated customers, annualized data sales, or consumer/usage revenue rather than contracted enterprise revenue; the investor recommends comparing growth with similar business models and says margins are improving rapidly. The data-provider thesis is split: the investor says model builders’ data needs are increasing, while investors differ on whether data vendors can be durable large businesses or whether data sales mainly finance their own robotics research.
- Compute access and financing are constraints for AI companies: the investor says smaller firms struggle to secure capacity and many large neoclouds are uninterested in deals below $200 million; they see access to debt at viable terms as a potential constraint, noting some compute-heavy labs may need debt exceeding 5–10x the equity they raised. Compute-in-kind financing is emerging and can appeal to founders, but sourcing, pricing, duration, and reuse are complex, while founders generally prefer clean equity.
- Almost all U.S. ballot measures intended to speed data-center construction were rejected; hosts described bipartisan local opposition linked to project secrecy, NDAs, environmental concerns, and water scarcity. OpenAI’s compute-campus blueprint said it would drop NDA requirements and share plans, which hosts viewed as a corporate response to pressure. Hosts also said Wall Street had become less willing to reward hyperscaler spending on data centers, adding a financial constraint to the buildout.
- Canva was reported to be laying off more than 1,200 employees, and the hosts said Canva and Squarespace each cut about 20% of their workforces. They discussed post-pandemic overhiring and competition from general-purpose AI tools as possible pressures; Canva’s revenue growth had slowed for the first time, but the hosts said AI’s role was uncertain.
- The episode reported an all-stock Marvell–Lumentum acquisition valued at $115B and argued that inflated AI valuations and stock-based dealmaking can distort startup funding and acquisition dynamics. CrowdStrike also acquired Fiddler AI for $400M and Dreadnode for $95M as part of an expansion in AI security.
- Serialized microdramas were said to have more than 118M monthly viewers; Elo Story TV raised an $80M Series C from Hornbell Capital and NBC Universal.
- Google’s Project Star Catcher completed an orbital AI inference test: a refrigerator-sized satellite on SpaceX’s Transporter 18 rideshare carried four Google TPUs, and an onboard Gemma 4 model processed an uplinked prompt and returned its answer to Earth. This was an incremental ground-to-orbit test, not evidence that space data centers are imminent; thermal and radiation challenges remain, and the next milestone is testing communication between two satellites. Google’s longer-term vision is a laser-linked satellite constellation handling distributed jobs, unlike approaches focused on individual satellites.
- At Reddit’s earnings discussion, presenters linked traffic pressure to Google AI Overviews: U.S. daily uniques fell 2% year over year, while search referrals declined by more than one million visits per week on average. They see utility and shopping queries as particularly exposed, while cultural commentary may still draw users to Reddit; they also raised the possibility that Reddit shifts from a destination for people toward a source for AI systems.
- The episode reports a Binance hot-wallet theft of about $6.3–$6.4 billion across 10 blockchains; speakers say the suspected attack path involved an engineer downloading malware through a fake job interview, and warn that agent swarms and more convincing deepfakes can intensify social-engineering attacks. Separately, European supermarket freezer attacks exploited end-of-life controllers that often retained default passwords; a later attempt to warm three plasma-storage sites was caught by alarms, and no products were lost.
- Salesforce Ventures says it created a $1B AI fund in early 2023 and invested across model companies (Anthropic, Mistral, Cohere), infrastructure, voice (ElevenLabs), and video (Runway); it is now extending into physical AI, including Figure AI, Physical Intelligence, Zipline, and Japan-based Mugen. The interviewee sees early robotics scaling-law signals and revenue beginning to scale as companies adopt more vertical go-to-market strategies.
- The interviewee warns that current valuations are too high, the buyer pool becomes small above $10B, and only about 1% or fewer companies go public; they expect a reckoning because many highly valued companies will not grow into their valuations.
- On AI-native CRM, the interviewee says Salesforce has not seen a product novel enough to plausibly become a multibillion-dollar company, describes the space as crowded with too many entrants and funding, and argues VCs should favor genuinely new markets over niche differentiation.
- Salesforce says it is moving more products toward outcome-based pricing, such as paying for resolutions rather than seats; its acquired AI support offering was running internally in 14 days, handled over 40% of help-site traffic, and resolved 65% without a human. The interviewee says the AI capability could not be built quickly enough internally; AI talent is hard to hire, and an acquisition can take 6–9 months end to end.
- Salesforce says Slack’s revenue is nearly three times its level at the 2020 acquisition and that it is now the company’s fastest-growing product; the strategic role has expanded to Slack as a conversational interface for apps and AI agents.
- For acquisition readiness, the interviewee cautions that ARR alone can mask customer attrition; weak financial controls, poor customer-contract data, high attrition, and inadequate privacy or security are diligence risks, and security can kill a deal. They recommend red-teaming before diligence; one unnamed penetration test exposed source code, the CEO’s laptop, and employee information, and the problems were deemed unrecoverable.
- After Rolls-Royce publicly ended its engine relationship with Boom, the company began developing its own engine in mid-2022; founder Blake Scholl said optimizing that engine with the aircraft made boomless supersonic cruise possible.
- Boom says the aircraft engine can be converted into a 42-MW power turbine by removing the thrust fan and adding a turbine and electric generator; Scholl described the units as modular data-center power deployable in N+1 arrays.
- Scholl cited AI-related power constraints, hyperscalers building their own power plants, and a multi-year turbine backlog as the market signal. He said that when he asked early Boom investor Sam Altman about a 40-MW net gas turbine, Altman urged Boom to make as many as possible as fast as possible.
- Scholl said Boom went all-in after two more months validating the market and technical plan, raised capital on the turbine strategy, and expected turbine revenue the following year; he described the product as high-margin and capable of helping fund the supersonic aircraft, after the company had been barely sustaining engine development.
- For hard-tech investing, Scholl argued that such companies are not necessarily more capital-intensive over their lifetimes, but need more capital before first revenue to prove product-market fit because they cannot validate demand simply by shipping as software startups can.
Market thesis: a16z argues AI has made vulnerability discovery and exploit development cheap and fast, while remediation remains human-gated: median full remediation was 43 days, and only 26% of known-exploited vulnerabilities were fully remediated in the cited dataset. The opportunity, in its view, is to protect systems that cannot be patched quickly rather than relying on faster patching alone.
Six company-building wedges:
- Live protection plus code repair: generate and deploy a narrow live mitigation, then have agents write and test a permanent fix for the versions actually in production; staged rollout and automatic rollback are part of the product.
- AI SOC and incident response: detect behavior from existing security-product event streams and respond during an incident, combining detection, managed response and incident-response work.
- Per-request identity for people and agents: attribute each request to a human or software principal and use task-scoped, short-lived credentials, with approval for high-impact actions.
- Proven recovery: independently verify backup posture and run isolated restore tests, producing evidence usable by boards, auditors and insurers. The article cites a gap between 90% of leaders saying they could meet recovery targets and only 28% of victims getting all their data back.
- Security at software installation and access: hold, sandbox and verify the provenance of packages, extensions, vendor connections and AI-agent skills or tools.
- A managed long-tail security platform: combine exposure reduction, secure remote access, network segmentation and rehearsed manual fallback for organizations such as utilities, hospitals and supermarket operators without dedicated security teams.
Investment context: The cited 2026 breach data attribute 31% of breaches to exploited bugs and 35% to phishing, stolen credentials or pretexting; third parties were involved in 48%, up from 15% two years earlier. The authors argue that stand-alone security categories risk becoming features; defensibility comes from combining workflows and starting with the hardest technical problem, while dashboards and reports follow once that works.
- NVIDIA announced an Isaac Lab update integrating Newton as it moves from PhysX, DGX Station blueprints for policy training, and the Agile One SN reference platform built with Agile. The platform includes Thor integration, an optimized software and firmware stack, Groot, and Uji hands; the stated aim is to avoid developer setup that can otherwise take weeks or months.
- Physical-AI training is constrained by scarce, costly real-world interaction data: unlike language models, robots need data capturing physical dynamics; teleoperation can be difficult without force feedback, while human egocentric and pose data offer additional training signals. Simulated data is more abundant but not necessarily as high-quality as real data, making real/simulated co-training a challenge.
- NVIDIA’s stated approach combines conventional simulators for physics grounding with neural simulators for diversity; it is starting to use Cosmos for domain randomization and data generation, policy evaluation, and potentially as a backbone for future world-action models. Neural simulation can misrepresent physics, and success in simulation does not guarantee transfer to a real robot, so hybrid simulation and sim-to-real validation remain important.
- Sonic was presented in the interview as a 42-million-parameter, open-weight model for whole-body behaviors across different robot morphologies. The respondent describes it as a data-hungry, lower-level whole-body-control model that can pair with Groot or another VLA for higher-level reasoning.
- The episode rundown lists an OpenAI valuation cut to $1.25T, Google losing $500B in market value in 12 hours, and DoorDash buying Instacart for $17B.
- The rundown lists Kalshi raising $1B; the discussion characterizes it as shifting from a prediction market with social utility toward sports gambling, with its national approach running into state-by-state regulation as Utah sues.
- Harry's notes frame Cognition at $80B as market-correct, citing durable coding-agent demand and momentum after acquiring the Windsurf team and IP; they also describe a fund up 5x on paper considering putting its last $2B into Cognition. Serval is presented as having exceptional enterprise adoption and a likely 10x, while its $150M raise may be too small for funds that need to deploy capital; a 10x is described as harder at Cognition or Baseten at $30B.
- Foundation-model companies may acquire robotics capabilities to extend from the 81M knowledge workers in the US to physical workers, potentially doubling their addressable market.
- Anthropic's reported GAAP revenue rose from roughly $5B in Q1 to $11B in Q2 and $17B in Q3, while quarterly growth slowed from about 100% to about 50% (still 5x year over year); Jason attributes the slowdown to pricing pressure from OpenAI offering somewhat equivalent products at 30% off, despite no decline in OpenRouter demand.
- The AI infrastructure downside is asymmetric in the notes: strong demand would support CoreWeave's bonds, but if demand disappoints, CoreWeave could suffer before Google or Amazon, whose balance sheets are larger.
- DoorDash said AI agents generated only several hundred orders against 3M daily deliveries; the counterargument is that agents could steer users to direct restaurant orders or pickup and avoid platform fees, while Rory argues ordering dinner through an agent is not much easier than using the app.
- Agent memory remains an unsolved, use-case-specific area: developers and startup teams reported no general-purpose solution because decisions about what to store, retrieve, and forget vary across niches and workflows; experimentation is progressing, but the field is not yet solved.
- A startup opportunity may lie in specialized, low-friction memory systems rather than infrastructure alone: one participant said infrastructure options already work for suitable use cases, while deciding what information to write and when remains difficult; their team saw better results after switching from upfront knowledge graphs to incrementally adding useful information. Adoption also requires balancing customization against cost and implementation friction; one participant used a hypothetical $3 million system as an example of a customer rejecting an overly costly solution.
- The discussion suggested agent memory may be accessible to very small teams: a single developer could potentially build a solution competitive with one from a researcher.
- a16z argues AI is widening the exploit-to-patch gap: median full remediation is 43 days, only 26% of known-exploited vulnerabilities in a cited dataset were fully remediated, and an unreleased model reportedly produced a remote, no-login Linux-kernel exploit in under an hour. Its thesis is that defenses must protect systems without waiting for patches.
- The firm identifies six startup openings: live exploit mitigation followed by AI-written permanent fixes; AI first-responder detection and containment; per-request access controls for people and agents; verified backup recovery; an install gateway for packages, extensions, and agent tools; and managed security for long-tail operators without security teams.
- Recovery validation is a specific pain point: a cited survey found 90% of leaders said they could meet recovery targets, but only 28% of victims got all their data back.
- Product caveat: machine-speed fixes can cause self-inflicted downtime, making staged rollout and automatic rollback integral to live-fix products.
Garry Tan amplified a linked post presenting as Anthropic alignment research the claim that 3 million tokens of advice on complex moral dilemmas reduced malicious behavior to 0%, with a 28-fold efficiency gain across model generations; this is a secondhand claim, not a result independently established by Tan’s post.
a16z’s Asaf Ezra and Steph Zhang argue that AI has made exploit development cheap while patching remains slow; the article cites a 43-day median for full remediation and says only 26% of known-exploited vulnerabilities in the cited dataset were fully remediated. They expect winning companies to make patching unnecessary or someone else’s job by combining vulnerability discovery, protection of running systems, and fix verification; they warn that standalone legacy security categories risk becoming features.
Their six proposed cybersecurity company/product wedges are:
- Live mitigation in production, followed by a permanent code fix tailored to deployed versions.
- An AI SOC that detects behavior from existing security-event streams and responds, with human approval for disruptive actions.
- Identity and access controls that judge each request, attribute it to a person or software agent, and issue task-scoped credentials.
- Backup posture management that independently verifies backup resilience and tests real restores.
- Software-supply-chain controls that screen and sandbox packages, extensions, vendor access, and agent tools before use.
- A managed security platform for under-resourced operators, combining exposure removal, secure remote access, network segmentation, and manual fallback.
The recovery opportunity is supported by a confidence gap: 90% of surveyed leaders said they could recover from a cyberattack, but only 28% of victims got all their data back; median recovery cost was $375,000 when backups survived versus $3 million when backups were hit.
- Aside introduced Computer Use, available on Mac and Windows, with background operation across multiple apps on macOS.
- Aside reports 2.7× faster performance and 65% fewer tokens than Codex in internal evaluations. Garry Tan praised the product and highlighted its use of a real Chromium browser, which he said few or almost no sites can block.
Domu (S24) is building an AI workforce for money-related conversations—including collections, servicing, sales, and retention—for banks, insurers, and healthcare companies; the company emphasizes empathy and compliance alongside efficiency in difficult, regulated interactions. In buy now, pay later, Domu says its agents collect $186 for every $100 collected by human operations. It reports working with four of the five largest US BNPL companies and three top-10 US banks, and recently raised a $15 million Series A to expand beyond collections into broader customer relationships.
Paul Graham highlighted a Boom founder’s argument that hardware teams should engineer software systems for designing hardware, and that AI has made this approach more accessible . The founder reports that Boom’s turbomachinery tool lets one engineer do in real time work that previously took 100 engineers six months, and that another tool auto-generates 65% of an aircraft structure; he also cites a boomless supersonic airplane built by 50 and a full-scale supersonic turbine built by 150 . He expects the approach could enable building and certifying a supersonic airliner without many more people, a forward-looking claim rather than a completed result .
Jessica Livingston flagged Boom’s expansion into making gas turbines for data centers, alongside a forthcoming Social Radars episode with Boom founder Blake Scholl. Scholl argues AI is changing hardware engineering by making software development more accessible; he says Boom’s turbomachinery tool lets one engineer do in real time work that previously took 100 engineers six months, while another tool auto-generates 65% of an aircraft structure.
Garry Tan argues that agent skills need eval-driven development loops because improving models can make existing skills unnecessary; he removed his /investigate skill after finding that Opus 5.5 performed better without it.
Hosted GBrain now asks before a teammate’s AI uses an account you connected, aiming to let you access your own credentials without granting others access without permission in a shared company brain.
Boom Supersonic says Rolls-Royce’s exit as engine partner prompted it to build its own engine, which it credits with enabling boomless supersonic flight and opening a gas-turbine business aimed at AI data-center power demand. The company says that turbine business could help fund development of its supersonic airliner.
Paul Graham noted that supersonic engines resemble power turbines because they must operate continuously at full power in demanding high-temperature conditions. The accompanying episode description frames Boom Supersonic’s recent transformation as moving from losing Rolls-Royce as its engine supplier to financing airliner development by selling gas turbines.
Defense in Depth, Rebuilt for Machine Speed

Co-authored with @steph_zhang (opens in new tab)
In our last piece (opens in new tab), we argued that the bottleneck in offensive cyber was the skilled work of turning a bug into a working exploit. In 2025 and 2026, that work became cheap. Patching did not get faster. This piece is about what follows. Our view is that the gap between exploit and patch won’t close by patching harder, and the products and policies that matter over the next five years will be those that protect systems even when they cannot be patched quickly.

In October, two critical bugs in PHP, the language behind much of the web, leaked before their fix. Exploit attempts began four days before public disclosure (opens in new tab). Luckily, hosting and content-delivery companies could block attacks at their edge while the underlying servers remained unpatched. Meanwhile, between 2.6 and 4.4 million PHP installations (opens in new tab) outside that umbrella stayed exposed, most of them on versions that will never get a fix.
That week is the argument in miniature. Protection did not have to wait for the patch. Someone else could stand between the attacker and the vulnerability.
The arithmetic doesn’t close
Patching is a per-vulnerability, human-gated process. Someone must learn about the vulnerability, find the affected systems, test the fix, schedule the patch and confirm everything is in order post patching. Those steps still take weeks. The 2026 Verizon breach report (opens in new tab) put median full remediation at 43 days and found only 26 percent of known-exploited vulnerabilities fully remediated in its dataset. Veracode’s 2025 report (opens in new tab) put average flaw-remediation time at 252 days, up from 171 five years earlier.
Discovery is moving differently. AI systems can search for vulnerabilities by the class and help turn a published fix into a working exploit in hours. In October, Anthropic reported that an unreleased model produced a remote, no-login exploit for a Linux kernel bug (opens in new tab) that had been fixed upstream weeks earlier, while two of the most widely used server distributions still had no fixed package (opens in new tab). Red Hat had rated the bug moderate because its timing race was hard to win. The model won it in under an hour.

Even where patching can speed up, deployment carries its own outage risk. In July 2024, one faulty CrowdStrike update crashed about 8.5 million Windows machines (opens in new tab). And if patches need to be deployed 100s or 1000s of times a day, you just swap attacks for self-inflicted downtime.
So the question isn’t how to patch faster. It’s how to stop needing to.
The things that will never be patched in time
The case is starkest for the machines whose updates are slow by design, and those are the ones where failure is physical.
Industrial control systems. Grid, water and factory controllers get patched in maintenance windows, often annually, after the vendor’s regression testing. Sometimes no fix exists: Dragos found that about a quarter of 2025’s industrial advisories shipped with no patch or mitigation at all (opens in new tab) and that only 2% of industrial vulnerabilities needed action immediately - the rest wait. US grid rules allow 35 days to evaluate a patch and 35 more to apply it (opens in new tab).
Medical devices. Infusion pumps, imaging systems and ECMO machines live for 10 to 20 years, often on unsupported operating systems, and a patch can mean re-certification. FDA cybersecurity rules apply only to new devices. In one 2025 survey, 89% of hospital systems had connected devices with a known-exploited vulnerability (opens in new tab).
Vehicles. Newer fleets take over-the-air updates. Older ones don’t, and software recalls move at the speed of safety regulation.
Everything else with a chip. Building controllers, cameras, routers and refrigerators often have no update channel and no owner who knows they are online. In October, attackers heated the refrigeration in hundreds of French supermarkets in one night (opens in new tab), mostly through end-of-life controllers that no longer get fixes. The national cyber agency’s only advice was to disconnect them. Three weeks later the same attack hit stores in Belgium, Luxembourg, Sweden and Estonia (opens in new tab), and the contractor for one Belgian chain said the fix needs physical changes to every unit (opens in new tab).
For all of these, patching was never really the control. It was the hope. The controls that work are off the device.
What scales, in order of reach
Four approaches can protect equipment that cannot be patched quickly. We rank them by how far down the long tail they reach.

1. Get it off the open internet. The most harmless exploit is the one that can’t reach its target. When researchers at Censys found nearly 400 water-utility control screens exposed online (opens in new tab), including 40 that allowed control without a login, it worked with the EPA and the vendor to reach their owners. Within nine days, a quarter had been secured. By May 2025, fewer than 6% were still exposed (opens in new tab). No patch was involved, and it moved faster than any patch cycle could.
The practical problem is that operators and contractors need remote access. Asking them to unplug the equipment often fails. What works is giving them an affordable way to keep that remote access without public exposure, and reaching them through someone they already answer to: a regulator, the vendor, their internet provider or their insurer.
Who delivers the message matters. In one study of infected consumer devices, a European internet provider’s quarantine-and-notification process cleared 92% of infections within 14 days. (opens in new tab)Email warnings did no better than saying nothing. AI makes finding the exposure nearly free. Informing the owner and getting them to act is the hard part.

2. Segment what has to stay connected. In May, Dragos documented an intruder using a frontier model as its main operator (opens in new tab) who reached the boundary between a Mexican water utility’s office network and its control system, and stopped there. The control network was walled off. Segmentation is old and unglamorous, but it can keep a network intrusion from becoming a physical event. Those boundaries have to be maintained, including the routes used by contractors and remote administrators.
3. Block the attack in the network, at machine speed. The PHP week showed what this looks like when it works: a protective rule written within hours and deployed in front of millions of servers. That model, sometimes called virtual patching, has mostly been a web-traffic product for big platforms. The next step is to generate those rules automatically from each disclosure, using the same AI that writes the exploits, and push them to places that aren’t behind a big platform: industrial protocols, hospital networks and the small business router.
4. Remove the whole class. The most durable fix eliminates the kind of bug rather than the instance. Google reports that memory-safety bugs fell from 76% of Android’s vulnerabilities in 2019 to 24% in 2024 (opens in new tab), mostly by writing new code in memory-safe languages. Formal verification, safer defaults and hardened protocol libraries can reduce other recurring weaknesses. This is slow and reaches the long tail last, but it is the only approach that actually shrinks the number of bugs to find.
Two more investments belong alongside these: safe fallback and replacement. A water plant needs to be able to operate by hand, a hospital needs to be able to work on paper for a week. And some devices are simply too old to protect economically and need to be retired.
Recovery is the control everyone forgets
All four of those defenses reduce risk. None reduces it to zero. For the long tail, what decides whether an attack is a bad week or a lost quarter is whether the backups work. And attackers know it.
Backups are now a primary target. In Sophos’s 2024 survey of ransomware victims (opens in new tab), 94% said attackers had tried to compromise their backups, and 57% of those attempts succeeded. Mandiant’s latest report (opens in new tab) describes leading ransomware groups going after backup infrastructure, identity services and hypervisor management together, and deleting cloud backups outright. CISA’s updated advisory on the Akira group (opens in new tab) lists exploits of backup-server software as a way in.
Confidence has not caught up. In Veeam’s 2026 survey (opens in new tab), 90% of leaders said they could meet their recovery targets, but only 28% of victims got all their data back. In Sophos’s healthcare survey, use of backups to recover encrypted data fell to 51% in 2025 from 72% three years earlier (opens in new tab). And losing your backups is expensive. Victims whose backups were compromised reported (opens in new tab) median recovery costs of about $3 million, against $375,000 where the backups survived.

The lesson is that backups are part of the attack surface, not insurance. They need protected credentials, copies an intruder cannot readily alter, isolation from the access paths attackers take first and regular restoration tests. “We have backups” is not a posture. “We restored the hospital’s records system from last night’s copy in four hours last Tuesday” is.
The umbrella has a shape, and a cost
If the answer is that someone else stands between the attacker and the vulnerable system, then who that someone is matters. Today it is a small number of cloud, content and security companies. The largest content-delivery network alone now sits in front of a quarter of all websites, up from under 4% a decade ago (opens in new tab). That concentration is why the PHP week went well. It is also a single point of failure: the July 2024 outage was one faulty update from one security vendor, and it cost the largest US companies an estimated $5.4 billion, of which insurance was expected to cover only 10 to 20% (opens in new tab). And it raises a sovereignty question that countries and regulators are only starting to ask, as Jason Healey has pointed out (opens in new tab): whose rules apply when a handful of US platforms decide which traffic reaches the world’s servers?

The economics push in one direction anyway. Defending a single asset costs about what it always did, while attacking it keeps getting cheaper. Over time the long tail has two choices: shelter under someone’s platform, or get its exposed infrastructure off the internet. The organizations that do neither, the county water system, the clinic and the small manufacturer, are the ones the data piece showed are already paying.
The policy end: fixing other people’s machines
Some owners will not act because they do not know, cannot afford it or no longer exist. Then the question becomes whether someone else may intervene.
There is precedent. In April 2021, a US court authorized the FBI to remove malicious web shells from hundreds of private Exchange servers (opens in new tab) whose owners hadn’t acted. In a December 2023 operation disclosed the following month, another court order let it remove a Chinese state botnet from hundreds of small-office routers (opens in new tab), most of them beyond vendor support. Both were narrow interventions against specific companies. Pressure for broader intervention will grow: notify, then quarantine, then remediate devices that endanger others. That is a real civil-liberties trade, and it is better argued now than improvised during a crisis.
The opportunities we see
The categories we think win share one property: they make patching unnecessary, or someone else’s job. Each also combines multiple categories into one. Finding a vulnerability, protecting the running system and verifying the fix become more useful when one product carries the work through.
The old categories on their own are at risk of becoming a feature in this new world. The company that takes the merged category, and starts from its hardest part, is the one with a shot at being generational. We see at least 6 opportunities.
1. Fix it live, then fix the code. Pentesting, vulnerability management and application security become one loop. The old rule was that source code is the truth and production follows. Security speed is breaking that rule.
We believe the new generation of solutions will mitigate a vulnerability in the running system within hours: an edge rule that drops the malicious request, an in-process hook that checks the function’s input and refuses the exploit, or a patch applied in memory without a restart, as live kernel patching has done for years.
Keeping up with these live fixes has been impractical: too many patches, too many versions across internal and third-party libraries. The bet is that coding agents can apply version-specific live fixes at machine speed with high confidence in compatibility. The agents then write the fix against the exact library and API versions actually deployed, open the pull request and confirm the two match.
The sales motion follows from the same capability: break the prospect’s current versions in a day, then run the same attacks against the system with live protection and watch them fail.
The same machinery belongs on the vendor side, where it is clearer who pays. A Linux distribution that ships a kernel fix in days rather than weeks gives all its customers a fix sooner. Europe’s Cyber Resilience Act (opens in new tab) adds pressure: since September 2026, covered manufacturers have had to issue an early warning within 24 hours of learning that a vulnerability is being exploited. From December 2027, they will also be responsible for handling vulnerabilities throughout each product’s support period.
The risk is the one from our first piece: a bad fix shipped at machine speed creates self-inflicted downtime, so staged rollout and automatic rollback are part of the product, not an add-on.
How it plugs in. The live fix needs somewhere to run, and most companies already have those places: the content-delivery edge, the API gateway, service mesh, and lightweight agents inside the application process that can hook functions or patch them in memory.
The product reads the advisory, checks deployed versions and writes the narrowest live fix that covers the bug. It tests against live or recorded traffic, uses watch-only mode where possible, and enforces the fix in stages with automatic rollback.
The code fix runs on a second track: AI writes the patch against the versions in production, replays recorded traffic to show nothing breaks, opens the pull request, and retires the live fix once the real fix ships.
The numbers that matter are hours from disclosure to protection, days to the permanent fix, and how often a live fix blocks legitimate traffic. On the vendor side, the same loop backports one fix to every supported version at once.

Where the live fix runs. The edge rule, the in-process hook and the in-memory patch each cover a known bug. A deeper layer covers the technique, including before an advisory exists.
Writing exploits is becoming cheaper, but many still rely on familiar actions on systems the defender can watch, and the techniques exploits rely on are a short list even when the bugs are not. Of the 48,185 vulnerabilities published in 2025 (opens in new tab), 884 were newly exploited (opens in new tab), and CISA’s own review (opens in new tab) found that most of the weakness types behind its exploited list (opens in new tab) are ones the industry has known how to prevent for decades.
The same in-process instrumentation, placed where untrusted input gets parsed or code crosses into the operating system, gives a small model places to judge whether exploitation is occurring, with possible escalation paths to larger models. The product defends against recurring techniques instead of chasing each bug. Every miss in the proof-by-exploit trial becomes training data. The hard parts are speed and false alarms. None of this makes a company unbreakable. It reduces the attack surface the attacker is counting on.

How it plugs in. Most exploits pass through a few choke points: parsers and deserializers that turn untrusted bytes into objects; code that builds database queries and shell commands, runtime operations that manage memory or execute generated code and calls to the operating system to run programs, open files or make memory executable.
Hooks at those points can catch the moment a bug turns into control, such as a web server suddenly starting a shell. A small model in the path decides within the request whether to allow, block or escalate.
A larger model or an analyst reviews escalations in seconds and can push a new rule out to the edge, feeding into the protection above. Interventions range from dropping a request to killing a process or isolating a machine.

2. Detect without rules, respond first. The AI SOC, incident response and managed detection become one service.
Detection today runs on rules that people write and maintain, and every rule fails in one of two ways. Too specific, and it misses the next variant. Too broad, and it adds to an alert queue already longer than any team can read, which is how a real alert gets ignored with the rest. In Vectra’s 2026 survey (opens in new tab), security teams saw about 3,000 alerts a day and never got to 63% of them. In a second survey (opens in new tab), 40% had switched off a detection rule, or considered it, because they couldn’t keep up with what it produced, and 60% had seen an alert nobody investigated turn into a real incident.
Another gating factor is that a good share of the evidence never reaches the SIEM at all. Ingestion and storage costs pressure teams to drop what they believe is noise. The version we think wins reads events straight off the security products already in place, develops detections, and acts while the incident is unfolding.
That makes it the first responder, taking on work that analysts do and managed-detection and incident-response services sell today. An intruder who got in at machine speed moves at machine speed, so the response has to as well.
How it plugs in. The product sits on the event streams the organization already pays for, endpoint, identity, email, network and cloud, and reads at the source rather than after they land in a SIEM. A model watches for behavior rather than signatures, including process chains, login patterns and data movement that don’t fit a host’s history, and proposes a detection it can explain. Confirmed detections ship as rules the model also retires when they go quiet.
Response runs through the same products’ own controls: isolate the endpoint, end the session, block the sender, snapshot the host for forensics, with a human approving anything that would take a production system down.
Buyers should measure time from the first malicious event to containment, the share of incidents contained or alerts addressed with no human in the loop, and false isolations per month.

3. Judge every request, not every login. Identity, endpoint security and network access become one decision. The old model assumed a user and a machine were the same thing: log in once and the session is trusted. Agents broke that.
A developer’s laptop now carries a person, a coding agent with its own keys and a browser agent with its own sessions, and all three send requests from the same machine in the same minute. Trust has to be judged per request, by who or what produced it, and that judgment has to happen on the endpoint, because by the time traffic reaches the network the distinction is gone.
Access becomes just in time: granted for one task from context, withdrawn when the task ends, and invisible when it works. None of this has to be disruptive. The friction today comes from standing privileges someone has to review, take those away and most decisions happen in the background.
How it plugs in. An agent on the endpoint attributes each outbound request to a process and a principal, human or software, and signs it. A broker issues credentials scoped to one task and one resource, with lifetimes measured in minutes, and the network layer refuses anything unsigned or out of scope. Actions that move money, delete data or grant access get human approval, and everything an agent does is logged against the person who launched it.
Buyers should measure standing credentials with production access, activity attributable to a principal, and time to revoke a session once it is flagged.
4. Prove recovery. Backup, disaster recovery and cyber insurance become one product. Backup storage belongs to established vendors, but proof does not. The missing piece is backup posture management - continuous, independent verification that backups exist, resist alteration, sit outside the identity systems attackers take first and actually restore, with evidence an auditor or an insurer will accept.
When prevention fails, this decides whether the outage lasts days or months.
How it plugs in. The backup copies live outside the identity system attackers take over first: separate accounts with no shared administrators, write-once storage with enforced retention, and deletion that needs two people. On a schedule, the product restores real systems into an isolated clean room, boots them, checks the data, scans for implants and times every step.
That record is the product: the last good restore, the hours to bring back each critical system and the share of data recovered, in a form a board, auditor or insurer will accept.
The survey data show why this matters. In Sophos’s study, 46% of victims (opens in new tab) whose backups survived were fully back within a week, against 26% of those whose backups were compromised. Those with intact backups were also about half as likely to pay a ransom. Veeam reported full recovery at 40% (opens in new tab) among organizations that raised resilience budgets, which were more likely to buy immutable storage and automated backup, against 16% for the rest.
The recovery record is also the underwriting input. Correlated losses, where one shared bug hits thousands of victims at once, are difficult to model and price and exactly what insurers exclude today. The firms that can model that risk and connect coverage requirements to tested controls will shape the market alongside the products themselves.

5. One control at the point of install. Software supply chain, CI/CD security and the developer endpoint become one control. Some of October’s biggest losses didn’t begin with a missing patch. Binance now puts its theft at $6.3 billion, (opens in new tab) with its initial investigation describing one engineer’s compromised laptop. Atampered package also reached up to 5,000 developers through a code editor’s extension marketplace (opens in new tab), attempting to install a backdoor.
Package registries and marketplaces, developer machines and agents credentials are now another part of the attack surface.
The model is the one email security settled on twenty years ago: hold incoming material at a gateway, open it in a sandbox, check for who really sent it, and then release or quarantine it before a person ever sees it. Today the inputs come through package managers, extension marketplaces, browsers, vendor connections and, increasingly, the skills, tools and documents or webpages that AI agents fetch on their own. For an agent a document is also an instruction.
The product is the same three checks - hold, detonate, verify provenance, applied under one policy to every channel.
In Verizon’s latest report (opens in new tab), exploited bugs were the top single initial-access vector at 31%, but phishing, stolen credentials and pretexting together accounted for 35%. A third party was involved in 48% of breaches, up from 15% two years earlier. Sonatype counted more than 454,600 new malicious open-source packages in 2025 (opens in new tab) alone.

How it plugs in. Each path needs a control where installation or access is granted. Developer machines get allow-listed extensions and packages, device checks before they reach production, and no long-lived production credentials sitting on a laptop.
Package registries and internal mirrors hold new versions briefly, run installs in a sandbox to watch what they do, and check signed provenance. Vendor access is scoped, expiring and reviewed. Agent skills and tool connectors get held and tested like a package (what the agent may then do with them is category 3’s job).
The numbers to watch are time spent in screening, the share of installations tested in a sandbox, the share of agent skills and connectors that passed the hold before first use, and the number of laptops holding long-lived production credentials.

6. The long-tail platform. Exposure management, secure remote access, control-network segmentation and manual fallback become one product for the organizations that will never run a security team: the water utility, a hospital’s biomedical department or a supermarket chain’s refrigeration contractor.
Exposure removal only works as a product if it sells the alternative: a cheap way to keep remote access without sitting on the open internet, and a channel to the owner through someone they already answer to - the vendor, the internet provider or the insurer.
The same service walls off the control network, keeps the manual fallback rehearsed and holds the inventory a regulator or insurer can check. Managed platforms already give small businesses services they could not run themselves. This is the same model for the machines that can’t move to the cloud.
Alongside these products, migrating to memory-safe code is newly practical because AI can do much of the translation. It reaches the long tail last, but it is the only approach that shrinks the number of bugs there are to find.
Each of these starts from a hard problem: a safe patch against the versions actually deployed, detection without manual rule-writing, a principal behind every request or a restore that is proven rather than assumed. That is the place to start. The dashboard and the reports are the easy parts and follow once the hard part works, and the hard part is what makes the combined category defensible.
The bet
The last piece ended with a wager: that 2026 looks less like the start of a cyber war than the start of a long, expensive worm era. The last worm era ended when one company took ownership of the problem and fixed it. Nobody owns this one.
For many systems, the window between exploit and patch will stay open. The work is to make that matter less: fewer things exposed, fewer operations that depend on an immediate patch, and backups that actually bring systems back.
Special thanks for their contributions to this piece to @zanelackey (opens in new tab), @YODELAGARZA (opens in new tab), @OwenColby (opens in new tab)
Full article in the a16z newsletter: https://www.a16z.news/p/defense-in-depth-rebuilt-for-machine (opens in new tab)
Market thesis: a16z argues AI has made vulnerability discovery and exploit development cheap and fast, while remediation remains human-gated: median full remediation was 43 days, and only 26% of known-exploited vulnerabilities were fully remediated in the cited dataset. The opportunity, in its view, is to protect systems that cannot be patched quickly rather than relying on faster patching alone.
Six company-building wedges:
- Live protection plus code repair: generate and deploy a narrow live mitigation, then have agents write and test a permanent fix for the versions actually in production; staged rollout and automatic rollback are part of the product.
- AI SOC and incident response: detect behavior from existing security-product event streams and respond during an incident, combining detection, managed response and incident-response work.
- Per-request identity for people and agents: attribute each request to a human or software principal and use task-scoped, short-lived credentials, with approval for high-impact actions.
- Proven recovery: independently verify backup posture and run isolated restore tests, producing evidence usable by boards, auditors and insurers. The article cites a gap between 90% of leaders saying they could meet recovery targets and only 28% of victims getting all their data back.
- Security at software installation and access: hold, sandbox and verify the provenance of packages, extensions, vendor connections and AI-agent skills or tools.
- A managed long-tail security platform: combine exposure reduction, secure remote access, network segmentation and rehearsed manual fallback for organizations such as utilities, hospitals and supermarket operators without dedicated security teams.
Investment context: The cited 2026 breach data attribute 31% of breaches to exploited bugs and 35% to phishing, stolen credentials or pretexting; third parties were involved in 48%, up from 15% two years earlier. The authors argue that stand-alone security categories risk becoming features; defensibility comes from combining workflows and starting with the hardest technical problem, while dashboards and reports follow once that works.
- a16z argues AI is widening the exploit-to-patch gap: median full remediation is 43 days, only 26% of known-exploited vulnerabilities in a cited dataset were fully remediated, and an unreleased model reportedly produced a remote, no-login Linux-kernel exploit in under an hour. Its thesis is that defenses must protect systems without waiting for patches.
- The firm identifies six startup openings: live exploit mitigation followed by AI-written permanent fixes; AI first-responder detection and containment; per-request access controls for people and agents; verified backup recovery; an install gateway for packages, extensions, and agent tools; and managed security for long-tail operators without security teams.
- Recovery validation is a specific pain point: a cited survey found 90% of leaders said they could meet recovery targets, but only 28% of victims got all their data back.
- Product caveat: machine-speed fixes can cause self-inflicted downtime, making staged rollout and automatic rollback integral to live-fix products.
a16z’s Asaf Ezra and Steph Zhang argue that AI has made exploit development cheap while patching remains slow; the article cites a 43-day median for full remediation and says only 26% of known-exploited vulnerabilities in the cited dataset were fully remediated. They expect winning companies to make patching unnecessary or someone else’s job by combining vulnerability discovery, protection of running systems, and fix verification; they warn that standalone legacy security categories risk becoming features.
Their six proposed cybersecurity company/product wedges are:
- Live mitigation in production, followed by a permanent code fix tailored to deployed versions.
- An AI SOC that detects behavior from existing security-event streams and responds, with human approval for disruptive actions.
- Identity and access controls that judge each request, attribute it to a person or software agent, and issue task-scoped credentials.
- Backup posture management that independently verifies backup resilience and tests real restores.
- Software-supply-chain controls that screen and sandbox packages, extensions, vendor access, and agent tools before use.
- A managed security platform for under-resourced operators, combining exposure removal, secure remote access, network segmentation, and manual fallback.
The recovery opportunity is supported by a confidence gap: 90% of surveyed leaders said they could recover from a cyberattack, but only 28% of victims got all their data back; median recovery cost was $375,000 when backups survived versus $3 million when backups were hit.