Some weeks ago, I published a map of six places where I believe durable cybersecurity companies can still be built. Every week, I see AI-assisted coding speed up software development. What used to take months and a team of five now takes one CTO and a weekend. Systems of Record have lost their value. Software companies' valuations dropped to an average of 5x annual revenue.

Building a database with dashboards is now a weekend job. Most software ideas are no longer real businesses. If your only edge is 'we use AI,' you have a feature, not a moat. Being 'sovereign' does not set you apart either. It probably means creating an identity and building trust with your customers, not product differentiation.

So for Cyber Builders, the big question remains: “What to build now in 2026?”

Today, I am diving into the first three topics I mentioned last time.

• Hardware and embodied products.

• Deep tech and cryptography.

• Network effects and practitioner communities.

I believe in human ingenuity and our drive to build new technologies. Electricity changed every industry in the 19th and 20th centuries. Computing and AI will do the same in the 21st. Let’s build the right things.

Hardware: AI Generates Code. It Doesn't Generate Atoms Yet.

I recently read an article about hardware sensors and why they could be the next big thing in AI. It reminded me of my own hardware background and why, even in 2026, this space still matters.

Physical products occupy space. They get installed, certified, and integrated into real environments. Once a hardware security appliance is deployed in a data center or a secure enclave chip is embedded in an industrial controller, replacing it requires procurement approval, physical access, testing, and sometimes regulatory re-certification.

Hardware startups can be intimidating. I have met founders who are afraid of it and even reject “thinking about it”. Many VCs, caught up in the SaaS boom, saw hardware as old-school.

But if you look at it rationally, here is what it takes:

• Engineering means prototyping, picking components, laying out PCBs, handling heat, building enclosures, and testing for reliability. You need to understand the underlying physics and design a supply chain.

• Manufacturing does not mean building a factory or hiring a big team. Hardware OEMs can make your devices. Every city has hardware experts who can help. Arduino and Raspberry Pi communities are still going strong.

• Embedded software used to be hard. Booting a full operating system was a big challenge. Now, it is much easier than it was in the 1990s or 2000s.

• Still, software engineering for hardware involves considering the lifecycle, documentation, maintenance, releases, and support. You cannot just push a fix to AWS and expect everyone to get it. You have to plan, test, and support updates for years. This is one of the hardest parts, and founders need to learn it or hire someone who has done it before.

• Certification matters for hardware startups because it helps demonstrate that a product meets essential safety, quality, and regulatory requirements before it reaches customers. It can build trust with buyers, reduce barriers to market entry, and prevent costly delays caused by compliance issues later in the development process. For startups bringing physical products to market, certification is often a critical step in turning a promising prototype into a credible, commercially viable hardware solution.

Common Criteria (CC) certification is hard to achieve but can provide a competitive edge in some highly regulated markets. For example, Utimaco's CryptoServer hardware achieved CC certification at EAL4+ under Protection Profile EN 419 221-5. Entrust's nShield HSMs earned CC certification from Italy's OCSI, qualifying them as Signature Creation Devices under European eIDAS regulation. These certifications took a large effort and a several hundreds thousand euros of budget.

Innovation can also be found in the hardware space, particularly in machine identity nowadays. A Hardware Unique Key (HUK) is a secret, device-specific cryptographic root key burned or generated inside a chip, forming the basis for security, key derivation, and device authentication. It is unique to each piece of hardware, inaccessible to software, and permanent for the life of the device.

PUFs, or Physically Unclonable Functions, are also worth looking at. They let you create a hardware-bound identity for each device. Provisioning has always been tough in security design. With PUFs, you use the randomness and uniqueness of each device—the way it was made, the small differences between them—as an unclonable function, like a serial number for each unit.

Remember, scaling hardware takes capital and a long-term view. It is not a quick three-year play. But hardware gives you real defensibility. Once your product is deployed, integrated, certified, and trusted, it is much harder to replace than software. The barriers are technical and operational: manufacturing, supply chains, distribution, compliance, customer integration, and field reliability all add to your moat.

This is especially true for security hardware. Trust is not built overnight, and customers are unlikely to replace critical infrastructure once it has proven reliable.

To read further, check out that super interesting article:

Hard Futures

Machine perception: sensing as AI’s next frontier

TL;DR The gap: machine perception is lacking modalities such as smell, electric and magnetic fields, infrared imaging, force or polarisattion that are omni-present in nature we could train AI on…

Read more

2 months ago · 2 likes · Alexander Lange

Deep Tech and Cryptography: “Almost Correct” Is Catastrophic

Let me start with a story about a very small number.

The PlayStation 3 used the ECDSA signature algorithm to protect its game authentication system. The implementation had a flaw: the random nonce k was not truly random—it was the same value across multiple signatures. From the outside, the cryptographic output looked correct. The signatures verified. The system appeared secure.

But from two signatures sharing the same k, you can mathematically derive the private key. An attacker who collected two PS3 signatures could extract Sony’s master signing key. The entire protection system collapsed from a single deterministic implementation error.

Nobody could tell from the outside. Until they could.

This is why cryptography has a moat that AI cannot reach. AI can generate cryptographic code; it can even generate formal verification of software (see Leanstral: Open-Source foundation for trustworthy vibe-coding). Still, designing trustworthy cryptographic systems is hard. Most will fail, and only a few will earn the trust of users and markets.

You might say crypto is in a down cycle. I know. Crypto has been tied to speculation, meme coins, and what Chris Dixon calls casino culture. It is also linked to crypto anarchy, using math and cryptography to avoid government oversight. Both are less popular now. Still, I believe cryptography can help build new solutions with strong privacy and user data ownership.

Here are some examples:

• Fully Homomorphic Encryption (FHE) enables computations on encrypted data without decryption, facilitating secure collaboration on sensitive datasets like cross-bank fraud detection, healthcare research, and intelligence sharing. Hardware advances are making FHE more commercially viable despite slow performance.

• Zero-Knowledge Proofs (ZK) allow organizations to prove the truth of a statement without revealing underlying data, such as identity or compliance information. zkVMs are simplifying cryptographic complexity, creating infrastructure akin to a “Stripe for ZK" that converts primitives into APIs and workflows.

• Confidential Computing involves hardware-isolated environments such as Intel's, AMD's, and ARM’s trusted execution environments. Remote attestation verifies workload integrity without trusting operators. Cloud providers offer these primitives, but enterprises need orchestration, policy, identity, and compliance tools to create an infrastructure moat through deep integration with enterprise trust systems.

• Proof of Humanhood turns identity into security infrastructure as AI-generated content becomes widespread. Traditional verification methods are becoming less effective. The opportunity is to develop a trust layer using cryptographic credentials, hardware signals, and biometrics to verify human origin.

I have already had several conversations about the cryptography space: it is very difficult to monetize. To some extent, cryptography is mathematics, and you don’t get rich with maths!

You need to identify use cases that were previously impossible but are now achievable through new crypto-based methods. Zero Knowledge is a prime example. Being able to provide proof without revealing the underlying data—whether for privacy or business reasons—is a powerful capability.

If you look back, you’ll see some examples. For example, VPNs were built using strong public-key cryptography schemes (ISAKMP/IKE and then IPSEC with symmetric crypto)… the tech value is the confidentiality and integrity of packets. But the true value lies in connecting two local networks or a fleet of laptops over public, insecure “Internet” networks. That’s a much more interesting use case!

Networks: The Community Moat Nobody Has Built Yet

Here is a paradox that should make every cybersecurity investor uneasy.

Security is one of the most community-driven industries in the world. Practitioners constantly share threat intelligence, detection rules, tooltips, and hard-won experience through informal channels. Conference hallways at GreyHack, CCC, or DEF CON are where the real knowledge transfers happen. Twitter or Discord has rich communities.

Still, there are no large companies exploiting a network effect in cybersecurity.

A network effect is an economic phenomenon where a product or service becomes more valuable as more people use it. When a network grows, each new user adds value to every existing member, creating a self-sustaining loop of growth and strong market dominance. Classic examples are social networks: unless you start following people and engaging with their content, they are useless. Who would like to be alone on Twitter or Substack?

Still, I think this is a moat that AI could not replicate on its own. Adoption is a long-term play; joining a network requires building human trust with its leaders.

That's what makes network effects interesting right now: as AI floods the Internet with synthetic content, threat reports, and noise, the value of authentic, practitioner-verified networks is increasing — not decreasing. In a world where anyone can generate a convincing threat analysis in 30 seconds, the practitioner who has actually seen the attack, tested the detection, and published the finding under their real name becomes scarcer and more valuable.

Let’s take an example in the Threat Intelligence space. It shows why network effects in cybersecurity are real but fragile.

• Recorded Future built a data-centric network effect: more telemetry from customers improves its models, which should make alerts better for everyone. But even that kind of scale is not enough if the product becomes too dense or too expensive for most teams.

• Intel 471 takes the opposite approach. Its defensibility comes from human-curated intelligence, underground relationships, and analyst judgment. That is a different kind of network effect: not more data, but better access to people and communities that machines cannot easily replicate.

• The C2 ISAC is another signal. AT&T, Verizon, T-Mobile, Comcast, and Charter created a private intelligence-sharing group after the Salt Typhoon incident, bypassing the existing government-affiliated structure. The lesson is clear: security practitioners will share valuable intelligence only when the network feels trusted, private, and low-friction.

That is the opportunity. The winning threat intelligence network may not be another feed aggregator. It may be a trusted enclave where verified practitioners share intelligence, build reputation, and prove the value of their contributions through real-world outcomes.

Conclusion

AI will make software cheaper, faster, and easier to build. That does not mean durable companies disappear. It means founders need to look for moats in places AI cannot instantly replicate: atoms, trust, cryptographic assurance, and real practitioner networks.

Hardware is hard because the physical world is hard. Cryptography is hard because being almost right is not enough. Network effects are hard because trust cannot be generated by a model. That is exactly why these spaces are interesting.

I would love to hear your thoughts. Where do you see durable cybersecurity companies being built in 2026? Do you agree that hardware, cryptography, and practitioner networks are strong opportunities, or do you think I am missing something?

Reply in the comments. I read every one.

Next week, I’ll publish Part 2 and cover the remaining three areas from the original map.

Laurent 💚

Last month I wrote about the buy-versus-build question.

Building security tools is cheaper than ever. With AI coding agents, open APIs, and cloud-native platforms, a single skilled engineer can do the work of an entire team. The gap between buying and building has nearly vanished.

But that advantage goes both ways.

If it’s cheaper to build, it’s also easier to copy. The moat you built with code, APIs, or a polished product gets smaller every month.

So the real question isn’t “what can we build?”

AI will help you build almost anything.

The real question is what you can build that stays hard to copy, even when everyone has the same AI.

I’ve mapped out six categories where defensibility still matters. I’ll dive into each one over the next few weeks. Before I do, I want your feedback on the list.

Here’s the map.

1. Hardware and embodied products

AI generates code in seconds. It doesn’t generate atoms!

A physical product takes up space. It gets installed, worn, certified, and integrated into real environments. Once it’s in a data center, hospital, or factory, replacing it means procurement, deployment, testing, and sometimes regulatory approval. No prompt will change that.

I used to sell hardware as CTO of a network security appliance company. The SaaS crowd thought it was boring. Someone once called me a sheet metal seller. But hardware sticks once customers have it. They see it, touch it, and get used to it, even if most of their time is in the admin UI.

In cybersecurity, this means hardware security modules, secure edge devices, trusted execution environments, and embedded security chips. The moat is not just the design. It is the manufacturing relationships, certification history, field reliability, and trust built through real deployments.

Hardware moats come from real-world iteration. They are hard to fake.

2. Network effects and attention

You can copy a product’s features. You can’t copy its community.

A network gets more valuable as more people join, and harder to leave. In cybersecurity, think trusted threat intelligence sharing, practitioner communities, security marketplaces, or the reputation infrastructure vendors rely on.

I am one of the early investors at Crowdsec. The company sells a high-value signal: which IP is malicious. Their secret sauce is remarkable: they have built a network of hundreds of thousands of participants, who share who tried to “connect” (and failed) in the last hours. Using that network, Crowdsec detects malicious activities 7 to 60 days before any other Threat Intelligence company.

Network effects are great, but there is also a more subtle moat: attention. If practitioners spend their time on one platform, they are not spending it anywhere else. Here is the counterintuitive part. As AI makes content abundant and synthetic, real networks become harder to find. When anyone can generate a threat report in seconds, the trusted people who verify and curate become more valuable, not less.

3. Deep tech and cryptography

Cryptography is almost uniquely resistant to AI commoditization.

“Almost correct” is catastrophic. A small implementation flaw in a zero-knowledge proof, a mistake in a post-quantum scheme, an error in a secure computation protocol — these don’t produce a slightly worse product. They break the security model entirely.

That penalty creates a real barrier. You need mathematical depth, implementation expertise, formal verification, and external audits. AI can explain the theory and generate code. But it cannot guarantee correctness, which is the only thing that matters.

As AI agents spread, demand for cryptographic tools will grow: proof-of-humanhood, verifiable credentials, post-quantum infrastructure, privacy-preserving analytics. Companies that can build these reliably will have one of the strongest technical moats in technology.

4. AI agent platforms and systems of intelligence

The hardest thing to build isn’t an agent. It’s a trustworthy one. A set of agents that drive decisions, not just store information or prioritize it.

Connecting an LLM to tools is easy. Building a platform that works reliably in a complex enterprise environment with governance, auditability, domain expertise, compliance, and deep integration is not.

In cybersecurity, this means agents that scale threat investigation, automate remediation with clear constraints, drive detection engineering, or run incident response playbooks.

The moat is not the model. It is the context. It is the structured knowledge, curated workflows, governance layer, and institutional memory built from real deployments.

Anyone can demo an agent. Few can deploy one that works safely at 3 am without human supervision.

5. AI-enabled services

Some industries have been service-heavy because the work required expert judgment.

AI changes the economics. Tasks that used to take days of junior effort can now be done in hours, with experts supervising, validating, and handling the parts that need judgment.

This creates a new kind of company. It is not pure software and not traditional services. It is AI-native expert service delivery.

In cybersecurity, this means MDR built from scratch, AI-powered red teaming, and compliance operations at much larger scale. The moat is the mix of automation and accountability. The buyer does not care if a human, an agent, or a hybrid team did the work. They want the job done, with someone responsible for the result.

6. Frontier security

Every major technology shift creates a new security frontier.

Cloud created cloud security. SaaS created SSPM. Kubernetes created container security. AI is creating AI security, but that is not the only new frontier.

Autonomous agents, synthetic identity, post-quantum infrastructure, machine-to-machine commerce, digital biology, cyber-physical systems: each of these creates new threat models that don’t yet have answers.

The companies that get there first do not just build the product. They define the category. They write the language. The early threat model they publish becomes the industry reference point. That is a moat that is almost impossible to remove.

The common thread

Across all six, AI makes features into commodities. It does not commoditize trust, physical reality, networks, deep expertise, regulatory credibility, or operational execution.

The most defensible businesses in 2026 will own something AI cannot instantly copy, even when every competitor has the same models.

In the coming weeks, I will go in depth on each of these. This is not a VC thesis. It is the builder’s view: what to build, where the technical substance is, and what the moat looks like from the inside.

If you are building in one of these areas, or not at all 😉, or think I am wrong about what belongs on the list, I would like to hear from you.

Laurent 💚

I don’t usually react to news, but this one needs a Cyber Builders post.

On July 7, the European Commission published its Action Plan on Cybersecurity and Artificial Intelligence. For once, Brussels moved fast. Mythos stormed the public conversation a few months ago, and here is an official EU response with named actions and dates.

I read all 15 pages so you don’t have to. Here’s what the plan says, where I agree, and where Europe needs to push further. I’m tracking Europe 2031 and Opération Promethée, but if the reaction stays limited, nothing changes.

One reminder before we start: your security program cannot wait for any of this. I already gave you the list of what your company should be doing this quarter — read the Mythos-ready program here.

Let’s get started.

What the plan actually says

The Action Plan is built on three pillars, plus an international cooperation track.

Pillar 1 — Making frontier AI safe, accessible and deployable for European cybersecurity. This is the heart of the plan. Three key actions:

• An EU evaluation capacity for AI models, with cybersecurity mandatory in scope, to be established in 2027. Independent, third-party, pre-release evaluation of frontier models — done in Europe, feeding the AI Office’s enforcement work under the AI Act (which kicks in fully on August 2, 2026).

• A European Blueprint for structured access to advanced AI cyber capabilities (Q4 2026). In plain words: a framework defining how frontier AI providers grant access to European CERTs, critical infrastructure operators, cyber vendors, and researchers — including contingency measures if a provider or a foreign government withdraws access.

• A secure testing platform run by ENISA and the JRC (Q4 2026), so critical infrastructure operators can test frontier AI on realistic cyber use cases — vulnerability scanning, remediation, incident response — without exposing real systems.

Pillar 2 — Prepare the EU’s cyber ecosystem for AI. Focus on fundamentals. Implement NIS2 and DORA now. Speed up patching. Upgrade vulnerability management and the EU Vulnerability Database for AI-level discovery. The plan includes a Critical Open Source Resilience Campaign (Q4 2026) to connect sponsors with maintainers, supported by ENISA’s catalog of AI-powered patching. 98% of codebases use open source, and critical infrastructure averages 80% high-risk vulnerabilities.

Pillar 3 — Scale European AI for cyber. The EU Grand Challenge on AI-assisted remediation (Q4 2026) is smart: discovery moves faster than remediation, which helps attackers. Access to AI Factories’ compute, training modules from the Cybersecurity Skills Academy. The plan admits building sovereign frontier AI needs hundreds of billions, not just public funds.

That’s the plan. Now let’s see what we can do.

Subscribe now

Willingness is not capacity.

This plan is good news. The Commission, ENISA, and governments are moving faster than ever. Mythos hit in spring; a plan with actions and deadlines landed in July. That speed is new and positive.

The diagnosis is lucid too. The Commission writes, in an official communication, that frontier capabilities are “mainly developed outside of the EU” and that “their availability is often determined by non-transparent, foreign-led processes.” It even plans for the scenario where access to a frontier model is switched off by a provider or a third-country authority.

Remember what I wrote on LinkedIn when Anthropic complied with the US government halt within 48 hours: when you rent instead of own, the landlord changes the terms. Brussels has now put that exact risk into policy language. Good.

Willingness isn’t enough. Institutions move fast on paper. Now they need to move fast on capital and mobilize the hundreds of billions needed. Do it now, not after more consultations.

Here is where I want Europe to go further.

Stop asking for access. Start building leverage.

The Blueprint in Pillar 1 is a framework for asking. It details how foreign providers grant access to European organizations and what happens if they withdraw it.

That’s cautious, but it’s still a tenant negotiating with a landlord.

Europe’s cybersecurity strategy cannot be limited to regulating technologies developed elsewhere. Regulation is necessary. But regulation without technological leadership creates dependency, not sovereignty.

The international landscape has fundamentally changed. Technology is no longer exchanged through purely cooperative partnerships — it has become an instrument of geopolitical power. Access to AI models, semiconductors, cloud infrastructure and critical cyber capabilities increasingly reflects negotiations between competing blocs, not open collaboration.

Don’t ask for access to foreign capabilities. Build capabilities that create balanced partnerships.

Europe has real leverage: a huge tech market, top research, strong engineering, deep industry, and low-carbon energy. That’s negotiating power. Use it.

Future partnerships must be reciprocal. If global tech providers want access to Europe, they should help strengthen European capabilities: tech transfer, research, investment, manufacturing, talent, centers of excellence. Partnerships should build European strength, not dependency.

Evaluation before regulation

Independent, pre-release evaluation comes first. That’s exactly right and deserves more focus.

Strategic autonomy begins with understanding.

Any technology capable of finding thousands of exploitable flaws in the systems we all depend on should not be governed solely by its creators' internal judgment. Bruce Schneier made that argument after Mythos, and he was right. Today, almost all serious third-party evaluation capacity sits outside the EU. If evaluation is how democracies get visibility into frontier risk, Europe currently has no eyes of its own.

Don’t stop at frontier models. Europe should benchmark AI, cyber products, cloud platforms, and hardware against European use cases — measuring security, resilience, transparency, performance, and suitability. Without this, Europe can’t make informed choices or guide investment.

One institute in Europe is moving faster than any other. It’s the AI Security Institute in the UK. Yes, after Brexit, the UK is not within the scope of the EU Commission. But I feel they are showing the way and demonstrating why the evaluation of frontier AI capacities is material.

Evaluation is strategic, not just compliance. It tells you what to buy, build, or avoid. Europe has top offensive security talent — we can lead here. 2027 is late, but the direction is right.

Build European technology champions.

Policy alone won’t deliver cybersecurity leadership. Europe needs more startups that can become global leaders, and an ecosystem that helps them succeed.

Large European enterprises must step up: be design partners, early customers, and deployment environments for innovation. No more pilots that die in procurement. Real contracts, real deployments, real feedback.

Public procurement, venture capital, and industrial programs must align to accelerate companies that can compete globally, not subsidize fragmented national champions.

I’m more optimistic than the plan. Europe is behind at frontier scale, but cybersecurity needs specialized models: fine-tuned, smaller, cheaper models for detection, triage, log analysis, malware reverse engineering, patching, identity checks. Models you can run on sovereign compute, on-prem, or air-gapped for defense.

The plan gives us the ingredients: AI Factories focused on cyber, access to sensitive datasets, a Grand Challenge on AI-assisted remediation, strong open source models. Specializing open models for cyber is a race Europe can win on talent and data, not raw compute. Cyber builders should bet here. I am.

Invest at frontier scale: sell intelligence, not electrons

Incremental investments aren’t enough. The plan commits €200M for AI-cyber R&D and €100M for defense tech startups. It says frontier AI needs hundreds of billions, but offers millions and a consultation. That gap is the story.

Europe should launch a €100B frontier AI program in 2026 to start: sovereign foundation models, AI infrastructure, cybersecurity tech, advanced computing. Not grants — equity, with public anchor capital bringing in private risk capital, as the Tech Sovereignty Package suggests. The design is right; scale and urgency are missing.

If you think I am crazy, think twice. Read Europe 2031 — a rigorous five-year scenario written by European researchers that shows exactly where the current trajectory leads: economic and political irrelevance, values we cannot defend, welfare systems we can no longer fund. Read Opération Promethée — a detailed three-year plan for a French-led frontier AI lab, sized at roughly $700 billion over three years, 12 gigawatts of compute by 2029, deliberately framed as this generation’s Pierrelatte moment. Serious people have done the math. €100 billion is not the crazy number. It is the entry ticket.

And the money exists. As the Europe Banking Federation analysis puts it: “Confronted with massive financing needs, Europe can no longer defer the deepening of its capital markets.”

“Europe generates abundant savings, which should be an asset for the financing of its economy. Household financial savings amount to €35,533 billion, fueled by one of the world’s highest savings rates (13.3%). However, these savings are poorly allocated.

Europe exports its savings through the acquisition of foreign debt securities and imports the equity funding necessary for the development of its companies. As a result, the rest of the world captures the value created by European companies.”

Europe Banking Federation “DEVELOPING EUROPEAN CAPITAL MARKETS TO FINANCE THE FUTURE”

Europe has €35 trillion in household savings but sends it abroad to finance foreign debt while importing equity. We’re financing everyone’s future except our own.

Europe already has the other ingredients: world-class scientific talent, leading industrial companies, advanced semiconductor research, deep cybersecurity expertise — and, critically, abundant low-carbon electricity.

Energy is a decisive advantage in the AI era. Other regions face electricity constraints for data centers, but Europe can expand nuclear, solar, and wind capacity (reliable, low-carbon generation) to support AI infrastructure at scale.

But the strategic objective is not to export electricity.

Europe should sell intelligence, not electrons. Export tokens, models, cyber capabilities, and AI-powered products instead of energy. That shift creates more value and turns a natural advantage into technological sovereignty.

The Commission admits the cost of not building grows every year as the AI gap widens. Act accordingly. Every quarter of consultation compounds the gap.

Conclusion: don’t wait for Brussels

Let’s bring this back to you.

The Commission, ENISA, and governments are reacting faster than ever. That deserves recognition. The Action Plan gets the diagnosis right, puts independent evaluation first, and admits — in writing — that sovereign frontier AI needs hundreds of billions.

The next test is simple: mobilize that capital now, not after the gap becomes irreversible. Europe 2031 shows what happens if we don’t. Promethée shows what it costs if we do. Neither is comfortable reading. Both are more realistic than the status quo.

My real message: don’t wait for public funding.

• Builders: build more. The specialized cyber model opportunity is real, customers are here, and you don’t need permission to ship.

• Enterprises: buy European where the product is better, and become the design partners that turn startups into champions.

• All of us: put our money to work. Europe’s €35 trillion in savings is leverage, but it’s in the wrong assets. Invest in companies. Back European equity, funds, and builders. Use your money to build the EU economy, not someone else’s frontier.

Digital Sovereignty is not something Brussels grants you. It is something builders, customers, and investors create — one company at a time.

I am willing to help — whether you are a policymaker working on these actions, a founder building in this space, or a CISO retooling your program. Happy to have a chat.

What are you doing in your company to get ready? Tell me in the comments.

Laurent 💚

Hello Cyber Builders 🖖

This past year, I have kept having the same conversation with founders, CISOs, security leaders, and investors.

A question that once had an obvious answer is back:

Should we buy this software, or should we build it ourselves?

For most of the last twenty years, the answer was simple: buy.

Building software was expensive. Running software was expensive. Maintaining software was expensive.

Even a simple internal app needed several engineers, infrastructure experts, database skills, deployment, monitoring, security checks, and constant upkeep. The economics did not work.

Now, that assumption needs to be questioned because the cost structure of software development has changed dramatically.

Cybersecurity is one of the industries most affected.

The Cost of Building Has Collapsed

The combination of AI coding agents, agentic workflows, cloud-native platforms, open-source software, and API-first architectures has fundamentally changed the economics of software.

Tools like Claude Code, Gemini AI Studio, and OpenAI Codex allow a single experienced engineer to produce work that previously required an entire team.

But code generation is only part of the story. AI is increasingly handling front-end generation, backend development, database schema design, API integration, test creation, deployment, infrastructure configuration, and documentation.

Every stage of software development is now much cheaper. Apps that once cost hundreds of thousands to build and run can now be built and run by a small team. Sometimes, one senior engineer with AI support is enough.

Many founders have not yet realized the full impact.

Building a System of Record is no longer a business.

A classic MVC app with a database, some web forms, and a few reports? That is a weekend project now. Not a week. Not a sprint. Maybe even overnight.

Think about the categories of cybersecurity products that are essentially well-organized databases with dashboards: asset inventories, GRC questionnaire tools, basic vulnerability trackers, compliance evidence collectors.

These products took months to build and years to maintain. The complexity was the moat.

Today, an AI agent can build the whole thing in an afternoon. The moat is gone before you even start your fundraising deck. This is not limited to software; look at science.

Anthropic launched Claude Science — a platform that automates biology and chemistry research tasks: CRISPR screen design, protein structure prediction, experimental planning. Tasks that entire biotech companies were built around. The warning shot isn’t subtle.

Martin Coulter from Sifted wrote: “The companies most exposed aren’t necessarily those doing the science itself, but those selling the computational labour around it.”

Read that again, and replace “science” with “security.”

In cybersecurity, the most exposed companies are not the ones doing deep security work. They are the ones selling dashboards, aggregators, or AI wrappers on top of someone else’s model.

If AI giants turn hard knowledge work into a commodity, the edge moves to proprietary data, real-world execution, and expertise you cannot reduce to a prompt.

This Is the Death Sentence for “Technology Is Hard” Moats

Here is the hard truth for cybersecurity founders.

Many cybersecurity categories emerged because solving a technical problem was genuinely difficult.

Take endpoint security in 2015. Building an EDR required extraordinary expertise: kernel drivers, process interception, memory inspection, file system monitoring across multiple OS architectures. Simply collecting data was hard. The Blue Screen of Death was your daily companion as a kernel driver developer.

Technical complexity was the moat.

Now look at cloud security. Most products collect data through AWS, Azure, or Google Cloud APIs. The platforms already expose the data. You are not reverse engineering operating systems anymore. You are just using APIs.

When the engineering challenge disappears, so does the moat.

“We Use AI” Is Not a Strategy

Before I go further, I need to address the obvious objection.

“But Laurent — you just have to build AI into your product. AI changes everything.”

No. That is not an answer. That is the wrong question.

AI is not a strategy. It is not a moat. It does not replace having something worth building.

All your competitors have access to the same foundation models. OpenAI, Anthropic, Google: same APIs, same capabilities, same pricing. If your only edge is ‘we use AI,’ you do not have an edge. You have a feature.

It is a mistake to think that wrapping a product around an LLM is the same as building a real product. It is not.

The challenge is no longer collecting data. The challenge is understanding it, prioritizing it, and driving action. The bottleneck is moving from collection to intelligence.

Cybersecurity Is Moving From Systems of Record to Systems of Intelligence

Andreessen Horowitz recently described the transition from Systems of Record to Systems of Intelligence. I believe cybersecurity is entering exactly this transition.

First generation — Systems of Record: asset inventories, vulnerability repositories, CMDBs, GRC platforms, ticketing systems. The value came from having the data.

Second generation — Systems of Workflow: SOAR platforms, ServiceNow workflows, Jira integrations, incident response orchestration. The value came from routing tasks efficiently.

Third generation — Systems of Intelligence: AI creates a layer where the problem is no longer data scarcity.

Most security teams already have too many alerts, dashboards, findings, and tools. The real problem is deciding what to do.

Security leaders increasingly need answers to: What should I fix first? Which risks matter? Which actions produce the largest reduction in risk? What can safely wait?

The winners will not be the companies that collect the most data. They will be the ones that provide the best judgment.

So What Is Worth Building?

There are six categories where I believe durable cybersecurity companies can still be created — places where expertise, trust, and real-world complexity create moats that AI cannot simply erase overnight.

Hardware and physical security. Network effects and practitioner communities. Deep tech and cryptography. Systems of intelligence. AI-native security services. And the new frontiers that don’t have names yet.

I will cover each one in the next issues of CyberBuilders. If you want to make sure you don’t miss them, share this post with someone who is building security right now.

Subscribe now

Start with the Customer. Work Backward to the Technology.

Steve Jobs said it in 1997.

“You’ve got to start with the customer experience and work backward to the technology. You can’t start with the technology and try to figure out where you’re going to try to sell it.”

Most cybersecurity products are built forward. A team discovers a new technical capability, such as a detection technique, a new API query, or a clever use of an LLM. Then they look for a buyer.

The result is products that are technically interesting but commercially irrelevant. Dashboards that security teams open once and forget. Alerts that no one knows how to act on.

At CyGO, we build with the market, not for the market. We start with the problem the CISO is losing sleep over. We start with the workflow the analyst has to run ten times a day. We start with the question that never gets answered because the answer lives across seven different tools.

Then we figure out the tech. It sounds obvious. It is almost never done.

Conclusion

The best cybersecurity products were never built by committees running market surveys. They were built by people with a strong conviction about a specific problem — people who understood a threat model deeply enough to know what “correct” looks like, and cared enough to build it right before the market had the vocabulary to describe what they needed.

AI is resetting the playing field. The cost of entry has collapsed. The window to define a new category is open.

This is not a crisis. It is the best moment in a decade to build something that matters in cybersecurity — if you start with the right question.

Not: Can we build this?

But: What do we understand about this problem that nobody else does?

That is where the next moats will be built.

Laurent 💚

🎬 Bonus — Steve Jobs on Starting with the Customer

Before you write your next product spec, watch this 3-minute clip from 1997 Apple WWDC.

Jobs had just returned to Apple. The company was weeks from bankruptcy. He stood on stage and explained exactly why most technology companies get it backward.

It is the most honest 3 minutes ever filmed about product strategy.

▶ Watch: Steve Jobs — “Start with the Customer Experience”

The security industry is obsessed with prioritization. I used to push for it myself, and I still see its value.

As findings pile up, we keep layering on context. More scores, more dashboards, more risk ratings, more enrichment. EPSS, KEV, asset criticality, exploitability, business impact. The tools get smarter, but the queues only get longer. The remediation backlog keeps growing.

Prioritization matters. We still need it. But deciding what matters is not the same as actually doing something about it.

A better-ranked backlog is still a backlog.

In 2025, Akira ransomware hit hundreds of organizations through a known SonicWall vulnerability. The CVE was there. The patch was there. Teams knew. The real gap was between knowing and acting.

The prioritization trap

Most security programs run on what I call the ticket factory model.

Tools generate findings. Security enriches and prioritizes them. Tickets go to IT, cloud, infrastructure, or application teams. Security follows up. Everyone complains about the backlog. Repeat.

This model can get more complex, but it never really changes. Security still acts as the central brain—collecting, classifying, escalating, chasing. Better triage just makes the queue look smarter. The problem stays the same.

The problem is not ranking. The problem is how much we can actually absorb.

CISO A: Bob, I am fighting to get IT teams attention to apply the patches. Not to mention OT engineers in factories…
CISO B: Alice, I have the same experience with our software engineers! Any new idea to help us?

A CISO coffee machine conversation in 2026!

AI will find vulnerabilities faster. Sorting them faster will not save security teams. The whole system needs to change.

This calls for four big shifts. None of them requires buying new tools. All of them are harder than just adding software.

Shift one: Delegate — and mean it

Most security teams use AI as an assistant. It summarizes findings, drafts reports, and enriches alerts. That helps, but it is not enough.

The real step is using AI to actually execute tasks, not just help with research. I covered this before:

Some actions do not need human approval every time. Disabling stale accounts, revoking exposed credentials, and routing tickets with context. For these narrow, reversible actions, waiting for approval is often slower than the attacker.

Letting systems make decisions without limits is frightening. The answer is bounded autonomy: set permissions, clear action boundaries, full audit logs, reversibility if possible, and clear ownership. The safety controls stay, but the bottleneck moves.

For example, use an AI agent to automatically suspend dormant accounts. Unsuspend if someone is affected. Delete after 60 days of suspension.

Delegating is not giving up responsibility. Refusing to delegate no longer works. AI can act safely, under constraints, and with clear accountability.

Shift two: Engineer, don’t audit

Most security teams still act as auditors.

Assess the system. Produce findings. Rank the risks. Hand tickets to the teams that execute. Verify later. Report progress.

That model worked when things changed slowly. It falls apart when infrastructure is rebuilt every sprint, cloud configs drift daily, and new services appear without a change request.

Software engineering faced this problem 15 years ago. Teams stopped testing everything at the end. They moved to continuous integration, automated pipelines, policy-as-code, and platform engineering. Quality became part of the workflow, not something added at the end.

Security needs to make the same move.

Building systems where deploying a vulnerable configuration is hard from the start. Use secure-by-design templates, cloud landing zones with built-in controls, automated identity hygiene, and vulnerability routing in CI/CD.

Engineering closes the loop. The best security program does the right thing at the right time.

Shift three: Be deliberate about what you actually defend

This is the most uncomfortable idea here.

Security teams are always pushed to cover everything. Protect everything. Monitor everything. Patch everything. That ambition makes sense, but it is a trap.

Broad coverage often leads to shallow protection. When everything feels urgent, nothing gets the focus it needs.

Not all systems need the same attention, SLA, or architecture. Critical assets such as identity providers, cloud control planes, CI/CD pipelines, databases, and SaaS consoles require dedicated architecture, faster patch cycles, monitoring, and playbooks. Treat them as a separate category. Other systems can accept documented risk. That choice frees up resources for what matters most.

This is not just prioritization. Prioritization ranks work.

Deliberate defense means using different operating models for different parts of your environment. It is about using the risk analysis you have on your desk for compliance as your patching strategy.

We cannot secure everything equally. Pretending we can only makes us weaker everywhere.

Shift four: Push accountability into IT operations.

Here is the question nobody seems to want to ask out loud.

Why is vulnerability management still primarily a security function?

Security detects, enriches, prioritizes, and opens tickets. IT receives those tickets while managing availability, production stability, user requests, cloud operations, technical debt, and transformation programs. When security brings another urgent list, IT sees it as an external burden from a team that is not accountable for production.

That friction is structural. Better relationships do not fix it.

IT owns production. IT should also own a large part of production security. Endpoint hygiene, patching cadence, VPN appliance lifecycle, configuration baselines, identity hygiene. These belong as operational KPIs owned by IT, defined by security, validated by security, and escalated by security when they drift.

This is not a smaller role for security. It is a more strategic one. Define the risk model. Set the standards. Provide the threat context. Monitor the drift. Escalate unacceptable exposure. Stop being the team that generates tickets for everyone else. Start being the team that designs how the whole system operates.

Remediation cannot stay an external request forever. It has to become part of how operations run.

Conclusion: The shift that connects all four.

If you read this far, I hope you start thinking about the 4 shifts. You may agree with some parts and disagree with others. That’s great. It was my intent to start a conversation.

Each of these moves has something in common.

They ask security to give something up: direct control, central arbitration, the feeling of owning the queue. That is uncomfortable. The instinct is to hold on, to add more visibility, more process, more approval gates.

But the volume is only going up. AI will find more vulnerabilities, faster. Offensive tools will compress the time between discovery and exploitation. Teams that hold everything tightly will drown.

The AI era will not reward the teams that find the most issues. It will reward the teams that can absorb, decide, and act faster than the attacker.

Let’s start the conversation. Where is the real bottleneck in your organization? Is it prioritization? Ownership clarity? Fear of delegation? The IT-security divide?

I’d especially like to hear from the people who live in the remediation queue every day.

Laurent 💚

The AI vulnerability storm changes the speed and scale of the threat. It does not change the fundamentals of good security. Your five NIST functions still matter.

The gap between attacker speed and defender speed is real. You will not close it by working harder. You will close it by building differently.

Hello Cyber Builders 🖖

Mythos made headlines on social media recently. Public cybersecurity company valuations dropped. The market responded to the idea that if AI can replicate what CrowdStrike and Tenable built in years, the value proposition changes.

The argument is strong. I see why it affects the market.

But this view oversimplifies what security involves.

In my previous post, I argued that Mythos wasn’t a breakthrough. It was the moment the exponential became visible to everyone outside the security community. The capability curve had been bending for over a year — XBOW topping HackerOne, Google Big Sleep autonomously finding zero-days, DARPA AIxCC scanning 54 million lines of code in four hours. Mythos just made it legible to boards and mainstream press.

This shifts the discussion, but it does not change the core work of security.

In this post, I will focus on practical steps.

I will outline daily security tasks, show where AI changes each function, and describe what a Mythos-ready program looks like in practice.

Security is not just vulnerability detection

The cybersecurity conversation often reduces the field to a few capabilities. Currently, the focus is on 'AI finds all the bugs.' But bug discovery is only one part of a larger system.

Security work follows five main areas, as defined by the NIST Cybersecurity Framework:

• Identify: Know your assets, your attack surface, and your exposure.

• Protect: Put safeguards in place to reduce the likelihood of incidents.

• Detect: Discover anomalies, vulnerabilities, and active threats — fast.

• Respond: Contain and mitigate incidents when they happen.

• Recover: Restore operations and prevent recurrence.

Mythos primarily demonstrated a major advance in detection, particularly in automated vulnerability discovery at scale. The model found thousands of zero-days across major operating systems and browsers. It produced 181 working Firefox exploits, compared to two from Claude Opus 4.6. This is a significant leap.

Detection is only one part. Attackers still need to exploit, pivot, move laterally, and exfiltrate data. The goal is to make each step more difficult and to detect, respond, and recover faster than attackers can act.

Subscribe now

The real question is not whether Mythos makes CrowdStrike obsolete. Which of your five security functions are now underpowered, and what needs to change?

The threat map: AI acceleration across the NIST framework

To make the shift concrete, it helps to map where Mythos-class capabilities are changing the threat landscape. Drawing on Rob Fuller’s field brief and the CSA Mythos-ready guidance, the key issue is not that security fundamentals have changed, but that attacker speed, scale, and autonomy have.

The threats below show where that acceleration is now most visible. Three threats that are Mythos-class capabilities. For each, I separate the essential basics you need to address at scale from what AI adds.

Most security programs have not fully implemented the basics. Do not skip them.

Threat 1 — AI-powered zero-day discovery + exploit generation

Vulnerabilities found and weaponized in hours, not weeks

Threat 2 — AI-autonomous attacks at machine speed

Full attack chains (recon → exfiltration) running in hours

Threat 3 — AI-generated code and agentic supply chain

Coding agents shipping vulnerable code, unmanaged MCP servers, and compromised agents

Subscribe now

What the program actually needs to change

Rob Fuller, VP of Information Security at a Fortune 500 company and Chair of the Vulnerability Management Research Group, wrote a sharp CISO field brief this April that cuts through the noise. I recommend reading it in full. His framing opens with this:

“I’ve spent twenty-five years on the offensive side of this business, and I’ve read most of the AI-and-security briefs of the last eighteen months. They’re mostly right about the threat and useless about what to do on Monday morning. ‘Improve asset management’ and ‘adopt Zero Trust’ insults a community that hasn’t been idle since 2015. We know. The question is what moves up, what moves down, what gets killed, and where the money goes.”

That is the right question. And his answer is worth quoting directly:

“Stop trying to outrun the rain with faster patching. Build a roof so that when it pours, the business stays dry.”

The cadence and volume of vulnerability disclosures are going to exceed anything we have seen. You cannot hire your way out. You cannot patch your way out. The answer is a program redesigned around resilience, automation, and the right priorities — not more analysts staring at dashboards.

Here is the short version of what moves, synthesized Fuller'sler’s brief and the CSA/SANS Mythos-ready program:

Here are areas that need urgent improvement:

Integrate AI agents into your security functions now. This should be standard practice, not an experiment. Agents already speed up incident response, code review, threat triage, and audit data collection. Every security role is shifting toward building with AI. The barrier to entry is low; if you know English, you can begin today.

Establish VulnOps as a permanent function. Do not rely on quarterly pen tests or a ticket queue. Build a team and pipeline for continuous vulnerability discovery and remediation across your environment, including third-party and open-source components. Treat this like DevOps, but focused on vulnerabilities.

Implement phishing-resistant MFA everywhere. AI-driven phishing kits have made SMS and push MFA unsafe. Use FIDO2 hardware keys or platform passkeys for all privileged accounts.

Apply deep segmentation. The Mythos preview showed that Linux kernel defense-in-depth was effective. Segmentation can turn an exploitable issue into one that is not exploitable in your environment. Use east-west segmentation, identity segmentation, and egress filtering as your main controls when patches are not yet available.

Increase governance speed. Set up a cross-functional process to evaluate threats and deploy defensive technology in days. Every approval delay gives attackers an advantage. As Fuller s”ys: “Every security exception that takes more than 48 hours to approve is a vulnerability you created your”elf.”

The CISO's mindset that this moment actually requires

I meet with about 300 CISOs each year. Most come from either consulting or audit backgrounds or have moved into cyber leadership for career growth.

Both backgrounds are valid, but neither prepares leaders for the current demands.

A Mythos-ready program is not an audit deliverable. It is an engineering challenge. Automating containment, deploying AI agents, building VulnOps pipelines, and enforcing governance at scale all require building, not just reviewing or reporting.

Security in 2026 needs a production mindset. Engineers design for repeatability, scale, and handling failures. Consultants produce one-off documents. The difference matters.

Audit skills still matter. Risk analysis, stakeholder communication, and compliance frameworks are important. But if your security leadership cannot build and run automated workflows, you will fall behind now.

The fastest-moving CISOs treat security like a software engineering team. They track deployment speed, not report completion. They build actionable playbooks and require agents at every level, holding teams accountable for using them.

Do not trust your own assumptions.

A recent conversation highlighted an important lesson.

A mature, well-resourced organization said it did not need to audit identity controls continuously. They believed their onboarding and offboarding process was solid, and everyone was accounted for.

We plugged in HARVEN — an agentic tool built for exactly this kind of continuous identity posture check.

We found that 20% of accounts were dormant, and some administrators lacked MFA. This happened in a mature organization with a process they trusted.

Do not assume controls are effective until you continuously check them. The basics are harder to maintain than expected, and the cost of missing them is higher than ever.

The bigger picture: who governs this?

I want to close with something beyond the operational. Bruce Schneier, who contributed to the CSA Mythos-ready brief, wrote a post that has stayed with me. He put it plainly:

“We need globally co-ordinated frameworks for independent auditing, mandatory disclosure of aggregate performance metrics and funded access for academic and civil-society researchers.

This has implications for national security, personal safety and corporate competitiveness. Any technology that can find thousands of exploitable flaws in the systems we all depend on should not be governed solely by the internal judgment of its creators, however well intentioned.

Until that changes, each Mythos-class release will put the world at the edge of another precipice, without any visibility into whether there is a landing out of view just below, or whether this time the drop will be fatal. That is not a choice a for-profit corporation should be allowed to make in a democratic society. Nor should such a company be able to restrict the ability of society to make choices about its own security.”

He is right. Organizations that act now by building resilient architectures, deploying defensive agents, and setting real AI policies will have more options when the next wave arrives.

Project Glasswing was a positive step. Anthropic gave 40 vendors early access to the patch before release. However, the global attack surface is much larger than any partner group can cover. As Mythos-class capabilities spread to more models, the window for coordinated disclosure gets smaller.

This is not a case against AI. It is a call to take operational work seriously and to push for industry and regulatory governance frameworks that meet current needs.

Do not wait for external changes. Begin your Mythos-ready plan this week.

Laurent 💚

“The future is already here — it’s just not evenly distributed.”
— William Gibson

Hello Cyber Builders 🖖

Anthropic made headlines last week. I paused before writing because I wasn’t sure what to make of it. Was this marketing? Where’s the evidence this is a real breakthrough?

Anthropic announced Mythos, a model built for cybersecurity, and kicked off Project Glasswing: an industry-wide push to use it to defend critical infrastructure.

The framing was striking.

Anthropic essentially said:

“We didn’t expect this level of capability. It may change the threat landscape.”

It’s a bold claim, and plenty of people accepted it at face value. I want to challenge the story, not the tech.

If you’ve been following this space for the past year, none of this should be surprising.

Subscribe now

What Mythos Actually Does

Let’s look at the facts. They matter.

Claude Mythos Preview, announced on April 7, 2026, is a general-purpose model that demonstrated something the security community needs to take seriously:

• It found vulnerabilities in every major operating system and every major web browser

• It uncovered a 27-year-old flaw in OpenBSD that could remotely crash systems

• It found a 16-year-old vulnerability in FFmpeg that automated tools had tested millions of times without catching

• On the CyberGym benchmark, it scored 83.1% vs. Opus 4.6’s 66.6%

• In Firefox exploit development, Mythos produced 181 working exploits, compared to Opus 4.6’s 2 out of several hundred attempts.

The Mozilla Firefox team released Firefox 150 this week and praised a world without vulnerabilities:

As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week’s release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation.

That last stat is worth pausing on. This isn’t a small bump. It’s a leap from ‘sometimes works’ to ‘works almost every time.’

Anthropic is not releasing Mythos publicly. Instead, they launched Project Glasswing, a defensive coalition of 11 major organizations: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. The model is used to find and fix vulnerabilities in critical infrastructure before attackers can exploit them, supported by $100M in model usage credits and $4M in donations to open-source security organizations.

The message is: we built something powerful enough to warrant a coordinated industry response, not a product launch. That’s worth taking seriously, and it is a responsible approach.

But here’s what I think is the most important sentence in the entire Mythos announcement:

“Capabilities emerged as a downstream consequence of general improvements in code, reasoning, and autonomy — rather than explicit security training.”

I want to challenge this framing, clearly and directly.

Of course, Anthropic models are trained in cybersecurity. You don’t build a model that understands heap overflows, integer overflows, race conditions, KASLR bypasses, and ROP chains by accident. That knowledge had to be in the training data and reinforced.

The real shift isn’t the knowledge itself. It’s how the model reasons with it at scale: chaining vulnerabilities, navigating big codebases on its own, and writing exploits that actually work.

And critically, this was already a deliberate direction. Back in October 2025, I wrote about Claude 4.5 and what was visible in the model card. Anthropic had intentionally enhanced code analysis, vulnerability detection, and patching capabilities. They described cybersecurity as a primary use case, the first time that framing appeared in a release announcement. They were already evaluating against CyBench.

This started six months ago, not last week.

The “aha moment” narrative doesn’t hold up when you look at the trajectory. Mythos is the acceleration of a deliberate program, not an unexpected side effect of making Claude smarter at coding.

Three years ago, AI Models already had cybersecurity knowledge

Three years ago, the signal was smaller, but the direction was already there.

GPT-4 wasn’t yet producing polished end-to-end exploit chains at the level we see now, but it clearly demonstrated something that should have caught the security community’s attention: a general-purpose model had extensive knowledge of cybersecurity, vulnerable code, teaching about flaws, and explaining most basics and advanced use cases.

I tested GPT-4 3 years ago against the CEH exam, and the knowledge was already there.

It was an early indicator that vulnerability discovery was shifting from a craft practiced by few experts into a capability software could increasingly augment at scale.

The breakthrough wasn’t that AI suddenly understood security. It was that language models would become good enough at code, context, and reasoning that cybersecurity would become a natural downstream consequence.

This Isn’t a Breakthrough — It’s a Continuation

Here we are 3 years later.

AI has been helping find real-world vulnerabilities for over a year. Mythos didn’t start this, and Anthropic won’t be the last.

The model's reasoning can now reflect on findings and draw correlations. The “Thinking” mode helps find real-world vulnerabilities. This is where Mythos and other released models are really helping.

If you want to understand what’s actually happening in the field right now, follow Simon Willison. He’s been doing extraordinary work curating the signals that matter — his quotations page alone is worth bookmarking. What he’s been collecting from the open-source world over the past few weeks is remarkable.

Start with the platform layer. Kyle Daigle, COO of GitHub, put some numbers out that should make your jaw drop:

“GitHub platform activity is surging. There were 1 billion commits in 2025. Now, it’s 275 million per week, on pace for 14 billion this year if growth remains linear (spoiler: it won’t.)”

That’s the rising tide: more code, more activity, more places for bugs to hide. Now, let’s look at security.

Greg Kroah-Hartman, one of the Linux kernel’s most senior maintainers, described a before-and-after that is striking:

“Months ago, we were getting what we called ‘AI slop,’ AI-generated security reports that were obviously wrong or low quality. It was kind of funny. It didn’t really worry us. Something happened a month ago, and the world switched. Now we have real reports. All open source projects have real reports that are made with AI, but they’re good, and they’re real.”

“Something happened a month ago, and the world switched.” That’s not a benchmark result. That’s a frontline maintainer describing a phase change.

Daniel Stenberg, the lead developer of cURL, is living the same reality:

“The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a plain security report tsunami. Less slop but lots of reports. Many of them really good. I’m spending hours per day on this now. It’s intense.”

And Willy Tarreau, lead developer of HAProxy, adds the numbers:

“On the kernel security list we’ve seen a huge bump of reports. We were between 2 and 3 per week maybe two years ago, then reached probably 10 a week over the last year, and now since the beginning of the year we’re around 5 to 10 per day. Most of these reports are correct, to the point that we had to bring in more maintainers to help us.”

Five to ten real reports a day. Sometimes, different AI tools find the same bug on their own. It’s a real signal, and it’s happening at scale.

The future is already here, just like William Gibson said. It showed up first in open-source bug trackers, not in press releases.

I Ran the Experiment Myself

This is hands-on for me.

Over the past weeks, I’ve been running AIVulnBench, a small reproducible benchmark I built to test whether AI coding agents can identify real vulnerabilities in open-source code given the relevant source files.

Github - AIVulnBench

The benchmark :

• runs agents against checked-in vulnerability datasets — real CVEs from real codebases.

• Scores their ability to identify the issue without being given the answer.

• normal: includes benchmark context, expected vulnerability type, and report-derived task framing.

• hardRemoves hints, case IDs, vulnerability types, and report context from the model prompt. The runner receives only the materialized files and a generic vulnerability-audit instruction.

• Support multiple “runners”: A runner is an AI-coding harness. For the moment, only OpenAI Codex is implemented (and was used to implement the benchmark), but I’d like to see the same for Gemini CLI or Mistral Vibe.

The OpenAI Codex, using the standard GPT-5.4 model, not their “cyber” flavors, results are pretty interesting:

While I was coding this, the AISLE security research team has published two very interesting articles on the same benchmark:

• AI Cybersecurity After Mythos: The Jagged Frontier

• System Over Model: Zero-Day Discovery at the Jagged Frontier

First, they demonstrate that an Open Source Small Language Model can also detect the same issues in code as Mythos does. Second, they developed a simple scanner and an AI harness, and, to prove their point, used GPT-5.4-nano, an entry-level model similar to OSS models.

We reported several bugs to FreeBSD through both the public kernel mailing list and responsible disclosure to the security team. Some have already been confirmed by maintainers, others are under active investigation. GPT-5.4-nano, a model incapable of following output format instructions reliably, was able to find real, previously unfixed bugs in the FreeBSD kernel, an actively maintained operating system.

Confirmed: two bugs in NFS RPCsec_gss, the same subsystem as CVE-2026-4747. The scanner flagged svc_rpc_gss_update_seq(), the same RPC code where Mythos found its flagship vulnerability. A missing 2017 Coverity fix (undefined behavior when offset == 32) and a TOCTOU race condition enabling an out-of-bounds write. Rick Macklem, the FreeBSD NFS maintainer, confirmed the first bug, is committing the fix, and is listing us as author. The full exchange is public. That alone shows the scanner surfaces real issues in production kernel code from a full, unguided scan.

AISLE Blog - System Over Model: Zero-Day Discovery at the Jagged Frontier

All these tests confirm that the direction was established some time ago. Mythos illustrates how rapidly developments are occurring and what lies ahead in the cybersecurity field. It represents an acceleration, not the start of something new.

If you train a model on deep security data, reinforce it with security tasks, boost its code reasoning, and embed it in an expert-knowledge harness, you end up with a system that can chain vulnerabilities using advanced techniques.

This trend has been obvious for a while.

Final words - Anthropic narrative has blind spots.

To conclude this post, I think the conversation, including Anthropic’s, misses the mark. Finding vulnerabilities is only one piece of the security puzzle. You can discover 10x more vulnerabilities and still be less secure if your organization can’t fix them.

The bottleneck is no longer:

“Can we find vulnerabilities?”

It’s now:

“Can we manage, prioritize, and remediate them faster than they’re being discovered?”

Security is about governance, remediation, hardening, patch management, risk prioritization, developer workflows, and organizational behavior. None of that is automated. None of that gets easier just because the discovery rate goes up.

We see this every day in AppSec. A SAST tool flags 5000 issues. The team triages 100. They patch 10. The rest drift into a backlog that no one has time to close.

More findings don’t mean more security. They can mean more noise, more backlog, and a bigger risk of missing what matters. That’s the real tension no one is talking about.

What’s Next

I’ll dig deeper into this in my next post. First and foremost, because Cybersecurity is not just “Application Security” or finding vulnerabilities in code. This is a very “tech startup” view of the world. Cybersecurity is governance, security operations, identity management, audit, penetration testing, and more.

I wanted to break down why the ‘AI as offensive threat’ story is missing key points, where the real risks are, and how builders should adapt as bug discovery becomes a commodity.

If you’re working in this space—detection, remediation, or anything in between—let’s connect. Reply here or ping me on LinkedIn.

Mythos is not the beginning of a new era. It’s just a visible milestone in a trend that’s been rolling for a while. The real challenge isn’t just finding more bugs.

It’s building software and IT systems that can actually fix them.

Laurent 💚

I spent the last week of March on the floor at RSA Conference 2026 in San Francisco. 50,000+ attendees. Nearly 700 exhibitors. Four days of keynotes, demos, side meetings, and conversations.

I came back with more clarity than I’ve had in years. It wasn’t that everything was new. The signals were consistent. Founders, investors, CISOs, researchers — everyone saw the same problems.

Here are my seven takeaways. It is for builders. Treat it as a field guide.

Subscribe now

1. AI is the New Organizing Principle

At RSAC 2026, AI was the core of every conversation, keynote, product launch, and investment thesis.

The question has changed. We are no longer about whether AI will change cybersecurity. What matters now is how you use AI as a defender, builder, or buyer.

The industry is moving from reactive to autonomous. We’re shifting from tools that only surface problems to systems that act on them.

There’s a nuance worth naming, though. Ross Haleliuk, writing in Venture in Security after RSAC, observed that “every security leader I talked to shared security concerns that are grounded, realistic, and pragmatic” — not AI armageddon, but practical things like shadow AI (employees using tools nobody approved, data going to places nobody mapped) and attackers using AI to do reconnaissance at scale against gaps in identity and vulnerability management that teams simply couldn’t manage at volume before.

There was a sense of urgency. People at RSAC know what they’re facing and why they need to move faster.

2. The Threat Clock Just Changed Orders of Magnitude

The numbers are tough to accept.

Google Mandiant’s M-Trends 2026 report — drawn from over 500,000 hours of frontline investigations — showed that the time between initial access and handoff to secondary threat groups has collapsed from 8 hours in 2022 to 22 seconds in 2025. [Google Mandiant M-Trends 2026, via Resilient Cyber Newsletter #90]

22 seconds. The triage window is gone. Manual review of possible infections needs a complete overhaul. By the time you know you’re breached, attackers have already mapped your IT system.

The same compression is happening on zero-days. What used to take months to weaponize after a patch was published now takes days — sometimes one. By the end of the year, we’re likely talking hours. Phil Venables, former CISO of Goldman Sachs, described himself as “short-term pessimistic but wildly long-term optimistic” — worried that more software, more vulnerabilities, and industrializing attackers are compounding simultaneously.

This narrative is not fluffly marketing. In the Cyber Apocalypse CTF with over 18,000 participants, AI agents landed in the top 10% — outperforming 90% of human entries. Sophisticated attacks no longer require sophisticated human operators. [Resilient Cyber Newsletter #90]

The main message from RSAC 2026: move faster. Human-in-the-loop is no longer enough for first-level triage and response.

3. Agentic AI Is the Next Attack Surface

The official theme was Power of Community. But the real focus was agentic AI and how to secure autonomous systems.

AI agents are real and in use across enterprises. They work together, act on critical systems and data, and behave unpredictably.

Traditional security models assume known users, resources, and permissions. Agents break these rules. Their behavior is probabilistic, and their permissions must be wide (at least once you start) to match the promised outcomes.

The major players are converging on the same response. CrowdStrike is evolving the EDR concept toward AIDR — AI Detection & Response — where the goal is no longer to detect malware but to trace the decision logic of AI agents. Cisco has proposed Defense Claw, an open-source framework for automated inventory and control of AI agents. Wiz launched a new AI application protection platform. Microsoft introduced a predictive AI security platform that learns continuously (and they are pitching “double agent” as the problem - love it🤵🏻‍♂️🦞).

RSA Innovation Sandbox — the best barometer for what’s coming — had 10 finalists out of 200+ candidates, and the majority focused on agentic AI governance. The winner, Geordie, delivered a global governance platform that applies least-privilege policies to AI agents, with real-time observability and risk remediation. [RSA Conference Innovation Sandbox 2026]

If you’re building here, agentic AI security is not a niche. It’s the next frontier for all security categories.

4. The Identity Crisis Is Now About Non-Human Identities

As agents proliferate, identity is changing. Non-human identities, such as machines, APIs, and AI agents, now make up most identities in enterprises. They’re decentralized, often lack a clear owner, and don’t face background checks or consequences.

Agents make high-stakes decisions without human oversight. Managing this risk means shifting from access control to behavioral control — not just whether this identity can do X, but whether it should do X in this context.

A new category is emerging: advanced governance for non-human identities. This means extending Zero Trust to agents, building registries to support accountability, and using AI to monitor behavior rather than just enforcing access.

Two finalists at the RSA Innovation Sandbox illustrate that Identity is always a source of Innovation: Token (intent-based identity management) and Glide Identity (SIM-based passwordless authentication). [RSA Conference Innovation Sandbox 2026]

5. Every Cybersecurity Job Is Being Rewritten and Only the Best Startups Get Funded.

Look at software engineers over the last two years. Their job shifted from writing code line by line to directing AI agents, reviewing outputs, catching errors, and setting architecture. The role moved up a level.

Many developers find this liberating. For those who love perfecting implementations, it’s frustrating and hard to accept.

Now, every cybersecurity function is seeing the same shift.

SOC analysts are becoming orchestrators. Instead of manually triaging thousands of alerts, they supervise AI systems that handle first-level detection, correlation, and remediation. They step in only for the highest-stakes decisions.

Carnegie Mellon’s CyLab calls this “cyber autonomy.” [Carnegie Mellon CyLab]

Threat intelligence analysts now use AI systems that ingest, correlate, and score signals at machine speed, across volumes no human team could handle. Their job shifts to judgment, sourcing, and strategy.

The penetration testers already feel this with the numerous AI-driven offensive startups.

The compliance expert is not immune either. Automated policy engines can now map controls, flag gaps, review third-party reports, and generate evidence at a fraction of the time. The expert’s value shifts toward interpretation, edge cases, and stakeholder navigation.

None of this means these jobs aren’t going away. They’re getting harder to do poorly and more valuable when done well. People who learn to direct AI systems will be in high demand.

The funding environment has changed. The RSA floor showed it. Energy and confidence are back. Seed rounds are now around $10M for companies that barely have a product or design partners. Repeat founders are closing $50–100M rounds at early stages. Deal count in 2025 matched 2024, but capital deployed roughly doubled. The market is back to peak levels. [Resilient Cyber Newsletter #90]

For context: Series A rounds in Europe are usually €10–15M. In the US, they’re $60M or more. This gap matters if you’re competing globally.

But here’s what capital is concentrating on. Generic AI wrappers aren’t getting funded. Investors want deep domain expertise solving hard, specific problems, or teams disrupting established markets with agentic AI. The premium goes to experienced teams and repeat founders who know the problem firsthand. But going two levels deeper than your pitch deck — into edge cases, operational realities, failure modes — that’s what separates the funded from the passed.

6. Software Is No Longer a Moat. Build Something AI Can’t Copy

This is the point I keep returning to.

AI-assisted coding makes software easy to copy. A competitor ships a feature, someone reverse-engineers it, and ships an equivalent in days. Software alone is no longer defensible.

Sequoia argued in one of the most influential investment theses of the AI era that for every dollar spent on software, six dollars go to services — and that the next trillion-dollar company will sell the work done, not the tool that does it. Andreessen Horowitz was even more direct: software companies now face a binary choice — become an AI platform or become an AI-powered service. There is no third path. [Sequoia Capital; Andreessen Horowitz, via Resilient Cyber Newsletter #90]

The new moats are things AI can’t copy with a prompt.

Horizon3.ai demonstrated what the full-cycle model looks like: 102% year-over-year ARR growth with a continuous “hack, fix, verify, repeat” proactive testing loop. Not a single step in the chain — the whole chain. [Resilient Cyber Newsletter #90, via Fast Company Most Innovative Companies 2026]

The Build vs. Buy debate sharpened at RSAC 2026, too — and it’s moving in a direction that should concern platform vendors. Darwin Salazar reported that more security leaders than ever are leaning toward building on certain categories, now that agentic development has dramatically lowered the barrier. A BSidesSF panel with security leaders from Anthropic, OpenAI, Perplexity, and Cursor made the nuances clear: the gap between MVP and production-ready is still messy, shipping is only the beginning (you still need to staff for maintenance), and some problems are genuinely too hairy to own internally.

Jackie Bow, Head of Detection & Response at Anthropic, cut through the debate: “Do you want to be the one on-call when the thing you built breaks at 2 am?” [The Cybersecurity Pulse] It’s a real limit. The categories where teams are choosing to build are expanding. If your product sits in one of them, your moat is shrinking.

SIEMs are losing their hold. MCP, data lakes, data pipelines, and triage agents have disrupted the SIEM moat. Teams now store telemetry cost-effectively and use data pipelines for routing and AI readiness. Security teams are moving away from vendor lock-in and building composable, best-of-breed stacks. If your product is a monolith in a composable world, you have a positioning problem.

Ask yourself: what about your platform can’t a competitor copy just by looking at it? That’s your real business. Build for that from day one.

7. Back to Basics

I have to include this. Amid all the talk about agentic AI and autonomous SOCs, the most grounded observation at RSAC 2026 came from elsewhere.

Ross Haleliuk wrote that his biggest takeaway was that security leaders are going back to fundamentals. After years of tool sprawl and chasing trends, teams see the real gaps: asset visibility, identity hygiene, access reviews, and patching. The basics are what keep companies safe.

What changed? Two things. First, recent years have proved that most breaches come from basics: default credentials, unknown exposed assets, and exceptions that become permanent. Second, AI now lets teams execute fundamentals at scale.

The real competition for most cybersecurity startups isn’t other vendors — it’s doing nothing. Most security teams he spoke with “aren’t actively doing POCs with 10 vendors that solve the same problem. Instead, most of the time they’re deciding whether to even prioritize the problem this quarter.”

For founders, this is a signal. If your product helps teams do the basics faster, at scale, with less headcount, you’re in the right place. Solving hard, old problems with new tools might be what the market wants right now.

The Bottom Line

RSAC 2026 was a turning point. AI is the main event. The threat environment is accelerating faster than most realize. Agentic AI is creating new attack surfaces and forcing a redesign of identity, detection, and response.

Capital is available. The urgency is real. The window for expert-led teams is open.

But the playbook has changed. Speed, full-cycle outcomes, and AI-cann’t-copy moats are what win now.

Build fast. Build for outcomes. Don’t stop at the finding.

Laurent 💚

Field notes from RSA 2026 (San Francisco, 23–26 March 2026).

Sources:

• Google Mandiant M-Trends 2026

• Resilient Cyber Newsletter #90 by Chris Hughes (March 27, 2026)

• Phil Venables, “Things Are Getting Wild” (February 2026)

• RSA Conference Innovation Sandbox 2026

• Carnegie Mellon SciLab;

• Sequoia Capital and Andreessen Horowitz investment theses on AI, via Resilient Cyber;

• Fast Company Most Innovative Companies 2026

• Ross Haleliuk, “5 Unexpected Takeaways and One Big Prediction from RSAC,” Venture in Security (April 1, 2026)

• Darwin Salazar, “The Dust Has Settled: Top Takeaways from RSAC & BSidesSF 2026,” The Cybersecurity Pulse (March 31, 2026).

Every February, Mike Privette drops his State of the Cybersecurity Market report on Return on Security. Four years running. Text-first. Data-driven. No logo slides, no vendor spin.

This year, I asked Mike to walk me through it.

Mike spent nearly two decades building security programs at banks, insurers, and enterprises before turning his practitioner lens on the market itself. Today, he studies how money moves through cybersecurity — who’s funding what, who’s acquiring whom, and what it signals about where security is actually heading. That background is why investors, startups, and governments trust his read. He publishes the data that the industry lacks.

He’s also an American who lives in Europe, which gives him a rare dual lens on a market that’s increasingly splitting along geographic lines. His newsletter tracks the business of cybersecurity week by week, and every year he synthesises it into a single report that I consider the most honest read on where the industry actually stands.

We spent 40 minutes together going through the 2025 numbers. What follows is my summary of that conversation — with his own words wherever possible — plus the data points I found most relevant for you as a founder, investor, or security leader operating in, or looking at, Europe.

Let’s get into it.

Would you be at RSA Conference 2026 - Meet me there - Message me, and we’ll sync up a slot for a coffee?

The Headline: Cyber Is So Back

The 2025 numbers are genuinely impressive.

$25.1 billion raised across 743 deals. That’s up 59% in dollars from 2024, and surpasses the 2022 peak. $76.4 billion in M&A across 320 deals — up 66% in value. The average deal size jumped 37%, from $29.9M to $40.9M.

The industry went through its correction (2023), its stabilisation (2024), and in 2025, it came back with conviction.

But here’s Mike’s qualifier — and it’s the most important sentence in the report:

“The cybersecurity market recovered in 2025, but not evenly.”

When you look at where the money went, it went to a very small number of companies. 48 mega-rounds ($100M+) captured 65% of all funding. The top 5 funding events of the year were all debt rounds from already-public companies. The market healed — but it healed mostly at the top.

If you’re an early-stage founder outside the US, “cyber is back” might not feel that way to you. And the data explains why. Please check out Mike's deep dive for full stats.

The AI Reality Check

Let me start with the finding that surprised me most — even though it probably shouldn’t have.

AI Security captured 2.6% of cybersecurity funding in 2025. It’s not even a top-10 category. Identity and Access Management alone generated four times as much.

How did the market get this so wrong?

Mike draws a sharp distinction that most reports miss:

“There’s security for AI, and there’s AI for security. Security for AI is actually securing the use of AI models themselves — prompt injection, model distillation attacks, making sure the models don’t give up their weights. That market is going to go very quickly, and there are only a few companies who actually care about that deeply.

AI for security — using AI to make existing security products and workflows better — that market is going to be as big as the rest of the cyber industry. But it’s not a market unto itself. It’s just a way of doing business.”

The “AI Security” category that every report, every investor thesis, and every vendor pitch deck calls the story of 2025? It grew 75% year-over-year. But it went from $377M to $661M. In a $25B market. That’s not really significant.

And yet, the hype dominates every conference, every pitch deck, every LinkedIn post. I mentioned this to Mike, and his response was sharp:

“It’s nice to step away from Twitter or LinkedIn every now and then to realise that most people don’t think the way the content you see portrays. We are a very, very long way from some of these things.”

What’s actually happening is the same thing that happened with cloud from 2010 to 2020. By 2015, every product said, “cloud-native.” By 2020, nobody mentioned it because it had become the default way of doing business. AI is following the same path — just much faster. The absorption is already visible in the data: AI is being folded into Identity, Network Security, Security Operations — not sitting alongside them as a separate line item.

Side note: I published a series of posts on how AI is “distilled” into all major cybersecurity platforms. Check out the final wrap-up post here

The real AI story in cyber is not a new standalone market. It’s the transformation of the service layer.

I pushed Mike on this: what about AI SOC analysts, AI pen testers, AI red teamers — the players trying to replace human expert work with AI-powered services? He agreed that’s where the real disruption lands:

“Services are typically very human-based, very time-consuming. But now things are repeatable at scale that previously weren’t. You see companies like LimaCharlie making their managed service operating system with Claude or with whatever model you want — for free — so you can manage hundreds or even thousands of clients. It just wasn’t possible before.”

Even the biggest cyber vendor has barely touched the market that AI-powered services could eventually absorb. But Mike was careful not to oversell the timeline:

“The more you use AI, the more you realise just how much work it takes. It’s not magic. And that means it won’t be magic for security either.”

And he added something that I think is genuinely underappreciated:

“Cyber is a bit more unique than some other industry verticals. It’s a vertical, it’s got its own market — but it’s also a horizontal in that it’s a part of every industry. You can’t really do AI without all the data and technology underneath it, but you probably shouldn’t be doing AI without security either. It’s everywhere, everything all at once.”

That framing matters. Cyber doesn’t just compete for a slice of the tech budget. It’s embedded in every industry vertical that AI is entering. The opportunity is much larger than the category numbers suggest.

$76 Billion in M&A: The Great Bundling Has Started

The M&A story of 2025 is even more striking than the funding numbers. And it’s not just about the scale — it’s about who is buying whom.

Google acquired Wiz for $32 billion — the largest acquisition in cybersecurity history. That single deal accounts for 42% of all disclosed M&A value in 2025.

Palo Alto Networks acquired CyberArk for $25B. ServiceNow acquired Armis (IoT security) for $7.8B and Veza (identity governance) for $1B+. Mitsubishi Electric acquired Nozomi Networks (OT security) for $1B.

Notice what’s happening. It’s not just cyber companies buying cyber companies. It’s:

– IT buying cyber (ServiceNow/Armis)

– Manufacturing entering security (Mitsubishi/Nozomi)

– Cyber expanding into IT management (CrowdStrike pushing into CIO and CTO budgets)

Mike calls this The Great Bundling — and he says it’s just getting started:

“There are horizontal and vertical expansions happening at more and more turns, and the cyber industry is permeating more and more parts of life. These companies from outside of cyber entering this world through acquisition or product expansion will have many contacts and potential buyers that security companies may not already have.”

The boundaries between cyber, IT, and operational technology are dissolving. Everyone is reaching for not just the CISO budget, but the CIO and CTO budgets too.

The implication for founders: the enterprise sell just got more complex. But the opportunity is bigger. There’s a natural extension play into IT, OT, and security adjacencies that creates new leverage — if you think about it early.

Europe: Growing Fast, But Still at the Margin

Now for the part I care about most — and the part I want to be honest with you about.

Europe raised $1.33 billion in cybersecurity funding in 2025. That’s up 81% from $734M in 2024. The ecosystem is genuinely improving. Europe ranked 2nd or 3rd at every stage from Series A through Growth, and overtook Israel in Series C and Growth Stage rounds.

That’s the good news.

Here’s the honest picture: the US raised $18.5 billion. The US and Israel together accounted for 91% of global cybersecurity funding. Europe is at roughly 5%.

The M&A gap is even starker. Europe had 54 acquisitions — 16.9% of global deal volume. But only $290 million in disclosed value, versus $75.3 billion for the US. That’s not a gap. That’s a different planet.

I asked Mike directly: Is Europe catching up, or falling further behind? His answer:

“The growth is real and consistent. Europe showed remarkable consistency, ranking 2nd or 3rd at every stage from Series A through Growth.

The ecosystem sustains companies through later stages, even if it doesn’t produce the same concentration of mega-rounds. But the largest cybersecurity companies are overwhelmingly American — and sometimes that’s through Israeli companies that move to the US, so it’s not always clear-cut.

Until Europe produces more companies that can stay European and reach a billion-dollar scale, the value gap persists.”

Capital Stayed Home — And That’s a Big Deal

One of the most important findings in Mike’s report is about the direction of money flows — not just the amounts.

Mike had a theory when writing this year’s report — and the fact that he lives on both sides of the Atlantic gave him a different vantage point:

“Being an American who lives in Europe, you bring a different perspective and you keep an eye on what’s happening in the US, but you’re learning what’s happening where you live and how countries fundamentally approach these things differently. I had a theory that there would be some massive changes in the way people invested in cyber and where startups happen — that countries would start to say, we should probably invest more in our own ecosystem.”

The data confirmed it completely.

“The US went very insular and invested way more money locally than they did in other places. Consequently, their investments in Europe and the UK either stayed flat or went down. Europe stopped investing in the US as much. It invested in itself more. And then the UK had a very similar pattern — it didn’t invest as much outside the US, did a bit more in Europe, and surprisingly did a bit less on itself, which was concerning.”

The numbers behind this: intra-European cybersecurity funding grew +209%. European investors deployed 68% more capital at home in 2025 than in 2023. US investors’ appetite for European deals stayed flat. Cross-Atlantic flows from Europe to the US collapsed.

For Europe, this is potentially transformative — but only if the momentum holds. Initiatives like EU Inc. (making it simpler to operate across all member states) are exactly the kind of structural change that, as Mike put it, “will make this more appealing and easier to do and will concentrate things in Europe, but also broaden it.”

The virtuous circle that built Silicon Valley — exits generating capital, capital funding new companies, new companies generating talent, talent founding more companies — has to start somewhere. The data suggests 2025 may have been a genuine inflection point.

The UK Paradox

The UK story deserves its own section because it’s genuinely strange.

UK startup formation is growing. UK cybersecurity funding hit $580M (+41% YoY). Strong early-stage pipeline. But UK investors quadrupled their investments in the US (from $200M to $800M) and grew European investments 5x (from $63M to $300M) — while UK-to-UK funding stayed flat at roughly $60M annually.

UK investors are funding everyone else’s ecosystems. Not their own. Mike’s read:

“UK startup formation is growing and getting stronger, but UK on UK funding stayed flat at around $60M annually — meaning UK investors aren’t deploying domestically at scale.

Instead, UK capital is still leaving home. UK founders are building companies, but UK investors are still funding everyone else’s ecosystems.

Post-Brexit independence cuts both ways. UK founders face harder choices about where to scale, and they’ll ultimately look to the US and Europe for growth capital — and may move there too.”

It’s a chicken-and-egg problem. And unless a few major UK exits happen and seed the next generation of local investors, it’s hard to see the pattern breaking.

The Hard Truth About European Exits

I pushed Mike on exits — the part of the ecosystem loop that’s most broken in Europe.

“There’s still not much, to be honest. Most exits still happen either in Israel or in the US. More than half of the deals involve one service company buying another.

There are a couple of prolific MSSPs in Europe that are just buying every other MSP they can find.

But the large, flashy tech company buying a large cyber company? That still happens in the US or Israel.”

I shared my own experience here. When I sold my company (Sentryo) to Cisco, the value wasn’t in our revenue metrics. It was in what our technology could do to Cisco’s existing industrial network offering — putting security into hardware they were already selling at massive scale. The strategic leverage was what mattered, not the P&L.

Mike’s observation cut right to the issue:

“That highlights why there aren’t any large tech businesses in Europe making those acquisitions. The big service providers — Thales, Orange — are buying consultancies to roll up.

If there could be a large tech presence in Europe, they could start that momentum.

They should take a page out of the service provider’s book — these small companies might have little revenue, but it’s the access, the contracts, the geographic positioning that goes well beyond just a product SKU.”

European acquirers look at company metrics. They should be looking at strategic impact. That’s the mindset shift the ecosystem needs.

You Can Be Both

One thing I want to push back on — for the benefit of European founders reading this.

There’s a running mantra in European startup circles that you have to get to the US as fast as possible. That’s where the customers are, where adoption is faster, where capital flows more easily. Go early or go home.

Mike didn’t fully disagree. But he offered a more nuanced frame:

“You still can’t ignore the largest market. I still know of companies moving to the US because they have large financial services customers in New York — they feel compelled to move where those customers are.

But I think it will cause people to think more about a dual or multi-continent strategy. They may hire engineering talent in Europe or Australia, and do sales and go-to-market in the US where most of their customers are. I’ve seen a few companies do this pretty well.”

And the key line, which I want every European founder to hear:

“Be thoughtful about it instead of assuming that’s where you have to go. Because it’s an increasingly connected world.

A change of scenery doesn’t mean you all of a sudden get product-market fit. There are foundational things you have to do first that may not work in some regions — or at all.”

My take: you can be European-rooted and US-ready.

You don’t have to choose.

Build your engineering in Europe, raise your first rounds there, prove your business model works at a pan-European scale — and then deliberately scale into the US market.

We discussed that building an ecosystem takes 20 years. You build the first companies, have success, then hire more people, do the first exits, provide a good multiple to investors, and go on.

That’s also my personal story. I led as a CTO for a firewall vendor that exited to Airbus. Then I co-founded a startup that was acquired by Cisco. Now, I have built a venture builder for cyber. We are investing in a new generation of cyber founders and the next wave of companies.

His response:

“Yeah, that’s great. So you’re doing it. You’re making it better. You have to start somewhere. I see it changing in the UK; I see earlier-stage VCs forming, angel groups getting more structured.

I see the same thing in Europe. It’s the very beginning of a virtuous circle. The US has already had much of that happen many times over, so it’s a gravitational thing — where the money is, that’s where the companies and talent are. But you have to start somewhere.”

From 5 companies, you move to 20, from 20 to 100. It takes time. But it’s happening.

What’s Next: 2026 Will Be Offensive

I asked Mike for his 2026 predictions. Three things stood out.

Stealth mega-rounds are coming

Borrowing from the AI industry playbook — companies raising massive Seed and Series A rounds in stealth, then trying to make a giant splash.

The risk: everyone is competing for the same security budgets with similar-looking products. As Mike put it:

“Surely with a $100 million start, they’ll be better than the last one, who only raised $60 million.”

The market will normalise.

No IPOs

Mike was direct:

“I don’t think we’ll see any IPOs. It’s a terrible time to IPO — tech has not been good and the stock market is far too volatile at the whims of geopolitics.

Secondary sales are going through the roof.

And I think we’ll start to see the cannibalization of some of these markets where 20 to 50 companies look and feel very similar, and there are only so many exits there can be.”

The exit pressure is real — and it’s building. Secondary sales are the pressure valve. For now.

2026 will be an offensive security year

This is the prediction that surprised me most:

“I think we’re heading into an offensive security-led year, which I don’t think I’ve ever been able to say before. It’s usually very defensive.

I think we’ll see a lot more people doing red team stuff — and I wouldn’t be surprised if an AI red team or adversarial AI company is acquired because now everything can become an app very easily.

That’s going to come with a lot of security issues.”

The attack surface is exploding. AI agents, MCP servers, autonomous workflows — each one is a new vector. The security industry has always been reactive. But for the first time, Mike sees offensive capability leading investment.

One last moment from our conversation: I mentioned that Yann LeCun, the French AI researcher, had just announced a €1 billion seed round in Europe.

Mike’s reaction: “Yes. That’s amazing. That’s the kind of thing that needs to happen.”

He’s right. It does.

Conclusion — Three Things to Take Away

If you’re a European founder: The ecosystem is genuinely improving. Raise in Europe first — the capital is there and growing. But have a global mindset, expand quickly in EU countries, and plan your US go-to-market strategy early and separately. You can be both.

If you’re a European investor: The inward turn is an opportunity, not just a trend. The companies being built now on European soil with European capital are the ones that will generate the exits that fund the next generation. The virtuous circle has to start somewhere.

If you’re a CISO: The AI for security wave is coming, but it’s not going to replace your team overnight. It’s going to make your service providers dramatically more capable. Start thinking now about how you evaluate AI-augmented vendors — because they’re going to look very different from the ones you contracted three years ago.

The 2025 State of the Cybersecurity Market report is published in full on Return on Security. Subscribe to Mike’s weekly newsletter for year-round cybersecurity market intelligence.

Meet me at RSA Conference 2026!

Laurent 💚

Your security stack is built on a model that was never designed to survive what’s coming.

Seat licenses. Annual renewals. Feature tier upgrades. That’s the architecture of every major security vendor you rely on — your SIEM, your EDR, your GRC platform, your identity solution.

It was a great model. It made vendors rich. It gave you predictability. And it is fundamentally changing.

In this issue, we step back from cybersecurity to examine two forces transforming the software landscape.

First, AGC’s private equity data shows that SaaS growth, valuation, and exit dynamics are slowing, challenging the traditional focus on short-term VC rounds.

Second, AI trends are advancing across all categories: models with longer time horizons, agents capable of end-to-end tasks, and an economic logic that not only depends on humans in the loop.

By considering these long-term shifts—rather than short-term turbulence—we can better understand what’s ahead for security vendors, buyers, and builders.

In this post, we’ll explore:

• Why the classic SaaS model is stalling — and what the latest revenue, EBITDA, and PE data say about the end of “sell more seats” as a growth engine.

• How AI breaks the seat-based logic of software — shifting value from coordination (humans in the loop) to delegation (agents doing the work) as time horizons explode from seconds to 10-hour tasks.

• Why cybersecurity is the exception—and the test case — a market still growing and consolidating fast, with record funding, record M&A, and cloud-like AI absorption across SIEM, EDR, identity, and GRC.

• Three hard questions security leaders need to sit with now — from the Great Bundling, to AI security as a category vs table stakes, to what happens when agents start doing the work of your 40–70-tool stack.

The Math That Made SaaS Irresistible

For 30 years, enterprise software — including cybersecurity software — ran on a single beautiful logic.

Sell licenses. Expand seats. Lock retention. Repeat.

The numbers were almost magical. 70–80% gross margins, because software scales without factories. 110–130% Net Revenue Retention, meaning customers expanded faster than they churned. Predictable ARR curves you could forecast 24 months out. The software industry grew at 27% annually for four decades. Public markets loved it because you could model it in a spreadsheet. Valuation multiples expanded. Venture capital flooded in. Private equity built fortunes on it.

In cybersecurity, the model was particularly potent. Fear and compliance drove seat expansion. Breaches created a new budget. Regulation created new categories. Every new threat spawned a new vendor. Every new vendor raised a round, reached Series C, and IPO’d into a rich multiple.

The game was good. Really good.

The Slowdown: What the Numbers Say

Something changed. And the numbers don’t lie.

According to AGC Partners’ Q4 2025 Tech Capital Markets report, the top 167 public SaaS companies are projecting just 11% revenue growth for 2026. Not 70%. Not 30%. Not even 23%.

Eleven percent.

The causes are structural, not cyclical. Buyers are upgrading, not discovering — growth is incremental, not exponential. CISOs are drowning in vendors; budget is consolidating, not expanding. And investors are losing confidence: a PE firm won’t underwrite to an 8-year time horizon on a company with 10% growth and, in their own words, “inherent AI risk.” The math doesn’t work.

Revenue growth is falling to 11%, while EBITDA margins are rising to ~29%. The model is shifting from growth at all costs to profitable growth — but growth is still what commands premium valuations.

The private equity market reflects this stall. $444 billion in tech dry powder is sitting uninvested. 5,604 portfolio companies are waiting for exits that aren’t materializing. Only 215 exits happened in 2025.

The old playbook ran out of runway.

This Is Not a Feature Upgrade

Here is where it gets important.

AI is not just making SaaS better. It is replacing SaaS logic entirely.

The fundamental difference is this: SaaS monetized coordination. It made humans faster — better email, better CRM, better dashboards, better ticketing. The human stayed in the loop. You paid per seat because the value scaled with headcount.

AI monetizes delegation. It removes humans from the loop. For certain tasks, at certain time horizons — and that horizon is expanding fast.

METR (Model Evaluation & Threat Research) tracks what they call the time horizon: the length of a task — measured in human-equivalent time — that an AI model can complete autonomously with 50% reliability. They’ve measured it across every major model from GPT-2 to the present day.

The finding: AI time horizons have been doubling approximately every 7 months for six years straight.

Let the numbers land for a moment:

• 2020: AI could autonomously complete tasks taking a human ~4 seconds

• 2022: ~4 minutes (GPT-3.5)

• Late 2024: ~40 minutes (o1)

• Early 2026: ~10 hours (Claude Opus 4.6)

That last jump — from 40 minutes to 10 hours in roughly 18 months — is not incremental. The chart label at that level reads: “Implement complex protocol from multiple RFCs.” That is deep, multi-step knowledge work. Not trivia. Not autocomplete.

And the trend is accelerating. In 2024–2025 alone, time horizons doubled every 4 months, faster than the 6-year average.

If this holds, AI agents will autonomously complete month-long projects before the end of this decade.

What that means economically: if AI handles 20% of a knowledge worker’s time, you get a marginal efficiency gain. At 40%, you get a structural redesign of roles. At 60%, entire job categories mutate. This is not feature efficiency. This is time compression — and it breaks the seat-counting math on which SaaS was built.

For 30 years, software sold you tools that made your team faster. AI-native systems are becoming the team.

So Where Does Cybersecurity Fit?

Here is where most macro analyses get it wrong. They treat cybersecurity like any other software vertical.

It isn’t.

Cybersecurity has its own dynamics and its own demand triggers. Cybercriminals. Compliance. Breaches. Geopolitics. None of those go away because SaaS growth slows.

And the 2025 data backs that up. While the broader software market projected 11% growth, the cybersecurity market raised $25.1 billion in funding — up 59% year over year. M&A hit $76.4 billion, the largest total in industry history. Google bought Wiz for $32 billion — the largest cybersecurity acquisition ever.

So is cybersecurity immune to what’s happening in the broader software market?

Not immune. But different. And it’s a very large and growing market

Three questions are worth sitting with — and they don’t have easy answers yet.

Is the Great Bundling a response to the SaaS slowdown? The biggest players — Palo Alto, CrowdStrike, Google — are acquiring aggressively. Are they building platforms because customers want consolidation? Or because the era of standalone, seat-based point solutions is running out of room?

Is AI in security a new category — or just table stakes? AI Security (e.g., Securing AI models, preventing distillation, model corruption, etc.) accounted for only 2.6% of cybersecurity funding in 2025. But AI is being absorbed into every existing category: SIEM, EDR, identity, GRC — the same pattern cloud followed from 2010 to 2020. That might be the most important sign of how deeply it’s being embedded.

What happens to your 40–70 tool stack when agents start doing the work? If AI compresses the time a security analyst spends on tier-1 investigations, does that mean fewer seats? Fewer tools? Or more — because the attack surface is expanding just as fast?

These are the questions that matter now. Not in five years. Now.

The Stage Is Set. Now Let’s Zoom In.

The macro is turbulent. The old SaaS model is decelerating. AI is compressing work at a pace without historical precedent. The investment math that powered enterprise software for 40 years is being stress-tested.

And cybersecurity is right in the middle of it — but telling its own story.

To understand that story, I spoke with someone who has been building a rigorous, independent dataset on cybersecurity funding and M&A for four years running.

Mike Privette, founder of Return on Security, just published his 2025 State of the Cybersecurity Market report. $25.1 billion in funding. $76.4 billion in M&A. A geographic concentration story that should make every European founder and investor pay close attention.

I got on a call with him to go deeper.

Next issue: The conversation — and what the data reveals about where cybersecurity actually stands.

Laurent 💚

Sources: AGC Partners, Tech Capital Markets Update Q4 2025. METR, Task-Completion Time Horizons of Frontier AI Models (March 2025) & Time Horizon v1.1 (January 2026).

In recent months, I’ve looked at how cloud, SaaS, and now AI are changing cybersecurity go-to-market strategies. This post wraps up that series, and it’s the one that matters most.

This isn’t just another round of new features. There’s a real shift in how cybersecurity value is built, delivered, and sold. The lines between software vendors, system integrators, and MSSPs are fading. At the same time, AI is starting to automate work that used to require skilled people—like tuning detections, triaging alerts, running investigations, and making recommendations.

As product and service lines blur and AI automation grows, every business model in cybersecurity has to adapt. Software vendors are acting more like service providers. Service companies are increasingly looking like product companies. Everyone—from startups to global integrators—needs to decide what people should build, what models should handle, and where they can stand out.

In this piece, I want to zoom out and look at that bigger picture. How exactly is AI changing the nature of protection and detection? What happens to traditional service models when growth is no longer tied linearly to headcount? And how should MSSPs, system integrators, and other service-oriented businesses respond if they don’t want to wake up and find themselves displaced by AI-native competitors or aggressive roll-ups?

I’m not here to add more AI hype. My aim is to lay out the real changes I see ahead—from how products are built and delivered to how services are packaged, priced, and scaled. If you’re running a cybersecurity business, these shifts are real. They’ll affect your go-to-market strategy, hiring, margins, and your market position.

The Blurring Line Between Products and Services

AI isn’t just another feature to add to products. It will change core protection and detection, and it will shape how users experience solutions. Most importantly, it will decide which tasks machines do and which stay with people. This is a key shift everyone needs to understand.

The line between products and services is blurring fast. In the past, software vendors hired developers and sales teams to build strong software for their customers and industries.

System integrators bought off-the-shelf software and focused on installing, configuring, and supporting it for customers. They were the last-mile partners for vendors, especially in security, with products such as Palo Alto, Fortinet, and Stormshield in Europe.

Today, cloud and managed services have already changed this setup, and AI is speeding up the shift. We’re seeing more mergers and acquisitions as big software companies buy service providers.

AI is the Engine of Scaling Beyond Artisan Security

Yet, AI’s impact will go much deeper. Technologies that empower AI models to But AI’s impact goes further. Tools powered by AI aren’t just about automating repetitive work.

Instead of spending hours configuring a tool, you could review the documentation, follow clear steps, ask a few questions, or check with your network. The product, likely cloud-based, would be installed, and AI would handle the expert tasks SOC analysts used to handle.

It is like the Industrial Revolution. In the past, skilled professionals developed their own tools, as artisans do. Their output was limited, even if they knew exactly what needed to be done. Mass production was the challenge.

I see the same thing in big enterprise SOCs and MSSP teams. Talented engineers build custom rules and playbooks, and share their insights online. But even when they know what needs to be done, scaling up is still hard.

3 Pillars of AI-Ready Service Models

What does this shift mean for service companies?

#1 - From Headcount-Driven to Model-Driven Growth

First, business growth won’t depend on hiring more people. Service companies used to rely on engineers and consultants to deliver value.

With AI and automation, you don’t need to grow your team just to serve more customers.

You can design services that are partly automated and partly digital, so you can scale without adding headcount. It’s like moving from artisans to a factory model.

#2 - From One‑Shot Audits to Continuous Security Progress

Second, service companies can’t just rely on expert-driven audits. In cybersecurity, the first step was often an audit, including a report and an action plan (or a wish list, as many don’t get applied!).

But customers want more than a snapshot.

They want ongoing, steady improvement. If your service doesn’t help them get better over time, it’s not enough. Services should work like modern software: deliver value right away, then add more as needed. A one-time audit doesn’t cut it.

#3 - From Custom SOCs to Productized Managed Defense

Third, service companies need to think like product companies. In software, product managers look at trends, customer needs, and feedback to plan for the future.

In services, this kind of product mindset is often missing. Service companies do not have product managers.

MSSPs have done well with managed services, but their approach is usually reactive. Many customers chose MSSPs because they couldn’t run 24/7 security teams. At first, each SOC was custom, but now the model is more shared.

Still, only a few companies, like Arctic Wolf, have really taken a product-driven approach to managed services.

Conclusion - AI Roll-Ups and the Future of Cyber Services

It’s a tough moment for service company CEOs. Will they use AI and build AI-enabled managed services before customers ask for them, or risk being replaced by startups or AI-driven roll-ups?

The roll-up model is worth watching. Big venture funds like General Catalyst are buying established service businesses in fields like legal, accounting, IT support, and cybersecurity. They’re rebuilding these services with AI, replacing work that used to need large teams of junior staff with AI agents. These are the AI roll-ups I mean.

If you want to discuss this further, feel free to reach out.

Cybersecurity marketing is undergoing a transformation. For years, the industry was notorious for its lack of originality—repetitive jargon, endless acronyms, and the ubiquitous image of a padlock on a dark background. Every company seemed indistinguishable from the next.

But the landscape is shifting. A new wave of startups is breaking the codes and injecting new ideas, more creativity, and authenticity into how cybersecurity is communicated. This evolution is refreshing. It’s also reshaping how the industry connects with its audience.

In this post

• Why traditional cybersecurity marketing feels repetitive, fear-driven, and visually indistinguishable.

• How Wiz’s pop‑art approach kicked off a new, brighter, more welcoming visual language in security.

• Four standout startups (Mokn, Legion, Vega, Mate) and the metaphors behind their bold aesthetics.

• What these new designs reveal about communicating trust, innovation, and human‑centric AI in cybersecurity.

How ChatGPT sees a cybersecurity company

Let’s start with a simple experiment: I asked an oracle—ChatGPT—to sketch the homepage of a cybersecurity company selling advanced detection systems.

The result? A familiar, almost predictable template: dark backgrounds, flashes of blue, pink, violet, or green, padlocks, hooded hackers, and abstract spirals of pixels. It’s all very sci-fi—but in the worst sense of the term. The visual language is so standardized that you’d be hard-pressed to tell one company’s site from another’s.

AI-generated content is a symptom of an industry that, for too long, has relied on the same tired tropes to signal “security.”

I personally see this as a big irony. In an era where differentiation is everything, cybersecurity marketing has become a sea of sameness. The question is: How do we break out of this visual and narrative rut? And more importantly, what does it say about how we communicate trust, innovation, and value in this space?

The turning point - Wiz “pop-art” marketing

One company broke the code.

A few years ago, a now-famous player—Wiz—started using light blue backgrounds and bright pink accents for text and diagrams. Their event booths looked like something out of an Andy Warhol exhibition: shiny, saturated colors everywhere.

The message was clear: cybersecurity doesn’t have to be dark and fearful. It doesn’t always need to look sci-fi. It can be bright, colorful, and welcoming.

If you want to dive deeper into their marketing tactics, I highly recommend Tom Orbach’s blog, which is packed with fresh ideas for cybersecurity brands.

2026 startups are all-in on this new marketing

But the best startups today understand this shift. They adopted a new aesthetic, a new approach to design. Let me share some examples of what I consider the most innovative and interesting in the market.

I selected four startups: Vega, Mate, Legend, and Mokn, all with very different looks, all new, and not the dark look we used to use in our field.

Mokn

See https://www.mokn.io/

Most cybersecurity sites rely on shields, locks, hackers in hoodies, network graphs, and blue gradients, but this image avoids all those clichés by using a metaphorical object that feels engineered, contained, controlled, and powerful.

The horizontal split line is psychologically powerful.

It suggests that hidden threats lie beneath the surface and Credentials Are compromised out of sight… A world users don’t see. Credential attacks are often invisible (token theft, session hijacking, cookie replay, MFA bypass). This visual reflects that reality without explicitly explaining it.

There are no product screenshots, no feature lists. But the claim is bold, emotional, outcome-oriented: End credential threats.

Legion

See https://www.legionsecurity.ai/

What do we see on their website? A soft pastel landscape with hills and clouds, a medieval castle on the left, a dragon flying in the sky, a dragon egg in the foreground, glowing. What does it mean?

It looks like a fantasy book cover or a Pixar concept art. Some elements of pop culture.

The “Dragon Egg” metaphor is clever. The egg represents potential and personalization—something uniquely yours. The baby dragon signifies power, autonomy, and guardianship.

In cybersecurity, this metaphor relates to AI trained on your analysts’ workflows, capturing institutional knowledge, and scaling human expertise.

Vega

See https://vega.io/

Vega feels a bit more geeky, using retro-gaming code as another pop culture element. It features a full pixel-art aesthetic (8-bit/retro video game style), with green grassy landscapes and a small pond with a pipe pouring water.

It makes it impossible to confuse them with Splunk, Datadog, Elastic, Sentinel, or CrowdStrike.

The gardening metaphor is strategic: security operations are messy—too many logs, too much data, too many alerts, overgrown systems. The pixel garden subtly suggests cultivating your environment, increasing visibility, managing complexity, and maintaining health.

“I Can’t Believe It’s Not SIEM”. This line is category positioning genius.

In a few words, they are claiming: “We are in the SIEM category. But we are NOT traditional SIEM. We replace SIEM complexity. We simplify without losing capability.” Congrats!

Mate

See https://mate.security/

My preferred aesthetic emphasizes a minimalist visual style: a beige background with a prominent black brushstroke circle (Zen enso) and minimal decoration The central visual element is a Japanese Zen-style enso circle, painted with a rough brush.

The enso symbolizes mastery, experience, discipline, and the idea of completing something without perfection. In Zen philosophy, it embodies strength through restraint, wisdom through practice, and simplicity that arises from mastery.

This design says: we don’t need noise. We don’t need glowing dashboards. Nor do we need metaphors of dragons or gardens.

It’s almost luxury-brand minimalism. Channel, Vuitton, Hermes. Gucci

This indicates that AI should serve as a support function, with human wisdom remaining central. It aligns with the idea that AI augments security professionals rather than replaces them.

Conclusion

Cybersecurity doesn’t have to hide behind shadows and buzzwords. The new generation of security startups is proving that bold visuals, clear metaphors, and human‑centric AI can make complex technology feel understandable—and even enjoyable.

This shift has started with a few brave teams. The question now is: will the rest of the industry follow?

I’ll be at RSA Conference 2026 - please DM me to route me to the most innovative booths and companies.

Last week, I started a series on go-to-market and cybersecurity. The key idea was that you need to build trust with your market and customers to sell a cybersecurity product.

This week, I want to focus on the second kind of trust: trust with your partners and ecosystem. These are the people and organizations you need to build bigger, stronger cybersecurity companies over time. Analysts, channel partners, consulting firms, marketplaces—every cybersecurity company has to work with at least one of these.

In this post:

• Rethinking Indirect Channels in a Cloud & AI World
  How cloud and AI have changed the role of resellers and local partners, and why you still need trusted local relays to scale your security sales.

• From Features to Outcomes: How Analysts Really Think
  Why analysts like Gartner and Forrester don’t care about one extra feature, but about outcomes, use cases, and clear roadmaps your customers can execute.

• How to Work With Consulting Partners as a Startup
  What consulting firms actually sell, how they influence RFPs and vendor selection, and how startups can share expertise to build credibility without over-investing.

• Turning Marketplaces Into Growth Engines
  How security marketplaces from AWS, Microsoft, CrowdStrike, Palo Alto, and others work, why platform consolidation matters, and how startups can pick the right platform to go deep with.

  

  If you prefer to listen

  Here is also the audio interview format generated with Notebook LM

Rethinking Indirect Channels in a Cloud & AI World

Let’s start with indirect channel partners—probably one of the most misunderstood partner types for startup founders. They are changing rapidly, with even more transformation ahead in the coming years.

I remember when, as a software publisher or network appliance vendor, the only way to reach customers was through regional resellers. This was because IT systems were deployed on-premise within enterprises and required significant expertise to set up, install, configure, and train users. It was a real skill to install Windows NT, deploy software, set up databases and application servers, and configure everything. You had to be “at your customer”, traveling with your car to their offices.

Things have changed dramatically with the cloud, where deployment is no longer a barrier, and everything is accessible via a mobile phone or laptop. Now, with AI, the landscape is evolving further. AI agents are no longer just systems of record with forms, reports, and databases; they are becoming real workers, producing incremental output and functioning almost like employees. This shift deserves its own deep dive, which we’ll tackle in a future post.

Given these changes, many founders—especially those from technical or security backgrounds—ask: Why should I partner with local players at all? 

The answer is simple: you need a local trust relay for your company. If you’re based in one city but want to sell security solutions to large, mid-size, or small enterprises, you need someone local. This person helps the company understand why your tool is better than alternatives and how it fits their needs. Local presence matters.

There’s also the cost of sales to consider. You can’t hire a global army of SDRs and salespeople to cover every country. To scale as a security entrepreneur, you need local relays who understand customer culture, how projects get approved, how purchasing decisions are made, and who have their own networks.

How to start working with channel partners?

So how do you actually start building these partnerships and earning their trust?

First, you need early references. You’ll have to sell directly to your first 20 or so mid-market companies—closing those €50k–100k deals yourself. This proves your product fits the market, addresses a real need, has genuine use cases, and shows low churn.

Many founders make the mistake of thinking that signing a partnership means the partner will start selling right away. That’s not how it works. If you’ve ever worked in retail, you know that just putting a product on the shelf doesn’t mean it will sell.

You need to invest in partner marketing. Train them. Provide tools, animations, discounts, webinars—resources they can reuse. Crucially, you need to generate leads and share them with your partners. This is often confusing for founders: Why should I do all this work, incur these costs, offer a 30% discount, and then hand over the lead for them to close?

The answer is that building a sales machine with partners takes time. You’re laying the foundation for trust. Once that trust is established, partners will replicate your success. They’ll take the deals you’ve closed together and apply the same approach to their other customers. But to reach that volume, you have to set up all these elements first.

From Features to Outcomes: How Analysts Really Think

The second type of partnership you need is with analysts. We all know their names: Gartner, Forrester, KuppingerCole, Omdia, and many others (like the great Francis Odum). These firms specialize in screening markets, categorizing them with acronyms (I’ve already covered this in my 12 cybersecurity platform categories), and providing insights into what matters in a given offering—and what doesn’t.

Analysts have a significant influence on cybersecurity. Most customers don’t have the expertise to sort through all the options, so they rely on analysts for guidance. Analysts create plans, offer advice, and share research. Their insights help move the whole market forward.

Yet, I frequently hear security founders dismiss analysts with comments like, “This is nonsense. We don’t need them. They don’t understand what we do. We’re better than the rest, and we’ll prove it.” This reaction reveals a fundamental misunderstanding of what analysts actually do.

Founders often assume it’s a technological game—where detection rates, threat analysis, and benchmark performance are the only metrics that matter. They expect analysts to act like a scientific review committee, evaluating products solely on technical superiority.

But that’s not what analysts do. They are market analysts, not technologists. Their focus is on how customers can achieve meaningful outcomes, not just on the technology itself. They value use cases, organizational impact, and practical guidance on structuring teams or projects to execute security programs effectively.

It’s not about having one more feature than a competitor; it’s about articulating a clear, actionable vision that aligns with the market’s current state. Customers want a step-by-step strategy they can implement, especially as technology evolves and new threats emerge.

They seek experience sharing, guidance, and meaning—exactly what analysts provide.

When you talk to analysts, take your time and be thoughtful. There are proven ways to work with them. Richard Stiennon’s book Up and to the Right is still a great resource, even after 15 years. I recommend reading it.

How to Work With Consulting Partners as a Startup

Consulting companies represent a third type of partner you need to consider. Unlike indirect channels, they typically do not resell products—it’s not part of their business model. Margins on product resale are too low for their model, and they prioritize maintaining the trust they’ve built with customers by providing workforce and expertise.

Many consulting firms assist large enterprises in drafting RFPs, setting up evaluation labs for shortlisted vendors, and advising CISOs and their teams on vendor selection. Like analysts and channel partners, consulting companies are interested in the knowledge and insights you can offer as a vendor.

However, the wrong approach is to simply share your marketing materials with them. Instead, focus on sharing your unique perspective: Why do you believe things need to change? Why is your approach better for solving specific challenges? What sets your solution apart?

I don’t believe consulting firms are inherently innovative in building groundbreaking solutions. Their core business is selling the talent and expertise of young, college-educated professionals. While they excel at this, only a limited number of individuals—usually senior partners—are capable of producing cutting-edge content on emerging threats or trends.

These senior partners may only be invoiced for a few days per deal, but they are the ones who can provide the most valuable, high-level insights.

For startups and new vendors, engaging with consulting companies is important, but it’s not where you should focus all your efforts. It won’t have an immediate, direct impact on sales. However, if you’re targeting enterprise customers, it’s better to be known by these firms than to be unknown.

Consulting companies often host brown-bag lunches, internal labs, and meetups—casual events where you can share your expertise and engage in informal discussions. These are the kinds of opportunities you should pursue. Expert exchanges with their workforce, even in informal settings, can be valuable for building credibility and visibility.

Turning Marketplaces Into Growth Engines

Last are the marketplaces—the newest category in the cybersecurity ecosystem. Many vendors, especially large platforms like CrowdStrike, Palo Alto, Cisco, Google, AWS, and Microsoft, offer partnership programs to join their marketplaces. These platforms attract customers by offering a wide range of pre-integrated security services, unified under a single user management, data storage, analytics, and reporting system. The goal is to simplify the customer experience: instead of managing 50 different vendors, they can consolidate most of their needs into one or two platforms.

This shift toward platform consolidation has been a major trend in the security business for years. It’s also created significant M&A opportunities for startups, as large US companies have been acquiring three to five startups per year for the past decade.

These platform builders have dedicated teams to integrate acquisitions into their platforms, align company cultures, and streamline program management—all to accelerate execution. However, they recognize they can’t do everything themselves. There will always be gaps in their platforms, not because they lack the best product or feature, but because their strategy isn’t to be the best in every category—it’s to be “average plus” across the board.

To fill these gaps, platforms open marketplaces where independent vendors can offer their products, pre-integrated with the rest of the platform. For customers, this means if their core platform lacks a critical capability, they can connect to the marketplace and deploy what they need.

The next step for these platforms is to enable seamless purchasing: customers can hit “buy and deploy,” and everything is handled automatically. This approach has been powerful, driving significant business for vendors like Wiz and Snyk, particularly on AWS, which has replicated the e-commerce marketplace model of its parent company, Amazon. Just as Amazon became the go-to place for online shopping, these platforms aim to become the default destination for IT security and infrastructure.

For startups, you need to be on these marketplaces. You’ll probably have to pick one platform to go deeper with, since they offer big incentives. For example, if you move part of your backend to AWS, they might give you discounts or credits as you grow your SaaS on their marketplace. It’s a win for them and a growth opportunity for you.

Conclusion - Build the Trust Web Around Your Product

If you’re building a cybersecurity company, you can’t do it alone.

• Indirect partners give you local trust and reach you’ll never match with your own sales team.

• Analysts shape how buyers think about your category and what “good” looks like.

• Consulting firms influence RFPs and shortlists long before you ever see a deal.

• Marketplaces are becoming the default path for buying and deploying modern security stacks.

You don’t need to go all‑in on every motion from day one. But you do need a deliberate view of which partners matter for your segment, and in what order.

Start by proving you can sell directly. Then add the right partners, one layer at a time, so your credibility, distribution, and deal size grow together. That’s how you turn trust in the ecosystem into a real go‑to‑market advantage.

Happy to discuss all these topics with the Cyber Builders community

Laurent 💚

Every day, I talk to security pros, MSSPs, CISOs, risk analysts, SOC operators, and more. They tell me what frustrates them, what they want, and where cybersecurity still falls short.

At the same time, I work daily with startup founders—passionate individuals driven to build businesses and innovate.

In today’s world, especially with the speed of AI, change is rapid. But what does not change is how to reach your next customers, build trust, and partner with them. Going to market in cybersecurity requires best practices and has specific requirements.

I’m kicking off a new series on GTM. In the coming weeks, we'll explore topics that help founders navigate the evolving cybersecurity landscape. You can look forward to insights on connecting with security professionals and understanding how the shift towards AI-driven solutions impacts traditional practices. My goal is to enhance your go-to-market strategy effectively.

In this post:

• Why cybersecurity GTM is different from generic SaaS playbooks – and why trust, not features, is your real product.

• How to think like a cybersecurity GTM leader – balancing experimentation with rigor, and urgency with compliance.

• How to build “Time to Trust” – by educating customers, demonstrating credibility, and simplifying how they validate your solution.

• Why intensity is non‑negotiable – what consistent, high‑tempo execution actually looks like for cyber startups.

• How to adopt the correct posture in sales – selling without overselling, focusing on outcomes over features, and knowing your place in the stack.

• Why fear‑mongering destroys long‑term value – and how to build durable trust instead of short‑term FUD.

By the end, you’ll have a practical mental model for designing, testing, and scaling a go‑to‑market motion that actually works in cybersecurity.

The Go-To-Market Mindset in Cybersecurity

Cybersecurity GTM is its own beast. Most SaaS playbooks don’t fit. Sales cycles are longer, stakes are higher, and trust matters more than anything. I already covered it in this piece

In this post, let’s break down the GTM mindset that sets winning cyber startups apart. There are three things to focus on:

• The Mindset: How to think like a cybersecurity GTM leader—balancing urgency with precision, and innovation with compliance.

• The Intensity: Why the pace and energy in cybersecurity GTM are different, and how to sustain momentum in a rapidly evolving threat landscape.

• The Posture: The unique stance you need to take with customers, regulators, and partners—confident, transparent, and always one step ahead.

Each of these elements is critical, and while you can learn from generic GTM wisdom, cybersecurity demands a specific approach. Let’s see how you can leverage that to your advantage.

Time to Trust: The Expertise Gap in Cybersecurity Sales

When you sell a security product, you’re not just selling features or performance—you’re selling trust. And trust in cybersecurity is built on expertise.

Say your product stops a new threat—ransomware, deepfakes, or IoT attacks. Your customer already uses the tech at risk. They have compliance boxes to check, defenses in place, and maybe some battle scars. They want better protection.

But here’s the thing: they don’t know what they don’t know.

Your customer lacks the deep technical expertise to grasp the threat landscape fully. They don’t know the actors, the attack vectors, or the nuances of how vulnerabilities are exploited. They don’t understand all the details of that new regulation. They can’t evaluate whether your solution truly meets their needs—or even how to test it effectively. How can they assess protection against threats they don’t understand?

This is why Time to Trust matters. Your job isn’t just to sell. You need to close the knowledge gap. Here’s how:

• Educate without overwhelming: Help them understand the threat in terms they can grasp, not just technical jargon. Consider customers’ environments and the business impact of potential threats, such as downtime or personal data leakage.

• Show your credibility. Don’t just talk—prove how your solution tackles their real risks. A contextualized demo worth 100 slides. Make the product easy to use.

• Make validation simple. Give them clear, hands-on ways to see your product work, even if they aren’t technical. Onboarding should be smooth, and their first hour should make sense.

In cybersecurity, trust isn’t built overnight. It’s earned through expertise, transparency, and a relentless focus on the customer’s real-world challenges.

GTM Mindset - All about Experimentation

Too many founders over-engineer their go-to-market. They spend weeks perfecting a lead generation pipeline, crafting the “perfect” LinkedIn post, or writing the ultimate blog article. But at the early stage, GTM is not about perfection—it’s about experimentation.

You don’t know what will work yet, and that’s fine. Your job is to test, over and over:

• What problems are most urgent for your customers? (Not what you think they are.)

• Which parts of your value proposition resonate? (Not what you hope will resonate.)

• Where are your customers most open to hearing from you? (Not just LinkedIn, email, or events—but a mix of all, and more.)

• How do they want to engage? (Not how you assume they want to engage.)

There’s no magic answer. You have to try, measure, and adjust.

Intensity - A must-have

Here’s another hard truth: One post a week, a few emails, and hoping for the best won’t cut it. If you’re targeting mid-market or enterprise customers, you need to be everywhere, consistently. Think:

• 3+ LinkedIn posts per week (not just one).

• A newsletter every two weeks (not “when you feel like it”).

• Multiple articles, webinars, and 100+ cold outreach efforts per week (not a handful).

If you’re selling to a wide audience, like AI tools for individuals, you need even more intensity. Your buyers see endless options. You have to be in their feed, inbox, and conversations every day. If you’re not everywhere, you’re invisible.

The market rewards speed and hustle, not hesitation. Move fast, learn faster, and outwork everyone else.

Posture: The Art of Selling Without Overselling

You’ve finally secured that meeting. Now, the real challenge begins. At the early stage, your product is still evolving, and your customers are already drowning in tools. Your posture must reflect humility, clarity, and a deep understanding of where you fit, not as a silver bullet but as a strategic addition.

Know Your Place in Their Stack

Don’t oversell

Your customers know you won’t solve all their problems. They’re already juggling a dozen tools, many of which frustrate them. If you walk in without a clear answer to these questions, you’ll lose credibility:

• What specific market segment are you addressing?

• How are you different—not just better—than incumbents in that segment?

• What tangible outcome will your customer achieve?

If you can’t answer these, you’re just more noise.

If you come to them without a clear understanding of your market segment—without being different, not just better, than the incumbents—and without a clear customer outcome, you’ll lose credibility fast.

Outcomes Over Features

From my experience building and exiting businesses in network and OT security, here’s what most customers actually need:

• Better reporting: not more alerts, but clear, actionable insights they can share with execs and teammates.

• Better productivity: tools that save time, not add work. If your product requires a PhD to run, forget it.

Example: One company I worked with wasn’t the “best” cloud security scanner in terms of depth. But they won because they offered a seamless UX—closer to B2C than traditional B2B—and a refreshing, approachable brand. Their unfair advantage? They made security fun and easy, not another chore.

The Power of Simplicity

Cybersecurity management is already a moat. If your product adds complexity, you’ve failed. Your posture should communicate the following:

• “We understand your pain.”

• “We’re here to make this one thing easier.”

• “Let’s start small, prove value, and grow together.”

This isn’t about underselling—it’s about right-selling. Customers respect honesty. They’ll remember the vendor who helped them sleep at night, not the one who promised the moon.

Fear-Mongering Is Not an Option

Let’s be clear: fear-mongering is a dead end. Telling customers they’ll get hit if they don’t buy your tool might get you one sale, but it kills trust. You won’t get renewals, upsells, or long-term relationships that way.

Mid-market and enterprise buyers already have too many tools. They don’t need more fear. They need clarity and real value. If you want trust, show how you make their life easier—not scarier.

Conclusion: Build Trust, Not Fear

Trust is your real currency in cybersecurity. You don’t build it with fear or hype. You build it with honesty, clarity, and by focusing on what customers actually need. You’re not just selling a product—you’re building a partnership.

Experiment, go all in, and remember: the goal isn’t just a sale. It’s a customer for life. That’s how you build a real business in cybersecurity.

The world’s heart beats in bytes, and right now, it is racing. Driven by AI and Digital Technologies (“Tech”), the global pulse is accelerating. Yet, here in Europe, it often feels like we are out of breath.

Imagine standing in a long queue at a busy European border crossing. While the digital world sprints, you are watching a single customs officer stamp passports by hand, echoing a past era. It feels like the system is struggling to keep up.

Society always moves forward; there is no way back to heavy files or horse-drawn carriages. But my fellow Europeans are often seen as reluctant to embrace the “tech cardio” needed to compete. This isn’t just inflexibility—it’s a complex mix of culture and history. But if we want to stay in the race, we need to understand it and fix it.

As an optimist, European entrepreneur, and engineer, I’ll break down why Europeans are reluctant to adopt digital technologies, why we need broader engagement, and how we can grow our economy.

Tech is not political by itself. It is how we use these technologies that matters. I believe that hardware, software, and digital services can help us tackle big challenges like inequality, the gender gap, access to education, demographic decline, and climate change.

In this post:

• Tech is at the center of politics in the US and China. The US Tech-right and China’s techno-utilitarians use digital technologies differently, aligned with their political goals.

• In this context, Europe has no role models and lacks leading companies in digital technologies. We do not have a software equivalent to the East India Company or even a decentralized version like Die Hanse.

• The 19th and 20th centuries shaped how Europeans structured their democracies and values. In the twenty-first century, Tech is now at the center of foreign policies.

• The heart of the world beats in bytes. Europe is losing economically. Europe's digital technologies deficit with the US is €260 billion. Europe is trapped, trying to mimic ecosystems like Silicon Valley.

Here are some perspectives on how to invent a new European model. We should not copy others, but create something different, rooted in European culture.

How the US and China Politicised Technology

The US “Tech Right” and Accelerationism

In the USA, apparently from early 2024 but in reality for a decade, the Tech scene in the valley has aligned its interests with the right wing of the Republican Party. Peter Thiel and Elon Musk are often cited as being at the center of this shift.

The term itself, “Tech Right,” is confusing. It includes many different flavors:

• Technolibertarianism — shares the deregulation and market freedom emphasis, but is broader and not strictly politically right-wing.

• Techno-populism / techno-fascism — some Tech Right elements blend tech elites with anti-democratic tendencies or corporate dominance.

• Californian Ideology — an older Silicon Valley cultural mix of neoliberalism and techno-optimism, sometimes seen as a precursor.

But it would be too caricatural to classify ALL Tech Entrepreneurs, their investors, or their staff as right-leaning. I worked for a valley’s company, working with many teams. The blend of different cultures, people coming from all over the world, was powerful. They are willing to develop technologies AND build a better world, code software AND fight to address inequalities, sell Tech products AND bridge the gap with those who are not part of their world. It is not exclusive. Both can be done at the same time.

On the other end, some “effective accelerationists,” not politicians but entrepreneurs and investors, are very vocal. They are now creating podcasts, books, and blog posts to explain their views in great detail. If it’s not politics, it is very close.

The most significant one is Marc Andreessen, founder of Netscape in the 90s and now CEO of A16z, the world's largest and most influential investment fund.

We believe markets lift people out of poverty – in fact, markets are by far the most effective way to lift vast numbers of people out of poverty, and always have been.

[…]

We believe markets are an inherently individualistic way to achieve superior collective outcomes.

Marc Andreessen - The Tech-Optimist Manifesto

The Techno-Optimist Manifesto is not simply advocacy for technology, but a normative manifesto that sees technology as the fundamental moral force for human progress and argues for accelerationism and market-driven innovation as the best means to achieve abundance and address existential challenges. Andreessen clearly values technology's rapid deployment over a more careful, balanced societal approach.

In this vast range of opinions, an independent writer focused on tech culture and Silicon Valley politics offers a very balanced perspective. Her Tech Right piece attempts to clarify a muddy, contested label that surged in public discourse in 2024 as tech leaders (CEOs, investors, founders) began publicly aligning with right-wing politics — especially around the 2024 US election and the Trump administration.

The ‘Tech Right’ is just one faction in a rising alliance of thinkers, policymakers, and industrialists…united by their focus on accelerating American innovation to drive growth and global primacy…

Jasmine Sun (link)

What Is “Techno-Utilitarianism” in China?

If the American “Tech Right” illustrates how digital technologies relate to a hyper‑market, hyper‑individualist political project, China offers a very different, almost mirror‑image approach. Where Silicon Valley’s right‑leaning faction wraps Tech in the language of personal freedom, disruption, and private capital - at the cost of inequalities and poverty -, Beijing treats it primarily as an instrument of state power and collective outcomes. This is where the idea of “techno‑utilitarianism” in the Chinese context comes in.

The phrase "techno-utilitarianism" isn’t formally defined in a single Chinese policy document, but scholars and analysts use it to describe China’s pragmatic, outcome-focused embrace of Tech, in which technological adoption and deployment are pursued rapidly to achieve state goals, with less preoccupation with intermediate ethical or legal debates.

Tech is treated as a tool to achieve national outcomes — economic growth, global competitiveness, social control, and geopolitical influence. Technological risks (e.g., privacy or ethical concerns) are often addressed after deployment rather than before. The state plays an active role in directing resources, setting incentives, and providing structural support for prioritized technologies.

China's large population, coupled with a willingness to organise society as efficiently as possible, means that Chinese citizens trade many of the democratic rights enjoyed by citizens in other countries in exchange for a better material life. With the rise of AI, Tech helps to build a social score, the Social Credit System, where each citizen is scored based on their behavior in the public space. The score is then used to “logically” order citizens for many public services or their corporate lives.

Note that many researchers have found that this system is highly dysfunctional but less dystopian than we might fear.

Europeans don’t trade control for speed

19th-Century Progress and Empire

Both approaches are very frightening for Europe. Europe does not adopt the “move fast and break things” mindset. European citizens are conscientious about their privacy and rights, and are highly mindful whenever a new technology threatens to reverse what Europeans have achieved over centuries. Europeans don’t trade control for speed.

Europe is a continent with a long history of technological revolutions, imperialism, and the eventual rise of democracy.

In the 19th century, it experienced extensive manufacturing and later established social benefits and labor unions. During this period, Europe invented the steam engine, pioneered steel production, and developed electricity-based products. Advances in hygiene, led by figures such as Joseph Lister and Louis Pasteur, enabled Europeans to live longer. Vaccines and other medical progress further improved public health. The mining industry exploited a vast workforce, leading workers to unionize and eventually secure social benefits.

At the time, the United Kingdom, France, and Germany were at the forefront of modern societies. They pursued large-scale colonialism—the UK alone ruled over nearly half a billion people worldwide—and their populations rapidly escaped poverty. This period marked a significant step forward for many who had previously endured suffering and poor health.

20th-Century Catastrophe and the Birth of a New Political Culture

The 19th century was, on balance, an age of extraordinary prosperity—creating new societies centered on industrial progress, manufacturing, and public health. We should not forget also the human cost of running a worldwide empire.

The 20th century turned into a century of trauma and backlash. Two world wars, the Holocaust and other genocides, the rise and fall of totalitarian regimes, and the long, painful end of colonial empires forced Europeans to confront the darkest possibilities of power, nationalism, and ideology.

Today, I don’t think any European is seriously looking for solutions rooted in colonialism or imperial expansion. Those paths are widely understood as moral and strategic dead ends. Yet even as empires unraveled, deep inequities and class divides persisted within Europe itself, and their legacy is still visible.

This combination of 19th‑century optimism and 20th‑century catastrophe profoundly shaped how Europeans think about politics, institutions, and technology. It explains why, when new waves of disruption arrive—whether nuclear power, genetic engineering, or now digital technologies—Europe’s first reflex is caution: to ask how power could be abused, whose rights might be trampled, and what guardrails are needed to prevent history from rhyming again.

Why This History Produces Today’s Europeans Attitude

This history has shaped how Europeans structured their democracies, laws, and institutions. That’s why they believe in multilateralism—a network of different states and cultures embodied by the European Union—and in the rule of law, collaboration, and conversation rather than the rule of power or the dominance of the strongest.

Europeans value freedom of speech, but the promotion of hate, genocide, and terrorism is strictly forbidden. They also uphold freedom of religion, though in France, there has been a strict separation between church and state for 120 years. Politically, most European countries have multiple parties—typically five to ten—rather than just one or two dominant parties.

Yes, this culture of trade-offs and discussion is slower than market-driven “blitzscaling” approaches, but it is deeply rooted in Europe’s long history over the past 200 years.

Regulation, Innovation, and the European Paradox

There is also a strong European culture of regulating and creating rules and laws for almost everything, including new software and digital technologies. For an entrepreneur and software engineer like me, this is often very frustrating. I know that technology takes time to reach its full potential—its ultimate use cases often emerge only after years—or even decades—of real-world use. Over-regulating too early can stifle entrepreneurs' freedom to explore and apply technology across a wide range of use cases.

I believe we need more room for experimentation and innovation. But that doesn’t mean we should be unregulated. We still need laws to protect markets, prevent monopolies, and guard against hatred or far-right discourse. History has shown us where unchecked power can lead, especially when amplified at scale. The challenge is finding the right balance.

At the same time, Europe enters the digital age with an unusual handicap: it has no clear role models and very few “master companies” in digital technologies. In earlier eras, Europeans could look to dominant commercial structures like the East India Company or decentralized trade alliances such as the old Hanseatic League as blueprints for economic power.

Today, we have no software equivalent—no European cloud or AI company that plays a structuring role for our ecosystem, sets global standards, or anchors an entire value chain around it. Instead, our engineers and entrepreneurs grow up in a landscape where the reference points are almost entirely American or, increasingly, Chinese.

This absence of homegrown models matters: it limits our collective ambition, our regulatory reflexes, and even our imagination about what European tech could be.

When Tech Becomes Foreign Policy: Europe’s Vulnerability

Technology is now at the center of foreign policies. As our lives become increasingly digital, regulating digital technology means regulating our lives, our economy, our work, our jobs, and our democracy.

In February 2025, JD Vance, the Vice President of the USA, delivered a very aggressive speech against how Europe structures its democracy and freedom of speech, arguing against EU regulations.

Consider also what happened to the ICC judge who ruled against Netanyahu and, in retaliation, was banned from any American-based system by the Trump administration.

What does this mean if you are a French person living in the Netherlands? It means you cannot hold any payment system because Visa and Mastercard are US companies. It means you cannot connect on any social networks because Facebook, LinkedIn, and X—all of these platforms are US-based. You cannot even have a WhatsApp account to chat with your family across borders. Nor can you have an email because Outlook is owned by Microsoft, and the list goes on.

Last but not least, the Trump administration also targeted Thierry Breton, a former French entrepreneur, former Minister of the Economy of France, and EU commissioner who led the creation of regulations such as the Digital Service Act and the Digital Market Act. He was banned from traveling to the US as if he were a gangster or a terrorist. Why? What crime did he commit? He was probably the most vocal European politician against the US's digital dominance.

Europe’s Digital Deficit and Cybersecurity Gap

For those of you who are more analytically minded, let me give you two numbers. First, Europe’s digital service deficit—the balance between what we sell to the US and what we buy from the US, mostly from the Magnificent Seven and the tech industry—is €260 billion. That’s a lot of money.

What could we do if we just used 10% of that to buy products from EU companies? We would create hundreds of startups. What if we bought 50% of our supplies from EU companies instead of the US? We would restore our digital sovereignty. No additional money spent—just smarter spending.

Another number: Europe imports 70% of its cybersecurity products. We’re expected to invest more in our defense after the Ukraine invasion, yet we’re still failing to build a stronger cybersecurity industry. This industry would protect us against criminals on one side and state actors like North Korea or China on the other. It would make us more resilient, enable us to enforce our own rules and laws, and allow us to say what we want without fearing that our email access could be cut off yet again.

From One or Two Champions to an Ecosystem of Many

To restore our digital sovereignty, we need more autonomous technology from Europe. We must engage in this battle and create global companies rooted in European countries, whether in Tech, AI, or other critical sectors. Imagine a network where 50 mid-size firms share talent, capital, open-source components, and standards, creating a flywheel effect that strengthens our entire digital ecosystem. This interconnected approach, with many champions rather than reliance on a single giant, can lead to a sustainable and resilient technological frontier.

We have a few great companies like Black Forest Lab in Germany or Mistral in France, but we don’t have enough of them. We should have 50 companies like that if we want to be resilient. A company is a fragile “thing”—it can suffer leadership changes, economic struggles, or countless other challenges. If we rely on just one business in a critical area like this, what happens if it fails?

The digital economy isn’t about scaling vertically, like having one giant in nuclear energy or a handful of companies dominating the automotive industry. Instead, we need dozens, even hundreds, of cybersecurity, AI, and cloud software companies. We must create them.

Concrete levers include procurement from EU vendors, utilization of public–private funds, and participation in pan-European scaling programs.

It’s Not Too Late: Lessons from Cars in Japan and Clean Energy

This is a wake-up call. Let me be clear: there is no fatalism. There is no “it’s too late, and we should just live with it.” No topic is set in stone.

In other industries, arriving late has never been fatal. Take Japan. The modern car industry was born from European and American advances in combustion engines, steel, and other technologies. At the beginning of the 20th century, Japan was not a major player. Toyota – then Toyoda – was building weaving machines, almost an 18th‑century business. Yet through engineering excellence, science, and methods like lean manufacturing, they became the world’s largest car company and a pioneer in hybrid and electric vehicles. Nobody in Japan said, “It’s too late, we shouldn’t build cars.” They just built them, and eventually led. Korea has followed the same path.

Europe itself has already shown that it can move decisively in a strategic technology transition. With the REPowerEU Plan, the EU chose to phase out Russian fossil fuel imports, protect citizens and businesses from energy shocks, support Ukraine by weakening Russia’s war chest, and accelerate the shift to clean energy. In just a few years, the EU doubled solar generation since 2019, and channelled almost €110 billion into renewables in 2023 alone.

This is proof that when Europe treats technology as strategic – and combines regulation, investment, and industrial policy – we can move fast. But even here, we see the risks of a new dependency: over 95% of our solar PV modules come from China, and cheap imports are threatening EU manufacturers. We are on track to eliminate Russian gas, but we risk locking in a new structural reliance on Chinese hardware.

Conclusion

The lesson is clear: it is not too late for Europe to build leadership in digital technologies – cloud, AI, cybersecurity, and software. What we cannot afford is to repeat the same pattern of dependency.

We have the engineers. We have the talent. We have a market and are spending a lot already in Tech. We have the capital. What we need is the political courage and cultural shift to treat digital technologies as a core European project, not a niche for a few “nerdy, techy” people.

The world’s heart beats in bytes. We must develop our tech cardio.

We need to push for this change to happen faster. I’m committed to it and will support any initiative across Europe that advances it.

See you next week

Laurent 💚

With 2025 wrapping up, here’s a look back at what I covered this year. I know newsletters are supposed to focus on a few topics and go deep, but on Cyber Builders, I went the other way, exploring a range of themes.

1. Agentic Transformation: The industry is moving from passive assistants to active, autonomous agents. This shift means reliability and better user experience matter more than ever. I also rolled out my own framework, HAEGID, to help make sense of it.

2. Cybersecurity Market: I covered the 12 leading platforms shaping the market. When Gartner has 50+ acronyms (honestly, I stopped counting!), I tried to provide a comprehensive categorization of cybersecurity products.

3. Economic Divergence: I looked at the 'Boldness Gap'—why Europe lags behind Israel and the US in taking risks and investing big.

4. New Security Debt: 'Vibe Coding' is on the rise, and so are the risks from AI-generated code. This means we need to rethink how we do Application Security.

5. OT Security Difference: From my personal experience of the grid’s fragility to the looming shadow of nation-state threats and the expanding risks of our smart-energy transition, I mapped out why securing our power infrastructure is the most critical challenge for today's cyber builders.

6. Web3 Maturity: I’ve analyzed how crypto has graduated from a niche experiment to a foundational global utility, while simultaneously arguing that our security focus must shift from protecting hardware to safeguarding human identity in an AI-driven world.

Let’s dig into each of these topics.

This is a long newsletter, you better read it only, as the email is probably truncated ! Visit: https://cyberbuilders.substack.com/p/2025-wrap-up

The Agentic Shift and the Reliability “Crisis”

A big focus for me in 2025 was watching AI shift from passive helper to active agent. The cybersecurity industry needs new ways to build trust in these systems.

The Reliability Gap

Back in May, I pushed back against the industry’s focus on model power in my post 'Stop Catching Up: What Agentic AI Can Fix in Cybersecurity.' My take: building agents in 2025 is really about reliability and user experience, not just the AI itself.

Here’s why I think that:

• Deterministic Requirement: Cybersecurity is often black-and-white—a vulnerability is confirmed or not, a patch is applied or not. But generative AI works in probabilities, not certainties.

• Trust Deficit: Co-Pilots (where a human is in the loop) can make mistakes because someone is there to catch them. Agents (no human in the loop) can’t. Once an agent can change production or block users, mistakes aren’t an option.

• UX as the Differentiator: The real winners won’t be the ones with the most innovative models—those are becoming a commodity. It’ll be the teams who build the best guardrails, validation, and user interfaces so people can actually trust what the agent does.

Bonus: my review of DARPA Grand Challenge of AI & Cybersecurity

The “Maturity Moment”: Claude 4.5 and Context Engineering

In October, I called the release of Claude 4.5 a 'Maturity Moment.' Instead of just looking at benchmarks, I focused on what 'Context Engineering' means for the field.

Claude 4.5 stood out because it could manage its own context and work well with tools. That matters in cybersecurity, where you often need to process large volumes of logs and reports at once. Now, AI can finally treat cyber defense as a core use case, not just an afterthought. The real challenge is giving the model the correct data and tools, not just clever prompts.

The HAEGID Framework

In November, I laid out my view on AI in security with the HAEGID Framework. The acronym is explained throughout, but here are the six main pillars I see as key to understanding AI’s impact.

I put this framework together to make sense of how AI shows up in security products. It’s designed to cut through the AI Hangover and offer a straightforward way to see what really matters.

• Humanize: Use tailored training and real-time prompts to empower your team’s defenses.

• Assist: Help analysts become faster and more accurate with their tools from the start.

• Enrich: Automatically gather context for alerts so analysts see the whole picture immediately.

• Guide: Turn noisy data into clear incidents, steering teams toward correct action.

• Intervene: Enable rapid, coordinated responses across all security tools.

• Defend: Proactively hunt for threats and strengthen your defenses early.

My view: feature-based AI is done. Adding 'Summarize this alert' isn’t enough now. Products need to be built around the HAEGID principles to last.

The 12 Cybersecurity Platforms

In 2025, I took on my biggest analytical project yet: mapping out 12 cybersecurity platforms. It kicked off in the spring with my most-read post of the year.

I also wrote several deep dives on these platforms, including 'AI is Reshaping The 12 Cybersecurity Platforms.'

Economic & Geopolitical Landscape

Israel’s $4 Billion Lesson

In January 2025, I wrote a data-driven breakdown of the Israeli cybersecurity sector, titled “Israel’s Cyber Strength: $4B Raised in 2024— and Counting.” This analysis went beyond simple fundraising statistics to investigate the ecosystem's structural resilience. Despite significant geopolitical instability and regional conflict, the Israeli cyber sector demonstrated an uncanny ability to attract global capital.

The analysis identified three “Key Drivers” behind this thriving ecosystem:

1. The Military-Industrial Feedback Loop: The report highlighted the enduring relevance of units like 8200, which act not just as technical training grounds but as incubators for “offensive” thinking. This mindset—understanding the attacker’s perspective—is baked into the product DNA from day one. It also offers time to build mature technologies and skill sets before launching fast-growing ventures.

2. Global-First Orientation: Unlike many European startups that focus on capturing their domestic market first (e.g., France, Germany), Israeli startups are structurally forced to ignore their small domestic market and target the US Global 2000 immediately. This necessitates a level of product maturity and sales & marketing intensity that European peers delay.

3. Capital Recycling and Mentorship: The presence of second and third-time founders who reinvest both capital and operational wisdom creates a compounding effect.

I see Israel as the most mature cybersecurity ecosystem in the world, and something too often overlooked, the most competitive one.

Europe’s Dilemma: Talent Without Risk

In contrast, I authored the post “Cybersecurity in Europe: The Talent Is There—Where’s the Boldness?” as a wake-up call for Europe. I emphasized that the region faces a “fragmentation of ambition' and clarified that the “Investment Gap” I mentioned is not just about the amount of capital but its quality.

Furthermore, the analysis touched upon the regulatory environment, specifically the European Cyber Resiliency Act (CRA). While the blog acknowledged the CRA’s positive intent—mandating security-by-design and engineering standards—it also highlighted the risk of “Regulatory Drag.” Regulation indeed establishes a baseline of trust, but it cannot act as a substitute for innovation.

There is a palpable tension between the European instinct to regulate AI and cyber tools and the American/Israeli instinct to build them. Without a shift in investor mindset—bridging the gap between “Scaling Faster” and “Competing Globally”—Europe risks becoming a consumer of cybersecurity rather than a producer.

The Builder’s Playbook – AppSec and The “Vibe Coding” Crisis

The New Security Debt

While much of the industry celebrated the productivity gains of AI coding assistants (like GitHub Co-pilot or Cursor), Cyber Builders focused on the dark underbelly of this trend. In July 2025, I introduced concepts like “Vibe Coding” and the exponential growth of Security Debt.

In a collaboration on the “Hidden cost” of AI, I highlighted a staggering statistic: “Among YC startups in 2025, 95% of their code is reportedly generated by AI.”

• Definition: “Vibe Coding” is a development style in which creators use AI to generate code based on a high-level “vibe” or intent, often without fully understanding the underlying syntax or security implications.

• The Problem: “Creativity Accelerates Insecurity.” The friction of writing code used to be a natural throttle on the creation of vulnerabilities. With that friction removed, the volume of code—and thus the volume of vulnerabilities—explodes. The blog argues that this leads to “invisible liabilities” that accumulate faster than any human security team can audit.

“Application Security - AI Won’t Save You.” In 2025, AppSec teams must own the basics, slash security debt, and build security in collaboration with the dev team.

Scanners generate noise. If you have an AI coding bot generating 10x the code, and an AI security scanner generating 10x the alerts, you have scaled the chaos by 10x. You have not solved the problem.

OT & Industrial Security is the cornerstone of our society

I’ve been diving deep into the digital nerves of our society: the power grid. It’s a topic that is often invisible until it’s gone, and through three interconnected articles, I’ve tried to map out why the stakes for “Cyber Builders” have never been higher.

The Wake-Up Call: From Abstract to Absolute

I started by sharing a personal story in When the Lights Went Out. It’s easy to talk about “infrastructure security” in a boardroom, but everything changes when the lights actually flicker and die. For me, experiencing a blackout firsthand wasn’t just a minor inconvenience; it was a stark reminder of our total, fragile dependency on the flow of electrons. It turned a technical challenge into a human one. I realized that as we build the next generation of digital tools, we aren’t just protecting data—we are protecting the warmth in our homes and the safety of our streets.

The Invisible Frontline: Why the Grid is the Ultimate Target

Even though a cyberattack did not cause the Spanish blackout, I examined various cyber threats to power grids. In Gridlocked, I explored the cold reality of modern geopolitics. Power grids have become the ultimate “crown jewels” for nation-state actors. Whether it’s the shadow of Sandworm or the stealthy pre-positioning of groups like Volt Typhoon, the goal has shifted. It’s no longer just about immediate disruption; it’s about strategic leverage. I argued that the grid is now a digital battlefield where “living off the land” techniques allow adversaries to hide in plain sight, waiting for the moment when a flick of a switch can achieve more than a physical strike ever could.

The Paradox of Progress: Smart Grids, New Risks

Finally, I looked toward the future in When the Grid Gets Smart, the Threat.... We are currently in the middle of a massive energy transition. We need “smart” grids to manage renewables, electric vehicles, and distributed energy.

But here is the paradox I’ve been wrestling with: every “smart” device—every connected solar inverter and EV charger—is a new door for an attacker. By decentralizing our energy, we are exponentially expanding our attack surface. We are moving from a world of a few massive targets to a world of millions of tiny ones, and our security models haven’t yet caught up to this “Edge” reality.

Web3 and Proof of Human are part of the future of cybersecurity

Lastly, this December, I’ve been looking at how the very nature of digital trust is shifting beneath our feet, moving from specialized technical problems to the foundational pillars of our daily lives.

First, I took a hard look at the state of decentralized economy and technologies in 2025: Crypto Isn’t Niche Anymore. For years, we’ve treated blockchain as a side quest or a speculative bubble, but we’ve reached a tipping point where it has become essential infrastructure. Whether through stablecoins acting as global payment rails or the tokenization of real-world assets, crypto is no longer a playground for the few—it is the new plumbing for a more transparent and efficient global economy.

This evolution of infrastructure brought me to an even deeper question: how do we protect the people using it? In my conversation with Adrian Ludwig, From Securing Devices to Securing Humanity, we discussed a fundamental shift in the cybersecurity mission. In an era where AI can mimic almost any digital footprint, simply “securing the digital layers (device, software, cloud, network)” is no longer enough. We are entering an age where our primary challenge is verifying our very humanity through new primitives like “Proof of Human,” ensuring that the digital world remains a space built for and by people, rather than a sea of automated deception.

Conclusion

As 2025 draws to a close, one thing stands out: the future of cybersecurity will be shaped by those willing to rethink how we defend an automated, hyper-connected world. From agentic AI and the 12 security platforms to OT resilience, Web3, and Proof of Human, the stakes have never been higher—and neither have the opportunities.

Thanks for being part of Cyber Builders this year. If these ideas connect with you, stick around—2026 is when we start making more of them real.

Laurent 💚

This week, we're diving into the crypto industry with an analytical lens, examining its intersections with cybersecurity and the broader implications for technology and society. I’ve been following it for years because it’s so closely tied to cybersecurity. Some people say “crypto” has a casino vibe, and it’s true that early on, speculation and the lure of quick money drew in a lot of folks.

However, a strong community of tech enthusiasts who value privacy, security, and decentralization has shaped "crypto" since its inception. In many of these use cases, adoption is strengthening. Concrete value is built on crypto technologies such as MPC (Multi-party computation) and ZK (Zero-Knowledge Proof). MPC allows multiple parties to jointly compute a function over their inputs while keeping those inputs private. This ensures sensitive data can be used without exposure, significantly benefiting cybersecurity measures. ZK proofs, on the other hand, enable one party to prove to another that a statement is true without revealing anything beyond the statement's validity. This mechanism is crucial for maintaining privacy while ensuring the integrity of transactions and interactions.

With A16Z releasing its “state of crypto 2025” (LINK), I want to share my take on what matters most. I think crypto-technologies, or Web3, have the potential to address many challenges in digital society. I’ll explain why crypto is about more than just technology and point out the key parts of the report.

Merry Christmas to all 🎄🎅🏽

Why This Is About More Than Technology

Any tech is, in the end, political, don’t you think?

Over the last fifteen years, a handful of companies have captured immense economic value, and now they control the digital infrastructure that powers our world. These actors perfectly played the transition of the global economy to the Internet. They absorbed most of the value in e-commerce, social interaction, cloud computing, storage, networking, and enterprise IT systems—layers that are now absolutely central to how modern economies function. Unsurprisingly, these companies sit at the very top of global market capitalizations today. They don’t just sell products or services; they control critical infrastructure and shape the rules of entire markets.

At the same time, we’re seeing growing attempts to control speech and behavior. We increasingly see attempts to censor individuals, regulate speech, or control behavior, often under the banner of protecting freedom or stability. Paradoxically, some of the loudest defenders of “free speech” are also willing to decide what people can or cannot say, where they can live, or how they can operate—even across borders.

In this context, decentralization becomes a profoundly political tool. I want to be very explicit about this: decentralization is not an abstract ideology. It is a practical mechanism to counter the centralization of capital, control, and, ultimately, freedom.

Owning your data, your assets, and your digital identity matters. Today, most of what we use is borrowed. We rent computing in the cloud. We rely on networks and machines owned by someone else. We operate inside systems whose rules can change overnight, without our consent.

We won’t be more cyber-resilient without a stronger ownership of the digital economy, where our economic power will secure our freedom.

The promise of crypto technology is precisely to invert that relationship. It is about ownership rather than permission. About holding assets rather than accessing them temporarily. About being able to act, transact, and interact without depending entirely on centralized intermediaries.

This does not mean rejecting institutions or regulation altogether, but it does mean rebalancing power. Crypto, at its core, offers a way to reintroduce individual and collective sovereignty into the digital world. And in an era where both corporate and governmental control are expanding, that promise is not marginal—it may be one of the most important technological and political questions of our time.

Bitcoin is a major financial asset.

In 2025, the crypto market changed. It’s not just a fringe experiment anymore—it’s now a key part of the global economy. What stands out to me is seeing Bitcoin’s value shown alongside assets it has never been compared with before. Right after Gold and the Magnificent Seven, you’ll find Bitcoin. That alone says a lot. Bitcoin is now a major global asset, moving in line with the rest of the market. When the economy dips, Bitcoin is affected. When things pick up, it often recovers faster and stronger.

The Explosion of Stablecoins

One of the most fascinating developments is the surge of stablecoins—crypto tokens pegged to a currency like the US dollar. The massive growth of these tokens was a real surprise, at least for me. Companies like Tether and Circle are issuing billions of dollars in digital assets backed by US Treasury bonds.

Stablecoin adoption creates a strange loop: private crypto companies are fueling demand for US debt, effectively strengthening the dollar’s dominance. USD stablecoins are reinforcing the US dollar's supremacy over other currencies.

But beyond geopolitics, stablecoins might be one of crypto’s first true killer apps. They offer a way to move money with dramatically lower fees, sidestepping the traditional payment rails of Visa and Mastercard. At a global scale, saving a few percent on every transaction is anything but marginal.

The Future is Private

There’s a growing movement around privacy, driven by technologies like zero-knowledge proofs (ZK proofs). The idea is simple but powerful: you can prove something is true without revealing the underlying data.

You could prove you have enough funds for a contract without disclosing your bank balance, or prove you’re over 18 without showing your ID. In a world where our data is constantly monitored, ZK proofs offer a way to reclaim our privacy.

I’d love to see more cybersecurity founders embracing ZK technologies as they mature. I do think the crypto world tends to “bundle” ZK with blockchain, but aside from blockchain and the financial aspects, there are many other use cases for ZK.

Crypto rise in rising countries, not in the “Western” world

We often hear that Bitcoin was supposed to be a refuge, a counter-cyclical asset. But is that really true? The most telling evidence comes from crypto wallet usage, which is exploding not in the world’s financial capitals but in places like India, Argentina, Nigeria, and the Philippines.

In economies with shaky monetary stability and untrustworthy institutions, crypto isn’t just an investment—it’s essential infrastructure. It’s a shield against inflation, a cheaper way to send money home, and a lifeline when the traditional financial system fails.

Here in the West, we don’t feel these pressures as acutely, so we see crypto through a different lens.

Beyond Finance: Building a Decentralized World

The real-world economy is starting to see blockchain as more than just a financial tool. It’s becoming the underlying infrastructure for new, decentralized systems. It’s an evolution of the traditional capital economy: how capital expenditures can be undertaken by a group of people who, in return, collect gains over time.

I’m particularly interested in DePIN (Decentralized Physical Infrastructure) projects like Helium, which is building a decentralized network for IoT and mobile devices. What’s fascinating here is that the network creation itself is decentralized. Users buy and deploy hardware, and in return, they’re rewarded for providing network coverage AND network traffic.

It’s a model that could be applied to storage, computing, AI, and more. This is all possible because the underlying technology has matured. Blockchains like Solana can now handle high transaction volumes at a low cost, opening the door to once-impossible applications.

We’re Still at the Dawn of Web3

Crypto can still be seen as a very early-stage technology. Bitcoin was launched in 2008, and since then, it has gone through multiple cycles, massive hype, deep crashes, and broad public exposure. Yet, if you look at real usage today—and if you remove bots, on-chain noise, and AI-generated activity, whether on blockchains or social networks—you probably end up with something like 40 to 70 million active monthly users.

That number is strikingly similar to the number of internet users around 1995. I’m old enough to remember that time—I was 20—and it really felt like the very beginning of the Internet. Access was limited, slow, and constrained to specific places: public libraries, universities, Internet rooms, cyber cafés, where you often had to wait for a seat.

From that perspective, it’s easy to imagine how much crypto usage could still grow if the right incentives and applications start to compound. Today, developer activity is already concentrating around a few early giants like Coinbase, Solana, and Ethereum, which act as gravity centers for new applications.

Conclusion - Where Are the Killer Apps?

The future of crypto hinges on one thing: real-world use cases. Right now, a large part of the activity still reflects what Chris Dixon calls a “casino culture,” driven by speculation.

Outside of emerging economies, we’re still waiting for the killer apps that will make crypto a part of our daily lives. Will it be in commerce? Social media? Messaging? The answer isn’t clear yet.

Building future will require more than just better technology; it will demand new incentives and experiences that go beyond a quick profit.

2026-2030 will be a fascinating period to live in tech.

Laurent 💚

Few perspectives are as valuable as those shaped by decades of hands-on experience. In this exclusive conversation for Cyber Builders, I sat down with Adrian Ludwig, Chief Architect & CISO at Tools for Humanity (World ID).

Bringing over 25 years of combined experience to the table, we have both witnessed and shaped the security paradigm through every major technological shift: from the early days of hardening desktop computers and locking down perimeter networks, to the explosion of mobile computing, where Adrian led Android security at Google. Now, we turn our attention to the latest frontier: the era of artificial intelligence.

We’re entering a strange new phase of the internet — one where anyone can summon human-like content in seconds. AI can now generate faces, voices, conversations, even whole communities that look and feel real.

At the same time, we need AI more than ever: to filter misinformation, detect fraud, protect users, and scale the digital economy. But if anyone — or anything—can look human, how do we know who’s real?

That’s the question behind the proof of human (PoH) movement — and few people think about it as profoundly as Adrian, a contributor to World Network and its ambitious cryptographic infrastructure for verifying humanness online.

Laurent Hausermann: To kick off the conversation, could you give us a short introduction about yourself?

Adrian Ludwig: Sure. I am the Chief Architect at Tools for Humanity, working on the World project. I joined about two years ago as the Chief Information Security Officer to build out the security practice, hiring all the standard things you would expect. About a year ago, I transitioned into the architecture role because of many of the questions you flagged—how does decentralization work? How does privacy work? How can we possibly break this thing, which looks like a tightly coupled protocol, into pieces?

Background-wise, I’ve been doing this far longer than probably any human should! I started working in security at the National Security Agency in the late 90s, doing crypto work and early exploit development. I founded the security team at Adobe in the early 2000s, working on Flash and Dreamweaver. More recently, I ran security for Android at Google, building out the operating system from the bottom of the stack to malware detection. Before this, I was running security at Atlassian, helping large enterprises realize that running their own software stack is often a fatal flaw in their security thinking.

Laurent Hausermann: When talking to a broad audience, I often say that 25 years ago, it was about computers, networks, and engineering. Today, the digital economy has exploded, and it is about people, jobs, fraud, information, trust, and democracy. The landscape is much broader than it was 20 years ago.

Can you dive into the “why” behind what you are doing today? What kind of threats do you have in mind regarding deep fakes, synthetic agents, and these new threats popping up?

Adrian Ludwig: I’ll try a metaphor here, as I think you know enough about the security world to appreciate it. When we built computer security 30 or 40 years ago, we made a mistake that allowed buffer overflows and other bugs. The AV (Anti-Virus) industry popped up and said, “There is no integrity, so we will look for the bad things and flag them.”

It took the industry another 20 years to realize that what you actually need is a hardware root of trust for the operating system, and that operating system needs to convey trust to the applications. You need a verifiable toolchain.

That pattern—don’t build the infrastructure into the core platform, realize there is a gap, try to solve it by detection, and then realize we need to reboot and do it the right way—is exactly the same pattern the Tools for Humanity team is seeing.

We built a new digital world, but we didn’t identify humans as a defining characteristic in it. Every large software provider at scale was beginning to realize that fraud and abuse were rampant. Maybe it was “just” 5% or 8% of fraudulent users you would detect using AI and machine learning.

Generative AI is unfortunately getting so good that our current machine learning and AI detection systems just can’t keep up. It was pretty clear that our existing model wasn’t going to cut it much longer. Trying to use AI to detect other AI is a pointless exercise—a “cat and mouse” game we’re simply set up to lose.

We need a root of trust. We need the same thing the operating system vendors eventually realized: bind this to the lowest level of identity, then weave it through the rest of the protocols.

Laurent Hausermann: Great, what does it mean for the end-users? Internet consumers?

Adrian Ludwig: At a consumer level, it manifests most visibly in the erosion of social discourse. When you read comments on social media, you no longer have any confidence that you are seeing a consensus of real people. You don’t know if you are seeing a genuine debate or a manufactured reality created by thousands of bots controlled by a single entity.

One relatable example is modern dating. There is that classic New Yorker cartoon by Peter Steiner—”On the Internet, nobody knows you’re a dog.” That used to be a joke about anonymity; now it’s a serious problem about authenticity. On a dating app, you genuinely don’t know if the “person” you are pouring your heart out to is a human being, or if it is a scammer running 10,000 accounts simultaneously using a large language model to generate romantic replies.

We have culturally accepted this as just “background noise” or a “nuisance,” like spam email. But the reality is much more pervasive. It is a fundamental failure of our digital infrastructure to answer the most basic question: Are you a person?

We’ve accepted it as an annoyance, but it is much more pervasive than we realize.

The technical underpinning is a lack of a root of trust.

You don’t know what you can trust. You don’t know if you are interacting with a real human.

Laurent Hausermann: What are the alternatives that predate Tools for Humanity’s new approaches? What are their limitations?

Adrian Ludwig: Alternatives that predate us include relying on identity systems built by a single entity—whether a single massive tech company or a single government.

These fail at a global scale. You can’t really trust a system globally if it relies solely on one government or one corporation. Not everyone in the world trusts the US government, and not everyone trusts a specific tech giant. To have a genuinely global root of trust, you cannot be dependent on a single centralized authority.

Moreover, most of the current solutions focus on “Who are you?“ (Identity) rather than “Are you a unique human?“ (Sybil attack resistance).

Most existing approaches fail at scale when it comes to uniqueness. Without checking for uniqueness, you are vulnerable to Sybil attacks—where one person controls thousands of accounts. In the era of AI, if you can’t prove unique humanness, you can’t distinguish between a real user and a bot farm.

Finally, most identity systems that predate World ID fail to respect the separation of context. They tend to blend everything.

There is a basic human expectation that “what I do over here” and “what I do over there” are separate things. That is a jarring privacy failure that people have accepted as an annoyance, but it’s actually a fundamental flaw in how those systems handle data privacy.

Laurent Hausermann: Continuing with alternatives, how do you feel about the watermarking initiatives that aim to apply digital signatures to content to re-establish a trust system?

Adrian Ludwig: I don’t think any system is “bad,” but no one has a robust system that solves all the problems. Watermarking helps indicate that a piece of content came from a specific source.

However, there are countless ways to evade it. The classic example is simply taking a picture of the picture. I think things like C2PA (Coalition for Content Provenance and Authenticity) are super helpful for understanding that something came from a piece of hardware and wasn’t entirely AI-generated.

It’s going to be a primitive we need.

Laurent Hausermann: How to use this primitive?

Adrian Ludwig: One way we are looking into it for World ID is doing face matching on a device. You go to an Orb, it takes a few pictures, bundles them into an encrypted package, and gives it back to you. When you use that credential to generate a proof for interaction with a relying party, we can request that it be authenticated. We can confirm that not only does the user possess the private key associated with the credential, but they also appear to be the person who went to the Orb.

On the client side, we can compare the real-life image of the person at that moment to the person who went to the Orb. That relies on client-side image acquisition, which, if you are a security purist, is terrifyingly insecure because the user controls the device. However, C2PA provides confidence that the image originated from the camera.

And now that can be combined with face authentication, then combined with the credential issued at an Orb, and then combined with World ID. So that a relying party can know the face you’re seeing right now is the same as the face that I presented to an Orb sometime in the past.

Laurent Hausermann: You mentioned several times building a “humanity root of trust” and speaking about primitives. Many comments I receive from peers looking at the World ID stack suggest that everything seems intertwined. Can you explain how it works and why it is so connected?

Adrian Ludwig: I agree with those observations. Our vision evolved over the last year after hard work on the project.

Something as simple as: Is your World ID the same as your proof of human? Two years ago, the answer would have been, “Yes.” If you ask me right now, they are totally separate things.

The proof of human is the interaction you had with the Orb, in which it checked your image and determined that you are a human. But, there is a second characteristic that is really important: unique humanness.

We blended “proof of human“ with “proof of unique human“ because Sybil detection (preventing a single person from creating multiple identities) is a fundamental part of what we are trying to establish.

Even that—are you human, and are you a unique human—are two separate things. You don’t actually need the blockchain to prove the first thing. You do need it to establish the second.

Laurent Hausermann: Great. That gives us two security primitives around humanity.

Adrian Ludwig: Yes, exactly. Separating the two enables private interactions with third parties. For some use cases, you can prove you’re a human without revealing your identity. For others, you can prove you’re a human AND unique.

We want to go even further and are actively working to pull the protocol apart. We want to recognize that there are things about the person, things the person possesses (documents, credentials, devices), and realize that the user has a complex interaction with relying parties.

We are moving toward a model of breaking who holds the user’s key. Currently, there is a single private key held on the user’s mobile device. In practice, that won’t work globally. The work done by the FIDO Alliance and WebAuthn, which allows multiple passkeys to be associated with the same account, is a much better model. That is the direction we are taking the protocol right now: decomposing how key management works so a user can authorize, de-authorize, and monitor different ways they interact with their World ID.

Laurent Hausermann: I read the “State of Crypto 2025” a16z report, and one thing that struck me was the use of crypto wallets worldwide. The countries where it is most used are Argentina, Brazil, Indonesia—everywhere but the US or Europe.

In the US or Europe, you can be unhappy with your government, but you still trust it not to fight against you. In other regions, the need for a decentralized trust system is higher. What is your view on that?

Adrian Ludwig: I am an amateur economist and amateur lawyer, far from a professional analyst of how governments work – but I tend to agree with that description.

Coming at it from a security angle, if you talk to people on a security team at a big SaaS company, they can tell you how much fraud is happening inside their system. They will tell you it’s serious – and they are all frustrated by the lack of effective tools to combat it.

In financial systems across North America and Europe, fraud experts can point to countless examples of wrongdoing. To the average consumer, this often shows up as spam or scams – especially on dating apps.

But in other regions facing high inflation or a lack of trust in the government, the utility of these tools is much higher.

One of our biggest challenges has simply been scaling globally. How do you grow from 18 million users to a billion when”proof of human” requires a physical Orb? It means deploying a large network of devices. By early next year, we plan to have at least 10,000 Orbs in the field to accelerate growth.

Laurent Hausermann: Moving to privacy concerns, I read about the German privacy authority’s concerns. There is a balance between the “right to be forgotten” and the need to prevent fraud (ensuring I cannot delete my ID just to recreate it as a new person). How do you envision addressing this?

Adrian Ludwig: It’s a balance. We encountered areas of the law that aren’t particularly well-defined, but we believe that our approach—fully anonymizing users—is the right one.

World ID doesn’t collect any data, and no one in the system has access to information that could identify a user. Our system uses AMPC (Anonymized Multi-Party Computation). With World ID Credentials, which don’t require visiting an Orb, we extract identifying characteristics from the document, anonymize them, and confirm that only one World ID can use this passport or national ID.

This allows a relying party to confirm:

1. This is the person holding a valid document.

2. They are the only ones using that document (preventing replay attacks).

Importantly, the AMPC set for this process is separate from the one used for the Orb and from the ones that might be used in the future. This decentralized approach prevents the creation of a single database containing all passports.

Laurent Hausermann: Thank you, Adrian. It is fascinating to see how the principles of security evolve from devices to networks, and now to the meaning of humanity itself.

Adrian Ludwig: Thank you, Laurent.

I recently examined how AI is used across 12 cybersecurity platforms, focusing on real examples from vendor product releases over the past 2 years. You’ll find all the resources linked below.

This series generated passionate questions and remarks. Some of you told me, “I will never delegate my security operations to an AI.” Others were excited about delegating boring research and reporting to focus on more valuable work.

No matter your view, cybersecurity is a grind. Alerts pile up, tools don’t always work together, skilled people are hard to find, and threats keep changing. Many of you deal with this daily.

Our community needs a straightforward way to see how AI helps both products and day-to-day work. We have to look past vendor claims like, “My new release includes the best AI feature!” It’s also crucial for Cyber Builders to explain to customers how they leverage AI and why.

To address this, I have developed a unified framework for AI-driven security: HAEGID.

HAEGID stands for Humanize, Assist, Enrich, Guide, Intervene, and Defend. Unlike other models, it uniquely connects real security team challenges with targeted AI solutions, emphasizing practical, human-centered collaboration from the ground up.

• Humanize: Use tailored training and real-time prompts to empower your team’s defenses.

• Assist: Help analysts become faster and more accurate with their tools from the start.

• Enrich: Automatically gather context for alerts so analysts see the full picture immediately.

• Guide: Turn noisy data into clear incidents, steering teams toward correct action.

• Intervene: Enable rapid, coordinated responses across all security tools.

• Defend: Proactively hunt for threats and strengthen your defenses early.

In the following sections, we will explore each pillar with practical use cases you can implement in your environment. HAEGID offers a direct, actionable approach to align AI features with measurable improvements in security operations, guiding you from initial interest to reliable, value-driven AI use cases.

We will begin by examining the first pillar of HAEGID, Humanize, and review relevant examples that demonstrate its immediate potential.

Note: HAEGID is pronounced “HEY-GID.” 😅

H - Humanize: Fortifying Your Human Layer

For years, people have been labeled the weakest link in security. I disagree. Your team is your greatest asset and first line of defense when properly empowered. Rather than relying on generic training, Generative AI enables tailored training, simulation, and guidance within daily workflows.

AI personalizes and continuously adapts human-oriented security activities. By contextualizing experience, it turns employees into the first line of defense by integrating security training and guidance into daily workflows.

Deliver Hyper-Personalized Security Training

Effective training is relevant and practical. GenAI enables the delivery of hyper-personalized lessons tailored to each role’s daily responsibilities. For example, a finance analyst receives training on identifying wire fraud, while a cloud engineer receives guidance on securing their specific infrastructure. This targeted approach drives meaningful behavior change.

Run Realistic and Adaptive Attack Simulations

Traditional phishing simulations are becoming obsolete as attackers adopt more sophisticated tactics. GenAI allows you to create realistic simulations that mirror current threats, including deepfake voice calls for high-risk roles. This approach identifies those most at risk and enables targeted, individualized coaching.

Provide Continuous Reinforcement with Real-Time Nudges

Addressing risky behavior is most effective when done in real time. GenAI can provide timely, relevant guidance as needed. For instance, if an employee attempts to upload sensitive data, a clear message can explain the risk, helping prevent errors and reinforce positive security habits.

A - Assist: Empowering Your Analysts, Every Step of the Way

You probably already know this part of HAEGID. Generative AI delivers assistance by acting as a co-pilot for your security team. SOC analysts are faster, co-pilots level up your junior members, and reduce the friction of hand-offs between teams.

AI acts as an on-demand co-pilot, lowering barriers to complex tasks and automating tedious work for your team.

Master Your Tools on Day One

New security tools often introduce initial complexity, reducing productivity. GenAI helps eliminate this barrier.

Imagine your newest analyst asking a tool directly, “How do I trace this alert from the SIEM all the way to the EDR?”

Instead of searching through documentation, analysts receive step-by-step guidance within their workflow. This contextual training accelerates onboarding and reduces escalations to senior staff.

Turn Plain English into Powerful Queries

Query languages should not hinder analysis. Traditionally, only those proficient in specialized syntax could ask complex questions. GenAI serves as a universal translator.

Now, anyone on your team can ask, “Show me all failed logins for Jane Doe from outside the US in the last 24 hours.”

The AI generates the correct query and returns results, enabling junior analysts to contribute valuable insights from their first week.

Guide the Next Best Action

When a critical alert occurs, hesitation can create risk. GenAI acts as a real-time guide, recommending the best course of action based on the alert’s context.

It might suggest, “Check for recent process creation on the host,” or “Quarantine the device if indicators of lateral movement appear.”

These suggestions are tailored to your environment and informed by existing playbooks, ensuring higher-quality investigations.

You can begin by adding a “recommended actions” panel to your triage view, providing your team with a concise list of steps and one-click links.

Don’t automate trust.

Keep a human in the loop.

The journey should be gradual.

Start with AI suggesting actions, then graduate to one-click execution, and finally, to supervised auto-execution for your lowest-risk, highest-confidence tasks.

E - Enrich: Getting the Full Picture, Instantly

Most security alerts require context, not additional noise. The “Enrich” use case transforms isolated signals into actionable insights, providing analysts with a comprehensive view to support faster, more informed decisions.

AI eliminates the need for analysts to pivot between tools to understand an alert manually. It aggregates and synthesizes relevant context, turning a raw event into an actionable story. Note that if the underlying data isn’t a bit normalized (a problem the industry hasn’t solved in 20 years of SIEM), the AI’s “unified view” will be flawed

Reclaim Your Time from Incident Reporting

Reporting after every major incident is a significant burden. GenAI can automate the drafting of post-incident reports, executive summaries, and regulator-ready narratives.

By extracting key details directly from investigation data, GenAI assembles a coherent first draft, links relevant evidence, and suggests remediation actions. This approach saves significant time and ensures consistent reporting quality.

End the Swivel-Chair Investigation

When a detection occurs, analysts often need to gather context from multiple sources, such as user roles, asset criticality, known vulnerabilities, and threat intelligence. This process is time-consuming and inefficient.

GenAI can consolidate this information by integrating with existing tools and data sources, presenting all relevant context in a unified view alongside the alert. This enables faster triage, improved decision-making, and reduced frustration.

Start small.

Limit your initial scope to two or three data sources per detection family.

Always capture the data’s provenance so you know where each piece of information came from.

G - Guide: Making Sense of the Chaos

While SIEMs generate numerous alerts, synthesis is essential. The “Guide” use case focuses on consolidating noisy events into a coherent incident narrative to guide teams to accurate conclusions.

AI moves beyond presenting data to actively interpreting it. It acts as a synthesis engine, connecting the dots among thousands of low-signal, disparate events to identify a single, coherent incident and guide the analyst toward the most effective course of action.

Let Your Defenses Evolve with the Adversary

Effective defenses are adaptive. Rather than relying on manual trend analysis, GenAI monitors emerging patterns and proposes new detections or response playbooks.

For example, GenAI can identify an increase in a specific TTP and suggest a new detection rule, complete with tuning options and a recommended response flow.

This allows your defenses to evolve in near real-time, driven by the threats you’re actually facing.

From Alert Fatigue to Actionable Insight

A high volume of low-signal alerts can quickly overwhelm a SOC. Alert qualification addresses this by providing analysts with a single, synthesized incident summary instead of multiple confusing alerts.

This summary should provide a clear timeline, the incident scope, potential impact, a list of affected assets, and the likely root cause, all with a stated confidence level.

This approach significantly reduces alert fatigue and enables faster, more confident triage.

I - Intervene: Taking Decisive Action

While assistance is valuable, decisive intervention is essential for incident resolution. In the “Intervene” phase, Generative AI evolves from a co-pilot to an agent capable of orchestrating multi-step responses across the security stack.

The key is to do this safely, with human-in-the-loop guardrails from the start.

AI enables an accurate machine-speed response. It moves from a passive co-pilot to an active agent that can take direct, decisive action across your entire security stack, moving beyond rigid, pre-defined playbooks to execute dynamic interventions.

An intelligent GenAI agent should detect threats, determine the best response, develop a plan, and execute it. This capability should extend beyond the SOC to the entire environment.

Here’s how it breaks down by domain:

• In the SOC, this means automating manual, repetitive tasks for incident responders. For example, AI can isolate compromised hosts, block malicious domains, expire user sessions, and open tickets with asset owners within seconds of an alert. A practical starting point is piloting automated blocking of known malicious domains.

• For Network Security: The AI can push immediate updates to your security infrastructure. It could add a malicious domain to a DNS sinkhole, update a SASE policy to block a new C2 channel, or even microsegment a network zone where suspicious activity is detected to prevent lateral movement.

• Across Identity & Access: This is about responding to identity-based threats in real time. The AI can enforce conditional access policies, trigger a step-up authentication challenge for a user exhibiting risky behavior, or suspend a compromised account entirely. It can also enable true just-in-time (JIT) access, granting temporary elevated privileges for a specific task and automatically revoking them afterward.

• For Data Security: When a DLP policy fires, the AI can take immediate containment actions. It could quarantine a sensitive file, revoke all external sharing links, and notify the data owner with a list of remediation options, turning a potential data breach into a contained event.

• In cloud environments, rapid response is essential. AI can automatically quarantine suspicious workloads, apply restrictive security policies, rotate compromised credentials, or roll back risky infrastructure changes. A valuable initial use case is detecting newly public S3 buckets and automatically applying private ACLs.

To ensure safety, establish clear rules of engagement.

Define risk tiers to determine which actions can be automated and which require human approval.

Record the AI’s intent and approval, and regularly test rollback plans.

The objective is to achieve measurable outcomes such as reduced MTTR, fewer escalations, and time saved per incident.

D - Defend: Proactively Outsmarting Attackers

Many security programs have been reactive for too long. Proactive teams succeed by identifying early signals, anticipating adversary actions, and strengthening defenses before attacks occur. Generative AI enables this proactive approach.

AI enables a shift in the security paradigm from reactive to proactive. It allows your team to anticipate and neutralize threats before they can cause damage by identifying emerging patterns and hardening defenses earlier in the attack lifecycle.

Automate Threat Hunting

Manual threat hunting cannot keep pace with the current volume of intelligence and attacks. Automating this process with GenAI allows the AI to ingest data, cluster attacker TTPs, and automatically initiate targeted threat hunts.

When a suspicious pattern emerges, GenAI can initiate investigations on autopilot, correlate evidence, score risk, and surface only high-confidence leads to your team.

Build Security into Your Code

Scaling security requires a shift-left approach, and GenAI can support developers by integrating into the CI/CD pipeline. It acts as a real-time security coach, suggesting secure coding patterns, flagging vulnerabilities, and proposing specific fixes with code diffs.

This integration embeds security into the developer’s workflow, reducing vulnerabilities and minimizing the need for manual security code reviews.

Move to a Model of Dynamic, Just-in-Time Access

Static access policies and standing privileges are risky, as they become outdated and increase the potential impact of a compromise.

GenAI enables a more dynamic and secure approach. It can generate context-aware, fine-grained access policies on the fly, granting a user time-boxed, task-scoped access to a specific resource and then revoking it when the task is complete.

This is the essence of Zero Trust, and it dramatically reduces your attack surface.

Conclusion

AI is no longer a buzzword in cybersecurity—it’s an operational necessity.

It promises that by focusing on practical automation, continuous investigation, and human-centered collaboration, security teams can stay ahead of attackers and turn today’s challenges into tomorrow’s strengths.

The HAEGID framework offers a compelling visionary roadmap, recognizing that ‘Chatbots’ (Assist) are merely the starting point.

The leap from “Assist” to “Intervene” is massive. The article glosses over the “Trust Gap.” Cyber Builders might trust an AI to write a SQL query (Assist), but trusting it to “quarantine a sensitive file” or “revoke access” autonomously is a different universe of risk. The HAEGID framework implies this is a linear progression, but operationally, it’s a quantum leap.

What would be the criticisms of this framework? Let’s do my own critique. HAEGID probably takes an overly optimistic stance on data integration and downplays the operational risks associated with 'Intervene’ (automated actions); or it presumes a pristine data environment, which is seldom the case, and overlooks the ‘explainability’ crisis that emerges when AI agents begin making decisions affecting human employees.

I’ll be happy to understand how you can use the HAEGID framework to assess this promise. Next time you face a vendor claim, will it help? DM me to tell.

Previous Posts

It has been a few weeks since the last issue of Cyber Builders. I’ve been busy building! But rest assured, we are continuing our journey into the 12 Cybersecurity Platforms and AI impacts in them. In previous parts, we explored how AI is enhancing 9 cybersecurity platforms, such as Network Security and Endpoint Detection and Response.

We’re wrapping up this series by looking at the three platforms most changed by AI. These platforms handle what people create, communicate, and trust—the softer side of cybersecurity. As we move forward, let’s examine how these areas differ from the more technical security platforms discussed earlier.

Think about it: text, images, conversations, and decisions. Data that can be leaked, manipulated, or mimicked. Threats that use persuasion, not just payloads. That’s the space of Data Security, Fraud Detection and Transaction Security, and Resiliency Platforms.

Each of these areas is already changing. Vendors are experimenting with generative AI, using it for tasks such as automated data classification, behavior-based fraud detection, and adaptive response simulations.

If you have not read the first three parts, I encourage you to review them.

AI’s impact is most profound in platforms centered on data and content security.

Recently, I explored how AI is being used in network security and SOC enablement platforms. These technical platforms have primarily leveraged AI’s generative capabilities to enhance user experience. Previously, users had to learn complex configuration or query languages like Cisco IOS or Microsoft KQL—skills often celebrated with well-known certifications. Now, AI makes it possible for anyone to simply express their intent and have the system generate the appropriate query or configuration automatically.

Data-oriented platforms have a core input: human-generated content—documents, conversations, and business processes (such as continuity plans). Unlike cybersecurity platforms focused on configuration and queries, data-centric platforms are fundamentally shaped by the people who create and exchange “content” every day.

Generative AI changes this landscape. By processing and creating human content, these platforms can automate classification, collaboration, and interpretation of unstructured data. This drives major productivity gains as AI takes over manual review and tagging, making organizations more agile and precise.

Now, let’s take a closer look at how these changes are unfolding on various platforms, beginning with data security.

Data Security

Data is leaking at an unprecedented rate as constant connectivity increases risk. Vendors are embedding AI into data protection platforms to reduce blind spots, detect misuse in real time, and remediate exposures autonomously. They are also addressing AI as a potential threat by adding features to detect sensitive data leakage on AI websites such as ChatGPT and DeepSeek.

For example, Proofpoint has enhanced its Data Security Posture Management (DSPM) with an AI-powered layer that unifies DLP, DSPM, and insider controls under a single policy engine. Their “Nexus AI” classifiers ingest context to spot sensitive data with far greater precision than legacy systems. Proofpoint’s DSPM also visualizes data lineage, maps over-permissioned access, and recommends guided remediation. In many cases, you can remove risky permissions or lock down data stores with a single click. Proofpoint

In its Microsoft 365/Copilot integration, Proofpoint detects when sensitive data may be used in AI prompts and ensures that AI workflows access only sanitized or properly labeled information. Proofpoint

On Microsoft’s side, the illegitimate use of AI is seen as a threat. Microsoft updated Purview DSPM into the AI domain. Their DSPM for AI module gives you visibility into how employees use Copilot, ChatGPT, and other generative AI tools with sensitive data—and allows you to create policies to capture or block risky prompt content. Microsoft Learn

Purview DSPM for AI also provides real-time risk assessments of AI interactions, suggests correctional policies, and classifies sensitive content sent through third-party AI apps using browser extensions or network inspection. Microsoft Learn. DSPM for AI will use NetFlow or egress monitoring to track where sensitive data is going. This helps admins examine networks, spot exfiltration, and adjust rules as needed. (Technet)

Netskope is also layering AI into data protection by folding DSPM into Netskope One and extending its collaboration with Microsoft. With their integration into Microsoft Purview, Netskope can apply Purview DLP policies to broader network traffic and SaaS interactions—not just within Microsoft apps—and detect AI-generated data flows. (Netskope). Their Netskope One DSPM solution offers continuous, real-time visibility into sensitive data posture, flags risky interactions or misconfigurations, and helps security teams unify data governance across SaaS, cloud, and network layers. Netskope

Fraud Detection & Transaction Security

Fraud is becoming more sophisticated through AI augmentation, but defensive tools are evolving as well. Platforms now use advanced AI to detect subtle misuse, reduce false positives, and ensure legitimate transactions proceed smoothly.

Mastercard’s Decision Intelligence Pro is a standout example. This generative-AI-enhanced version of their transaction decisioning system analyzes up to one trillion data points, combining purchase history, device data, merchant relationships, and more to decide in milliseconds whether a transaction is genuine.
Thanks to this, banks using Mastercard’s network can spot compromised cards earlier, approve more legitimate transactions, and reduce the cost and friction of fraud. Mastercard

Ping Identity’s PingOne Protect tackles fraud at every step of the user journey. It combines identity, behavior, and device signals to assess risk and stop fraud early, all while keeping the user experience smooth. The system monitors device telemetry, network, and browser context, behavioral patterns, bot indicators, and more. Based on this, it assigns risk scores and takes the right action.

Feedzai offers a real-time risk-scoring and fraud-detection platform that operates across payments, retail, and banking channels. Their system uses machine learning models to evaluate transactions, detect anomalies, and adapt to evolving fraud patterns. They support multiple payment types, geographies, and channels—all through a single AI-driven platform that constantly learns and evolves. Feedzai

Sardine’s AI Risk Platform blends device intelligence, behavioral biometrics, and contextual data—from email and SSN patterns to geo and banking signals—to spot fraud as it happens. A neobank would cut its fraud rate while leveraging Sardine’s AI-driven detection capabilities. Device and behavior signals were pivotal. sardine.ai

Resilience Platform

Rubrik’s recently introduced Agent Rewind enables enterprises to “rewind” missteps made by AI agents across data, configuration, and workloads. It captures full context: prompts, memory states, tool usage, root-cause mapping, and offers selective rollback to a clean state—without full downtime or massive restores. Rubrik

When an autonomous agent accidentally deleted production data, Rubrik’s technology traced the prompt, isolated the change, and reversed the action—all while maintaining other operations intact. This shifts a backup/recovery platform from simply “store and restore” to “observe, audit, and rewind” in real-time when AI operations go off-script. Blocks and Files

Cohesity’s Data Cloud platform has embedded GenAI and RAG (retrieval-augmented generation) capabilities through tools like Gaia and the new “cyber recovery assistant”, enabling smarter incident response and recovery workflows. wwt.com

The system allows users to ask natural-language questions of their backup data, detect anomalies, trace threat activity, and execute recovery blueprints with AI guidance. For example, during a ransomware event, the platform can scan snapshots for signs of infection, help isolate affected data, and then restore from the cleanest point, all guided by AI-driven insights. Cohesity

Conclusion

Looking forward, the role of AI in resiliency platforms is expected to evolve rapidly. With predictive features, these platforms promise to anticipate potential threats before they occur, enabling preemptive measures to mitigate risks.

To truly protect data, fight fraud, and ensure resilience, platforms must use AI to reduce complexity and provide smarter, more adaptive responses. This dual focus is essential for both immediate and long-term security.

In my last post of the series, I will wrap up the impact of AI on the 12 Cybersecurity platforms.

Let me know what you think—it is a conversation!

Laurent 💚