A16Z’s Anne Neuberger, General Partner and Head of Global Affairs, writes today in the Wall Street Journal:

AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.

The same AI can work for defenders: finding exposed systems, ranking which matter most and generating fixes. For old equipment that can’t be patched, AI can create workarounds, such as a firewall rule or a settings change. The question is whether it can be applied fast enough.

The most significant national risk is concentrated, fortunately. Failures that would cascade across the country run through a few hundred operators and their shared vendors: large transmission substations, the Fedwire and ACH payment systems, water utilities serving big cities, core telecom networks and 911 systems, regional trauma centers and the health-record vendors. Smaller operators matter too, often as soft entry points, but protecting the critical few first buys time to fix the rest.

Drawing on her experience as Deputy National Security Advisor for Cyber and Emerging Threats for the United States, Anne outlines a plan for a new model to drive national cyber resilience, accountable to the White House’s Super Intelligence Force, and led by CEOs of key American companies responsible for critical infrastructure:

Executive summary

The U.S. must address the significant risk that a cyber attack disrupts the operation of critical infrastructure that a large number of Americans rely on. This cyber defense plan outlines the governance and actions that are necessary to identify and contain the exposure at the few hundred operators and shared vendors whose failure would cascade nationally. The plan of action aims to (a) put in place adequate cybersecurity in each sector, accounting for many old, unmanaged systems, (b) use SI to find and fix vulnerabilities in sector-specific, broadly used code, and (c) create AI guides or harnesses for organizations’ unaddressed vulnerabilities to allow for rapid ID’ing of necessary patches as new models come out. A second phase of this work would establish digital replicas or “twins” of critical, shared systems across sectors to enable regular testing of shared systems.

The public-private partnership plan activates and makes accountable leading companies in each sector as they understand the most significant operational risks in the sector, and without their role, the scale of U.S. infrastructure makes rapid, broad progress difficult. The White House’s Super Intelligence Force would establish a CEO council that is accountable for overall results. The sector Information Sharing and Analysis Centers would become the AI-enabled drivers that deliver them to each sector’s designated regulator.

• Scope: five sectors — power, banking and payments, water, communications, and hospitals.

• Targets: the few hundred operators and shared vendors whose failure would cascade nationally.

• Technical core: use AI to find flaws and produce tested workarounds at machine speed, eliminate internet exposure of control systems, segment networks, prove 72-hour manual operation. Determine the nationally scaled defenses that telecoms, Infrastructure as a Service, cloud networking (e.g. Cloudflare) can provide and what legal protections are required to activate these national cyber defenses.

• Governance core: CEOs sign sector targets and report monthly via ISAC scorecards. Large operators assist small ones.

• Legal fixes may be necessary: liability protection for information sharing and a potential safe harbor for participating companies who meet outcomes-based targets.

The threat and the regulatory gap

AI is shrinking the time between finding a flaw and exploiting it. Meanwhile, much of critical infrastructure cannot be patched on that timeline today. Operational technology (OT, the systems that run physical equipment) often stays in service for more than 20 years. Some of it cannot be patched without risking outages.

Current regulatory rules were not built for this threat, with fixed patch windows and a compliance mindset, measuring whether controls are in place rather than the exposure and containment speed.

Organizing for Impact

A National Governance Model to Drive Rapid Scaling of Cyber Defense

Accountable to the White House’s SI Force, led by CEOs, run through the (Existing) Sector Coordinating Councils and Information Sharing Analysis Centers (ISACs) and Regulators

The U.S. lacks a governance model to drive a purposeful, rapid effort to secure the most critical infrastructure. This plan outlines that model in a public-private partnership. In summary, the White House’s Super Intelligence Force sets national targets, CEOs commit their sectors to them, and the SCCs/ISACs deliver the work within each sector and measure the results.

The U.S. has a governance system to drive this work – established twenty years ago by executive order, each sector has a strategic Sector Coordinating Council and an operational Information Sharing and Analysis Center - but it needs renovation. Sector Coordinating Councils (SCCs) and Information Sharing Analysis Councils (ISACs) are private sector led, non profit entities that function under federal directives and established public private partnership frameworks. The most effective ones have two layers, a CEO and CISO layer, to enable both strategic and operational action on cybersecurity across the sector. Today, the power and financial services sector ISACs have CEO-level involvement; the water, telecom and hospital ISACs do not.

The White House’s established Super Intelligence Force should leverage these ISACs, to coordinate work with critical infrastructure sectors. The SI Force will need to work with the most influential CEOs in sectors where the ISACs do not currently have a CEO-level layer to ensure those ISACs are upgraded to create a CEO layer to drive the action needed.

In addition to the existing ISACs, this plan activates two other groups: (a) cloud, cybersecurity providers, and telecoms to identify technical cyber defenses that could be scaled broadly, if there were appropriate legal liability protections, and (b) AI labs and technology firms to partner with critical infrastructure firms to scan their code and firmware and produce fixes and workarounds. AI labs should also work with makers of industrial control systems to build digital twins of standard equipment, so fixes can be tested before they touch a live grid or water plant with findings flowing through Gold Eagle, the administration’s new AI-enabled vulnerability clearinghouse, which should expand from software into industrial equipment. Equipment makers, many of them foreign, should have to act on findings by a deadline as a condition for selling to critical operators. Success should be measured by how quickly flaws are contained and whether essential services can keep running under attack.

The following chart summarizes the participants and their roles in this national cyber defense plan:

How accountability would work

1. Signed commitments. Each council CEO signs the sector’s targets: zero internet-exposed control systems, 72-hour manual-operation drills passed, critical vulnerabilities contained (patched or with a compensating control) within a set time.

2. Monthly scorecards. Each ISAC reports anonymized sector-wide metrics to the White House’s SI Force. Each CEO sees their own company’s position against the sector. A sector behind target triggers a CEO-level review with the SI Force leader.

3. Board sign-off. For public companies, the board attests to outcomes-based progress metrics, consistent with existing SEC cyber disclosure rules. Regulators accept that attestation in place of duplicate audits, which incentivizes involvement.

4. Large operators sponsor small ones. Utilities sponsor co-ops and city utilities in their footprint. Large health systems sponsor rural hospitals. Big banks fund community-bank tools through FS-ISAC. National carriers backstop rural carriers.

5. Cross-sector drills. Every sector depends on power and telecom. So, in 3-6 months, the CEO council runs a joint drill modeled on GridEx (the grid’s large-scale attack exercise), with power, telecom, banks and hospitals responding together to an AI-speed attack.

What each ISAC becomes

Today ISACs mostly share threat alerts at the CISO level. Under this plan they would expand to drive the sectors’ work:

• Shared AI tools: detection rules, exposure scanning of members, and AI-generated workarounds (eventually tested on digital twins (software copies of real systems) to enable confidence).

• Coordinated fixes: one channel to vendors for AI-discovered flaws affecting the whole sector.

• Mutual aid at scale: builds on the electricity sector’s Cyber Mutual Assistance program and banking’s Sheltered Harbor data-restoration standard.

• Metrics: the ISAC produces the scorecard, so companies report once.

Note: CEOs will not authorize sensitive data sharing without legal cover and firms may have legal liability for vulnerabilities they identify. Hence the SI Force must identify mechanisms to provide legal protection in both instances. The first would be addressed by the reauthorization of the Cybersecurity Information Sharing Act of 2015, the second by some form of time-based liability protection.

The Technical Strategy

Strategic technical approach: contain, prove resilience, scale with AI

The overall technical strategy is to protect the targets that matter most first, contain what cannot be patched, and use AI so a small number of defenders can cover thousands of operators.

1. Rank the targets per sector and identify the critical ones to participate

Rank operators by how much harm a failure causes and how many others depend on them, not by size. Shared vendors often carry more risk than any single operator. Below is the suggested approach for the five first sectors.

• Power: large transmission substations, balancing authorities, and the plants needed to restart the grid after a blackout.

• Banks and payments: Fedwire, ACH, CHIPS, clearing houses, and widely shared cloud and core-banking vendors.

• Water: utilities serving large populations (those with 50,000 or more Americans), especially their chemical dosing controls.

• Telecom: internet routing, the core mobile network, 911 systems, and the timing signals other sectors rely on.

• Hospitals: regional trauma centers, electronic health record vendors, and medical device makers.

2. Contain what can’t be patched

• Find and close exposure: AI-assisted scanning finds every internet-facing control system, VPN and remote-access path. Each is cut off, placed behind a monitored access point, or protected with phishing-resistant multi-factor login.

• One-way connections: hardware that only lets data flow out of the most critical control networks.

• Shrink the blast radius: separate IT from control networks, and segment by site so one breach can’t spread across a whole utility or health system.

• Prove manual operation: every top target shows it can keep operating without its IT systems for 72 hours, tested in drills. Hospitals use paper charts, utilities manual control, banks fallback settlement.

• Backups out of reach: offline copies of control-system configurations, demonstrated ability to reconstitute IT systems from bare-metal, so systems can be rebuilt quickly.

• Prepare for resilience: pre-position regulatory waivers and authorities to direct critical resources during response to major operational outages.

3. Scale defense with AI (delivered through the ISACs)

• Find and fix flaws: AI vulnerability discovery on open source, vendor code and firmware before release. Findings go to manufacturers through a national clearinghouse, and vendors must provide a fix or workaround on a set timeline with a window for critical infrastructure to deploy fixes and protections before broad distribution.

• Fix with workarounds: for systems that can’t be patched, AI turns each flaw into a specific compensating step (a firewall rule, a monitoring alert, a configuration change), tested on a digital twin before it goes live.

• Block malicious traffic: CDNs, firewall providers, telcos and network providers can redirect malicious traffic before it reaches operational systems. Government authorities may be necessary to deploy at scale.

• Monitor for operators who can’t afford staff: a subsidized AI security operations service for small water systems, rural hospitals and electric co-ops. (Nonprofit funding is available today.)

• Train against realistic attacks: AI-driven red-team exercises against each sector’s digital twins, so defenders practice against attacker-speed tools.

Guardrails: AI defense tools are read-only for control networks by default, and a human approves any change.

Sector playbooks

Each sector has one top risk, priority plans, an ISAC to run it, and a short list of CEOs chosen by the size and influence of the firms they lead in that sector.

Policy, Funding and Metrics

Cross-sector members

Every sector runs on the major cloud providers (Microsoft, AWS, Google) and increasingly on frontier AI labs. They join the SI Force CEO Council as members responsible for the AI defense tools and for discovering flaws in vendor products.

Policy levers, funding and proposed timeframes

The White House’s Super Intelligence Force must address policy, legal liability and regulatory issues to incentivize the necessary participation. The bullet points below outline the priority fixes needed.

• Measure results, not paperwork: regulators track zero exposed control systems, time to contain a critical flaw, and proven hours of manual operation, not checklists.

• Regulatory relief for performance: companies that hit outcomes-based targets and have board sign-off get safe harbor protections.

• Vendor responsibility: secure-by-default requirements in federal purchasing; vendors disclose how long they will support a product and must offer fixes or workarounds for AI-discovered flaws on a set timeline.

• Information sharing: long-term CISA 2015 reauthorization, so operators can share AI-generated threat data quickly and with legal protection.

• Compute for defense: the federal government secures frontier-model access and compute for the participating companies and the national vulnerability clearinghouse.

• Workforce surge: a reserve of vetted responders, drawn from large operators and vendors, who can be sent to the most critical of critical infrastructure during an incident.

Timeline and metrics

The top targets should be contained within 6 months. Some have proposed replacing unsupported equipment but that is costly and can take 2–5 years, which is why containment comes first. The cost of addressing the scale of national tech debt is likely to be significant. It must be prioritized for those operators and shared vendors whose failure would cascade nationally and who lack the resources to upgrade their systems unilaterally.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

To hear more from , , and on this topic, check out the companion podcast to this piece here.

If you want to understand an industry, study its favorite archetypes.

In the case of gaming, first there’s the indie dev. This category includes guys like Eric Barone (the creator of Stardew Valley), Jonathan Blow (Braid, The Witness, and Order of the Sinking Star), and small teams like Tarn and Zach Adams (co-creators of the epic, sprawling world-sim Dwarf Fortress). People like these developers and the games they create because despite all odds they were able to create a commercial success well outside of the warm confines of a conventional studio. They are the gaming equivalent of the nerdy guy getting the girl. The fact that these games could succeed at all is part of their appeal (they are also, of course, quite fun).

Then there is the prophetic toolmaker: guys like Tim Sweeney and John Carmack. These are people whose experiments programming bare-metal and pushing the boundaries of hardware later expanded what other people could build. Their work produced engines, editors, and simulations that eventually became environments for other people to build in.

Finally, there is the world-building studio. These are teams like Rockstar Games (Red Dead Redemption 2 and the upcoming GTA VI) or Larian Studios (Baldur’s Gate 3) who spend years constructing a place whose detail and verisimilitude (not to mention tiny easter eggs) exceed anything one player is likely to notice. As examples: Red Dead’s wildlife includes possums playing dead and bears bluff-charging and GTA VI will have six in-game radio stations (including one hosted by fictional characters voiced by Lana Del Rey and her husband). People love these games because of how lived-in they feel.

These archetypes gesture at different values: indie devs get to toil away at their specific vision, and occasionally strike gold when that vision resonates. The prophetic toolmakers are responsible for pushing a technical boundary. And the world-building studios construct a game of extraordinary depth.

Usually, when a scary new disruptive technology gets introduced to an industry, the first things to suffer are the archetypes. But this may not be the case for AI. In fact, the most compelling case for AI in games is that it can accelerate all three. The same technology that helps one person realize a strange idea can help an engineer investigate a game’s internals, or give a studio more opportunities to experiment within a production that already employs hundreds of specialists.

This was the theme we (Anish, Jon, and I) kept returning to during our recent conversation about AI and games. We all have stories of games we’ve wanted to make for years, and we all had different things that had prevented us from attempting them, like a missing technical skill or the difficulty of sustaining an ambitious project long enough to finish it (especially when we all have full-time jobs that have nothing to do with the day-to-day of game development). Reducing those obstacles means we (and much more professional versions of us) can attempt more ideas. It also increases how ambitious an attempt can be.

The opportunities fall along two dimensions: whether AI is helping with an existing game or a new one, and whether its main contribution is lower cost or new possibilities.

For the would-be indie dev, the immediate opportunity is to bridge the gap between having a very specific idea and possessing every skill required to express it. Being excellent at one aspect of game design, like devising a core loop, can still leave a person unable to make the thing they want because they might be lacking in other key areas. In our podcast, Jon describes agents working across these disciplines: helping with a design document, constructing assets in Blender, assembling a scene in an engine, inspecting screenshots, and attempting fixes. So a solo developer might lean on tooling in the Produce quadrant to get them to a playable prototype, and discover what is interesting about an idea much earlier.

There’s still, of course, considerable work between that discovery and a finished game. Anish’s Habbo Hotel-inspired record store experiment, which he discussed on our podcast, originated with a DJ friend of his complaining that online record shops all looked like cookie-cutter eCommerce sites. Anish wanted to build something that felt more akin to shopping for records in Toronto in the 1990s, which involved loud music, mixtapes, rave flyers, and serendipitous conversations. Anish gave a model visual references from Habbo Hotel and began reconstructing that experience. The record shop occupies Invent in the chart because production assistance serves an end-to-end game.

Anish eventually made his record shop and its surrounding street moddable, with storefronts other players could build out. His son added a pet-adoption center (which Jon pointed out could be a nod to the much-played Roblox game, Adopt Me). The animals in his record shop could be adopted and follow their owners around, a behavior Anish hadn’t put into the original project; he says the coding agent added it and made the original record shop codebase backward-compatible with the new mechanics. This is Extend: a player brings an idea into a world he already knows.

Jon’s eight-year-old son offers a smaller, contemporary version. He wanted to play Ghost of Tsushima; Jon thought it was too violent. He began asking ChatGPT about its mechanics and boss battles, then used Codex to help build a Minecraft mod inspired by it.

A lot of these emergent model capabilities, like using Blender or 3D libraries like Three.js and Spark.js, really only materialized in the past couple of months. When OpenAI’s Astra was released, people were immediately blown away by its sophistication in computer use, which involved being able to do long-running tasks in computer graphics suites and engines like Blender, Unity, and Unreal. And the Opus series of models from Anthropic has proven especially great at end-to-end game design, as well as code implementation. A few months ago, you may have been able to get a model to generate some usable assets or a game spec. Now you can literally prompt something like “make this game more fun” and voila, the game is more fun. Simon Willison has a great post exploring a lot of these dynamics in more detail.

The increasing capabilities of these models offer a good transition into exploring the “prophetic toolmaker” archetype and what role they might have in the AI age. AI is getting demonstrably better at putting games together. It also, quite remarkably, is great at taking them apart. This is a process known as decompilation, which involves working backward from a compiled program toward source code that people can inspect and modify.

Getting there requires inventive engineering of its own. In Maurice Heumann’s account of an AI decompilation project, where he steered a team of agents toward decompiling an FPS game, agents initially produced readable code with incorrect behavior. This forced his team to introduce a check that compiled reconstructed functions and compared them with the original binary, accounting for references whose addresses could change. This is a useful picture of the new technical pioneer: a project overseer designing the conditions under which agents can tackle a problem reliably. This is an example of Recover.

On the podcast, Jon pointed out that, by his count, there are at least four decompiled instances of Halo that run in-browser. We are fully prepared for the new gaming heuristic to change from “Can it run Doom?” to “Can it decompile Halo?”

It would have been very easy for large studios to dismiss AI out of hand (as many gamers have done in recent months) and even easier for them to get angsty and litigious in the wake of rising decompilation efforts. So it’s been interesting to look at the responses of major studios that are signaling real openness and excitement.

In October, Tim Sweeney described a reorganization around AI-assisted development, with the aim of enabling employees to make more and better work and extending the benefits to teams using Unreal. Xbox’s announcement of Xbox Labs focused on games being reconstructed for new hardware, browser ports, and remixes. Xbox established a group to explore these possibilities and share tools. The significance of this is that established companies see opportunities both in expanding production and in making existing libraries newly usable.

For the world-building studios, the opportunity is twofold: the ability to collapse development cycles, and to reconsider what is worth attempting in the first place. As Jon pointed out on the podcast, committing years and hundreds of millions of dollars to a game incentivizes producers to favor familiar franchises. AI opens up new opportunities by shortening the time between idea and prototype. By shortening development cycles, a studio is able to prototype more game ideas faster, and thus take more risk on original IP or experimental genres that would not have otherwise been greenlit under a traditional development cycle.

All three of us are building games ourselves now, and by the end of the podcast we were discussing how far we wanted to take that freedom. Anish has been working on reviving Solar Realms Elite, a multiplayer game from his bulletin-board days whose source code was lost. A design document and an executable survived, and he’s persisted, returning to the project with each new generation of models, and now has what he describes as a faithful recreation running on his computer. Jon wanted to revisit Civilization II and endow subjects with agendas of their own, so that ruling an empire would involve persuading people to cooperate. Elena is thinking about resuscitating some old dating sims she made in Unity, back in the pre-AI days.

The obvious criticism to lob at this current era of AI-generated games is that they might be fun for the creator, and maybe a small cohort of their friends, but we’re still far away from truly expansive and coherent AI-generated games. Critics might say the reason that these early AI games are fun has more to do with the novelty of creating a game, and less to do with the actual entertainment value of the game itself. But is that really a bad thing? Creation has long been play—from building Legos to doodling with crayons to building worlds in Minecraft.

This just means that we’re witnessing one of the things we’ve always loved about gaming: that it creates a cottage industry of how-to guides and tacit knowledge and idea exchange. Gaming also has a history of people finding something compelling while tinkering with someone else’s work; as a well-known example in the world of modding, Counter-Strike began as a Half-Life mod in 1999. We can take that story seriously without expecting every Minecraft mod or vibe-coded game to become the next Counter-Strike.

Basically, expect a lot more games in the future. Someone who gets into game development by reconstructing an old favorite might discover an interest in its underlying systems (it is really hard to get into decompilation without learning what a game binary is, for example). Someone who makes a world for their friends might keep expanding it for years and attract a massive audience. These are recognizable tropes and origin stories for the archetypes we already admire. An industry so fond of stories about obsessive people making unlikely things should be excited about giving more people somewhere to start.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Before we dive into today’s article, congratulations to Counsel Health on its acquisition by OURA. Read more about the news here.

The primary users of the Internet are no longer human. They’re AI agents.

Agents now make up the majority of web traffic, write more than half of new articles published online, and generate most of the code pushed to production.

This is what the early stage of a platform shift looks like: adoption is measurable, but the business models it enables mostly aren’t visible yet. Every prior shift changed both what people could do and how businesses reached them. The Web gave businesses a storefront anyone could visit; mobile put that storefront in everyone’s pocket. AI has already changed what people can do, but its transformation of distribution is just beginning.

As agents move from answering questions to completing tasks, they’ll increasingly decide which products to use, which services to subscribe to, and where to spend money on our behalf.

Businesses that treat agents as first-class customers have a shot at a wave of growth. Those that don’t may find themselves under threat. For years, retailers and platforms built walls to keep bots out - now, they will have to fight for bots’ business.

If agents break out to the true consumer and capture real usage, they’ll unlock the biggest unrealized opportunity in AI: a true platform shift. Every prior platform shift (web, mobile) paired a new product capability with a new distribution mechanism. AI has overperformed on the first and underperformed on the second, which is a big reason consumer adoption has stayed so limited outside ChatGPT.

The early signs of a distribution shift are already here. LLMs like ChatGPT, Claude, and Grok are a large and valuable source of traffic for many businesses. Shopify reported that AI-driven traffic to its stores grew eightfold year over year in Q1 ‘26, while orders from AI-powered searches grew nearly thirteenfold. And it’s accelerating: Human Security saw agentic browser traffic grow 8x between August and October, with Muse driving the largest share of activity (60%) and OpenAI products reaching a combined 30%.

Just like websites could target users more effectively than billboards, agents should hypothetically be an even stronger referral source - as they have deep and specific data on the user and their needs. So far, this is proving to be true - AI-referred consumer traffic is higher engagement and converts better to revenue than non-AI traffic, with a lower bounce rate. Even pre-agents, an estimated 11% of shopper journeys in the U.S. visited AI before a transactional site.

Right now, most of this traffic is happening via browser use - where an agent either takes over the user’s browser, or spins up its own virtual machine and browser instance, and completes the task by clicking around like a human would. However, we’re starting to see the emergence of the equivalent of an App Store for agents, but on steroids - connectors, plug-ins, and MCPs, where agents can more directly access third-party tools and sites.

As one example - we asked ChatGPT to create and edit a video ad using the Krea, Descript, and Eleven Labs plug-ins. It coordinated across the products, and upsold us on a Descript paid plan to get the video done.

Using an agent to sign up or pay for a product will only get easier as the underlying platforms allow a user to “lend” their identity or tokens to other products to get a task done (ex. Sign in with ChatGPT). Eventually, agents will be able to select and install the tools they need without human intervention - Claude already allows enterprise admins to connect plugins for their entire organization. Just yesterday, OpenAI launched Businesses in ChatGPT - companies can now claim their business, add product feeds, and see insights on how users interact with them on ChatGPT.

There are a few categories of companies that may stand to benefit from the B2A economy:

• Agents / agentic models - most people picture ‘consumer agents’ as standalone harnesses like Instinct, Muse, and Wabi. We believe every product will soon operate agentically, as the models behind them get more action-oriented. ChatGPT (with 1.2 billion weekly active users) has a particularly intriguing opportunity here.

• Products newly enabled by agents - Amazon needed the Internet to come to life, and Uber could not have existed without the mobile phone. We expect agents to produce their own examples. Exactly how is hard to predict, but a few themes include self-running SMBs, marketplaces or network products that are AI-intermediated, and auto-optimizers.

• Incumbents who optimize for agents - LLMs have already been a significant source of traffic for many websites, which formed the basis of the generative engine optimization (GEO) industry. GEO largely stops at discovery. Agents will take it further, into evaluation and execution of purchase / signup choices, an even larger market.

• Agent infrastructure - for agents to operate in the real world on behalf of their humans, they’ll need their own set of tools. We’re already seeing system strain at fairly low agent volume on payments, fraud and identity, and communication (iMessage, calls, email, etc.).

We already have one case study of how this might play out - coding agents, which completely transformed developer behavior. As of September 2026, upwards of 40% of GitHub PRs started with an agent’s draft - versus just 17% six months prior.

Like consumer agents, coding agents have to rely on external tools to complete tasks. Say a user asks an agent to build a website. Finishing that job may require a database, hosting, authentication, email delivery, and monitoring. Beyond the agentic models and harnesses themselves (Cursor, Codex, Claude Code, Cognition, as well as vibe coding platforms like Replit, Lovable, and Base44), many other players saw growth:

• Supabase reported in June ‘26 that more than 60% of new databases are launched by AI tools

• Neon reported in May ‘25 that automated agents deploy 80% of its new databases

• Stripe reported in June ‘26 that agents accounted for nearly 40% of documentation traffic and 70% of CLI requests for API resources

• Vercel reported in October ‘26 that agent-triggered deployments had increased 28x over the last twelve months

Fewer than 1% of the global workforce is developers - what happens when the other 99% starts using agents?

This is the first in a series of pieces exploring the agent economy. Calling it “AI commerce” undersells the opportunity - yes, agents will drive transaction volume to physical products and services. But, they will also reshape how traffic, tokens, and revenue are routed to digital products. Most enterprises are still blocking agent traffic due to concerns about fraud and chargebacks, but we believe they’ll have to embrace an increasingly valuable wave.

Over the next few weeks, we’ll be publishing more insights and data around what consumer agent usage looks like now, how agents are deciding which sites and products to direct traffic to, how infrastructure is developing around agents, and what the remaining hurdles are for agents to complete transactions.

This space is changing on a daily basis - below is our best current mapping of the market. This includes the agents themselves, as well as the infrastructure that allows them to exist.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Today, companies expand their reach at an unprecedented speed. The best ones deliberately build their product and services for a global audience. As a result, their products need to be in every language and localized to meet their customers where they’re at.

But localization is not simply running all of a company’s text through translation - it involves isolating and managing translations across disparate surfaces like codebases, documentation, marketing, media, and more. It also involves working across internationalization libraries, traditional translation management systems (TMS), and even external agencies.

It’s a time-consuming, difficult process that results in a lot of brittle workflows and slow release cycles. And companies spend billions annually doing it. The maintenance itself is another nightmare - copies go out of sync, and UI components break visually.

The good news is this is the type of problem that’s ripe for disruption by AI and, with the right technical primitives, the entire localization stack can be reinvented from the ground up to solve these problems.

That’s why we’re very excited to announce our investment in General Translation. General Translation is first and foremost a developer infrastructure company. Their unique approach is full-stack localization - rather than having designers and engineers rip out translatable text from design and logic, teams can now use General Translation’s developer primitives to integrate directly into their React apps, documentation, and more.

The end result is consistent, AI-powered localization across all surfaces and products while directly integrating with daily tools like GitHub, Figma, and Slack. Rather than treating localization as a separate step, it becomes directly integrated into the product development cycle so companies can get back to building.

Today, some of the fastest growing companies like Cursor, Cognition, Ramp, and Clickhouse are already using General Translation to scale their products to every language. What really stood out to us when talking with these customers is how transformative the experience is compared to legacy localization services, and how much they valued the team’s speed, technical judgement, and attention to detail.

Since day one, Archie McKenzie and the entire General Translation team have had a strong love for languages and elegant systems. Archie came from a classical languages background and majored in Computer Science at Princeton. He has the rare combination of understanding the messiness of language problems as well as designing scalable software. That’s resulted in a distinct product with a laser focus on craft.

We believe more companies should be able to serve global audiences earlier without having to deal with the headache of localization. We couldn’t be more excited to lead their Series A and have Martin join the board.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

At the start of the Great Depression and with seemingly impossible engineering challenges before them, San Francisco began construction on the Golden Gate Bridge, a project long-derided as “the bridge that couldn’t be built.” Workers constructed what was then the world’s longest and tallest suspension bridge amid fierce currents, fog, and high winds. Construction began in January 1933. Cars crossed the bridge by May 1937. The cost was $35 million. The feat rivaled the construction of the Empire State Building a few years earlier: 102 stories in 410 days and a month ahead of schedule. It was an age of builders, where seemingly impossible feats of engineering, great and small, were routine across America.

Nearly a century later and five miles away, San Francisco commissioned another public work: the Noe Valley public toilet. The 150-square-foot bathroom containing one metal toilet and a baby changing station was projected to cost $1.7 million and take over two years to build. After public outcry, the city accepted a donated modular bathroom alongside pro bono engineering and architectural work. The project still cost taxpayers around $200,000, as the donated toilet still required permitting and sign off from over a half-dozen agencies, including the Arts Commission.

It is easy to handwave the Noe Valley toilet as an outlier, but the same sad tale repeats itself across the country:

• California’s high-speed rail project has spent $13 billion of its original $33 billion budget with little to show for it. Its estimated total costs have ballooned to $128 billion.

• In two decades, America has completed only two large nuclear reactors from the ground up, seven years late and roughly $23 billion over budget. At its peak, America completed four or five a year.

• An Arizona mine capable of supplying a quarter of U.S. copper demand has sat idle since its 1995 discovery, facing a 35-plus-year path to production due to permitting and litigation.

• A 550-mile transmission line took 17 years to complete. Construction took two years. Legal battles took the rest. Its sister project took 15 years.

• A 94% complete West Virginia pipeline stood idle for nearly a decade amid permitting disputes resolved only by an act of Congress and Supreme Court order.

These examples would be comical if they were not symptomatic of a deeper illness. Our communities face failing infrastructure, aging buildings, and utilities increasingly inadequate for a modern economy. America’s share of global manufacturing was 25% in 1997. It is 16% today. Absent intervention, it will fall to 11% by 2030.

These failures persist despite our access to technologies, capital, and expertise unimaginable in the age of builders.

We should be building faster and more safely than ever before. Instead, we are doing the opposite.

What is stopping us from building?

Democracy Is Not the Problem

Some blame our inability to build on democracy itself: too many disparate voices when efficiency demands a single, powerful voice. This view portrays embarrassing inefficiencies as the price of freedom, presenting a false choice between liberty and effective development.

While this argument is superficially persuasive—factories, data centers, ports, even whole cities seem to rise overnight in China while these projects would take years, if not decades, to build here—it ultimately gets it exactly wrong. History is replete with examples of authoritarian states dismally failing at industrial projects. Even when authoritarian states build, they often build inefficiently, rewarding raw output over profitability. The result is a system that builds things no one wants. It is why China, the model of authoritarian industrial might, produces ghost cities and vast industrial overcapacity it must then dump into the global economy.

Democracies can build at extraordinary speed when governments create the right conditions. After Congress created dedicated financing, national standards, and clear federal-state responsibilities in 1956, the United States opened roughly half of the Interstate Highway System within a decade. Modern democracies still demonstrate this capacity. Spain has built more than 3,800 kilometers of high-speed rail (second only to China) at comparatively low unit costs. Taiwan has paired one-stop industrial administration and ready access to land, power, and water to bring cutting-edge semiconductor fabs online in roughly two years.

Regime type is not the decisive variable. What matters is whether industrial policies enable construction: clear authority, standardized requirements, predictable financing, competent agencies, and rules that force governments to reach decisions rather than merely create opportunities to delay them.

Environmental Safety is Not the Problem

Another common fallacy holds that endless process is the price of environmental safety: that permitting, siting, and interconnection barriers delaying hundreds of renewable energy projects are somehow what lead to a clean environment.

The idea seems simple. Less building leads to less pollution. But industrial production does not disappear. It moves elsewhere, often to China, which emits two to three times more carbon per unit of output than America. Blocking a factory here does not eliminate emissions. It exports them to a dirtier producer. The result is an example of inadvertent policymaker murder-suicide: in demanding ever more onerous process, environmental advocates harmed both American industry and the environment.

Endless process does not save the environment. Canada and Australia—hardly known as environmental free-for-alls—permit mines up to five times faster. Madrid, bound by the EU’s strict environmental laws, expanded its metro faster and more cheaply than almost any city on Earth. Switzerland, no less committed to nature, bored the world’s largest rail tunnel beneath the Alps and delivered it a year ahead of schedule. These are not countries that decided nature matters less.

Instead, they emphasize substantive environmental protections while minimizing procedural delays. Environmental studies can be consolidated into a single permit. Courts review the permit’s legality, rather than endlessly relitigating the underlying analysis. Challenges run on short clocks. And the loser may bear the winner’s costs, disincentivizing frivolous suits. For highly consequential projects, legitimacy can be established up front.

The Real Problem: Rewarding Process Rather than Requiring Results

The United States did not take this approach. Instead, it married an extraordinarily demanding procedural apparatus to a litigation system seemingly incapable of finality.

The most notable culprit is the National Environmental Policy Act (NEPA). Unlike substantive statutes such as the Clean Water Act and the Clean Air Act, NEPA is procedural. It requires agencies to analyze and disclose environmental impacts before major actions involving federal land, permits, or financing. As the Supreme Court observed in 2025, regulatory layering and aggressive litigation turned it from “a modest procedural requirement into a blunt and haphazard tool” employed to thwart new construction.

The result is years of procedural review under a statute that imposes no substantive environmental standard. In 2024, even the simple environmental assessments averaged over a year while the more demanding Environmental Impact Statements (EIS) took nearly four years. Department of Energy data puts the mean EIS cost at $6.6 million and even smaller assessments at $300,000. That is before legal fees, staff time, and litigation, meaning NEPA can push even the smallest projects over $1 million in permitting costs alone.

Like lampreys, these attacks latch on and slowly bleed a project dry. Clearing one review provides no finality, as opponents may bring another challenge using NEPA or a related statute.

Sometimes, the threat alone kills projects at inception. Investors understandably hesitate when a permit provides no certainty, meaning that capital cannot deploy and America cannot build.

Ironically, this procedural obsession often blocks projects meant to save the environment. It helped doom Cape Wind, a proposed 468-megawatt offshore wind project in Massachusetts, abandoned after more than 15 years and over $100 million without a single turbine built. Instead, developers spent their money answering “dozens of sometimes overlapping, often contradictory agencies, hundreds of officials and thousands of pages of impact statements,” and litigating various claims, such as the allegation that turbines nearly five miles offshore would disturb spiritual tribal resources.

This obsession with process repeats across industries, imposing costs on builders and the communities they serve. Transmission lines wait more than a decade amid permitting fights, while NEPA lawsuits disproportionately delay clean energy projects. The same procedural weapons are routinely turned on housing. State versions of NEPA are frequently used to block new homes, burdening families rather than polluters. And the problem extends beyond permitting. More than 2,000 gigawatts of energy capacity, nearly twice the existing U.S. power fleet, sit waiting to connect to the grid in an “interconnection queue” that now averages about five years per project.

None of this protects the environment, helps consumers, or lets America rebuild. It is the fetishization of process: endless rechecking and re-litigation without result. And it is self-perpetuating. We have built regulatory labyrinths that only the largest firms can afford to navigate, creating an ecosystem of attorneys, accountants, and consultants paid to guide companies through the maze who, as a result, have every incentive to keep it standing.

We thus tax the innovator twice, once by the state and again by the outside expert, slowing progress and discouraging the building of vital businesses and infrastructure. The cost and complexity keep new companies from building and push established ones abroad, often to jurisdictions where the same output pollutes more. It is the worst of all worlds.

A Bipartisan Solution

So what is the secret of nations that build? They reward responsible construction rather than delay. We can have a vibrant democracy that protects the environment alongside historic reindustrialization. Our procedure is the problem. And that is eminently fixable.

Thankfully, there is a growing bipartisan consensus to do exactly that. Petrochemical executives, renewable energy advocates, builders, and bankers, among other unlikely allies, support permitting reform. The Senate’s Bipartisan American Affordability and Jobs Act of 2026 along with similar bipartisan House bills give that coalition a concrete path forward. These provisions deserve support because they address the uncertainty that keeps companies from committing capital to American factories and infrastructure. Here are five priorities that the final bill must address:

1. Limit Procedural Review: The Supreme Court has confirmed that NEPA is procedural. The Senate bill would codify that principle and generally allow construction to continue while agencies correct NEPA errors, rather than halting projects for those errors. It also expedites judicial review to quickly resolve any legitimate disputes. The bill would additionally curtail NEPA’s current expansive jurisdiction by establishing that a federal loan or loan guarantee alone would not trigger NEPA review for nearly all privately developed project.

2. Enforce Hard Deadlines: Congress should impose hard deadlines for federal authorizations, adequately staff permitting personnel, and provide enforceable remedies when agencies fail to act. The Senate bill does so, creating not only firm deadlines for agencies but deadline-enforcement legal mechanisms that incentivize prompt agency decisions.

3. Establish One Project, One Review: Congress should designate a lead agency and, as the Senate bill would allow, bind federal participants to one coordinated review and expedited schedule to the maximum extent practicable. The bill would also allow qualifying state or tribal environmental reviews to satisfy NEPA when the lead agency determines they serve a similar function. Canada, the EU, and Australia use similar models.

4. Make Permits Final: Injunctions based on procedural flaws should not halt construction. Agencies likewise should not rescind validly issued permits absent extraordinary circumstances. The Senate bill would prohibit injunctive relief for procedural NEPA errors and provide reinstatement, legal fees, and financial compensation for unlawful government interference.

5. Simplify Permitting: Agencies can clear routine activities without time-consuming environmental assessments or impact statements through categorical exclusions. While existing authority allows agencies to adopt each other’s categorical exclusions, too few have done so. The Senate bill would permit combinations of applicable exclusions, require a public cross-agency inventory, and direct agencies to develop or adopt exclusions for specified grid and storage projects. Congress should also encourage federal-state partnerships that pre-clear sites for environmental review, utilities, and zoning, allowing companies to build in weeks rather than years. Taiwan uses a similar model to great effect.

These bipartisan reforms would strip away procedural deadweight, allowing us to build again while simultaneously safeguarding our environment and encouraging the dynamism of a free society.

The Golden Gate Bridge was called “the bridge that couldn’t be built.” Four years later and despite every naysayer’s objection, it was. We are the same country today, except we empower the naysayers rather than the builders.

That needs to change. We did not lose the capacity to build great things. We buried it under layers of senseless process.

We are a nation that is ready to build again. It is time for Congress to clear the way.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Today we’re running a Weekend Culture special, welcoming acclaimed music journalist Jeff Weiss. To learn more about the Paid in Full Foundation, check out their website and listen to our podcast with them here.

In the fall of 1979, a 12-inch record from a small New Jersey independent label changed the world’s understanding of rhythm, slang, and Newtonian physics. The 15-minute single featured three previously unknown rappers who called themselves the Sugarhill Gang. They rhymed about everything from the joys of watching Knicks basketball in color to Superman’s bedroom shortcomings to the beat’s ability to “move you out of this atmosphere.”

“Rapper’s Delight” sold at least two million copies by the label’s own count and became the first hip-hop song to crack the Billboard Top 40. To outsiders, it was a mystery, a curio, a novelty fad. Many in the older generation claimed that it wasn’t even music. Where were the melodies? The harmonies? This is just noise! But teenagers everywhere embraced its playground jokes, slick braggadocio, and funky groove lifted straight from Chic’s “Good Times.”

From the genre’s first steps toward world domination, its business side was fraught with chicanery, intimidation, and exploitation. The “Rapper’s Delight” phenomenon doubles as the story of hip-hop’s original sin. The Sugarhill Gang was assembled like a boy band by a former soul singer named Sylvia Robinson and her son Joey. Few in the five boroughs ever rated them as rappers. In fact, one of their members, a former nightclub doorman named “Big Bank Hank” (born Henry Jackson), was discovered only while blithely spitting bars to pass the time during shifts at a pizza parlor in Englewood, New Jersey.

When it came time to enter the studio, Hank turned to Grandmaster Caz of the Cold Crush Brothers, whom he had briefly managed. At the time, almost no one believed that hip-hop would ever translate to wax, let alone travel past the New Jersey Turnpike. So the 18-year-old Caz shrugged his shoulders, let Hank borrow his rhyme book, and inadvertently rewired history. On “Rapper’s Delight,” Hank recited Caz’s verses verbatim without even bothering to alter the part where Caz spells out his name (“I’m the C-A-S-A, the N-O-V-A, and the rest is F-L-Y”).

Despite composing lyrics that kickstarted hip-hop as a commercial entity, Grandmaster Caz never received royalties or official songwriting credit for his contributions. His futuristic and complex rhyme schemes became a foundational influence on Golden Age legends like Big Daddy Kane, Rakim, and Kool G Rap. But to casual fans, Caz’s contributions were overlooked. Instead, the Sugarhill Gang became the first faces of hip-hop.

If the betrayal of Caz was frequently retold as a fundamental part of hip-hop lore, far fewer knew the depth of the improprieties. On October 24, at the Paid in Full Foundation’s fourth annual Hip Hop Grandmaster Awards, the crowd inside the Bellagio Hotel’s Tower Ballroom heard Nile Rodgers of Chic – this year’s recipient of the nonprofit’s Quincy Jones Achievement Award – explain the full magnitude of the swindle.

After discovering that the Sugarhill Gang’s smash swiped “Good Times,” Rodgers and his Chic partner, Bernard Edwards, threatened to pursue hip-hop’s first copyright lawsuit. What they didn’t know at first was that the Sugar Hill label was funded by the notoriously unscrupulous Morris Levy, a Genovese family associate widely believed to have inspired the Hesh character on The Sopranos.

Rodgers described an impromptu studio ambush at New York’s Power Station by Levy’s sumo-sized goons – who only halfway concealed their pistols to try to scare the young musicians. The studio employees cleared the room, leaving Chic to their fate. According to Rodgers, Levy’s stooges menacingly warned him, “Even if you win, you’ll lose.”

Undeterred, the members of Chic hired an attorney, who, as Rodgers put it, “knew where Levy’s bodies were buried.” It led to a negotiated settlement that gave Chic publishing and a lucrative royalty. They were the lucky ones, a disco band with #1 singles, platinum plaques, and the means to retain the best lawyers. It took some of the Sugar Hill rappers nearly forty years, and decades of litigation, to recover what they were owed.

Until this year in Las Vegas, Caz and Nile Rodgers had never taken the stage together. To the uninitiated, that sentence may seem unremarkable. But for those aware of the history, it was a landmark step toward healing a psychic wound that had festered since hip-hop’s genesis. There is no way to fully redress the missed opportunities and profiteering of the past, but to watch Caz rap the lyrics that he wrote as a teenager in the South Bronx, backed by Rodgers and Chic, was to see what could have and should have been. The DJ running it back to where the needle was always supposed to be dropped.

It was one of at least a half-dozen surreal moments of the evening that made it seem as though a pop-up sanctuary for hip-hop history had materialized several hundred feet away from where high rollers played $100 hands of Pai Gow poker.

Founded by Ben and Felicia Horowitz, the Paid in Full Foundation honors the hip-hop immortals whose artistic contributions far outweigh the financial remuneration they received in return. As Ben described Eric B. & Rakim’s debut masterpiece, the foundation’s namesake Paid in Full: “I bought it for $10 and got at least $5 million worth of value out of it. It needed to be paid back.” Each honoree receives a five-year grant with no strings attached. Inspired by Quincy Jones’ work with the Jazz Foundation, the grants have allowed past recipients, among them Rakim, Scarface, George Clinton, Roxanne Shanté, Grandmaster Caz, Kool Moe Dee, Grand Puba, and Kool G Rap, to purchase homes, pay off medical bills, and finish long-delayed creative projects.

In addition to the Horowitzes, the Board of Directors and Advisory Board include Nas, Quincy Jones III, Fab 5 Freddy, record industry veteran Steve Stoute, and the president and CEO of the Apollo Theater, Michelle Ebanks. It’s something like the old Veterans Committee at the Baseball Hall of Fame. The yearly selections are shaped by those who have made indelible contributions in their own right. They know ball.

Kool G Rap never went platinum or gold. He never even got nominated for a Source Award. But his warp-speed beat vivisections and cinematic storytelling make him akin to hip-hop’s Scorsese. Nas once said, “G Rap wrote the bible.” And when the late Big Punisher met the Queens legend, he literally kneeled to kiss the ring. But it was Paid in Full that finally paid him.

At this year’s event, G Rap ferociously rapped his underworld hits in army fatigues, still grimy, strafing the black-tie crowd with verbal artillery. Grand Puba glided at his Brand Nubian apex. Mr. Wiggles of the Rock Steady Crew danced like he had just stepped out of a battle from Beat Street. It can make you feel like you understand how the pyramids got built: not through advanced technology bestowed by ancient aliens, but through shared wisdom and communal effort. A collection of extraordinary engineers furthering the art form one acrobatic cadence and rhyme scheme at a time.

The most poignant moments occurred during the Fireside Chats, where some of the greatest of all time paid homage to their own heroes. Paid in Full is about watching Nas tell the 2026 honoree, Kurtis Blow, that he remade “If I Ruled the World” because he was “so impressed by you … it did something to me seeing you do that song in Krush Groove.”

“At the same time that the Bronx was burning, you was telling a different story than the news,” Nas continued. “You was uplifting the Bronx and giving the message about the people – how beautiful we really were during the worst times ever … This Black man had the audacity to be on the silver screen and say ‘If I ruled the world.’ [And] you did rule the world!”

It is about hearing Kurtis Blow respond to Nas, while Roxanne Shanté and Run from Run-DMC looked on admiringly. The first solo hip-hop superstar talked about getting a cassette tape of Nas and Lauryn Hill’s song, listening to it for hours, rewinding it to decode the meaning. Then excitedly calling Sony to tell them how great it was.

“[I told them] that if they just did normal promotion behind it, I guarantee it will go double platinum,” Blow said. “And it did.”

Paid in Full is about putting the art over old grudges. In 1985 at the New Music Seminar’s Battle for World Supremacy, a 15-year-old Roxanne Shanté squared off in the finals against Busy Bee Starski. According to Shanté, Blow scored her final round a lowly 4, thereby handing the title to the veteran. In her retelling, Blow did this because he believed the fledgling genre wouldn’t be taken seriously if a teenage girl was crowned the best in the world. But when it came time to pick this year’s honorees, Shanté herself nominated the “Breaks” rapper. And she was sitting beside him onstage, the first to give him his flowers.

Paid in Full is about watching Ice Cube pay tribute to his fellow West Coast hip-hop pioneer, the D.O.C. In 1988 and 1989, the pair were the chief lyrical masterminds behind N.W.A., at least until Cube acrimoniously split from the group to pursue a solo career. But before Cube declared war against the world’s most dangerous group, the D.O.C. dropped a Dr. Dre-produced No One Can Do It Better, which remains arguably the best West Coast gangsta rap record in the East Coast tradition.

A few months after the album’s release, the D.O.C. slammed his car into a concrete divider late at night on the freeway. The accident and the life-saving intubation that followed wound up permanently damaging his voice. Despite the tragedy, the D.O.C. went on to help Dr. Dre and Snoop Dogg write The Chronic, Doggystyle, and Chronic 2001, but the financial depredations done to him along the way offered more evidence for the necessity of the foundation. According to the D.O.C., Eazy-E gave him a gold chain in exchange for his publishing. And during the incorporation of Death Row Records, the Dallas-born rapper was allegedly promised a 35 percent ownership of the label that Vibe estimated to be worth $100 million in 1996. But like so many of his peers, the D.O.C. never received his promised share.

Ice Cube went on to become a multimedia juggernaut – a film and television actor, director, producer, and the star of Coors Light commercials. But in Las Vegas he delivered a heartfelt encomium to the D.O.C. as “an emcee that was years ahead of his time, exactly on time, at the same time … an architect of West Coast Hip-Hop … not only for his lyrical brilliance, but for his foundational role in shaping the sound, spirit, and legacy of Hip-Hop culture.”

In a landscape predicated on the immediate and ephemeral, it is easy to lose sight of how much the D.O.C. meant. Perhaps the comedian Chris Rock put it best in a 2004 Rolling Stone list of his all-time favorite hip-hop albums.

“I was going to school in Brooklyn, and the only time you could see rap videos was on a weekend show with Ralph McDaniels called Video Music Box,” Rock wrote. “D.O.C.’s video for ‘It’s Funky Enough’ premiered, and D.O.C. had an L.A. Kings hat on. When I came to school on Monday, half the kids in Brooklyn had L.A. Kings hats on.”

Rock’s memory of late ’80s Brooklyn is also a testament to the seismic impact of McDaniels, this year’s recipient of the Contributor Award. Debuting on local New York television in 1983, his Video Music Box was Yo! MTV Raps and BET’s Rap City long before either of them existed. It was McDaniels who popularized the phrase “shout out,” and who directed the music videos for Nas’ “It Ain’t Hard to Tell,” the Wu-Tang Clan’s “C.R.E.A.M.,” and Shanté’s “Roxanne’s Revenge.” Few, if any, contributed to the documentation and early visual aesthetic of hip-hop more than the man often called the genre’s greatest archivist.

Over the last fifty years, hip-hop has evolved from a rebellious subculture birthed by teens in the rec rooms, parks, and smoldering ruins of the ’70s South Bronx into a multibillion-dollar global behemoth. Its superstars are courted by presidential candidates of all parties; it has soundtracked revolutions and soda commercials, transformed the speech patterns and lingo of multiple generations, and its rhythms and philosophies have been absorbed into all facets of popular culture. No one thinking of a master plan could have devised anything more effective.

In the process, the tradition was diluted. It started as a close-knit community, almost entirely circumscribed within New York, and ruthlessly protected by stewards of the art form: a self-contained subterranean culture that arrived with its own code of ethics and conduct. Spontaneous innovation, originality, and creative integrity mattered most. The “wild style” reigned supreme. The early culture embodied a point that Quincy Jones would later make: when you think about money, God walks out the room. But as with the nation writ large, the emphasis on valuations over values took root.

For those who built it, the dividends rarely trickled down. In 2011, Kool Herc, the DJ widely credited as the inventor of hip-hop, turned to the internet for help to pay for his kidney stone surgery, due to his lack of medical insurance. Jay-Z can sell out multiple nights at Yankee Stadium, but the overcharge never reached the Cold Crush; Grandmaster Caz was still living in the projects until his first Paid in Full checks arrived.

It’s an old American story. King Oliver, a founding father of New Orleans jazz, was a pool hall janitor at the end of his life. He died broke, and his sister was forced to spend her rent money paying for his burial. Jelly Roll Morton, the first great jazz composer, died in poverty, still fighting with his publishers over unpaid royalties. And Billie Holiday was said to have spent her final days with 70 cents in the bank and some cash taped to her leg, under police guard in her hospital bed. Caz is already older than any of them lived to be.

Of course, a few grants a year can’t repay an entire generation, but they’re a start. Paid in Full refuses to let these cultural giants languish in our midst, and its grants have fundamentally changed the artists’ lives, though still not as much as the artists changed ours. And if you’re lucky, you might witness Grandmaster Caz, at an age when most Americans start collecting Social Security, offering a glimpse of what it was like at the break of dawn, rapping the words from the fabled notebook he lent out nearly a half-century ago. This time under his own name.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

In our last piece, we argued that the bottleneck in offensive cyber was the skilled work of turning a bug into a working exploit. In 2025 and 2026, that work became cheap. Patching did not get faster. This piece is about what follows. Our view is that the gap between exploit and patch won’t close by patching harder, and the products and policies that matter over the next five years will be those that protect systems even when they cannot be patched quickly.

In October, two critical bugs in PHP, the language behind much of the web, leaked before their fix. Exploit attempts began four days before public disclosure. Luckily, hosting and content-delivery companies could block attacks at their edge while the underlying servers remained unpatched. Meanwhile, between 2.6 and 4.4 million PHP installations outside that umbrella stayed exposed, most of them on versions that will never get a fix.

That week is the argument in miniature. Protection did not have to wait for the patch. Someone else could stand between the attacker and the vulnerability.

The arithmetic doesn’t close

Patching is a per-vulnerability, human-gated process. Someone must learn about the vulnerability, find the affected systems, test the fix, schedule the patch and confirm everything is in order post patching. Those steps still take weeks. The 2026 Verizon breach report put median full remediation at 43 days and found only 26 percent of known-exploited vulnerabilities fully remediated in its dataset. Veracode’s 2025 report put average flaw-remediation time at 252 days, up from 171 five years earlier.

Discovery is moving differently. AI systems can search for vulnerabilities by the class and help turn a published fix into a working exploit in hours. In October, Anthropic reported that an unreleased model produced a remote, no-login exploit for a Linux kernel bug that had been fixed upstream weeks earlier, while two of the most widely used server distributions still had no fixed package. Red Hat had rated the bug moderate because its timing race was hard to win. The model won it in under an hour.

Even where patching can speed up, deployment carries its own outage risk. In July 2024, one faulty CrowdStrike update crashed about 8.5 million Windows machines. And if patches need to be deployed 100s or 1000s of times a day, you just swap attacks for self-inflicted downtime.

So the question isn’t how to patch faster. It’s how to stop needing to.

The things that will never be patched in time

The case is starkest for the machines whose updates are slow by design, and those are the ones where failure is physical.

• Industrial control systems. Grid, water and factory controllers get patched in maintenance windows, often annually, after the vendor’s regression testing. Sometimes no fix exists: Dragos found that about a quarter of 2025’s industrial advisories shipped with no patch or mitigation at all and that only 2% of industrial vulnerabilities needed action immediately - the rest wait. US grid rules allow 35 days to evaluate a patch and 35 more to apply it.

• Medical devices. Infusion pumps, imaging systems and ECMO machines live for 10 to 20 years, often on unsupported operating systems, and a patch can mean re-certification. FDA cybersecurity rules apply only to new devices. In one 2025 survey, 89% of hospital systems had connected devices with a known-exploited vulnerability.

• Vehicles. Newer fleets take over-the-air updates. Older ones don’t, and software recalls move at the speed of safety regulation.

• Everything else with a chip. Building controllers, cameras, routers and refrigerators often have no update channel and no owner who knows they are online. In October, attackers heated the refrigeration in hundreds of French supermarkets in one night, mostly through end-of-life controllers that no longer get fixes. The national cyber agency’s only advice was to disconnect them. Three weeks later the same attack hit stores in Belgium, Luxembourg, Sweden and Estonia, and the contractor for one Belgian chain said the fix needs physical changes to every unit.

For all of these, patching was never really the control. It was the hope. The controls that work are off the device.

What scales, in order of reach

Four approaches can protect equipment that cannot be patched quickly. We rank them by how far down the long tail they reach.

1. Get it off the open internet. The most harmless exploit is the one that can’t reach its target. When researchers at Censys found nearly 400 water-utility control screens exposed online, including 40 that allowed control without a login, it worked with the EPA and the vendor to reach their owners. Within nine days, a quarter had been secured. By May 2025, fewer than 6% were still exposed. No patch was involved, and it moved faster than any patch cycle could.

The practical problem is that operators and contractors need remote access. Asking them to unplug the equipment often fails. What works is giving them an affordable way to keep that remote access without public exposure, and reaching them through someone they already answer to: a regulator, the vendor, their internet provider or their insurer.

Who delivers the message matters. In one study of infected consumer devices, a European internet provider’s quarantine-and-notification process cleared 92% of infections within 14 days. Email warnings did no better than saying nothing. AI makes finding the exposure nearly free. Informing the owner and getting them to act is the hard part.

2. Segment what has to stay connected. In May, Dragos documented an intruder using a frontier model as its main operator who reached the boundary between a Mexican water utility’s office network and its control system, and stopped there. The control network was walled off. Segmentation is old and unglamorous, but it can keep a network intrusion from becoming a physical event. Those boundaries have to be maintained, including the routes used by contractors and remote administrators.

3. Block the attack in the network, at machine speed. The PHP week showed what this looks like when it works: a protective rule written within hours and deployed in front of millions of servers. That model, sometimes called virtual patching, has mostly been a web-traffic product for big platforms. The next step is to generate those rules automatically from each disclosure, using the same AI that writes the exploits, and push them to places that aren’t behind a big platform: industrial protocols, hospital networks and the small business router.

4. Remove the whole class. The most durable fix eliminates the kind of bug rather than the instance. Google reports that memory-safety bugs fell from 76% of Android’s vulnerabilities in 2019 to 24% in 2024, mostly by writing new code in memory-safe languages. Formal verification, safer defaults and hardened protocol libraries can reduce other recurring weaknesses. This is slow and reaches the long tail last, but it is the only approach that actually shrinks the number of bugs to find.

Two more investments belong alongside these: safe fallback and replacement. A water plant needs to be able to operate by hand, a hospital needs to be able to work on paper for a week. And some devices are simply too old to protect economically and need to be retired.

Recovery is the control everyone forgets

All four of those defenses reduce risk. None reduces it to zero. For the long tail, what decides whether an attack is a bad week or a lost quarter is whether the backups work. And attackers know it.

Backups are now a primary target. In Sophos’s 2024 survey of ransomware victims, 94% said attackers had tried to compromise their backups, and 57% of those attempts succeeded. Mandiant’s latest report describes leading ransomware groups going after backup infrastructure, identity services and hypervisor management together, and deleting cloud backups outright. CISA’s updated advisory on the Akira group lists exploits of backup-server software as a way in.

Confidence has not caught up. In Veeam’s 2026 survey, 90% of leaders said they could meet their recovery targets, but only 28% of victims got all their data back. In Sophos’s healthcare survey, use of backups to recover encrypted data fell to 51% in 2025 from 72% three years earlier. And losing your backups is expensive. Victims whose backups were compromised reported median recovery costs of about $3 million, against $375,000 where the backups survived.

The lesson is that backups are part of the attack surface, not insurance. They need protected credentials, copies an intruder cannot readily alter, isolation from the access paths attackers take first and regular restoration tests. “We have backups” is not a posture. “We restored the hospital’s records system from last night’s copy in four hours last Tuesday” is.

The umbrella has a shape, and a cost

If the answer is that someone else stands between the attacker and the vulnerable system, then who that someone is matters. Today it is a small number of cloud, content and security companies. The largest content-delivery network alone now sits in front of a quarter of all websites, up from under 4% a decade ago. That concentration is why the PHP week went well. It is also a single point of failure: the July 2024 outage was one faulty update from one security vendor, and it cost the largest US companies an estimated $5.4 billion, of which insurance was expected to cover only 10 to 20%. And it raises a sovereignty question that countries and regulators are only starting to ask, as Jason Healey has pointed out: whose rules apply when a handful of US platforms decide which traffic reaches the world’s servers?

The economics push in one direction anyway. Defending a single asset costs about what it always did, while attacking it keeps getting cheaper. Over time the long tail has two choices: shelter under someone’s platform, or get its exposed infrastructure off the internet. The organizations that do neither, the county water system, the clinic and the small manufacturer, are the ones the data piece showed are already paying.

The policy end: fixing other people’s machines

Some owners will not act because they do not know, cannot afford it or no longer exist. Then the question becomes whether someone else may intervene.

There is precedent. In April 2021, a US court authorized the FBI to remove malicious web shells from hundreds of private Exchange servers whose owners hadn’t acted. In a December 2023 operation disclosed the following month, another court order let it remove a Chinese state botnet from hundreds of small-office routers, most of them beyond vendor support. Both were narrow interventions against specific companies. Pressure for broader intervention will grow: notify, then quarantine, then remediate devices that endanger others. That is a real civil-liberties trade, and it is better argued now than improvised during a crisis.

The opportunities we see

The categories we think win share one property: they make patching unnecessary, or someone else’s job. Each also combines multiple categories into one. Finding a vulnerability, protecting the running system and verifying the fix become more useful when one product carries the work through.

The old categories on their own are at risk of becoming a feature in this new world. The company that takes the merged category, and starts from its hardest part, is the one with a shot at being generational. We see at least 6 opportunities.

1. Fix it live, then fix the code. Pentesting, vulnerability management and application security become one loop. The old rule was that source code is the truth and production follows. Security speed is breaking that rule.

We believe the new generation of solutions will mitigate a vulnerability in the running system within hours: an edge rule that drops the malicious request, an in-process hook that checks the function’s input and refuses the exploit, or a patch applied in memory without a restart, as live kernel patching has done for years.

Keeping up with these live fixes has been impractical: too many patches, too many versions across internal and third-party libraries. The bet is that coding agents can apply version-specific live fixes at machine speed with high confidence in compatibility. The agents then write the fix against the exact library and API versions actually deployed, open the pull request and confirm the two match.

The sales motion follows from the same capability: break the prospect’s current versions in a day, then run the same attacks against the system with live protection and watch them fail.

The same machinery belongs on the vendor side, where it is clearer who pays. A Linux distribution that ships a kernel fix in days rather than weeks gives all its customers a fix sooner. Europe’s Cyber Resilience Act adds pressure: since September 2026, covered manufacturers have had to issue an early warning within 24 hours of learning that a vulnerability is being exploited. From December 2027, they will also be responsible for handling vulnerabilities throughout each product’s support period.

The risk is the one from our first piece: a bad fix shipped at machine speed creates self-inflicted downtime, so staged rollout and automatic rollback are part of the product, not an add-on.

How it plugs in. The live fix needs somewhere to run, and most companies already have those places: the content-delivery edge, the API gateway, service mesh, and lightweight agents inside the application process that can hook functions or patch them in memory.

The product reads the advisory, checks deployed versions and writes the narrowest live fix that covers the bug. It tests against live or recorded traffic, uses watch-only mode where possible, and enforces the fix in stages with automatic rollback.

The code fix runs on a second track: AI writes the patch against the versions in production, replays recorded traffic to show nothing breaks, opens the pull request, and retires the live fix once the real fix ships.

The numbers that matter are hours from disclosure to protection, days to the permanent fix, and how often a live fix blocks legitimate traffic. On the vendor side, the same loop backports one fix to every supported version at once.

Where the live fix runs. The edge rule, the in-process hook and the in-memory patch each cover a known bug. A deeper layer covers the technique, including before an advisory exists.

Writing exploits is becoming cheaper, but many still rely on familiar actions on systems the defender can watch, and the techniques exploits rely on are a short list even when the bugs are not. Of the 48,185 vulnerabilities published in 2025, 884 were newly exploited, and CISA’s own review found that most of the weakness types behind its exploited list are ones the industry has known how to prevent for decades.

The same in-process instrumentation, placed where untrusted input gets parsed or code crosses into the operating system, gives a small model places to judge whether exploitation is occurring, with possible escalation paths to larger models. The product defends against recurring techniques instead of chasing each bug. Every miss in the proof-by-exploit trial becomes training data. The hard parts are speed and false alarms. None of this makes a company unbreakable. It reduces the attack surface the attacker is counting on.

How it plugs in. Most exploits pass through a few choke points: parsers and deserializers that turn untrusted bytes into objects; code that builds database queries and shell commands, runtime operations that manage memory or execute generated code and calls to the operating system to run programs, open files or make memory executable.

Hooks at those points can catch the moment a bug turns into control, such as a web server suddenly starting a shell. A small model in the path decides within the request whether to allow, block or escalate.

A larger model or an analyst reviews escalations in seconds and can push a new rule out to the edge, feeding into the protection above. Interventions range from dropping a request to killing a process or isolating a machine.

2. Detect without rules, respond first. The AI SOC, incident response and managed detection become one service.

Detection today runs on rules that people write and maintain, and every rule fails in one of two ways. Too specific, and it misses the next variant. Too broad, and it adds to an alert queue already longer than any team can read, which is how a real alert gets ignored with the rest. In Vectra’s 2026 survey, security teams saw about 3,000 alerts a day and never got to 63% of them. In a second survey, 40% had switched off a detection rule, or considered it, because they couldn’t keep up with what it produced, and 60% had seen an alert nobody investigated turn into a real incident.

Another gating factor is that a good share of the evidence never reaches the SIEM at all. Ingestion and storage costs pressure teams to drop what they believe is noise. The version we think wins reads events straight off the security products already in place, develops detections, and acts while the incident is unfolding.

That makes it the first responder, taking on work that analysts do and managed-detection and incident-response services sell today. An intruder who got in at machine speed moves at machine speed, so the response has to as well.

How it plugs in. The product sits on the event streams the organization already pays for, endpoint, identity, email, network and cloud, and reads at the source rather than after they land in a SIEM. A model watches for behavior rather than signatures, including process chains, login patterns and data movement that don’t fit a host’s history, and proposes a detection it can explain. Confirmed detections ship as rules the model also retires when they go quiet.

Response runs through the same products’ own controls: isolate the endpoint, end the session, block the sender, snapshot the host for forensics, with a human approving anything that would take a production system down.

Buyers should measure time from the first malicious event to containment, the share of incidents contained or alerts addressed with no human in the loop, and false isolations per month.

3. Judge every request, not every login. Identity, endpoint security and network access become one decision. The old model assumed a user and a machine were the same thing: log in once and the session is trusted. Agents broke that.

A developer’s laptop now carries a person, a coding agent with its own keys and a browser agent with its own sessions, and all three send requests from the same machine in the same minute. Trust has to be judged per request, by who or what produced it, and that judgment has to happen on the endpoint, because by the time traffic reaches the network the distinction is gone.

Access becomes just in time: granted for one task from context, withdrawn when the task ends, and invisible when it works. None of this has to be disruptive. The friction today comes from standing privileges someone has to review, take those away and most decisions happen in the background.

How it plugs in. An agent on the endpoint attributes each outbound request to a process and a principal, human or software, and signs it. A broker issues credentials scoped to one task and one resource, with lifetimes measured in minutes, and the network layer refuses anything unsigned or out of scope. Actions that move money, delete data or grant access get human approval, and everything an agent does is logged against the person who launched it.

Buyers should measure standing credentials with production access, activity attributable to a principal, and time to revoke a session once it is flagged.

4. Prove recovery. Backup, disaster recovery and cyber insurance become one product. Backup storage belongs to established vendors, but proof does not. The missing piece is backup posture management - continuous, independent verification that backups exist, resist alteration, sit outside the identity systems attackers take first and actually restore, with evidence an auditor or an insurer will accept.

When prevention fails, this decides whether the outage lasts days or months.

How it plugs in. The backup copies live outside the identity system attackers take over first: separate accounts with no shared administrators, write-once storage with enforced retention, and deletion that needs two people. On a schedule, the product restores real systems into an isolated clean room, boots them, checks the data, scans for implants and times every step.

That record is the product: the last good restore, the hours to bring back each critical system and the share of data recovered, in a form a board, auditor or insurer will accept.

The survey data show why this matters. In Sophos’s study, 46% of victims whose backups survived were fully back within a week, against 26% of those whose backups were compromised. Those with intact backups were also about half as likely to pay a ransom. Veeam reported full recovery at 40% among organizations that raised resilience budgets, which were more likely to buy immutable storage and automated backup, against 16% for the rest.

The recovery record is also the underwriting input. Correlated losses, where one shared bug hits thousands of victims at once, are difficult to model and price and exactly what insurers exclude today. The firms that can model that risk and connect coverage requirements to tested controls will shape the market alongside the products themselves.

5. One control at the point of install. Software supply chain, CI/CD security and the developer endpoint become one control. Some of October’s biggest losses didn’t begin with a missing patch. Binance now puts its theft at $6.3 billion, with its initial investigation describing one engineer’s compromised laptop. A tampered package also reached up to 5,000 developers through a code editor’s extension marketplace, attempting to install a backdoor.

Package registries and marketplaces, developer machines and agents credentials are now another part of the attack surface.

The model is the one email security settled on twenty years ago: hold incoming material at a gateway, open it in a sandbox, check for who really sent it, and then release or quarantine it before a person ever sees it. Today the inputs come through package managers, extension marketplaces, browsers, vendor connections and, increasingly, the skills, tools and documents or webpages that AI agents fetch on their own. For an agent a document is also an instruction.

The product is the same three checks - hold, detonate, verify provenance, applied under one policy to every channel.

In Verizon’s latest report, exploited bugs were the top single initial-access vector at 31%, but phishing, stolen credentials and pretexting together accounted for 35%. A third party was involved in 48% of breaches, up from 15% two years earlier. Sonatype counted more than 454,600 new malicious open-source packages in 2025 alone.

How it plugs in. Each path needs a control where installation or access is granted. Developer machines get allow-listed extensions and packages, device checks before they reach production, and no long-lived production credentials sitting on a laptop.

Package registries and internal mirrors hold new versions briefly, run installs in a sandbox to watch what they do, and check signed provenance. Vendor access is scoped, expiring and reviewed. Agent skills and tool connectors get held and tested like a package (what the agent may then do with them is category 3’s job).

The numbers to watch are time spent in screening, the share of installations tested in a sandbox, the share of agent skills and connectors that passed the hold before first use, and the number of laptops holding long-lived production credentials.

6. The long-tail platform. Exposure management, secure remote access, control-network segmentation and manual fallback become one product for the organizations that will never run a security team: the water utility, a hospital’s biomedical department or a supermarket chain’s refrigeration contractor.

Exposure removal only works as a product if it sells the alternative: a cheap way to keep remote access without sitting on the open internet, and a channel to the owner through someone they already answer to - the vendor, the internet provider or the insurer.

The same service walls off the control network, keeps the manual fallback rehearsed and holds the inventory a regulator or insurer can check. Managed platforms already give small businesses services they could not run themselves. This is the same model for the machines that can’t move to the cloud.

Alongside these products, migrating to memory-safe code is newly practical because AI can do much of the translation. It reaches the long tail last, but it is the only approach that shrinks the number of bugs there are to find.

Each of these starts from a hard problem: a safe patch against the versions actually deployed, detection without manual rule-writing, a principal behind every request or a restore that is proven rather than assumed. That is the place to start. The dashboard and the reports are the easy parts and follow once the hard part works, and the hard part is what makes the combined category defensible.

The bet

The last piece ended with a wager: that 2026 looks less like the start of a cyber war than the start of a long, expensive worm era. The last worm era ended when one company took ownership of the problem and fixed it. Nobody owns this one.

For many systems, the window between exploit and patch will stay open. The work is to make that matter less: fewer things exposed, fewer operations that depend on an immediate patch, and backups that actually bring systems back.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Apple Skips Capex, and the Crowd Goes Wild (Sort Of)

It’s been a tough month (well, really a tough few months) for the “AI Trade,” and as earnings continue to roll in, it’s been more of the same.

In terms of which companies have driven Nasdaq returns over the last 30 days, it’s definitely AI and AI-adjacent companies, but they’ve been driving Nasdaq in the wrong direction:

The bottom left quadrant is where the downward drag lives, and it’s full of hyperscalers, neoclouds, semis, and AI supply chain. The top right quadrant is where the (smaller) upward pull can be found, and the biggest contributors are household “tech” names, like . . . Costco and Walmart.

So, it hasn’t been a great month for tech. It happens. There, of course, are two notable exceptions: (1) Tesla, which is mostly a partial rebound off an otherwise moribund year (from a stock performance standpoint); and (2) Apple, which didn’t exactly knock it outta the park (on a returns basis), but was still a positive contributor to the index, unlike the rest of the “Big Tech” field.

In fact, as of earlier this week, Apple has been the only Mag7 company to beat either major index year-to-date:

Only Apple has beaten Nasdaq this year, and while Nvidia still had a slim lead on the S&P 500 when the data was pulled for this chart (using rolling 7 day averages), that lead has since evaporated.

It’s a remarkable turnaround from the Mag7 concentration story of last year. Far from driving the index, big tech has largely lagged (while the beneficiaries of big tech spending pulled ahead).

And it’s that latter point about big tech spending where Apple really has “shined.” As Charts has observed in the past, when it comes to the AI arms race, Apple is really just sitting this one out:

While the four main hyperscalers have increased their respective capex since 2023 anywhere from ~6x-9x, Apple’s capex is actually less than it was before the AI spending spree kicked off. The same observation can be made about capex as a % of sales: for the hyperscalers, the ratio has ~2-3xed, while for Apple, it’s declined by about a third.

None of this should be terribly surprising, but it’s still striking to see. The market is obviously rewarding Apple for not investing so much (or really anything) in AI. Instead, Apple sticks to its knitting, and the knitting has been pretty good:

iPhone revenue growth has rebounded substantially, while services continues to compound at ~13% yoy. For all the talk of more expensive components flowing through to more expensive (and therefore, less sought after) devices, that hasn’t been the case (yet) for iPhones, at least.

If there’s any “soft spot,” it’s that the broader universe of Apple devices (Macs, iPads and wearables) has tapered off into single-digit growth.

iPads, especially, have gone from a very big deal, to a relative afterthought. When iPads were introduced back in 2010, it took only 3-4 years before iPad sales hit their high watermark:

iPad sales peaked in 2013—and were nearly 20% of all of Apple’s revenue at the time—but have basically been downhill (or flat) ever since. Currently, representing less than 6% of revenue, iPads have never been less of a big deal to Apple’s overall success.

Apple has, of course, more than made up for it in other ways, but if you had said back in 2012 that the device responsible for 20% of Apple’s revenue had just hit peak sales . . . and that Apple would be just fine—more than fine, even—basically no one would have believed you. And that includes Warren Buffett, who only started buying his famous Apple position in 2016.

Think different, I guess.

AI Does Roblox

Apple may be indifferent to AI, but that doesn’t mean everyone else is.

Roblox is one of the biggest games in the world, and it’s had a roller-coaster year, to put it mildly:

It’s an actual roller coaster. Being a Roblox shareholder must be fun.

But Charts doesn’t really care about that. What Charts cares about is the little nugget below from Roblox’s recent earnings release on the role of AI in game development. For context, Charts has variously observed in the past “so many apps, so little time,” i.e., that while AI has super-charged code output, Chrome plug-ins, app development, new websites, and the like, that doesn’t always translate into super-charged user behavior for those apps, etc. (and, in fact, in the aggregate, it has not).

Roblox, on the other hand, appears to be having a very different experience:

“We have been embracing AI to accelerate creation since the first release of Roblox Studio Assistant in December 2023. Over the past month, more than 80% of the top 100 games on Roblox (ranked by hours engaged) used AI tools to accelerate creation, and the number of daily asset uploads to the Roblox cloud tripled month-over-month.

Since Q2, time spent using AI tools (including Build, Studio Assistant, and external AI via MCP) tripled among our top creators, and those using our MCP server daily grew nearly 5x.

In Q3, Break and Steal an Egg and Huss Valley were both created almost entirely with AI and both broke into the Roblox top 20 (ranked by concurrent players). Build is our new prompt-to-game creation tool. Since its alpha launch in New Zealand, Singapore, Serbia and Thailand, more than 500,000 users have used Build – and have published over 70,000 games.” -Q3’26 Roblox Letter to Shareholders

OK, so those are some pretty impressive vanity metrics on the explosion of AI-driven game development from Roblox management, but the one that really jumps out is the top left: the stark rise in the share of “top games” released in the last 90 days.

In other words, people are using AI to make games—that much we’ve seen—but, in this case, other people are actually playing them. That’s a new and welcome development.

For what it’s worth, and it may not be worth much, SensorTower’s data does show a recent step-change (or recovery, depending on how you look at it) in Roblox’s userbase:

Roblox users skyrocketed back in the second half of 2025, and after some serious mean-reversion, appear to have skyrocketed once again.

Good for Roblox, one supposes. Whether that’s AI or something else, Charts has no idea, but perhaps it’s not all AI Appslop, after all.

GLP-1s: The Other GPT

You may have read recently about all the other peptides, so what better occasion to drop some fun facts about GLP-1s.

More specifically, what happens to the food spending habits of GLP-1 users, after they’ve stuck with GLP-1s for a while?

According to some Circana data, surfaced by Dan Frommer of The New Consumer, the results are a little surprising: GLP-1 households still spend more on food than the average household, and when it comes to food services, they actually spend more than before:

GLP-1 households started out as above-average spenders, and while both store-spending and away-from-home food spending decline initially, they both begin to recover in Year 2. Food-service spending (i.e. dining out) actually ends up slightly higher than the pre-GLP-1 baseline by the middle of the second year.

If GLP-1 users are spending more on food than they did before, does that make GLP-1s a waste of their time? No, probably not.

It more likely means that GLP-1 households shifted their food spending habits from less-healthy things to more healthy things, that are perhaps a bit more expensive:

Year 1 and especially Year 2 post-GLP-1 diners had big shifts towards water, soup, rice, and fruits and veggies, and big shifts away from sausage, pies, and alcohol. (Note that Charts is unsure how “tap water” would show up in receipt data, but we’re just gonna roll with it.)

As a shift to more expensive, but healthier, that checks out. Alcohol consumption especially, really does appear to change, as GLP-1 users were average or above-average booze-spenders before they started treatment, but by year 2, are well-below average for every category of alcohol, with the exception of wine (which increases moderately).

There’s another unlikely takeaway here. When GLP-1s took off, many predicted a collapse for the dining and CPG industries. But, rather than a food-spending GLPocalypse, there appears to be a moderate lift to food-spending, albeit with a substantial shift (and the industry has adapted accordingly). That seems pretty good.

There is one final interesting aside, which may be something or nothing, or may raise some questions about the noisiness of the data. There is at least some vice that seems to benefit substantially from GLP-1 users:

Candy and frozen treat spending both increased substantially over the first 2 years of treatment, such that below-average spenders became above-average spenders of both.

Again, maybe that’s just noisy data, or maybe there are some substitution effects at play here, as well (for the better). Perhaps instead of pies, cookies and cake, people switch to popsicles and ice cream, instead? And that’s probably a bit healthier?

Year of the Maxx

Finally, just a little chart-tribute to the dictionary.com “word” of the year: “maxxing.”

Maxxing is, of course, not a word in the traditional sense, but it’s been an awfully popular turn of phrase in 2026:

Search interest in various iterations of “maxxing” spiked in 2026 (although “sleepmaxxing” appears to have peaked last year), with “maxxing” itself growing nearly 20x since the beginning of the year. Congrats, everyone. We officially maxxmaxxed.

Maxxing beat runners-up, “affordability,” “data center,” “Odyssey,” and “Unc,” for the 2026 crown. Make of that what you will.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

On the last day of August, a single operator pointed a few hundred AI agents at a print-management server used by schools and offices around the world. The agents built a test lab, wrote exploits for 2 bugs disclosed 4 days earlier, pulled a target list from an internet scanning service, and went to work. From an empty workspace to the first break-in at a real victim took under 4 hours. When the campaign launched the next morning, 11 organizations fell in 26 seconds. By the time GreyNoise finished counting, 395 organizations in 48 countries had been compromised, half of them schools. The model doing the work was a cheap, open-weight one, not a frontier model from a US lab. The agents even ignored a list of 28 countries they were instructed to avoid.

7 weeks later, 2 critical bugs in PHP, the language used by 70% of websites, leaked ahead of their patch. Exploit attempts were hitting Amazon’s decoy servers, set up to catch attackers, 4 days before disclosure and 12 hours before the fix with working shells following within 3 days. CJ Moses, Amazon’s CISO, wrote that AI “makes it cheaper to turn a patch diff or advisory into a working exploit” and that “a 7-day or 30-day SLA assumes a delay that no longer exists.”

Inside our firm, these events started a debate: One camp sees the start of a bad decade where agents exploit every published vulnerability within hours, attack power grids, water systems and hospitals where patches take months or even years. The other has been here before. In 2003 Metasploit threatened to arm every amateur and in 2009 Shodan was supposed to expose every industrial controller and IoT device on earth. Neither ended the internet.

Here is where we landed

For twenty years, the bottleneck in offensive cyber was the expertise and time required to turn a vulnerability into a working exploit. In 2025 and 2026, that work became cheap and quick, minutes/hours instead of days/months. Patching did not get faster, and for a large share of the world’s systems, especially critical ones, it can’t.

However, that doesn’t mean it all adds up to a catastrophe. We believe the grid is not about to go dark, and the internet is not about to go down. We do think it leads to outbreaks like those of the 2003 worm era and the 2017 WannaCry outbreak, landing hardest on systems that cannot be updated quickly, and on the few targets where a single break-in is worth billions.

The exploit is the part we can measure across 23 years, so it is where our data starts. But the cost of a skilled attacker’s time mattered at every step. Scouting a network, adapting an exploit to an unusual setup, moving inside, getting paid: each step needed a person, and a person’s days only made sense against a target that could pay them back. That is what “too small to target” meant. Small organizations were never spared the mass attacks, but they were spared the hands-on ones, because they weren’t worth anyone’s time.

AI is cutting the cost of every one of those steps, not just the exploit. That is why 2 of the largest incidents this fall needed no new vulnerability at all: the supermarket refrigeration attacks hit controllers that no longer get updates and whose weaknesses had been public for months, and the Binance theft went through one engineer’s laptop.

Mandiant’s data shows the average time from disclosure to attack falling from 63 days in 2018-19 to 44 in 2020-21, 32 in 2021-22 and five in 2023. By 2024, attacks came an average of one day before disclosure. By 2025, seven days before.

One caveat matters: the lines crossed before agentic AI existed. Professional attackers, mostly state groups and ransomware crews, were already hitting internet-facing appliances before patches shipped. What AI changes is who can operate inside that window, and how fast known bugs, not only zero-days, get weaponized.

Why exploitation was the bottleneck

An exploit is a program that turns a vulnerability in the code or logic into access. For two decades, building one was expensive. RAND’s 2017 study of more than 200 zero-days found a median of 22 days for a professional to build a working exploit. Brokers paid thousands to millions of dollars each and the skill sat inside intelligence agencies and a few well-funded criminal groups.

The expertise required may help explain the most-cited statistic in the vulnerability management space: only about six percent of published vulnerabilities had ever been seen exploited in the wild. Epoch’s Timothée Chauvin attributes most of that gap to attackers “not having enough time to exploit all the vulnerabilities.”

This is also why Metasploit didn’t end the internet. Metasploit made it cheap to use an exploit someone had already written. But someone still had to write it, choose a target and run the attack. AI agents are starting to take on those jobs too.

At the time defenses also improved. Microsoft halted Windows feature work for two months to focus on security, then shipped Service Pack 2 with a firewall on by default and stronger update controls. Crime professionalized, giving attackers more reason to preserve access they could monetize. And Metasploit became a tool defenders used to test themselves. Those last two forces still matter. But Microsoft could change the software running on much of the world’s computers. Today’s exposed systems span thousands of vendors and millions of unsupported installations.

The better precedent is the one time the scarce step became free - EternalBlue. Microsoft patched the bug in March 2017. A month later, the NSA’s exploit for it leaked. WannaCry hit 59 days after the patch was available and disrupted 81 of England’s 236 hospital trusts. NotPetya followed, causing more than $10 billion in damages. Every victim had had two months to patch.

Before that came the 1999-2004 worm era. Those outbreaks caused more than $250 billion in losses in 2025 dollars, according to an estimate cited by Jason Healey. Microsoft’s security overhaul helped bring them under control.

What changed in the field

The 2026 field record is short but specific. On September 21, an AI agent chained two zero-days in a help-desk product to break into the Dutch Institute for Vulnerability Disclosure, escalating “in seconds,” with the agent, in DIVD’s words, “deciding the next step itself.” In May, Google’s threat intelligence group reported the first zero-day it assesses was developed by AI in criminal hands, intended for mass exploitation and disrupted before use. In August, the NSA, CISA, FBI, Department of Energy and EPA warned that AI-generated scripts were targeting internet-exposed Siemens controllers in energy, water and chemical plants. The advisory named no new vulnerabilities, only old exposure newly automated. And Dragos documented an intruder using a frontier model as its “primary technical executor” who built a 17,000-line attack framework and reached the boundary between a Mexican water utility’s office network and its control system before being stopped.

None of these is a catastrophe, and the PHP bugs make the point both ways. A week after disclosure, millions of attempts had produced few confirmed compromises: memory-corruption bugs are hard to exploit reliably, and hosting providers and content networks blocked attacks at their edge within a day. But between 2.6 and 4.4 million internet-facing PHP installations remain, with about 80% on versions the project no longer supports and several hundred thousand with no fix at all. Most are old blogs and small business sites nobody would target on purpose. But that is the point: when attacking is nearly free, attackers no longer need to want a target, and a hijacked site becomes a host for phishing, malware or the next campaign. Unlike Y2K, there is no date after which that risk goes away.

Why it is happening now

The frontier labs’ results explain the field. They come mostly from the AI developers themselves and run without live defenders, so we read them as an explanation for what we see in the field, not as proof on their own. In March 2026, Anthropic reported that several hundred attempts and about $4,000 got its then-current model to two working Firefox exploits. A month later, its next model, which it has kept off general release, produced 181 on the same task. By June it reported going from a released Firefox patch that fixes a bug to a working exploit in under an hour, and from Windows kernel binaries with no source code to 8 complete privilege-escalation chains in 18 hours at about $2,000 each. Independent measurement points the same way: the UK’s AI Security Institute finds the length of cyber tasks frontier models finish unaided doubling every 4.7 months, and in May reported the first models to complete its 32-step corporate-network range and its industrial-control range.

Cyber is not a special case. Since late 2024, the length of tasks models can reliably complete in both cyber and coding has doubled every 4-5 months. Coding offers a preview: in under 2 years, agents went from demos to production use at 83 percent of large companies.

Put simply, an exploit has gone from a skilled person’s month to a few hours of machine time, and an N-day, a bug that already has a patch, can now be weaponized before most organizations have read the advisory.

Patching has not moved

In 2003, Qualys measured the half-life of a critical vulnerability, the time for organizations to patch half their exposed systems, at 30 days. In 2008 it was still 30. The 2026 Verizon Data Breach Investigations Report puts the median time to fully fix a known-exploited vulnerability at 43 days, up from 32 the year before, with only 26 percent fully fixed within the year, in the same year exploitation became the leading way breaches begin. Below the enterprise, it is slower or never: a quarter of 2025’s industrial-control advisories shipped with no patch at all, grid operators are allowed 35 days to evaluate a patch and 35 more to apply it, and FDA cybersecurity rules cover only new medical devices. Even at the top of the stack the last mile is slow. In October, Anthropic reported that an unreleased model had written an exploit giving a remote attacker with no login full control of Linux servers that use multipath TCP, through a kernel bug fixed upstream on October 5. More than three weeks later Ubuntu and Red Hat, two of the most widely used server distributions, still had no fixed package, and Red Hat had first rated the bug moderate because its timing race was hard to win. The model exploited it in under an hour. Severity scores still assume a human attacker. Buyers know it. In a survey of 100 large-company security chiefs our colleagues published this week, a fintech CISO put it plainly: “you’re able to find vulnerabilities faster, but you’re not able to patch faster.”

Why we don’t expect a catastrophe

Start with the grid, because it is what people fear most. Turning off power takes more than access. Grid control systems use specialized industrial protocols, have protection equipment designed to limit failures, and can often be run by hand. Every successful grid attack on record, Ukraine in 2015 and 2016, took a state team months of preparation and purpose-built tooling, and power was restored within hours. Large US utilities operate under mandatory federal reliability standards for segmentation and patching.

For states, the constraint on a grid attack has never been the exploit, it has been intent and the willingness to accept the consequences. Chinese state operators quietly kept access inside some US critical-infrastructure networks for at least five years, according to CISA. Access alone does not tell us when, or whether, an attacker will cause disruption.

The harder question is the actors who would not hold back: hacktivists, terrorist groups, and fronts that let a state disown the result. Their constraint was never intent, but was capability - the engineering work it takes to turn access into a physical effect. That is exactly what AI erodes. Open-weight models have typically trailed the frontier by months to a year, and versions with their safety training stripped out are no longer an underground practice: Hugging Face hosts thousands of them, and since September, at least one startup has sold hosted access to a leading open-weight model with its refusals removed, as TechCrunch reported. Practitioners say stripping refusals costs some capability, which may slow this but will not stop it. So we should assume that within a year an unrestricted model will do what the most capable restricted models do today: find bugs, write reliable exploits from a patch, move through a network and run for weeks without a human.

We already have examples of what exposed controls allow:

In January 2024 pro-Russian hacktivists overflowed a water tank in Muleshoe, Texas, by changing a pump setting. In April 2025 a pro-Russian group opened a dam valve in Bremanger, Norway, for four hours. In late 2023 an Iran-linked group posing as hacktivists took over water-utility controllers across the US through a default password. Every one hit a small operator with an exposed control screen, and every one ended in local disruption measured in minutes or hours, not an outage. We expect more attacks of this kind, with more capable attackers reaching small operators.

The reason we still don’t expect the bulk grid to fall is not that these groups lack skill. Even attackers with full state capability have produced outages measured in hours, because the grid is built to absorb the loss of any single component. Its protection equipment acts on physics rather than software, and restoration is practiced. That architecture held against states, and it is what holds against everyone else. The risk from unrestrained actors lands, again, on the long tail.

The internet as a whole is more robust than its weakest server. Most of the traffic people depend on runs through a few cloud, content-delivery and hosting platforms that update at machine speed - during the PHP scare they had protective rules in place within a day for the millions of sites behind them. Core routing and naming infrastructure is concentrated, closely monitored and run by organizations with the budgets of what security people call “the security 1%.”

The history agrees. The worm era hit the whole internet repeatedly and never took it down. NotPetya caused more than $10 billion in damage and shut down shipping lines and drug plants for weeks, but the internet carried on. And today’s numbers are not moving the way a catastrophe would require. Confirmed exploited vulnerabilities grew modestly, from about 640 in 2023 to 880 in 2025, while published vulnerabilities rose by two thirds. Ransom payments fell for a second straight year. Only 12 of the 440 PaperCut victims lost full control of their networks.

There are two risks we watch closely.

The first is attacks spreading beyond their intended targets. The PaperCut agents ignored their operator’s targeting rules, and in a separate lab incident about 1,200 nominally isolated agents found a way to coordinate and some 700 joined an attack nobody sanctioned. NotPetya’s worst damage was collateral too.

The other is aggregation: state-grade capability in more hands could reach operators whose defenses were built for much less capable attackers: small water systems, rural electric cooperatives and county hospitals. Coordinated attacks, especially ones that destroy systems rather than demand payment, could turn local disruptions into a regional emergency.

October showed how damage can spread across many sites. Attackers manipulated refrigeration systems in hundreds of French supermarkets, causing fires and food losses. Three weeks later, stores across Belgium, Luxembourg, Sweden, Estonia and other European countries reported similar incidents. Some units were set to 50°C.

French authorities had already told operators to remove these controllers from the public internet, warning that unsupported equipment would remain vulnerable even after a factory reset. No AI involvement has been shown, but the pattern matters: many sites, one night, several countries.

The second wave matters most for this piece. Three weeks of warning had not been enough to secure the exposed equipment. Where a fix requires physical work at each site, a faster advisory does little to shorten the job.

Nobody is too small anymore

The damage will fall unevenly. Organizations that counted on what researchers Murphy and Stone call the “seemingly-rational calculation that attackers may not bother” are the ones AI prices back in. Half the PaperCut victims were schools. In Claroty’s 2025 study of 351 healthcare organizations, 89 percent had connected medical devices with known-exploited vulnerabilities linked to ransomware and insecure internet connections. An attacker does not need to control an MRI scanner to hurt a hospital, only to stop it.

The money already shows the shift. Ransomware leak-site claims rose by more than half, while ransoms paid fell to about $820 million. More attacks, less money: cheaper intrusions reach smaller victims who mostly don’t pay. Verizon’s 2025 breach report found ransomware in 88 percent of breaches at small and mid-sized businesses, against 39 percent at large ones. Access is getting cheaper too: the average price criminals paid for access to a victim’s network dropped from about $1,427 in early 2023 to $439 in early 2026, according to data cited by Chainalysis.

We expect the break-even victims to move downmarket, to dentists, county governments and small manufacturers. Attackers can also sell access or stolen data without depending on the victim to pay. States and hacktivists get the same cheaper capability without needing revenue at all. Shared software makes losses correlated: one bug in shared code can now expose thousands of victims at once. Ransom revenue alone will miss much of the damage as destructive attacks grow. A wiper demands nothing. We would watch the number of victims and the length of their outages.

Hospitals show what those outages mean. Even before AI, hospitals hit by ransomware averaged two to three weeks of downtime, and confirmed attacks on healthcare providers worldwide grew sixfold between 2018 and 2024. Counting leak-site claims, attacks held at about 440 a year in 2024 and 2025. The first nine months of 2026 already matched that, and the third quarter’s 192 attacks and claims were a record. Most of the recent rise remains unconfirmed, so it is an early signal. Recovery could also get harder: attackers are targeting backups to prevent victims from restoring systems independently. If the backups go too, outages lasting weeks could stretch into months.

The long tail is not the only place where the cost lands. Exposure follows whatever cannot update at machine speed, whatever its owner’s budget. And at the other end sit a few targets so valuable that one break-in becomes a market event. Binance now puts the October 29 theft at $6.34 billion, with its initial investigation tracing the attack through compromised engineers’ computers and stolen credentials. Within hours, two lending platforms had frozen markets the attacker was using to cash out, and $628 million of leveraged positions had been liquidated. The same day, a tampered copy of the Claude Code extension sat in Cursor’s extension marketplace for about eleven hours and reached up to 5,000 developers’ machines. It attempted to plant an SSH backdoor. Cursor pulled it and rebuilt its marketplace. How the package got there remains unexplained.

Who can patch their way out, and who can’t

The instinctive answer to a faster attacker is faster patching. It works for some systems and not others, and the line between them is mostly about what an update costs.

Two things follow. Machine-speed patching works where an update is cheap to apply and cheap to undo: software the vendor runs for you, browsers and phones that update silently, servers behind a platform that can block an attack at its edge while the real fix ships. It does not work where an update means stopping a physical process, re-certifying a medical device or reaching an owner who doesn’t know the device exists. And patch speed has a ceiling even where it works. If fixes arrive every few minutes, applying them all becomes its own outage risk: in July 2024 one faulty security update crashed about 8.5 million Windows machines and grounded flights for days. Past some cadence, patching replaces attacks with self-inflicted downtime. For everything in the bottom-right of the figure, the goal shifts from fixing the vulnerability to making it unreachable, through isolation, segmentation and network-level protection, with safe manual fallback when that fails. What that takes is the subject of our next piece.

A scorecard

What would change our minds

We will know within two years, and the indicators are public.

1. Exploited-vulnerability counts. VulnCheck counted about 880 in 2025. Under 1,200 in 2027 and the skeptics were right about magnitude, above 2,000 and the cost collapse has arrived. For scale, the long-run six percent share applied to 2025’s CVEs would be about 2,900, eight a day.

2. Exploitation at disclosure. In 2025, 29 percent of exploited vulnerabilities were attacked on or before the day their CVE was published. Above half by 2027 and the window has closed from the attacker’s side.

3. Time to patch. The DBIR median was 43 days. Under 30 in the 2028 report and defenders adapted, above 60 and the window is the whole story.

4. AI-found bugs in the wild. So far 1.3 percent of AI-discovered vulnerabilities have been exploited. Still under five percent at the end of 2027 and AI discovery is helping defenders more than attackers.

5. Victim breadth. Ransomware leak-site victims hit a record in 2025. If they keep rising while payments fall, the damage is spreading downmarket as we expect.

6. Industrial disruption. Physical disruption at scale has now happened without attribution: in October hundreds of French supermarkets lost refrigeration in one night, and on November 1 stores in four more countries did. If by the end of 2027 none has been attributed to an AI-run intrusion, “exploitation is not impact” holds for industrial systems.

7. Destructive versus extortion attacks. If the share of major incidents that destroy data or equipment, rather than demand payment, rises through 2027, unrestrained actors have arrived and ransom figures understate the damage.

Twenty-three years of data say patching does not get faster on its own. Microsoft could once make a large part of the internet safer by fixing Windows. This time no single company owns the problem. Our bet is that 2026 looks less like the start of a cyber war, and more like the start of a long, expensive worm era for everyone without a platform to shelter under – and for the few targets valuable enough that the platform itself is worth attacking.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Most people I talk to agree that tech buyouts are in a tough spot right now. Yet, LP $s continue to flow into re-ups with these same managers. In other words:

Tech buyouts have historically been the “safe” bet within private markets. To use a real estate analogy: it’s the good house, on an ideal street, with a reliable stream of buyers. Venture, in contrast, was always the undeveloped lot on the other side of town…until recently.

Tech buyout is a late-cycle asset class. It’s most effective once a technology wave has settled and when business models are predictable enough to borrow against. When a new technology wave drops, all bets are off. By contrast, that’s when venture shines.

Have we seen this movie before? Yes, twice. Top quartile venture beat top quartile buyout through the internet build-out and again through mobile and cloud. But in between, for the vintages caught in and after the dot-com bust (roughly 1998 to 2005), venture trailed.

I believe we’re still at the start of the next technological wave today. The pattern you see is also why the most fatal error in venture is trying to time innovation. LPs who keep consistently committing across vintages catch the lags but can also catch the absurd highs.

For those thinking: maybe that kind of VC lumpiness isn’t for me. Fair. But the slow-and-steady playbook in tech buyout is under a lot more stress than most people realize. You can already see it in how funds value what they own: in the first half of 2026, venture funds marked their tech companies up 16%, while buyout funds only marked their tech holdings down 4%.1

Of course, some of the stress is cyclical, but IMO this is a bigger structural change.

Most buyouts today are take-privates or companies bought from another sponsor, financed with debt, in an economy changing faster than at any point since the internet. Recall the “safe bet” house analogy earlier: if the neighborhood is being rezoned, you bought at the top (looking at you, 2021) and you have an adjustable-rate mortgage: ring ring—your lender is calling.

Don’t get me wrong: venture got caught in the go-go days of 2021 as well. But the difference is that we mark our assets down, sigh deeply and move on, because a venture fund doesn’t depend on every house on the block surviving. In fact, venture thrives in uncertainty. Every bet we make is essentially an out-of-the-money call option, and we’re okay with the zeroes because we’re after the power-law outliers—the fund returners.

The big private equity bonanza

Ironically, the origins of buyout looked a lot closer to venture. Some early returns were lumpy and outlier-driven e.g., Wesray’s 1982 buyout of Gibson Greetings was $1M of equity on an ~$80M deal and the company went public 16 months later at a valuation ~$290M. That’s how leverage became the 9th wonder of the world for PE (8th wonder, of course, being ‘compounding’, per Warren Buffett!).

The second buyout wave was buying family businesses and “professionalizing” them: improving the business, cutting costs, growing earnings and utilizing cheap leverage along the way.

Fast forward 40 years and PE has chewed through the “fixer uppers”—back to our housing analogy—and many homes on the block have already had a PE owner at some point. What PE tends to buy today is a company that another sponsor already owned or, in the biggest deals, a public company that has been taken private, usually with a plan to cut costs. In 2025, about half of US PE exits by count were sales to another sponsor (PitchBook).

The 2010s were the golden years for buyouts: low interest rates led to steadily rising multiples, which Bain says “powered over 50% of all buyout returns”.2 That meant shorter holds and quick distributions. Meanwhile, global buyout assets under management grew from $1.6 trillion in 2015 to $3.9 trillion in 2021. Put bluntly, falling rates and a flood of new money likely bailed out a lot of deals.

SaaS, of course, was also the manna from heaven for private equity: capital-light, consistent recurring revenue that was easy to lend against, lots of small markets with clear leaders, and a small but critical line in the customer’s budget, so prices could go up.

But where did ‘PE investing in SaaS’ come from? Venture funded it—unlevered—in the mid-2000s when the model was new and unproven. PE bought it in the 2010s, once it was mature, predictable and easy to borrow against.3 But what happens when the music stops?

What’s left when you turn on the lights

The math today looks different.

Over the past decade, US buyouts have slowly underperformed the public markets, which have been increasingly powered by the tech Mag 7.

And that’s typically with borrowed money.

PE-backed middle-market companies carry 4.7–6.0x adjusted EBITDA in net debt across the 2019–25 vintages, roughly 2.5 to 3x the median S&P 500 company’s 2x (J.P. Morgan).

So buyout has trailed public stocks while carrying far more debt. Over the last 10 years, US Buyout returned 14.5% a year, underperforming the Russell 3000. In contrast, US venture as a whole returned 17.6% a year over the same period (pooled across all funds), 2.3 points ahead of the Russell 3000. Unlevered.

But what about distributions?

PE cash back is down and exits now take an average of about 7 years, up from 5 to 6 years in 2010–21.4

Venture, of course, has its own distribution problem as well: exits slowed sharply after 2021. But venture is a power-law business, and the case to invest in venture lies in the access to the top 5% of managers, not the median. So let’s compare the best with the best across both.

A top 5% US venture fund (2007–16 vintages) was 5.3x DPI. A top 5% US buyout fund? 3.5x DPI.

Moreover, for the top 5% performance, a top US venture fund has nearly 2.2x better TVPI than a top buyout fund.

It’s important to consider also that in venture, winning tends to beget winning: the best firms typically get the next call from the best founders. A venture firm’s track record has stayed a meaningful predictor of its next fund, while for buyouts, since 2000, last fund’s top quartile hasn’t reliably predicted the next.5 So if you’re asking yourself “how do I choose the top VC managers?”, the answer is fairly straightforward.

Lastly, there is an extreme difference in what’s being held. DPI in venture is waiting on companies that are likely still growing and are raising their Series M, but buyout is usually waiting on levered companies whose value has gone flat, valuations have not necessarily been marked down to reality and there are no obvious buyers.

The roughest parts: 2021-2022

Trouble in homeownership usually starts when the unimaginable happens: you bought near the top, the rate resets higher and the appraisal goes flat. That’s exactly what happened to a large slice of what PE bought in 2021 and 2022, as we all know by now.

Many of these companies can’t cover interest in cash anymore, so they’re adding it to the loan. For those borrowers, loan-to-value went from 44% to 75% in a year. Sadly though, when the mortgage outgrows the house, the lender takes the keys.

Look at when those companies were bought: 70% of the debt foreclosed in 2025–26 came from 2021 or 2022 deals. Deals done after rates went up barely appear. It isn’t just the middle market. Private equity firms backed 54% of the largest US corporate bankruptcies during 2025.6

Medallia is a good example here. Thoma Bravo, arguably the best software operator in private equity, bought it in 2021 for about $6.4 billion. This year, it handed the company to a group of lenders led by Blackstone, wiping out about $5.1 billion of equity for Thoma Bravo and its co-investors. If a sponsor of that caliber couldn’t make a 2021 deal work, blame the vintage. And for some LPs, there’s no escaping it: the credit fund that took the keys and the buyout fund that lost the equity often sit in the same portfolio. The risk simply moved from one pocket to the other.

But if the house is in trouble, why don’t the appraisals show it? As the youths say: bruh, it’s because the people who own the house are the ones doing the appraising!

In venture, a fund’s marks go up when a company raises a new round at a higher price. Meaning, more VCs show up with more checks. Yes, perhaps you can debate that VCs chase hot deals like little kids running after a soccer ball. But no one’s in the business of lighting cash on fire. If a mark goes up, it’s because the market believes the company is worth more.

PE is the opposite: it owns the company outright and its market price is decided behind closed doors by the people who own it. Even if the business is struggling, it’s very easy to bury your head in the sand and keep the valuation where it was. As they say, more fiction has been written in Excel than in Word.

So when no outside buyer shows up, more sponsors sell the company to a new continuation fund they also manage, with secondary investors putting up the cash. These “continuation vehicles” made up 14% of PE exit value in the first half of 2026, up from 5% in 2020 (Jefferies).

Some funds go even a step further and borrow against the whole portfolio to send cash back to LPs, so distributions go up without a single company being sold. These NAV loans can flatter reported returns, and they add a second layer of debt on top of what the companies already owe.7

Investors who trade these assets every day price them lower than the funds that hold them: BDCs (publicly traded funds that lend money to private, mid-sized companies, many of them owned by PE firms) heavy in software trade well below NAV, and default rates range from 1–3% to about 15% depending on what you count. Realized losses are still under 1%, which means the losses haven’t been taken yet.

In summary, about $140B of risky loans owed by PE-backed companies mature in 2028, and another $160B in 2029. In 2023–25, the amount coming due two years out averaged about $60B. About a third of it is software, and a quarter is already rated CCC+ or below.8

Maybe it’s cyclical, maybe it’s structural

So what’s the outlook? Optimists will say that rates will come down and the debt will get cheaper. Then again, PE-backed tech exit value is down 77% from this time last year:

Keep in mind, also, that many would-be buyers of application software are software companies whose own shares have fallen, so they’re not able to pay up.9 Finally, the buyers who are able to buy, are buying new technology: Nvidia agreeing to buy Hugging Face for $13 billion or SpaceX acquiring Cursor for $60 billion. The old stuff is sitting on the shelf.

And finally, buyout fundraising is seeing the same headwinds. It fell 16% in 2025, to $395 billion, and was still lagging at midyear 2026.

It is safe to say that the 2010s aren’t coming back anytime soon: a supply of fixer-uppers, a decade of falling rates, and fast-growing funds that kept buying from each other at higher prices. A few rate cuts help the debt; they don’t re-create that decade.

And at the very top of the market, the incentives have shifted too. Many of the biggest buyout firms are now public companies, and IMO the scoreboard has quietly moved from focusing on outperformance through returns to a business valued on AUM.

Furthermore: 12 is the new 5. According to Bain, a typical 2015 buyout needed about 5% a year of EBITDA growth to make 2.5x in five years, with rising multiples doing much of the work. Today debt costs more and covers less of the price, while entry prices haven’t come down and aren’t rising anymore, so the same deal needs 10–12%.

Can these companies easily go from 5% to 12% EBITDA growth? No.

Golub Capital, one of the biggest lenders to PE-backed companies, tracks how its borrowers are doing every quarter. Its software borrowers went from 9% revenue growth to under 3% in two years. EBITDA is still growing, so it has become a margin story. And that helps pay the interest. But it isn’t the growth those deals were likely priced for.

Compare that to venture, where companies are priced on revenue growth rather than EBITDA: the median is about 18–30% a year, and outliers like Revolut, Databricks, SpaceX and Anduril grew revenue 46%, 80%+, 92% and 100%+, respectively. These are venture growth companies, not scrappy seed bets. And because the best companies are staying private longer than ever, more of that growth is happening before they ever hit the public markets.

What exacerbates this even more is PE increased tech exposure late product cycle: tech went from 23% of buyout deal value in 2018 to about 1/3 not long after ChatGPT launched in late 2022. And since then PE has begun to retreat from tech.

So, is private equity cooked?

Not overnight, no. Capital is sticky, and the best buyout managers will adapt. To be fair, smaller buyouts outside levered software can still do just fine. It’s the giants and the 2021 software that are weighing on the benchmarks. But the conditions that made the 2010s are gone: a supply of fixer-uppers, a decade of falling rates, and funds buying from each other at higher prices. A few rate cuts won’t recreate them.

My advice is to call your manager today about those 2021-2022 vintages and find out how much interest is being added to the loan (PIK). Then find an exit route.

And if the instinct is to trim buyout and move into private credit or secondaries, look at who’s on the other side of this essay. Private credit loans to SaaS companies grew from about $8 billion in 2015 to more than $500 billion by the end of 2025 (BIS), and the lender’s upside is capped at the interest they’re owed. Secondaries mostly buy existing buyout stakes at a discount. Either way, you’re still holding the same buyout companies, with less to gain.

Which leaves venture. When people tell me that venture is still riskier at the median, I agree and ask: why are you in the median? Proximity to venture does not equal participation in its rewards. If you’re going to be in venture, you need to be in the top 5%. From there, the difference between the asset classes is stark.

And venture has grown up from its cottage industry: in May, Anthropic raised $65 billion in a single round. That’s more than the $56.6 billion Electronic Arts take-private, which Bain calls the largest buyout on record.10 At the current market cap speculation between $1.5-$2T, that’s almost half of the current PE NAV today.

We believe we’re at the beginning of a massive technological wave and the white space to build and innovate is boundless. As my partner Martin Casado famously said:

My addendum to that is about returns: if you’re re-upping into buyout today, be prepared for the soy sauce and salt grains in your eyeballs—whether intentional or not.

Subscribe now

The above reflects the subjective views and beliefs of a16z Capital Management, L.L.C. (“a16z”) or its respective affiliates, and is not, and is not intended to be, an offer to sell -- or a solicitation of an offer to buy -- any securities, and may not be used or relied upon in evaluating the merits of any investment. It should not be construed as or relied upon in any manner as investment, legal, tax, or other advice. Any projections, estimates, forecasts, targets, prospects and/or opinions expressed in these materials are subject to change without notice and may differ or be contrary to opinions expressed by others. Any charts provided here or on a16z content distribution outlets are for informational purposes only, and should not be relied upon when making any investment decision. Certain information contained in here has been obtained from third-party sources. While taken from sources believed to be reliable, a16z has not independently verified such information and makes no representations about the enduring accuracy of the information or its appropriateness for a given situation. All content speaks only as of the date indicated. There can be no assurances that a16z’s investment objectives will be achieved or investment strategies will be successful. Any investment in a vehicle managed by a16z involves a high degree of risk including the risk that the entire amount invested is lost. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures.

A major lesson in getting productivity out of agents over the last few years has been to give them computers and applications like you would a human. This wasn’t obvious at first, and we as an industry tried to create agent APIs and other abstraction layers. But the reality is that AI models want to act more like humans, not less. And so the best thing to do is just give them a full desktop, a full browser and a full app and let them go to work.

Now, that can be pragmatically tough, because often apps are operating system specific (e.g. Windows) or have specific hardware requirements. So the most sophisticated users allow their agents to connect to apps and operating systems remotely. Phaze enables that remote access.

Phaze is a high-performance remote desktop solution for giving humans and agents a local-like experience on remote workstations. What sets Phaze apart is multi-fold. For one, it’s the best solution for interactive, latency-sensitive workloads. So if you want to give your agent access to Blender or Unreal Studio, Phaze is the way to do that. But it was also designed from the ground up for working with agents, which makes compatibility, management and administration seamless.

It’s not a surprise Phaze is as good as it is given the team behind it. In fact, this is their second time building an industry-leading remote desktop solution. Benjy Boxer and Chris Dickson, the founders of Phaze, previously built Parsec, which at the time was the leading remote desktop solution for graphics-intensive applications. We were investors in Parsec and sat on the board through its acquisition by Unity.

So I’m very excited to be working with this team again to bring desktops and applications to agents. And of course to humans too.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Make sure to also check out the companion podcast to this piece with here.

The longevity movement is here to stay (no pun intended).

Not long ago, taking care of our health largely meant following our doctor’s advice and sticking to what our insurance covered. There has always been a fringe movement of biohackers and crunchy people taking a more hands-on approach, but that mindset has only recently moved into the mainstream.

Two things accelerated this shift. The first was the COVID-19 pandemic, which made us acutely aware of our mortality and the fragility of our health. It exposed the limits of our medical system and reminded us that a yearly physical doesn’t necessarily mean we’re healthy.

The second was ChatGPT. Suddenly everyone could ask questions about their health and make sense of complex medical information in simple English. Today, Americans are taking their health into their own hands, spending more time, money, and energy on health and longevity.

So what is coming next? To understand how people are taking charge of their health – and what they want – we surveyed 500 randomly selected consumers in the U.S. on their views about everything from peptides to toxins to brain-computer interfaces.

We’re also talking to people at the cutting edge of health and technology. Our upcoming podcast conversations will explore how they approach their own health and what the rest of us might learn from them. First up, Andrew Huberman walks us through a day in his life, from food and exercise to supplements and sleep.

For founders, this newfound consumer interest in health creates an opening. We think some of the biggest opportunities in longevity will go to companies that help people take action and manage their health over time.

Below, we combine our observations on the longevity market with our recent survey results to explore where the next great companies might be built.

Trends in Longevity

The race to become a “healthcare home” or the “Muse for healthcare”

Today, there is no single place to manage your healthcare. Your records are scattered across doctors’ offices, and getting care means navigating a mix of phone calls, patient portals, pharmacies, and labs.

Companies are racing to build the ultimate healthcare home – an app that knows your medical history and records, prescribes your annual labs and imaging, connects to your wearable, and uses AI to help you understand what’s going on. And when you need care, it connects you with virtual or in-person clinicians who can prescribe treatment or perform procedures as needed.

The leading contenders in this race have different head starts. Function Health has lab and imaging results that show how our health changes over time. Oura and WHOOP already have a place in our daily routines. General Medicine and Counsel start with the ability to deliver care. Ferry Health understands the fragmented landscape of where to get insurance-covered care. OpenAI, Anthropic, Amazon, and Apple are building on large audiences and products we already use.

The race is to become the first place a consumer turns to when they need something done for their health. Asking AI a question about your health is useful, but arranging the next test, booking the appointment, and making sure the patient gets follow-up care and prescriptions is harder. As AI makes answers and interpretation cheaper, value will migrate to the companies that can figure out the action layer.

If this sounds like “Muse for healthcare,” that’s the idea. There is room to build very large companies around the healthcare needs that generalist AI assistants are unlikely to prioritize. The complexity of our healthcare system today makes this harder to build, but could also make it harder to replace.

We expect room for multiple winners. Almost everyone could use this kind of help.

From organic food to non-toxic everything

The MAHA movement has brought the toxins in our food, water, and everyday products to light, and consumer willingness to spend on “clean” non-toxic products has grown massively. Just a few years ago, the word “microplastics” was not in our lexicon; now our survey revealed that 63% of consumers are aware of the plastic particles building up in our bodies, 35% are concerned about them, and the biggest biohackers are trying plasma exchange to remove microplastics from their blood.

For consumers looking to reduce everyday exposures, the shopping list goes way beyond buying organic food into a broader focus on what we ingest. Our survey of Americans revealed lots of consumer change in this respect. 24% of respondents are swapping to nontoxic cookware, 39% are subbing out plastic for glass, and 70% are filtering their water.

That mindset extends beyond the kitchen and into the broader home. Healthmaxxers are buying air purifiers (37%), testing their homes for mold (18%), switching to organic-cotton clothing or bedding (17.5%), and even buying new natural or organic mattresses (11%). Even EMF emitted by wifi, cell phones, and microwaves is on consumers’ radar: 14% said they are trying to reduce it.

Consumer spending is moving faster than the evidence. People are willing to pay for peace of mind, even when the health benefit of a particular purchase is hard to measure. In our survey, 62% of respondents said they would pay more for products labeled as “non-toxic.” That creates opportunities across food, home goods, and personal care.

Peptides for all

GLP-1 receptor agonist medicines (e.g., semaglutide, tirzepatide, orforglipron, and others) have revolutionized health more than any drug in our lifetimes, transforming care for diabetes, obesity, and cardiovascular health – and the promise of their benefits keeps growing.

The runaway success of this class of approved GLP-1s, growing comfort with at-home self-injection, and loosening regulation have also fueled a surge of interest in other unregulated peptides. Consumers are now experimenting with compounds not approved by the FDA that are marketed for recovery, performance, and appearance, including the pursuit of “looksmaxxing.” For example, BPC-157 is promoted for tissue repair; melanotan II for tanning.

But the market’s enthusiasm to date has outpaced the actual evidence. Many of these compounds are still missing strong human data that demonstrates safety and efficacy, and buying from unregulated suppliers raises questions regarding what is actually in the vial. And while HHS’s most recent policy eases enforcement against licensed pharmacies compounding six peptides under specified conditions, these peptides remain unapproved by the FDA, with unresolved questions about safety and efficacy. Despite the buzz, the single-digit billion compounded peptide market is dwarfed by even a single FDA-approved peptide: Eli Lilly’s tirzepatide, which generated nearly $44 billion in sales under the Mounjaro and Zepbound brands in the first nine months of 2026 alone.

We see the peptide trend unfolding along two distinct paths across biotech and healthcare. From the biotech side, we predict growth in the pipeline of rigorous, FDA-regulated peptide drugs – and growing enthusiasm from investors seeking to underwrite medicines that not only meet the traditional safety and efficacy bars, but could also have vast consumer appeal. This is an unnatural trend for the biotech sector: drugs are indicated based on clinical need, and historically the market has actually struggled to identify and treat patients efficiently. Peptide medicines with robust consumer pull can create an unusually efficient path to patients, and we suspect this dynamic could extend to other disease areas, including sleep, bone health, and cardiovascular health.

On the care delivery side, we could see a repeat of the GLP-1 cycle if additional peptide drugs demonstrate safety and efficacy and gain mainstream adoption. GLP-1s helped many care delivery companies grow, but most of the enterprise value accrued to pharma. Other peptides could follow a similar pattern in care delivery: first, dedicated prescribing companies may emerge, following the model of Calibrate, Found, and Weekend Health from the GLP-1 wave. Then, existing healthcare companies could add peptide prescriptions to attract new patients. But as more companies offer the same drugs, prescribing them could become less of a competitive advantage and more of a service patients expect. At that point, offering peptides may matter more for keeping existing patients from leaving than for attracting new ones.

Cholesterol could become dinner-table conversation

Cholesterol could become dinner-table conversation for a surprising reason: while heart disease is still America’s biggest silent killer, there’s rapidly growing evidence that we can understand risk, detect disease at early stages, and intervene with medications to not only prevent but actually reverse some of the plaque already in our arteries. This is giving consumers a compelling reason to take their heart health seriously before a cardiac event.

For LDL – the “bad” cholesterol – the evidence increasingly supports “lower is better,” especially for people at higher risk. A study published this October found that intensive treatment shrank plaque in the heart’s arteries by about a fifth over 18 months in people with heart disease. Getting cholesterol into the “normal” range may not be enough for your personal risk, and medication could provide additional protection.

New treatments could bring cholesterol management to a wider audience. PCSK9 inhibitors like Repatha help the liver clear LDL from the blood, but injections, cost, and insurance restrictions have limited their use. Only 21% of our survey respondents knew about these drugs. We expect that to change and for these drugs to enter the consumer zeitgeist as miracle drugs that lower cholesterol with few side effects: Lipfendra, the first PCSK9 inhibitor available as a daily pill, received FDA approval in July 2026.

Evidence also supports treating high-risk patients before their first heart attack or stroke. In people with diabetes and no known major artery disease, adding Repatha to existing treatment lowered the estimated five-year risk of a first heart attack, stroke, or death from coronary heart disease from 7 to 5%.

The next frontier is lipoprotein(a), or Lp(a), an inherited risk factor for heart disease. Roughly one in five people has high levels, which are largely unaffected by diet or exercise. U.S. guidelines now recommend testing Lp(a) at least once in adulthood. Drugs targeting Lp(a) could give millions of people a new way to address that risk, but the clinical benefit of pharmacologic intervention still needs to be demonstrated. Novartis’s recent pelacarsen trial lowered Lp(a), but failed to meet its primary endpoint of reducing cardiovascular events. That said, we’re quite optimistic about other Lp(a) targeting drugs from Eli Lilly and Amgen now in trials.

Consumers don’t have to wait for the next drug. Knowing your Lp(a) can help you decide how aggressively to manage LDL and other heart risks. The question to ask: “Given my family history and risk, how low should I try to get my LDL – and would medication help me get there?” We see an opening for companies that connect testing to personalized treatment, help patients access medications, and track their progress. Knowing your numbers is the starting point. The opportunity is helping people act on them.

Wearables: Act 3

Wearables have become a daily habit for many consumers. In our survey, 54% of respondents use one, and 83% of those users check it every day. There’s still room to make that habit more useful: 55% of wearable users say their data has never prompted a behavior change or a doctor’s visit. What stood out to us is that nearly three in four would wear a second device if it measured something new. We expect the next wave of wearables to build on that curiosity, giving people more insight into their bodies and a clearer sense of what to do with it.

The first wave of wearables, led by Fitbit, got us counting our steps. The next generation – Oura, WHOOP, and Apple Watch – made checking our sleep, heart rate, and recovery routine.

Today’s third generation is being built to answer more specific questions about our health. Clair is developing a wearable designed to estimate hormone patterns without a blood draw. Lumia is building blood-flow tracking into earrings. These products give us new ways to understand parts of our health that have been difficult to track day to day.

The category leaders are expanding in this direction too: Oura now uses nighttime data to flag patterns related to blood pressure and lets users log GLP-1 doses and side effects alongside their biometric data, helping them follow how their body responds over time.

Deregulation is aiding this innovation. In January 2026, the FDA updated its general wellness policy, clarifying how certain non-invasive wearables can offer wellness insights without medical-device clearance. In June, it closed its warning letter to WHOOP after the company changed its Blood Pressure Insights feature and labeling. Oura is also offering blood-pressure-related insights as wellness features. There’s more room to build here, provided the products stay within the boundaries of wellness claims.

The bigger prize is a device small enough to wear without thinking about it, capable of reliably tracking a much wider range of biomarkers in real time. Imagine a non-invasive version of a CGM that measures far more than glucose. If we get there, we’ll have a fundamentally different understanding of what’s happening in our bodies in real time and mere step trackers will feel archaic.

Brain health & brain-computer interfaces

Neurotechnology could open up new ways to improve health and interact with consumer technology.

Elon Musk’s Neuralink has brought implantable brain-computer interfaces (BCIs) into public view. Its surgically implanted devices already enable clinical trial participants with paralysis to control computers by decoding intended movement from motor cortex activity. The company is also developing technology intended to restore some visual perception for people who are blind by stimulating the brain’s visual cortex.

Other emerging implantable approaches record from the brain’s surface without penetrating the underlying tissue, offering potential advantages for safety and long-term use. At UCSF, Dr. Edward Chang’s team uses high-density electrode arrays placed on the brain’s surface to record signals across several brain regions. In 2021, Chang’s team became the first to decode full words directly from the brain activity of a person who was paralyzed and unable to speak. More recently, the same team decoded speech and gestures together, showing the ability of a single implant to support both words and body language.

For other application areas, non-invasive approaches could bring neural interfaces to the masses even sooner. Companies are building brain-sensing patches, headbands, or hats with electrodes that can sense the state of the brain and are attempting to read it. Companies like Conduit, Alljoined, and Aleph Neuro are approaching neural decoding as a data scaling problem, collecting large datasets to train AI models that translate weak, noisy signals recorded non-invasively from the brain into text and images reflecting what someone is thinking or seeing. One day, we may be able to communicate ideas directly to AI agents without first putting them into words. But neurotechnology also has “write” applications relevant to health, where wearable devices could go further than just reading what’s happening in our brains and actually change brain activity itself. We’re seeing more and more neuro wearable devices coming to market that aim to improve sleep and focus through targeted stimulation of the brain or peripheral nerves.

This all sounds like science fiction, but we’re betting in our lifetimes, brain-computer interfaces and “wearables” for the brain will become a real consumer category and part of everyday life. Our survey suggests early consumer interest: 39% would use a non-invasive brain-sensing device for sleep, focus, or mood, and 29% for thought-controlled devices, with greater interest among men.

What Founders Should Take From This

The encouraging signal across these six areas is that consumers are ready to act. They’re seeking out tests, trying new products, and spending their own money on health.

That is the opportunity for founders: help people turn their interest in health into something useful in their lives. Start with a problem they care about, show that the product helps, and make it easy enough to keep using. Companies that do that well can grow with their customers as their needs change.

We believe some of the next great consumer health companies will be built around that relationship. If you’re building one, we’d love to hear from you.

Special thanks to , , and for their help with this piece.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

There is a quote from Jim Barksdale, former CEO of Netscape, that rings true for building and operating any business, and especially a robotics company: the main thing is to keep the main thing the main thing. The main thing in robotics is getting the robot to complete human tasks – not the training data, not the specifics of the model, not the type of hardware used. Yet the prevailing debate in much of robotics centers on these factors.

Tutor Intelligence, unlike many of its peers, knows that the main thing is getting their robots to complete specific jobs, repeatedly and with high accuracy, for customer after customer. This is exactly why we’re excited to lead the company’s Series B.

Tutor is a robotics research and deployment company that builds generally capable robot hardware. They deploy into real production environments ahead of full autonomy, using human teleoperators (“tutors”) to train the robot foundation models and make the fleet more capable over time. It’s a novel approach that’s paying off.

Most robotics companies start by building a general model and then finding its initial use case. To do this requires massive upfront data collection, and capital, to build even a basic model.

Tutor took the opposite approach. First, they identified a real need and use case. Then, still before building a robot brain, they put the hardware to work using remote tutors (that were so skillful customers found real value while not being able to tell the difference between the work done by employees and the work done by tutors). With each deployment in a real scenario, Tutor could work backwards to create their model from the deployment data. The approach offers a win-win for customers and Tutor. For customers, the operating model delivers value right away. For Tutor, the company is able to collect the training data that really matters and build an increasingly capable model, cost efficiently. Every robot put to work makes the next robot smarter, cheaper, and easier to deploy.

Being in the field early with enterprise clients has made their business stronger beyond the model too. No matter how strong a robotics company’s research is, you can’t scale without a great product experience: great hardware, great software,a simple sales process and a post-product robot support lifecycle. Tutor not only builds great robots, but is one of the few companies that has solved the full business system for robotics.

To date, Tutor robots are in operation across some of the country’s largest manufacturing and logistics networks, with plans to have more than 1,000 robots under contract by the end of 2027. Tutor also has a strong track record of landing and expanding as customers derive value: nearly a third of customers who received Tutor robots in the past 12 months were existing Tutor customers installing additional robots. Excellent customer service and implementation times as low as 8 hours add to Tutor’s offering.

When we talked to Tutor customers, we also consistently heard about Tutor’s unique business model. Robotics has been typically confined to large enterprises with the ability to pay millions upfront for expensive systems and implementation. Tutor’s flexible AI brain and hourly pricing model shift capex to opex, unlocking SMB and mid-market customers where much of America’s manufacturing exists in addition to some of the largest logistics companies.

Tutor’s first two robots start with essential work in warehousing and logistics. Cassie has a single arm for case picking and palletizing / de-palletizing workflows. Sonny has two arms and greater dexterity to serve each pick, such as in e-commerce fulfillment. Both embodiments leverage the same model, part of Tutor’s vertical integration across brain, hardware, and data collection. By building the full stack, Tutor can build toward more generally capable robots.

Advancements in robotics and AI will be one of the biggest drivers of innovation and economic value this century, but cutting-edge research won’t be enough. Compelling product experiences will be key to adoption – which is why we believe product-focused teams will win in this market.

Co-founders Josh Gruenstein and Alon Kosowsky are lifelong robotics enthusiasts who met as undergrads at MIT. They combine excellent research chops with a practical, ROI-driven orientation that is more typical in enterprise software. As a result, Tutor’s approach and early traction reflects not only their customer and problem solving focus, but also lays the groundwork for them to potentially build the best robot models, robot hardware, and collectively the robot company.

We are proud to partner with the Tutor Intelligence team as they continue to deliver customer ROI through robotics.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Lower inference costs can improve margins for application companies, but more capable models and easier development tools can also make parts of an application easier to replace. The commercial question is what customers will continue to pay for as their alternatives improve.

This exposure varies by product. An application is vulnerable when a customer can reproduce its core output with a general-purpose model and little ongoing effort. This is the question for AI application companies right now. Pricing is always important, but right now it’s extra important, yet it sometimes gets overlooked or postponed because fast-growing AI companies are reluctant to tackle it.

All AI application companies need to spend time rigorously developing and pricing out these obvious-but-necessary capabilities: Domain expertise, deep integrations, reliable execution, and hard-to-access context. These are all pricing levers that can make buying substantially more attractive. Founders need to understand which advantages their customers actually value, then strengthen and price them.

The resulting build-versus-buy test looks like this:

Repsol’s legal team put the build-versus-buy question to a direct test. In a blind evaluation, it compared Harvey with Microsoft Copilot and its own internal AI prototype, Lexia. Harvey delivered the highest-quality output, then outperformed the alternatives on accuracy and time savings during an eight-week pilot involving 50 lawyers across 12 jurisdictions. Repsol proceeded with a full rollout. Harvey reports that lawyers now save four to six hours per week, with adoption reaching 96% across the legal department. The benefits also extend to future work: the team used Harvey to identify recurring objections across past agreements and improve its contract templates with fallback language. The case illustrates how an application can earn its premium through better execution than credible alternatives, measurable savings, and the ability to turn accumulated knowledge into reusable guidance.1

From this and other examples, we gather three rules for sustained success:

1. Operate the workflow better than the customer can

2. Make context cheaper to rent than to rebuild

3. Prove the value, then price to capture it

1. Operate the workflow better than the customer can.

A customer does not need to rebuild your entire application to weaken your pricing power. Moving one high-volume task in-house or establishing a credible alternative can be enough to challenge the premium.

One buyer at a global professional-services firm told us that if a direct prompt to a frontier model produced a better work product than a vendor’s productivity tool, the firm saw little reason to pay the platform premium. For sensitive projects, the firm had built an internal AI platform that could run models locally or on premises when clients would not permit third-party products. It was also experimenting with open-source code and alternatives to commercial applications.

To defend the premium, the vendor must outperform the customer’s alternative across the full workflow. In contract review, that means applying a company’s legal standards, keeping edits consistent across a document, and preserving context as negotiations evolve. Those requirements help explain why a specialized application can remain valuable even when customers have access to capable models.

Harvey’s Playbook Review illustrates the execution this requires. A lead agent distributes review across specialized agents, reconciles conflicting edits, and checks the completed document. Harvey evaluates performance against legal rubrics and selects models based on their quality, speed, and cost for each task. The system also preserves review context so follow-up requests can build on earlier work. Harvey describes a further opportunity: learning from the redlines lawyers accept, edit, or reject, so future reviews require less guidance.

Each completed workflow can also strengthen evaluations, validate context, and deepen customer-specific knowledge. When that learning improves the next result, the application’s advantage can compound with use. Founders should measure the gains in quality, reliability, and delivery cost that accumulated learning produces.

What this means for founders: benchmark your most exposed workflow against the customer’s best credible alternative. Include implementation, human review, failures, and maintenance. Identify what gets better with every use.

2. Make context cheaper to rent than to rebuild.

Context can justify a premium through exclusive access, useful preparation, or both. Private observations that customers cannot obtain elsewhere have value in their own right. For information customers can access, the advantage depends on the cost of making it accurate, current, and usable.

One vertical software company we spoke with had accumulated years of proprietary pricing benchmarks across roughly 3,000 companies and was exploring access through a Model Context Protocol (MCP) server, which would let AI systems query them directly. The economics are straightforward: the vendor can collect, organize, validate, and maintain the information once, then spread that cost across many customers. Each customer can rent reliable, current context for less than it would cost to reconstruct and maintain a comparable resource alone. The vendor earns a margin by eliminating duplicated work; the customer gets a better answer at a lower total cost.

The same could apply to customer-owned information. Policies, CRM records, contracts, and workflow history may already belong to the buyer, but preparing them for reliable use requires permissions, normalization, retrieval, and ongoing validation. An application can earn its fee by doing that work well and using feedback to improve the context over time.

What this means for founders: identify whether customers pay for access, preparation, or both. Compare your price with the engineering, validation, and maintenance effort you remove, at an equivalent level of quality.

3. Prove the value, then price to capture it.

Better execution and trusted context create the potential for a premium. In our August 2026 survey of 100 enterprise LLM decision-makers, 94% expected total LLM spending to increase, and 37% expected it to at least double in the next year.

As spending grows, customers need to see what it delivers: how much work gets done, at what quality, and at what total cost relative to their alternatives. That proof provides the basis for deciding what the application can charge for.

Start with a unit customers recognize: a contract reviewed, support conversation resolved, research task completed, or record enriched. Measure its full delivery cost, including retrieval, model calls, tools, retries, evaluation, and human review. Include failed attempts when calculating the cost per successfully completed unit.

Then show what that work is worth. Compare the application’s price, implementation, ongoing oversight, and residual human work with the cost and quality of the process it replaces. Where an internal build is a credible alternative, include its development and maintenance costs too.

Decagon’s Notion case study connects that comparison to a buying decision. Notion considered building internally, then chose an external solution so its teams could focus on the core platform. After evaluating quality, integrations, security, and partnership, it selected Decagon. The published case reports up to a 34% improvement in ticket resolution time. That gives buyers both a reason for choosing the application and a measure of the work it improves.

Once you can demonstrate the value of completed work, choose a pricing model that lets you capture part of that value. You could set the price based on the time saved, quality delivered, and customer’s alternatives, while ensuring profitable delivery.

As Sarah Wang and I argued in “You Are Not a Model. Don’t Price per Token,” applications should price at the highest layer of value they can reliably measure, attribute, and defend. Recognizable work—a research brief, contract review, or support interaction—can be priced directly or packaged through credits. Credits are a currency, not a value metric; they should map to tasks or intuitive levels of effort customers can plan around.

Predictability also has to survive the economics of real workloads. Clay’s pricing memo describes how fixed AI prices overcharged simple workloads while making complex ones unprofitable. Clay responded by separating Data Credits from Actions for orchestration, retaining fixed credit pricing for more bounded AI workloads, and passing through actual token costs for more variable reasoning models with no markup. This gives customers a way to pay for orchestration while treating volatile model inputs separately.

This separation also matters as delivery costs fall. When the price is tied to recognizable work, a vendor can use routing, caching, or better models to improve margins, reduce prices, or include more work. Customers can share in those gains without having to track every change in the underlying model mix. The flexibility is valuable only while the complete offer remains attractive relative to their alternatives.

What this means for founders: measure the full cost of completed work, demonstrate its value against the customer’s alternatives, and choose a pricing unit the buyer can forecast. Model margins across typical and expensive workflows, then decide how to share efficiency gains while keeping the full offer attractive.

Keep earning the premium.

The test is whether buying your application offers a better combination of total cost, quality, speed, and risk than the customer’s best credible alternative. That comparison includes your price as well as the effort required to implement, operate, and maintain each option.

Together, execution, context, proof, and pricing strengthen the case for buying. Reliable work and trusted context create the advantage; clear evidence makes its value visible; and pricing lets customers share in efficiency gains while rewarding the vendor for improving delivery.

Model progress continually improves the customer’s alternative. Your advantage must widen faster for the application to keep earning its premium.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Technology is now central to how countries defend themselves, grow their economies, and provide for their citizens. For American innovators, this creates both an opportunity and a responsibility: to ensure the technologies we build strengthen America and our allies.

In conversations with government leaders around the world, I hear a consistent message. They want to adopt American innovation, and they want to build with us—through shared capabilities, joint ventures, and partnerships that meet their countries’ needs. Turning that interest into meaningful collaboration requires understanding what governments are trying to accomplish, how they make decisions, and where technology can make a practical difference.

Today, I’m pleased to welcome Andy Baker, former U.S. Deputy National Security Advisor, as an Advisor to a16z’s Global Affairs mission.

Andy brings experience in diplomacy and national security at the highest levels of government. He served as Deputy National Security Advisor to President Donald Trump and National Security Advisor to Vice President JD Vance, helping develop and execute U.S. foreign policy and national security strategy. Previously, he advised then-Senator Vance on foreign policy and national security. Earlier in his career, Andy spent more than a decade as a Foreign Service Officer, including assignments in Afghanistan and at NATO headquarters in Brussels.

That experience matters for our founders. Companies building in AI, defense, cybersecurity, energy, and critical infrastructure increasingly operate in markets where government priorities and commercial opportunities are closely connected. They need to understand how their technologies address a country’s strategic needs, which partnerships can help them succeed, and how geopolitical developments may affect their plans.

Andy will advise Global Affairs and our portfolio companies on these questions, bringing a practitioner’s understanding of international affairs and government decision-making. His perspective will help founders assess opportunities, navigate geopolitical complexity, and build partnerships that support the adoption of American technology.

We established Global Affairs to connect the ambition of our founders with the needs of America and our allies. The work is practical: helping countries access and build with critical technologies, helping companies navigate unfamiliar markets, and turning shared priorities into lasting capabilities.

Andy will make that work stronger. Please join me in welcoming him to Andreessen Horowitz.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

From Andrew Chen: These days at a16z I’m mostly working on Speedrun, where we write the first check into brand new startups (up to $1M), and a lot of what we focus on is founder backgrounds/profiles. What are the right ones? How will the profiles change as we enter the age of AI? This is a daily conversation topic.

(And also, a plug: This week is actually the final week to apply for the upcoming SF residency where you can work out of our offices, hang out with me, and start your next company. Deadline to apply is this Sunday, November 1st.)

The new founder archetypes

A while back, I talked to Ben about the new opportunities laid out by AI for solo founders. The question is, does AI give individual founders so much leverage that they can build a huge company just by themselves - you don’t need a business/technical cofounder delineation - and one person can just do it? The discussion starts at ~5:00:

There’s no doubt that AI will empower solo founders. In the past, what might have required two cofounders for business+technical, or three for product+technical+GTM, maybe can be boiled down to a solopreneur. On the other hand, Ben’s point is that maybe the v1 of a product, or what’s expected as a seed-stage startup just goes up. If a team of cofounders is multipled 100x and thus can make more progress than a solopreneur that’s 100x, then maybe the team still wins.

The solo founder is part of a list of maybe new archetypes that I think we’ll soon see a lot more of - and I’ll make both the pro and con case for each here:

• Solo founders

  • Why: Solo founders can do 100x with AI, so they can ship a v1 when previously they couldn’t have before

  • Why not: Maybe a team of cofounders still makes more progress. Maybe you can agentically code but someone still needs to do a million meetings with customers. Maybe coding was never the main bottleneck for startups in the first place?

• Non-technical founders

  • Why: There’s elite talent that comes from areas like finance, consulting, who can’t code but are passionate about business. There’s also folks in creative industries who create all day but just not in code. Now they can build

  • Why not: Why not: Maybe AI makes it easier to build a prototype, but there’s still a big gap between a demo and a reliable product that can scale. If everyone can build the first version, maybe technical judgment becomes more important in deciding what to build, what’s actually possible, and how to stay ahead as the product gets more complex. (especially true for product categories like dev tools/etc)

• Domain experts

  • Why: A doctor who works at a hospital understands all the problems they face each day. A real estate broker really gets the subtleties of their markets, their clients. Same with a soldier, teacher, etc. What if they could use software to solve their own problems and build business along the way?

  • Why not: Hoteliers didn’t create Airbnb and the finance industry didn’t create Kalshi. Sometimes you just need an outsider’s view in order to reinvent an industry, versus building incremental improvements

• Kids, high schoolers, college students

  • Why: Young people have already been building products early on. Start with a Minecraft mod, a Roblox game, a Discord bot, and suddenly you’ve learned how to make something that thousands of other people use. Now add AI, and a kid with an idea can build way more, way earlier

  • Why not: Building something your friends love is very different from building a company. You still have to hire, raise money, manage people, and figure out how to make money. And maybe young founders have an advantage in consumer products because they understand their peers, but much less of one when it comes to enterprise software, healthcare, or other industries where experience and relationships really matter. Sometimes you just need domain expertise

• Content creators

  • Why: They’re already creating. So instead of creating videos, maybe the same skills can go into creating software. Plus, they have distribution. They know what their followers care about, how to get their attention, and how to reach them without paying for ads. In the past, turning that audience into a software product meant finding a technical cofounder or hiring a team. Now a creator could build and launch something themselves, and immediately put it in front of millions of potential users.

  • Why not: Having followers helps with a spike of distribution, but building a sustainable growth engine is something else. The most valuable products aren’t memes - they are long-running, long-growing products that need to be endlessly tweaked and iterated on. Does the DNA work?

… and we could go on.

I think we’ll most certainly see a rapid expansion in the types of founder archetypes building new products. That’s a good thing. We’ll see high failure rates, inevitably, but some of them will work. Some of the archetypes - like kids/high schoolers - have some huge advantages but lack domain expertise. The archetypes with lots of domain expertise, like dentists building AI dentist software, have lots of experience but might lack an outsider’s disruptive mindset. There’s pros and cons to each, but building a bigger tent in the founder community can only be a good thing.

Different archetypes are also successful at any given time because they tap into each era’s unique technology and distribution as well.

The “yes” archetypes and “no” archetypes

Let’s look at some of the historical examples of past archetypes that make investors say “yes.” Each startup wave produces a new highly desirable archetype that gets hot, until the next one hits:

• After Google, it was Stanford PhDs

• Facebook: Dropouts building Web 2.0 social apps for their friends

• Airbnb: Designery hipsters building beautiful mobile experiences

• Uber: Gritty, highly operational founders creating on-demand mobile apps

(And of course maybe we’re back to compsci PhDs in the AI infra age)

In contrast, there’s also an extensive “no” list — a lot of the common wisdom would have you avoid teams like these:

• No solo founders

• Avoid non-technical founders

• Techies disrupting hotels is fine, but no to hoteliers building tech!

• Skeptical on international founders, but depends on region/category

• Married couples?

• No dentists, content creators, celebrities, etc…

We could make a big list. But shouldn’t a world-changing technology like AI change some of these? But what if some of these end up being all wrong? What if AI unlocks some of the archetypes that previously were disadvantaged at building products, but now they might thrive? This gives us the opportunity to revisit a bunch of these.

You might look at the list above and also ask, is any validity to them? The archetypes function at multiple levels I think:

• The obvious thing: If you think social apps/marketplaces/on-demand/AI will be a venture scale product category with many winners, then you might look at the leading one, ascribe some of the success to the backgrounds of the founders, and look for more like them. Maybe everyone from that demographic has similar advantages

• Less obvious: Further, each founders’ opportunity is unlocked by the underlying technology cycle and distribution channels. In Web 2.0, if social apps distributed via viral email invites are a thing, then nothing else is better than getting high social people (like college students) with .edu emails emailing each other. If the editorial picks for the Apple App Store are important, then well-connected designery app developers are ahead. The iPhone unlocked GPS/maps/etc which then unlocks on-demand, and it turns out those

• Even less obvious: If all the investors all sorta agree that a founder for a given age should look a certain way, then every investment of that type is safer in a self-reinforcing way. Every investment you make is likely to attract more dollars and the founder may have multiple “unfair” rounds given to them even when things aren’t quite working out

tldr; yes they might have real insights and advantages but there’s also funny self-reinforcing effects that can help. Particularly important when it comes to pre-seed/seed where rounds are often fragmented where many people have to say yes for a bunch of small checks to come together.

The next archetypes

So where does that leave us? I think the interesting question isn’t which of these new archetypes will work. It’s which of the old assumptions about founders were actually fundamental, versus just consequences of the technology and distribution of the time.

Some of the old rules will survive. Coding might get easier while sales, recruiting, judgment, and persistence don’t. Domain expertise might help you find problems but make it harder to rethink an industry from scratch. A solo founder might be able to do the work of ten people, but a team of three might be able to do the work of thirty.

But some of the rules are almost certainly going away. And that means people who would have looked like unusual or even bad founder profiles five years ago might suddenly have real advantages. The mistake would be to replace the old pattern matching with a new version: “solo founders are good now,” “domain experts are good now,” “creators are good now.” The point is that when the underlying technology changes this much, the founder profiles that work should change too.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

Job FUD Fades

Microsoft made some headlines last week when it announced an employee buyout offer to 60,000 of its employees—roughly a quarter of its workforce—that would be worth something like ~$10B, if everyone said “sure.”

The company didn’t explicitly blame AI for the offer—in fact, Microsoft’s CFO said the goal was to “offer employees agency,” and she expected a low uptake because internal opportunities remain strong. For the most part, no one else really tried to make it an “AI Is Taking All The Jobs” story either, and to the extent that AI played any role at all, the general speculation revolved around Microsoft’s Capex commitments, as the unspoken driver for cutting expenses.

Maybe there’s something to that, and maybe not, but in the bigger scheme of things, it does appear that the AI Jobs Apocalypse FUD has faded somewhat from its fever pitch back in May:

News reports on AI and Job Loss have reverted to about where they were ~1 year ago, and explicit “AI-related” layoff announcements in August and September were the lowest of the year.

That isn’t to say that AI isn’t changing the workforce, and that those changes are still likely in the early innings, but the breathless declarations of widespread AI substitution lacked the evidence then (as they do now), and it would seem as though the doomers have moved on to other things.

The AI Job FUD Fade makes even more sense, when you consider the mounting evidence that AI (or something else) is causing a meaningful increase in demand for technical (and non-technical) roles:

According to data from Indeed, job postings for SWEs, manufacturing, and especially engineering, continue their upward inflection from last year. Even HR roles, generally considered a signal for additional hiring, have finally returned to their prepandemic baseline.

Zooming in a bit closer, the improving prospects for technical hires are even more pronounced, of late:

Since October of last year, job postings for Engineers, SWEs, and Manufacturing are up ~30%, ~26% and ~13% respectively.

It’s almost like the advent of AI has caused a surge in demand for both the people building the infrastructure that makes AI possible and the people putting AI to work. Imagine that.

Elsewhere, because Charts likes to riff specifically on the boon to hard-hat jobs that has followed the historic surge in Capex, this is a pretty fun observation from Lightcast. It turns out that blowing things up is a fairly remunerative profession in most states, but especially North Carolina and New York:

With a midpoint of ~$30/hr, that makes the median blaster ~20-25% better paid than the median worker.

Here’s another fun-fact about blowing things up professionally.

Unlike the broader universe of skilled trades, explosives workers are relatively young:

~71% of boom-makers are aged 34 and below.

Now, to be fair, this data shows a substantial amount of variation in median hourly pay for explosives and ordnance workers (even after adjusting for cost of living), which suggests that some skepticism is in order for the headline figures. It’s likely that composition and sample-size are doing some work here, both on the deflator (e.g., a statewide NY deflator would do a poor job capturing the variance in COL between NY’s metros and the areas of NY where the blasting likely takes place), and what it means to be an explosives worker (e.g., NC’s military munitions experts or CA’s special effects gurus v. the ammo-plant line workers in Iowa).

Even so, if you’re young and hungry, it seems like it’s a good time to learn to code, learn to weld, and learn to make things explode.

Not today, AI Jobs Apocalypse, not today.

AI Referred, Shopper Approved

Charts previously observed that while Agentic Shopping is still early, there’s some data that suggests humans are quite ready to let AI actually handle checkout. That isn’t to say that consumers aren’t increasingly using AI in the process of shopping, or that consumers are slowing their ecomm roll, more broadly.

To the contrary, if anything, buying things online is only getting more and more popular.

Take Visa, for example, the credit card rails giant isn’t a perfect proxy for ecomm, but it’s in the ballpark, and Visa just reported the largest full-year revenue bump in 15 years (excluding M&A and the pandemic recovery year):

Visa generated ~$46B in revenue (on $15.7T in volume) in the past fiscal year, a nearly 15% yoy increase. That’s an awful lot of swipes and swipe-fees, for an already large and mature business.

That’s what’s already happened, but in terms of what comes next, there too, data suggests that consumer appetite for ecomm is only growing. Bain’s consumer survey shows across the board increases in shopping intentions for ecomm’s biggest season: holiday shopping.

More shoppers say they plan to shop Black Friday, Prime Day, and Cyber Monday, and only 10% said they’d avoid the ecomm bonanza entirely.

The point is that ecomm is already a big deal, and that rather than plateauing, ecomm continues to capture a larger share of overall retail spending, and it shows no signs of slowing.

OK, what’s that got to do with Agentic Shopping and AI? Well, perhaps nothing, but perhaps not.

Recall that one thing consumers really like to use AI for is price comparison, which should mean that peak ecomm promotional season is an especially opportune time to shine. Likewise, AI appears increasingly popular in the discovery and deliberation part of the consumer journey, and there’s some evidence that “AI referred” shoppers are relatively high intention shoppers, arriving with their wallets out:

According to data from Adobe, AI-referred ecomm traffic engages more, spends more time, views more pages, is more likely to convert (and less likely to bounce), and perhaps most importantly, has a ~50% revenue uplift as compared with non-AI-referred traffic.

Those are some pretty solid early returns for AI-assisted shopping. Interestingly, Google itself called out the fact that AI summary searches were putting downward pressure on traditional search monetization. Google has seen the innovator’s dilemma, and it’s all-in.

Elsewhere, there are other clues that AI is delivering ROI in the consumer journey. Meta knows a thing or two about serving ads, and rather remarkably, the average price per Meta ad (in the US and Canada) has grown 20%+ YoY for two consecutive quarters now:

Average CPMs for Meta had mostly stabilized for most of 2024 and 2025 (seasonal spikes notwithstanding), so the recent upward inflection—driven apparently by Feed and Stories, primarily—is a real step-change, and not some longer-running theme. Meta has certainly alluded to using AI to improve its internal engines, so perhaps that’s part of the story here, but either way, it’s a notable jump in ad monetization.

In the bigger scheme of things, whether AI Shopping Agents are inbound or not, it seems pretty clear that AI is definitely having an impact on consumer behavior, as well as an impact up and down the stack for the operators (and their economics) who make ecomm possible. It’s a boon for payments and discovery (not to mention the etailers themselves), but also a rapidly changing landscape, with potentially very different effects on incumbents and challengers, alike.

Rack Spread Cometh (But Why)?

On the subject of AI ROI and the implications for the biggest spenders at the heart of the buildout, Charts wants to take a moment to reflect on some of the data that’s not behind all the FUD, necessarily, but certainly seems to play a prominent role.

And yes, in case you haven’t noticed, FUD is definitely in the air, although unlike in the spring, when the concern was that AI was so good it was going to take all the jobs, now the concern is that AI is not good enough to make all the Capex worthwhile (on a timeline commensurate with the spend). If AI does not generate sufficiently meaningful returns, then the Capex will slow, the chipmakers will fade, and the “bubble will burst,” or so the story goes. Charts offers no view whatsoever on the relative merits of either the bears or the bulls, but is here to simply observe that, for the moment, the bears preside.

For example, the cost of insuring the debt behind the buildout (and the chipmakers) has soared since the middle of the summer:

Generally speaking, when the cost of insuring debt rises that means that the perceived likelihood of default is also rising. Naturally, the perceived likelihood of default rises, when concerns over payback for the underlying investment are also rising.

Now, to be fair, this isn’t all AI FUD. The cost of debt generally has risen, and with all this fresh issuance, supply-demand dynamics come into play, as well. Default risk isn’t the only thing that can drive a premium on the cost of borrowing today, relative to tomorrow or yesterday, but in this case, it’s surely not helping.

Here’s another striking example of the sentiment shift:

Goldman’s basket of “AI Winners” has given back all of its relative gains v. Goldman’s basket of “AI At-Risk.” And once again, it’s a tale of two seasons: January to June, the AI Winners won big, but from July to October, the winners came crashing back down to earth, even more quickly than their stratospheric rise.

OK, but the fact of FUD was not really the point.

The point was to focus on one of the charts that appears to be playing a prominent role in the FUD narrative.

The chart was recently dubbed the “Crunch Spread,” but as a16z’s Editor-at-Large has pointed out, the Rack Spread is a far better name (as you’ll soon see). There are a few different versions of the chart, but the gist of it is this:

Token prices are falling, while GPU rental rates are rising.

The Crunch Rack Spread is a reference to the Crack Spread—a well-known indicator in commodities-land that refers to the price difference between crude oil and its refined products. (You see now, why “Rack,” which refers both to server racks and sounds a lot more like “Crack,” is a far superior moniker to “Crunch.”)

• For oil, the Crack Spread is an indication of where the supply-demand imbalance sits: does it come from pulling the stuff out of the ground (and/or shipping it across the sea), or does it come from getting the downstream oil-products into end-user demand?

• When it comes to AI, the idea is that GPUs are like the crude oil, and tokens are like the downstream products (which makes the models the oil refiners, in this analogy). In this case, so the story goes, the Rack Spread (i.e., the difference in compute pricing v. token pricing) is indicating that the compute substrate is in relatively high demand, while the derivative token layer has a relative surplus.

• The implication is that this is bad news for the model-layer, such that tokens are increasingly a fungible commodity, and that’s also bad news for the compute-layer, because if tokens are a commodity, then why spend lots of money on compute to train the next best thing? That’s roughly the story, at least.

Now, there are reasons why the Crack Spread analogy is inapt, not the least of which is that oil and its downstream products are volume-bound (and the end-demand for oil-products is relatively known): you cannot make more gasoline than the oil it comes from, and so the Crack Spread (which measures the price difference of an equivalent unit of volume) tells you the specific premium for taking a certain amount of oil and turning it into a certain amount of something else. It’s a mostly fixed limit on refiner margins, and you can’t really make it up on volume, especially when the aggregate demand for oil doesn’t move all that much. In other words, the Crack Spread is a solid indication of how the energy pie is carved up, as between the drillers and refiners.

When it comes to GPUs and tokens, by contrast, there is no equivalent unit of measurement: there is no barrel of GPUs ready to be converted into an equivalent barrel of tokens. Token prices may fall, but token volumes can still increase, which means overall spending on tokens can also increase, and not only is that good for the models (where the upper limit on token demand is very much an upward moving target), it tells you very little about the balance of power in a (not-)fixed economic pie, let alone anyone’s margins in the final account.

Be that as it may, it remains the case that there’s an eyeball correlation between the July-ish moment that the Rack Spread began rising to prominence (featuring the decline of token costs), and the moment that AI FUD in public markets began to spread. Whether or not the analogy to the Crack Spread is sound, the market seems to be deriving some bearish “AI Demand” signal from the fact of falling token prices, especially.

But, here is the thing, and the actual point that Charts would like to make.

First, even if you take these weighted-average price/token indexes at face-value, they still indicate that overall token spending is increasing. But more importantly, no one should take them at face-value—they are directionally interesting and useful for sure (and Charts has used them before, and will continue to do so), but they are all derived from small and biased samples that do not remotely reflect “ground truth” demand for token volume or token spend (as those vendors freely disclose).

Whether it’s Ramp’s data, OpenRouter, Silicon Data, or Ornn, token volumes and token spending is derived from the small subset of users that expose those things to those vendors, which most large enterprises (who comprise the lion’s share of demand) do not! In fact, it’s pretty likely that the users who expose their spend and token usage to those vendors are precisely the ones who are most focused on managing their token spend, and routing to the lowest cost models. To repeat, the sample is both small and biased, and again to repeat, none of these sources claim otherwise—they are all perfectly transparent about they’re measuring.

That doesn’t make their $/token data bad or useless, but it does mean that it says far less about actual token consumption and spending than people seem to think. (For various reasons that Charts will not get into here, GPU index pricing, by contrast, is a much stronger signal, even if there too, there are limitations.)

Consider the following napkin math on “token spend”:

If you take Ornn’s blended price per token and multiply it by OpenRouter’s data on token volume—again, napkin math, not a rigorous methodology—you get a ~160% increase in token spending since May. If you take Ramp’s token spend data, you also get a token spend increase, but it’s roughly 122%.

Those are directionally similar numbers, but even within this biased universe (which likely has a fair amount of overlap), there is still a substantial amount of variance around this all-important proxy for intelligence demand. And if that is what Mr. Market is hanging his hat on, that’s a remarkable thing indeed.

Here’s another example of how noisy AI spend data actually is. According to a recent survey from the Atlanta Fed, mean AI spend/employee has increased to over $1,000/employee:

Ramp’s data, by contrast, points to a median (not a mean) $/employee of $15.70/month, or $188/year. Without knowing which data is more or less correct, suffice it to say that $188/year is a lot less than $1,000/year (even if, perhaps, the mean-median difference is doing a lot of the work).

The reality is that actual token spending and consumption are relatively opaque, for better or for worse. No one actually knows the totality of AI token spend. AI companies do not report earnings, and there is no sufficiently large or representative panel of spending data to make a sound estimate.

It makes sense that the rough proxies that we do have would rise in prominence—again, they are interesting and useful—but it makes less sense to treat them as some definitive indicator of which way the winds are actually blowing, let alone as the centerpiece for the FUD-case (or the permabull-case, either).

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

We’re excited to present a16z American Dynamism’s annual list of 50 companies that are rebuilding and protecting America. To learn more, watch our companion podcasts here.

Introduction

America’s ability to prevent conflict depends on what it can build, how fast it can deliver and how long it can keep going. A new generation of defense companies is moving advanced systems from testing prototypes to full-scale production. Now the industrial base has to keep pace. That means factories that build at scale, suppliers that ship on time, and domestic sources for critical materials and energy.

The pressure is real. Russia’s war in Ukraine has sent NATO allies racing to expand weapons production and rebuild stockpiles. The conflict with Iran has exposed gaps in U.S. munitions inventories. China’s rare earth export restrictions have rattled manufacturers around the world. Strength is measured by the ability to keep producing under pressure.

There is no scaled defense industrial base without a strong industrial base. Founders must design for mass production from day one, weighing cost and manufacturability alongside performance. And bringing production onshore means rebuilding the full chain, from processing raw materials to machining precision components to assembling finished systems.

That is the theme behind this year’s American Dynamism 50: Production is Deterrence. The list is organized around three connected pillars: Systems, Factories and Inputs.

Systems deliver capability. Factories provide the plants, tools and software to build them at volume. Inputs supply the materials and power that keep the line moving.

The payoff reaches well beyond defense. The same capacity that arms the country also creates skilled jobs, revitalizes communities and makes the supply chains behind energy, housing, and everyday goods more resilient.

The companies on this list are rebuilding the industrial foundation that protects America and strengthens her allies.

By Pillar

Company Overviews

Ambrosia Energy

Austin, TX · Founded 2024 · Inputs

Ambrosia Energy builds solar and battery plants for businesses that can’t wait for grid power, aiming to deliver electricity roughly a year after signing a contract at about $100 per megawatt-hour. Founders Ben Longmier and Sara Spangelo previously led Starlink Mobile after SpaceX acquired their company Swarm. Construction began in West Texas in January 2026. At their June launch, Ambrosia said completed sections were running and the next phase was funded, with 200 megawatts of solar designed to deliver 20 megawatts continuously.

Amca

El Segundo, CA · Founded 2024 · Factories

Amca is an engineering and manufacturing company focused on re-engineering critical components for defense and aerospace supply chains. Founder and CEO Jai Malik saw an opportunity to uplevel existing aerospace and defense component suppliers, combining their manufacturing capabilities and deep technical knowledge with a world-class, centralized engineering team. Amca improves existing operations and develops new or replacement components for customers facing limited supply, long lead times, or missing technical data. Today, Amca offers both direct component sales and re-engineered parts to government buyers.

Anduril Industries

Costa Mesa, CA · Founded 2017 · Systems

Anduril builds defense hardware around software, connecting their autonomous systems through the Lattice platform to support force protection and unmanned combat missions. In June 2026, the U.S. Air Force awarded Anduril development and production contracts for the Fury aircraft under the Collaborative Combat Aircraft program. The following month, the first Ohio-built Fury rolled off the production line at Arsenal-1, the company’s 5 million sq. ft. manufacturing campus near Columbus. Anduril is expanding manufacturing as government demand for their systems grows. In March, the Army awarded Anduril an enterprise contract that simplifies purchases of the company’s software and hardware, with a ceiling of $20 billion over 10 years.

Apex

Los Angeles, CA · Founded 2022 · Systems

At Palantir, Ian Cinnamon kept hearing satellite customers complain about their spacecraft buses. He co-founded Apex to offer standard buses that handle power and propulsion for satellites of different sizes, allowing customers to concentrate on their payloads. Standardization also means Apex can mass-produce spacecraft, driving down cost as they drive up quality and earn flight heritage for their designs. At Factory One in Los Angeles, the company is targeting a peak capacity above 200 satellites a year for defense and commercial constellations.

Arda

San Francisco, CA · Founded 2025 · Factories

Bob McGrew, OpenAI’s former chief research officer, co-founded Arda to close the gap between designing hardware and building it. Its software turns product designs into assembly plans and work instructions, then updates them as designs change. Anduril already uses Arda within ArsenalOS, its manufacturing software, meaning instructions that previously took hours might be completed in minutes. Arda launched publicly in October 2026 with $230 million in total funding. The company is extending its planning software into robotic assembly, aiming to make production lines adapt as quickly as the products they build.

Astranis

San Francisco, CA · Founded 2015 · Systems

Astranis’s MicroGEO satellites stay fixed above a single spot on Earth by flying in geostationary orbit, giving telecom operators and governments a communications option solely dedicated to their needs . Co-founder and CEO John Gedmark founded the Commercial Spaceflight Federation in 2005, and teamed up with Ryan McLinko, who led both the electrical and mechanical engineering teams at Planet Labs, to start Astranis. Astranis builds their satellites at San Francisco’s Pier 70 and reported five in orbit and five in production in May 2026. They put the value of their contracted satellite services at more than $1 billion.

Atomic Industries

Detroit, MI · Founded 2021 · Factories

Aaron Slodov co-founded Atomic Industries to automate one of manufacturing’s slowest steps: making the molds that turn product designs into repeatable parts. The Detroit company combines tooling design, physics simulation, and factory production in a single operation. Its software models plastic flow, heat, and structural behavior before a mold is cut, then uses production data to improve subsequent designs. Atomic supplies injection-molded plastic parts for automotive, consumer, aerospace, and defense applications, with mold making as the foundation for scaling domestic production.

Base Power

Austin, TX · Founded 2023 · Inputs

Justin Lopas, who built rockets at SpaceX and led manufacturing at Anduril, co-founded Base Power with Zach Dell. The home battery company opened Factory 1 in Austin’s former newspaper printing plant in October 2025, then began producing their Texas-designed Base Core there in 2026. Base Core is available in Texas and Illinois, and the company plans another Austin factory. Base installs and operates the batteries to support the grid while keeping energy in reserve for household outages.

Castelion

Torrance, CA · Founded 2022 · Systems

Castelion is developing hypersonic missiles intended to be affordable enough for the military to buy in large numbers. Co-founder Bryon Hargis previously helped define national-security satellite products at SpaceX. By August 2026, the company had more than $500 million in U.S. military contracts and had broken ground on Project Ranger, a planned 21-building production campus in Rio Rancho, New Mexico. Their Blackbeard program is moving through testing and procurement toward fielding in 2027.

CHAOS Industries

Los Angeles, CA · Founded 2022 · Systems

CHAOS Industries is building a distributed radar system that detects and tracks threats using arrays of smaller antennas. Their products include VANQUISH, a distributed early-warning radar, and ASTRIA, a long-range radar built for high-precision tracking. Bo Marr, formerly of Epirus and Raytheon, co-founded CHAOS alongside Gavin Hood, who previously worked at Palantir and Britain’s Secret Intelligence Servicehe company is expanding manufacturing in Southern California and reported making 40 radars a month, with a target of 100 by late summer.

Chariot Defense

San Bruno, CA · Founded 2024 · Inputs

Chariot Defense builds the power systems that keep drones, sensors, communications equipment, and electronic warfare tools running when vehicles and generators are switched off. Its Amphora platform combines energy storage, conversion, and software-controlled distribution in hardware designed to work with existing military vehicles, generators, and solar arrays. Founder Adam Warmoth previously led counter-drone programs at Anduril.

Covenant

Founded 2024 · Systems

Founded by Michael Kaufman and Ofir Dayan, Covenant is developing Anthem, a long-range precision-strike missile designed for affordable mass production. Commercial components and local supply chains support the company’s U.S. manufacturing, and they use the same approach in Germany and Israel. By Covenant’s September 2026 public launch, Anthem had completed more than 200 flight tests, including a live-fire demonstration near Tan-Tan, Morocco, on August 6. In September, Covenant opened a 105,000-square-foot factory in Dallas to work alongside their German and Israeli facilities. The company plans to use these plants to supply long-range strike weapons in the quantities needed for sustained deterrence. Serial production in Dallas is scheduled to begin in early 2027, with a target of 5,000 missiles a year once production ramps up.

CX2

El Segundo, CA · Founded 2024 · Systems

CX2 builds electronic warfare systems that help military units locate and disrupt hostile radio signals, including those used by drones and jammers. Its co-founders include former Army helicopter pilot Porter Smith, Epirus founder Nathan Mintz, and Lee Thompson, who led radio-frequency engineering at SpaceX. The company develops airborne platforms and payloads that integrate with existing military sensors and command systems. In 2026, CX2 moved into a 30,000-square-foot headquarters and manufacturing facility in El Segundo, expanding space for engineering, testing, and production.

Diode

New York, NY · Founded 2024 · Factories

Davide Asnaghi co-founded Diode after working in Apple’s Special Projects Group and studying electronics manufacturing in Hong Kong and Shenzhen. The company helps engineers get circuit boards built and delivered with fewer supplier handoffs, starting with schematics written as code. Engineers can export their designs into established engineering tools and check manufacturing requirements before the boards are built. Diode says their tools help customers including Saronic and Physical Intelligence move faster between revisions and produce more designs per engineer.

Forterra

Clarksburg, MD · Founded 2002 · Systems

Forterra builds unmanned ground vehicles that move supplies and evacuate wounded soldiers along routes that would otherwise expose drivers to enemy fire. Under a U.S. government program, Forterra produced and delivered 105 Lancer vehicles to Ukraine in less than six months. By July 2026, the fleet had transported over 777,000 pounds and carried out 88 casualty-evacuation operations across more than 1,100 missions. In August, the U.S. Army selected Forterra for the Infantry Last Tactical Mile initiative, bringing Lancer’s AutoDrive autonomy platform and Vektor communications system to the program. The effort focuses on rapidly deployable resupply and casualty evacuation.

Endurance Energy

Seattle, WA · Founded 2025 · Inputs

Andrew Redd left SpaceX to found Endurance Energy, which develops modular generators that turn heat beneath the ocean floor into electricity for coastal grids and industrial sites. In summer 2026, the company expanded into a 25,000-square-foot Seattle facility for research and manufacturing. In September 2026, Endurance deployed its Adélie prototype at Axial Seamount off Oregon, using a natural hydrothermal vent to reportedly generate more electricity than it consumed. Endurance is developing a two-megawatt commercial generator and a project in Tonga targeting first power in 2027.

Foundry Robotics

San Francisco Bay Area, CA · Founded 2025 · Factories

Foundry Robotics is building a manufacturing operation around flexible robotic cells that assemble complex hardware. Its focus spans defense and commercial robotics, battery packs, and mechanical subassemblies, with the aim of moving products from prototype to production without building a dedicated factory for each design. Founder Adarsh Kulkarni previously led robotics at Scale AI. Foundry combines manufacturing engineers, robot hardware, and AI models on the assembly floor, collecting data from each task to improve subsequent builds. In October 2026, it announced that Avea Robotics was joining the company, adding technology that lets human operators intervene when robots encounter unfamiliar situations.

General Matter

El Segundo, CA · Founded 2024 · Inputs

General Matter is developing domestic uranium enrichment capacity to supply America’s next generation of nuclear reactors. Their focus includes high-assay low-enriched uranium, or HALEU, a fuel that remains in limited domestic supply even though many advanced reactors need it. Founder Scott Nolan, a former SpaceX engineer and Founders Fund investor, spent a year searching for a company addressing America’s nuclear fuel gap before starting General Matter. In January 2026, the Department of Energy awarded General Matter $900 million in milestone-based funding to develop domestic HALEU enrichment capacity over ten years. Site preparation is underway at the former Paducah Gaseous Diffusion Plant in Kentucky, where the company plans to establish a new enrichment facility.

Generalist

San Mateo, CA · Founded 2024 · Factories

Generalist builds AI models that help robots learn physical tasks from demonstrations, with an initial focus on dexterous manipulation. Its team brings experience from Google DeepMind, Boston Dynamics, and OpenAI. In August 2026, the company introduced GEN-1.5, showing robots learning simple tasks from a single brief demonstration and adapting to unfamiliar objects and tools. The demonstrations remain focused on short tasks, but they point toward a different way to automate factories: teach a robot what to do without writing a new program for every product change. Generalist is expanding access to the model as it works toward broader use.

Hadrian

Torrance, CA · Founded 2021 · Factories

Hadrian builds highly automated factories to expand domestic production of critical programs for aerospace and defense. From components manufacturing, to in-house production lines, to dedicated factories, Hadrian’s flexible manufacturing platform ensures customers’ capacity needs are met. Hadrian’s manufacturing is powered by its Opus software, which automates key manufacturing and inspection tasks, enabling its technicians to train faster and increase throughput. In January 2026, Hadrian brought Factory 3 in Mesa, Arizona, online less than six months after signing the lease. The company now has four facilities spanning nearly 3 million square feet. Hadrian plans to expand production for U.S. defense programs with factories and production lines for munitions and autonomous systems.

Helsing

Munich, Germany · Founded 2021 · Systems

Helsing builds autonomous defense systems and the AI software that enables them to operate, from strike drones to aircraft and underwater vehicles. Its HX-2 drone is designed for mass production, with software taking on functions that would otherwise require more hardware and assembly steps. The company’s Resilience Factories distribute manufacturing across allied countries, using local suppliers and workforces to build capacity close to customers. Helsing has deployed thousands of HX-2 drones to Ukraine. Its first Resilience Factory in southern Germany has initial capacity for more than 1,000 drones a month. A planned West Virginia factory would extend that production network to the U.S., with capacity for more than 2,000 HX-2s a month once fully operational.

Hermeus

Los Angeles, CA · Founded 2018 · Systems

AJ Piplica helped develop the Air Force’s X-60A hypersonic test vehicle before co-founding Hermeus in 2018. The company builds uncrewed high-speed aircraft through successive prototypes, using each flight to improve the next design. In May, Quarterhorse Mk 2.1 reached Mach 1.21 on its third test flight, less than a year after the first Quarterhorse aircraft flew. In September, Pratt & Whitney licensed Hermeus to manufacture F100-PW-229 engines, expanding its planned role from aircraft development into domestic engine production.

Heron Power

Scotts Valley, CA · Founded 2024 · Inputs

Heron Power’s five-megawatt Heron Link uses solid-state electronics to connect large power users and energy projects to the grid, combining functions normally handled by transformers and other equipment. Founder Drew Baglino formed Tesla’s energy engineering organization in 2014 and oversaw Megapack’s launch and production ramp. Heron plans to invest over $100 million in Factory One in Morgan Hill, California, with mass production targeted for late 2027 and a goal of up to 10,000 units a year.

Impulse Space

Redondo Beach, CA · Founded 2021 · Systems

Tom Mueller led propulsion development at SpaceX from its founding through 2020, working on the engines that powered Falcon rockets and Dragon spacecraft. He founded Impulse Space in 2021, which builds vehicles to transfer spacecraft from orbit to orbitImpulse makes their spacecraft in Redondo Beach and propulsion components in Colorado. Helios is still in development for higher-energy transfers, with a first mission targeted for 2027, while Mira has already flown multiple maneuvering and deployment missions.

K2 Space

Torrance, CA · Founded 2022 · Systems

Large satellites become more attractive as launch costs fall, and K2 Space builds them with high power and payload capacity for communications and defense. Co-founder Neel Kunjur previously helped develop and integrate Dragon’s avionics at SpaceX, and teamed up with his brother Karan to found K2. The comany makes many of their components in-house at a Torrance factory designed to produce up to 100 satellites a year. Their first spacecraft, Gravitas, reached orbit in March 2026.

Mach Industries

Huntington Beach, CA · Founded 2023 · Systems

Ethan Thornton was prototyping defense hardware in his garage at 16, before his work at MIT drew Lincoln Laboratory’s attention. Mach Industries develops unmanned strike aircraft, with propulsion developed in-house. Their Forge manufacturing network is designed to produce Mach’s weapons, including their munitions and counter-UAS systems, along with partners’ systems. The factories can retool as designs and requirements evolve. Mach expects to begin production on at least three programs in 2026. They’re expanding Forge and their Mach Propulsion division while developing second-generation systems so they can make more weapons and critical components for U.S. and allied forces.

Mariana Minerals

San Francisco, CA · Founded 2024 · Inputs

Turner Caldwell spent more than nine years at Tesla, moving from battery manufacturing to leading their minerals and metals programs. He co-founded Mariana Minerals, which bought Copper One, a copper mine and refinery in southeastern Utah, in late 2025. Mariana is automating mine and refining operations using their MarianaOS software that spans the entire lifecycle of mining development and operations. Funding raised in August 2026 supports the work at Copper One and the development of Lithium One in East Texas.

Mind Robotics

Palo Alto, CA · Founded 2025 · Factories

Founded by Rivian’s RJ Scaringe in November 2025, Mind Robotics is developing AI models and hardware for robots to handle jobs fixed equipment still struggles with. Within months, they had raised more than $1 billion, including a May 2026 round to fund more deployments. Rivian’s factories give Mind a place to test their technology as the company works toward serving manufacturers outside the auto industry.

Neros Technologies

Torrance, CA · Founded 2023 · Systems

Neros co-founders Soren Monroe-Anderson and Olaf Hichwa met as teenage drone racers, each already designing and selling drone components. Their company now supplies Archer first-person-view drones to U.S. and allied forces through a supply chain Neros says doesn’t depend on China. Archer AI and Bandit add autonomous strike and interception, with both planned for combat deployment before the end of 2026. Neros raised $250 million in August 2026 and is targeting production of one million drones a year in Torrance by 2028.

Nominal

Los Angeles, CA · Founded 2022 · Factories

Nominal develops software that gives hardware manufacturers a shared view of system performance from prototype development through production. Engineers can use the platform to combine sensor data with test results and automate workflows for testing systems and validating performance as production scales. Co-founder Cameron McCord experienced those testing challenges while working at Anduril. Nominal serves customers like Anduril, HII and AeroVironment. In April 2026, the Air Force Test Center awarded Nominal a contract with a ceiling of $53 million to modernize the center’s test data infrastructure.

Northwood

Torrance, CA · Founded 2023 · Systems

Northwood aims to spare satellite operators the difficulties of either renting shared space on highly-congested ground stations, or of building ground stations of their own, by offering services from their communications network. Led by MIT and Harvard-trained CEO and co-founder Bridgit Mendler, Northwood’s antennas and software already operate across multiple continents. The company opened a new headquarters and factory in Torrance in August 2026 and is preparing to move production there in October, with three dedicated lines intended to make hundreds of antennas a year.

Peak Energy

Burlingame, CA · Founded 2023 · Inputs

After five years developing battery manufacturing technology at Northvolt, Landon Mossburg co-founded Peak Energy. Their grid batteries use abundant sodium and are designed to lower operating costs by reducing the need for cooling. In July 2026, Peak chose a Sacramento factory designed to produce up to four gigawatt-hours a year, with first shipments targeted for early 2027. The company says customer commitments already exceed six gigawatt-hours.

Perennial Autonomy

California · Founded 2023 · Systems

Perennial Autonomy is building battle-tested drone systems. After successful deployments in support of Operation EPIC FURY and U.S. Central Command, Joint Interagency Task Force 401 awarded the Eric Schmidt-backed company a three-year procurement contract with a ceiling of $500 million. The contract will fund additional procurements of Perennial’s Merops interceptors, Bumblebee ISR quadcopters, and Hornet mid-range strike drones.

Podium Automation

Brooklyn, NY · Founded 2024 · Factories

Jamie Niu and Jacob Buser co-founded Podium Automation to make industrial control panel production faster and more reliable. Podium combines its own design software with CNC machining and automated wire processing, then assembles and tests the finished panels in Brooklyn. The approach reduces manual work and catches design problems before fabrication, helping customers bring new production equipment online without waiting on a traditional panel shop. The company supplies UL 508A-listed panels for manufacturing, energy, aerospace, and warehouse automation.

Prometheus

San Francisco, CA · Founded 2025 · Factories

Prometheus is developing AI models for engineering and manufacturing. Co-founded by Jeff Bezos and Vik Bajaj, the company trains these models on specialized data to work with the geometry and physics of complex hardware, from jet engines to semiconductors. Its tools are intended to help engineers explore designs, simulate performance, and refine products before committing to physical prototypes and tooling. Prometheus aims to shorten this development cycle, helping manufacturers resolve engineering problems earlier and move new products into production faster.

Radiant

El Segundo, CA · Founded 2020 · Inputs

Doug Bernauer began exploring nuclear power at SpaceX while working out how to supply energy to a Mars colony. He co-founded Radiant, which is developing Kaleidos, a transportable reactor, built in a factory, and designed to supply one megawatt of electricity. The reactors are designed with military installations and remote customers in mind, offering an alternative to diesel generators that need regular fuel deliveries. The company sent their first demonstration unit to Idaho National Laboratory in August 2026 and plans an Oak Ridge factory designed for up to 50 units a year. An Army Janus agreement worth up to $750 million covers the development and deployment of 15 units.

Redwood Materials

Carson City, NV · Founded 2017 · Inputs

Redwood Materials founder JB Straubel co-founded Tesla, where he served as chief technology officer from 2005 to 2019. Redwood recovers materials for new batteries from used cells and manufacturing scrap in Nevada and at their newer South Carolina campus. EV batteries that still have useful life go into Redwood Energy’s stationary storage business, including a 63-megawatt-hour project with Crusoe.

Relativity Space

Long Beach, CA · Founded 2015 · Systems

Relativity launched Terran 1 in 2023, and brought on new CEO Eric Schmidt in 2025. Since, they have accelerated their technical development of Terran R, a new, larger reusable rocket that is expected to debut in late 2026. All 13 engines for the first flight had passed acceptance testing by June 2026, and Relativity has reported more than $3 billion in launch agreements.

Saronic Technologies

Austin, TX · Founded 2022 · Systems

Dino Mavrookas served 11 years as a Navy SEAL and completed eight combat tours before starting Saronic. The company builds autonomous surface vessels and is expanding shipbuilding capacity in the U.S. to produce more of them. Their Echelon software gives operators one interface to plan missions and control a single vessel or an entire fleet. The U.S. Navy awarded Saronic a $392 million production contract late last year. In June 2026, the Navy used the company’s 24-foot autonomous Corsair boat to rescue two downed Apache helicopter pilots near the Strait of Hormuz. In July, Saronic chose Brownsville, Texas, for Port Alpha, a planned shipyard representing more than $3 billion in investment. The shipyard is targeted to open in 2028 and would add to the company’s existing capacity in Franklin, Louisiana.

SendCutSend

Reno, NV · Founded 2018 · Factories

Jim Belosic founded SendCutSend to get custom parts for his garage projects without waiting weeks or paying hundreds of dollars apiece. Drawing on his software background, he built a service where customers upload a design for an instant quote, dramatically improving the legacy email-based quoting process. SendCutSend grew largely on their own cash after an early friends-and-family round, then took their first institutional funding in May 2026. That month, they committed more than $250 million to facilities as part of a five-year, $1 billion investment in U.S. manufacturing, including not only the laser cutting business with which SendCutSend started, but also machining, bending and forming, welding, and more.

Senra Systems

Redondo Beach, CA · Founded 2023 · Factories

Senra Systems makes the wire harnesses that carry power and signals through aerospace and defense systems. Their Amp software brings engineering and production work into one system that also manages the supply chain, helping teams assemble harnesses efficiently and consistently. Co-founder Jordan Black began his manufacturing career repairing roller coasters at the Santa Monica Pier before joining SpaceX, where he developed wire-harness manufacturing processes. In July 2026, Senra opened their second factory in Cypress, California, adding about 80,000 square feet and expanding their manufacturing footprint fivefold. They plan to use the factory to increase monthly output from 1,000 harnesses to 10,000 by 2027.

Shield AI

San Diego, CA · Founded 2015 · Systems

During his service as a Navy SEAL, Brandon Tseng saw situations where autonomous systems could have helped protect troops. He co-founded Shield AI, whose Hivemind software lets aircraft fly autonomously when GPS and communications are unavailable. Hivemind powers the V-BAT, which is built in Frisco, Texas, and has already been fielded. The software is also intended for the X-BAT combat aircraft still in development, while its role in the Air Force’s Collaborative Combat Aircraft effort extends beyond Shield’s own airframes.

Skydio

San Mateo, CA · Founded 2014 · Systems

Skydio builds autonomous drones for defense, infrastructure operators, and public safety customers. Their aircraft and docking systems are produced in Hayward, California. Co-founders Adam Bry and Abe Bachrach worked on autonomous flight at MIT and helped start Google’s Project Wing before founding Skydio. Skydio announced a five-year, $3.5 billion U.S. investment plan in April 2026, to expand research and development, domestic supply chains, and manufacturing capacity through its SkyForge program. SkyForge includes a planned manufacturing facility five times the size of Skydio’s existing space. Skydio had already shipped 60,000 drones to over 3,800 customers when they announced the plan.

Specter

San Francisco, CA · Founded 2025 · Systems

Specter was started by Philip Clark and Xerxes Libsch to unleash AI into the physical world. Xerxes spent 6 years at Anduril as Chief Architect, and Philip is also a partner at Thrive Capital. Specter builds vision AI for the physical world, utilizing mesh sensing, ruggedized edge compute and custom multi-modal AI models. Their AI model can understand physical environments in real-time, drastically increasing the efficiency and automation of physical industry across numerous F500 customers. Specter is deploying this technology to solve some of the hardest operational problems at the heart of physical industry today - from manufacturing optimization, critical infrastructure security to logistics and supply chain tracking.

Stoke Space

Kent, WA · Founded 2019 · Systems

Co-founded by former Blue Origin rocket engineer Andy Lapsa, Stoke Space is developing a new launch vehicle, Nova, which is designed to lower launch costs by recovering both stages and flying them again. They completed a first-stage proto-qualification campaign in 2026 and are preparing Launch Complex 14 at Cape Canaveral for a first launch targeted for late 2026.

Ulysses

San Francisco, CA · Founded 2023 · Systems

Ulysses’ founders first built drones in Ireland, then turned to underwater robots for seagrass restoration, work the company continues with partners such as the Great Barrier Reef Foundation. Ulysses now builds Mako underwater vehicles for inspection and defense work, with the U.S. Navy and Office of Naval Research among their customers and partners. The company makes key components in San Francisco and builds the Leviathan surface vessel and Kraken system to launch and recover their vehicles. Funding raised in April 2026 is intended to put larger fleets of those robots in the water.

Unlimited Industries

San Francisco, CA · Founded 2025 · Factories

Alex Modon co-founded Unlimited Industries after watching his first major industrial construction project in Texas stretch from months into years. The company uses software to generate and compare designs for power and data infrastructure, then takes the projects through engineering and construction. At their December 2025 launch, Unlimited said they already had active projects and could cut design and estimating work from months to days.

Valar Atomics

El Segundo, CA · Founded 2023 · Inputs

After building an auto-repair business and a software startup, Isaiah Taylor founded Valar Atomics, which is developing gas-cooled nuclear reactors alongside the processes to manufacture them. Under the DOE Reactor Pilot Program, their Ward 250 completed a zero-power criticality test at Utah’s San Rafael Energy Lab in June 2026, sustaining a nuclear chain reaction.

Varda

El Segundo, CA · Founded 2021 · Factories

Will Bruey worked on SpaceX’s Dragon spacecraft before co-founding Varda with Delian Asparouhov. Varda develops orbital factories to process pharmaceuticals in microgravity and return them to Earth. Its reentry capsules also carry government experiments that collect data during hypersonic flight. The company builds its spacecraft and heat shields in-house in El Segundo. In March 2026, Varda leased a 205,000-square-foot industrial and office campus to expand spacecraft and capsule production, alongside a separate biopharma development facility. On October 20, 2026, it launched W-7 to study cancer-drug crystallization in orbit, its third launch that month.

Westmag

South San Francisco, CA · Founded 2024 · Factories

David Hansen learned how the motor supply chain worked while sourcing components from China for Weel’s self-balancing e-bikes. He co-founded Westmag in 2024, which manufactures and tests drone motors and robot actuators at Factory 01 in South San Francisco while working to control upstream parts and materials. At their June 2026 public launch, Westmag said production was growing to meet commitments for hundreds of thousands of units, with a target of more than 30 million a year before 2030.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

a16z General Partner has a new essay out today on the four philosophies that shape how investors evaluate deals. You should read it! You can find it here.

For years, the industry prepared for quantum computing to rewrite the rules of cybersecurity. Then AI got there first.

This summer, OpenAI’s agents broke out of a cybersecurity evaluation and breached Hugging Face’s production systems. They exploited vulnerabilities, used stolen credentials, and worked their way into another company’s infrastructure, all to get the answers to their tests. OpenAI’s incident report describes how the models chained together the steps to get there.

This was just a preview. Since then, AI has helped uncover weaknesses in software that much of the internet depends on. Just last week, companies were scrambling to patch critical flaws in PHP, which powers roughly 70% of websites. The flaws had been sitting there for more than a decade before researchers working through OpenAI’s Patch the Planet initiative helped uncover them. That same day, eMudhra, a certificate authority trusted by every major browser, was found to have used encryption keys so weak that one of them was just the number 4.

Mistakes like that have always existed, but models are getting better at finding weaknesses and figuring out how to exploit them. The progress is visible in the AI Security Institute’s evaluations, where newer models can complete increasingly complex cyber tasks.

More serious vulnerabilities are also being reported. With the growing volume confronting companies, security teams have to determine which weaknesses pose the greatest risk to their business and get them fixed before someone exploits them.

Meanwhile, the environment they’re protecting keeps growing. Employees are shipping applications they couldn’t have built a year ago. Agents are getting access to company documents, source code, and production systems. Every new application and connection gives security another thing to understand and protect.

That helps explain why we’ve seen the market caps of cybersecurity platforms like Palo Alto Networks and CrowdStrike take off this year.

There is more to secure. And enterprise budgets are following.

To understand how security leaders are responding to these pressures, we surveyed 100 CISOs at companies with more than 1,000 employees about their priorities, budgets, and buying plans for 2027.

Unsurprisingly, a large majority (87%) expect cybersecurity spending to increase, driven primarily by AI-enabled threats and the expanding attack surface created by their own AI deployments.

Most of the additional spending is headed for tools. What stands out, though, is that it isn’t coming at the expense of people. Despite AI handling more of the work, nearly half expect security headcount to increase in 2027, another half expect it to stay flat, and only 4% expect to cut.

Why? The ambition is to cover more ground: investigate alerts that might otherwise wait, test more applications, and close vulnerabilities sooner.

CISOs are already running pilots, setting aside budget, and deciding which products they trust to put into production. Many of those buying decisions will play out over the next twelve months. And the priorities look quite different from a year ago…

AI Rewrites the Priority List

A year is a long time in security right now. When we asked leaders to recall their 2026 priorities, exposure and vulnerability management and SIEM topped the list. For 2027, all seven of the most-selected initiatives involve AI.

What becomes P0 varies by organization. SOC automation gets the most first-place votes, while other teams put offensive security, remediation, or securing their own AI deployments first. Where buyers start depends on where the pressure is greatest, but there is broad agreement that AI capabilities are core to their security stack.

The movement from recalled 2026 priorities shows how quickly the agenda is changing. Internal AI agent security, SOC automation, and offensive security make the largest gains. Code security, remediation, and AI governance follow closely.

Two jobs are driving the shift:

1. Enterprises need to secure the AI their employees and customers are already using.

2. They also want to put AI to work inside security, helping teams investigate attacks, test systems, and fix what they find.

The Next Buying Window Is Already Open

While interest is high, most enterprises have yet to put these capabilities into production. Only 18% report production use of AI SOC tools, and 13% report production use of either AI offensive security or AI exposure and vulnerability remediation.

Many are already piloting, however, or expect to reach production within the next year. Code security and email defense are further along, but even there, production adoption remains far from universal.

The purchase plans are more immediate. 45% plan a new purchase or upgrade for internal AI agent security within twelve months, followed by offensive security at 42% and AI usage and governance at 38%.

Buyers are making decisions as the products themselves keep changing. Some are expanding an initial deployment, while others are comparing vendors for capabilities they’ve never bought before. Across categories, the next year will bring a wave of evaluation and purchasing.

Here is where CISOs told us the market is heading, and where we see opportunities.

Offensive Security Becomes a Continuous Capability

Earlier this month, we partnered with Kevin Mandia and led Armadin’s Series B because we believe it’s critical for defenders to leverage the same speed and scale that AI is giving attackers. Armadin uses autonomous agents to find exploitable paths through enterprise systems and help security teams close them.

That speed matters because the environment doesn’t stand still. A team can spend weeks working through its pentest findings while developers keep shipping features, employees connect new services, and permissions change. By the time those issues are fixed, there may already be another set of weaknesses to investigate.

AI makes that gap more consequential. Bain estimates that it can compress a typical attack sequence from roughly four weeks to about eighteen hours, leaving much less time to find an exposure and get it fixed.

Security leaders want to test more often. 83% rate more frequent security posture testing as important, including 54% who call it very important.

“With all the new AI threats, we need to find things before others do.” - CISO at a Global Manufacturer

Human pentesters bring expertise that companies still need, but there are only so many applications and systems they can cover. One security team described keeping its testing budget intact and using AI to cover more applications and infrastructure.

Buyers also expect testing to become much more frequent. Today, 18% say most of their offensive testing runs continuously against production assets; 52% expect it to within a year. Looking five years out, 44% expect testing to be embedded in CI/CD, triggered by code or infrastructure changes.

That brings security testing into the process of building and maintaining software. A release can trigger a new test, and a fix can be checked as soon as it is deployed. Teams can check for new weaknesses as they ship, rather than waiting until the next scheduled assessment to find out what changed.

Finding Is Great, but Fixing Is Key

Finding a vulnerability can be the fast part. Getting it fixed means finding the right owner, working out what needs to change, and getting that change tested and deployed. For a team already sitting on a backlog, faster discovery can leave it with even more work to finish.

“With a lot of these AI tools, you’re able to find vulnerabilities faster, but you’re not able to patch faster.” - Fintech CISO

A validated attack path helps teams prioritize that work by showing what an attacker can actually reach and which changes would stop the attack. Buyers also want help making those changes and checking that they worked. In our survey, 70% want to retest and verify that vulnerabilities have been fixed, 67% want to prioritize remediation using validated exploitability, and 57% want fixes or remediation tickets generated automatically.

An executive at a large cybersecurity platform described the opportunity as building “a fix it with the find it.” That means following a finding through to a change the team can deploy, then rerunning the attack to make sure the exposure is closed. The team gets help resolving the issue and evidence that the fix actually worked.

The SOC Gets More Capacity, One Action at a Time

As attacks move faster, security teams need to investigate and respond faster. Their ability to keep up depends on a limited resource: analyst time. To work through an alert, an analyst still has to pull evidence from several systems, reconstruct what happened, and determine whether there is a real threat. By the time they have the full picture, hours are gone, and the response has not started.

AI SOC tools can take on more of that work. Agents can pull the relevant evidence and run routine checks, leaving analysts more time to investigate complex cases and work on decisions that need their judgment. For teams already stretched thin, that can mean getting to threats that would otherwise sit in the queue.

How much authority to give those agents is a separate decision, though. Today, 36% of respondents are comfortable letting agents act autonomously on low-risk actions. Looking 12 months ahead, 60% expect to be comfortable with that level of autonomy. Only 7% expect to allow autonomous action in most cases.

Gathering logs is different from changing a production system. Teams can delegate much of an investigation while retaining approval for a response that could disrupt the business.

Cotool lets security teams turn their own investigation processes into agents that work across existing tools, triage alerts, and take action within permissions they define. Analysts can review the results, refine the process, and choose where approval is required. An investigation the team knows how to run can then happen repeatedly without someone having to work through every step by hand.

Securing the AI Inside the Enterprise

AI is already embedded in enterprise work. 92% report at least limited production use of employee generative AI tools, 83% report production use of coding assistants or agents, and 55% have MCP servers or other agent-to-application integrations in production.

These systems can reach source code, retrieve company documents, and take actions across applications. A security leader at a restaurant software company asked the question many teams are confronting: “How do you really know what the agents are really doing?”

The concerns are concrete. 47% include employees leaking sensitive data into AI tools among their biggest worries, and 46% cite agents exceeding their permissions or being compromised. Another 29% worry about prompt injection or data leakage through AI applications.

For many enterprises, these questions are already slowing deployment. 63% of responses describe security slowing at least some AI adoption, including reviews, approval requirements, and restrictions on particular uses.

Security teams need to know which tools and agents are running, who owns them, what they can access, and what they actually do. And the answers keep changing. Software approved as an ordinary application gains agentic capabilities with its next update, employees add extensions and integrations, and an agent’s permissions expand as it takes on more work.

Keeping up is harder than it sounds. Agents run on employee devices with the user’s own permissions, so to the tools built for the last decade of endpoint security, an agent reading a file or calling an API looks exactly like the employee doing it. EDR, DLP and Zero Trust all break at that point.

That’s why we invested in Neo. Neo’s founders helped build SentinelOne and are now rebuilding the endpoint layer for a world where agents act continuously and often outnumber the people they serve. Neo tracks the agents, extensions and MCP servers on employee devices and what each can access. It checks whether a person or an agent is behind an action and enforces policy in real time. An agent might be allowed to investigate a production issue but need approval to change the system.

Human Risk Gets an AI Upgrade

Even with the rise of increasingly sophisticated attacks, the human side of security remains a major risk (the password on a sticky note is, unfortunately, still with us). 80% of organizations surveyed by SANS rank social engineering as their top human-related risk. Ultimately, simply convincing an employee to do something is often the easiest way in, and AI is making those requests far more convincing.

A message can sound like a colleague. A voice can sound like a manager. A video can look like someone you know.

When Brian Long from Adaptive Security came in to pitch, he showed us these two photos of Elon Musk and asked us to pick the real one.

Most of us got it wrong.

Impersonation now goes well beyond misspelled emails and suspicious text messages. Even a careful employee could be caught off guard by a request that appears to come from someone they know and trust.

That moment reinforced how much training and simulations need to evolve. Adaptive runs AI-powered phishing and deepfake simulations across email, voice, and messaging so employees learn to recognize the attacks they will actually face, not the ones from five years ago.

Not only do these impersonations look more real, but there are a lot more of them too. AI makes it easy to keep spinning up fake executive profiles, spoofed domains, and fraudulent sites. Security teams can no longer keep up with finding and taking each one down by hand, so they’re turning to tools like Doppel to automate that work.

More Code, a Higher Bar for Security

You can feel good about your own security and still inherit a serious problem from the software you depend on. The recent PHP vulnerabilities brought that home.

Code security is hardly a new category. Companies have been buying SAST and SCA tools for years. But AI is helping developers ship more code, putting more and more pressure on the existing security tools companies have relied on for years.

And that’s why nearly half of the CISOs we surveyed put AI code security among their top five priorities for 2027, up from about 25% in 2026 - that can mean upgrading to tools like Socket that actively scan dependency code themselves and/or using minimal container images that are continuously rebuilt from source with the latest security patches.

“We have way more engineers developing than we have security people testing.” - CISO at a financial services company

More Demand, but Platforms Get the First Call

Even as priorities shift and new buying cycles open, existing platforms often get the first call.

When asked where they would look first for AI security capabilities, 44% default to features from an existing security platform, compared to 21% who start with an AI-native security vendor. A company that already protects a buyer’s endpoints, holds its security data, and has been through procurement has a real head start.

As one leader put it: “I trust CrowdStrike. It has the brand. It has the credibility.”

But the first call is not always the last one. When we asked what would lead them to choose a startup over their incumbent, 47% said solving a capability gap their existing vendor cannot address. Better performance, faster innovation, pricing, and integration with the existing stack also factor in, but the primary door opener is a problem the platform simply does not solve.

For many buyers, adopting a startup means adding a capability alongside the platform they already use, not replacing it. A new vendor earns a place by solving a priority problem their current tools leave unresolved and proving that it works in their environment.

A Noisy Market Makes It Harder to Know What to Buy

Across AI security categories, dozens of vendors are promising more autonomous security, faster investigations, and less manual work. Their descriptions can sound remarkably alike.

Jake’s Black Hat 2026 vendor landscape laid it out well. Some categories have as many as 43 vendors - that’s a lot of companies for a buyer to have to sort through.

Buyers need to understand how much work each product completes, how much follow-up their team still handles, which actions it can take safely, and what it costs to run. Getting those answers takes time from the same people the product is supposed to help.

A CISO at a global apparel company described narrowing seven or eight vendors to three for hands-on testing. As he put it, “It is not humanly possible to do the proof of concept for all seven or eight.”

And the comparison keeps changing. New vendors enter, products expand, and improvements in the underlying models can change what is possible during the evaluation itself. That makes committing harder.

Another security leader explained his hesitation: “I do not want to keep buying point products over and over again ad hoc, just to solve each new problem every day.” He’d signed a short-term contract for one tool and was still evaluating others.

That caution can coexist with real demand. Teams are requesting budget, running pilots, and putting initial products to work while deciding what to deploy more broadly. They want to address the problems in front of them without adding another product every time a new one appears.

Looking Forward

AI has rewritten the security agenda faster than any shift in recent memory. Budgets are rising, teams are growing, and CISOs are evaluating capabilities that looked very different just a year ago. They are already running pilots and putting AI to work across use cases like offensive security, SOC automation, and the protection of their own AI deployments.

And they are looking beyond their existing platforms.

That is where startups come in. In the newest AI categories, the incumbents have not caught up, and security leaders are bringing in whoever can solve the problem in front of them. Startups have been the ones to see what these changes require and build for them.

We expect this next wave to produce important security companies, built around capabilities that enterprises are only beginning to need and will soon find difficult to operate without.

Special thanks to , and for their contributions to this piece.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.

So many aspects of our lives are going to change over the next twenty years. And one that’s easily in the top five is the question: “What do you do at work all day?”

Two massive breakthroughs are on the cusp of happening around this question. The first one is agentic automation: “describe a task that we currently do, and automate it.” The second one is employee empowerment to take initiative. People closest to the problem can increasingly investigate and take action on opportunities without waiting for information and authority to travel through layers of hierarchy.

Both of these things are radical changes - for the better! - to what everyone does all day. IF, and this is a big if - organizations are actually able to evolve into this new way of working. A shockingly large component of “what is someone’s day to day job” is constrained by the system of record and decision-making used by their employer. And this in itself is constrained by the database technology they use, and what it makes possible. Not many people think about this second part.

Enter Databricks. Outside of people in their sphere of influence (who know them very well), Databricks might be the most under the radar story in Silicon Valley, even though they’ve now surpassed a $7 billion run rate, growing 80% y/y. You’ve certainly heard of them, but not that many people actually know what Databricks does, other than being 1) a data company, and 2) important for agents, although perhaps not sure why.

The Databricks story is a wild sequence of events, and a serendipitous example of a product whose time has come. Three years ago, every interaction on Databricks involved a human. Today, the company is seeing more queries from agents than people, and more than 17 million databases are launched by agents every day. This trend will continue.

There are four parts to this story:

1) What does Databricks actually do? What is a “Lakehouse” and a “Lakebase”, those words you may have seen on billboards, and why are they an architectural breakthrough that arrived just in time?

2) What is a “system of record”, and why do agents need a new kind of SoR if they’re gonna work inside real companies, make real decisions, and contribute to the company’s knowledge base?

3) What is a firm in the first place? How does that change, if agents outnumber people 1000:1? How do firms differentiate themselves, and create value?

4) What are people’s jobs all day, in this new world? The promise of AI at work is often advertised as, “Ordinary people now have software engineer powers.” But the long-term impact isn’t necessarily “everyone is an engineer.” It might be closer to, “Everyone is a manager.”

This is, perhaps, the highest-stakes piece of all. We’re witnessing in real time the great undoing of the management style that built the 20th century, as chronicled in James Burnham’s famous work The Managerial Revolution. Eighty five years ago, Burnham described how information technology and organizational complexity was creating a corporate operating model, where a small class of professional managers centralized the decision-making inside of companies. Today, thanks to a new wave of technology, the craft practitioners at the front lines are regaining responsibility again - and we’re all better for it.

This is Databricks, and why it will power the future of the firm.

From Spark to Agents

Databricks has recently been described as “a data company that caught the AI wave.” But the company was built by AI researchers a decade before the wave arrived. The business is four technology S-curves stacked over nearly two decades – Spark, Lakehouse, Lakebase, and now agents – each of which created the innovation window for the next. To properly appreciate this sequence of unlocking potential, we have to take a minute and talk about database technology.

In 2009, Ali Ghodsi was a visiting researcher at UC Berkeley watching internet companies use enormous datasets to predict what people would click, buy, and watch. This was a time when people talked about “Big Data” a lot. The leading framework was Hadoop, which companies like Yahoo, Facebook, Twitter, and LinkedIn used to process data workloads in parallel across thousands of cheap, commodity servers. Before Hadoop, the standard way to process larger workloads was to buy a bigger machine from vendors like Oracle or IBM that cost millions of dollars each, so Hadoop was an attractive alternative.

Hadoop’s critical flaw was that each round of a computation saved its results to disk before the next could begin. That made work easier to recover when one of the cluster’s cheap machines failed, which was a sensible choice. But it was painfully slow for iterative workloads like machine learning, where you make predictions, measure the error, update a model, and then repeat. Hadoop treated each round as a new job and reloaded the same data from disk every time, so the cluster spent minutes moving data for every few seconds of improving the model.

This problem inspired Matei Zaharia, a PhD student at Berkeley, to write the first version of Apache Spark. Spark built on Hadoop’s innovation of spreading data processing work across cheap machines, but let applications keep frequently reused data in the servers’ much faster memory between rounds instead of loading it from disk each time – without giving up fault tolerance. That made these repetitive workloads up to ten times faster. The lab open-sourced it in 2010, and three years later, Ali, Matei, and five of their fellow researchers founded Databricks to abstract away the complexity of running the distributed infrastructure Spark required – the clusters, the scaling, the security – behind a single platform for the enterprise.

Spark sped up data processing, but where that data lived was another problem. Enterprise data in that era occupied two separate worlds. Data warehouses held the structured, trustworthy records that let analysts ask questions of them in SQL and powered every dashboard and quarterly report. Data lakes provided cheap storage for everything else, like documents, images, recordings, and logs. Data lakes were cheap, so teams dumped everything into them; but nothing was checked or structured on the way in. Even though a vast ecosystem of AI open-source tools like TensorFlow and PyTorch grew around the data lake, it was hard to get value from a pile of data you couldn’t trust, which earned them the nickname “data swamps.”

Both systems solved a problem, but they created a divide. Engineers and data scientists lived in the lake with Python while analysts lived in the warehouse with SQL. Whenever one side needed the other’s data, someone had to build a pipeline to move it. This left the company with lots of copies, pipelines, permissions, and conflicting definitions. But in the late 2010s, Databricks, Uber, and Netflix each landed on the same fix independently. Their projects (Delta Lake, Hudi, and Iceberg) added a table layer over the files in the lake, giving them warehouse-like guarantees such as all-or-nothing updates, schema management, and versioned history. Instead of moving the data into a separate warehouse for reliability and performance, a company could now run warehouse-style workloads on the same storage where the data already lived. It was the breakthrough that made a new architecture possible.

In 2020, Databricks invented the “lakehouse” by merging the data lake and the data warehouse. It combined the cheap, flexible storage of the data lake with the strict reliability and fast query performance of a data warehouse, then made warehouse-grade SQL and machine learning first-class workloads on the same foundation. The cheap storage that held everything became trustworthy enough to serve as the data foundation that engineers, data scientists, and data analysts could finally share. “The best data warehouse is a lakehouse,” went the tagline, and customers seemed to agree. Today, Databricks’ Lakehouse runs at a more than $1.5 billion revenue run-rate, growing over 100% year over year.

Amazon CTO Werner Vogels made the case from the customer’s side in a January 2020 blog post. “If you wanted to combine all of this data in a traditional data warehouse without a data lake, it would require a lot of data preparation and export, transform, and load (ETL),” he explains. “You would have to make trade-offs on what to lose and continually change the structure of a rigid system.” Data lakes let you import data in any format, eliminating these trade-offs. The lake was also a powerful foundation for machine learning and AI, which, Vogels wrote, “thrive on large, diverse datasets.”

One divide remained. The lakehouse unified the data a company analyzes, but not the data its applications run on. The operational database, which manages real-time transactions for day-to-day business operations, like processing payments or user logins, was still stitched to the lakehouse by a web of fragile pipelines. Compute and storage remained bundled in one monolithic box, and data was trapped in proprietary formats that made migrations one of the scariest technical projects in any organization.

So in 2025, Databricks bought Neon, a serverless Postgres company whose databases were already being created mostly by AI agents, and which represented a new architectural category of databases, called lakebase (inspiring Databricks to call the resulting product that integrated Neon into Databricks “Lakebase”). Just as the lakehouse rebuilt the warehouse on top of the data lake, Lakebase applies the same idea to the operational database. It separates storage from compute so data can be stored cheaply in the data lake while compute scales up or down with demand. And because operational databases and the lakehouse share the same underlying storage, database changes automatically become available to analysts, engineers, and agents, without a web of pipelines to build and maintain. Databricks calls this unification of transactions and analytics LTAP, for Lake Transaction/Analytical Processing.

This separation makes the database behave more like code. Even petabyte-scale databases can be duplicated in seconds because Lakebase only copies the changes. This lets an agent create an isolated branch, experiment on it, and throw it away when it’s done – a consideration even Databricks didn’t fully appreciate until recently. Lakebase launched last year and has already crossed a $100 million revenue run rate, and agents are its most prolific users. “We think that is probably going to be a bigger market in the long run than the existing database market,” Ali says.

This technological unlock has come just in time. For decades, software in a company was built by a small group of engineers and used by everyone else. We are moving to a world where a person declares the outcome they want and the software figures out how to achieve it. Instead of thousands of employees reading and writing from a handful of databases managed by a central team, the company will have thousands of databases that millions of agents read and write to.

A System of Record for Agents

In June, Ali stood in front of ~30,000 people at the company’s Data + AI Summit and asked the room to raise their hands if artificial general intelligence had arrived. He counted maybe ten percent.

“We believe AGI is already here,” he told them, pointing out that today’s frontier models can already solve more than half the questions on Humanity’s Last Exam – 2,500 questions, written by experts in more than a hundred fields, believed to be too hard for any AI to answer.

When ChatGPT came out in 2022, it could handle coding tasks that take a person about thirty seconds. Today’s frontier agents complete coding tasks that take a skilled engineer a full work day. Researchers at METR, an independent evaluation lab, have tracked the length of a task an agent can finish on its own across models going back to 2019, and it has doubled roughly every seven months. Recently, progress has been even faster, with similar trends beyond coding. If it holds through the early 2030s, agents will be capable of doing tasks that would take a human years.

Yet, inside most companies today, AI still isn’t trusted to reliably update records in Salesforce.

“AI does not have an intelligence problem,” Ali explains. “It has a context problem.” Even the smartest human would be all but useless without access to the company’s data, permission to act, feedback, or the knowledge in other employees’ heads. Ali’s answer is what he calls a “system of record for agents.”

Maybe you’ve seen a clip of Palantir CEO Alex Karp talking about ontology. “All of the value in the market is going to go to chips and what we call ontology,” he posits. “The ontology allows you to take an LLM, use it, refine it, and impose it on your enterprise.” What that means in practice is usually left as an exercise for the listener.

Every company has an ontology – a working model of what exists, how those things relate, what its words mean, and which source governs when two disagree. Parts of it live in databases, dashboards, policies, and documents. But much of it lives only in the heads of experienced employees. It’s also never finished. Contracts change, workarounds become processes, exceptions become rules, and the official record drifts away from how the work is actually done. The same is true of who decides what and of remembering which decisions were right – authority and evaluation are just as unwritten as ontology. People compensate for all of it almost invisibly. It’s the job of the VP of Sales to know that the biggest committed deal has stalled because the champion is quietly interviewing elsewhere, that one rep’s “90%” really means 50% – and to cut the forecast before it reaches the CEO.

For agents to act autonomously, much of the ontology, authority, and evaluation that currently lives in people’s heads will have to move into the firm’s system of record. Databricks is betting the lakehouse is the natural home for it because that’s where the rest of the company’s data is stored and governed. “The lakehouse has become the system of record nowadays,” Ali says. “I call it SORA – the System of Record for Agents.”

Employees can interact with this system of record through Genie, the natural-language interface Databricks launched in 2024 that lets anyone in the company ask questions of its data and, increasingly, build agents on top of it. Underneath, the record has to span the whole firm and continuously answer four questions, each of which Databricks is working on:

What is true? Lakehouse and Lakebase already hold the state.

What does it mean? Instead of letting AI loop through all the data in a company hunting for answers every time someone asks a question, Databricks’ Genie Ontology continuously builds a graph of what the organization knows, like how revenue is calculated or what was discussed in the transcript of last week’s standup. An algorithm the engineers dubbed OntoRank (a nod to Google’s PageRank) ranks which knowledge is authoritative by weighing attributes like who created a definition, how widely it’s used, and how recently it changed. In Databricks’ testing, grounding an agent in the company’s ontology raised the accuracy of answers from about 50% to 84.5%.

What is allowed? The old access model of a login for every employee held up when every worker was human, but it breaks when employees are spinning up hundreds of agents a day. “You can’t grant access to each proprietary, siloed database to your agents,” Ali explains. Databricks’ Unity Gateway gives every model, agent, and AI tool in the company an identity, a budget, and guardrails, and traces log every action so the company can see what its AI systems are doing, what data they access, and how much they cost.

Did it work? Databricks gives companies two ways to build agents. Business teams build theirs in Genie, turning a prompt into a shareable agent that reasons over the company’s data and, increasingly, takes action in applications like Slack or Salesforce. Engineers build more customized agents in Agent Bricks, Databricks’ developer platform for production AI agents. Either way, Databricks lets teams write their own exams – the acceptable results and the mistakes that cannot be made – and gives them tools to optimize each agent against the company’s definition of good for a given task, which is how AI becomes a loop.

Every platform shift in enterprise computing has created a new fight over the system of record. IBM dominated the mainframe era. Oracle and SAP became foundations of the client-server enterprise, while Salesforce, Workday, and ServiceNow built the SaaS systems of record for sales, HR, and IT. Agents are the next shift.

But which vendor wins is a smaller question than how agents will change the firm itself.

The Nature of the Firm

In his 1937 article “The Nature of the Firm,” economist Ronald Coase asked why firms exist at all. If markets can coordinate activity through prices and contracts, why bring people together inside companies and subject their work to managerial direction?

His answer came down to transaction costs. Finding the right person, negotiating what needs to be done at what price, and monitoring it all take time and money. A firm replaces some of those repeated market transactions with a more open-ended arrangement in which managers direct resources within agreed limits. But organizing work inside a firm is not free either. As a company grows, more information has to travel through more people, and eventually, the cost of organizing the next transaction internally costs as much as buying it from the market. In Coase’s account, the firm expands until those two costs meet.

Forty years later, Herbert Simon – one of the few people to win both the Nobel Prize and the Turing Award – observed that centralizing the memory of a business decentralized its decisions. A shared computer record, he wrote, “allows each of the decentralized decision points to take actions independently” because the system automatically reconciles those actions against the shared record.

For an airline, a ticket agent in Boston didn’t have to call every other ticket agent before selling the last seat to Chicago. She consulted the record, and when she sold the seat, the record changed for everyone. Centralized state made decentralized action safer because people could coordinate with the record instead of with each other.

The relational database extended this principle across the company. Work that once required reports, meetings, and managerial handoffs became a query against the shared record, which let the company coordinate more products, locations, people, and transactions without adding management at the same rate. By the 1990s, the internet let the outside world write to the firm’s record, and an online marketplace could coordinate buyers, sellers, inventory, and payments among millions of strangers.

Because both external and internal transaction costs fell, the database era did not make firms uniformly larger or smaller. Instead, it allowed a wider range of firms to exist. Large firms became capable of managing far more complexity, while small firms could rent or buy capabilities that once required entire departments.

The same is likely to be true of AI. Inside the firm, agents can reduce coordination costs by automating reporting, search, and routine tasks. Outside it, they can help find and evaluate vendors, negotiate routine terms, and monitor the results. Like the database before it, AI will raise the complexity ceiling of the businesses and markets that can exist. But its more consequential effect may be how it changes the shape of the firm.

The typical firm of the twentieth century was pyramid-shaped because hierarchy was its information processing system. Facts moved up through reports and meetings, decisions moved back down, and the map of information flow mirrored the org chart. Management decided what data was worth gathering or sharing, which meant the company’s view of itself was only as good as what its managers had chosen to collect.

Databases changed this structure, but only partially. A shared record allowed people to access information directly and act more independently, but usually within procedures that someone else had already designed. For much of the computer era, a relatively small group of managers, operations teams, and engineers defined the company’s schemas, metrics, applications, and workflows – and far more employees used those systems than helped design them.

This constrained not only what people could do, but what the organization could know. For example, a support rep who hears the same complaint several times a week knows something the company doesn’t if her manager doesn’t write up a report that captures it. And fixing the problem is another thing entirely.

The technical barriers to both – knowing and doing – are now falling at once.

As Andrej Karpathy put it in 2023, “The hottest new programming language is English.” Natural-language interfaces allow more domain experts to interrogate a company’s data without waiting for people who know SQL or Python to anticipate or answer every question. At Novo Nordisk, a century-old global healthcare company, scientists used to wait on data engineers to write their queries. Now they ask Genie, “show me all of our obesity data,” and it pulls the relevant trials, insights, and visualizations instantly.

And within defined permissions, employees are empowered to create solutions that save hours or even days of work. At the electric vehicle manufacturer Rivian, a finance analyst with no SQL experience used Genie to build a revenue dashboard for the CFO, and a supply chain analyst built an app to track inbound inventory shipments.

This doesn’t mean everyone has access to all of the firm’s data or resources without approval. Shared ontology, permissions, and accountability become more important as work becomes more distributed. The system of record centralizes state and guardrails while decentralizing who can ask questions, design workflows, and act.

In March, Jack Dorsey wrote a manifesto titled “From Hierarchy to Intelligence” describing how his company Block is beginning to test an extreme version of this idea. “For the first time,” he writes, “a system can maintain a continuously updated model of an entire business and use it to coordinate work in ways that previously required humans relaying information through layers of management.”

Ali’s “system of record for agents” is similar to what Jack calls the “world model” of the company – a continuously updated representation of the organization’s operations, decisions, capabilities, and priorities. People at the edges of the company ground the model in reality, while the model supplies the shared context needed to act. “People reach into places the model can’t go yet.” Dorsey explains. “They sense things the model can’t perceive: intuition, opinionated direction, cultural context, trust dynamics, the feeling in a room. They make the calls the model shouldn’t make on its own, especially ethical decisions, novel situations, and high-stakes moments where the cost of being wrong is existential.” The result is a firm that needs fewer layers of management to coordinate it and gives leaders greater visibility into the work, even as it becomes more distributed.

Databricks already provides some of the underlying infrastructure for Block. It manages and governs petabytes of Block’s data across Square, Cash App, and TIDAL, and Block used Databricks to ground its AI coding assistant, goose, in the company’s context.

For Dorsey, the competitive case for this new architecture is speed. “Companies move fast or slow based on information flow,” he argues. “Hierarchy and middle management impede information flow.”

Ali agrees with Dorsey directionally, but with one distinction. “I agree philosophically with Jack Dorsey,” he says. “The question is does that apply to the org chart of humans too?” People conflate two things, he argues: the org chart and the way information moves through the company. “Ten, twenty years ago, these were the same thing.” The only way to learn what was happening was to ask your people, who asked theirs, up and down the tree – but that’s no longer true. “Genie pretty much answers any question I have in any meeting about anything,” he adds. The firm will still need managers, just fewer information routers. Developing people, helping teams decide what’s important, and noticing when someone is unhappy still require human attention.

So while the two disagree about how much hierarchy will disappear, both see AI taking over the information-routing work that gave managers immense power over the twentieth-century firm, as companies grew too complex to run without them.

The Second Managerial Revolution

Eighty five years ago, on the heels of the Great Depression, James Burnham wrote a book called The Managerial Revolution which foresaw a great change in how businesses worked, and even how capitalism itself worked. Coming out of the Depression, one of the prevailing trendy attitudes was that entrepreneurial capitalism had run its course as an economic trend, and some new system was bound to replace it. Socialist collectives were one trendy proposal at the time, nationalization was another.

Burnham understood what was going on. He articulated a third kind of thing, not just a corporate structure but an entirely new kind of social order, called the “managerial society.” In this system, the decisive ruling class would be neither the traditional capitalist owners nor the workers, but professional managers, planners, bureaucrats, and executives who operate large corporations and states.

Modern institutions, he believed, were too technically complex to be directed personally by individual capitalists. Since no CEO can know everything happening inside a company with a hundred thousand employees, control would gradually migrate from owners and domain experts to administrators.

In the second half of the twentieth century, Managerialism scored a near-complete victory. “Most of the executives at Fortune 500 companies are not domain experts at whatever the company does, and they’re certainly not the founders of those companies,” Marc Andreessen comments. “They’re professional managers, and in fact, over the course of their careers, they’ll probably manage many different kinds of businesses – they might work in healthcare for a while, then financial services, and then they’ll work in something else.”

But that victory is exhausting itself. The scalability and professional reliability of Burnham’s Managerial Class came at the expense of speed and adaptability, particularly in the face of changing technology.

Maybe, Marc suggests, applying agents - on top of a rigorous foundation like Databricks - creates a third model that can offer the best of both worlds. It helps preserve the founder’s vitality and adaptability, while refactoring the managerial work required to scale. Agents will put this way of operating within reach of more founders by automating some of the information routing and coordination work that made the managerial layer necessary, while the firm’s system of record gives the people at the edges the context and authority to act.

Elon Musk takes Marc’s idea a step further. Earlier this year, he predicted that companies with “humans in the loop” will lose. Keeping humans in the loop in the age of AI, he argues, will be like using a spreadsheet that requires a person to calculate some of its cells.

Elon may be right about the eventual destination – nobody knows how far away the fully autonomous company is, and the forecasts range from years to never. But until then, the irony is that the decline of managerialism may look more like everyone becoming a manager. Not everyone will have direct reports, but more people will be specifying work, delegating execution, inspecting results, and updating the process. The second managerial revolution is not so much the death of management as it is the end of the professional managerial class’s monopoly on it.

Software engineers are feeling this acutely today, as the job shifts from artisanally writing code to managing a team of coding agents. An engineer’s day increasingly looks like a manager’s: scope the problem, break it into tasks, delegate them to agents working in parallel, then review the pull requests that come back – approving some and sending others back with notes. As agents become capable across more domains, more knowledge workers will make a similar shift: from performing every step themselves to specifying, delegating, and judging the work. The Novo Nordisk scientists and Rivian supply chain analysts are already directing agents with Genie to do work that used to require a team of engineers or data scientists, freeing those teams to focus on their most strategic work.

This is good news for human productivity and salaries because execution and judgment are economic complements: when AI reduces the cost of routine execution, demand rises for the judgment that directs it.

The mathematician Alfred North Whitehead observed a century ago: “Civilization advances by extending the number of important operations which we can perform without thinking of them.” The firm advances the same way, becoming more autonomous one loop at a time. Every time a person corrects an agentic loop, the correction should improve the next execution. And as a loop proves it can perform a bounded job reliably, the human moves out of it and to the next unsolved problem, leaving what they have learned in the firm’s shared record.

But, as Burnham probably would’ve noticed, for the firm to remain sovereign, it must own its model and everything the people at the edges teach it.

The Sovereign Firm

Great people will be more valuable than ever in the agentic firm. But great people also come and go. Meanwhile, models keep improving, and every competitor can rent the same ones. So how, exactly, does the firm build a sustainable competitive advantage in this new world?

Consider two banks renting the same frontier model to help make credit decisions. The first sends the model a prompt, receives an answer, and records the final decision. The second records which facts produced the answer, any human override, which decisions performed well, which failed, and adjusts its policy throughout. A year later, when a better model arrives, only one of them has built a better bank. If you replace the AI model at your company and the new one inherits your definitions, permissions, evaluated cases, customer history, and hard-won exceptions, that is a foundation for a sustainable competitive advantage. If the new AI model starts from the same prompt as everybody else, that is not.

The second bank is what people have started calling a “sovereign” firm. If a provider raises its prices, changes its terms, or retires a model, the firm can switch providers without losing what it has learned. As the models get smarter and companies grow more dependent on them, that independence only becomes more important.

In a recent essay, Microsoft CEO Satya Nadella reached a similar conclusion for a different reason. AI models continuously absorb the expertise of humans and organizations and commoditize it, he argues, so “every company is going to have to build what I think of as human capital and token capital.” Human capital is the knowledge, judgment, relationships, and ingenuity of a company’s people, and token capital is the AI capability it builds and owns. The two compound in a learning loop, and “this loop becomes the new IP of the firm.”

Data is the foundation of token capital. “Every company’s business data is their gold mine,” Nvidia CEO Jensen Huang told the audience at Databricks’ 2024 Data + AI Summit, explaining that nearly every process at Nvidia starts with a data flywheel, from chip design to supply chain. “It is making it possible for us to be one of the largest, small companies in the world,” he said. At the time, Nvidia was valued at more than $3 trillion with just 30,000 employees. “The reason for that, of course, is that we have so many AIs in the company helping us out, doing amazing things.” Jensen believes this will apply to every company. “It’s an extraordinary time,” he said, “and it starts with data.”

Databricks is betting that data and the loops built on top of it should live in systems the firm controls. That even includes Databricks’ own specialized models, which it has spent years optimizing for enterprise workloads. The important thing is the loop, not just the data; which is where they’ve been focused since 2023, before it was obvious to everyone. Ownership alone is not a moat, but it prevents the firm’s memory from becoming trapped in some vendor’s stack. The moat emerges only when the data and AI that reasons over it help the firm improve its decisions and products faster than competitors can.

Databricks built this muscle early on. Spark was open source, so customers could just download it and run it themselves. But eventually the founders learned that customers would pay for Databricks if they made Spark easier to run, faster, more secure, and more useful for the enterprise. To survive, they had to create value for their customers faster than the free alternative could catch up. And as agents lower the cost of finding and switching to alternatives, more companies will face a similar test.

The Best Idea You’ll Ever Have

About a decade ago, Ali called me for advice. One of the biggest companies in the world had offered to buy Databricks for about six times the valuation of its last funding round.

It seemed like a dream outcome considering that just two years earlier the company had almost died and couldn’t find a lead for its Series C. We led the Series A in 2013, back when the company was seven Berkeley academics whose only recurring revenue was ticket sales to their own conference, and stepped in with NEA to lead the Series C nobody else would.

Ali remembers the conversation better than I do:

“Hey, you can do whatever you want. I’ll support you in either case. And actually, if you sell for this number, it’s really great for me: we make a lot of money at a16z, I’ll pay the investors back many times over. Honestly, for me personally, that’s probably the better option. But I’m just thinking back. I was CEO of Loudcloud and Opsware — the cards I was given at that company weren’t the company you have. And when I look back, how often in life do you have the chance to even have a company like Loudcloud or Opsware, let alone a Databricks? It’s just such a freaking big market. You can sell and make a lot of money, and you’ll be super successful in life. But if you’re like me, you’re going to look back the rest of your life thinking: ‘I missed that one shot. That was the one thing, and I should’ve taken it all the way. And now I’ll never know how far I could’ve taken it.’ So do you want to live with that, or do you want to just have the money? I’ll support whatever you want to do.”

Ali said thanks and hung up. Then he said to himself: “We’re never doing this. It’s not happening.”

You just don’t get this good of a market opportunity with this good of an entrepreneur. That’s the rarest of rare things. We see great entrepreneurs but their market opportunity is limited, and then we see companies that have a great market opportunity but the entrepreneur is not big enough to fulfill that. But this was a case where we had both.

Last month, Databricks crossed a $7 billion revenue run rate, growing 80% year over year, and was valued at $190 billion. The entrepreneur, it turned out, is big enough.

And the TAM is the foundation of the firm itself – a shared system of record that defines what is true, what the data means, who can do what, and what worked. With that foundation in place, people and agents can act autonomously without routing every decision through layers of management, while the results of their actions flow back into a record the firm owns.

Coordination costs will fall, companies will get more done with the people they have, and new companies will get built that never made sense before, because ten people will be able to do what used to take thousands. And until AI can do everything a great person can do – which is a long way off – this will make great people more valuable, not less.

Fewer people will be carrying out procedures someone else designed because agents will handle the work that’s already been figured out. More will work on problems that no one has solved yet – judging what’s good, noticing what’s changed, and deciding what should exist next.

What will people do at work all day in the coming decades? The honest answer is: whatever hasn’t been figured out yet. As agents and the firm automate more of the work we already know how to do, people work with this new intelligence to build amazing new things and solve problems previously out of reach.

Subscribe now

This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.