ENSI research — built on a library of 115 primary documents and 52 company dossiers.

The argument, before the list

In 2024 a team at the University of Illinois gave a tool-using GPT-4 agent the public advisories for fifteen real, recently disclosed vulnerabilities. It exploited 87% of them, at an average cost of about $3.52 a run, against an estimated $25 of an expert’s time. Without the advisory text its success rate fell to 7% (Fang et al 2024). The danger sits in the gap between the moment a weakness is published and the moment it is fixed. Every advisory is now, in effect, a set of instructions a machine can follow. Zafran, an Israeli exposure-management company, counts about 130 new CVEs a day and says roughly one in three is weaponised on the day it is disclosed. Dream Security has analysed a four-day, fully autonomous AI-agent intrusion into Asian government agencies that ran up to eight sub-agents at once. Anthropic’s Mythos model has shown autonomous zero-day discovery and exploit chaining. Offence has started to automate. Defence organised as a procurement list cannot keep up with it.

The usual response is to buy the best tool in each category, then another console for whatever came out last quarter. That produces coverage without comprehension. Look at the fifty companies in this series by the job each one does in a working defence, rather than by the category it sells in, and they form something else: a parts list for a single machine. Three independent bodies of work describe that machine in almost the same terms: NATO’s reference architecture for autonomous cyber-defence agents, co-written with Masaryk University in Brno (Kott et al 2019), the BAE Systems survey of deep reinforcement learning for Dstl (Palmer et al 2024), and the finalists of DARPA’s AI Cyber Challenge (Zhang et al 2026). All three arrive at the same design: sensors feed a graph-based world model of the estate, planning agents choose actions, actuators isolate, patch and re-route, the system learns from outcomes, and a human supervisor owns judgement and accountability.

Israel’s fifty companies map onto that loop almost one to one. Armis, Axonius and Claroty see devices; Cyera and Varonis see data; CyberArk, Silverfort and Astrix see identities; Apiiro, Cycode and Legit see code. Wiz and XM Cyber turn it all into attack paths; Oligo, Upwind and Sweet show which risks are live; Pentera and Cymulate test the defences; Zafran mitigates. Check Point, Cato, Zero Networks, Island and Waterfall prevent by design. SentinelOne, Torq and 7AI respond; BioCatch and Forter read behaviour; KELA and Sygnia track the adversary; Zenity, Noma, Koi, Irregular and Alice secure AI. Behind them sit the labs at Ben-Gurion, Tel Aviv, Weizmann and the Technion, repeatedly first to name new classes of threat.

Nobody has assembled the machine. The best of these companies each built a graph over one slice of the estate: Wiz’s security graph of cloud resources, Armis’s device knowledge base, Astrix’s identity graph, Apiiro’s Software Graph, Cycode’s Context Intelligence Graph, XM Cyber’s digital twin, and the context graph Torq bought with Jit. Since late 2023 the platforms have tried to join the slices by acquisition: Google bought Wiz, Palo Alto Networks bought CyberArk and Koi, ServiceNow bought Armis, Cisco bought Astrix, and CrowdStrike agreed to buy XM Cyber’s patents and source code. Buying the companies gives a platform a bundle of products. It does not give it the loop. Shlomo Kramer, co-founder of Check Point, Imperva and Cato, put it plainly: “True convergence is not achieved by integrating products under a SASE umbrella.”

Four design laws run through the dossiers and the research, and they organise everything that follows:

1. Context beats coverage. XM Cyber’s analysis of more than 40 million exposures found fewer than 1% came from CVEs and only 2% sat on the “choke points” where attack paths converge. Zafran says 99% of “critical” vulnerabilities are not exploitable once you account for the controls already in place.

2. Architecture beats speed where it can. Zero Networks’ Benny Lakunishok: “You can’t outrun AI, but you need to out-architect it.” A one-way optical gateway or default-deny segmentation takes the race away rather than trying to win it.

3. Autonomy is only as good as its governance. An agent that isolates the wrong production server causes an outage. Machine-learning detectors can be evaded in ways that adversarial training “should have no effect” on (Shamir et al 2019). Humans have to own the rules of engagement.

4. The loop has to learn. It needs gyms in which to train defensive agents, research pipelines that name the next class of threat before it arrives, and national sharing so that one victim’s lesson protects the next organisation.

For us, a mid-sized European state (the Czech Republic is our default example), this is an opportunity rather than a shopping list. No state needs fifty companies. It needs to own the loop: the graph, the policies, the training gym, the sharing fabric and the human judgement. It can buy the parts on conditions, which matter because most of the best parts now belong to American platforms, and NÚKIB’s 2026 strategy already names the “shortage of secure and competitive domestic technological alternatives, which deepens dependence on the technologies of foreign rivals” (NÚKIB 2026). There is also a warning at the top of the Israeli system. Before 7 October 2023 an 8200 analyst warned that a Hamas exercise closely followed the eventual attack plan, and her superiors dismissed the analysis as “aspirational” (Wyss, CTC Sentinel 2024). The most advanced loop in the world still fails if the humans at the top of it do not listen.

Summary of main points

• The most advanced system is a control loop, not a product. See → understand → prevent → respond → learn, over one graph of assets, identities, data, code and AI agents. NATO’s AICA architecture, the BAE/Dstl survey and DARPA’s AIxCC finalists converge on this design.

• Israel’s fifty companies are the parts list. Each of the twenty-four features has an Israeli company or lab among its global leaders; no organisation has assembled all twenty-four.

• Offence automated first, and cheaply. An LLM agent exploited 87% of one-day vulnerabilities from advisory text at about $3.52 a run. The decisive metric is now hours from disclosure to mitigation.

• Context is the multiplier. Wiz’s “toxic combinations”, XM Cyber’s choke points, Oligo’s function-level reachability and Zafran’s exploitability-in-context each shrink the problem by one or two orders of magnitude.

• Prevention by architecture is back. Automated segmentation, enterprise browsers, AI-maintained allow-listing and one-way gateways remove whole attack classes.

• The AI era adds a layer. Agents are a new identity, a new supply chain and a new worm surface. Israeli research (Morris II) and companies (Zenity, Noma, Koi, Irregular, Alice) lead it, and platforms bought six AI-security start-ups in about eighteen months.

• The national layer is what a state adds. Sector SOCs and sharing (Israel’s “Cyber Dome”), coordinated disclosure, a gym for defensive agents, and protection specified against a named adversary (RAND’s SL1–SL5, co-written by Israel’s Pattern Labs).

• Governed autonomy is a feature in its own right. Before October 7, Israeli intelligence let automation replace pushed warnings. Rules of engagement, hand-off and a heard dissenter are part of the machine.

• For a Czech-scale state: build the loop, buy the parts, on sovereignty conditions. Most of the best parts now answer to American platforms; the twelve-month roadmap at the end sequences the work.

How the system is organised

The twenty-four features sit in six layers of four, in the order of the loop:

• Layer 1 · See everything — 1 live asset intelligence · 2 the data map · 3 the identity fabric · 4 code-to-runtime lineage

• Layer 2 · Understand risk — 5 the attack-path twin · 6 runtime truth · 7 continuous adversarial validation · 8 disclosure-to-mitigation within hours

• Layer 3 · Prevent by design — 9 the prevention-first converged edge · 10 lateral movement designed out · 11 the governed last mile · 12 crown jewels protected to a named adversary

• Layer 4 · Detect and respond at machine speed — 13 autonomous hybrid detection · 14 the agentic SOC · 15 behavioural trust · 16 adversary intelligence and elite response

• Layer 5 · Secure the AI era — 17 the agent registry · 18 agent runtime guardrails · 19 the AI supply-chain gate · 20 frontier-model evaluation

• Layer 6 · Learn and govern — 21 national collective defence · 22 the research-to-product pipeline · 23 the cyber gym · 24 governed autonomy

Each feature is a capability, not a product, with the same six-part brief: what it is · who proves it (Israeli companies and research, named) · the mechanism · the frontier (today versus 2028) · the agentic engine (which agents run it, what the human owns) · build or buy (for a mid-sized EU state or large enterprise). Company figures come from the dossiers and are often company-reported.

Layer 1 — See everything

Every serious failure in the dossiers begins with something nobody knew existed: an unmanaged device, a forgotten bucket, a service account from 2014, a coding agent a developer installed on a Friday. The first layer is the graph that the other twenty features read from.

1. Live asset intelligence across IT, OT, IoT and medical

• What it is. A live inventory of everything that connects (laptops, cloud workloads, SaaS, printers, PLCs, infusion pumps and now AI tools), each with its owner, its controls and its normal behaviour.

• Who proves it. Armis built an agentless inventory that tracks about 7 billion devices and sold to ServiceNow for $7.75B. Axonius correlates 1,400+ data sources across 45+ asset classes, flags gaps such as a laptop without EDR or a leaver’s live account, and serves 90+ US federal agencies. Claroty listens passively in industrial and medical protocols, with Siemens, Rockwell and Schneider as investors. Ben-Gurion’s N-BaIoT gave each IoT device its own learned model of normal and caught every test attack at a 0.007 false-positive rate (Meidan et al 2018).

• The mechanism. Read network traffic and the tools already deployed rather than installing anything new, then compare each device with a knowledge base drawn from every customer, a data network effect.

• The frontier. Today: inventory plus exposure ranking. By 2028: AI tools and agents as first-class assets (Axonius already ships a Claude adapter), and each device’s “predictability” used as a gate on whether it may connect at all (Meidan et al 2018). Unmanaged sensors are already a battlefield: Palestinian Islamic Jihad hacked road cameras for rocket targeting (Freilich, INSS 2024), and in June 2025 Iranian actors used weakly secured Israeli security cameras to adjust missile fire (Sharma, MP-IDSA 2025).

• The agentic engine. Discovery agents reconcile sources, chase owners and ticket the gaps. Humans decide which assets are crown jewels and sign off on devices that can never be managed.

• Build or buy. Buy: the capability is mature and platforms are absorbing it. Insist on neutrality and full data export, since Armis now belongs to one ITSM vendor. Build the sector-wide inventory of critical OT that no single operator holds.

2. The data map

• What it is. Knowing what sensitive data exists, where it lives, which people and machines (now including AI agents) can reach it, and who is actually touching it.

• Who proves it. Cyera classifies data by meaning (a contract, source code, a health record) rather than by pattern-matching, produces a usable map in days, and has moved from posture into DLP and, with the ~$1B Oasis purchase completed on 3 September 2026, into identity. It is valued at $12B. Varonis has twenty years of permissions metadata, maps permissions against actual use and removes excess access automatically. Its Agent Intent-Based Access Control (August 2026) governs what AI agents may touch.

• The mechanism. Classify by meaning, join the result to the identity graph, and fix automatically. The Varonis dossier puts it bluntly: remediation “is what CISOs pay for.”

• The frontier. Today: posture reports and DLP. By 2028: data and identity run as one “trust layer” deciding, request by request, what each agent may read. An AI assistant can surface anything its user is technically allowed to see, so every over-permission becomes a potential AI data leak. As Varonis’s management puts it, “AI and data security cannot be treated as separate problems.”

• The agentic engine. Classification agents label; remediation agents revoke stale access and quarantine exposed stores. Human data owners approve changes to business-critical sets, and the data-protection officer owns the legal basis.

• Build or buy. Buy the classifier. Build the national classification taxonomy and the handling rules that GDPR and public-sector law require. Price the risk: Cyera’s valuation is reported at about 80 times ARR, Varonis is in reported talks with Proofpoint, and Microsoft bundles Purview.

3. The identity fabric: humans, machines and agents

• What it is. Every identity (employee, service account, API key, OAuth grant, certificate, AI agent) is known, owned, least-privileged and granted access just in time, with policy enforced at authentication.

• Who proves it. CyberArk created privileged access management and extended least privilege from humans to machines (Venafi) to agents, and now forms Palo Alto’s ~$25B “Idira”. Silverfort sits inside the authentication stream of Active Directory, Entra and Okta, putting MFA in front of command-line admin tools, legacy applications, OT and service accounts. It claims more than 10 billion authentications analysed a day. Astrix named the “non-human identity” category and was bought by Cisco for about $400M. Transmit handles customer identity, fraud and passkeys on one platform.

• The mechanism. Silverfort’s founding insight is that attackers mostly don’t break in, they log in, so enforce where every lateral move has to pass. Machine identities already outnumber human ones by an order of magnitude. The 2023 compromise of a Microsoft cloud key reached 22 organisations, including US government agencies.

• The frontier. Today: discovery of non-human identities plus a vault. By 2028: runtime authorisation of each agent action. Silverfort bought Fabrix for exactly this, and CrowdStrike paid $627.9M for SGNL. Cisco says only about 24% of organisations can properly guardrail and monitor their agents.

• The agentic engine. Agents rotate and revoke stale tokens and propose least-privilege roles. Humans approve privileged access to crown-jewel systems and keep the break-glass keys.

• Build or buy. Buy, knowing this is security’s most fought-over category and Israel no longer has an independent anchor in it. Build the policy: how agents acting for citizens and officials are identified, delegated and held to account is a rule only the state can write.

4. Code-to-runtime software lineage

• What it is. A living map of repositories, pipelines, dependencies, secrets, APIs and deployments, linked to what runs in production and to whoever owns each fix, now including AI-written code and the agents that write it.

• Who proves it. Apiiro‘s Deep Code Analysis flags only “material” changes, such as a new API exposing personal data. Its Guardian Agent rewrites the prompts sent to coding agents so the output fits policy. Its own analysis finds AI coding agents quadruple code volume and expand the attack surface six-fold. Cycode owns its scanners plus a context graph; Legit maps the “software factory”. Checkmarx, in 60% of the Fortune 100, finds only 24–36% of frontier-model code is both secure and functional.

• The mechanism. Move from findings to context, then route each task to the cheapest engine that can do it properly. Cycode’s Lior Levy: “the answer isn’t a better model, but a system that decides which one runs where.”

• The frontier. Today: aggregated findings ranked by context (ASPM). By 2028: autonomous find, prove and patch. The AIxCC finalists paired proofs of vulnerability with patches at 92% accuracy (Zhang et al 2026), Checkmarx has joined Anthropic’s Project Glasswing, and Legit’s Roni Fuchs predicts vendors will compete on fixing vulnerabilities rather than finding them.

• The agentic engine. Threat-modelling, guardian, triage and patch agents work in sequence, and the patch agent proposes a fix only after proving the flaw. Humans own architecture and the merge into crown-jewel systems.

• Build or buy. Buy the scanners, which are commoditising. Build a national find-prove-patch capability for the open-source code critical infrastructure depends on. Czech code is already in that supply chain: CZ.NIC’s Knot resolver was patched after Tel Aviv University’s NXNSAttack disclosure (Afek, Bremler-Barr & Shafir 2020).

Layer 2 — Understand risk

Seeing everything produces millions of findings, and a list of millions of findings is not a defence. The second layer turns the graph into a handful of decisions and then acts on them within hours. This is where Israeli companies have done most to redefine the market, because the answer here is a change of method, not better scanning.

5. The attack-path digital twin

• What it is. A model of the estate that works out how an attacker could chain small weaknesses (a misconfiguration, a cached credential, an over-permissive role) into a route to a crown jewel, and ranks fixes by how many routes each cuts.

• Who proves it. Wiz builds an agentless graph of every workload, identity, network path, secret and data store: a vulnerable container matters only if it is internet-exposed, holds a privileged identity and can reach sensitive data. These “toxic combinations” made its name in Log4Shell, and Google paid $32B. XM Cyber, founded by a former Mossad director and two intelligence-technology chiefs, simulates attacker chains across Active Directory, cloud IAM, Kubernetes and OT without live exploitation. Its study of 40 million+ exposures found 80% came from misconfigurations and credentials, under 1% from CVEs, and only 2% sat on choke points.

• The mechanism. A graph data model makes path analysis cheap, whereas competitors built on relational tables produced “long, flat lists”. Defenders see alerts. Attackers see a graph of routes to a target.

• The frontier. Today: separate twins for cloud and on-premises. By 2028: one twin across cloud, identity, on-premises, OT and agents: the “world model” of NATO’s AICA architecture, in which planning agents simulate a response before executing it (Kott et al 2019; Palmer et al 2024).

• The agentic engine. Path agents re-run on every change; remediation planners group fixes into projects. Humans name the crown jewels and accept residual risk.

• Build or buy. Buy the engine, but weigh who owns it: Wiz belongs to Google, and XM Cyber’s European owner has sold its IP to CrowdStrike and licensed it back. Build the national twin of cross-sector dependencies, which no vendor models.

6. Runtime truth

• What it is. Evidence from inside running workloads about what actually executes, what talks to the internet and what touches data, so that risk is ranked by what is really happening rather than by which packages happen to be installed.

• Who proves it. Oligo‘s eBPF sensor sees which vulnerable function in which library is actually called, claims 90–99% noise reduction, and since April 2026 blocks the offending system call while the application keeps running; its researchers found ShadowRay in AI infrastructure. Upwind built “inside-out” cloud security (valued at about $3.8B, ARR undisclosed). Sweet Security was founded by the IDF’s former CISO after a fruitless six-month search for a real-time cloud detection tool for the army’s move to public cloud. Aqua has done container runtime security since 2015.

• The mechanism. Kernel-level telemetry plus a behavioural profile of each library. A library that suddenly spawns a shell is flagged even inside a legitimate process.

• The frontier. Today: prioritisation and cloud detection. By 2028: blocking by default, with runtime as the control point for AI agents too (Sweet’s Agentic AI Blocking, July 2026). The test is trust: in the Oligo dossier’s words, “how widely customers let the sensor run, and in blocking mode.”

• The agentic engine. Triage agents stitch process, identity, API call and bucket into one attack story. Humans decide, service by service, when monitoring becomes blocking.

• Build or buy. Buy. Budget for “sensor fatigue” and outage risk, and require that runtime evidence flows into the shared graph, as Oligo now does into Wiz’s.

7. Continuous adversarial validation

• What it is. Attacking yourself safely and continuously to prove which defences actually work. It replaces the annual penetration test, which covers a slice of the estate once a year.

• Who proves it. Pentera‘s founder ran a red team in the IDF’s IT branch and judged penetration testing “routine, repetitive and well-defined”. The product runs real exploits safely in production, cuts about 10,000 alerts to 6–8 root causes, sells with a one-day proof of value that ends at domain admin, and passed $100M ARR in 2025. Cymulate simulates attacks across email, web, endpoint, network and cloud for 1,000+ customers, then writes the missing detection rule for the customer’s own SIEM.

• The mechanism. Chain weaknesses as an attacker would, report root causes a board can read, and close the loop with a fix, not a finding.

• The frontier. Today: scripted campaigns. By 2028: LLM red-team agents. PentestGPT found models strong on sub-tasks but weak over long engagements, and the fix was architectural: separate planning, generation and parsing modules plus an explicit task tree (Deng et al 2024). The dispute is over safety: the AI-native US rival Horizon3.ai now outgrows Pentera, whose CEO argues production networks still need deterministic guardrails.

• The agentic engine. Red-team agents plan chains under a task tree, and purple-team agents write the detection that failed. Humans set the rules of engagement and the blast radius.

• Build or buy. Buy the platform. Build a national red team, with NÚKIB and the Czech Cyber and Information Warfare Command as natural hosts, that runs it across critical operators to a common standard.

8. Disclosure-to-mitigation within hours

• What it is. A closed loop from “an advisory is published” to “exploitation is blocked here”, which runs before the patch lands.

• Who proves it. Zafran asks of every finding whether the vulnerable code runs, is reachable, would be blocked by an existing control, and is being exploited, then retunes the EDR, firewall and WAF the customer already owns to cover the “exploitation window”; its Attack Chain Killswitch is built with Google Threat Intelligence. Cato says its automated CVE mitigation protects within 45 minutes. Oligo blocks exploit techniques rather than single CVEs, virtual patching for zero-days and known flaws alike. Radware added “AI Xploit Shield” for safe patching in June 2026.

• The mechanism. Mitigate first and patch second, and make controls the customer has already paid for stand in for the patch.

• The frontier. Today: days to weeks, a human approving each change. By 2028: hours, because disclosure now amounts to weaponisation (Fang et al 2024), and the AIxCC finalists already find, prove and patch in one loop (Zhang et al 2026). Treat every published advisory as instantly weaponisable.

• The agentic engine. Intake, exposure, mitigation and change agents run in sequence. Humans own change windows on crown jewels: an automated change that causes an outage gets blamed on the tool, and cautious customers “keep a human approving every change.”

• Build or buy. Buy the engine. Build the national piece: the CERT should publish machine-readable mitigations alongside every advisory so that operators’ agents can act on them within the hour.

Layer 3 — Prevent by design

Detection is a race. Prevention by design removes the race altogether. Israel has the longest record here of any country: the first commercial firewall came out of an 8200 veteran’s work on classified networks in 1993. The four features in this layer share one idea. They remove a whole class of attack rather than getting better at catching it.

9. The prevention-first converged edge

• What it is. One enforcement fabric for every user, site and cloud: firewall, web gateway, zero-trust access, DLP, DDoS and API protection, applied in a single pass under one policy and one data lake. By default it blocks rather than alerts.

• Who proves it. Check Point invented stateful inspection (FireWall-1, 1993), still competes on blocking rather than detecting, and shares its ThreatCloud feed across 100,000+ customers; its July 2026 AI Network Firewall inspects traffic to and from models and agents. Cato built networking and security as one stack on its own backbone of 70+ points of presence, with $415M+ ARR growing about 42%, three years as a Gartner SASE Leader, and a Prague R&D centre it is tripling. Radware mitigates carrier-grade DDoS on-premises and in the cloud, and reports web DDoS up more than 110% in the first half of 2026.

• The mechanism. Convergence: one policy model, one data lake, one upgrade path. Owning the network path also lets the edge replace the WAN budget, so it sells as a saving.

• The frontier. Today: SASE and hybrid-mesh firewalls. By 2028: the edge also inspects agent traffic (Check Point with Lakera, Cato with Aim Security) and pushes virtual patches across the whole fleet within the hour (feature 8).

• The agentic engine. Policy agents propose rule changes from the graph, and mitigation agents deploy them. Humans own policy intent and exceptions.

• Build or buy. Buy. This is the most mature Israeli layer, and one of the few with independent Israeli vendors left. Check vendor health, though: Check Point’s revenue grew just 1% in Q2 2026. Cato’s Prague centre is a local anchor worth cultivating.

10. Lateral movement designed out

• What it is. Every machine may talk only to what it needs, and administrative protocols stay closed until a person proves identity just in time. A stolen credential or a compromised laptop then cannot spread.

• Who proves it. Zero Networks observes traffic, writes least-privilege rules itself and enforces them without agents, at the network switch for OT devices that cannot run software. It puts MFA at the network layer so that RDP and SSH open only on proof of identity, and since August 2026 applies “least agency” to AI agents. Its 2026 benchmark found 80% of enterprise servers reachable from anywhere on the internal network. Customers report segmentation “in weeks, not years”, with net dollar retention above 120%. Silverfort‘s authentication firewall and CyberArk‘s just-in-time sessions close the identity side.

• The mechanism. Default-deny, generated from observed behaviour. Microsegmentation always worked; what killed it was deployment, which meant multi-year, consultant-heavy rollouts and rules nobody maintained. Automation removes that cost.

• The frontier. Today: on-premises Windows estates and OT. By 2028: segmentation of AI agents at process level, plus quarantine triggered automatically by detection. Ben-Gurion’s IoT work showed that sub-second detection could stop a launched attack “in less than a second” (Meidan et al 2018).

• The agentic engine. Learning agents propose rules from observed flows, and enforcement agents quarantine on signal. Humans approve crown-jewel flows and hold the break-glass keys.

• Build or buy. Buy. The vendor is small: a third-party estimate puts its 2025 ARR near $18M, unconfirmed by the company. Plan for it being acquired. For a regulator, segmentation of crown jewels is a control NIS2 supervision can ask to see evidence of.

11. The governed last mile: browser and endpoint

• What it is. Control where a person or an agent actually acts on data, in the browser tab and on the laptop: what may be copied, pasted, uploaded, installed or run.

• Who proves it. Island created the enterprise browser. Built on Chromium, it governs copy and paste, downloads, printing and screenshots, masks sensitive fields and runs contractor sessions without VDI or VPN, for eight of the world’s ten largest banks and about $200M of founder-stated revenue. Glow revives application allow-listing, which failed for a decade because humans could not keep the lists current: its agents map, score and allow, remove or block every application and AI tool on each endpoint. It claims AI-tool use on corporate devices rose from 15% to 45% in a year.

• The mechanism. The browser sees data after decryption, at the moment the user acts. Allow-listing always worked in principle, and agents remove the cost of upkeep that made it impractical.

• The frontier. Today: the enterprise browser plus last-mile DLP. By 2028: what Island calls “the control plane for your agentic enterprise”, a single place where both human and agent actions are governed, and default-deny software on every managed device.

• The agentic engine. Research agents score every new app and extension, and policy agents decide. Humans own the exception process. The old failure mode still applies: block a developer’s tool once too often and the product gets switched to monitor-only.

• Build or buy. Buy. It is a natural fit for public administrations that want to retire VDI for contractors. Check where the reasoning runs, though: Glow’s enforcement decisions use Anthropic and Gemini models accessed through Amazon Bedrock, which raises data-handling questions for regulated buyers.

12. Crown jewels protected to a named adversary

• What it is. For the few assets whose compromise would be a national event (grid control, nuclear, water, classified enclaves, AI model weights), security specified against which attacker must be stopped; where the answer is “a state”, the control is physical.

• Who proves it. Waterfall‘s optical unidirectional gateways let data physically flow only out of the plant, across more than 1,000 installations. By the company’s reading, gateway-protected sites are exempt from more than 35% of NERC CIP requirements, and France’s ANSSI requires hardware-enforced one-way flow for its most critical systems. RAND and Pattern Labs (now Irregular) defined security levels SL1–SL5 against about 38 attack vectors; SL5 targets the most capable nation-states and, the authors judge, is beyond most organisations today (Nevo et al 2024).

• The mechanism. The stakes are physical. In April 2020 IRGC-linked attackers took control of six Israeli water and sewage stations and could have raised chlorine to potentially lethal levels; the INCD’s head called it “a turning point in the history of modern cyber warfare” (Freilich, INSS 2024). So the first design question is “which actor must this asset withstand?”, and where consequences are physical, deterministic controls (”there is no inbound path”) win. Isolation alone fails: more than 17 malicious frameworks have targeted air-gapped networks (Guri 2024), and acoustic leakage defeats Faraday cages (Genkin, Shamir & Tromer 2013).

• The frontier. Today: diodes for OT monitoring. By 2028: hardware-enforced remote access (Waterfall’s HERA), signed firmware (Ronen et al 2017) and mutual authentication between engineering stations and PLCs. Technion and TAU researchers showed a rogue station could run injected logic while the PLC displayed the original code, because the engineering station was not authenticated to the PLC and every PLC of a model shared one key pair (Biham et al 2019).

• The agentic engine. Deliberately little autonomy inside the enclave: agents watch the one-way feed; humans own every inbound change.

• Build or buy. Buy the hardware; European diode makers compete on local certification. Build the national register of crown jewels, with each asset assigned an adversary tier and audited against it.

Layer 4 — Detect and respond at machine speed

Prevention fails some of the time, and when it does the loop has to notice, decide and act faster than an adversary whose tempo is now set by software. The fourth layer is where autonomy earns its keep, and also where it can do the most damage.

13. Autonomous hybrid detection on every endpoint and segment

• What it is. Detection that runs where the attack happens, on the device or the network segment, before or as code executes. It combines a learned model of normal behaviour with behavioural models and signatures, and it can contain and roll back without waiting for the cloud or a human.

• Who proves it. SentinelOne detects and rolls back ransomware on the device with no cloud round-trip, running one agent on its own data lake at $1.218B ARR. Cynet bundles one agent with 24/7 MDR for firms without a SOC and claims 90% of threats are remediated without human action. In research, Ben-Gurion’s Kitsune learns “normal” traffic without labels on a Raspberry Pi (Mirsky et al 2018), and Bar-Ilan’s DeepSign reached 98.6% accuracy on unseen malware variants in 2015 (David & Netanyahu 2015).

• The mechanism. Use both paradigms. Kitsune’s authors recommend running learned detection alongside a signature engine, because signatures cannot see what is new and learned models cannot be trusted on their own.

• The frontier. Today: EDR and XDR. By 2028: a learned detector on every segment, wired to automatic isolation. The limit is structural: adversarial examples follow from the geometry, and adversarial training “should have no effect” on them (Shamir et al 2019). ML detection is never the only layer. Deep Instinct’s deep-learning lead lasted about five years.

• The agentic engine. On-device agents act within bounded rules. NATO’s reference architecture confines destructive actions to the host the agent sits on (Kott et al 2019). Humans set the rollback and quarantine policy.

• Build or buy. Buy: endpoint security is a winner-takes-most market. For small firms, fund NIS2 programmes delivered through managed service providers, the channel Cynet, Coro and Guardz were built for.

14. The agentic SOC, humans on the loop

• What it is. AI agents do the tier-1 work (enrichment, triage, investigation, correlation and first response) across the tools the organisation already runs, and hand analysts a case that is already assembled. Humans supervise from “on the loop” rather than approving every step.

• Who proves it. Torq claims more than 95% of tier-1 tasks automated and 100 million automations a day, and says it replaces the SOAR or case-management layer in about 70% of deployments; the Jit context graph it bought lets agents judge alerts by business impact. Check Point’s CISO says it handles many internal alerts with no human involvement. 7AI, from Cybereason’s founders, reports 9 million+ investigations and a million+ analyst hours returned; its customer DXC cut tier-1 analyst time by 80%.

• The mechanism. The plumbing comes before the intelligence. Torq had an execution engine and integrations when LLMs arrived. The research agrees: orchestrated specialist agents with explicit external state beat one general agent (Deng et al 2024; Zhang et al 2026).

• The frontier. Today: autonomous triage. By 2028: federated data with no central SIEM (7AI’s “Federated SIEM”) and multi-agent response built on AICA’s five functions of sensing, planning, acting, collaborating and learning (Kott et al 2019). Hunters is the warning: right about the data-lake SIEM, it lost to the vendors that own endpoint telemetry.

• The agentic engine. Triage, investigation, containment and reporting agents do the work. A human incident commander approves destructive actions, and detection engineers curate the agents’ skills.

• Build or buy. Buy the agents but own the data layer, normalised to an open schema such as OCSF, so the agents can be swapped. 7AI reads telemetry from the same vendors that are building rival agents.

15. Behavioural trust at the human layer

• What it is. Judging whether the person (or agent) behind a session is who they appear to be, and whether they are acting of their own will, from how they behave rather than what they know.

• Who proves it. BioCatch reads typing cadence, swipes, phone angle and hesitation (3,000+ signals, a verdict in under 500ms) across 19 billion sessions a month at 350+ banks, catching scams where password, device and customer are all genuine. Its Australian BioCatch Trust network scores receiving accounts across banks without sharing personal data, and Visa is paying $2.4B for the company. Forter runs a cross-merchant identity graph, answers in about a second, pays the chargeback when wrong and treats AI shopping agents as a new identity class. Transmit joins identity, fraud and verification in one flow.

• The mechanism. Own a signal nobody else collects, pool it across institutions, and sell to the budget that feels the loss. Impersonation, including real-time deepfakes, is the offensive-AI threat that industry and academia jointly rank highest (Mirsky et al 2021).

• The frontier. Today: bank and e-commerce fraud. By 2028: sessions run by agents, where the keystroke signal vanishes. Transmit warns that agents are “blinding” fraud detection; the new problem is telling a legitimate delegated agent from a malicious one.

• The agentic engine. Scoring models run in-line and investigator agents map mule networks. Humans own customer-harm decisions and redress.

• Build or buy. Buy the engines. Build the national layer: an inter-bank behavioural-sharing consortium convened by the central bank and police, on the BioCatch Trust model, whoever the vendor is.

16. Adversary intelligence and elite response on call

• What it is. Knowing who is selling access to your network, which of your credentials have leaked and which exploits are being traded for your software, and having operators who have fought state-grade intrusions ready to take over when the loop fails.

• Who proves it. KELA has watched closed forums, markets, Telegram and infostealer logs for more than fifteen years, with analysts inside; by its own count it has indexed 34.1 billion compromised credentials in 2026 alone. Its research on TeamPCP, the group behind the Trivy and Checkmarx compromises, went to Australian police and the FBI, and two men were charged in August 2026. Sygnia, from the Team8 foundry, led the investigation of the $1.5B Bybit theft attributed to Lazarus and exposed “Velvet Ant”, a China-nexus group that hid in a Linux login system for almost a decade.

• The mechanism. Intelligence matched to the customer’s own exposure rather than raw feeds, and crisis trust converted into retainers, readiness work and MDR.

• The frontier. Today: alerts and retainers. By 2028: intelligence flows straight into the graph, so a leaked credential is revoked and a traded exploit triggers mitigation (feature 8). War sets the bar: in June 2025 SecurityScorecard analysed 250,000 Telegram messages from 178 groups, and wartime defence needs real-time chatter monitoring. Deception belongs here too: in 2015–16 Iranian hackers who “believed that they had succeeded” against Israel’s grid had hit honeypots (Freilich, INSS 2024).

• The agentic engine. Collection and triage agents (KELA’s “Digital Cyber Analysts”) do the volume work. Humans own attribution, liaison with law enforcement and crisis command.

• Build or buy. Buy the commercial intelligence. Build a national incident-response reserve. Note Singapore’s route: Temasek bought Sygnia outright, and the dossier’s verdict is that the buyer’s route is faster.

Layer 5 — Secure the AI era

AI agents are at once a new class of identity, a new software supply chain and a new worm surface. This is the layer where Israeli research has most clearly named the threat first, and where the platforms moved fastest to buy the answer: in about eighteen months Palo Alto bought Protect AI, SentinelOne bought Prompt Security, Check Point bought Lakera, Cato bought Aim, CrowdStrike bought Pangea and F5 bought CalypsoAI.

17. The agent registry and governance

• What it is. A registry of every AI agent the organisation runs, whether homegrown, embedded in SaaS or running on a developer’s laptop. Each entry records the agent’s owner, tools, data, identities, MCP connections and approval status, and policy is applied before the agent is deployed.

• Who proves it. Zenity began by governing low-code tools, finding large enterprises averaging nearly 80,000 low-code apps and agents, over 60% of them vulnerable. It now covers Copilot, ChatGPT Enterprise, Gemini, Claude, Cursor and Bedrock, and Gartner has called it “the company to beat” in agent governance. Noma typically finds 10 to 100 times more agents than teams expect, and marks every agent and MCP server Approved, Requires Review or Blocked, with tool-level permissions. Astrix (now Cisco’s), Varonis and Cyera come at the problem from identity and data.

• The mechanism. Treat every agent as both a software asset and a non-human identity, and run it through inventory, then posture, then policy.

• The frontier. Today: discovery. By 2028: the agent registry is as basic as the asset inventory. The open question is who owns it. Identity vendors argue agents are non-human identities, while AI-security vendors argue they need runtime control. Cisco says only about 24% of organisations can currently put proper guardrails and live monitoring on agents.

• The agentic engine. Discovery and posture agents keep the register current. A named human business owner approves each agent’s scope and answers for it.

• Build or buy. Buy the tooling. Build the rule: every agent acting for a public body sits in a register with a named, accountable human owner.

18. Agent runtime control and agent-to-agent guardrails

• What it is. Controls that follow what an agent actually does, step by step: its tool calls, memory access, control flow and messages to other agents. They allow, modify or block actions before they execute, and stop a malicious instruction spreading from one agent to the next.

• Who proves it. The Technion’s Morris II showed prompt-injection “worms” spreading between AI email assistants and exfiltrating data hop by hop, and shipped the defence with the attack: a guardrail with a true-positive rate of 1.0 and a false-positive rate of 0.015 (Cohen, Bitton & Nassi 2024). Zenity inspects each agent step and blocks inline; Sweet ends unauthorised tool calls; Check Point (with Lakera) and Alice guard models at runtime; Salt watches the APIs and MCP servers agents act through. Irregular has documented agents cooperating to steal data and switching off security tools in red-team runs.

• The mechanism. Deterministic action control wrapped around non-deterministic models. The Israeli research habit is to publish the attack and the countermeasure together.

• The frontier. Today: prompt filtering and tool-call blocking. By 2028: agent-to-agent traffic treated like network traffic, segmented, inspected and rate-limited. The hard part is unsolved, as the Zenity dossier admits: deterministic control over non-deterministic agents without blocking legitimate work.

• The agentic engine. Guardrail models watch the working agents. Humans decide which actions always need approval. Legit’s VibeGuard, for example, asks a person before an agent deletes code or touches production.

• Build or buy. Buy. Build the requirement into public procurement of AI agents, and fund academic work on containing agent worms.

19. The AI and software supply-chain gate

• What it is. A gate on everything that is installed or pulled in, from packages, extensions and containers to models, MCP servers and agent “skills”, together with hardened release pipelines for the security tools themselves.

• Who proves it. Koi began with a fake VS Code theme, built in about thirty minutes, that reached 300+ organisations in a week. Its Wings engine detonates every component and update in a sandbox, and its disclosures included ShadyPanda (145 browser extensions, 4.3 million installs) and ClawHavoc (341 malicious agent skills); Palo Alto bought it about twenty months after it was founded. Zenity has disclosed a malicious-skills campaign with 1.7 million installs. Snyk bought Invariant Labs, which named “tool poisoning” and “MCP rug pulls”, and Legit keeps secrets out of agent memory by injecting them through MCP.

• The mechanism. Inventory, sandboxed analysis and approval at install time, plus immutable, pinned and signed releases (Ronen et al 2017).

• The frontier. The warning came in March 2026. After a non-atomic credential rotation, attackers force-pushed 76 of 77 trivy-action tags of Aqua’s Trivy to credential-stealing malware, then reused stolen credentials to poison two Checkmarx GitHub Actions. Security vendors are supply-chain targets too. By 2028: an AI bill of materials (Cycode’s AI-BOM) and signed agent skills become standard.

• The agentic engine. Analysis agents detonate and score components, and humans approve anything with high privilege. Check the analysts as well as the code: a company has sued Palo Alto and Koi over a threat report allegedly built on unverified AI output.

• Build or buy. Buy the gate. Build a funded programme of secure release engineering for widely used open-source projects, which the Aqua dossier calls “cheap brand protection.”

20. Frontier-model evaluation and red-teaming

• What it is. Measuring what a model can do offensively before it ships, red-teaming it against real adversarial content, monitoring drift after deployment, and protecting its weights to a defined security level.

• Who proves it. Irregular (formerly Pattern Labs), about 25 people, sits inside the pre-release evaluation loop of OpenAI, Anthropic and Google DeepMind. Its work is cited in the evaluations of Claude 3.7 Sonnet and OpenAI’s o3 and o4-mini, and it co-wrote RAND’s SL1–SL5 (Nevo et al 2024). Alice (formerly ActiveFence) sells red-teaming, runtime guardrails and drift detection built on years of labelled real-world abuse data, works with 8 of the 10 leading AI labs, and reports ARR approaching $100M.

• The mechanism. Test environments that compound with every engagement (Anthropic judged Irregular’s “more diverse” than it could build internally), scarce adversarial data, and MLSecOps, meaning security testing and monitoring built into the machine-learning lifecycle (Mirsky et al 2021).

• The frontier. The failure is instructive. In July 2026 Anthropic disclosed that a misconfigured environment run with Irregular had given test machines live internet access: of 141,006 runs reviewed, six across three incidents reached real organisations’ production systems, and OpenAI reported a similar lapse. A range for testing offensive AI is itself critical infrastructure. By 2028: states and large firms evaluate every model and agent they deploy, as EU AI Act testing duties bite.

• The agentic engine. Attacker agents run inside contained ranges. Humans own containment, and in particular the egress rules.

• Build or buy. Buy access to evaluators. Build national evaluation capacity inside the cyber gym (feature 23), with containment audited like any other critical system.

Layer 6 — Learn and govern

The first five layers can all be bought. The sixth is where a state adds what no vendor can supply: shared memory across organisations, a pipeline for new knowledge, a place to train and certify defensive agents, and rules that keep autonomy accountable. It is also the layer where a mid-sized European country has the most room to lead.

21. National collective defence: sector SOCs, a national SOC and a “Cyber Dome”

• What it is. The layer no organisation can build alone: sector SOCs feeding a national SOC, real-time CISO exchange, and warnings and mitigations pushed to the whole market, so one victim’s lesson protects everyone.

• Who proves it. Israel’s National Cyber Directorate (INCD) runs defence in three layers (market resilience, operational response, national defence), aiming for “the defense operational cycle to outpace that of the adversary” and “immunization from similar attacks throughout the market”, with CyberNet linking CISOs in real time (INCD 2021). The 2025 strategy adds a “Cyber Dome”, an idea first sketched by Raska (RSIS 2014), whose systems “will fuse and correlate various types of data, incorporating AI to create a holistic snapshot of all imminent attacks and threats to the economy”, plus a national SOC fed by sectoral SOCs (INCD 2025).

• The mechanism. Federation plus trust by design. Sector SOCs keep context and a national SOC sees the whole, and responsibility shifts from operator to state as the threat level rises (Frei, ETH CSS 2020). Israel moved critical-infrastructure protection out of the Shin Bet and deliberately gave the civilian authority no law-enforcement powers, “to prevent any ongoing suspicion of NSA-like practices”; its head likened the service to a public water system: “When we will find contamination, we will not suspect who contaminated it” (Tabansky 2020).

• The frontier. Today: hotlines and alerts. By 2028: machine-readable sharing at machine speed, against targets now written into the 2025 strategy: “zero significant damage to critical infrastructure” and a stated position against paying ransoms (Shabtai, BESA 2025). The plumbing is the obstacle: 53% of ICS-specific observables lack adequate representation in the STIX standard and 77% of extracted artefacts lack operational detail (Hahn et al 2026).

• The agentic engine. Fusion agents correlate the sector feeds and early-warning agents draft alerts. Humans own intervention, legal limits and attribution.

• Build or buy. Build: this is the sovereign core, and for us it belongs with NÚKIB and the sector CSIRTs. Buy components such as KELA’s national suite, but be wary of “sovereign stacks” sold whole, like that of Dream Security, founded by NSO’s former CEO. Its own dossier’s verdict: “Sovereignty rented from a foreign vendor is still dependency.”

22. The research-to-product and disclosure pipeline

• What it is. An institutional pipeline that turns academic attack research into coordinated disclosure, global patches, standards and start-ups, so the loop learns about a new class of threat before adversaries use it.

• Who proves it. Ben-Gurion showed that a botnet of 1,355 hijacked smart-irrigation systems could empty a water tower in an hour (Nassi et al 2018). Tel Aviv University’s NXNSAttack fix was adopted by BIND, Unbound, PowerDNS, CZ.NIC’s Knot, Google, Cloudflare, Amazon and Microsoft (Afek, Bremler-Barr & Shafir 2020), and its Siemens S7 model flagged single anomalous bits while passing over 99.82% of production traffic as normal (Kleinmann & Wool 2014). Weizmann and the Technion add IoT chain reactions and Morris II, and the INCD counts seven academic cyber centres and 500+ papers (INCD 2021). Company labs (Team82, Oligo, Zenity Labs, Koi) carry the habit into the market, and Team8’s foundry turned theses into Claroty and Sygnia.

• The mechanism. Publish the attack and the countermeasure together, ship a fix that can actually be deployed (MaxFetch ran in BIND with no loss of throughput), and fund labs through several channels: state centres, industry institutes and philanthropy.

• The frontier. Today: human researchers. By 2028: autonomous vulnerability research (AIxCC; Checkmarx in Project Glasswing) multiplies the volume of findings, and coordinated disclosure has to run at machine speed as well.

• The agentic engine. Research agents fuzz and reason over nationally critical code, and disclosure agents coordinate with maintainers. Humans own dual-use judgement and timing.

• Build or buy. Build. Brno’s Masaryk University already co-authored NATO’s reference architecture for autonomous defence (Kott et al 2019). Pair a funded disclosure programme with a foundry wired to critical-infrastructure buyers.

23. The cyber gym

• What it is. A national range that doubles as a training gym and certification ground for defensive AI agents. It uses simulation for speed and emulation for truth, and runs public challenges with real budgets.

• Who proves it. Mostly not Israel, which is the point. Australia’s CybORG trains agents in simulation and validates them in emulation: all 21 agents succeeded in simulation, but only 139 of 210 emulation runs did, and four agents never transferred (Standen et al 2021). The Five Eyes run the annual CAGE challenges, and DARPA’s AIxCC final ran seven autonomous systems for about 143 hours on 53 projects derived from critical-infrastructure software, each with $85K of compute and $50K of LLM credits (Zhang et al 2026). The library holds no public Israeli equivalent; the closest are commercial (Irregular’s environments, Pentera Labs).

• The mechanism. The gap between simulation and reality is the core risk, and exploitability, not average reward, is the metric. CAGE entries scored against fixed red agents reward overfitting, and agents that beat scripted attackers can be brittle against adaptive ones (Palmer et al 2024).

• The frontier. Today: research gyms. By 2028: certification. No defensive agent gets autonomy on a critical network without passing the gym, and the same range hosts AI-model evaluation (feature 20), with containment audited after Irregular’s egress failures.

• The agentic engine. Red agents fight blue agents while evaluator agents score them. Humans design the scenarios and set certification thresholds.

• Build or buy. Build: this is where a mid-sized EU state can lead rather than follow. A Czech-hosted, EU-open challenge with real compute budgets would fill a gap Israel has left open.

24. Governed autonomy

• What it is. Explicit rules for what each agent may do without asking, when it must hand off to a human, how the defenders’ own models are attacked and tested, and how every action is logged and reversed.

• Who proves it. NATO’s architecture bounds destructive actions by rules of engagement, confines them to the host and keeps a human override open (Kott et al 2019); INSS recommends deciding, system by system, which functions keep human supervision (Antebi, INSS 2021). The sharpest evidence is Israel’s own. Before October 7 the intelligence community’s “love affair” with cyber intelligence and AI brought automated processing “with little or no human intervention”, an “intelligence pool” that analysts pulled from instead of warnings pushed to them, and the 2021 dismantling of 8200’s OSINT unit on the strength of machine translation (Bar, NIPP 2024).

• The mechanism. Tiered autonomy. Reversible actions are taken first and reported afterwards. Destructive actions, and any action touching a crown jewel, need a human first. Offensive or cross-border action is never autonomous and stays an all-of-government decision under law (INCD 2021).

• The frontier. Today: ad hoc approvals. By 2028: autonomy levels certified in the gym, MLSecOps for the defenders’ own models, which can be poisoned and evaded (Mirsky et al 2018; Shamir et al 2019), and audit trails a regulator can read.

• The agentic engine. Oversight agents watch the working agents, and a named human owns every autonomy grant. Warnings are pushed, never left in a pool, and dissent has a protected channel. The 2025 strategy now writes in countermeasures against the biases that underrate strategic surprise (Shabtai, BESA 2025); the October 7 lesson is that a system must hear the analyst who is right (Wyss, CTC Sentinel 2024).

• Build or buy. Build. This is policy, not product, and it is the feature that decides whether the other twenty-three can be trusted.

How the twenty-four compose into one machine

One graph. The most important design decision is that all twenty-four features read and write one world model. Its nodes are assets, identities (human, machine, agent), data stores, code, runtime processes and adversaries; its edges record what can reach, access, run on, call, own and exploit what. The seven graphs named at the start of this report, from Wiz’s to the one inside Torq, are each a partial version of the “world model” in NATO’s reference architecture (Kott et al 2019). The machine needs one graph, in an open schema, owned by the defender, not seven owned by seven vendors. Hunters’ use of the OCSF schema points the way; the gaps Hahn et al (2026) found in STIX for industrial systems show how far there is to go.

One loop. Layer 1 writes the graph. Layer 2 annotates it with attack paths, reachability, validation results and mitigations. Layer 3 compiles those into enforcement: segmentation rules, browser and allow-list policy, edge virtual patches, diodes. Layer 4 watches for deviations and acts; Layer 5 applies all of it to agents; Layer 6 brings warnings and research in, sends lessons out, certifies agents and sets their autonomy.

An illustration, not a case study:

1. 09:00 · An advisory is published. An intake agent parses it, and the graph shows 14 instances in the estate.

2. 09:10 · Runtime evidence (Oligo-type) shows the vulnerable function executes on three of them. Path analysis (Wiz- or XM-type) shows one sits on a choke point to the billing database.

3. 09:25 · A mitigation agent drafts a virtual patch at the edge and a tightened segmentation rule (Zafran-, Cato- and Zero Networks-type). A human approves it, because the billing database is a crown jewel.

4. 09:40 · Validation (Pentera- or Cymulate-type) confirms the path is closed, and a patch agent opens a pull request with proof of the vulnerability attached.

5. 10:30 · The national CERT publishes the mitigation in machine-readable form. Threat intelligence (KELA-type) later flags an exploit for sale, and every subscriber’s agents check themselves against it.

Where real deployments break. The dossiers are candid about the failure points:

• Integration seams. Axonius, Zafran and 7AI all depend on APIs that competing platforms can restrict or price. A loop joined only by third-party APIs lasts only as long as those vendors allow.

• Alert noise. Without the Layer 2 joins the loop drowns, which is why the best products are measured by what they remove: Pentera cuts about 10,000 alerts to 6–8 root causes; Oligo claims 90–99% noise reduction, Torq about 70%.

• Platform lock-in. Bundles are not loops. Armis lost its neutrality inside ServiceNow, Wiz’s neutrality inside Google is an open question, and XM Cyber’s owner now licenses its own technology from CrowdStrike. Hunters shows the flip side: a correct architecture loses to whoever owns the telemetry.

• Blocking fear. Sensors and allow-lists go to monitor-only after one bad block; autonomy is revoked after one outage.

• The defenders’ own supply chain. Trivy and Checkmarx fell to the same campaign in March 2026; every privileged tool in the loop is a target.

• The humans. A loop whose warnings sit in a data pool rather than being pushed to someone who must act fails, however good its sensors (Bar, NIPP 2024).

Operating model and metrics

Twelve indicators show whether the loop is actually closing:

1. Coverage of the graph · the share of assets, identities (human, machine, agent) and sensitive data stores with a named owner and the required controls; the unit is the gap Axonius flags, such as a laptop without EDR.

2. Agent visibility · agents in the register as a share of agents discovered. Noma typically finds 10 to 100 times more than teams expected.

3. Exploitable exposure on crown-jewel paths · the count of open choke points, not total findings. XM Cyber found only 2% of exposures sit on choke points.

4. Time from disclosure to mitigation · median hours from advisory to blocked exploitation on reachable instances: the headline number, because machines exploit from the advisory text (Fang et al 2024).

5. Validated control efficacy · the share of simulated attack techniques blocked or detected, re-run continuously (Pentera, Cymulate).

6. Lateral reachability · the share of servers reachable from anywhere on the internal network. Zero Networks’ benchmark found 80%, and the target is near zero around crown jewels.

7. Crown jewels at tier · the share of registered crown jewels meeting their assigned SL level (Nevo et al 2024).

8. Autonomous closure with audited error · alerts closed without a human, always reported beside the rate of wrong actions.

9. Analyst hours returned · the measure 7AI publishes, which boards understand.

10. Fraud and scam loss per million sessions · the budget that feels the loss (BioCatch, Forter).

11. Sharing latency · the time from the first victim’s report to mitigation across the market, which is the INCD’s “immunization” put into numbers.

12. Recovery order and time · how fast the functions that matter return. When ransomware locked every system at Hillel Yaffe hospital in October 2021, occupancy fell from 83% to 64%; national experts had a new network built and systems restored in clinical-priority order, and restoring records and the laboratory module was associated with a 30% rebound, imaging archives with 50% (Abbou et al 2024). Rank recovery by function and rehearse the paper-based blackout.

The human roles that remain are the ones that carry judgement:

• the loop owner · one accountable executive, or for the state NÚKIB

• crown-jewel owners · who set adversary tiers and accept residual risk

• detection and agent engineers · who curate agent skills and review wrong actions

• the red-team lead · who sets rules of engagement for offensive validation

• the intelligence analyst and law-enforcement liaison · who own attribution

• the incident commander · who approves destructive actions in a crisis

• the AI-governance officer · who owns the agent register and autonomy grants

• plant engineers · who own every inbound change to OT

• the protected dissenter · the analyst whose warning the system is obliged to escalate

Building it: a twelve-month roadmap

The sequence fits a Czech-scale national programme, led by NÚKIB with sector regulators and operators of essential services, or a large enterprise with a board-level loop owner. It follows the loop’s own order, but governance starts on day one, not in month twelve.

Months 0–3 · Name and see

1. Appoint the loop owner and publish an autonomy charter: which actions agents may take alone, which need approval and which are never autonomous (feature 24).

2. Build the crown-jewel register and assign each asset an adversary tier on the SL1–SL5 model (feature 12).

3. Stand up the graph with bought asset, identity and data-map tools (features 1–3), exporting everything into a schema the state owns.

4. Open the agent register for public bodies (feature 17) and baseline the twelve metrics.

Months 3–6 · Understand and close doors
5. Deploy the attack-path twin and continuous validation on crown jewels (features 5 and 7).
6. Segment crown jewels and put authentication-layer MFA on legacy and admin paths (feature 10). Put one-way gateways on the highest-consequence OT sites in energy and water (feature 12).
7. Build the disclosure-to-mitigation pipeline, with the national CERT publishing machine-readable mitigations alongside advisories (feature 8).

Months 6–9 · Respond at machine speed
8. Pilot an agentic SOC on a federated, open-schema data layer in two sectors, feeding a national SOC. Launch a CyberNet-style trusted CISO exchange (features 14 and 21).
9. Convene the banks, the central bank and the police into a behavioural fraud-sharing consortium (feature 15). Contract incident-response retainers and form a national responder reserve (feature 16).
10. Put a supply-chain gate on developer and administrator endpoints in government, and make runtime guardrails a condition of buying AI agents (features 18 and 19).

Months 9–12 · Learn
11. Open the national cyber gym and an EU-open challenge with real compute budgets, with Masaryk University and the Czech technical universities as founding partners, and house AI-model evaluation in the same range (features 20 and 23).
12. Launch a research-to-product foundry with ten critical-infrastructure design partners and a funded coordinated-disclosure programme (feature 22).
13. Review the metrics and decide which agents move up an autonomy tier and which move down.

What to buy, and what to build. Buy what is mature and commoditising: the tools behind features 1–7, 9–11 and 13–19, and the diodes for feature 12. Build what makes it a loop and makes it ours: the graph and its schema, the crown-jewel register, the national twin, the CERT mitigation feed, the national SOC and sharing fabric, the fraud consortium, the national red team, the gym, the research pipeline and the autonomy charter.

Buy on conditions drawn from the Dream Security and Cellebrite dossiers: source-code access or escrow, local hosting and staff, data export in open schemas, clean exit clauses and, for dual-use tools, published end-use vetting.

The dependency risks, named.

• Ownership has moved west. Wiz belongs to Google; CyberArk and Koi to Palo Alto Networks; Armis to ServiceNow; Astrix to Cisco; XM Cyber’s IP is going to CrowdStrike and BioCatch to Visa. The only European buyers in the dossiers are Thales (Imperva) and Schwarz, which sold XM Cyber’s IP on and licensed it back.

• Independence is thinning. Check Point, Cato, Radware, Claroty, Axonius, Island and Cyera remain independent, several are obvious targets, and Varonis is in reported talks with Proofpoint.

• Country exposure. Principal R&D sits in Israel. Radware’s annual report warns that the shekel will “materially increase” its costs, and Guardz’s CTO ran a funding round while deployed as a reservist.

• Model dependence. AI-native products such as Glow reason on American frontier models.

• Reputational tail. Dream Security’s NSO lineage and Cellebrite’s uneven vetting (Serbian customers suspended, similar evidence from Jordan and Kenya dismissed) show how a vendor’s export governance becomes its customers’ problem.

The mitigation is the same in every case: own the graph, own the policies, keep the exit open.

Close: build the loop, buy the parts

The question behind this report was what the most advanced cybersecurity system in the world would look like if Israel’s best companies and research were combined. The answer is less a list of twenty-four products than one machine with twenty-four organs: a live graph of everything owned, context that reduces millions of findings to a handful of choke points, architecture that removes attack classes outright, agents that respond in minutes, a new layer for AI agents, and a national layer that learns, shares and holds autonomy to account.

Israel has built almost every organ, and its own strategy describes the whole in almost exactly those terms: a “Cyber Dome” that fuses data with AI into “a holistic snapshot of all imminent attacks” (INCD 2025). But the Cyber Dome is still in its preliminary operating stage, and in 2025–26 Israel sold many of the organs to American platforms, which are assembling bundles, not loops.

That leaves room for a mid-sized European state. The Czech Republic does not need an 8200 or fifty unicorns. It needs to own four things no vendor can sell it: the graph, the policies, the gym and the judgement. It can buy the rest on hard conditions from the best builders in the world, one of which, Cato, is already tripling its engineering centre in Prague. The pressure comes from offence, which already runs at a few dollars an attempt, before the patch is written. The first move is the least glamorous one: name the crown jewels, map them into one graph, and write down what the machines may do without asking. The rest of the roadmap follows from those three steps.

ENSI research — built on a library of 115 primary documents and 52 company dossiers.

The argument, before the list

Between 11 February and the end of April 2026, the three largest acquisitions of Israeli companies ever made all closed. Palo Alto Networks completed its ~$25B purchase of CyberArk on 11 February. Google closed its $32B all-cash purchase of Wiz on 11 March. ServiceNow completed its $7.75B cash purchase of Armis in April. In August, Visa agreed to pay $2.4B for BioCatch. In June a five-year-old data-security company, Cyera, was valued at $12B — and then spent about $1B buying another Israeli start-up, Oasis. Palo Alto also bought Koi, twenty months after it was founded; Cisco bought Astrix; CrowdStrike agreed to buy the patents and source code of XM Cyber. It is hard to name another country of ten million people that has had a year like it.

The standard explanation is the start-up count: thousands of tech firms, a famous intelligence unit, a culture of improvisation. That explanation gets the causality backwards. The start-ups are the output, not the cause. What Israel has built over three decades is a system with four moving parts, and each is visible in the dossiers behind this report:

1. A selection-and-training engine. Unit 8200 screens eighteen-year-olds on raw potential — “the top 1 percent of the 1 percent of the country”, in one alumna’s phrase (Rousseau 2017) — and its technology arm Unit 81, the Talpiot programme and the less-celebrated Mamram and Matzov units produce engineers who have worked at state scale before they are 25. INSS calls the result “double-feeding”: the same people circulate between army, industry and academia through service and reserve duty (Antebi, INSS 2021).

2. Anchor companies that act as founder academies. Check Point trained the founders of Palo Alto Networks, Imperva, Cato, Orca and Torq. The Israeli operations of Microsoft and Symantec — themselves partly built from acquisitions of Israeli start-ups — trained the founders of Wiz, Apiiro, Zero Networks, Torq and Cycode, and supplied Island’s go-to-market team.

3. A specialist venture layer. Cyberstarts wrote the first cheque into Wiz and then backed Cyera, Oasis, Island, Upwind, Glow, Zafran and Legit. Team8 manufactured Claroty and Sygnia as a foundry. YL Ventures seeded Axonius and Cycode. By 2020 Israel was attracting 37% of global venture funding for cybersecurity (IISS 2021); in 2024 Israeli cyber raised $4B across 89 rounds, “primarily funded by overseas investors” (YL Ventures 2024).

4. Exit recycling. Adallom’s sale to Microsoft produced both Wiz and Armis. Luminate’s sale to Symantec produced Torq. Spot.io’s sale to NetApp produced Upwind. Even Cybereason’s collapse produced 7AI.

The system’s signature product is not a start-up but a category: the commercial firewall, privileged-access management, the web-application firewall, agentless cloud security, the enterprise browser, non-human identity, AI-agent governance. Israeli founders repeatedly name a budget line that did not exist and then own it for a decade.

That is why 2025–26 is both the proof and the warning. The proof: the system’s output now commands the highest prices in the industry. The warning: the output leaves. With CyberArk rebranded as Palo Alto’s “Idira”, Wiz inside Google Cloud and Armis inside ServiceNow, strategic control of Israel’s champions in identity, cloud and exposure management now sits in California. Israel keeps big R&D centres and the tax — an estimated NIS 10B (~$3.2B) from Wiz alone — but it no longer has an independent anchor company in either identity or cloud. The largest Israeli-headquartered independent, Check Point, grew 1% in Q2 2026. The OECD names the structural cause: “vibrant start-up activity but a comparatively low base of long-term capital” (OECD 2025). The system manufactures companies faster than the country can keep them.

For a mid-sized European state — our home example is the Czech Republic — the lesson is not “build an 8200”. Conscription-scale military intelligence and a permanent, existential threat environment are not exportable, and nobody should want the second. What is exportable is the machinery around them: founder academies, specialist seed funds, foundries wired to critical-infrastructure buyers, the state as a demanding first customer, and rules that keep exit capital and people at home. NÚKIB’s 2026 strategy names precisely the gap Israel closed and we have not: a “shortage of secure and competitive domestic technological alternatives, which deepens dependence on the technologies of foreign rivals” (NÚKIB 2026). And the Israeli system is already spilling into our region — Cato Networks is tripling its R&D centre in Prague.

This report ranks the fifty companies that make the system visible. It puts the analysis first — ten angles on what the list reveals — and the ranking second, as a reference layer. It closes with what a state like ours should copy, what it should refuse to copy, and five moves for the next twelve months.

Summary of main points

• Israel’s edge is a system, not a start-up count — selection (8200, 81, Talpiot, Matzov, Mamram), founder academies (Check Point, Microsoft and Symantec Israel), specialist venture capital (Cyberstarts, Team8, YL) and exit recycling.

• The exit machine is at its peak and concentrating. Five exits at or above $2.4B since late 2023 — Wiz, CyberArk, Armis, Imperva, BioCatch — all to foreign buyers. Decision rights leave; R&D and tax stay.

• Category creation is the specialty, and it lasts about a decade. Check Point’s firewall bought twenty years, Aqua’s container bet about ten, Deep Instinct’s deep-learning lead about five.

• The repeat founder is the most valuable national asset. Wiz, Armis, Cato, Island, Torq, Upwind, Apiiro, 7AI and Transmit are all second or third acts.

• “Build in Israel, sell from the US” is the template — and it is leaky. Snyk’s Israeli team fell from several hundred to about 90 while the company passed 1,500 staff.

• AI security is the new centre of gravity — Cyera, Zenity, Noma, Glow, 7AI, Irregular, Alice, Torq — but most of its metrics are self-reported and the platforms have already bought six AI-security start-ups in about eighteen months.

• The 2021 cohort is a warning to the 2026 cohort. Forter, Transmit, Orca, Salt, Cymulate, Snyk and Aqua carry peak-cycle valuations that have never been retested.

• Capital efficiency is the more portable Israeli model. BioCatch, KELA, Cynet, Checkmarx and Sygnia created real value without a Wiz-sized war chest.

• The national-security-adjacent firms are an advantage and a liability. Cellebrite’s uneven human-rights vetting and Dream Security’s NSO lineage show the governance duty that comes with dual-use exports.

• For us: copy the machinery, not the conscription. Five moves for the next twelve months close the report.

How we ranked

The ranking is a composite judgement, not a formula. Each company was scored on four things: value created (exit price, market capitalisation or last priced valuation, read against disclosed revenue or ARR); category leadership (did it invent or define a category, and does it still lead it?); momentum in 2025–26 (new capital, growth and customer wins — or layoffs, stale valuations and leadership churn); and what it teaches (how clearly the company shows a mechanism others can copy).

The inclusion rule: Israeli-founded, with core R&D in Israel, whether independent, public or acquired. Acquired companies count, because an exit proves the capability; they are ranked by the value and the category they created. Offensive-spyware vendors — NSO, Paragon, Candiru — are excluded and treated in this series as a governance problem, not a league-table entry.

Three honest caveats. First, much of the data is company-reported: Upwind’s $3.8B valuation rests on no disclosed ARR, Glow’s $1.2B on no disclosed revenue, Island’s $200M revenue on a founder interview. Second, a 2021 valuation and a 2026 valuation are not the same currency, and we have discounted the former. Third, the tiers matter more than the exact position — #24 and #27 are closer than the numbers suggest. Two companies from our original long-list, Hunters and Deep Instinct, fell out after the September 2026 fact check; we keep them as cautionary cases, because what went wrong is as instructive as what went right.

The fifty sit in four tiers: the Titans (1–6), the Category Leaders (7–18), the Scale-ups and Specialists (19–32), and the AI-Era Vanguard and the Niche Leaders (33–50).

The analysis: ten things the list reveals

Read as a set, the fifty dossiers describe a machine with a recognisable operating logic — and recognisable failure modes. Ten angles follow; each ends with the decision it implies.

1. The exit machine — and its concentration risk

Five of the fifty have been sold, or agreed to be sold, for $2.4B or more since late 2023:

• Wiz · Google · $32B cash · closed 11 March 2026

• CyberArk · Palo Alto Networks · ~$25B cash and stock · closed 11 February 2026

• Armis · ServiceNow · $7.75B cash · closed April 2026

• Imperva · Thales · $3.6B · closed December 2023

• BioCatch · Visa · $2.4B cash · announced August 2026, pending

Beneath them runs a long tail of $200–400M “flash exits” bought within one to five years of founding — Astrix to Cisco for about $400M, Koi to Palo Alto about twenty months after it was founded, and the unranked Seraphic, Apono and Entro — plus older mid-sized sales that built the founder base: Adallom to Microsoft (~$320M), Fireglass to Symantec (~$300M), Trusteer to IBM (~$1B), Sygnia to Temasek (~$250M), XM Cyber to Schwarz Group (~$700M).

The machine works. Wiz alone is estimated to yield about NIS 10B in Israeli tax, a roughly $1.5B return to one seed fund, and some 1,000 newly liquid engineers in Tel Aviv; Google set aside about $1.5B in retention packages. Imperva, after two changes of owner, remains “the largest and most central hub” of Thales’ global cyber division. Palo Alto now calls its Israeli operation a “primary global innovation hub”.

But look at who the buyers are. Of the acquirers above, only Thales and Schwarz are European — and Schwarz, having bought XM Cyber as a pillar of its European digital-sovereignty business, agreed in July 2026 to sell XM Cyber’s patents and source code to CrowdStrike and license them back. Even the European buyer could not hold the IP. Meanwhile the independent Israeli layer has thinned to a handful: Check Point (revenue +1% in Q2 2026, product revenue −14%), Cato (still private, IPO repeatedly deferred), Varonis (in reported acquisition talks with Proofpoint), Radware. CyberArk cut about 500 jobs within days of closing, about 100 of them in Israel, and its brand is gone.

Read the filings, too. Koi’s sale was reported at about $400M; Palo Alto’s 10-K shows $231M of purchase consideration plus $61M of replacement equity — roughly twice the Series A price set five months earlier. Excellent for the founders, but a small multiple, and the pattern the Koi dossier names: “many sub-$500M exits and few independent category leaders.”

The decision: an exit is the end of strategic control, not of value. A state that wants to keep the value must negotiate for what survives the sale — R&D continuity, retained talent, tax and option rules that keep founders’ capital building at home — because it cannot stop the sale itself.

2. Category creation is the Israeli specialty

Trace the fifty by what they invented and a lineage appears — each entry a budget line that did not exist until an Israeli company named it:

• 1993 · stateful-inspection firewall · Check Point (FireWall-1; ~40% of the firewall market by 1996)

• 1999 · privileged access management · CyberArk (for two decades, “PAM meant CyberArk”)

• 2003 · web-application and database firewall · Imperva (SecureSphere)

• 2011–16 · behavioural biometrics for banks · BioCatch

• 2015 · converged networking and security, later named SASE · Cato

• 2015 · developer-first security · Snyk · automated penetration testing · Pentera

• 2016 · standalone API security · Salt

• 2017 · cyber asset attack surface management · Axonius

• 2019–20 · agentless cloud scanning and the graph-based CNAPP · Orca, then Wiz

• 2020 · the enterprise browser · Island

• 2021 · AI-native data security posture · Cyera · non-human identity · Astrix · low-code-then-agent governance · Zenity

The mechanism repeats. First, a design choice that removes deployment friction — “no agents, results in minutes” was worth more to Wiz than any single feature, and the same agentless logic powered Orca, Armis, Axonius, Salt and Zero Networks. Second, naming the category before the analysts do: Astrix kept saying “non-human identity” until it became a budget line; Cycode rebranded early enough to sit in the first Gartner quadrants of two categories. Third, research as marketing: Claroty’s Team82, Orca’s Research Pod, Salt Labs, Oligo, Zenity Labs and Legit win buyers with disclosures, not advertising — the same disclosure culture that runs through Israeli academia, where offensive research on DNS and cryptographic libraries ended in patches across the internet’s backbone (Afek, Bremler-Barr & Shafir 2020; Genkin, Shamir & Tromer 2013). Fourth, standards seats: Zenity’s CTO co-leads OWASP projects; Irregular co-authored RAND’s SL1–SL5 model-weight security levels.

The warning is in the dossiers’ own lessons. “Inventing a category buys you 20 years, not forever” (Check Point, which missed or joined late next-generation firewalls, cloud and SASE). “An early category bet buys about a decade” (Aqua). Being first is not being the winner: Orca invented agentless scanning and patented it; Wiz won on sales speed and brand. Deep Instinct’s deep-learning lead lasted about five years.

The decision: fund the naming of categories, and budget for the successor product from year five. Category creation is a repeatable national skill; category defence is a separate one that Israel’s own champions have often failed at.

3. The repeat-founder flywheel

Draw the family tree of the fifty and most of the top of the list turns out to be second and third acts:

• The Kramer line · Check Point (1993) → Imperva (2002) → Cato Networks (2015, with Gur Shatz, who had built Incapsula inside Imperva) · Imperva co-founder Mickey Boodaei → Trusteer (IBM, ~$1B, 2013) → Transmit Security, funded with $40M of the founders’ own money before it left stealth

• The Adallom line · Rappaport, Luttwak and Reznik → Adallom (Microsoft, ~$320M, 2015) → Microsoft’s Israeli R&D centre → Wiz ($32B) · Yevgeny Dibrov, on Adallom’s founding team → Armis ($7.75B) · Michael Nicosia, Adallom’s VP of global sales → co-founder of Salt Security

• The Symantec line · Dan Amiga: Fireglass (Symantec, ~$300M, 2017) → Island, recruiting Symantec’s former president Mike Fey as CEO · Ofer Smadari: Luminate (Symantec, 2019) → Torq · Lior Levy, a Symantec architect → Cycode, with Fey as seed investor and director

• The Microsoft-Israel line · Idan Plotnik: Aorato (Microsoft, ~$200M) → Apiiro · Benny Lakunishok, who worked on Microsoft’s integration of Aorato and Hexadite → Zero Networks · Roni Fuchs, an early Aorato employee → Checkmarx → Legit Security

• The Argus line · Argus Cyber Security (Continental, ~$430M) trained Astrix’s CEO, a Legit co-founder and Guardz’s CTO; Guardz’s CEO came from IntSights (Rapid7)

• The operator lines · Spot.io (NetApp, ~$450M) → Upwind ($3.8B) · Eyal Gruner: Versafe (F5, ~$100M) → Cynet, and co-founder of Cymulate · Cybereason (valued ~$3B in 2021, a distressed sale in 2025) → 7AI, whose $130M Series A came 302 days after it left stealth

The venture data confirms the pattern: in 2024, 15 new Israeli cyber start-ups were founded by serial entrepreneurs who had already built and sold a company, up from 10 in 2023, and a handful of experienced teams raised seed rounds above $20M (YL Ventures 2024).

Two things follow. First, foreign acquisitions are founder schools. Microsoft’s purchases of Adallom, Aorato and Hexadite, and Symantec’s of Fireglass and Luminate, did not hollow out Israeli cyber; they showed the next generation the problem from inside a platform, and produced Wiz, Apiiro, Zero Networks, Island, Torq and Cycode. Second, the pipeline is wider than 8200. SentinelOne’s founders came from neither 8200 nor 81 — “no one in the country would invest in us” — and built a $1.2B-ARR public company. Checkmarx and Apiiro came from Mamram and Matzov; Pentera from an IDF IT-branch red team; Cymulate from a services firm; Forter from PayPal’s fraud operation; Irregular from IBM and Google AI research; Glow from Meta; Guardz from the go-to-market side of two acquired start-ups. Zafran’s CEO fled Tehran at 17 and left 8200 as a major.

The decision: the most valuable national asset is not the conscript but the second-time founder, and policy should be written for them — option taxation, workable non-competes, and keeping acquirers’ local R&D centres alive after the deal.

4. Build in Israel, sell from the US

Sort the fifty by headquarters and the template is unmistakable. US-headquartered with Israeli R&D: Wiz, Cyera, Claroty, Axonius, Forter, Zafran and Apiiro (New York) · Armis and Upwind (San Francisco) · SentinelOne (Mountain View) · Salt and Legit (Palo Alto) · Island and Silverfort (Texas) · Snyk, Pentera, Cynet and 7AI (Boston area) · Varonis and Guardz (Miami) · Checkmarx (Atlanta) · Orca (Portland) · Coro (Chicago). Headquartered in Israel: Check Point, Cato, Radware, Cellebrite, BioCatch, Zenity, Oligo, Cycode, Zero Networks, Sweet, Dream, Sygnia, KELA, Waterfall.

The logic is commercial, not sentimental. The buyer is American: Wiz drew up a “Wiz 100” list of Fortune 500 targets and now counts half the Fortune 100 as customers. The founder moves: Tomer Weingarten was SentinelOne’s CEO and only salesman in Silicon Valley for three years. Or the American is hired as an equal — Salt made its US sales veteran a co-founder; Island’s Amiga chose to be CTO and gave the CEO role to Fey, “very strong ... in managing Americans”. Island runs sales from Dallas while 95% of development stays in Israel. The US government is the prized anchor customer: Axonius built a separate federal subsidiary with FedRAMP authorisation and 90+ agencies; Cellebrite, Checkmarx, Oligo and Sweet are all chasing or holding FedRAMP.

The template leaks. SentinelOne’s dossier is blunt: “Israel keeps R&D only.” Salt’s: headquarters, sales “and much of the value sit in California”. Snyk’s Israeli centre shrank to about 90 people; Deep Instinct stopped recruiting in Israel in 2023. And the talent ceiling is binding: Israeli R&D wages rose 11% in the first seven months of 2024 against 7.3% for other high-tech workers (OECD 2025), Radware warns that a weak dollar will “materially increase” its shekel costs, and the scale-ups are building elsewhere — Cato in Prague and London, Coro in London.

The decision, for us, is double. Israel’s overflow is our opportunity: Prague is already a destination for its engineering capacity, and every such centre is a potential founder academy. And for our own founders, the US-first template is also the realistic one — but they should keep product leadership, not just coding, at home.

5. The AI-security wave — and who leads it

Almost every company that raised a large round in 2025–26 did so on one of two theses:

• Security for AI · Cyera (data and identity controls for AI agents; $12B) · Zenity (agent governance; $125M Series C; Gartner’s “company to beat”) · Noma (agent inventory to runtime; $132M raised) · Alice (a real-world adversarial dataset sold to 8 of the 10 leading AI labs; ARR approaching $100M) · Irregular (pre-release cyber evaluations for OpenAI, Anthropic and Google DeepMind) · Glow (AI agents running application allow-listing; $180M before launch) · Oligo and Sweet (runtime protection for AI stacks) · Astrix (non-human and agent identity, now Cisco’s)

• AI running security · Torq (AI SOC; a $1.2B unicorn) · 7AI (agentic SOC; $130M Series A) · Zafran (agentic mitigation) — while the incumbents re-platform: Check Point bought Lakera, Cyata and Deepchecks and hired about 500 people with AI skills; SentinelOne bought Prompt Security; Cato bought Aim; Snyk says its Evo agent layer is 60% of new deal volume

Why Israel is early: its research labs name AI threat classes first. Technion demonstrated a self-propagating prompt-injection “worm” between GenAI assistants and shipped a guardrail in the same paper (Cohen, Bitton & Nassi 2024); a BGU-led consortium mapped 33 offensive AI capabilities onto MITRE ATT&CK (Mirsky et al 2021); Irregular’s CEO co-wrote RAND’s five security levels for model weights (Nevo, Lahav et al 2024). Why now: offence automated first. A tool-using GPT-4 agent exploited 87% of fifteen real one-day vulnerabilities from the public CVE text alone, at about $3.52 a run (Fang et al 2024). That is the logic behind mitigation-first products — Zafran’s claim that 99% of “critical” vulnerabilities are not exploitable in context, Oligo’s runtime exploit blocking, Zero Networks’ deterministic containment.

Three cautions. The numbers are mostly self-reported: Noma, Zenity, 7AI and Glow disclose no absolute ARR. The platforms are buying the category: Protect AI, Prompt Security, Lakera, Aim, Pangea and CalypsoAI were acquired in about eighteen months. Trust can fail: in July 2026 Anthropic disclosed that an evaluation environment run with Irregular had live internet access, and in six runs Claude reached the production systems of three real organisations; Koi and Palo Alto are being sued over a threat report allegedly built on unverified AI output. Underneath, the national base is slipping — Israel fell from 5th to 9th on the Tortoise AI index in four years while Singapore rose from 10th to 3rd (Israel Innovation Authority 2025) — and its talent pool is narrow: only 23% of its AI professionals are women (OECD 2025).

The decision: AI security is the one field where a newcomer can still name a category — and the evaluation-and-assurance end (Irregular’s niche) is more defensible than the guardrail-feature race.

6. Platforms absorb categories — know whose roadmap you are on

The fifty are, in effect, the R&D pipeline of a handful of platforms:

• Google · Wiz (cloud)

• Palo Alto Networks · CyberArk (identity) · Koi (agentic endpoint) · Talon (browser, ~$625M) · Dig (data) · Protect AI — Koi was its 12th Israeli acquisition since 2014, half of its 24 significant deals, and its Tel Aviv centre now fills 22 floors of one tower

• ServiceNow · Armis (exposure); an investor in Snyk

• CrowdStrike · XM Cyber’s IP (attack graphs) · Seraphic (browser, reported $420M) · Flow (data) · SGNL ($627.9M, identity) · Pangea

• Cisco · Astrix (non-human identity); a minority stake in Zafran

• Visa · BioCatch · Thales · Imperva · Akamai · Noname ($450M), LayerX (~$205M)

• Check Point, the home consolidator · eleven Israeli acquisitions in 2018–25, then Cyata, Cyclops, Rotate and Deepchecks in 2026

• Israeli scale-ups as consolidators · Wiz (Gem, Dazz, Raftt) · Cyera (Trail, Otterize, Ryft, Genie, Oasis) · Torq (Revrod, Jit) · Silverfort (Fabrix) — five Israeli cyber start-ups bought other young Israeli start-ups in 2024 alone (YL Ventures 2024)

For the independents this is a squeeze. Claroty lost Armis, its closest rival, to ServiceNow and now sells neutrality. Axonius’s most logical buyers are the platforms it competes with. Salt is “the last large standalone player” in API security after Noname sold for $450M, less than half its old $1B mark. The ASPM trio — Apiiro, Cycode, Legit — face Palo Alto’s Cortex Cloud, Wiz Code and GitHub bundling the same view. Hunters learned that “SIEM is a platform market”.

The fifty show four survival strategies: neutrality as a product (Axonius; Zenity across Copilot, ChatGPT, Claude and Cursor; Torq’s “CrowdStrike finds threats, Torq finishes them”), becoming the consolidator (Cyera), partnering with the giant you would otherwise fight (Silverfort with Microsoft, Radware’s OEM deals with Check Point and Cisco, Waterfall with Siemens Energy), and selling at the peak of demand (Astrix, sold as Cisco needed an agent-identity layer; Koi, whose buyer had used its product internally for months before the deal).

The decision: the exit market sets the floor and the platform roadmap sets the ceiling. Founders should map their likely buyers from the first round, as Astrix’s investors did.

7. Stale unicorns and the valuation reset

The 2021–22 cohort is still carrying its peak-cycle prices:

• Snyk · $8.5B peak (2021), $7.4B last priced (2022), investor marks about $3.7B, a private-equity bid below $3B rejected, an interim CEO

• Forter · $3B (May 2021) · no price and no revenue figure disclosed since

• Transmit · $2.2B on a $543M Series A (June 2021) · about 326 staff

• Orca · $1.8B (October 2021) · about 350 staff after raising roughly $630M

• Salt · $1.4B (February 2022) · about $75M reported revenue, about 170 staff

• Aqua · “above $1B” and flat since 2021 · both founders stepped back in November 2025

• Pentera · about $1B since January 2022, despite ARR growing more than threefold

• Cymulate · about $500M (2022), after promising a unicorn “within two years”

The extreme case sits just outside the list: Cybereason, valued at about $3B in 2021, was worth about $300M a year later. Now set the 2025–26 cohort beside it: Upwind from $900M to $3.8B in 21 months with no ARR disclosed; Cyera from $1.4B to $12B in about two years at a reported ~80x ARR; Dream from $1.1B to $3B in 16 months on a customer base one investigation put at fewer than ten; Glow from $400M to $1.2B while still in stealth.

The mechanics that turn a price into a trap are all in the dossiers: a preference stack that any exit must clear (Transmit), an IPO bar of roughly $500M revenue (Claroty, Upwind), and the liquidity drag that forces secondaries as a retention tool (Island, Claroty’s $50M, Cato’s ~$120M). The companies that escaped did it with discipline — Pentera grew into its price, Axonius raised $200M flat by choice, Claroty waited until growth carried it back above its peak.

The decision: model the exit at normal multiples before joining a peak round. The question for 2029 is how many of today’s AI-security marks become the next stale unicorns.

8. Capital as a weapon versus capital efficiency

Two strategies coexist in the fifty, and both work — in different conditions:

• Capital as a weapon · Wiz ($1.9B raised) · Cyera (over $2.3B in five rounds in 26 months; about $7M per employee for the Genie acquisition) · Island (~$730M; every competitor had to raise “in Island’s shadow”) · Upwind (~$730M) · Glow ($180M before launch)

• Capital efficiency · BioCatch (EBITDA breakeven at about $100M ARR in 2022, then Permira, then Visa) · KELA (profitable since inception; one outside round in seventeen years) · Sygnia ($4.3M raised, sold for ~$250M within three years) · Checkmarx (~$100M raised, a $1.15B buyout) · Cynet (~$78M disclosed; 1,100+ direct customers and 9,000+ through partners) · Cycode (~$81M; a Gartner Leader) · Zero Networks (just over $100M; revenue doubling; net retention above 120%)

The weapon works when three conditions hold at once: a proven team, a land-grab category, and growth that is real — Wiz’s refusal of $23B was right only because it then reached $1B ARR. It fails when the round sets the headcount plan: Deep Instinct planned for 400 people and is down to about 180; Hunters raised about $100M in five months to double its staff; Coro raised about $255M in two years in a small-ticket SMB market; Snyk lost $267M on $147M of revenue in 2022.

Efficiency has its own exit menu, and private equity is on it: Thoma Bravo took Imperva private for $2.1B and sold it for $3.6B; Hellman & Friedman bought Checkmarx; Insight bought Armis outright for $1.1B in 2020 and saw it sold for $7.75B; Temasek bought Sygnia; Vector took a growth stake in KELA.

The decision: for an ecosystem with less capital than Tel Aviv, the efficient model is the portable one. A profitable company with $100M ARR “can be sold to PE, then to a strategic ... without ever needing an IPO window” (BioCatch).

9. The national-security-adjacent firms: advantage and liability

A distinct cluster of the fifty sells intelligence-grade capability: Cellebrite (phone forensics), Dream Security (national cyber defence and “sovereign AI”), Sygnia (incident response), KELA (cybercrime intelligence), XM Cyber (attack-path modelling, founded by a former Mossad director) and Irregular (testing the offensive capability of frontier AI). Offensive-spyware vendors — NSO, Paragon, Candiru — are excluded from the ranking altogether.

The advantage is real. Sygnia’s ex-8200 responders led the investigation of the $1.5B Bybit theft; Temasek bought the firm, and with it a capability Singapore chose not to build. KELA’s research on the group behind the Trivy supply-chain attack went to the Australian Federal Police and the FBI, and two men were charged in August 2026.

The liability is equally real. Cellebrite sold to Russia, Belarus, Hong Kong, China, Bangladesh and Myanmar before cutting them off; after Amnesty showed Serbian police using its tools to unlock a journalist’s phone and plant spyware, it suspended Serbian customers — but called similar Citizen Lab findings on Jordan and Kenya “speculation”, and publishes no vetting criteria. Dream was co-founded by NSO’s co-founder, Shalev Hulio, whose indictment a Barcelona court ordered in 2025; an investigation found 12 staff who had worked at NSO or other spyware firms; its “sovereign” systems come from a company with about 85% of its staff in Israel.

There is a deeper caution in the library. The October 7 failure was “not the result of a single glaring failure but rather the accumulation of several problems”; among them, a non-commissioned officer in 8200 warned in July 2023 that a Hamas exercise closely followed the attack plan, and her superiors dismissed the analysis as “aspirational” (Wyss, CTC Sentinel 2024). A system that selects talent brilliantly does not thereby guarantee it listens to it.

The decision for a buyer state: legitimacy is part of the product — demand systematic, published end-use vetting, and when buying “sovereign” capability insist on source-code access, local hosting and staff, and clean exit clauses. “Sovereignty rented from a foreign vendor is still dependency” (Dream Security dossier).

10. What the cautionary cases teach

Hunters and Deep Instinct fell out of the fifty, but their failure modes run through the list:

1. Right architecture, no distribution. Hunters bet early and correctly on the data-lake SIEM, with Snowflake, Databricks, Okta, Cisco and Microsoft’s M12 as investors. It had no telemetry of its own; the endpoint platforms turned SIEM into a bundle. No financing since January 2022; a newsroom silent since March 2025.

2. A technical lead without a platform. Deep Instinct applied deep learning to raw malware bytes — an idea traceable to Bar-Ilan research funded by a state consortium (David & Netanyahu 2015) — and won an HP OEM deal that brought “volume, not ownership”. The lead lasted about five years.

3. Hiring to the round. Deep Instinct’s 400-person plan, Hunters’ planned doubling, Cybereason, Coro.

4. A workflow moat eroded by AI. Snyk and Checkmarx lost standing as coding agents and frontier models absorbed code scanning; Pentera is now outgrown by AI-native Horizon3.ai.

5. Forecasting valuations in public. Deep Instinct’s “several unicorns within nine months”, Cymulate’s “unicorn within two years”.

6. Forgetting that security vendors are targets. Aqua’s open-source Trivy scanner was hijacked in March 2026, and the stolen credentials were reused to poison Checkmarx’s GitHub Actions.

The system’s resilience is the counterpoint. Cybereason’s founders came back as 7AI; Hunters’ CTO now lists its seed investor as his affiliation; Deep Instinct’s own dossier counts the engineers who moved on to the next wave as its lasting contribution. The decision: judge an ecosystem by how cheaply it recovers from failure — how fast talent is re-absorbed — not by the size of the rounds it celebrates.

The Fifty, tier by tier

What follows is the reference layer: one entry per company, in ranked order — what it is, why it sits where it does, and the one thing to learn. Status is as of 22 September 2026. Each entry points to its full ~1,000-word dossier in the companies/ folder.

Tier I — The Titans (1–6)

The six companies that define what the Israeli system can produce at full scale: two of the three largest exits in the country’s history, its oldest champion, its most valuable independent, and its largest listed challenger.

01. Wiz — Cloud security (CNAPP) · acquired by Google for $32B in cash, closed March 2026. An agentless security graph across AWS, Azure, GCP and Oracle that surfaces the handful of “toxic combinations” among 100,000 findings. The largest Israeli exit ever and the fastest-growing security company on record: $1M to $100M ARR in about 18 months, over $1B in 2025. It refused Google’s $23B and got $32B eight months later. Lesson: a repeat team plus zero deployment friction compounds. → 01 - Wiz.md

02. CyberArk — Identity security / privileged access · acquired by Palo Alto Networks for ~$25B, closed February 2026; now “Idira”. The vault for an organisation’s all-powerful accounts, stretched by acquisition from humans (the core product) to machines (Venafi) to AI agents. Ranked second for two decades of category ownership and a painful licence-to-SaaS shift that left 88% of $1.44B ARR as subscription. Lesson: own one control point — least privilege — and extend it across every identity type. → 02 - CyberArk.md

03. Check Point Software Technologies — Network security platform · public (Nasdaq: CHKP), ~$13.7B. It invented the commercial stateful firewall in 1993 and became Israel’s founder academy. Ranked on history, ~40% operating margins and $4.2B of cash, not growth: Q2 2026 revenue rose 1% and product revenue fell 14%. Under CEO Nadav Zafrir it is buying AI-security teams (Lakera, Cyata, Deepchecks). Lesson: profitability becomes a trap when rivals reinvest in adjacent categories. → 03 - Check Point Software Technologies.md

04. Cyera — AI-native data security, now a data-and-identity layer for AI agents · independent, $12B (June 2026). Agentless AI classification that tells a company what sensitive data it holds and who — or which agent — can reach it; the $1B Oasis purchase adds non-human identity. The most valuable independent Israeli cyber company — at a reported ~80x ARR, and loss-making. Lesson: re-run a proven architecture (Wiz’s agentless graph) on a new asset. → 04 - Cyera.md

05. SentinelOne — Autonomous endpoint, XDR and AI SIEM · public (NYSE: S), ~$8.3B. One lightweight agent on its own data lake; half of its $1.22B ARR now comes from beyond the endpoint. The largest independent Israeli-founded pure play still growing above 20% — but still at a −31% GAAP operating margin and below its ~$9B IPO valuation. Lesson: outsiders can win; founders turned down by Israeli VCs went straight to the US, with the CEO as sole salesman. → 05 - SentinelOne.md

06. Armis — Asset visibility and exposure management · acquired by ServiceNow for $7.75B in cash, closed April 2026. Agentless discovery of every connected device, from printers to infusion pumps, checked against a knowledge base of some 7 billion devices. Sold at about 23x ARR while growing over 50% at $340M+, six years after Insight’s $1.1B buyout. Lesson: find the pain before the product — its founders cold-called CISOs before choosing one. → 06 - Armis.md

Tier II — The Category Leaders (7–18)

Companies that own a category, or created one, but have not reached Titan scale — because they are still private, too narrow, already absorbed, or carrying governance or growth questions.

07. Cato Networks — SASE · independent, $4.8B; ARR $415M+, growing ~42%. Networking and security written as one cloud stack on its own global backbone; a Gartner SASE Leader three years running, and Shlomo Kramer’s third company. Below the Titans because it is private, smaller than Palo Alto’s $1.5B SASE line, and its IPO keeps slipping. It is tripling its Prague R&D centre. Lesson: replace a budget (the WAN) rather than add a line item. → 07 - Cato Networks.md

08. Island — Enterprise browser · independent, $4.8B; ~$200M revenue growing ~100% (founder-stated). A Chromium browser with a policy engine at the last mile — copy, paste, download and AI-prompt control without VDI or VPN; eight of the ten largest banks use it. It created the category; it sits here because its figures are unaudited and Palo Alto’s Prisma Browser is bundling the idea. Lesson: take over a default application instead of adding an agent. → 08 - Island.md

09. Varonis — Data security · public (Nasdaq: VRNS), ~$5.6B; Proofpoint reported in acquisition talks. Twenty years of permissions metadata with automated remediation — an unglamorous file-access problem made urgent by AI copilots. SaaS is now 95% of revenue after a transition that drove the stock to a $19.70 low. Growth in the high teens keeps it mid-tier. Lesson: boring structural problems make durable franchises. → 09 - Varonis.md

10. Claroty — Cyber-physical systems security · independent, ~$3B; ARR over $200M. Built inside the Team8 foundry and sold through its investors Siemens, Rockwell and Schneider to plant engineers who distrust IT vendors. With Armis gone to ServiceNow, it is the leading independent in OT, IoT and medical-device security — still pre-profit, and well short of the ~$500M revenue a listing now needs. Lesson: strategic investors can be your sales force. → 10 - Claroty.md

11. Axonius — Cyber asset and exposure management · independent, $2.6B; ARR over $200M. A neutral, agentless layer that correlates 1,400+ data sources to answer “what do we actually have?”, with a FedRAMP-authorised federal arm serving 90+ agencies. Close to cash-neutral; it raised $200M flat by choice. Held back because it is single-category and its likely buyers are its competitors. Lesson: pick the unsexy, universal problem. → 11 - Axonius.md

12. Upwind — Runtime-first cloud security · independent, ~$3.8B (September 2026). It sees what actually executes inside cloud workloads and is the leading independent alternative to Google-owned Wiz. Built by the Spot.io team after its sale to NetApp. The fastest-rising valuation of 2026 — $900M to $3.8B in 21 months — with no ARR disclosed, hence #12. Lesson: when the category leader is acquired, the independent number two gets a window. → 12 - Upwind.md

13. Imperva — Web application, API and data security · acquired by Thales for $3.6B, December 2023. Two decades of web-application and database-firewall IP, and two exits (Thoma Bravo at $2.1B, then Thales). Its founders went on to Trusteer, Incapsula and Cato, and Israel remains Thales’ largest cyber hub. Ranked on franchise and founder yield rather than independence. Lesson: a first company that trains founders is worth more to an ecosystem than its own exit. → 13 - Imperva.md

14. Cellebrite — Digital forensics for law enforcement · public (Nasdaq: CLBT), ~$2.4–2.8B. The global default for extracting court-admissible evidence from seized phones: ~86% gross margin, 117% net retention, ARR of $508M. Documented misuse by customers in Serbia, Jordan and Kenya, a 2026 guidance cut and three CEOs in about twenty months keep it mid-table. Lesson: when you sell to governments, legitimacy is part of the product. → 14 - Cellebrite.md

15. BioCatch — Behavioural biometrics for banks · Visa agreed to acquire for $2.4B (August 2026, pending). It reads how a customer types, swipes and holds the phone to catch scams in which password, device and customer are all genuine — 19 billion sessions a month across 350+ banks. EBITDA breakeven at $100M ARR, then Permira, then Visa. One vertical and one signal keep it at #15. Lesson: sell to the budget that feels the loss. → 15 - BioCatch.md

16. Forter — E-commerce fraud prevention · independent, $3B (2021, stale). A one-second approve-or-decline decision drawn from a cross-merchant identity graph, backed by a chargeback guarantee: it sells an outcome, not a score. Mid-table because it sits beside core cybersecurity and has disclosed neither a new price nor revenue since 2021. Lesson: underwrite your own accuracy — a guarantee turns a risk tool into a revenue product. → 16 - Forter.md

17. Snyk — Developer-first application security · independent; last priced at $7.4B, now marked ~$3.7B; interim CEO. It created developer security with a free tier and automatic fix pull-requests, reaching $325M+ ARR. Growth slowed to about 12%, its Israeli team shrank to about 90, and coding agents now threaten the workflow it owned — its Evo agent layer is 60% of new deals. Lesson: a workflow moat lasts only as long as the workflow. → 17 - Snyk.md

18. Radware — DDoS and application protection · public (Nasdaq: RDWR), ~$1.24B. Carrier-grade DDoS protection in appliance and cloud form; profitable, with $400M+ in liquid assets, founder-run for 29 years, and cloud ARR past $100M growing 22%. Long-run growth of 3–4% a year and related-party governance hold it at #18. Lesson: durability is a strategy — but venture bets incubated inside a slow public company (SkyHawk) rarely survive. → 18 - Radware.md

Tier III — The Scale-ups and Specialists (19–32)

Unicorns and near-unicorns of two vintages: the 2021 cohort still growing into peak prices, and the 2025–26 cohort raising on the AI thesis.

19. Torq — AI SOC · independent, $1.2B (January 2026). AI agents triage and respond across whatever tools a customer already runs, on a no-code automation engine that was ready when LLMs arrived. Repeat founders (Luminate, sold to Symantec) with Check Point engineering roots. Last disclosed ARR was $24M+ (2024) against a $100M target. Lesson: build the plumbing before the magic. → 19 - Torq.md

20. Orca Security — Agentless cloud security · independent, $1.8B (2021). It invented and patented SideScanning — full cloud coverage in minutes — and then lost the scale race to Wiz, which used the same idea with faster enterprise selling. About 350 staff now carry a five-year-old mark. Lesson: being first is not enough; weigh go-to-market ability as heavily as technical originality. → 20 - Orca Security.md

21. Silverfort — Identity protection · independent, ~$1B (January 2024). It enforces MFA inside the authentication stream itself, reaching legacy apps, command-line admin tools and service accounts that other products cannot; it claims 10 billion authentications analysed a day. No ARR disclosed since “tens of millions”. Lesson: build at the point of enforcement, and solve the ugly legacy problem first. → 21 - Silverfort.md

22. Transmit Security — Customer identity, passwordless and fraud · independent, $2.2B (2021). Login, identity orchestration and fraud scoring for banks such as Citi, JPMorgan and HSBC — Mickey Boodaei’s third company after Imperva and Trusteer. No new capital in five years, no revenue disclosed, and a $543M preference stack any exit must clear. Lesson: a serial founder’s most durable asset is the buyer relationship. → 22 - Transmit Security.md

23. Aqua Security — Container and cloud-native security · independent, above $1B (flat since 2021). It pioneered container runtime security in 2015; its open-source Trivy scanner is the developer funnel — and in March 2026 was hijacked to steal CI/CD secrets. Its founders handed over to a sales-led CEO in 2025. Lesson: open source is distribution and attack surface at once; release engineering is a security function. → 23 - Aqua Security.md

24. Checkmarx — Application security testing · owned by Hellman & Friedman ($1.15B, 2020). A static-analysis engine embedded in 60% of the Fortune 100, founded out of the Mamram and Matzov units, with its CTO still in place after twenty years. A sale process seeking $2.5B+ has produced no deal, and AI is compressing classic scanning. Lesson: private equity is a real exit path for a capital-efficient enterprise vendor. → 24 - Checkmarx.md

25. Pentera — Automated security validation · independent, ~$1B (flat since 2022). It runs real exploits safely in production networks — a one-day proof of value that ends in domain admin — and was first in its category to $100M ARR. AI-native Horizon3.ai now outgrows it, and two 2026 layoff rounds cut about 20% of staff. Lesson: automate the job you did yourself — then add ML talent before AI redefines it. → 25 - Pentera.md

26. Salt Security — API security · independent, $1.4B (2022). It made API security a budget line, using behavioural baselines of API traffic to catch logic abuse, and now pitches “agentic security”. It is the last large standalone player after Noname and Traceable were absorbed, on about $75M of reported revenue. Lesson: ask early whether your category can survive on its own. → 26 - Salt Security.md

27. Dream Security — AI-native national cyber defence · independent, $3B (June 2026). It sells state-actor detection and “sovereign AI” to governments, with ARR above $100M within three years, largely through a former Austrian chancellor’s access. NSO lineage, a founder facing a Spanish indictment order, and a very small customer base cap it at #27. Lesson: in government markets distribution is the moat — and investors must price the tail. → 27 - Dream Security.md

28. Glow — AI-native endpoint security · independent, $1.2B (out of stealth July 2026). AI agents make application allow-listing — a category that failed because humans could not maintain the lists — workable, deciding which coding agents and MCP servers may run on a laptop. $180M raised; no revenue disclosed; ranked on team and thesis. Lesson: revive a “right idea, wrong decade” category once technology removes its constraint. → 28 - Glow.md

29. Zenity — Security and governance for AI agents · independent; $125M Series C (August 2026). It finds, governs and blocks AI agents across Copilot, ChatGPT, Claude and Cursor; it began in 2021 on low-code governance, and the market grew into its category. Revenue triples yearly from an undisclosed base, and Microsoft is both channel and competitor. Lesson: choose a wedge that sits just ahead of a bigger trend. → 29 - Zenity.md

30. Zafran — Threat exposure management and mitigation · independent; over $140M raised. It asks whether a “critical” vulnerability is running, reachable, already blocked or actively exploited — and then mitigates through controls the customer already owns. Founded by two decorated 8200 majors and a Unit 81 technologist; ARR has tripled, but is still “in the millions”. Lesson: reframe the question and the backlog shrinks. → 30 - Zafran.md

31. Noma Security — AI and AI-agent security · independent; $132M raised. One platform to find agents — typically 10 to 100 times more than teams expect — map their tools and MCP connections, red-team them and govern them at runtime. ARR up 1,300% from an undisclosed base, with Zenity as a direct Israeli rival. Lesson: build the angel round out of the CISOs you want as customers. → 31 - Noma Security.md

32. Oligo Security — Runtime application and AI security · independent; ~$140M raised. A kernel-level eBPF sensor that sees whether the vulnerable function inside an open-source library ever executes — and blocks the exploit if it does. Its research disclosures (ShadowRay, 0.0.0.0-Day) are its marketing. About 100 staff in a runtime market dominated by platforms. Lesson: go one level deeper than the incumbents look. → 32 - Oligo Security.md

Tier IV — The AI-Era Vanguard and the Niche Leaders (33–50)

Two kinds of company share the bottom tier: very young firms ranked on team, thesis and early momentum, and long-lived specialists that dominate a narrow market. Both are where the next Titans — and the next cautionary cases — will come from.

33. 7AI — Agentic SOC · independent; $130M Series A at ~$700M. AI agents triage and investigate alerts on top of a customer’s existing tools, sold channel-first through DXC. Founded by two of Cybereason’s co-founders; every metric is self-reported and the company is under two years old. Lesson: talent from a failed company comes back — pick the channel on day one. → 33 - 7AI.md

34. Irregular (formerly Pattern Labs) — Frontier AI security lab · independent; ~$450M (2025). It tests unreleased models from OpenAI, Anthropic and Google DeepMind for offensive cyber capability, and its CEO co-authored RAND’s SL1–SL5 model-weight security levels. About 25 staff; in 2026 its test environments reached the real internet. Lesson: sell to the people who create the risk — and run offensive-AI test ranges as critical infrastructure. → 34 - Irregular.md

35. Alice (formerly ActiveFence) — AI safety and security · independent; $140M at ~$700–800M (August 2026). Eight years of labelled real-world abuse data turned into red-teaming and guardrails for eight of the ten leading AI labs; ARR approaching $100M. A mixed, services-heavy business, priced accordingly. Lesson: an old dataset can be the ticket into a new market. → 35 - Alice.md

36. Sygnia — Incident response and MDR · owned by Temasek (~$250M, 2018). The ex-8200 team boards call mid-breach, turning crises into retainers and managed detection. A Team8 foundry company sold at about 58 times its capital within three years; two CEO changes in 2025. Lesson: services can yield a venture-scale exit if you sell to the top of the market and exit early. → 36 - Sygnia.md

37. XM Cyber — Exposure management and attack paths · owned by Schwarz Group (~$700M, 2021); CrowdStrike buying its IP. It models an estate as a graph and finds the “choke points” where attack paths converge — an offensive planner’s view from a former Mossad director. It will now license back its own technology. Lesson: make the attacker’s mental model the product. → 37 - XM Cyber.md

38. Zero Networks — Automated microsegmentation · independent; over $100M raised. It makes a proven but consultant-heavy control deployable in weeks: agentless rules generated automatically, MFA at the network layer. Revenue doubled, net retention above 120%, 99% of customers retained — from a small base. Lesson: look for proven ideas that failed on deployment. → 38 - Zero Networks.md

39. Apiiro — Application security posture management · independent; ~$135M raised. Deep code analysis maps software architecture and flags only material, risky changes; it is now moving into governing AI coding agents. It walked away from a $500–600M Palo Alto deal in 2022 and grew ARR 104% in 2025. Lesson: repeat founders carry a method, not a product. → 39 - Apiiro.md

40. Cycode — ASPM and software supply-chain security · independent; ~$81M raised. Its own scanners plus a code-to-runtime context graph; a Leader in Gartner’s first Software Supply Chain Security Magic Quadrant (2026). Capital-efficient, but without a priced round since 2021. Lesson: enter through the gap incumbents ignore — build pipelines and leaked secrets in 2019. → 40 - Cycode.md

41. Cymulate — Breach and attack simulation · independent; ~$500M (2022). Easy SaaS attack simulation across 1,000+ customers, now generating detection rules and fixes as well as tests. Born inside a penetration-testing services firm; it missed its own public unicorn deadline. Lesson: productise the services work you keep repeating — and never forecast your valuation. → 41 - Cymulate.md

42. Astrix Security — Non-human identity and AI-agent security · acquired by Cisco for ~$400M (June 2026). It named “non-human identity” early and extended one identity graph from SaaS tokens to AI agents, selling within five years of founding on about $85M raised. Lesson: a short category name buyers repeat can do more than features. → 42 - Astrix Security.md

43. Koi Security — Software supply-chain and “agentic endpoint” security · acquired by Palo Alto Networks, closed April 2026. It inventories and controls what users install for themselves — browser extensions, IDE plugins, packages, MCP servers — which endpoint tools mostly ignore. Founded in 2024 and sold about twenty months later: reported at ~$400M, though Palo Alto’s 10-K shows $231M plus $61M of replacement equity, roughly twice its Series A price. Lesson: prove the attack before you sell the defence — its fake VS Code theme reached 300+ organisations in a week. → 43 - Koi Security.md

44. Sweet Security — Cloud and AI runtime security · independent; ~$120M raised. An eBPF sensor plus cloud logs that now blocks rogue AI-agent behaviour, founded by the IDF’s former CISO after he failed to find a good enough cloud detection tool for the army’s move to the public cloud. ARR up sixfold from an undisclosed base. Lesson: start from a buyer problem you owned yourself. → 44 - Sweet Security.md

45. Legit Security — ASPM and AI-generated-code security · independent; $77M raised. It maps the “software factory”, ranks findings with its own scanners, and governs coding agents such as Claude Code and Cursor. Founded by Checkmarx veterans; no round since 2023. Lesson: aggregate, but own something — and use offensive research as marketing. → 45 - Legit Security.md

46. KELA — Cybercrime threat intelligence · independent (Vector Capital minority stake). Fifteen years of underground data plus human analysts; bootstrapped for nine years and profitable since inception; bookings up 101% last year; its research fed the TeamPCP arrests. Lesson: proprietary data compounds, and public-interest work is a sales channel. → 46 - KELA.md

47. Cynet — All-in-one XDR with bundled MDR · independent. One agent, one console and a human SOC in the box for companies that have no SOC; MSPs brought 64% of its Q4 2025 deals, on about $78M of disclosed funding. Lesson: build for the buyer the leaders underserve, and bundle the service into the software. → 47 - Cynet.md

48. Guardz — SMB security and MDR sold through MSPs · independent; $84M raised. One multi-tenant console that lets an outsourced IT provider secure dozens of small clients — identity, email, endpoint, cloud data — with AI triage and a human MDR team behind it. It owns the glue and rents the engines: SentinelOne (also an investor) for endpoint, Check Point for email. ARR grew 500% and then 300%, from an undisclosed base. Lesson: sell to the intermediary, not the end customer — and note that exits create founders; its own came from IntSights and Argus. → 48 - Guardz.md

49. Coro — Unified SMB security platform · independent; ~$275M raised. One agent and many modules for lean-IT mid-market firms, sold 100% through partners since 2025. Hypergrowth was followed by a reset and a channel veteran replacing the founder as CEO. Lesson: heavy capital in a small-ticket market becomes a burn problem the moment growth slows. → 49 - Coro.md

50. Waterfall Security Solutions — OT unidirectional gateways · independent. Hardware that lets data leave a power plant or rail network while nothing can come back in — an approach NERC CIP, US nuclear rules and France’s ANSSI reward or require. About 100 staff after nineteen years. Lesson: make the regulator your sales team, and sell certainty where failure is physical. → 50 - Waterfall Security Solutions.md

The cautionary cases

C1. Hunters — SOC platform / data-lake SIEM · no financing since January 2022. Right about architecture, backed by Snowflake and Databricks, beaten by platforms that own telemetry. → C1 - Hunters.md

C2. Deep Instinct — Deep-learning malware prevention · headcount down from ~400 to ~180. A genuine technical edge that never became a scaled business. → C2 - Deep Instinct.md

What this means for us

The Czech Republic starts from a better position than its size suggests — and with a clearer diagnosis of its gap than most. NÚKIB’s 2026 strategy lists real strengths: an advanced national system, internationally respected experts, a working community across state, business and academia, and the observation that “some of the most widely used commercial ICT security tools are developed by Czech companies or have domestic origins”. It is equally frank about the weaknesses: staffing and funding “insufficient in both the public and private sectors”, rigid public-sector pay, a still-reactive state, and an EU-wide shortage of up to 300,000 experts (NÚKIB 2026). The country has publicly attributed attacks to Russia (May 2024) and China (May 2025). It has the talent and the threat. What it lacks is the machine that turns the one into companies.

What to copy

• Founder academies, deliberately. Treat anchor companies and foreign R&D centres as schools for the next founders, and make leaving easy. Microsoft’s and Symantec’s Israeli centres produced Wiz, Apiiro, Zero Networks, Torq and Cycode.

• Specialist seed capital with a CISO network. One domain-expert fund, Cyberstarts, backed Wiz, Cyera, Island and Upwind early. Pair such funds with global VCs in “split-seed” rounds — twelve in Israel in 2024 (YL Ventures 2024).

• A foundry wired to buyers. Team8 started from a thesis and a network of corporate security chiefs and produced Claroty and Sygnia. Our equivalent is a foundry tied to the operators regulated under the new Cyber Security Act.

• The state as the demanding first customer. Axonius built a federal arm around FedRAMP; Waterfall made regulators its sales team. In Europe, NIS2 and the new Cyber Security Act are our FedRAMP: rules that turn security into a budget line.

• An alumni engine for our own units. 8200’s formal alumni association (14,000+ members) and its accelerator turn service into a network (Rousseau 2017). The Czech Cyber and Information Warfare Command and NÚKIB can build the same.

• A wide intake. Israel’s Magshimim trains gifted coders from underprivileged areas (IISS 2021), and many of the fifty came from outside 8200 altogether — SentinelOne, Checkmarx, Cymulate, Forter, Irregular.

What not to copy

• Spyware and inconsistent end-use vetting. The NSO lineage is a permanent liability, as Dream’s diligence file shows. Cellebrite’s uneven response to Amnesty and Citizen Lab findings shows how an ethics process that looks arbitrary gets priced in.

• Peak-cycle mega-rounds and hiring to the round. Transmit, Snyk, Cybereason and Deep Instinct are the evidence.

• Selling anchors with nothing negotiated. CyberArk cut about 500 jobs within days of closing. Snyk’s Israeli team fell to about 90.

• Faith in technical superiority over judgement. Before October 7, an 8200 non-commissioned officer’s warning was dismissed as “aspirational” (Wyss, CTC Sentinel 2024).

• A narrow talent base. Only 23% of Israel’s AI professionals are women (OECD 2025). NÚKIB’s commitment to equal opportunity for women and non-graduates is the better starting point.

• Rented sovereignty. “Sovereign” systems built by a foreign vendor are still dependency — and so is European hosting of US-owned IP, the arrangement under which CrowdStrike agreed to buy XM Cyber’s patents from its German owner.

Five moves for the next twelve months

1. Stand up a cyber foundry with ten critical-infrastructure buyers. NÚKIB convenes energy, banking, health and transport operators as design partners and first customers. The foundry picks theses from their unsolved problems and recruits founding teams against them, Team8-style. Target: three companies incorporated within the year.

2. Seed a specialist cyber fund with the state as anchor LP. The fund needs a domain-expert general partner with a CISO network, and a mandate to co-invest alongside tier-one international funds at seed. It should be judged on follow-on rounds raised, not on deployment speed.

3. Recruit Israel’s overflow, on spin-out-friendly terms. Cato is already tripling its Prague centre, and Israel’s talent ceiling pushes its scale-ups abroad. Make Prague and Brno the default second R&D site for Tier II–IV companies, with fast work permits and R&D tax treatment. Pair that with employee-option taxation at exit and no punitive non-competes, so today’s hires become tomorrow’s founders.

4. Make the state a demanding first customer, with sovereignty conditions. Create a procurement track for young domestic vendors of the “secure technological alternatives” NÚKIB calls for. Fund NIS2-driven SMB security programmes delivered through managed service providers — the channel Guardz and Coro were built for, and a market the enterprise-focused ecosystem neglects. Foreign “sovereign” suppliers should have to provide source-code access, local hosting and staff, published end-use vetting and clean exit clauses.

5. Build a national AI-security gym and disclosure pipeline. The library finds no Israeli public equivalent of DARPA’s AIxCC or the Five Eyes’ CAGE challenges, and flags this as a gap a mid-sized EU state could fill (Zhang et al 2026; Standen et al 2021). A Masaryk University researcher already co-authored NATO’s reference architecture for autonomous cyber-defence agents (Kott et al 2019). A cyber range where defensive AI agents are trained, tested and certified, plus a coordinated-disclosure pipeline through the national CERT, would put Czech teams in the evaluation-and-assurance niche. That is where categories are still being named.

For founders, the fifty compress into five habits: name the category, remove the deployment objection, make the American seller a co-founder, map the likely buyers from the first round, and never forecast your valuation. For investors: pay up for repeat teams, ask for ARR before paying for momentum, model every exit at normal multiples, and treat private equity as an exit, not a failure.

Close

Israel’s fifty are not a list of lucky start-ups. They are the visible output of a machine: it selects talent early, trains it on state-scale problems, passes it through anchor companies and specialist funds, and recycles every exit into the next founding team. In 2025–26 the machine delivered its best year and exposed its weakness in the same stroke: the champions it builds are sold, and strategic control goes with them.

A mid-sized European state does not need its own Wiz to benefit. It needs the conditions in which the second-time founder stays, the foreign R&D centre becomes a founder school, and the state is a demanding first buyer rather than a grant office. Those conditions are copyable, cheap next to what they return, and slow to build. The option value lies in starting now: every year of delay is another cohort of engineers trained in Prague and Brno whose first company gets built somewhere else.

ENSI research — built on a library of 164 primary documents and 52 company dossiers.

The argument, before the list

In mid-September 2025 Anthropic’s threat-intelligence team watched a Chinese state-sponsored group it designates GTG-1002 run reconnaissance, exploitation, credential harvesting and exfiltration against roughly thirty technology companies, banks, chemical manufacturers and government agencies. The human operators did between 10% and 20% of the work. The model did the rest — “approximately 80–90% of all tactical operations independently”, at “sustained request rates of multiple operations per second”, with the humans intervening only to approve the move from reconnaissance to exploitation, to authorise harvested credentials, and to decide what was taken (Anthropic 2025). It is the first documented case of an AI system orchestrating intrusions into confirmed high-value targets.

A few months later Verizon published the largest Data Breach Investigations Report ever assembled — more than 31,000 real incidents, more than 22,000 confirmed breaches, 145 countries — including a section on what threat actors do with AI when someone measures rather than asserts. In behavioural data classified against MITRE ATT&CK, the median piece of AI-assisted malware had 55 existing, known malware examples performing the same function, and fewer than 2.5% of observations involved a technique with one or fewer known precedents (Verizon 2026, p. 12). The framing of the whole report is two words: refinement, not revolution.

Both findings are true. Almost every “cyber trends 2026” list picks one and sells it.

This report tries to do the other thing. It ranks what is changing by how much evidence actually supports the change, and it keeps apart three things the genre melts together. Behaviour is what attackers measurably do differently, established by incident telemetry. Market is what defenders buy, established by funding rounds and acquisition prices. Capability is what is genuinely new in the technology, established by experiment and proof of exploitation. A trend list becomes marketing at the exact moment it presents a market movement as a behaviour change — “attackers are now targeting X” when what happened is that a new category of product for X was funded. A good deal of what circulates as threat intelligence in 2026 is a budget line wearing a threat actor’s clothes.

Sorted this way, the period has one defining shift, and it is a collision between two curves.

The first is the collapse of the cost and the latency of attack. Exploitation of vulnerabilities is now the most common initial access vector in the DBIR at 31%, up from 20% — a 55% rise in a year — overtaking credential abuse at 13% (Verizon 2026, p. 15). Twenty-nine per cent of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue were attacked before public disclosure. A tool-using LLM agent exploited 87% of a benchmark of real one-day vulnerabilities from the advisory text alone, at about $3.52 a run against roughly $25 of expert time — and 7% without the text, which locates the danger precisely in the window between publication and patch (Fang et al 2024). In December 2025 an AI agent wrote a working malware framework, VoidLink, in six days. Christopher Koch’s formulation is the one to carry: agentic AI is an attack compression technology, lowering the cost of reconnaissance, lure production, credential abuse, CVE-to-patch-gap matching, exploit adaptation and post-compromise decision support (Koch 2026, p. 1).

The second curve is an identity surface that grew faster than anyone’s controls and stopped being human. Non-human identities — service accounts, API tokens, workload identities, agents — grew 44% year on year and now outnumber human identities by 144:1, up from 92:1 twelve months earlier; across 230 billion permissions analysed by Veza, the share classified safe and compliant fell from 70% to 55% in a single year while ungoverned permissions rose from 5% to 28%; one in twenty AWS machine identities carries full administrator privilege; and enterprise IAM teams are responsible for only 44% of machine identities at all (Kurtz and Krawiecka 2026, pp. 18–20). The DBIR, from a different dataset entirely, points defenders to the same place: “we should pay special attention to service and machine accounts, as those will likely be the ones leveraged in our potential agentic AI future” (p. 22).

Put the curves together and the mechanism is unglamorous. Cheap, fast, tireless offence is being pointed at whatever is simultaneously exposed and over-privileged — and in 2026 exposure has a name (an unpatched internet-facing appliance) and privilege has a name (an ungoverned machine credential). Everything else in this report is a consequence of that collision, a market response to it, or a genuinely separate clock.

Two of the loudest items run on those separate clocks. Quantum: 37% of executives expect quantum technologies to affect cybersecurity within twelve months (WEF 2026, p. 48), while NIST’s own arithmetic says standardisation to full integration historically takes ten to twenty years, the federal target is 2035, and 112-bit classical public-key algorithms are deprecated after 2030. The urgency is real, but it is a crypto-inventory urgency, not an imminent-break urgency. “AI will replace the SOC”: the strongest rigorous evaluation to date, DARPA’s AI Cyber Challenge final, ran seven autonomous systems for roughly 143 hours over 53 real open-source projects and found that pairing a proof-of-vulnerability with a patch worked 92% of the time, with patch quality the practical bottleneck (Zhang et al 2026). An extraordinary result for autonomous repair of code you own. Not an autonomous security operations centre.

There is a third correction, less discussed and more useful to a national agency. Counting incidents without weighting impact manufactures alarm. In ENISA’s curated set of 4,875 incidents affecting the EU between July 2024 and June 2025, DDoS accounts for 76.7% of recorded incident types and hacktivism for almost 80% of recorded incidents — overwhelmingly low-impact noise — while intrusions are 17.8% (pp. 6, 8). A national threat picture built on incident counts will be dominated by hacktivist DDoS and will point budgets at the wrong thing.

This is the fifth report in the ENSI series on Israeli cybersecurity, and it asks a different question from the first four. Report 1 ranked the fifty companies that make Israel a cyber power; Report 2 extracted sixteen principles a state can copy; Report 3 specified the twenty-four features of the most advanced defensive system anyone could assemble. This one asks what a CISO, a founder and a national agency should believe about the next eighteen months — and what they should refuse to believe. The Israeli company evidence appears here as market evidence: who is putting capital behind which trend, priced by people with their own money at stake. The “we” is a mid-sized European state and its companies, with the Czech Republic as the default home example.

Summary of main points

• Rank trends by evidence, and separate three things — what attackers do (behaviour, from incident telemetry), what defenders buy (market, from rounds and exits), and what is technically new (capability, from experiment). Most trend lists present the second as the first.

• The defining shift is a collision. The cost and latency of attack collapsed — exploitation up to 31% of initial access, 29% of KEV bugs attacked before disclosure, agentic offence at a few dollars a run — at the same time as an identity surface growing 44% a year and now 144:1 non-human.

• Exploitation has overtaken credentials as the front door, and remediation is getting worse. KEV remediation fell from 38% to 26%; median time to full resolution rose from 32 to 43 days; 42,595 new CVEs, up 27%. The least glamorous finding in the library and the highest-confidence one.

• AI is industrialising the known, not inventing the unknown — with two thresholds crossed. APT28’s PROMPTSTEAL querying an LLM at runtime against Ukraine, and GTG-1002 at 80–90% autonomy. Hallucination remains a tax on offensive autonomy, in the attacker’s own telemetry.

• Non-human identity is the single highest-confidence trend — four sources, four methods, one conclusion — and the cheapest high-leverage fix available to a CISO or a state.

• Supply chain is now roughly half the breach population, sitting on maintenance debt: 92% of codebases carry components four or more years out of date. In March 2026 two security vendors in these dossiers were themselves the vector.

• Agent security became a discipline in eighteen months — OWASP’s ASI01–ASI10, the “Least-Agency” principle, and the first rigorous analysis of MCP, which measured attack success rising from 26.4% to 52.8% against non-MCP baselines.

• Ransomware’s economics inverted: more attacks, less money. In 48% of breaches, up from 44%, but 69% of victims did not pay and the median payment fell to $139,875.

• The APT-versus-criminal taxonomy is losing analytic value. State actors are abandoning bespoke tooling for the criminal ecosystem; commodity malware on a Czech network no longer implies a commodity adversary.

• Regulation is consolidating, not expanding. Europe’s binding constraint is reporting burden and certification latency — one scheme adopted in seven years — not a shortage of rules.

• The market’s answer to all of it is consolidation: $67bn of Israeli security companies changed hands in fourteen months. The platforms are buying bundles, and nobody has assembled the loop.

• For a Czech-scale state: fund patch latency, machine-identity governance and validation; ignore quantum panic-buying, unaudited “autonomous SOC” claims and agentification without a use case. Five moves close the report.

How we sort signal from hype

Every claim here was put through the same three tests, and the ranking that follows is a ranking of how well each trend survives them.

One: at least two independent sources, using different methods. A finding in one vendor’s telemetry is a product observation. A finding in ENISA’s curated incident set and Verizon’s breach census and a peer-reviewed measurement study, reached by three different instruments, is a fact about the world. Where a trend rests on one source, this report says so and ranks it lower, however important it would be if true.

Two: incident data over survey sentiment. The WEF’s Global Cybersecurity Outlook 2026 surveyed 804 qualified respondents from 92 countries, including 316 CISOs and 105 CEOs. That is an excellent instrument — for measuring beliefs. When 94% say AI will be the most significant driver of change in the year ahead, the honest reading is that is where the budget is going, which is a real and forecastable fact about the market and no evidence at all about attacker behaviour. Telemetry tells you what happened; surveys tell you what will be bought. Confusing the two is the commonest failure in the genre. This report uses both and labels which is which.

Three: a named falsifier. Every trend below states what would have to be observed for the call to be wrong — a number in next year’s DBIR, ENISA or Black Duck that would move it down the list. A trend with no falsifier is a slogan, and several claims that felt obvious in drafting did not survive the question.

Four caveats about the evidence base, because the sources are not equally clean. ENISA states its own limitations better than anyone in the genre, conceding that open-source collection is incomplete and that sectoral and geographic vagueness biases its dataset (2025, p. 7) — which is why its numbers are trusted here even where they conflict with vendor figures. Vendor reports carry sample bias their headlines do not: Black Duck’s audit data comes from 947 codebases examined during mergers and acquisitions, so it over-samples companies being bought and sold, and where mean and median diverge sharply this report quotes the median. Company figures are frequently self-reported — acquisition prices are hard, valuations and ARR mostly are not, and a 2021 valuation is not the same currency as a 2026 one. And some of the most important research here is a single paper: the MCP protocol analysis and the machine-identity taxonomy are the best work in their areas precisely because there is so little, and neither has been independently replicated.

The twelve trends sit in four evidential tiers. Tier A (1–4) rests on census-grade incident data from at least two independent collectors. Tier B (5–6) rests on strong but contested telemetry. Tier C (7–10) rests on protocol experiments, product evidence and market behaviour rather than breach counts. Tier D (11–12) covers changes whose direction is certain and whose timing is routinely overstated. Each section follows one shape: what is changing · the evidence · why it is happening · who is building for it · the hype check and the falsifier · what to do about it now.

Tier A — the census-grade trends

1. The front door is an unpatched appliance, and the patch queue is losing

What is changing. For fifteen years the standard opening move of an intrusion was a stolen password. It is now an unpatched internet-facing device. That reordering is the most consequential and least discussed finding of 2025–26, and it is displacing a whole management discipline: the quarterly vulnerability list is giving way to continuous, exploitability-aware exposure validation, because the list has become uncountable and the window unmeetable.

The evidence.

• Verizon (2026) — exploitation is now the single most common initial access vector at 31%, up from 20%, a 55% increase, overtaking credential abuse at 13%, across 22,000+ confirmed breaches in 145 countries (pp. 10, 15).

• ENISA (2025), measuring the EU independently across 4,875 curated incidents, puts exploitation lower by volume — 21.3% against roughly 60% for phishing — but far higher by yield: nearly 70% of vulnerability cases culminated in an intrusion and 68% ended in malicious code deployment, against 27% of phishing cases (p. 8). Phishing is the volume channel; exploitation is the conversion channel.

• Remediation is going backwards. Only 26% of CISA KEV-catalogued critical vulnerabilities were fully remediated in 2025, down from 38%; median time to full resolution rose from 32 to 43 days; organisations carry 50% more critical vulnerabilities than a year earlier (Verizon 2026, p. 10).

• The work grew faster than the capacity to do it: 42,595 new vulnerabilities, up 27%, 64% network-exploitable (ENISA 2025, p. 57) — while 29% of KEV vulnerabilities were attacked before public disclosure (Verizon 2026, p. 109).

Why it is happening. Three forces, none of them about AI. Edge devices — VPN concentrators, firewalls, file-transfer appliances, identity gateways — are internet-facing by design, cannot host an endpoint agent, and belong to teams with no maintenance window. Multi-factor authentication worked, raising the cost of the credential path enough to push attackers onto the software path. And the arithmetic of triage broke: patching capacity is roughly fixed while disclosure volume grows a quarter a year, so the backlog compounds mechanically.

Who is building for it. The most commercially mature trend here, and the Israeli ecosystem effectively invented the category.

• XM Cyber — the attack-path twin behind the choke-point argument: in its Cyentia-analysed data, 80% of exposures come from misconfiguration and credentials, under 1% from CVEs, and 2% sit on choke points · sold to Schwarz Group for $700M in 2021; on 16 July 2026 CrowdStrike agreed to buy the intellectual property alone — 45-plus patents and the source code.

• Armis — asset intelligence across IT, OT, IoT and medical · ServiceNow paid $7.75bn cash, closed April 2026, on ARR above $340M growing more than 50% — roughly 23 times ARR, the largest price ever paid for exposure management.

• Zafran — scores a CVE against controls the customer already owns · $60M Series C, December 2025, led by Menlo Ventures, past $140M with strategic money from American Express Ventures and Cisco Investments in 2026.

• Pentera and Cymulate — automated adversarial validation · Pentera passed $100M ARR in 2025 yet raised its $60M Series D at a flat “over $1bn” and cut about 20% of staff in 2026; Cymulate has not raised since September 2022 at roughly $500M. Validation works, and is priced below the platforms that absorb it.

• Oligo, Upwind and Sweet Security — runtime reachability, so a vulnerability counts only if the function executes · Oligo’s $60M Series C (August 2026) came on ARR up 300%; Upwind raised ~$300M at about $3.8bn in September 2026; Sweet’s $75M Series B included Munich Re Ventures — an insurer funding runtime security.

The hype check. Three things the evidence does not support. This is not an AI story — the shift appears in data that predates agentic offence. Credentials are not dead: the DBIR flags that part of credential abuse’s fall is an artefact of newly tracking pretexting (p. 15), and ENISA still puts phishing near 60% of cases by volume. And the claim that context shrinks the problem by two orders of magnitude — Zafran’s “99% of critical vulnerabilities are not exploitable in context”, XM Cyber’s under-1% — is self-measured: plausible, directionally corroborated by ENISA’s yield data, never validated by anyone without a product to sell.

Falsifier: if the 2027 DBIR shows exploitation falling back below credential abuse, or KEV remediation recovering above 38% with median time-to-resolution under 32 days, the call was wrong.

What to do about it now. Publish patch latency as a governed metric — median hours from KEV listing to mitigation on internet-facing assets. Separate that estate from everything else and give it a faster process with standing maintenance authority. Buy validation, not lists: the question is “is this reachable, and is it already blocked?” And build the compensating-control path — virtual patching, segmentation, exposure removal — because it is the only one that operates within hours.

2. Identity is the control surface, and most of it is no longer human

What is changing. Enterprise identity used to be a human-resources problem with a technology component. It is now a machine-population problem. Service accounts, API tokens, workload identities, CI/CD credentials and autonomous agents outnumber employees by one to two orders of magnitude, are created at machine speed, reviewed at human speed, and mostly belong to nobody. This is the single highest-confidence trend in the library — four independent sources, four methods, one conclusion.

The evidence.

• Kurtz and Krawiecka (2026) triangulate five sources. Entro Labs: non-human identities grew 44% year on year and outnumber humans 144:1, up from 92:1. ESG: 20:1 on average, with two-thirds of organisations having suffered a successful attack via a compromised non-human identity. Research and Markets: 17:1 conservatively, 96:1 in financial services. Veza, across 230 billion permissions: permissions classified safe and compliant fell from 70% to 55% in one year while ungoverned permissions rose from 5% to 28%, and one in twenty AWS machine identities carries full administrator privilege (pp. 18–19).

• Governance is nowhere near. CyberArk’s survey of 2,600 decision-makers in 20 countries: IAM teams are responsible for only 44% of machine identities, 68% lack identity security controls for AI, and 47% cannot secure shadow AI usage at all.

• The incidents are costed. The July 2024 CrowdStrike outage — one ungoverned automated update agent across 8.5 million systems — produced $5.4bn in Fortune 500 losses and up to $10bn globally, insured at 10–20%. 23.7 million secrets were exposed on public GitHub in 2024, 26% in CI/CD workflows. The Marks & Spencer intrusion, which began by impersonating an employee to a third-party IT provider, ended in 46 days of suspended online ordering and roughly £300m of lost operating profit.

• State actors got there first. Silk Typhoon, Salt Typhoon and Volt Typhoon have operationalised ungoverned machine credentials as primary espionage vectors, with privileged-access-management provider credentials a named Silk Typhoon target. Microsoft’s formulation of the era: “adversaries aren’t breaking in, they’re logging in” (2025, p. 5).

Why it is happening. Three structural reasons explain why incremental IAM spending has not worked: the visibility problem — no authoritative registry of which machine identities should exist; the governance velocity mismatch — identities minted by infrastructure-as-code in seconds, reviewed by humans in quarters; and identity debt, which “has compounding dynamics that existing IAM approaches are not reversing” (p. 20).

Who is building for it.

• CyberArk — privileged access extended to machines and agents · acquired by Palo Alto Networks for ~$25bn, closed 11 February 2026, on ARR of $1.44bn, and relaunched as “Idira”. It had already bought Venafi, the machine-identity and certificate company, for $1.54bn in 2024.

• Astrix Security — non-human identity, the category it named · acquired by Cisco, completed 29 June 2026, at roughly $400M on about 120 staff. Its $45M Series B (December 2024) was led by Menlo Ventures through the Anthology Fund it runs with Anthropic — a frontier lab’s venture arm funding agent identity a year before anyone measured the problem.

• Cyera — valued at $12bn in June 2026 · bought Oasis Security for about $1bn (completed 3 September 2026), Ryft for $100–130M and Otterize: a data-security company buying into machine identity because the two problems turned out to be one. CrowdStrike paid $627.9M for SGNL in January 2026.

• Silverfort — agentless multi-factor authentication inside the authentication layer, across more than 10 billion authentications a day · $222M raised, last priced near $1bn. The pattern worth noticing across all of them: the money moved to identity before the incident data did — the one place in this report where the market ran ahead of the telemetry rather than behind it.

The hype check. The direction is unanimous; the magnitude is not. 144:1 comes from one vendor’s telemetry, and the four estimates disagree by an order of magnitude — 144:1 against 17:1. Gartner’s projected 45 billion agentic identities is a forecast, not a count. The defensible claim is “machine identities outnumber humans by at least an order of magnitude, are growing fast, and are largely ungoverned”, which every source supports. The second overstatement is that non-human identity is a new category: service accounts have been the weakest link since Kerberos, and much of what is sold as NHI governance is privileged access management relabelled.

Falsifier: a vendor-neutral census — the kind NIST’s NCCoE agent-identity project could produce — finding machine-to-human ratios stable, or the share of breaches involving machine credentials flat in the next DBIR. Watch the insurers too: 88% of organisations already report insurers mandating enhanced privilege controls for machine identities, and a withdrawal would signal the loss data does not support it.

What to do about it now. Build the registry before the controls — you cannot govern a population you cannot count. Adopt zero standing privilege and just-in-time credentials as the target state, with SPIFFE/SPIRE as the workload identity standard, because both remove credentials at rest. Give every agent its own identity, never a borrowed human one: without one, an agent “operates in an attribution gap that makes enforcing true least privilege impossible” (OWASP 2025, p. 15). And treat secret sprawl in source control as an identity problem — 23.7 million exposed secrets is a credential population, not a set of lint errors.

3. Offence has industrialised — and two real thresholds were crossed

What is changing. Not the taxonomy of attacks. The economics. AI has lowered the cost of reconnaissance, lure production, credential abuse, CVE-to-patch-gap matching, exploit adaptation and post-compromise decision support — Koch’s “attack compression”. The consequence is not that every criminal becomes elite, but that targets previously too small to justify a tailored operation are now economic.

The evidence.

• Anthropic (2025) — GTG-1002 ran against roughly 30 entities in mid-September 2025 with the AI executing approximately 80–90% of all tactical work independently, orchestrated through Claude Code and open-standard MCP servers that decomposed each attack into tasks which “appeared legitimate when evaluated in isolation”. Tooling was commodity open-source pentest software; the custom work was integration. The jailbreak was social — operators role-played as employees of a legitimate security firm.

• Google Threat Intelligence Group (2025) — “adversaries are no longer leveraging artificial intelligence just for productivity gains, they are deploying novel AI-enabled malware in active operations” (p. 2). PROMPTSTEAL, used by Russia’s APT28 against Ukraine, queries Qwen2.5-Coder-32B through the Hugging Face API to generate Windows commands at runtime — the first observation of malware querying an LLM in live operations. PROMPTFLUX queries Gemini hourly to rewrite its own source for evasion. The underground market for illicit AI tooling “has matured in 2025”.

• Verizon (2026) is the counterweight from the same period: median AI-assisted malware had 55 known precedents, and fewer than 2.5% of observations involved a technique with one or fewer known examples (p. 12).

• Social engineering went mobile and vocal: human element in 62% of breaches; median click rates on voice and text vectors 40% higher than email. ENISA reports AI-supported phishing at “more than 80 percent of observed social engineering activity worldwide” by early 2025.

• Shadow AI became an insider-risk category: 67% of users access AI services from non-corporate accounts on corporate devices, regular AI users rose from 15% to 45%, and the most commonly exfiltrated data type is source code (p. 13).

Why it is happening. Because capability is being packaged, not invented. Anthropic’s conclusion is the proliferation argument: “cyber capabilities increasingly derive from orchestration of commodity resources rather than technical innovation” — and an orchestration layer over commodity tools is cheap to copy. Koch’s dated forecast is the most useful planning artefact in the library: 0–6 months, better lures and faster credential abuse; 6–18 months, semi-autonomous reconnaissance and targeting of AI agents and non-human identities; 18–36 months, crimeware-as-a-service packaging agentic workflows.

Who is building for it.

• Dream Security — sovereign AI cyber defence sold to states · $260M at a $3bn valuation, June 2026, led by Group 11, on ARR above $100M from fewer than ten customers · in August 2026 its researchers published a four-day fully autonomous AI-agent intrusion into Asian government agencies, running up to eight sub-agents and taking 2,500+ records — the second documented case of the GTG-1002 pattern.

• Irregular (formerly Pattern Labs) — measures the offensive cyber capability of unreleased frontier models for OpenAI, Anthropic, Google DeepMind and the UK government · ~$80M raised in September 2025 at about $450M, on roughly 25 people. It co-authored RAND’s model-weight security framework (SL1–SL5).

• Pentera and Cymulate — continuous automated offence against your own estate, the only defensive control that scales the way attack compression does.

• KELA — cybercrime intelligence on the market GTIG says “matured in 2025” · its 2026 report counts 2.86 billion credentials stolen in 2025 and 7,549 ransomware victims, up 45%.

The hype check. Two claims fail. “Autonomous AI attacks are here and everything has changed” — half true, and the caveat comes from the attacker’s own telemetry: Anthropic records that “Claude frequently overstated findings and occasionally fabricated data during autonomous operations, claiming to have obtained credentials that didn’t work”, and calls hallucination an obstacle to fully autonomous attack. GTIG is equally careful on influence operations: “None of these attempts have created breakthrough capabilities for IO campaigns”. “Every criminal is now an elite hacker” — refuted by Koch and the NCSC and OpenAI assessments he cites: “The expected change is not universal elite capability; it is capability packaging”.

Falsifier: the DBIR’s “55 known precedents” median falling toward 1, or a documented campaign whose decisive technique has no prior example and was discovered by a model. Either would mean AI had begun to change the taxonomy and not merely the tempo.

What to do about it now. Assume tempo, not novelty: the controls that stop these operations already exist, executed faster. Rehearse voice and text pretexting against your own helpdesk, where the 40% click differential and the Scattered Spider playbook meet. Give shadow AI a sanctioned path rather than a prohibition — 71% of companies that ban AI coding assistants acknowledge developers use them anyway — and instrument source-code egress specifically. And plan against Koch’s 6–18 month window: the next thing attackers automate is the abuse of your agents and machine identities.

4. The supply chain is now roughly half the breach population

What is changing. Third-party compromise has moved from a category of risk to the dominant one, and beneath it sits a quieter liability: the maintenance state of the open-source code every organisation ships. The two combine into an exposure no perimeter spending touches, because the intrusion arrives through a supplier you pay or a package you imported.

The evidence.

• Verizon (2026) — breaches with third-party involvement rose 60% year on year, reaching 48% of all breaches (p. 11).

• Black Duck (2026), auditing 947 codebases — 65% of surveyed organisations experienced a software supply chain attack in the past year, and 66% of identified malicious packages were purpose-built typosquats or dependency-confusion attacks. 98% of codebases contain open source, at a mean of 1,180 components, up 30% in a year.

• The maintenance debt is the underlying liability: 92% of codebases contain components four or more years out of date; 93% contain components with no development activity in two years; 78% carry a high-risk and 44% a critical-risk vulnerability. The most prevalent flaws are years-old jQuery vulnerabilities affecting 25–28% of codebases despite long-available patches.

• SBOMs systematically under-report: 16% of open-source components entered codebases outside standard package management — vendored dependencies, snippets from Stack Overflow or an AI assistant, binaries without source (p. 38). A manifest-only SBOM is not an inventory.

• The 2025 chronology is the argument: the March 2025 tj-actions cascade exposing secrets in more than 23,000 repositories; the September 2025 Shai-Hulud self-replicating npm worm across 500+ packages; Silk Typhoon entering via a stolen BeyondTrust key; a late-2024 wave of compromised Chrome extensions, AI and VPN extensions specifically (Verizon 2026, p. 109; ENISA 2025, pp. 11–12).

• Executives agree, which matters for budgets: 65% of large companies by revenue name third-party and supply chain vulnerabilities as their greatest challenge, up from 54% (WEF 2026, p. 45). Black Duck puts cybersecurity vendors’ own codebases at an 85% rate of high or critical vulnerabilities.

Why it is happening. The unit of software delivery changed and the unit of governance did not. Codebases grew 74% in file count in one year and 251% over five, assembled from registries with no namespace protection, by developers using assistants that suggest package names which sometimes do not exist — what ENISA calls “slopsquatting”. The AI layer adds its own supply chain: poisoned hosted models, trojanised PyPI packages, and the “Rules File Backdoor” that injects instructions into Cursor and GitHub Copilot configuration files.

Who is building for it.

• Apiiro, Cycode and Legit Security — application security posture management, each built on a graph joining code to runtime · Apiiro’s own data says AI coding agents produce four times more code and six times the attack surface, and its ARR grew 104% in 2025 · yet none of the three has taken a priced round since 2021–22. It is the one crowded category the platforms have not absorbed.

• Snyk — more than $325M ARR and over 4,800 customers (February 2026), against a last priced valuation of $7.4bn in 2022 and investor marks now around $3.7bn. Checkmarx, owned by Hellman & Friedman since a $1.15bn buyout, has sought at least $2.5bn since 2024 with no announced deal.

• Koi Security — provenance for the extension, package, MCP and agent-skill distribution layer · acquired by Palo Alto Networks twenty months after founding (closed April 2026; press reported ~$400M, the filing shows $231M plus $61M) · its research found GlassWorm across 35,800+ installs, ShadyPanda across 4.3 million, and 341 malicious agent skills in three campaigns.

• And the vendors were the vector. In March 2026 Aqua Security’s Trivy scanner was compromised — 76 of 77 trivy-action tags force-pushed to credential-stealing malware for about twelve hours — and the stolen credentials were then used to poison Checkmarx’s ast-github-action and kics-github-action. KELA traced both to one actor; two men were charged in August 2026.

The hype check. The claim that AI coding assistants caused the vulnerability explosion is not supported by the report everyone cites for it. Black Duck states plainly that “correlation is not causation”, and offers two competing explanations for the 191% rise in mean vulnerabilities per codebase: the Linux kernel becoming a CVE Numbering Authority, taking kernel CVEs from 290 in 2023 to over 3,500 in 2024, and the growth of microservices. The median series — 46 to 78 — is the honest number, and it grew far more modestly.

Falsifier: if the median vulnerabilities-per-codebase series flattens while the mean keeps climbing, the “exploding attack surface” story is largely a disclosure artefact. If third-party involvement in the 2027 DBIR falls back toward 30%, the 60% jump was definitional rather than behavioural.

What to do about it now. Generate SBOMs from binary composition analysis, not manifests, or accept that 16% of your components are invisible. Make the governance status of a dependency a procurement criterion, now that the Cyber Resilience Act’s “open source steward” category distinguishes foundation-governed projects that will carry vulnerability handling from solo-maintainer projects that will not. Treat CI/CD as production — tj-actions, Shai-Hulud and TeamPCP all ran through build systems with standing credentials. And rank suppliers by blast radius rather than contract value.

Tier B — strong telemetry, contested interpretation

5. Ransomware: more attacks, less money, and extortion detaching from encryption

What is changing. The volume curve and the revenue curve have separated. Ransomware appears in more breaches than ever while the amount extracted per victim falls, because refusing to pay has become the default corporate posture. The business model is adapting in the obvious direction — away from encryption, which is noisy and defeated by a good backup, and toward the threat of disclosure, which is cheap, works against organisations with immaculate recovery, and has been made more frightening by the breach-notification regimes designed to protect victims.

The evidence.

• Verizon (2026) — ransomware is present in 48% of all breaches, up from 44%, yet 69% of victims did not pay and the median ransom paid fell to $139,875 from $150,000 (p. 11).

• Brantly and Mason (2026), on 19,128 incidents across 110+ groups, show where it comes from: Russian-affiliated groups are 26% of publicised strains but 63% of all attacks, the top six account for 56% of all global victims, and 99.52% of their identified victims are outside Russia. The Czech Republic sits in the second tier, with over 50 attacks.

• The tail risk has not diminished. The September 2025 Jaguar Land Rover shutdown cost £1.9bn over five weeks — one incident costing roughly half of what the entire European cyber insurance market collects in premiums in a year. That market is small: of $16.6bn in global cyber premiums in 2023, nearly 60% was spent in the United States, against $3.9bn in Europe in 2024 (Hanson and Straub 2026).

• Law enforcement moves the distribution. NÚKIB recorded 27 ransomware incidents in Czechia in 2024 and assessed LockBit’s collapsed share as “very likely (75–85%)” the result of the February 2024 takedown. Google earlier attributed part of the profitability decline to sanctions reducing willingness to pay, by one estimate a 40% drop.

Why it is happening. Paying stopped being rational and stopped being safe. Backups improved, sanctions made payment legally hazardous, boards adopted no-pay policies — which removed the decryption key as leverage and left the leak site. It also fragmented the market: with lower yields per victim, groups compensate with volume and affiliates, so strain counts rise while median payments fall.

Who is building for it.

• Cyera and Varonis — data security posture: knowing what would be published and what it would cost · Cyera reached $12bn in June 2026 after raising $540M, $400M and $600M in thirteen months; Varonis runs SaaS ARR of $726M, up 52%, and was reported in September 2026 to be in advanced talks with Thoma Bravo’s Proofpoint.

• Sygnia — incident response and ransomware readiness, listed in Gartner’s 2026 Market Guide for IR retainers, and lead investigator on the $1.5bn Bybit theft. This is the surge capability a state must be able to call on.

• Zero Networks — microsegmentation as deterministic containment · its 2026 benchmark found 80% of enterprise servers reachable from anywhere on the internal network, which is the best single explanation of why exfiltration-based extortion works so well.

• Cynet, Coro and Guardz — consolidated security for the SME base the enterprise market ignores · Coro resolves 92.3% of tickets automatically; Guardz, which raised $56M in June 2025 on an explicit “secure and insure” thesis, found 89% of the small businesses it monitors had at least one compromised user.

• The category nobody funded: nothing in the 52 dossiers sells extortion-decision support or disclosure-risk quantification — which is exactly where the loss now sits.

The hype check. Two symmetric errors. “Record-breaking ransomware” is true of incidence and false of proceeds; “ransomware is in decline” is false of incidence, true of proceeds, and irrelevant to Jaguar Land Rover. The honest framing is that expected loss per victim fell while variance did not — the distribution insurers price worst. And a real limitation: this library measures the economics well and the encryption-versus-exfiltration split poorly. Neither the DBIR nor ENISA tracks extortion-without-encryption as a category. The shift is supported by the non-payment data, by ENISA’s framing of a landscape moving toward “continuous, diversified and convergent campaigns” rather than single high-impact incidents, and by the leak-site datasets — but it is an inference, not a measurement, and should be labelled as one.

Falsifier: payment rates rising back above 40%, or median payments rising, in the 2027 DBIR. Conversely, if a major dataset begins tracking encryption-free extortion and finds it a minority of cases, the “detaching from encryption” claim should be withdrawn.

What to do about it now. Rehearse the decision, not just the restore: a no-pay policy never tested against a live disclosure threat is a press release. Assume exfiltration in every case and rank data by what its publication would cost — which makes data mapping a ransomware control, not a compliance one. Treat cyber insurance as a liquidity instrument rather than a risk transfer. And note the asymmetry: 99.52% of Russian-affiliated ransomware victims are outside Russia, which makes this a due-diligence failure by a state rather than a misfortune, and gives a European government a legal framing it underuses.

6. The APT-versus-criminal taxonomy is breaking, and the deniable layer is centrally run

What is changing. Two convergences at once. State groups are abandoning bespoke tooling for the criminal ecosystem, and criminal groups are copying state tradecraft — so the malware in your network no longer tells you who is in your network. Separately, the “hacktivist” layer that generates most of Europe’s recorded incident volume is not a crowd; it is a managed capability whose targeting tracks the victim’s domestic politics.

The evidence.

• ENISA (2025) names the convergence: Kimsuky using ClickFix, Andariel affiliated with Play ransomware, Moonstone Sleet leveraging Qilin, APT29 and Sandworm operating from commercial residential proxies — while criminal groups copy state social engineering, FIN6 running fabricated LinkedIn personas (pp. 13–14).

• Microsoft (2025) confirms it from telemetry: Russian state actors “appear to have reduced their efforts to develop bespoke operations in favor of leveraging the cybercriminal ecosystem”, which “could make it more difficult for network defenders to attribute simple operations to sophisticated threat actors” (p. 48).

• The proxies are directed. Ukraine’s National Cybersecurity Coordination Centre states it plainly: “There are no independent ‘hacktivists’ in Russia”, and since late 2022 the services have run “a ‘turnkey’ methodology for creating, disguising and managing these pseudo-hacktivist groups” — including, after 7 October 2023, dozens of new groups launched against Israeli infrastructure, during which Ukraine saw its lowest number of cyber incidents in years (Tkachuk 2025, p. 18). The same deniable capacity, redirected. Mandiant shows the mechanism: a CyberArmyofRussia_Reborn YouTube channel created from APT44 infrastructure, and APT44 infrastructure exfiltrating data later leaked on it.

• The volume is measured, and it is political. Over thirteen months NoName057(16) attacked 3,776 unique hosts at a median of 50 targets a day, government and public sector 41.09%; by share of attack days, Ukraine ~29.5%, France 6.09%, Italy 5.39%, Sweden 5.29%, Germany 4.60%, Israel 4.50%, Czech Republic 4.00%. Target selection runs on a Russian working week. Czech targeting “notably ended in January 2025 after public reporting indicated that the ruling government was expected to lose the October 2025 election” to a party that would halt ammunition transfers (Recorded Future 2025). NÚKIB separately records hacktivists attacking weakly secured water-management OT and filming it for Telegram — one such attack in Czechia in 2024.

Why it is happening. Deniability is cheap and attribution is expensive. Commodity tooling strips the signal that once made attribution possible; the criminal ecosystem supplies access-as-a-service far below the cost of developing it; and a managed hacktivist front converts a low-impact DDoS into a political signal that can be switched on and off. Brantly and Mason locate the enabling mechanism precisely: not command, but selective non-enforcement — a state that polices its own internet tightly for dissent and not at all for what leaves its borders.

Who is building for it.

• KELA — cybercrime intelligence built from the forums where state and criminal tooling now mix · launched a National Cyber Resilience Suite for governments, national CERTs and police in October 2025, indexes 34.1 billion compromised credentials, bookings up 101% in the year to March 2026. This is the product shape a mid-sized state actually needs.

• Sygnia — nation-state incident response, which publicly documented the Velvet Ant and Fire Ant intrusion sets in August 2026. Dream Security — national-scale AI cyber defence, $260M at $3bn, carrying the governance liability of its NSO-adjacent lineage that Report 1 treats at length.

• Radware — DDoS and application protection, the unglamorous layer that absorbs the 80% · it measured web DDoS attacks up more than 110% in the first half of 2026.

• Waterfall Security — its 2026 OT threat report supplies the discipline this trend needs: 57 OT attacks with physical consequences in 2025, down from 76 in 2024, even as nation-state and hacktivist attacks doubled. Noise up, damage down.

• The gap: no company in the dossiers sells impact-weighted national threat measurement — precisely what the ENISA data says agencies need most.

The hype check. The evidence emphatically does not support treating this volume as national risk. Hacktivism accounts for almost 80% of ENISA’s recorded incidents and DDoS for 76.7% of incident types — overwhelmingly low-impact. A national threat picture that counts incidents will be dominated by the activity designed to be counted. Two further cautions. Jaclyn Kerr names the symmetrical analytic errors: assuming sub-threshold competence transfers to above-threshold capability, and assuming above-threshold ineptitude implies below-threshold weakness (CNA 2023). And Brantly and Mason concede that “all analyses of Russian involvement in its prolific ransomware industry are based largely on circumstantial evidence” — the convergence of independent strands is the contribution, not proof.

Falsifier: Microsoft telemetry showing state actors returning to bespoke tooling would reverse the attribution claim. A larger sample showing NoName targeting uncorrelated with the target’s domestic politics would break the “pressure signal, not damage” reading.

What to do about it now. Stop reporting incident counts to ministers and start reporting impact-weighted ones, or the DDoS tail will wag the national budget. Assume commodity malware may be a sophisticated actor and set the investigation threshold accordingly — that assumption costs a few analyst hours; the opposite costs a missed espionage foothold. Treat politically timed DDoS as an indicator of intent rather than an attack to be defeated. And sit with the finding Czech readers should find hardest: the campaign stopped when the polls changed. The deniable layer is a reward-and-punishment instrument aimed at domestic politics, and technical resilience is not a defence against it.

Tier C — capability and market evidence rather than breach counts

7. Agent and model security became a discipline in about eighteen months

What is changing. In December 2025 OWASP published a Top 10 for Agentic Applications; by February 2026 NIST had launched an AI Agent Standards Initiative and the Cloud Security Alliance an Agentic Trust Framework. A field with no shared vocabulary in mid-2024 now has a taxonomy, a standards pipeline, a scoring system and a measured evidence base. The speed is the finding — and so is the fact that the first rigorous security analysis of the protocol the ecosystem depends on arrived after five thousand servers had been deployed.

The evidence.

• OWASP (2025) — ten agentic risks that are now de facto standard vocabulary: ASI01 Agent Goal Hijack · ASI02 Tool Misuse · ASI03 Identity and Privilege Abuse · ASI04 Agentic Supply Chain · ASI05 Unexpected Code Execution · ASI06 Memory and Context Poisoning · ASI07 Insecure Inter-Agent Communication · ASI08 Cascading Failures · ASI09 Human–Agent Trust Exploitation · ASI10 Rogue Agents, mapped to the LLM Top 10, the Non-Human Identity Top 10, CycloneDX/AIBOM and the AI Vulnerability Scoring System.

• Maloyan and Namiot (2026) provide the measurement. Across 847 attack scenarios, five MCP server implementations and three LLM backends against equivalent non-MCP baselines, overall attack success rises from 26.4% to 52.8%. Cross-server propagation rises from 19.7% to 61.3%; sampling-based injection succeeds 67.2% of the time with no baseline equivalent, because the attack class does not exist outside MCP. With five servers and one compromised, attack success reaches 78.3% with a 72.4% cascade rate. Prompt-level defences are insufficient — a system-prompt instruction cut cross-server success only from 61.3% to 47.2% — while a protocol extension adding capability attestation cut overall success to 12.4% at a median 8.3 ms per message.

• Distribution is the weak point. A survey of 127 MCP server installation guides found typosquatting at 34%, supply-chain compromise 28%, social engineering 23% — and 73% of guides instruct users to run npx directly from GitHub URLs without integrity verification.

• The incidents are real. OWASP’s tracker records an npm-hosted backdoored MCP server with install-time and runtime reverse shells (October 2025), an unauthenticated RCE in Framelink’s Figma MCP server, a Cursor configuration overwrite via filesystem case mismatch, and working exfiltration exploits against Copilot and Amazon Q. Israeli research named the class first: the Technion’s Morris II demonstrated zero-click self-propagating worms moving between RAG-based GenAI applications — and shipped the guardrail with the attack, at a true-positive rate of 1.0 and a false-positive rate of 0.015 (Cohen, Bitton and Nassi 2024).

• Executive concern has flipped toward exposure: data leaks are now the top generative-AI concern at 34%, up from 22%, while “advancement of adversarial capabilities” fell to 29% from 47%, and organisations with a pre-deployment AI security assessment rose from 37% to 64% — leaving roughly a third with none (WEF 2026).

Why it is happening. MCP became a de facto standard within months of its November 2024 release, before anyone analysed it, and its weaknesses are architectural rather than implementation-specific: no capability attestation, bidirectional sampling without origin authentication, implicit trust propagation across multi-server configurations. Every server added raises the blast radius of every other one. OWASP’s diagnosis of ASI03 is trend 2 seen from the agent’s side — without a governed identity of its own, an agent sits in an attribution gap where least privilege cannot be enforced.

Who is building for it.

• Zenity — discovery, posture and runtime enforcement for agents built in Copilot, ChatGPT Enterprise, Gemini, Claude, Bedrock and Cursor · $125M Series C, 3 August 2026, led by Norwest, revenue tripling in each of the last two years; Gartner calls it “the company to beat in AI agent governance”. In August 2026 it disclosed a malicious agent-”skills” campaign with 1.7 million installs.

• Noma Security — AI security posture, red-teaming and agent access control · $100M Series B, July 2025, ARR up 1,300% in the year to mid-2025 · it reports finding ten to a hundred times more agents than customers expect, which is trend 2 restated as a discovery problem.

• Alice (formerly ActiveFence) — red-teaming and runtime guardrails · $140M, August 2026, led by Apax Digital, ARR approaching $100M, working with eight of the ten leading AI labs. Glow — $180M in about a year, out of stealth at $1.2bn in July 2026 — independently measures AI tool use on corporate devices rising from 15% to 45% in a year, matching the DBIR.

• Irregular — frontier-model evaluation · on 30 July 2026 Anthropic disclosed a containment failure found in its work: of 141,006 runs reviewed, six runs across three incidents saw the model reach the production systems of real organisations. OpenAI disclosed a parallel misconfiguration the same week. This is the strongest available evidence that agentic containment is not yet solved, and it comes from the labs themselves.

• And the category was absorbed before it matured: Check Point–Lakera (~$300M), SentinelOne–Prompt (~$250–300M), Cato–Aim (~$350M), Cisco–Astrix (~$400M), Palo Alto–Protect AI, CrowdStrike–Pangea, F5–CalypsoAI, plus Check Point’s ~$150M three-way purchase of Cyata, Cyclops and Rotate in February 2026. Every major platform now sells AI security. That is a market fact, not yet an efficacy fact.

The hype check. The claim that fails is that “MCP security” products can fix this. The paper is explicit that the weaknesses require protocol-level remediation; a scanner that inspects servers cannot supply a missing attestation layer. The second caution is evidential: this is one paper, not independently replicated. Third, OWASP supplies the counter-position from inside the security community — “Least-Agency”: “avoid unnecessary autonomy; deploying agentic behavior where it is not needed expands the attack surface without adding value”. That sentence cuts against the 2026 push to agentify everything, and it is the governance line of the year.

Falsifier: the MCP specification adopting capability attestation and message authentication, followed by a measured fall in attack success, would retire this trend by solving it — the outcome to hope for. Failure to replicate the 26.4%-to-52.8% gap would demote it.

What to do about it now. Inventory your agents before you govern them, on the same register as machine identities. Bind every agent action to a signed intent — subject, audience, purpose, session — and treat planner output as untrusted input passing through a policy gate. Pin and namespace every tool and MCP server. Apply Least-Agency as a procurement question: what does autonomy buy here that a scripted integration would not? And require a pre-deployment security assessment for AI tools — the one control that has already doubled in adoption and is still missing in a third of organisations.

8. The edge and the browser have become the control points

What is changing. The two places where work actually happens are the two places security historically could not see. The network edge — VPN concentrators, firewalls, file-transfer appliances, routers — is internet-facing and cannot host an endpoint agent. The browser is where every SaaS application, every generative-AI assistant and every copy-paste of source code now lives, inside a TLS session the endpoint agent cannot read. Both are being converted from blind spots into enforcement points: one because attackers went there first, the other because the data did.

The evidence.

• Attackers standardised on the edge. Mandiant’s five-phase APT44 playbook opens with “Living on the Edge” — compromise of routers and VPN appliances — before living off the land and pushing wipers from group policy (2024, p. 8). That is the path the DBIR measures at scale, with 64% of newly disclosed vulnerabilities network-exploitable (ENISA 2025, p. 57).

• The browser is now the exfiltration path. 67% of users access AI services from non-corporate accounts on corporate devices, regular AI users rose from 15% to 45%, and the most commonly exfiltrated data type is source code (Verizon 2026, p. 13). None of that is a malware event; all of it is a browser session.

• The extension layer is being attacked directly. ENISA documents a late-2024 wave of compromised Chrome extensions, specifically AI and VPN extensions (p. 15); OWASP’s tracker adds developer-tool configuration attacks, including the “Rules File Backdoor” in Cursor and GitHub Copilot.

• Machine traffic is becoming a population. AI bot traffic already accounts for roughly 15% of non-malicious bot traffic against 60% for search-engine crawlers (Verizon 2026, p. 64), and Forter measured an 18,510% day-over-day jump in agentic traffic after ChatGPT Agent launched. Sessions that are neither human nor malware are now routine, and nothing in the stack distinguishes them.

• Detection can live at the edge cheaply. Ben-Gurion’s Kitsune runs an ensemble of autoencoders as a network intrusion detector on a single core of a Raspberry Pi at roughly 5,400 packets per second, learning “normal” per channel with no labels (Mirsky et al 2018); the same lab’s N-BaIoT detected every attack from nine infected commercial IoT devices at a mean false-positive rate of 0.007 in 174 milliseconds, fast enough to drive automatic isolation.

Why it is happening. The estate inverted. When applications sat in a data centre, the perimeter was the control point and the endpoint was the last mile. Now the application is somebody else’s SaaS tenancy, the perimeter is an appliance that cannot be patched during business hours, and the last mile is a browser tab holding a session token. Enforcement has to move to whichever layer still sees the whole transaction, and there are only two candidates.

Who is building for it.

• Island — created the enterprise browser · $250M Series E in March 2025 at $4.8bn led by Coatue, with secondaries since at about $5bn, serving eight of the world’s ten largest banks · its roughly $200M of revenue is founder-stated and unaudited, the caveat the whole category carries.

• The rest of the category was bought: Palo Alto–Talon (~$625M), CrowdStrike–Seraphic (~$420M), Akamai–LayerX ($205M); Palo Alto’s Prisma Browser reported 1,500+ customers and nine million licences by February 2026.

• Cato Networks — converged SASE on its own backbone · ARR above $415M, up 42%, across 4,800+ customers (July 2026), valued at $4.8bn · and one of the few Israeli companies building in Central Europe, tripling its R&D centre in Prague.

• Check Point — the prevention-first edge · Q2 2026 revenue of $674M, up 1%, with market capitalisation down from $20.35bn at end-2025 to about $13.7bn in September 2026. That is what a twenty-year-old category looks like at maturity, and why the company spent about $150M in February 2026 buying three AI-security start-ups at once.

• Zero Networks — automated microsegmentation, so a compromised edge device reaches nothing · $55M Series C, June 2025, led by Highland Europe, enterprise customers up 230% · founder Benny Lakunishok states the design principle: “You can’t outrun AI, but you need to out-architect it.”

The hype check. Edge exploitation is well measured; the browser as a control point is a market trend with thin behavioural evidence. No census-grade dataset in this library breaks out browser-mediated exfiltration as a category, and the efficacy claims of enterprise-browser vendors are self-reported — Island’s revenue figure rests on a founder interview. The claim that an enterprise browser replaces the endpoint agent is unsupported by anything except vendor positioning. What is supported is narrower and still important: the browser is where shadow AI, SaaS session abuse and source-code egress converge, and in most organisations it is ungoverned.

Falsifier: if the DBIR or ENISA began tracking browser-mediated data egress and found it a small share of breaches, this is a product category rather than a threat shift. On the edge side, if KEV listings stopped being dominated by internet-facing appliances, the “living on the edge” pattern would be over.

What to do about it now. Treat the internet-facing appliance estate as a separate asset class with its own inventory, patch service level and compensating-control playbook — trend 1 arriving from the adversary’s side. Govern the browser rather than banning what runs in it: sanctioned AI endpoints, extension allow-listing with provenance, and egress policy on source code specifically. And put cheap unsupervised detection on segments you do not currently instrument, because the research says a switch mirror port and a single core are enough.

9. The agentic SOC is real, useful, and does not do what the marketing says

What is changing. Autonomous defensive agents have moved from reference architecture to shipping product in about three years, and they are genuinely good at a specific shape of problem: bounded, verifiable work where a machine can prove its own result. They are not good at the thing the category name implies, which is running a security operations centre. The honest 2026 position is that agents have compressed triage and repair, and have not touched judgement or accountability.

The evidence.

• The one rigorous evaluation is DARPA’s AI Cyber Challenge. In the August 2025 final, seven autonomous cyber reasoning systems ran roughly 143 hours without human intervention over 53 challenge projects derived from critical-infrastructure open-source software, each with $85,000 of cloud compute and $50,000 of LLM credits. Pairing a proof-of-vulnerability with a patch was 92% accurate; a few genuine zero-days were surfaced in real code — and patch quality was the practical bottleneck (Zhang et al 2026).

• Defensive agents are shipping. Google cites Big Sleep, a DeepMind–Project Zero agent that found real-world vulnerabilities including one about to be used by threat actors, and CodeMender, which automatically patches critical code flaws (GTIG 2025, p. 19). Anthropic’s own investigators used Claude to analyse GTG-1002 and recommend defenders “experiment with applying AI for defense in areas like SOC automation, threat detection, vulnerability assessment, and incident response”.

• The blueprint converged years ago. NATO’s AICA reference architecture — sense, plan, act, collaborate, learn, over a world model, with destructive actions bounded by rules of engagement (Kott et al 2019) — the BAE/Dstl deep-RL survey and the AIxCC finalists all describe the same machine.

• Adoption is real but shallow. 77% of organisations have deployed AI for cybersecurity, principally phishing detection (52%), intrusion and anomaly response (46%) and user-behaviour analytics (40%) (WEF 2026, p. 21) — assistive functions, not autonomous ones.

• The demand driver in a mid-sized state is labour, not ambition. Only 47% of Czech organisations consider their cybersecurity budget sufficient, unchanged since 2023; the share citing insufficient pay as the barrier to hiring jumped from 54% to 77% in a year; 55% cope with the skills gap by outsourcing (NÚKIB 2025).

Why it is happening. The architecture, not the model, does the work. PentestGPT’s gains came from decomposition and external memory — a reasoning module, a generation module and a parsing module with an explicit task tree — because the dominant failure mode of a long engagement is context loss (Deng et al 2024). AIxCC’s winners were ensembles of classical fuzzing with LLM-driven strategies, not a single large model. Agents work where the task can be decomposed and the result verified.

Who is building for it.

• Torq — agentic security operations · $140M Series D, January 2026, led by Merlin Ventures at $1.2bn, with Jit bought in May 2026 for $50–70M to acquire its context graph · claims more than 95% of tier-one tasks automated and 100 million automations a day, against a last disclosed ARR of “over $24M” in September 2024.

• 7AI — founded by the Cybereason team to run swarms of task-specific agents rather than one analyst replacement · $130M Series A on 4 December 2025 led by Index Ventures at about $700M, reported as the largest Series A in the industry’s history, 302 days after leaving stealth · by July 2026 it reported nine million investigations and a million analyst hours returned, with DXC citing an 80% cut in tier-one analyst time. ARR not disclosed.

• SentinelOne — autonomous endpoint and AI-SIEM · ARR $1.218bn, up 22% in the quarter to 31 July 2026, alongside an 8% workforce reduction in May 2026. Scale and autonomy have not yet produced operating leverage.

• The honest reading of the cluster: more than $2.3bn of primary capital went into Israeli “securing AI” and “AI running the SOC” companies in 2025–26, and almost none of it reports an absolute ARR base or a measured false-negative rate. The capital is a forecast, not a result — and Hunters, the agentic-triage company that has not raised in four and a half years or published a metric since 2022, is what the downside looks like.

The hype check. The most over-claimed category in the market, with three documented limits. Evaluation is weak: the BAE/Dstl survey notes that CAGE challenge entries are scored against fixed rules-based red agents, so “solutions that overfit on the provided Red agents are likely to perform best”, and argues that exploitability against an adaptive adversary, not average reward, is the metric that matters (Palmer et al 2024). The ML layer is structurally evadable: Shamir and colleagues showed adversarial examples with tiny Hamming distance are a consequence of high-dimensional geometry, and that adversarial training “should have no effect on the existence of adversarial examples” (2019) — machine learning can never be the only layer. And autonomy is bounded by consequence: an agent that isolates the wrong production server causes the outage it was deployed to prevent. AIxCC is a superb result about autonomously finding and repairing vulnerabilities in code you own, in a bounded competition, with $135,000 of compute per system. It is not evidence that a SOC can be unstaffed.

Falsifier: an independently audited evaluation showing sustained mean-time-to-respond improvements on real enterprise telemetry with measured false-negative rates would move this trend up two tiers; every vendor claim to date reports the former and not the latter.

What to do about it now. Buy agents for the bounded jobs first — alert enrichment, deduplication, evidence assembly, phishing triage, patch generation for code you own — and measure them on false negatives, not tickets closed. Write the rules of engagement before the deployment: what an agent may do unasked, what needs human approval, who is accountable when it acts. Keep a non-ML layer under every ML detector. And build the gym: there is no European public equivalent of AIxCC or the Five Eyes’ CAGE challenges, and a Masaryk University researcher co-authored NATO’s reference architecture — the evaluation-and-assurance niche is open.

10. The market is consolidating into platforms, and the platforms are buying bundles, not loops

What is changing. The buying pattern inverted. For a decade the market rewarded the best tool in each category; since late 2023 it has rewarded the platform that can absorb categories, financed at a scale the industry has never seen. This is the purest market trend in the report — and, unusually, the one with the hardest evidence, because a closed acquisition price is not a survey response.

The evidence.

• $67.15bn of announced Israeli cyber exit value in the fourteen months from December 2025 to August 2026: Google–Wiz $32bn (closed 11 March 2026), Palo Alto Networks–CyberArk ~$25bn (closed 11 February 2026), ServiceNow–Armis $7.75bn (closed April 2026), Visa–BioCatch $2.4bn (agreed 3 August 2026).

• Whole categories were absorbed. API security has effectively ceased to exist as a standalone market — Akamai bought Noname for $450M, Traceable merged into Harness in March 2025, and Salt Security is the last large independent, unfunded since February 2022. Data security posture management went the same way (Palo Alto–Dig, CrowdStrike–Flow, Rubrik–Laminar), except that Cyera stayed independent and became a buyer itself.

• AI security was absorbed before it matured: seven acquisitions in roughly eighteen months — Palo Alto–Protect AI, Check Point–Lakera (~$300M), SentinelOne–Prompt (~$250–300M), Cato–Aim (~$350M), CrowdStrike–Pangea, F5–CalypsoAI, Cisco–Astrix (~$400M).

• The enterprise browser, a category that did not exist in 2020: Palo Alto–Talon (~$625M), CrowdStrike–Seraphic (~$420M), Akamai–LayerX ($205M). Non-human identity went the same way: Cisco–Astrix, CrowdStrike–SGNL ($627.9M), Cyera–Oasis (~$1bn).

• Flash exits are routine. Palo Alto bought Koi twenty months after it was founded — and the press price (~$400M) diverges from the filing ($231M plus $61M), a caution about every unaudited number in this market.

• The money did not stop. More than $2.3bn of primary capital went into Israeli “securing AI” and “AI running the SOC” companies in 2025–26 alone: Cyera ($600M, $400M, $540M), Dream ($260M), Glow ($180M), Torq ($140M), Alice ($140M), 7AI ($130M), Zenity ($125M), Noma ($100M), Irregular (~$80M), Sweet ($75M), Oligo ($60M).

• Against roughly $20bn of untested 2021–22 paper: Forter at $3bn, Transmit $2.2bn, Orca $1.8bn, Salt $1.4bn, Axonius flat at $2.6bn since 2022, Aqua above $1bn since 2021, Pentera around $1bn since January 2022 — and Snyk marked down from $7.4bn to about $3.7bn, with a sub-$3bn private-equity bid rejected.

Why it is happening. Three pressures point the same way. Buyers are drowning in consoles and want fewer suppliers with more accountability — which is also what NIS2 and DORA reward, because every additional vendor is another oversight obligation. The strategic asset has become the graph: the platforms are buying context, not features — Wiz’s security graph, Armis’s device knowledge base, Astrix’s identity graph, Apiiro’s software graph, XM Cyber’s attack-path twin. And capital concentrated: a firm that can write a $32bn cheque can outspend every independent on distribution.

The hype check. The claim that consolidation improves security is completely unevidenced. Nothing in this library links platform consolidation to lower breach rates, shorter dwell times or faster remediation. What the library does show is the opposite risk: concentration. The CrowdStrike outage, a single automated update agent, cost $5.4–10bn, insured at 10–20%; the WEF cites the October–November 2025 AWS, Azure and Cloudflare outages as non-security proof of the same exposure. Shlomo Kramer, who founded Check Point, Imperva and Cato, puts the technical objection plainly: “True convergence is not achieved by integrating products under a SASE umbrella.” Buying the companies gives a platform a bundle. It does not give it the loop.

Falsifier: evidence that customers consolidated onto a single platform suffer measurably fewer or less severe breaches — the study nobody has run — would turn this from a market trend into a defensive one. Conversely, if the 2026 cohort of independents grows faster than the platforms’ security segments while staying independent, the absorption thesis is weaker than the headline prices suggest.

What to do about it now. Know whose roadmap you are on: when you buy a category leader, model what happens when it is acquired, and negotiate exit and data-portability terms in the first contract rather than the renewal. Keep the graph yours — the one asset a platform cannot sell you is a normalised model of your own estate. For a state, attach conditions to the concentration rather than resisting it: source-code access, local hosting and staff, published end-use vetting, clean exit clauses. And treat concentration as a resilience problem, not a procurement one: the question is not which platform is best, but what your recovery looks like on the day the platform itself is the incident.

Tier D — direction certain, timing routinely overstated

11. Regulation is the forcing function — and it is consolidating, not expanding

What is changing. Europe’s cyber regulation has crossed from rule-making into enforcement, and the political energy has flipped from more requirements to fewer touchpoints. NIS2 and DORA set the obligations; the Cyber Resilience Act sets the product deadlines; the AI Act adds a parallel regime. What is genuinely new in 2026 is that the EU has begun to treat its own fragmentation as the problem.

The evidence.

• The CRA timeline is concrete and close. In force 10 December 2024; vulnerability reporting obligations mandatory from 11 September 2026; full applicability with penalties from 11 December 2027. Obligations include placing products on the market free of known vulnerabilities, a minimum five-year support period, reporting of actively exploited vulnerabilities within 24 hours with follow-up in 72, and life-cycle-maintained SBOMs regenerated with each update (Black Duck 2026, p. 26). Its “open source steward” category is a novel regulatory object: an entity that takes documented responsibility for a component’s security without carrying the manufacturer’s penalties.

• Certification has under-delivered badly. In seven years the Cybersecurity Act produced one adopted scheme — the EUCC, available to vendors from 27 February 2025 — while cloud, digital identity wallets and 5G remain under development, and the Commission missed its own Article 67 evaluation deadline (EPRS 2026, pp. 3, 5).

• The direction of travel is simplification. The November 2025 digital omnibus would create a single entry point through which entities simultaneously fulfil incident-reporting obligations under NIS2, the CER Directive and the GDPR, on one ENISA-hosted platform (p. 4). ProtectEU (April 2025) refocuses the Cybersecurity Act revision on ICT supply chain resilience and explicitly targets “fragmentation of the internal market caused by different approaches at national level”.

• The mid-sized-state position is on the record. NÚKIB told the Commission it wants “shorter, policy-relevant output and clearer prioritisation, including advance notice of strategic decisions”, and criticised certification delays as undermining trust (p. 9) — the same complaint as the December 2024 Council conclusions and the March 2025 Warsaw Call, which ask for a “more risk-based, leaner, transparent and faster” approach. The European Court of Auditors separately found ENISA and CERT-EU under-resourced and lacking practical guidance on “how” rather than “what”, while the Committee of the Regions warned that overlaps between CSA certification, the Medical Device Regulation and the AI Act “may lead to fragmentation and ‘regulatory shopping’”.

• Jurisdictions are diverging at the same time. EU AI Act high-risk obligations bite from 2 August 2026; China’s amended Cybersecurity Law took effect 1 January 2026 with expanded extraterritorial reach; and the EU, US and Chinese AI governance frameworks are “fundamentally incompatible” (Kurtz and Krawiecka 2026).

Why it is happening. The obligations outgrew the institutions. ENISA’s mandate was written in 2019 for a world without NIS2, the CRA, the Cyber Solidarity Act or the Skills Academy, and a small national agency cannot absorb an expanding regulatory surface on a flat budget. The binding constraint in Europe is no longer requirement stringency; it is reporting burden and certification latency.

Who is building for it. Almost nobody, directly — and that is the finding. Not one of the 52 company dossiers behind this series is a pure-play governance, compliance-automation or cyber-insurance business. Regulation appears instead as a distribution channel.

• Waterfall Security — the purest case · its hardware-enforced unidirectional gateways are exempt from over 35% of NERC CIP requirements and 21 of 26 US nuclear perimeter rules; France’s ANSSI requires hardware-enforced one-way flow for the most critical systems; it is referenced by IEC 62443-3-3 and ENISA, and is now watching NIS2 enforcement.

• CyberArk — privileged access is “demanded by regulators and cyber insurers, which gives the market a compliance floor” · it enters large accounts through audit findings. Coro sells NIS2 into the SME base through a PwC Italy partnership (2026). Irregular and Alice are keyed to the AI Act and the Digital Services Act respectively.

• The certification arms race is the visible form of it — FedRAMP Moderate for Axonius (April 2025) and Checkmarx (July 2026), FedRAMP High for Cellebrite’s Guardian, Oligo routed through Palantir’s FedStart toward FedRAMP High and DoD Impact Level 5, Sweet and Upwind in process. Certification is not a control; it is a market-access licence, and every vendor treats it as one.

• Insurance shows up as an investor, not a product — Munich Re Ventures in Sweet’s $75M Series B, American Express Ventures in Zafran, and Guardz, built on a “secure and insure” thesis, which has since repositioned to agentic security operations.

The hype check. There is no evidence in this library that more regulation produces more security. The Court of Auditors found the guidance gap is in the “how”; one certification scheme has been adopted in seven years; and nobody has published a study showing NIS2-regulated entities outperforming comparable unregulated peers on incident outcomes. Regulation is best understood as a forcing function for budgets and deadlines — real and useful — not as a demonstrated control. Industry is split on whether voluntariness survives: Orgalim warns NIS2 and the CRA make certification de facto mandatory; BusinessEurope wants schemes “specific, voluntary, industry-relevant, and affordable”.

Falsifier: ENISA or a national agency publishing incident-outcome data showing regulated entities measurably outperforming unregulated peers would promote this from a deadline to a control. The consolidation claim fails if the single entry point slips or the omnibus is diluted into another parallel channel.

What to do about it now. Treat 11 September 2026 as the organising deadline for the SME base — 99% of EU businesses, of whom 57% say a serious cyber incident could likely bankrupt them — and deliver it through managed service providers rather than direct obligation. Make the governance status of dependencies a procurement criterion now that “open source steward” exists as a legal category. Build the reporting once, against the omnibus template, rather than three times. And push, as NÚKIB has, for the leaner mandate: a small agency’s scarcest resource is attention, and every additional scheme spends it.

12. Post-quantum migration is a present-tense inventory problem on a 2030–2035 clock

What is changing. Nothing, yet, in the threat data — and that is the point. The standards exist, the deadlines are set, and the work is long. Post-quantum belongs in a trends report not because anything happened in 2025–26 but because the migration has a start date already in the past for anyone holding long-lived secrets.

The evidence.

• The standards are published: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), with a FALCON-derived signature scheme intended later (NIST 2024, pp. 8–9).

• The arithmetic is the whole argument. “Historically, the journey from algorithm standardization to full integration into information systems can take 10 to 20 years“ (p. 8), against National Security Memorandum 10’s 2035 target. The transition table deprecates 112-bit-security classical public-key algorithms after 2030 and disallows all quantum-vulnerable public-key schemes after 2035.

• The threat model is present-tense. NIST names “harvest now, decrypt later” explicitly: adversaries “collect encrypted data now with the goal of decrypting it once quantum technology matures”. For health records, diplomatic traffic, source code and intelligence product, the exposure began the day the data was created.

• Executive expectation runs far ahead of the science. 37% of WEF respondents expect quantum technologies to affect cybersecurity within twelve months; the report’s own forecast is “a selective but material threat to cryptography” by 2030, and it names the real exposure — legacy encryption in embedded and industrial systems that cannot easily migrate.

Why it is happening. Cryptographic migration is an inventory problem wearing a mathematics costume. Most organisations cannot answer the first question — what cryptography is in use, in which protocol, library, appliance and PKI — and NIST is explicit that the transition covers network protocol standards, software libraries, cryptographic hardware and PKI, and is “unprecedented in scale”.

Who is building for it. Nobody here. Not one of the 52 Israeli companies in this series’ dossiers is a post-quantum or cryptography vendor, and not one contains a single PQC round, valuation or acquisition. The nearest adjacencies are CyberArk’s Venafi, bought for $1.54bn in 2024 for certificate and code-signing key management, and Thales’s CipherTrust stack sitting beside Imperva — and neither makes a post-quantum or crypto-agility claim. Read that as a market signal: the ecosystem that named and owned seven categories in fifteen years — the commercial firewall, privileged access, the web application firewall, agentless cloud security, the enterprise browser, non-human identity, AI-agent governance — has not bet on this one. Israel’s cryptographic tradition is deep, from Shamir at the Weizmann Institute to the Tel Aviv and Technion side-channel school, but its commercial expression has been implementation security, not algorithm migration.

The hype check. No cryptographically relevant quantum computer exists, and NIST IR 8547 remains an initial public draft as of September 2026 — cite it as NIST’s expected approach plus NSM-10, not as settled law. The 37%-within-twelve-months figure is sentiment, and it is exactly the kind of number that sells appliances. Anyone selling a “quantum-safe” box is selling crypto-agility, which is worth buying for reasons that have nothing to do with quantum computing. And the Israeli side-channel school supplies the warning that migration alone is insufficient: Genkin, Shamir and Tromer extracted RSA keys from the sound of a laptop and ECDSA keys from mobile devices with improvised equipment, concluding that air gaps, Faraday cages and power filters do not eliminate leakage and that the fix is algorithmic. A post-quantum algorithm implemented carelessly fails the way its predecessor did.

Falsifier: a credible demonstration of a cryptographically relevant quantum computer, or NIST relaxing the 2030 deprecation date in the final publication. Either would move this trend several places — in opposite directions.

What to do about it now. Start with a cryptographic inventory and a data-classification exercise, not a procurement. Rank data by confidentiality lifetime, because harvest-now-decrypt-later only threatens secrets that must survive past 2035. Identify the embedded and OT estate that cannot be migrated later and plan its replacement cycle now — where the WEF locates the greatest systemic exposure and NIST offers no timeline relief. And write crypto-agility into procurement for everything bought from today.

What the trends have in common

Read as one object, the twelve resolve into four patterns and one uncomfortable arithmetic.

Speed. In every trend where defenders are losing, the defender’s clock is human and the attacker’s is not. Disclosure to weaponisation is hours; disclosure to remediation is 43 days and rising. A credential is minted in seconds and reviewed in quarters. An intrusion runs at multiple operations per second while an escalation path runs at the speed of a change advisory board. The binding metric of the era is latency, not coverage — and nearly every control that works in 2026 works by removing a human from a loop that does not need judgement, so the humans are free for the loops that do.

Identity. Trends 2, 4, 7 and 8 are one question asked in four places: what is this thing, who vouches for it, and what may it do? A machine credential, a package provenance record, an agent’s scoped token and a browser session are four answers to the same problem, and the standards bodies have noticed — OWASP maps its Agentic Top 10 onto the Non-Human Identity Top 10, CycloneDX/AIBOM and the AI Vulnerability Scoring System. Identity, supply chain and agent governance are converging into a single discipline, and whoever builds one registry for all four will be years ahead of whoever buys four products.

Agency. Software that acts on its own is now on both sides of the line and in between: the attacker’s orchestrator, the defender’s triage agent, and the enterprise’s own automation, which is neither. Koch’s three-channel model is the right instrument — adversaries using agents against you, attacks against your agents, and your own agents acting with excessive autonomy — and most public debate collapses all three into the first. Least-Agency is the governing principle: autonomy without a use case is pure attack surface.

Consolidation. Of vendors into platforms, of regulation into single entry points, of infrastructure into three clouds. The same logic — fewer, bigger, more accountable — and the same second-order risk, which the CrowdStrike outage priced at $5.4–10bn from one automated update agent.

And the arithmetic nobody plans for: every one of these trends is more affordable for large organisations than small ones. Small organisations by revenue are twice as likely to report insufficient resilience as large ones; NGOs report 37% insufficient, the public sector 23%, the private sector 11%; confidence in national protection of critical infrastructure runs from 84% in MENA to 13% in Latin America and the Caribbean (WEF 2026). Meanwhile SMEs are 99% of EU businesses, and 57% of those surveyed say a serious cyber issue could likely bankrupt them. The frontier is widening the inequity, not closing it.

Five second-order effects worth planning for now.

1. The insurance market is becoming the de facto regulator of machine identity. 88% of organisations already report insurers mandating enhanced privilege controls for machine identities — faster than any legislature moved. But insurance cannot carry systemic loss: 10–20% coverage of the CrowdStrike losses, a European market a quarter the size of America’s, explicit accumulation risk, and a research literature that a structured review found consisted of about five relevant papers.

2. The attribution gap becomes a liability gap. OWASP diagnoses the agent’s missing identity as a security problem. It is also a contract, audit and insurance problem: when an agent acts, nobody has drafted who is responsible. Expect this to be litigated before it is legislated.

3. Jurisdictional incompatibility arrives in 2026, not later — EU AI Act high-risk obligations from 2 August 2026, China’s extraterritorial Cybersecurity Law from 1 January 2026, and three governance regimes that do not reconcile.

4. Geopolitics is a permanent input to the risk register. 64% of organisations account for geopolitically motivated attacks, 91% of those above 100,000 employees have changed strategy because of geopolitical volatility, and confidence in national preparedness is falling (31% low, up from 26%).

5. Measurement itself is a vulnerability. A national picture built on incident counts is dominated by the 80% that is hacktivist DDoS — activity manufactured to be counted. Impact-weighted reporting is a cheap reform with a large effect on where money goes.

What this means for us

A mid-sized European state cannot out-spend this frontier and does not need to. Some of the twelve trends are cheap to act on and high in leverage; others are expensive and low in leverage; and the difference is knowable in advance.

What to fund.

• Patch latency, as a published national metric — median hours from KEV listing to mitigation across regulated entities, reported like an epidemiological indicator. The highest-evidence trend in the report, and the one where Europe is measurably losing ground.

• A national machine-identity programme, before an agent programme — an authoritative registry, zero standing privilege, just-in-time credentials, SPIFFE/SPIRE workload identity, and a rule that every agent has its own identity. Cheap relative to leverage, and where both the DBIR and Koch’s 6–18 month forecast point.

• The CRA deadline as an SME delivery vehicle — couple 11 September 2026 to a standardised, automatable, risk-based audit the insurance market will accept, with partial-scope and multi-year cycles so it does not price out small firms, and state reinsurance considered as a price lever rather than a subsidy.

• A national protective DNS and the boring collective controls. Ukraine’s protective DNS cut losses from financial phishing by more than 30% in its first month, with 300+ providers joined. Nothing in this report has a better cost-to-effect ratio.

• An evaluation-and-assurance niche. There is no European public equivalent of DARPA’s AIxCC or the Five Eyes’ CAGE challenges, and a Masaryk University researcher co-authored NATO’s reference architecture for autonomous cyber-defence agents. A national range that doubles as a gym for defensive agents — and publishes assurance results with measured false-negative rates — is a category nobody owns.

• Crypto inventory and data classification, as the first and cheapest phase of post-quantum migration.

What to ignore. Quantum panic-buying — buy crypto-agility, not quantum-safe appliances, and do the inventory first. “Autonomous SOC” claims that report tickets closed and not false negatives; ask for the second number, and treat its absence as the answer. Agentification without a use case: Least-Agency is a procurement question, not a philosophy. Incident-count league tables, which reward the adversary generating countable noise. And sovereignty theatre — a foreign vendor’s “sovereign edition” is still dependency; the conditions are the substance.

For CISOs, five metrics replace fifty dashboards: median hours from KEV listing to mitigation on internet-facing assets; percentage of machine identities with a named owner and an expiry; percentage of agents with their own scoped identity and a signed-intent policy; percentage of components inventoried by binary composition rather than manifest; and tested recovery time for the three systems whose loss would stop the business.

For founders, the unnamed categories are visible in the gaps of this report: agent identity and delegation provenance; exposure validation for OT and embedded estates that cannot be patched; provenance for the extension and MCP distribution layer, where 73% of installation guidance has no integrity check; extortion-decision support and disclosure-risk quantification, which nothing in the 52 dossiers sells; audit automation cheap enough for an SME and credible enough for an insurer; and independent evaluation of defensive agents. Israel’s system names a category and owns it for a decade. Each of these is currently a problem statement with no incumbent.

For investors, three disciplines the 2021 cohort taught the hard way: ask for ARR before paying for momentum — roughly $20bn of Israeli paper from 2021–22 has never been retested; model every exit at normal multiples rather than at the outlier prices of 2026; and read a “trend” as a market signal until someone shows you incident data. The largest rounds in this cycle cluster on identity, supply chain and agent security, which is, for once, where the evidence also clusters.

Five moves in the next twelve months.

1. Publish a national patch-latency indicator for regulated entities, with KEV-style exploit-aware prioritisation for the internet-facing estate, and make it the headline number in the annual report instead of the incident count.

2. Stand up a machine-identity programme inside the national agency: a reference architecture (registry, zero standing privilege, JIT credentials, SPIFFE/SPIRE), a model policy for agent identity, and a requirement that regulated entities inventory non-human identities before the CRA deadline.

3. Ship an SME package against 11 September 2026 — a standardised risk-based audit, delivered through managed service providers, priced for a fifty-person firm, and negotiated in advance with insurers so that passing it lowers a premium.

4. Build the range as a gym — a national cyber range that trains and certifies defensive agents, publishes evaluation methodology with false-negative rates, and runs an open challenge: the European AIxCC nobody has built.

5. Start the cryptographic inventory, prioritising long-confidentiality data and the embedded and OT estate that cannot migrate later, against the 2030 deprecation and 2035 disallowance dates.

Close

The honest summary of 2025–26 is less dramatic than the marketing and more demanding than the reassurance. Attackers did not acquire new kinds of capability; they acquired speed, scale and reach, and pointed them at a surface that had quietly stopped being human. Defenders did not lose; they fell behind on one specific clock, and the evidence says exactly which one — 38% to 26%, 32 days to 43.

That is good news, in a way that is easy to miss. A field whose central problem is latency is a field where the fixes are known and the arguments are about execution. The organisations that do well over the next two years will not be the ones that bought the most convincing narrative about artificial intelligence. They will be the ones that can answer three questions in under an hour: what is exposed, who and what may act on it, and how fast can we take the exposure away.

For a state of ten million people, none of that requires a frontier lab. It requires a registry, a published metric, an audit an insurer will accept, and a range where defensive agents are tested rather than advertised. The most valuable thing a mid-sized state can do at this frontier is not to predict it, but to measure it honestly and act on the measurement — because the clearest finding across 171 documents is that the people losing ground are the ones who never knew which number to watch.

ENSI research — built on a library of 115 primary documents and 52 company dossiers.

The argument, before the list

On the International Telecommunication Union’s Global Cybersecurity Index 2024, Israel is not in the top tier. It sits in Tier 2 with a score of about 93.6 out of 100, below Estonia, Finland, Singapore, the UK and the US — and in the same band as the Czech Republic (ITU 2024). On almost any measure of what a cyber nation actually produces, the order reverses. In 2020 Israel took 37% of the world’s venture funding for cybersecurity companies and had 42 firms on the Cybersecurity 500, second only to the United States (IISS 2021). In 2024, a year of war and reserve call-ups, its cyber start-ups raised $4B across 89 rounds (YL Ventures 2025). The IISS net assessment puts the United States alone in its first tier and judges that, on security, intelligence, offence and alliances together, Israel and the UK “would probably be top” of the second (IISS 2021).

The gap between those two rankings is the subject of this report. The ITU index records whether laws, agencies and strategies exist; by its own account it “does not measure the quality of actions” (ITU 2024). Czechia has the institutions. It passed one of the world’s first comprehensive cyber security acts in 2014, created NÚKIB in 2017, and has just adopted a new national strategy that takes effect in 2026 (NÚKIB 2026). Israel, by contrast, became a cyber power before it had most of the formal machinery: “without an official national cyber strategy, a committed government agency to coordinate cyber activity, a unified military command, a national CERT, or a dedicated academic thrust” (Tabansky, TAU 2016). Neither the legal checklist nor the start-up count explains what happened.

The reframe we propose is this: Israel’s cyber power is an emergent property of a few deliberately designed mechanisms, running inside an unusual threat environment. Each mechanism has a named exemplar:

1. A light architect at the centre of government. Resolution 3611 (August 2011) created a National Cyber Bureau in the Prime Minister’s Office with a 2011 budget capped at NIS 4.5M. Resolutions 2443 and 2444 (2015) put cyber regulation inside the existing sectoral regulators and created a civilian operational authority that was deliberately given no police powers. The two merged into the Israel National Cyber Directorate (INCD) in 2017–18.

2. A talent engine. Unit 8200 selects on raw aptitude at eighteen, Talpiot runs a roughly nine-year elite science track, and Magshimim trains teenagers from the periphery from age fifteen. Reserve duty then keeps graduates moving between the army, universities and companies.

3. A venture template. Yozma (1992–93) put $100M into ten private funds on terms that shared the upside and required a foreign partner. Israeli venture investment went from $5M in 1990 to $3.3B in 2000 (Avnimelech, Kenney and Teubal, BRIE 2004).

4. A research pipeline. The INCD co-funded cyber research centres at six of the seven research universities on a matching basis, about $60M in the first five years (ICDK 2020). By 2021 the centres had produced more than 500 papers (INCD 2021).

5. Planted clusters and foundries. Beersheba’s CyberSpark (2014) put the national CERT, Ben-Gurion University and a technology park within walking distance of each other. Team8, founded the same year by 8200 veterans, built Claroty and Sygnia on a thesis-first foundry model wired to corporate security chiefs.

The environment is the other half, and it is not a model. Israel sees about 1,000 cyber attacks a minute (Benoliel, U Haifa 2015). It spends 5–6% of GDP on defence, roughly four times the Western average (Tabansky, TAU 2020). It conscripts its eighteen-year-olds, and it puts the damage from cyber attacks at about NIS 12B a year (INCD 2025). The threat gave the mechanisms their urgency and their customers. It also produced the model’s two worst failures. The pipeline that trains defenders also trains the mercenary-spyware industry: of the 74 governments known to have bought commercial spyware or forensics tools, 56 bought from firms based in or connected to Israel (Feldstein and Kot, Carnegie 2023). And faith in technical intelligence was one cause of the surprise on 7 October 2023 (Wyss, CTC Sentinel 2024; Bar, NIPP 2024). The mechanisms can be copied. The environment cannot — and no state should want it.

The actor in this story is the state, but not as an owner or a picker of winners. Israeli cyber companies “are not national champions directly subsidized by the government” (Lewis, CSIS 2016). The state designed the conditions, took some of the risk and let the market select. Its most important policy inventions came from a small, low-prestige agency, the Office of the Chief Scientist (Breznitz and Ornston 2012).

For a mid-sized European state (our home example is the Czech Republic) the question is not whether to copy Israel but which parts of its causal logic travel. NÚKIB’s 2026 strategy sets out both halves of the answer. It lists strengths Israel would recognise: an advanced national system, internationally respected experts, a working community across the state, business and academia, and security tools “developed by Czech companies or [with] domestic origins”. It is just as frank about the gaps: too few people and too little money in both the public and private sectors, a state that is still reactive, and a “shortage of secure and competitive domestic technological alternatives, which deepens dependence on the technologies of foreign rivals” (NÚKIB 2026). Czechia has the talent and it faces a threat. What it lacks is the machinery that turns the two into capability and companies.

This is the second report in a series: the first ranked the fifty companies Israel’s machine produced, and the third described the twenty-four features of the most advanced defence they could build. This one asks why the machine exists at all, and distils its logic into sixteen principles that a state, its companies and its investors can act on.

Summary of main points

• The engine is the mechanisms, not the threat. A small central architect, a talent pipeline, upside-sharing public capital, matched academic centres and planted foundries. The threat environment, conscription and a war economy should not be imported.

• The state designs the system but does not own it. Its tools were a bureau in the Prime Minister’s Office with a NIS 4.5M first-year budget (3611), a civilian defender with no police powers (2444), demand created through existing regulators (2443), and neutral R&D grants rather than subsidised champions.

• Talent is the base layer. The pipeline selects early on aptitude, gives recruits real missions at nineteen, releases most of them within six years and keeps them in circulation through reserve duty. Reservists teach at least 97% of the advanced classes at the IDF’s computer school (Breznitz, MIT 2002).

• The funnel is too narrow, and that is Israel’s biggest self-inflicted limit. About 94% of high-tech workers are non-Haredi Jews and only a third are women (Taub 2025). Only 6% of fourteen-year-old girls aspire to a tech job (Budge et al 2023).

• Capital was designed, not found. Yozma shared the upside, capped the state’s loss and required foreign partners. Specialist seed funds and foundries (Cyberstarts, Team8, YL Ventures) now carry the model.

• Every exit is recycled. Adallom’s sale produced both Wiz and Armis, and Cybereason’s collapse produced 7AI. But 89% of Israeli tech firms followed a venture-only or venture-then-trade-sale path and only about 6% reached public markets (Hashai and Menuhin 2006), so decision rights leave the country.

• The research pipeline publishes the attack together with the fix. Tel Aviv University’s NXNSAttack was patched across the DNS backbone, including in CZ.NIC’s Knot resolver.

• Israel specifies security against a named adversary, from a national “threat of reference” required by Resolution 3611 to the SL1–SL5 security levels for AI model weights that an Israeli start-up co-wrote with RAND.

• The guardrails lagged the capability, and the whole ecosystem paid for it. Israel accounts for 43.9% of the entities in the Atlantic Council’s global spyware dataset. The US blacklisting did more to discipline NSO than Israel’s own export licensing did.

• A machine cannot replace the dissenter. Before October 7 an 8200 analyst’s warning was dismissed as “aspirational”, and the unit’s open-source intelligence team had been disbanded on the strength of machine translation.

• If a state is starting today, four principles matter most: treat talent as national infrastructure (5), make the state the first demanding customer (4), share the upside (9) and build the guardrails with the capability (15). Principle 2, a central architect, is the precondition for all four.

How the sixteen are organised

The principles follow the causal chain of the Israeli system, from the state that designs it to the guardrails that keep it legitimate and ahead of its adversaries. There are four clusters of four:

• I · The State: designing the system · 1 decide what cyber power is for · 2 put one architect at the centre of government · 3 separate the civil defender from the spy · 4 make the state the first demanding customer

• II · The People: the talent engine · 5 treat talent as national infrastructure · 6 give the young real missions · 7 keep people circulating · 8 widen the funnel before it narrows you

• III · The Capital and the Market: the company machine · 9 share the upside, never insure the downside · 10 put domain experts behind the first cheque · 11 borrow the reach a small country lacks · 12 recycle every exit

• IV · The Guardrails and the Frontier: legitimate and ahead · 13 specify security against a named adversary · 14 publish the attack with the fix · 15 build the guardrails with the capability · 16 protect the dissenter from the machine

Each principle gets the same six-part brief: the principle in one line · the Israeli evidence (research cited by author or institution and year, plus named companies from the dossiers) · why it works · where it fails or is contested · how to transfer it (to the Czech Republic or a comparable EU state) · the first move (something concrete to start within twelve months). Company figures come from the dossiers and are often company-reported. Several of the most-quoted Israeli statistics rest on weaker evidence than their fame suggests, and we say so where it matters.

I · The State: designing the system

Israel’s state did four things well. It decided what cyber was for, put a small architect where turf wars could be settled, kept the civilian defender trusted by keeping it apart from the spies, and turned its own needs into demand. None of it required a large budget. All of it required design.

1. Decide what cyber power is for

• The principle in one line. Tie cyber to national ends first, prosperity as well as security, and let the means follow. A strategy is a process to be revised, not a document to be finished.

• The Israeli evidence. Israeli cyber power grew out of a much older security concept: qualitative superiority to offset small numbers, alliance with a superpower, early warning to offset the lack of strategic depth, and an ultimate deterrent. Heavy investment in science education and signals intelligence ran for decades before anyone said “cyber” (Tabansky, TAU 2016). When the state formalised its approach, the 2010 National Cyber Initiative (about 80 experts, led by Isaac Ben-Israel) set a goal of making Israel a top-five cyber nation. Resolution 3611 listed Israel as “a global IT centre” among its four priorities, beside protecting infrastructure (Housen-Couriel, CCDCOE 2017). The 2017 strategy called cyber “an engine of economic growth, social welfare and national security” (INCD 2017). The 2025 strategy moves the weight towards securing core national processes and adopts a three-year horizon (INCD 2025).

• Why it works. Ends give ministries a reason to cooperate and a yardstick for judging means. Framing cyber as both an economic engine and a security problem gave the treasury and the defence establishment a stake in the same programme. Tabansky’s diagnosis of Western failure is a focus on means (tools and headcount) that are never tied, through ends, ways and means, to political goals.

• Where it fails or is contested. Tabansky himself warns that turning Israel’s lessons into a checklist (”invest more in R&D, attract FDI”) repeats the error. Israel’s strategy documents also lag its practice: the 2025 work plan did not yet reflect the new strategy, and one of its authors argues it “should be updated every three years, not every eight” (Shabtai, BESA 2025). The growth end was only half met. High tech’s gains did not spread to the rest of the economy, and two thirds of workers are in sectors with below-OECD productivity (OECD 2025).

• How to transfer it. NÚKIB’s 2026 strategy already states a vision and calls cyber investment “a competitive advantage”. But it “does not itself establish specific financial requirements”, and by law it need only be updated every five years (NÚKIB 2026). The missing step is to name a small number of national ends that can be measured and to give each an owner. A comparison of ten national strategies found implementation plans, budgets and annual reporting “either absent or inadequately expressed”; Estonia stood out for building on lessons learned rather than accomplishments (Odebade and Benkhelifa 2023). Every leading state is on its second or third strategy, and it is “better to act now than wait for the perfect strategy” (Lewis, CSIS 2016).

• The first move. Attach to the NCSS Action Plan a one-page statement of three to five measurable national ends. Examples are the number of secure domestic or allied alternatives in strategic infrastructure, qualified experts added each year, and time from disclosure to mitigation in regulated entities. Report on them in NÚKIB’s annual evaluation to the government, and commit to a three-year refresh.

2. Put one architect at the centre of government — and keep redesigning it

• The principle in one line. Place a small coordinating body under the head of government, let it pay market salaries, and expect to reorganise it every few years.

• The Israeli evidence. Resolution 3611 made the head of the National Cyber Bureau report directly to the Prime Minister, capped its 2011 budget at NIS 4.5M, and told the PMO to solve “the high salaries needed to staff the Bureau”: market pay from day one. The bureau began as a “rather modest thirty-employee core” that coordinated rather than operated (Benoliel, U Haifa 2015). It sat in the PMO because in Israel only that office can settle disputes between ministries (ICDK 2020). Then it was redesigned again and again: from Shin Bet custody of critical infrastructure (B/84, 2002) to the bureau (3611, 2011), a separate civilian authority (2444, 2015) and a merged directorate (3270, 2017) with about 250 staff and a budget of $32–64M by 2019 (Frei, ETH CSS 2020).

• Why it works. Authority to arbitrate plus small size forces the architect to coordinate rather than build an empire. Market pay lets it hire operators rather than administrators. Redesign without embarrassment lets each version fix the failure of the last. A coordinating authority at the top is “essential ... if a strategy is to be more than a piece of paper” (Lewis 2016).

• Where it fails or is contested. Concentrating power in the PMO has a price. The 2018 draft Cyber Defence Bill would have let the INCD seize equipment without a court order and monitor all internet traffic, and critics warned of “unchecked powers” (Frei 2020; IISS 2021). The bill stalled, and Israel’s legal framework still lags its capability. The turf war with the Shin Bet lasted about two years, until the Prime Minister overruled it in September 2014 (Raska, RSIS 2015). A coordinator without political backing fails quietly: Estonia’s Cyber Security Council was “impeded by organisational deficiencies” from 2009 to 2013 and did not, in practice, fulfil its supervisory role (Osula, CCDCOE 2015).

• How to transfer it. Czechia already has the architect. NÚKIB is the central administrative authority for cyber security, and the Czech system has run on continuous strategic planning for fifteen years. What NÚKIB’s own strategy says it lacks is money and people: allocations “insufficient ... for expert salaries” and “rigidly set remuneration rules” (NÚKIB 2026). The Israeli lesson is to fix pay at the founding resolution and to give the architect a mandate that reaches into the industrial, educational and research ministries, not only the security ones.

• The first move. Prepare a government resolution modelled on 3611 with three clauses. The first exempts a defined number of NÚKIB and national CERT expert posts from standard civil-service pay tables. The second mandates a joint cyber-industrial work plan co-signed by the Ministries of Industry and Trade, Education, Youth and Sports, and Defence. The third fixes a review of the whole architecture after three years. Keep the new unit small.

3. Separate the civil defender from the spy

• The principle in one line. Make the civilian defender a trusted service with no police or intelligence powers, keep offence and military self-defence elsewhere, and agree in advance who leads when peace turns into war.

• The Israeli evidence. Resolution 3611 wrote the boundary into the founding text: it “does not apply to special bodies”, meaning the IDF, police, Shin Bet, Mossad and the defence establishment. The operational authority created by Resolution 2444 in 2015 was deliberately given no law-enforcement powers, “to prevent any ongoing suspicion of NSA-like practices, to build trust”, and infrastructure protection moved out of the Shin Bet (Tabansky 2020). Its first head likened the service to a public water system: “When we will find contamination, we will not suspect who contaminated it.” Responsibility rises with the threat across three layers. Organisations own robustness, the CERT and sector centres own resilience, and the security bodies own national defence (INCD 2017). The INCD leads in peacetime and the IDF in war (Frei 2020). The payoff is sharing: CERT-IL handled about 9,000 incidents and issued about 300 alerts in 2020, and CyberNet links company security chiefs in a trusted national network (INCD 2021).

• Why it works. Companies report to a body that cannot prosecute them or spy on them. A no-blame service gets more reports, and clear roles mean less time lost in arguments during a crisis. The move to a civilian authority was partly economic, because the Shin Bet-run regime “seemed to stifle innovation and economic growth” (Frei 2020). The INCD’s influence rests on competence rather than coercion, “like the Mossad” (Shabtai, BESA 2025).

• Where it fails or is contested. The boundary is permanently disputed. Agencies with different core values fought “month-long turf wars” over infrastructure protection, and dependence on 8200 and Shin Bet expertise is “a double-edged sword” (Frei 2020). Critical infrastructure is still guided jointly by the Shin Bet and the INCD (INCD 2025). A voluntary, trust-based model also leaves gaps. The B/84 regime left small businesses, NGOs and citizens “without cybersecurity” until the 2010s (Tabansky 2020), and public and SME awareness is still low (INCD 2025).

• How to transfer it. The Czech map already separates NÚKIB and the national and government CERTs from the Security Information Service (BIS), the Office for Foreign Relations and Information (ÚZSI), military intelligence and the Cyber and Information Warfare Command. Unlike the Israeli authority, though, NÚKIB is also a regulator that monitors and enforces compliance (NÚKIB 2026). The transferable idea is therefore a firewall inside the civil side, between the service that receives reports and the supervisor that fines. NÚKIB’s strategy also asks for a legal framework for action “both in peacetime and in the event of a transition to crisis”, and admits that processes for sharing “sensitive but unclassified information” are complex or missing.

• The first move. Publish a joint hand-off protocol between NÚKIB, the Cyber and Information Warfare Command and the intelligence services that says who leads at each threat level. At the same time, issue a no-fault guarantee: information an organisation reports voluntarily to the national CERT cannot be used for enforcement against it. Then open a trusted exchange for security chiefs on the CyberNet model.

4. Make the state the first demanding customer

• The principle in one line. Use regulation and procurement to create sophisticated demand, working through existing regulators and named entities, without picking national champions.

• The Israeli evidence. Resolution B/84 (2002), one of the first critical-infrastructure policies anywhere, regulated named entities rather than whole sectors. Those entities appointed security staff, paid for the mandated measures and shared information, and negligent executives faced sanctions (Tabansky 2020). Resolution 2443 (2015) added a double lever. Each sectoral regulator took on cyber for its own sector (demand), and the national bureau regulated the market for cyber professionals, products and services (supply), with five licensed professions and periodic re-testing. Bank of Israel Directive 361 put a cyber strategy and an accountable senior officer in every bank (Housen-Couriel 2017). The dossiers show demand working at firm level. Auditors and insurers wrote CyberArk’s privileged-access controls into requirements. Waterfall “made the regulator [its] sales team” through NERC CIP, NRC and ANSSI rules. Axonius built a FedRAMP-authorised federal arm that serves more than 90 US agencies, and Sweet Security grew out of the pain of a state modernisation programme, Nimbus.

• Why it works. A demanding buyer with a real problem pulls product quality up faster than a grant does. Regulation turns security into a budget line, and naming entities keeps the burden on those that matter. The state buys outcomes, and the market picks the vendor.

• Where it fails or is contested. Demand can become a burden. B/84 put all compliance costs on the supervised entities, and sector obligations “evolved organically” and differ from one to the next. Essential organisations that are not critical infrastructure still fall into a regulatory gap (Frei 2020; INCD 2025). Protecting a domestic champion that is not globally competitive “can backfire” (Lewis 2016). “Sovereign” procurement carries its own risk: Dream Security reached more than $130M in annual sales in about two years through political access, and its dossier concludes that “sovereignty rented from a foreign vendor is still dependency”.

• How to transfer it. Europe’s rules are our demand lever: Czechia’s new Cyber Security Act (2025) and the fast-growing body of EU legislation behind it turn security into an obligation, and therefore a budget line. NÚKIB’s strategy commits the state to “prefer security solutions of domestic origin or from reliable partner and allied countries”, to create “secure technology alternatives” in selected areas, and to support “certification bodies and testing laboratories” (NÚKIB 2026). Those commitments become a market only if public and regulated buyers publish real problems and pay to have them solved.

• The first move. NÚKIB and the Ministry of Industry and Trade publish ten problem statements drawn from regulated entities in energy, water, health and finance. Each sponsoring buyer commits to one paid pilot a year with a young EU vendor, evaluated in a national test laboratory. Contracts carry fixed sovereignty terms: source-code escrow, local hosting, open data export and clean exit clauses.

II · The People: the talent engine

Every serious assessment names the same binding constraint. The workforce is the limit on national cyber capacity everywhere, “with perhaps only Israel having adopted a sufficiently radical approach to upskilling its citizens” (IISS 2021). The Israeli answer is not one institution but a chain: find them at fifteen, select on aptitude at eighteen, give them real missions at nineteen, release them at twenty-four and keep them circulating for the next twenty years. Three of the four principles below are copyable without conscription. The fourth is the one Israel itself has failed.

5. Treat talent as national infrastructure

• The principle in one line. Fund the talent pipeline the way you fund a road: from school, with public money, against a named national need, and measured in cohorts rather than in graduates.

• The Israeli evidence. Cyber is a school subject, army officers scout in high schools, and a National Center for Cyber Education opened in 2017 (IISS 2021). Magshimim, funded by the state and the Rashi Foundation, takes fifteen- and sixteen-year-olds from the periphery for three years. It draws more than 2,000 applicants a year and teaches “cyber ethics” to keep talent away from black-hat hacking (Cordey, ETH CSS 2019). It was designed for “girls, religious students, and children outside the major cities”, and grew from about 400 to 4,800 participants in five years. In one cohort, 61 of 234 graduates were already working in high tech before military service, earning about 2.5 times their peers (Government of British Columbia 2019). About 75% go on to IDF cyber and intelligence units (Frei 2020). The Atuda programme funds about 1,000 degrees a year in exchange for six to ten years of service (ICDK 2020).

• Why it works. The pipeline turns a national need into a visible career ladder with public money behind it, starting long before universities can act. Selecting on aptitude rather than experience widens the supply: Unit 8200 takes candidates at or above the 89th percentile of the national psychometric test, and explicitly tests raw potential (Rousseau, Ohio 2017). Teaching ethics inside the programme is a cheap way to keep a generation of skilled teenagers on the defensive side.

• Where it fails or is contested. The pipeline still does not meet demand: Israel is roughly 10,000 cyber workers short (Hatuka and Carmel, TAU 2021) and about 18,000 engineers short overall (Noël, Ifri 2020). Early programmes such as Gvahim, which put programming into fourth grade in 70 schools, skew to the wealthier centre (Cordey 2019). The state loses the bidding war for its own graduates, because the private sector pays more (Antebi, INSS 2021), and the 2025 strategy still has to name the “juniors barrier” as a problem. The Magshimim numbers are programme claims, not evaluations.

• How to transfer it. NÚKIB’s strategy already commits to a National Cyber Security Education Plan, inclusive programmes and the linking of initial with further education, against an EU-wide shortage of up to 300,000 experts (NÚKIB 2026). Without conscription, the state has to buy the part the army supplies in Israel: the afternoon programme, the selection test and the guaranteed first job.

• The first move. Launch a three-year after-school cyber track for fifteen- to eighteen-year-olds in at least eight regions outside Prague, with a single national entry quiz, ethics in the syllabus, industry and reserve volunteers teaching, and a guaranteed interview at NÚKIB, the Cyber and Information Warfare Command or a partner company for everyone who finishes. First cohort within twelve months.

6. Give the young real missions

• The principle in one line. Train backwards from a real job in months rather than years, then hand nineteen-year-olds responsibility they would not get anywhere else.

• The Israeli evidence. Mamram’s six-month core course runs eight or nine hours of class and six or seven of laboratory a day, and needs no prior programming. It trains about 300 programmers a year, who then serve five and a half to six years; by twenty-one, one in four manages a team and one in ten runs a section with a budget (Breznitz, MIT 2002). Every course is designed backwards from a capstone that simulates the real job. Unit 8200’s six-month course runs sixteen- to eighteen-hour days in small teams and ends in a capstone that joins a technical task to an intelligence one (Rousseau 2017). Responsibility is structural. The IDF’s senior-officer-to-troop ratio is about 1:9, against 1:5 in the US Army, and since the 1973 Agranat Commission questioning authority has been expected. After 1973, 8200 was rebuilt into “small, flexible teams tasked with finding quick technical solutions” (Cordey 2019). The dossiers show the output. Check Point’s firewall grew from Gil Shwed’s military work linking classified and unclassified networks, and Pentera automated its founders’ red-team routine. Sweet Security began with the IDF information-security chief’s failed search for a product that did not exist.

• Why it works. Short courses beat degrees on time to competence, because they are designed backwards from the mission. Real responsibility under budget scarcity — what Breznitz calls a “selective factor disadvantage” — produces people who improvise and who have already carried consequences. The problems are national in scale, so the threat models the graduates later build products against are real ones.

• Where it fails or is contested. The famous numbers are weakly evidenced. The claim that IDF veterans are about three times more likely to found a unicorn traces back to LinkedIn posts (Suss 2025), and the best academic test uses a five-firm sample with only marginally significant results (Rousseau 2017). Military training produces operators, not businesses: interviewees describe Israel as “a startup nation, not a scale up nation”, with founders “product focused not business focused”. Military capital also needs a civilian conversion layer (Grassiani, U Amsterdam 2018). And the unit is not a prerequisite: SentinelOne’s founders had no 8200 network, were rejected by Israeli investors and built a company now worth about $8.3B; Irregular was founded by AI researchers and debaters.

• How to transfer it. The copyable part is course design and delegated responsibility, not conscription. A mid-sized state can run the same six-month, mission-designed course through its military cyber command and its national CERT, and can give twenty-two-year-olds ownership of real systems. NÚKIB’s strategy asks for exactly this emphasis on “the practical application of the knowledge acquired” (NÚKIB 2026).

• The first move. The Cyber and Information Warfare Command and NÚKIB jointly run one full-time six-month operator course a year, open to school-leavers and career changers without a degree, designed backwards from a capstone on a live sector range, taught largely by industry and reserve instructors, with a service commitment and a guaranteed posting at the end.

7. Keep people circulating — army, lab, company, and back

• The principle in one line. Make the border between state, academia and industry porous, trusted and free of intellectual-property claims, and keep the traffic dense enough to carry tacit knowledge.

• The Israeli evidence. The least-celebrated mechanism is reserve duty. The IDF computer school’s roughly 400 reservists contribute about 20,000 days a year, equal to 100 work-years, and teach at least 97% of the advanced classes. Industry experts share tacit knowledge there that they withhold in paid settings, and the IDF claims no “property rights or patents on technologies developed under its sponsorship” (Breznitz 2002). Churn is designed in. About a quarter of 8200 turns over each year, reservists return for up to three weeks a year into their forties, and the 15,000-member alumni association exists for business and hiring rather than commemoration (Cordey 2019). INSS calls the result “double-feeding”: the same people circulate between army, industry and academia (Antebi 2021). Anchor firms such as Check Point and foreign R&D centres such as Microsoft’s and Symantec’s became founder academies (principle 12). Density matters too. 120 firms sit on about 8 sq km of central Tel Aviv, where every Israeli cyber firm with more than 100 staff is based (Hatuka and Carmel 2021).

• Why it works. Circulation moves the knowledge that documents cannot carry, and it does so in both directions: the state learns what industry has built, and industry learns what the state actually needs. A no-IP rule removes the friction that would otherwise stop the flow. Density makes each exchange cheap.

• Where it fails or is contested. You cannot decree a cluster. Beersheba got a prime-ministerial declaration, the national CERT, a university centre, a technology park and tax discounts, and still went from one start-up founded in 2013 to eight in 2020, against 337 in Tel Aviv; its status is “not advancing, and perhaps is even eroding” (Getz, Buchnik and Zatcovetsky 2024). Only 19% of the relevant career military staff said they would move south, and 66% preferred Tel Aviv (Gal et al 2017). Circulation also has a club problem: knowledge stays inside a reservist “club membership” (Breznitz 2002), and recruitment skews to the Tel Aviv area and elite schools (Cordey 2019). And in war the circuit reverses: about 10% of high-tech and management staff were called up after October 2023 (Taub 2025).

• How to transfer it. Czechia’s strategy already names enhanced civilian-military cooperation and “making use of non-state capabilities to address crises” (NÚKIB 2026). Estonia has already shown an EU-and-NATO version of the mechanism: the Defence League’s Cyber Defence Unit, a volunteer body of public- and private-sector professionals given a statutory mandate in 2014 (Osula, CCDCOE 2015). The missing pieces for us are the mechanics: a standing reserve of civilian experts with clearances handled once, a no-IP rule on state-funded training and tooling, and the discipline to concentrate the traffic in Prague and Brno rather than spreading it thin across the regions.

• The first move. Stand up a cyber reserve corps of about 200 named industry experts contracted for ten to fifteen days a year to teach on state courses, staff crisis rotas and play in sector exercises, with security clearance processed once and centrally. Publish a rule that the state claims no IP on training materials or tools produced under its sponsorship.

8. Widen the funnel before it narrows you

• The principle in one line. Decide who belongs in cyber at fourteen, not at twenty-four, because belonging — not ability — is what determines who enters.

• The Israeli evidence. In a survey of 912 Israeli ninth-graders, 36% of Jewish boys, 18% of Arab/Palestinian boys and 6% of girls in both sectors wanted a technology job at thirty. The strongest predictor was identity: students who felt similar to programmers were more than nine times more likely to aspire to such a job, while liking mathematics explained nothing (Budge, Charles, Feniger and Pinson 2023). The adult numbers follow. About 94% of high-tech workers are non-Haredi Jews and about a third are women (Taub 2025), and only 23% of AI professionals are women (OECD 2025). Breznitz called the exclusion of Arab and ultra-Orthodox citizens “the vast waste of human resource from a national point of view” as early as 2002. Israel knows it: Magshimim targets the periphery, and the 2025 strategy commits to widening entry and to hiring wounded veterans into junior roles (INCD 2025). The counter-examples show what is possible. About 70% of staff in the 1991–98 incubator wave were recent immigrants (Trajtenberg, NBER 2000), and Zafran’s chief executive arrived as an Iranian-born teenage refugee and rose to major in 8200.

• Why it works — when it does. Widening the intake is the cheapest capacity increase available, because the constraint is people, and because the marginal recruit from an excluded group is competing against nobody. It also reduces concentration risk in the economy: Israeli high-tech workers pay about 6.3 times more income tax than other workers and provided about 36% of all wage-based income tax in 2021 (Taub 2025). A narrow base carries a whole state.

• Where it fails or is contested. This is the principle Israel has least delivered on. The gender gap is larger in Hebrew-language than Arabic-language schools, and the cultural association of computing with Jewish military service reinforces it (Budge et al 2023). Structural exclusion from the military route cannot be fixed by an after-school course. And the consequences are now visible as brain drain, more company registrations in the US and net emigration of skilled workers (Taub 2025).

• How to transfer it. NÚKIB has already written the commitment: inclusive training, and explicit attention to “equality of employment opportunities and conditions for women, experts without a university degree and graduates of non-technical disciplines” (NÚKIB 2026). What the Israeli research adds is the measurement point. Do not measure diversity at the hiring stage, where the funnel has already closed. Measure it at fourteen, and treat “feeling similar to a programmer” as the policy target.

• The first move. Run an annual survey of technology aspiration among fourteen- and fifteen-year-olds, disaggregated by gender and region, and publish it as one of NÚKIB’s indicators. Tie the funding of new education programmes to moving that number, and open every state-run cyber course to applicants without a university degree.

III · The Capital and the Market: the company machine

Israel’s cyber industry was not the natural result of having clever engineers. Venture capital emerges only on top of pre-existing research and human capital, and even then it has to be engineered (Avnimelech, Kenney and Teubal 2004). Israel engineered it in the early 1990s with about $100M and a good contract, then rebuilt the layer twice: first as specialist seed funds and foundries, and now, as private fundraising thins, as public patient capital again. The four principles in this cluster are the most directly copyable in the report, and the cheapest.

9. Share the upside, never insure the downside

• The principle in one line. Public money should take a minority position, bring in a foreign partner, and let private investors buy the state out cheaply if they win.

• The Israeli evidence. Yozma (1992–93) was a $100M government fund. It put $8M into each of ten private funds, never more than 40% of any fund, and required each fund to bring in an established foreign financial institution, because the skills and networks “did not exist in Israel”. Private partners held a five-year option to buy out the state’s stake at cost plus 5–7% interest. The designers’ logic was that “successes should be highly profitable, while failure would be subsidized only to the extent that the government investments were lost” (Avnimelech, Kenney and Teubal, BRIE 2004). Venture investment rose from $5M in 1990 to $3.3B in 2000. Yozma-descended funds held about 55% of the pool and had the highest survival rates through the 2001–03 crash. Its predecessor, Inbal (1992), insured the downside and failed. The same logic ran through the incubators, where the state recovered its money only if a venture succeeded (Noël 2020), and through the 1984 R&D Law’s neutral, demand-driven grants (Trajtenberg 2000). Israel is now re-running the play. Yozma 2.0 (2024) pays institutional investors extra yield to enter venture capital (OECD 2025), and a NIS 250M fund-of-funds inside the Yozma Fund targets deep tech (IIA 2025).

• Why it works. Asymmetric terms make the state a cheap, temporary partner rather than a shareholder to be managed. The mandatory foreign partner imports judgement and networks alongside the money, and officials sitting on fund boards learn what they are subsidising. Neutrality — funding any qualifying project rather than a chosen sector — reinforces emerging comparative advantage instead of guessing at it.

• Where it fails or is contested. Yozma worked because decades of defence R&D and university training had already produced the deal flow; sequencing matters. The agency that invented it then lost most of its freedom: its budget allocation by 2005 was “barely above a third” of the 2000 level (Breznitz and Ornston 2012). Fund clocks are a structural problem in their own right — with ten-year lives, general partners abandon good but slow projects, at an efficiency loss that “can be in excess of 25%” (Kandel, Leshchinskii and Yuklea 2005). And the model has not produced durable domestic scale: new Israeli tech companies fell from a peak of 1,404 in 2014 to about 500 in 2024 (IIA 2025).

• How to transfer it. The Czech gap is not the absence of money but the absence of terms. NÚKIB’s strategy records that funding conditions and EU rules “are unclear and continue to grow in complexity”, that procedural barriers stop organisations drawing available funds, and that NÚKIB will build “a professional structure for providers of state aid for research and development whose programmes focus on cyber security” (NÚKIB 2026). A Yozma-style instrument is a single contract, not a new agency.

• The first move. Design one fund-of-funds instrument on Yozma terms: state money capped at 40% of each fund, a mandatory tier-one international co-investor in every fund, a five-year buy-out option at cost plus a small interest rate, and a state observer on each board whose job is to report what is being learned. Anchor three or four specialist funds with it, and publish the terms before the call.

10. Put domain experts behind the first cheque

• The principle in one line. The first investor should know the buyer’s problem better than the founder does, and should bring the buyer with them.

• The Israeli evidence. A handful of domain-expert seed investors shaped a generation. Cyberstarts wrote the first cheque into Wiz and backed Cyera, Island, Upwind, Glow, Zafran and Legit; Wiz alone returned it around $1.5B. YL Ventures seeded Axonius with $4M in 2017 and sold the stake for $270M in 2021. Team8, founded in 2014 by 8200 veterans with corporate backers from Microsoft to Temasek, works as a foundry. It starts with a thesis, then recruits founders, and opens its network of corporate security chiefs from day one. It produced Claroty and Sygnia, which raised about $4.3M and sold to Temasek for a reported $250M within three years. The model has become market structure. In 2024 Israeli cyber had a record 50 seed rounds worth $400M, tier-one global funds joined 22 seed rounds (against 10 a year earlier), and 12 “split-seed” rounds were co-led by an Israeli specialist and a global fund (YL Ventures 2025).

• Why it works. Domain investors can judge whether a problem has a budget line before it has a product, and their networks turn the first customer conversation into design input. A foundry compresses the riskiest year of a company’s life: the thesis is validated by buyers before a founder is hired. Split seeds combine local judgement with the global follow-on capital that the local market cannot supply.

• Where it fails or is contested. The same layer of specialist capital also financed the other Israeli cyber industry: the Atlantic Council counts 14 US investors in spyware vendors, 12 of them in Israel (Atlantic Council 2024). Specialist funds also concentrate risk in fashionable categories — new firms crowd into cyber and fintech even as formation collapses (IIA 2025) — and the Series A and B layer thinned in 2024 while seed boomed. Peak-cycle prices did real damage: Transmit Security’s $543M Series A and Snyk’s 2022 valuation both became exit constraints. And even a well-backed thesis can lose: Hunters was right about the data-lake SIEM and beaten by platforms that owned the telemetry.

• How to transfer it. For a country our size, the scarce asset is not capital but a general partner with a security-chief network and the standing to convene buyers. That person can be recruited, and the state can make the job attractive by pairing the Yozma instrument with privileged access to the operators regulated under the Cyber Security Act. Report 1 sets out the foundry model in detail; the principle here is narrower — never let public money be the only money, and never let it be the expert money.

• The first move. Assemble a register of 30 chief information security officers from regulated operators who agree to act as design partners and, under published conflict-of-interest rules, as angel investors. Make state co-investment conditional on a round being co-led by a domain specialist and an international fund — the split-seed rule, written into the term sheet.

11. Borrow the reach a small country lacks

• The principle in one line. A small state cannot manufacture proximity to the world’s customers, capital, research and intelligence, so it should import them deliberately and on terms.

• The Israeli evidence. The cluster’s first economic job was to overcome distance from the market. Venture capital, US-based management, acquisitions as “a shortcut to the market” and early Nasdaq listings gave Israeli firms the reach their geography denied them (de Fontenay and Carmel, Stanford SIEPR 2001). Yozma imported foreign partners for their know-how. About 300 multinational R&D centres (Noël 2020), 47 of them in cyber (ICDK 2020), became founder schools. The company template is explicit: Island builds 95% of its product in Israel with a US executive team, and Salt Security’s lesson is to “hire the US seller as a co-founder, not as an early employee”. Reach is also state business. Israel “lacks the global intelligence reach” of the largest powers and compensates through its alliance with the US (IISS 2021). The US–Israel Cybersecurity Cooperation Enhancement Act (2016) created a DHS grant line for joint ventures, with at least 50% private cost share, merit review and governance by the binational research foundations. The INCD works with more than 90 CERT partners and calls cyber defence “a global ‘team sport’” (INCD 2021).

• Why it works. Imported reach is cheaper than building a domestic market that does not exist. Multinational centres bring frontier problems to local engineers and then lose those engineers to start-ups. Alliances buy early warning that no small state can collect alone. And capacity building abroad turns technical excellence into diplomatic standing (Tabansky 2016).

• Where it fails or is contested. Borrowed reach means borrowed control. Four of the five largest acquirers of Israeli cyber firms are in the San Francisco Bay Area (Hatuka and Carmel 2021). The dual-headquarters model leaves the headquarters, sales and much of the value in California, and R&D can drain too: Snyk’s Israeli team fell from several hundred to about 90 while the company passed 1,500 staff. Alliance dependence cuts both ways — the same United States that amplifies Israeli capability blacklisted NSO and stopped the L3Harris deal.

• How to transfer it. Our borrowed reach is institutional: NATO, the EU and the single market. NÚKIB’s strategy is explicit that for resource-constrained states “the solution ... lies in intensive cooperation with reliable partners”, names cyber attachés and the NATO Integrated Cyber Defence Centre, and singles out Czechia’s “multi-layered relationship with Israel” (NÚKIB 2026). Cato Networks is already tripling its Prague R&D centre. The task is to convert relationships into instruments with money attached.

• The first move. Create a binational co-funded industrial R&D instrument with Israel on the DHS–BIRD model: joint ventures only, at least 50% private cost share, merit review, unclassified projects, and a sunset clause. Pair it with a landing programme that makes Prague and Brno the default second R&D site for scale-ups, on the condition that local teams are allowed to spin out.

12. Recycle every exit

• The principle in one line. Treat an acquisition as the start of the next three companies, and design tax, liquidity and R&D rules so that the people and the money stay.

• The Israeli evidence. Recycling is the most consistent finding across the fifty dossiers. Microsoft’s ~$320M purchase of Adallom (2015) produced both Wiz and Armis. Symantec’s purchase of Luminate produced Torq, NetApp’s purchase of Spot.io produced Upwind, and Aorato’s founders went on from Microsoft to build Apiiro. Failure recycles too: Cybereason’s collapse produced 7AI, and IntSights and Argus alumni built Guardz. Check Point plays the “Fairchild” role, its alumni founding or seeding Palo Alto Networks, Imperva, SentinelOne and Illusive (Hatuka and Carmel 2021). In 2024, 15 new Israeli cyber start-ups were founded by entrepreneurs who had already sold a company, and five Israeli start-ups bought other Israeli start-ups (YL Ventures 2025). Wiz’s sale alone is estimated to have produced about NIS 10B in Israeli tax revenue, roughly $1.5B for one seed fund and about 1,000 newly liquid engineers.

• Why it works. An exit returns three things at once — capital, experienced operators and buyer relationships — and it returns them into a network dense enough to reuse them within months. The acquirer’s local R&D centre then becomes the next founder school, which is why the Imperva dossier’s lesson for states is to negotiate R&D continuity at exit rather than to mourn the deal.

• Where it fails or is contested. The exit is also the leak. Between 1995 and 2005, 89% of Israeli tech firms followed one of two paths, venture-only or venture-then-trade-sale, and only about 6% touched public markets (Hashai and Menuhin 2006). “The products created by the Israeli digital industry are in fact the companies themselves” (Noël 2020). Decision rights go with the sale: CyberArk cut about 500 jobs within days of closing, and Israel no longer has an independent anchor in either cloud or identity. The OECD names the structural cause as “a comparatively low base of long-term capital” (OECD 2025), and the Taub Center now records contraction in start-up formation, skilled emigration and a rise in US company registrations.

• How to transfer it. Czechia will not have a $32B exit soon, but it already has acquisitions, foreign R&D centres and senior engineers with option packages. The policy surface is small and specific: taxation of employee options at exit rather than at grant, enforceable limits on non-competes, room for secondary sales so staff can take liquidity without forcing an early sale (the Island and Claroty pattern), and commitments on local R&D negotiated when a state-supported company is bought.

• The first move. Write an “exit covenant” into every state-backed instrument: any company that has taken public research or venture money commits, on acquisition, to maintain its local R&D headcount for a defined period and to report it. Pair it with a matched pre-seed facility open only to founders and senior engineers who start a new company within twenty-four months of an exit, and publish an annual register of where R&D and decision rights actually sit.

IV · The Guardrails and the Frontier: legitimate and ahead

The first twelve principles explain how Israel built capability and companies. The last four explain what keeps them ahead of adversaries and able to operate in the world. Two are about the frontier: design against a real attacker, and publish what you learn. Two are about the guardrails. This is the cluster Israel executed least evenly, and the evidence for it is Israel’s own worst years.

13. Specify security against a named adversary

• The principle in one line. For every asset, first ask which actor it must withstand, then build and test to that tier. Publish a national threat of reference and revise it every year.

• The Israeli evidence. Resolution 3611 made an annual “national threat of reference” one of the bureau’s nineteen founding tasks, and Israeli cyber policy grew from national-security threats rather than cybercrime (Benoliel 2015). The habit reaches the frontier. Pattern Labs, now Irregular, co-wrote with RAND the model-weight security framework used by leading AI labs. It identifies about 38 attack vectors and sets five levels, from SL1 (amateurs) to SL5 (the most capable nation-states) (Nevo et al, RAND 2024). Offence taught defence. Stuxnet’s roots were “not in the IT domain but in nuclear counter-proliferation”, and in industrial systems “the worst vulnerabilities are not bugs, they are features” (Langner 2013). The defensive record follows. Iran has been “forced to focus mainly on soft targets” (Anderson and Sadjadpour, Carnegie 2018). An Iranian attack on the grid in 2015–16 hit honeypot decoys, and wartime DDoS peaking at a million attempted logons a second in 2023 had no significant impact (Freilich, INSS 2024). In June 2025 Israel “emerged largely unscathed in the cyber domain” (Sharma, MP-IDSA 2025). Firms sell the same logic: Waterfall sells “certainty to buyers facing physical consequences”, and XM Cyber made “the attacker’s mental model the product”.

• Why it works. A named adversary makes security investment proportionate, because not everything needs SL5. It gives buyers and vendors a specification that can be tested, and it lets offensive knowledge inform defence.

• Where it fails or is contested. A named adversary can harden into a “conception”. Hamas showed no cyber spike before 7 October (Google TAG and Mandiant 2024), and low-end vectors were missed. Palestinian Islamic Jihad intercepted unencrypted IDF drone feeds for two years and hacked road cameras for rocket targeting. In June 2025 Iranian actors used weakly secured Israeli security cameras to adjust missile fire (Freilich 2024; Sharma 2025). Ransomware locked every system at Hillel Yaffe hospital in October 2021 and bed occupancy fell from 83% to 64% (Abbou et al 2024); a threat model built around states has to cover that too. A perimeter defined by named entities also misses consumer IoT: 1,355 hijacked smart sprinklers could empty a water tower in an hour (Nassi et al, BGU 2018).

• How to transfer it. NÚKIB already names its adversaries. It calls Russia “the biggest direct and long-term threat” and also names China, North Korea and Iran, and it records Iranian activity against Czech water-management infrastructure. Czechia made its first public attributions in May 2024 and May 2025 (NÚKIB 2026). What remains is to turn those names into specifications. The comparative literature adds a budget rule: rank critical infrastructure by importance, so a smaller state protects its most important assets first (Tvaronavičienė et al 2020).

• The first move. NÚKIB issues an annual national threat of reference, classified in full with a public summary. Starting with water utilities, each designated operator assigns an adversary tier to its most critical systems and has them tested against that tier. Cameras, remote-access paths and consumer-side devices count as in scope.

14. Publish the attack with the fix

• The principle in one line. Fund deep, open research in a few elite laboratories, and make every attack they publish arrive with a coordinated disclosure and a mitigation that can be deployed.

• The Israeli evidence. The base is decades of theory. Shamir co-invented RSA (Rivest, Shamir and Adleman 1978). Biham and Shamir’s differential cryptanalysis rediscovered in public an attack that IBM and the NSA had kept secret for eighteen years (Biham and Shamir 1993). Goldreich and Wigderson co-proved that every NP statement has a zero-knowledge proof (Goldreich, Micali and Wigderson 1991). After a 2012–13 funding call, matched, excellence-based academic cyber centres produced more than 500 papers (Cohen et al, New America 2017; ICDK 2020; INCD 2021). The signature is attack plus fix. Tel Aviv University’s NXNSAttack found DNS amplification above 1,620 times. BIND, Unbound, PowerDNS and CZ.NIC’s Knot shipped fixes, and Google, Cloudflare, Amazon and Microsoft patched, mostly with the authors’ MaxFetch mitigation (Afek, Bremler-Barr and Shafir 2020). Rogue7 was disclosed to Siemens alongside publication (Biham et al 2019). The Technion’s Morris II AI worm came with a guardrail that caught it at a true-positive rate of 1.0 (Cohen, Bitton and Nassi 2024). Companies copy the habit: Claroty’s Team82, Oligo, Zenity Labs in OWASP, and Koi, whose thirty minutes on the Darcula attack produced its thesis, first product and press coverage.

• Why it works. Publishing an attack together with its fix earns trust from vendors and regulators and sets standards. It also turns a lab into a school: Daniel Genkin, whose acoustic key-extraction work with Shamir and Tromer produced a GnuPG patch, went on to co-author Spectre. Start-ups get their theses from the same work, and in the dossiers research is repeatedly “the go-to-market”.

• Where it fails or is contested. The academic base is thinning. Israel’s share of world publications fell from 0.94% to 0.67% between 2000 and 2022, only 1.3% of its papers are highly cited (last among eight peers), and international co-authorship is falling (Getz and Barzani, Neaman 2024). Industry funds only about 7% of university research, and more than 90% of commercialisation income comes from one institute (Bentur et al 2019). The capability is dual-use: people who can break ciphers are also recruits for offence. Israel also has no public equivalent of DARPA’s AI Cyber Challenge or the Five Eyes’ CAGE competitions for autonomous defence (Standen et al 2021; Zhang et al 2026).

• How to transfer it. Czech institutions are already in the loop. CZ.NIC’s Knot was among the resolvers fixed after NXNSAttack, and Masaryk University co-authored NATO’s reference architecture for autonomous cyber-defence agents (Kott et al 2019). NÚKIB coordinates national cyber research. Its own strategy admits, though, that “the practical use and deployment of research results is often problematic” (NÚKIB 2026). The international frameworks list what is missing. The Oxford model’s top stage of responsible disclosure requires legal protection for those who disclose flaws responsibly (Oxford GCSCC 2021). ENISA asks: “Is there a plan to link R&D initiatives with real economy?” (ENISA 2020).

• The first move. Run a matched-funding call on Israeli terms for two or three university cyber research centres: awards on excellence criteria, with each university matching the funding. Add a disclosure clause: every attack a centre publishes goes through coordinated disclosure via the national CERT and ships with a mitigation. Legislate a safe harbour for good-faith security research in the same session.

15. Build the guardrails with the capability

• The principle in one line. Put export control, end-use vetting and domestic oversight in place while offensive-grade skill is being built, not after, because the reputational cost falls on the whole ecosystem.

• The Israeli evidence. Resolution 3611’s work plan already called for better export procedures and oversight in 2011. What followed shows the cost of letting capability outrun governance. Eight Israeli vendors make up 43.9% of the 435 entities in the Atlantic Council’s global spyware dataset (Roberts et al 2024). Of the 74 governments known to have bought spyware or forensics tools, 56 bought from firms based in or connected to Israel. A study cited by Haaretz found that 80% of the founders of Israel’s roughly 700 cyber companies had served in IDF intelligence (Feldstein and Kot, Carnegie 2023). Candiru “reportedly recruits from the ranks of Unit 8200” and ran more than 750 sites impersonating Amnesty, the WHO and others, and Israel’s export licensing is “almost entirely opaque” (Citizen Lab 2021). Licensing followed geopolitics. Ukraine was blocked from buying Pegasus and Estonia barred from using it against Russian targets. Israel is not a formal Wassenaar member, and when rules tightened, firms moved export desks to Cyprus (Feldstein and Kot 2023). The check that worked came from outside: the US Entity List designation of November 2021 pushed NSO towards bankruptcy, while regulators at home seemed “largely unfazed” (Kotliar and Carmi 2024). At firm level, Cellebrite suspended Serbian customers but dismissed similar evidence on Jordan and Kenya, an inconsistency its dossier says investors price in.

• Why it works — where it is done. Guardrails are a licence to operate in allied markets. They protect clean firms from being tarred by others, keep the alliance that supplies reach (principle 11), and give talented people an ethical line. Magshimim teaches “cyber ethics” for this reason.

• Where it fails or is contested. Export control is also foreign policy, and secrecy limits transparency. Demand does not go away: when one supplier is sanctioned, buyers move to others, and vendors change jurisdiction and name. Candiru has traded under at least five names.

• How to transfer it. Czechia is today more buyer than producer, which makes this the cheapest moment to act. 14 of the 27 EU member states bought from NSO (Atlantic Council 2024). The European Parliament recommends import controls, an EU entity list and more transparency. The Atlantic Council recommends “Know Your Vendor” rules for government buyers, beneficial-ownership registries and published export licences. NÚKIB’s strategy already commits to regulation “balancing national security and individual rights”, with powers subject to monitoring (NÚKIB 2026).

• The first move. Attach a guardrail clause to every state instrument proposed in this report: the fund, the pilots, the R&D centres and the binational fund. The clause requires a published end-use policy for dual-use products, disclosure of beneficial ownership, and no sales of intrusion tools to unvetted end users. The state, as a buyer, adopts “Know Your Vendor” rules and publishes an annual aggregate report on intrusion-tool procurement.

16. Protect the dissenter from the machine

• The principle in one line. Automate collection and triage, but do not automate away the person who notices what the model does not expect. Warnings should be pushed to decision-makers, not left in a pool.

• The Israeli evidence. October 7 was “not the result of a single glaring failure”, but its causes included “an overestimation of Israel’s technological capabilities” and a drift from human to technical collection. Monitoring of Hamas hand-held radios reportedly stopped a year earlier, while Hamas used wired phones and fed deception through channels it knew were watched. The IDF had held the “Jericho Wall” attack plan for more than a year. A Unit 8200 NCO who warned in July 2023 that Hamas exercises matched it was dismissed as “aspirational” (Wyss, CTC Sentinel 2024). A former senior officer blames a “love affair” with cyber intelligence and AI. In his account, automated processing “with little or no human intervention” replaced pushed warnings with an “intelligence pool”, and 8200’s open-source unit, Hatzav, was dismantled in 2021 on the strength of machine translation (Bar, NIPP 2024). The chief of staff had warned in 2018 that “too much information is not a guarantee for better command and control” (Eizenkot 2018). Civilian cyber defence, by contrast, held through 2023–25. The technical literature agrees that machine-learning defences can never be the only layer, because adversarial training “should have no effect” on adversarial examples (Shamir et al 2019).

• Why it works. A record of technical superiority breeds a fixed belief about what the enemy will do, and automation removes the friction where anomalies used to surface. A protected dissenter puts that friction back on purpose. It matters most exactly when it feels least necessary, because the riskier a surprise attack looks, the more readily it is dismissed (Wyss 2024).

• Where it fails or is contested. Dissent channels decay into ritual. Israel created a “Devil’s Advocate” unit after 1973 (Rousseau 2017), and fifty years later such mechanisms had become “routinized and ritualized” (Wyss 2024). A speak-up culture in a hierarchy is “easier in theory than in practice”. Israel’s 2025 strategy now writes in countermeasures against the biases that lead analysts to underrate strategic surprise (Shabtai 2025), but a written rule is not proof that behaviour has changed.

• How to transfer it. NÚKIB plans AI-based detection and the automation of routine work so that savings can be redirected to salaries (NÚKIB 2026). That is the right direction, provided each automation decision is weighed against the human capability it removes, and the analyst who disagrees has a guaranteed route to the top.

• The first move. Adopt a written push rule for the national CERT, the National Cyber Operations Centre and the intelligence assessment staff. Any analyst may escalate a warning to the director and must receive a written reply within 72 hours, and every escalation is logged and reviewed each year. Before any analytic unit is cut or replaced by automation, a red team reviews which human capabilities will be lost.

What not to copy

Some of Israel’s advantages are side effects of conditions no democracy should create on purpose. Others are choices that Israel’s own research now treats as mistakes. The following should stay in Israel.

• The threat as the engine. Conscription-scale selection and a permanent existential threat gave Israel its workforce advantage (”Israel’s tech-heavy military and national conscription gave it an advantage”, Lewis 2016). A state cannot import them, and should not try. Czechia’s route to scale runs through coalitions, EU funds and certification.

• Spyware as an export industry. Opaque, geopolitics-driven licensing made Israel-linked firms the supplier to 56 of 74 known spyware-buying governments, invited a Cyprus workaround and imposed a reputational cost on the whole ecosystem. No one should copy it.

• Deniable tit-for-tat as deterrence. Israel-linked personas have taken Iranian petrol stations and banks offline (Google TAG and Mandiant 2024; Sharma 2025). But Israel’s reported counter-strike after the 2020 water attacks did not deter Iran, whose attacks resumed within weeks (Freilich 2024), and in the 2025 war cyber gave only an “incremental edge” (Sharma 2025). NÚKIB commits to developing offensive and multi-domain capabilities. They belong under law and allied coordination, not in signalling games.

• Powers ahead of oversight. The 2018 draft bill would have allowed equipment seizure without a court order and monitoring of all internet traffic. Israel’s legal dimension is its weakest, rated only “established” (Lewis 2016).

• The exit-only default and peak-cycle capital. Selling anchors without negotiating anything, $543M Series A rounds and hiring to the size of the round (Transmit, Snyk, Deep Instinct) are costs of the Israeli model, not features of it.

• A cluster by decree. Beersheba has a declaration, a CERT, a university and tax discounts, and saw eight start-ups founded in 2020. Buildings do not move people.

• A closed elite. A pipeline that reproduces one demographic runs out of people and concentrates national risk in a narrow, mobile workforce.

The principles as a system

The sixteen principles are not a menu. Israel’s advantage comes from how they feed each other, and its current weaknesses show where the loop leaks. The flywheel runs in six steps:

1. Ends and an architect (1, 2) create a mandate and remove the turf friction that stops everything else.

2. A trusted civil defender and a demanding state customer (3, 4) turn the threat into problems that companies can solve and data that defenders can share.

3. The talent engine (5–8) turns those problems into people who have already solved them at national scale.

4. Capital and reach (9–11) turn those people into companies with global customers.

5. Exits (12) return money, experienced operators and buyer relationships to the start of the loop, along with tax revenue that funds step one.

6. The frontier and the guardrails (13–16) keep the problems hard, the research ahead of the attacker, and the licence to operate intact.

Five pairs do most of the reinforcing:

• 4 and 13: a named-adversary specification is what makes the state a demanding customer rather than a grant office.

• 3 and 14: a trusted, no-fault CERT is also the channel for coordinated disclosure.

• 6, 7 and 12: missions, circulation and exits together produce the repeat founder, the most valuable asset in the dossiers.

• 9 and 10: Yozma’s foreign partners created the venture layer from which the specialist funds later grew.

• 11 and 15: alliances supply reach, and guardrails keep them. The US Entity List showed that an ally can also close the door.

The loop now leaks at three points. The narrow funnel (8) is starving the pipeline: the number of new companies has halved from its peak, skilled workers are emigrating and more companies are registering in the US. Exits (12) are sending decision rights abroad. And the dissent failure (16) contributed to a surprise that Israeli analysts now compare with 1973 (Bar 2024). A state copying the model should build these three points more strongly than Israel did, not less.

If a state is starting today, four principles matter most:

1. Treat talent as national infrastructure (5). It has the longest lead time: a fifteen-year-old recruited in 2027 is a founder in 2037. It is also the constraint every comparative study names.

2. Make the state the first demanding customer (4). It is the cheapest principle, because it uses rules already in force. It is also the fastest, because pilots can start this year.

3. Share the upside, never insure the downside (9). A single well-drafted contract brings in the capital and the know-how a mid-sized market lacks, and Israel is running the same play again with Yozma 2.0.

4. Build the guardrails with the capability (15). It is almost free at the start and ruinously expensive to retrofit, as NSO showed.

Principle 2 is the precondition for all four. Without market pay and the authority to arbitrate between ministries, none of them gets done.

How to know it is working. Measure capability, not commitment. The ITU index put Israel below Estonia and beside Czechia, and ENISA concedes that its own framework measures maturity rather than effectiveness (ENISA 2020). Use outcome indicators instead: the technology aspiration of fourteen-year-olds, operator-course graduates placed each year, paid pilots with young vendors, split-seed rounds, companies started by founders after an exit, disclosures shipped with fixes, and median time from disclosure to mitigation in regulated entities. Top that list with the Oxford model’s own definition of the highest stage for a national cyber marketplace: “Domestic cybersecurity products are exported to other nations and are considered superior products” (Oxford GCSCC 2021).

Close

Israel’s cyber power is often explained by its enemies, its army or its culture. The evidence points elsewhere. Across 78 nations, regional differences in cyber culture disappear once development and the scale of internet use are accounted for (Creese, Dutton and Esteve-González 2021). Israel became a cyber power before it had a strategy, then built the machinery to keep that power and turn it into an industry: a NIS 4.5M bureau, a civil defender without police powers, a six-month course designed backwards from a real mission, a $100M fund with a buy-out clause, and matched academic centres that publish the fix with the attack. Where Israel failed, the causes were choices, not fate: a narrow funnel, opaque export licensing, and faith in machines over the analyst who disagreed.

A mid-sized European state can copy the mechanisms without the threat, and it can build the guardrails that Israel added late. Czechia starts with more than it thinks: a comprehensive cyber law since 2014, a respected agency, a strategy that already names the right gaps, and Czech code and researchers inside the global disclosure loop. What it lacks is the engine: the pipeline, the terms, the first customers and the recycling that turn talent into capability and companies. Each of those is cheap next to the threat it answers, and each takes years to mature. The option value lies in starting all four first moves this year, because every year of delay is another cohort of fifteen-year-olds who never find out that the field was meant for them.

ENSI research — built on a library of 164 primary documents and 52 company dossiers

The argument, before the list

Three institutions with nothing in common have independently reached the same conclusion about the word at the centre of this series. In 2014, researchers at Canada’s signals-intelligence establishment harvested nine published definitions of cybersecurity — from the ITU, the CNSS, DHS, Public Safety Canada, Oxford and four individual scholars — and found them mutually inconsistent and overwhelmingly technical (Craigen, Diakun-Thibault and Purse 2014, pp. 14–15). In 2018, a British professor of international politics concluded that “cyber” has become “so nebulous that it has essentially become meaningless; it simply refers to too many different things at different times for different people” (Futter 2018, p. 202). And in 2020, the product-development team that maintains a listed cyber-security equity index — people whose job is to decide, every quarter, which companies are cyber companies — conceded in print that “there is no one consistent technology or segment” (Jones, Nasdaq 2020, p. 3).

A spy agency, a political scientist and a stock exchange, approaching from opposite ends, all report that the object does not hold still. The usual response is to treat this as a failure of the field and to propose a tenth definition. That is the wrong reading, and correcting it is the point of this report.

The absence of one definition is not a deficiency. It is evidence that there are four definitions, each doing a different institutional job, and each of them load-bearing. The academic definition exists to make an interdisciplinary field arguable: Craigen’s replacement — cybersecurity as “the organization and collection of resources, processes, and structures used to protect cyberspace and cyberspace-enabled systems from occurrences that misalign de jure from de facto property rights” (2014, p. 13) — is deliberately non-technical, because its purpose is to get engineers, lawyers, economists and psychologists into one conversation. The standards definition exists to be audited: NIST’s Cybersecurity Framework 2.0 is “a taxonomy of high-level cybersecurity outcomes” that is explicitly “sector-, country-, and technology-neutral” and contains no adversary, no offence and no state (NIST 2024, pp. i–ii). The doctrinal definition exists to allocate war-fighting responsibility, which is why Israel’s own operative definition of cyberspace deliberately excludes organisational and ideological properties as contingent rather than inherent (Tabansky 2011, p. 78). And the market definition exists so that capital can be allocated and membership adjudicated — Nasdaq’s classification is what it is because a committee has to be able to decide it, not because it is conceptually superior (Jones 2020, p. 5).

Borrow one of the four and you get an institution shaped like it. Take the standards definition as your national definition and you build a compliance regulator that is excellent at producing maturity scores and has no view on an adversary. Take the doctrinal definition alone and you build a command that cannot talk to a bank. Take the market definition — which is what happens by default, because it arrives free with every vendor briefing — and you build a trade association that mistakes a category map for a threat picture. Craigen’s warning is institutional rather than semantic, and it is the sentence this whole report turns on: the absence of a shared definition “impedes technological and scientific advances by reinforcing the predominantly technical view of cybersecurity while separating disciplines that should be acting in concert” (2014, p. 13). A state that defines cyber narrowly as an IT problem gets a narrow IT institution, and then wonders why it has no answer to everything the institution was not built to see.

Israel is the best place in the world to watch this happen, for a reason that has nothing to do with how many start-ups it has. Between roughly 2010 and 2018 it built all four definitions, and — this is the unusual part — kept them mutually translatable. The sequence matters more than the content. In May 2011, three months before the government resolution that created its first cyber institution, Lior Tabansky published an essay at the Institute for National Security Studies whose stated purpose was to “survey the field and create a common language for a fruitful public discussion of the developing issue of cyber security, proposing operative definitions… that can be applied in a discussion of Israel’s national security” (Tabansky 2011, p. 76). In December of the same year, Isaac Ben-Israel — the physicist and reserve major-general who had run the 2010 National Cyber Initiative — co-authored the companion essay, which builds its case for cyber policy not out of weapons but out of Popper’s three worlds, the Tofflers’ three waves and Romer’s endogenous growth theory, arriving at knowledge as “a non-rival, partially excludable good” before it reaches a single threat (Ben-Israel and Tabansky 2011, pp. 22–24). Resolution 3611 followed in August 2011 with a National Cyber Bureau of about thirty people and a first-year budget of NIS 4.5M; the operational authority came in 2015, the merged Directorate in 2017–18, and the Israeli Cyber Defense Methodology — built directly on NIST’s framework and its SP 800-53 controls — was published in June 2017 and adopted by the whole Israeli government in 2018 (NIST and INCD 2020, pp. 1–2).

Israel published its definitions before it built its institutions. Almost every other state does the reverse: it creates an agency, gives it a budget line, and then commissions a strategy that reverse-engineers a definition from whatever the agency already does. The Israeli order is cheap to copy and almost never copied. It costs nothing but authority, and it buys something no reorganisation can retrofit — a vocabulary that the general staff, the regulator, the university and the venture fund all use in the same sense.

The deeper reframe follows from that. If you ask why one small country produces both Unit 8200 and Wiz, the usual answers — conscription, threat, chutzpah — explain the supply of people but not the shape of the output. The better answer is definitional. Cybertech is an institutional translation layer: the machinery that converts an intelligence problem into a product category, and occasionally converts it back. Tabansky’s 2011 taxonomy of cyber weapons has three groups — unequivocally offensive, unequivocally defensive, and a dual-use middle of network monitoring, vulnerability scanning, penetration testing, encryption and the camouflage of content and communications (2011, p. 80). Read that middle category again in 2026 and it is not a doctrinal list. It is a product catalogue. Network monitoring became Armis and Axonius; vulnerability scanning became Orca and Wiz; penetration testing became Pentera, Cymulate and XM Cyber. The doctrine wrote the segment map fifteen years before the segments had names.

That translation is also where the model’s costs live. A definition built on means rather than effects — Ben-Israel and Tabansky’s precise and correct claim that information warfare is ancient and only computer warfare is new (2011, p. 28) — has two consequences a state must accept together. It makes the dual-use export problem structural rather than accidental, because an intrusion tool and an assurance tool are the same object under different licences. And it leaves the cognitive domain outside the definition and therefore, unless someone says otherwise in the same document, outside everybody’s mandate. Report 6 in this series documented exactly that hole in the Israeli case: a 2025 national strategy that lists a public mindspace resilient to foreign influence among its objectives, names no owner, and gives nobody the legal power to act.

For a mid-sized European state — the Czech Republic is our default home example — the practical question is not “what is the correct definition of cyber”. There isn’t one. It is: which of the four definitions is your agency actually running on, which of the other three have you quietly imported from a vendor, and what has the combination made you blind to. Report 1 ranked the fifty companies Israel’s machine produced; Report 2 distilled sixteen principles a state can act on; Report 3 specified the twenty-four features of the best defence anyone could assemble; Report 5 sorted the 2026 threat claims by the evidence behind them; Report 6 examined what happens when a first-rank cyber power meets an adversary it has decided not to treat as one. This report sits underneath all of them and asks the question they assumed an answer to.

Summary of main points

• There are four working definitions of cyber, not one, and each builds a different institution. The academic (Craigen et al. 2014 — interdisciplinary, property-rights based), the standards definition (NIST CSF 2.0 — six outcome Functions, no adversary in it), the doctrinal (Tabansky and Ben-Israel — computer warfare as a means-defined subset of information warfare) and the market definition (Nasdaq’s two classes, Deloitte’s sixteen Israeli segments, ENISA’s value stack). Adopt one by accident and you get an agency shaped like it.

• Israel published its definitions before it built its institutions, and defined cyber as economics first. Tabansky’s INSS essay in May 2011 explicitly to create “a common language”; Ben-Israel’s companion essay grounded in Popper, Toffler and Romer; Resolution 3611 in August 2011 with thirty staff and NIS 4.5M. The order is the cheapest transferable feature in this entire library.

• The load-bearing Israeli concept is the boundary between information warfare and computer warfare. “What is new about Third Wave warfare… is not information warfare per se, but computer warfare” (Ben-Israel and Tabansky 2011, p. 28). Cyber is defined by means: bombing a data centre is not cyberwar, however destructive. Futter reaches the identical line from Leicester seven years later.

• Defining cyber by means leaves the cognitive domain to nobody. Psychological warfare and media management sit inside information warfare and outside cyber. That is analytically right and institutionally catastrophic if no one else is named — the structural gap Report 6 documents in the Israeli response to Russia.

• Most of what states do to each other in cyberspace is an intelligence contest, not war. Rovner’s definition — “an information duel… about maintaining an information advantage” — and his verdict that these activities “differ from traditional intelligence activities in degree, not kind” (TNSR 2020, pp. 11–12). The answer decides who owns cyber: the spies or the military.

• Cybertech is an institutional translation layer. Tabansky’s 2011 “dual-use” middle category of cyber weapons — network monitoring, vulnerability scanning, penetration testing, encryption, camouflage — is, read in 2026, a list of product categories worth tens of billions. The doctrine drew the segment map before the segments existed.

• The industry has roughly twelve real segments, and only eleven are defined by what they protect. The twelfth — the SMB and MSP platform layer — is defined by who buys. That tells you what a “segment” actually is: an administered answer to a buyer’s assessment problem.

• Category creation and vendor consolidation are the same problem solved from opposite ends. The World Bank’s account of cyber as a market for lemons — returns “unquantifiable”, buyers unable to judge effectiveness before an attack (Vergara Cobos 2024, pp. 73–74) — explains both. Vendors invent labels because a label is the cheapest way to be legible; buyers consolidate because one large vendor is the cheapest way to reduce assessment cost. More than 75% of CISOs are pursuing consolidation, and for risk reasons rather than budget ones (Deloitte 2024, p. 14).

• The market perimeter is administered, not natural, and its demand base is one country. Nasdaq runs a classification committee, reviews quarterly and rules that companies “may not apply, and may not be nominated for inclusion” (Jones 2020, p. 5). Meanwhile North America is about 54% of global cybersecurity spending — sixteen times all of Latin America and the Caribbean — and governments are roughly 36% of the market, “primarily driven by demand from the United States” (Vergara Cobos 2024, pp. 75, 79).

• The definition decides the measurement, and the measurement decides the politics. The ITU index records whether laws and agencies exist and says itself that it does not measure the quality of actions; Israel sits in Tier 2 beside Czechia. Belfer ranks it outside the top ten and says it is under-ranked because it is opaque. IISS puts it top of the second tier, behind only the United States. Three indices, three answers, because three definitions of cyber power.

• For a mid-sized EU state the instruction is a sequence, not a menu: define in public, adopt the international taxonomy for organisations, diffuse through sectoral regulators rather than a general law, make market analysis a statutory duty, choose three or four segments deliberately instead of importing a category map — and name the owner of everything the definition leaves outside, in the same document that draws the boundary.

How this report is organised

Six sections and eighteen numbered points. Section I sets out the four definitions of cyber, one at a time, with what each makes visible and what each hides. Section II draws the three boundaries that matter — with IT security, with intelligence, and with information and influence operations. Section III is the anatomy of cybertech as an industry: twelve segments drawn from the fifty-two company dossiers behind this series, then the lifecycle of a segment from birth to absorption, and the economics that explain both. Section IV shows the Israeli concept becoming machinery. Section V is the argument that the definition decides the outcome — which agency exists, who owns the budget, what gets measured, and what a country is therefore structurally blind to. Section VI is the transfer.

Sources are cited inline by lead author or institution and year, and every one of them sits in the library behind this series. Company facts come from the fifty-two dossiers and are often company-reported; where a figure is contested or thin we say so. This report deliberately does not repeat Report 2’s principles or Report 3’s features — it explains the concepts underneath them.

I · The four definitions of cyber

Four definitions, four purposes, four institutions. They are not competing answers to one question. They are answers to four different questions that happen to share a prefix. The order below runs from the most abstract to the most consequential in money terms, and each point closes with the same two-part test: what does this definition make visible, and what does it hide.

1. The academic definition — cyber as a socio-technical field nobody can fence

Craigen, Diakun-Thibault and Purse open their paper with an epigraph from Charles Leslie Stevenson that should be printed on the wall of every national cyber agency: “To choose a definition is to plead a cause.” Their survey of the nine existing definitions finds five recurring themes, and the list is a usable checklist for any state drafting its own: technological solutions · events · strategies, processes and methods · human engagement · referent objects of security (2014, p. 15). Most published definitions cover two or three of the five and are silent on the rest. A state can audit its own strategy against that list in an afternoon and will usually find that “human engagement” and “referent objects” are missing — which is to say, it has not said who is being protected or by whom.

Their own replacement definition does two useful things. It moves the referent object from “data” and “assets” to property rights — borrowed from Ostrom and Hess — so that the protected thing is anything with meaning or value, and the protected relations include access, extraction, contribution, removal, management, exclusion and alienation (2014, p. 18). And it explicitly includes “cyberspace-enabled systems”, which puts operational technology, industrial control and medical devices inside the definition rather than bolted on afterwards as a special case. Any state whose definition of cyber does not do that second thing will spend the next decade arguing about whether the water utility is in scope.

The paper’s other contribution is structural. It characterises cybersecurity as a scale-free network with high degrees of change, connectedness and speed of interaction, in which “the capabilities of actors in the network are potentially broadly similar” (pp. 15–16). This is the academic root of the claim that a small state can punch above its weight — and note that the claim is a property of network topology, not of national character. Nye reaches the same place from international-relations theory: “The low price of entry, anonymity, and asymmetries in vulnerability means that smaller actors have more capacity to exercise hard and soft power in cyberspace than in many more traditional domains”, and “it makes little sense to speak of dominance in cyber space as in sea power or air power” (Nye 2010, abstract and p. 4). He is careful about the limit, too: “Power diffusion is not the same as power equalization” (p. 11). A teenager and a government can both do damage, but only states can mount sophisticated attacks on hardened targets, because those require “large intelligence agencies to intrude physically and/or crack highly encrypted codes”.

Then there is Futter, who is not offering a better definition but arguing that the word should be retired. His case is that “cyber” is a prefix that could almost always be replaced by “information”, “computer”, “digital” or “electronic” without loss, that social science “hijacked a concept that emerged from the hard sciences”, and that the resulting vagueness “often drives … misunderstanding and bad policy” (2018, pp. 201, 212–213). His most uncomfortable observation is about who benefits: “military officials and computer security companies have used imprecise language to help bolster budgets and business through nurturing a bleak and scary picture of the current information environment” (p. 210). Anyone reading a vendor category map — or a national threat assessment written with one open on the desk — should keep that sentence in view.

But Futter also supplies the finding that rescues the whole enterprise, and it is easy to miss. The precise vocabulary never died; it simply left the public debate. “US Cyber Command, UK National Cyber Security Centre, and the Israeli National Cyber Security Authority all have CNO policies and doctrine, but this is conspicuous by its absence in much academic writing and policy discussion” (p. 210). The mush is in the conference programme. Inside the agencies, people still say computer network exploitation when they mean computer network exploitation. A state that wants a serious cyber institution does not need to invent language. It needs to make the internal language the public one.

What it makes visible: the interdisciplinary object, the non-technical stakeholders, operational technology, and the fact that every definition is an argument for a budget. What it hides: operational specificity. You cannot task a unit, write a control or price a contract from Craigen’s definition, which is precisely why the other three exist.

2. The standards definition — cyber as a governed process

The most widely used definition of cybersecurity on earth is not a sentence. It is a taxonomy of six words, and its authority comes from the fact that it can be audited.

NIST’s Cybersecurity Framework 2.0, published in February 2024, defines cybersecurity by outcomes rather than technology: it “offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity”, and it “does not prescribe how outcomes should be achieved” (NIST 2024, p. i). The Core is a three-level hierarchy of Function → Category → Subcategory, described explicitly as “not a checklist of actions to perform” (p. 3). The six Functions are the operative definition:

GOVERN · risk-management strategy, expectations and policy are established, communicated and monitored · IDENTIFY · current risks are understood · PROTECT · safeguards are used · DETECT · possible attacks and compromises are found and analysed · RESPOND · actions on a detected incident are taken · RECOVER · assets and operations are restored.

The addition of GOVERN in version 2.0 is itself a definitional statement, and the most consequential one NIST has made in a decade. It moves cybersecurity from a technical function to an enterprise-risk and board question. A CISO who reported to the head of IT in 2013 and reports to the board in 2026 is living inside that edit.

Two design choices make this framework the one that travels. The first is neutrality: the outcomes are “sector-, country-, and technology-neutral” (p. ii), which means a national methodology can be built on top without importing another country’s controls, politics or legal assumptions wholesale. The second is the measurement layer — Profiles, which describe current versus target posture, and Tiers, which describe the rigour of risk governance from Partial to Adaptive (pp. 6–8). Neither is a score of whether you are secure. Both are scores of whether you are organised.

Israel is the best available evidence that the neutrality is real, because Israel used it. The INCD explicitly did not invent its own framework: “INCD chose NIST Cybersecurity Framework as the basis for building the methodology for the Israeli economy. Most of the controls that allow the method to be implemented are also derived from NIST (Special Publication 800-53)” (NIST and INCD 2020, p. 1). The reason given by Igal Unna, then the Directorate’s Director General, is strategic rather than technical and is the single most quotable sentence in this section: “harmonizing our methodology with leading standards creates an international cyber defense language which supports collaboration against global cyber threats” (p. 1). A country with world-class offensive capability, an independent doctrinal tradition and every incentive to assert sovereignty over its own standard chose instead to be intelligible. That choice should end the sovereignty argument in any mid-sized European capital where it is still running.

The adoption also fixed a real gap rather than merely importing prestige. Legacy Israeli methodologies “focused on ‘Identify, Protect and Recover’ outcomes; the application of the NIST Cybersecurity Framework is seen as strengthening ‘Detect and Respond’ considerations” (p. 1). A foreign taxonomy corrected a domestic doctrinal blind spot — which is the argument for borrowing one, stated by the borrower.

The European counterpart to the standards definition is ENISA’s, and it is worth naming because it does something NIST does not. ENISA’s Cybersecurity Market Analysis Framework exists because Article 8(7) of the Cybersecurity Act obliges the agency to “perform and disseminate regular analyses of the main trends in the cybersecurity market on both the demand and supply sides” (ENISA 2026, p. 9). Market analysis is a statutory duty of the EU’s cyber agency. Its seven-step workflow turns “what is a cyber market segment” into a repeatable procedure rather than a matter of taste, and its analytical core is the value stack: “the layered structure of the collection of services contributing to the value proposition of an organisation… bundles together products, services, processes or value streams” (p. 27). Version 3.0 aligns it with the Cyber Resilience Act and “products with digital elements”, and supports “recurrent market analysis and continuous monitoring of market dynamics, and comparability across studies” (pp. 9–10) — market monitoring as a standing capability, not a one-off report. It is also portable by design: “the structure and logic of the framework are sufficiently generic to allow its application, with limited customisation, by organisations other than ENISA” (p. 10).

One feature of ENISA’s taxonomy deserves to be lifted out, because almost every national industrial strategy gets it wrong. Its worked classification — built with the European Cyber Security Organisation and the Commission’s Joint Research Centre — puts R&D and education inside the value stack, alongside software, hardware, distribution channels and professional services: academia, professional training, awareness platforms, threat and cryptography research, standards and certification R&D, AI security research (ENISA 2026, Annex G, pp. 76–79). A country that counts only vendors when it measures its cyber industry is measuring the wrong thing, and will conclude it has no industry at exactly the moment it is building one.

What it makes visible: governance, comparability, the audit trail, and an international language that makes cross-border incident response possible. What it hides: the adversary. There is no threat actor anywhere in the CSF, no offence, and no concept of national power. It tells an organisation what “good” looks like and says nothing about who is coming. Used alone as a national definition of cyber, the standards definition produces compliance rather than capability — the same critique the ITU’s Global Cybersecurity Index attracts, and for the same structural reason.

3. The doctrinal definition — cyber as a subset of information warfare, defined by means

This is where Israel’s contribution is genuinely original, and where the vocabulary is at its sharpest.

Start with the object. Tabansky’s operative definition of cyberspace is “inter-connected networks of information technology infrastructures, including the internet, telecommunication networks, mission-specific networks, computers, and computer embedded systems”, with the virtual environment — “data stored and information processed by computers and transferred over these networks” — included (2011, p. 78). The definition deliberately excludes organisational and ideological properties, on the grounds that those are contingent rather than inherent. And the object is layered from the start: a physical layer of energy, circuits, processors, storage, cable and fibre; a logical layer of software; and a data and information layer (pp. 77–78). Nye, arriving from Harvard the year before, describes the same thing as “a unique hybrid regime of physical and virtual properties”: a physical infrastructure obeying rival-goods economics and sovereign jurisdiction, and an informational layer with increasing returns to scale and weak jurisdictional control, where attacks are cheap (Nye 2010, p. 3). Tabansky adds the line that keeps the whole subject honest: “cyberspace is not part of nature and would not exist without the information technologies that were developed in past decades” (pp. 76–77). Everything in it was built, which means everything in it was a decision.

Then the definitional move that matters most. Ben-Israel and Tabansky’s companion essay draws the boundary that every subsequent argument has to cross: “while information warfare is not new, this is not true of computer-based information systems… What is new about Third Wave warfare or war in the information age is not information warfare per se, but computer warfare” (2011, p. 28). Information warfare is as old as deception. What is new is that information systems now run on computers. Cyber is therefore a subset of information warfare, and the subset is defined by its medium.

The Israeli definition of computer warfare follows, together with the exclusion that gives it teeth: “unauthorized access to the adversary’s computer systems for the purpose of intelligence gathering, disruption, deception, and prevention and delay of the use of information, while preventing the enemy from doing the same to one’s own computer systems”, and — “A traditional attack (barrage, bombing, physical sabotage) on computer systems… is not classified as cyberwar” (p. 28). Effect does not define cyber. Means do. Destroying a data centre with a cruise missile produces the same outage as destroying it with malware, and only one of them is a cyber operation. This is not pedantry; it is the rule that decides which service is tasked, which budget pays and which legal regime applies.

Under the same framing, information warfare decomposes into four things: computer warfare, electronic warfare, psychological warfare and media management (p. 25). Futter draws the identical map seven years later from Leicester, with the operational vocabulary attached: the top-level split is between Information Warfare and Computer Network Operations, with CNO able to be a component of IW, while jamming radar or communications is Electronic Warfare and neither (2018, p. 210). Within CNO he restores the distinctions the word “cyber” erased — Computer Network Attack (disruption or physical damage), Computer Network Exploitation (theft of information: Moonlight Maze, the OPM breach) and Computer Network Defence, itself split into information, network and computer security (pp. 210–211). Only “the most sophisticated and destructive CNAs” qualify as using weapons. His worked example is the 2016 DNC hack: CNE to acquire the data, IW to use it. One operation, two disciplines, and a national system that owns only one of them will describe it as half an attack.

The Israeli doctrinal layer supplies three further instruments that a mid-sized state can lift directly. The first is the three-group taxonomy of cyber weapons: unequivocally offensive (malware, worms, Trojans, logic bombs, denial of service); dual use (network monitoring, vulnerability scanning, penetration testing, encryption, camouflage of content and communications); and unequivocally defensive (firewall, disaster recovery) (Tabansky 2011, p. 80). The middle category is simultaneously the root of Israel’s export-control problem and the root of its product industry, and we return to it in Section IV.

The second is an eight-level severity ladder of hostile cyber activity, descending in order: attack on civilian targets causing physical damage · attack on critical national information infrastructures causing physical damage · attack on military targets inside sovereign territory · attack on military targets outside it · insertion of dormant attack tools as attack preparation · crime and industrial espionage · use of dual-use tools for intelligence gathering and penetration testing · propaganda, abuse and defacement of official websites (p. 82). A ladder of this kind is what allows a state to route an incident automatically to the right responder, and most national systems do not have one written down.

The third is the split that does the most institutional work of anything in this literature: risks to cyberspace versus risks through cyberspace (p. 85). Threats to the infrastructure itself are answered by critical information infrastructure protection. Crime, espionage, terrorist coordination and malware travel through it and are answered by police, intelligence and regulators. Two categories, two very different agencies — and the failure to draw the line is why so many national cyber agencies spend their first five years arguing with their interior ministry.

Israeli doctrine is also unusually blunt about what does not work. On deterrence: “the Cold War model of nuclear deterrence is utterly impracticable in the cyber battlefield”, and because attribution is slow and uncertain, “any deterrence in cyberspace today must be based on preventing the attacker from scoring an achievement” (p. 83) — deterrence by denial, and the doctrinal origin of Israel’s investment in defence in depth and of the Iron Dome analogy that later became the “Cyber Dome”. On prioritisation: there is no objective way to rank what deserves protection, because “the relative importance of a computer system, and as a result, the amount of public investment required to defend it, are subject to a public discussion and a political fight” (p. 84). Ben-Israel and Tabansky add four tests for calling a cyber attack an act of war — organisational and geographic source, motive, level of complexity, and results including what would have happened without the defence — then concede that “answers sufficient for setting policy will undoubtedly be lacking” (2011, pp. 29–30). Their own list of open questions from 2011 is still open in 2026: is crashing a national banking system an act of war if nobody dies; are civilians who conduct computer warfare legitimate targets; is computer warfare between friendly states for economic intelligence “warfare” at all (pp. 31–32).

The third doctrinal position, and the one that has moved furthest since 2020, is that most of this is not warfare at all. The Texas National Security Review roundtable opens with the state of the field in five words — “Cyber war is out. But what is in?” — and reports that scholars “generally recognize the limits of cyber war as a useful concept” (Chesney and Smeets 2020, p. 2). Joshua Rovner’s candidate replacement is the cleanest boundary marker available: “An intelligence contest is an information duel… about maintaining an information advantage. All things being equal, the goal is to have more and better information, and success means keeping the other side in the dark” (p. 11) — as against war, “the use of organized violence to compel enemies to change their behavior”, and against arms racing, which requires transparency to work. His five defining characteristics are a usable taxonomy: collecting more and better information on adversary capabilities and intentions · exploiting what is discovered for practical gain, including reverse-engineering stolen intellectual property · a reciprocal effort to undermine adversary morale, institutions and alliances · sabotage of rival organisations · a contest run largely below the threshold of violence (pp. 13–14). His verdict is that these “differ from traditional intelligence activities in degree, not kind” (p. 12), and he explains why states prefer sabotage to war in terms any minister can follow: the results are “both practical and psychological… It may not be necessary to cause physical damage if personnel in target organizations fall victim to frustration and finger pointing” (p. 16). Two of his three examples — Natanz and Saudi Aramco — are the Israel–Iran file.

The panel splits roughly evenly, and the split is the useful part. Warner, Fischerkeller and Harknett argue that scale changes the quality of the activity and pushes it beyond intelligence; Lindsay and Rovner argue that the functional imperatives of intelligence and counter-intelligence explain the behaviour without a new framework (p. 6). A national doctrine has to pick, because the answer determines who owns cyber — the intelligence services or the military — and no organisational chart survives leaving it open. The roundtable closes with the governance warning that belongs in the founding legislation: intelligence officials “will also face increasing scrutiny from overseers, who have legitimate questions about how states compete in a domain they share with civilians. Allies and partner states, meanwhile, will likely have questions about activities on their own networks” (p. 17).

What it makes visible: the adversary, the threshold, the tasking, the escalation ladder, and the honest limits of deterrence. What it hides: everything that is information warfare but not computer warfare — which is to say, the half of the problem Russia actually runs. Section II takes that up.

4. The market definition — cyber as an administered category for allocating capital

The fourth definition is the one most people encounter first, and almost nobody reads as what it is: a governed standard with a committee, a rulebook and a revision cycle.

Nasdaq’s index classification is the purest specimen because it has to be adjudicable. Its definition — cyber security as “enabling the protection of and secure communication between unique nodes of the internet from both external and internal threats” (Jones 2020, p. 5) — is not an attempt at conceptual precision. It is an attempt at decidability, because a committee has to say yes or no about a specific company by a specific date. The industry is then split into exactly two classes: an Infrastructure Provider, “a direct provider of hardware or software for cyber security and for which cyber security business activities are the key driver of the business”, and a Service Provider, “a company whose business model is defined by its role in providing secure cyber based services”. The distinction is crisp: “Service Providers allow for their clients to conduct business securely while Infrastructure Providers are providing security itself” (pp. 5–6). As of 30 September 2020 the index stood at 63% infrastructure and 37% services.

Read the governance, which is where the real lesson is. An ISE Cyber Security Industry Classification Committee vets companies using “published audited annual reports and discussions with company investor relations groups, industry participants and experts”. Each company is assigned to a single category by principal business activity, with revenue the key determinant. Companies “may not apply, and may not be nominated for inclusion”. Reviews are quarterly, plus ad hoc on mergers, bankruptcy or delisting (p. 5). The perimeter of “cybertech” is an administered boundary, redrawn four times a year by people you cannot lobby. Every market map, magic quadrant and category listing a founder or an official reads is an artefact of the same kind, with an owner, a method and an incentive — and should be read that way rather than as a fact of nature.

The index also settles an empirical question that national industrial strategies routinely get wrong. Measured against the Nasdaq Global Benchmark Technology Index, the cyber index is about 54.9% software and 25.1% computer services, against 28.5% and 6.2% for technology as a whole — and it has zero semiconductor and computer-hardware exposure and only 2.5% internet, against 19.2%, 20.8% and 19.4% (p. 6). Cybertech is empirically a software-and-services industry, not a hardware one. A country planning a cyber industrial policy around fabrication or appliances is planning around the 2005 version of the market.

Two further things in this document are worth keeping. The first is that the index provider concedes its own instability: “just like the dynamic nature of the cyber threats, cyber security technology is also dynamic and is a moving target for many cyber security customers. In essence, there is no one consistent technology or segment” (p. 3). Any taxonomy — Nasdaq’s, Deloitte’s, ENISA’s, or the twelve segments in Section III of this report — is a snapshot with a shelf life. The second is that the paper’s economics are cited from vendor-adjacent sources: a $6 trillion cybercrime-damage figure for 2021 from Cybersecurity Ventures, and a $161bn-to-$363bn market forecast from Mordor Intelligence (p. 1). That is exactly the circularity Futter warned about — the market sizes the threat that sizes the market — appearing inside an investment-grade document that will be quoted in parliamentary committees for a decade.

The second market definition is the one that actually describes Israel. Deloitte’s Israel Cyber Industry Overview builds its taxonomy from “nearly 300 private Israeli or Israeli-affiliated cybersecurity companies (with Israeli founders)”, excluding listed and acquired firms, and sorts them into sixteen categories, each with a working definition: Vulnerability & Risk Management · IoT · Data Security & Privacy · Security Operations · Web Security · Application Security · Identity & Access Management · Fraud & Transactions · Endpoint Security · Network Security · Cloud Security · Threat Intelligence · SaaS Security · Blockchain Security · Email Security · Mobile Security (Deloitte 2024, pp. 16–23).

The shape of that industry differs depending on which unit you count, and the differences are informative. By company count the leaders are Vulnerability & Risk Management with 39 firms, IoT with 33, Data Security & Privacy with 28, Application Security with 24 and Security Operations with 24. By capital raised the order changes: Vulnerability & Risk Management $2,606m, Application Security $2,317m, Cloud Security $2,107m, Network Security $1,410m, Endpoint Security $1,335m. By employment it changes again: Application Security 3,068, Vulnerability & Risk Management 2,965, Cloud Security 2,648, Endpoint Security 2,326, IoT 1,829 (p. 16). Cloud Security is the extreme case and the most instructive: only fourteen companies, yet 2,648 employees and $2.1bn raised — which is what a segment looks like when three firms (Wiz, Orca, Aqua) have captured it. The sector as a whole “employs over 23,500 individuals, with a majority in Israel”, and “the top 10 companies collectively account for more than 7,500” (p. 16).

Deloitte also records the demand-side shift that redefines the category more profoundly than any taxonomy revision. Cyber spending by financial institutions fell from 0.72% of revenue in 2021 to 0.54% in 2023 — and the fact that it is now measured against revenue rather than against the IT budget “is a direct outcome of the broad impact of cyber on the entire business activities” (p. 11). Cyber has migrated from a line item inside IT to a line item beside it. That migration is the market’s version of NIST adding GOVERN.

The third market definition is economic, and it explains why the other two behave as they do. The World Bank’s Cybersecurity Economics for Emerging Markets treats the industry as an economy rather than a product catalogue. Global spending on information security and risk management “grew at twice the rate of the global economy in 2022, and it is projected to grow at over four times in 2024, representing spending of almost 0.2 percent of the world’s gross domestic product” (Vergara Cobos 2024, p. 75). The market is forecast to grow at an 11% compound rate from 2020 to 2027, with government buyers about 36% of it, “primarily driven by demand from the United States” (p. 79). And it is extraordinarily concentrated: “Approximately 54 percent of global spending on cybersecurity comes from North America, which is 16 times larger than the combined spending of all the countries in Latin America and the Caribbean” (p. 75).

Two implications follow immediately and neither is usually stated. First, any exporting cyber industry is built for one customer base, and a European state deciding to build one must decide consciously whether to replicate that dependence or hedge it. Second, the state is not a bystander in this market: per-capita government cybersecurity budgets exceed US$30 in Canada and the United States and are “less than US$1 in highly targeted developing countries like India and Mexico” (p. 74). Governments in high-income countries shape the market through procurement, standards, certification and R&D — Germany’s BSI standards are cited as setting de facto European market terms (p. 79). Where a state spends, a segment appears.

What the market definition makes visible: money, employment, concentration, the shape of demand, and the fact that categories are governed objects with owners. What it hides: everything the buyer does not buy. Nothing that cannot be sold appears in it — not doctrine, not deterrence, not the cognitive domain, not the unglamorous work of a national CERT. The gravest error in national cyber policy is letting the market’s definition, which exists to sell products, quietly become the state’s, which exists to allocate sovereign capability.

II · What cyber is not

A definition is only as useful as its edges. Three edges do the institutional work, and the third one is where states get hurt.

5. The boundary with IT security — cyber is not the security of your own computers

The first boundary is the one Tabansky drew in 2011 and it separates risks to cyberspace from risks through cyberspace (2011, p. 85). Threats to the infrastructure itself — to the routers, the fibre, the control systems, the resolvers — are answered by critical information infrastructure protection, and they are a national-security matter because the asset is national. Crime, espionage, fraud, terrorist coordination and commodity malware merely travel through the infrastructure, and they are answered by police, regulators, sectoral supervisors and the organisations themselves. Both are commonly called “cyber”. They require different agencies, different powers, different evidentiary standards and different budgets.

Futter puts the same test in a form a minister can apply: separate “the everyday challenges of the digital age (which might have to be managed individually or by organisations) from new risks that are posed to national security (which should be managed by governments)” (2018, p. 210). A national cyber agency that does not enforce this line ends up as a very expensive help desk, because the volume of the first category is effectively infinite and the second category generates no tickets at all until it generates a catastrophe.

The practical marker of the boundary is who is the referent object. If the answer is “this organisation’s data and uptime”, it is information security, and the right instruments are standards, insurance, procurement and liability. If the answer is “a function the country cannot do without”, it is cyber defence, and the right instruments are regulation of named entities, national situational awareness and state capability. Israel’s architecture enforces this by regulating named critical-infrastructure entities rather than whole sectors and reaching everything else through guidance, sectoral regulators and market mechanisms — which is why its critical infrastructure “has been guided, but not extensively regulated, by the state since 2002” and “most of the market is not regulated for cybersecurity risk management” (NIST and INCD 2020, p. 1). Light regulation is not an absence of a decision. It is the decision.

6. The boundary with intelligence — cyber is not a war, and mostly it is not even a conflict

The second boundary is the one the TNSR roundtable spent a special issue failing to agree on, which is itself the finding. If Rovner is right that state cyber activity is an intelligence contest differing from classical espionage “in degree, not kind” (2020, p. 12), then the institution that should own most of it already exists in every country, has a legal framework, an oversight regime and a professional culture — and creating a “cyber command” to do it again is duplication with worse oversight. If Warner, Fischerkeller and Harknett are right that scale changes the quality of the activity, then a new institution and a new doctrine of persistent engagement are justified.

Most European states have resolved this by not resolving it, which produces the characteristic pathology: an intelligence service running operations, a military command writing doctrine about them, and a civilian agency issuing advisories about their consequences, with no single threat picture. The transferable discipline here is not a preferred answer but the requirement to give one in writing. Name, in the founding document, whether cyber operations are an intelligence function that the military supports or a military function that intelligence supports. Israel’s answer is that the IDF leads in war and the civilian Directorate leads in peacetime, with the special bodies explicitly carved out of the 2011 resolution — a published division of labour with a switch, rather than a permanent ambiguity.

The boundary also has a measurement consequence. If cyber is mostly an intelligence contest, then the indicators of success are intelligence indicators — access maintained, access denied, adversary operations exposed and burned — and none of them appear in a national dashboard of incidents. A country that measures its cyber performance by incident counts is measuring the smallest and least strategic part of what is happening to it.

7. The boundary with information and influence operations — and the hole it leaves

The third boundary is the important one, and it is the reason this report exists in a series that includes Report 6.

The Israeli doctrinal definition is means-based and therefore precise: information warfare decomposes into computer warfare, electronic warfare, psychological warfare and media management, and only the first is cyber (Ben-Israel and Tabansky 2011, p. 25). Futter’s map is identical: Information Warfare and Computer Network Operations are distinct top-level categories, CNO can be a component of IW, and jamming is neither (2018, p. 210). Both are analytically correct. Both are institutionally dangerous, and for the same reason.

If cyber is defined by means, then the cognitive domain sits outside the definition — and unless the same document names its owner, it sits outside everybody’s mandate. This is not a hypothetical. Report 6 in this series documented it in the Israeli case in detail: a February 2025 national cyber strategy that lists a public mindspace resilient to foreign influence among its objectives, names no owner for it, and is accompanied by no law giving anyone the power to act; a former Israeli intelligence officer writing that “Israel lacks a national strategy for dealing with such foreign interventions: the Israeli Security Agency has insufficient legal powers to act, and the government’s cooperation with civil society bodies on this issue is in its infancy” (Rakov, JISS 2025, p. 9); and, since April 2023, a Kremlin-steered Hebrew-language influence operation running inside Israel with media clones, bought placements in mainstream outlets and a costed plan to seat a party in the Knesset. The country with the world’s second-best technical cyber defence has no institution for the other half of the same adversary’s mission.

The adversary, meanwhile, does not recognise the boundary at all. Russian doctrine operates informatsionnoe protivoborstvo — information confrontation — with an information-technical limb and an information-psychological limb under one chain of command, and Russian theorists “generally do not use the terms cyber (kiber) or cyberwarfare (kibervoyna), except when referring to Western or other foreign writings on the topic” (Connell and Vogler, CNA 2017, p. 11, cited in Report 6). Futter’s worked example makes the point without Russia: the 2016 DNC operation was computer network exploitation to acquire the material and information warfare to use it. One operation, two disciplines. A state with an agency for only one of them will see half of it, report half of it, and attribute half of it.

The resolution is not to stretch “cyber” until it covers the cognitive domain. That is what produces the mush Futter objects to, and it would put a technical agency in charge of speech — which is both incompetent and constitutionally alarming. The resolution is to keep the boundary and name the owner on both sides of it in the same act. Draw the line where Ben-Israel and Tabansky drew it, then immediately say: computer network operations here, foreign information manipulation there, one shared threat picture, one joint assessment, two mandates with different powers. Report 6 sets out the European models to copy for the second half — Sweden’s peacetime psychological-defence agency, France’s VIGINUM publishing attribution-grade technical dossiers with no takedown powers, the EEAS vocabulary and its enabler-focused deterrence playbook. The only novel instruction from this report is about sequencing: the hole is created at the moment of definition, so it has to be closed in the same document. A boundary drawn in a strategy and an owner named three years later in a different ministry is not a system; it is a gap with a timestamp.

III · The anatomy of cybertech

If the four definitions explain what cyber is, the industry explains what cybertech is. The taxonomy below is drawn from the fifty-two company dossiers behind this series rather than from an analyst’s quadrant, and it is offered with the same warning Nasdaq gives about its own: it is a snapshot. Deloitte counts sixteen Israeli categories; ENISA’s value stack groups the same firms five ways; Nasdaq sorts them into two. The twelve below are the segments that the evidence of actual companies, actual buyers and actual acquisitions supports in 2026.

8. The twelve segments, and what each one actually protects

• Network and edge — protects the path between things, and increasingly is the path. Check Point (the stateful-inspection firewall, 1993, and a $13.7B installed-base business), Cato Networks (one networking-and-security stack on its own global backbone, SASE), Radware (carrier-grade DDoS), Zero Networks (automated microsegmentation, agentless, deployed in weeks), Imperva (web application and database protection, now inside Thales).

• Endpoint — protects the device where code actually executes. SentinelOne (autonomous single-agent XDR on its own data lake, with half of ARR now beyond endpoint), Glow (AI agents making application allow-listing workable at enterprise scale), Cynet (all-in-one XDR with bundled MDR for smaller enterprises). Deep Instinct sits here as a cautionary case: a genuine deep-learning prevention edge that lasted about five years and did not become a scaled business.

• Cloud — protects workloads and configurations in infrastructure nobody owns. Wiz (agentless graph-based risk prioritisation; acquired by Google for $32B in cash, closed March 2026), Orca (which invented agentless SideScanning and patented it), Upwind (runtime-first, the leading independent alternative), Aqua (container and runtime security since 2015, with the open-source Trivy funnel), Sweet Security (eBPF runtime sensor).

• Identity — human, non-human and agent — protects the act of being trusted. CyberArk (privileged access; for two decades “PAM meant CyberArk”; acquired by Palo Alto Networks for ~$25B), Silverfort (enforcing MFA inside the authentication layer, reaching legacy systems others cannot), Transmit Security (customer identity and passwordless), Astrix (which named non-human identity early enough to make it a budget line, and sold to Cisco for ~$400M), Zenity (security and governance for AI agents).

• Data — protects the thing everything else is a proxy for. Varonis (twenty years of permissions metadata with automated remediation, made urgent again by AI), Cyera (AI-native classification plus a data-and-identity trust layer, valued at $12B in June 2026 after buying Oasis, Ryft and Genie).

• Application and software supply chain — protects what you built and what you imported. Snyk (developer-first security, distributed through developers), Checkmarx (SAST deep in 60% of the Fortune 100), Apiiro and Cycode and Legit (application security posture management, code-to-runtime context), Oligo (eBPF proving which vulnerable library functions actually execute), Salt Security (standalone API security), Koi (user-installed extensions, packages, MCP servers and agent skills — an unclaimed control point, bought by Palo Alto Networks).

• Exposure and validation — protects nothing directly; it tells you which of the other eleven to fix first. Armis (agentless discovery and a compounding device knowledge base across IT, OT and medical; acquired by ServiceNow for $7.75B), Axonius (a neutral correlation layer over 1,400+ data sources), XM Cyber (attack-graph choke-point prioritisation), Pentera (real exploits run safely in production), Cymulate (breach and attack simulation at SaaS scale), Zafran (mitigation through controls the customer already owns, cutting “critical” findings to the exploitable ~1%).

• SOC and automation — protects the defenders’ own throughput. Torq (hyperautomation whose engine and integrations were in place when AI arrived), 7AI (agentic SOC from repeat Cybereason founders, riding on existing tools). Hunters is the cautionary case: an early and correct bet on the data-lake SIEM that learned “SIEM is a platform market”.

• Fraud and identity trust — protects a transaction where the credentials are genuine. BioCatch (behavioural biometrics across ~19B sessions a month at 350+ banks; Visa agreed to acquire for $2.4B), Forter (a cross-merchant identity graph sold with a chargeback guarantee — an outcome, not a score), Transmit again on the consumer side.

• OT and cyber-physical — protects processes that can injure people. Claroty (industrial protocol depth plus distribution through Siemens, Rockwell and Schneider), Waterfall (hardware-enforced unidirectional gateways that NERC CIP, NRC and ANSSI rules reward or require), Armis again on the medical and device side.

• Threat intelligence and response services — protects by knowing, and by turning up. KELA (fifteen years of underground data with law-enforcement credibility), Sygnia (ex-8200 breach responders whose crisis wins convert into retainers), Cellebrite (court-accepted digital forensics), Dream Security (AI-native “sovereign cyber” sold to heads of state — and carrying heavy NSO-lineage risk).

• AI security — protects models, agents and the pipelines around them, and is about eighteen months old as a discipline. Noma (discover, govern, red-team and runtime-protect AI agents), Zenity (agent governance, Microsoft-aligned, Fortune 50 deployments), Irregular (embedded evaluator for OpenAI, Anthropic and Google DeepMind; co-authored RAND’s SL1–SL5 model-weight security levels), Alice, formerly ActiveFence (a real-world adversarial dataset), plus Cyera, Oligo and Glow extending from adjacent segments.

• The SMB and MSP platform layer — protects an organisation that has no security staff at all. Guardz (MSP-native multi-tenant console with bundled engines and AI-plus-human MDR), Coro (one modular agent for lean-IT mid-market, sold 100% through channel), Cynet again.

Now notice the thing that list is designed to expose. Eleven of the twelve segments are defined by what is protected. The twelfth is defined by who buys. That is not an inconsistency in the taxonomy; it is the taxonomy telling the truth about itself. A segment is not a natural kind. It is an administered answer to a buyer’s assessment problem — and when the buyer changes shape, the segment does too. The next two points explain the mechanism.

9. How a segment is born

Segments are not discovered. They are declared, and the declaration succeeds or fails on three conditions that recur across the dossiers with unusual consistency.

The first is an unclaimed control point: a place in the stack where something consequential happens and no incumbent has a right to stand. Island found it in the browser, the last mile between a governed enterprise and an ungoverned internet, and created the enterprise-browser category outright. Koi found it in the things users install themselves — extensions, packages, MCP servers and, latterly, agent skills — a surface that belonged to no product until it belonged to Koi’s. Astrix found it in the credentials that are not people: service accounts, tokens, integrations, and now agents. Zero Networks found it in the east-west traffic that firewalls were never placed to see. In each case the company did not compete for an existing budget; it argued that a budget was missing.

The second is removal of deployment friction, which is more often the real invention than the detection logic. “No agents, results in minutes” was worth more to Wiz than any single capability it shipped, and the same agentless logic powers Orca, Armis, Axonius, Salt and Zero Networks. Pentera’s one-day proof of value and Zafran’s use of controls the customer already owns are versions of the same move. This matters for a definitional reason: under conditions where the buyer cannot verify effectiveness, time-to-first-evidence substitutes for evidence. A product that shows you something true about your own estate in an afternoon has solved the buyer’s epistemic problem, not just a security problem.

The third is naming, and it is a deliberate, budgeted activity rather than a marketing afterthought. Astrix kept saying “non-human identity” until it became a line in procurement systems; Cycode rebranded early enough to appear in the first analyst quadrants of two categories; Zenity’s CTO co-leads OWASP projects; Irregular co-authored RAND’s SL1–SL5 model-weight security levels. Research functions — Claroty’s Team82, Orca’s Research Pod, Salt Labs, Oligo, Zenity Labs, Legit — win buyers with published disclosures rather than advertising, which is simultaneously a marketing channel and a contribution to the commons. The naming of a category is a standards activity performed by a company, and a state that wants its firms to create categories rather than fill them should fund the standards seats, the disclosure programmes and the research labs, not the advertising.

Israel is unusually good at all three, and Report 1 traces the lineage in detail — stateful inspection in 1993, privileged access in 1999, the web application firewall in 2003, behavioural biometrics from 2011, SASE and developer-first security in 2015, API security in 2016, cyber asset attack surface management in 2017, agentless cloud scanning in 2019–20, the enterprise browser in 2020, non-human identity and AI-native data posture in 2021. What Report 1 did not ask is why the same country keeps doing it, and the answer is in Section IV: the categories are downstream of a doctrine that named the tool classes first.

10. How a segment dies into a platform — and the lemons market that explains both

Then the categories collapse. Since late 2023 the fifty have produced five exits at or above $2.4B — Wiz to Google at $32B, CyberArk to Palo Alto Networks at ~$25B, Armis to ServiceNow at $7.75B, Imperva to Thales at $3.6B, BioCatch to Visa at $2.4B pending — plus a long tail of $200–400M acquisitions of companies one to five years old, including Astrix to Cisco and Koi to Palo Alto Networks. The fifty are, in effect, the outsourced R&D pipeline of about eight platforms.

The demand-side driver is explicit. More than 75% of CISOs say they are pursuing vendor consolidation, and Deloitte’s finding about their motive is the one worth carrying away: they are “motivated by risk posture improvement, rather than from budget needs” (2024, p. 14). Consolidation is not a cost programme. It is buyers deciding that fewer, larger relationships produce better security than more, better products — which is a statement about their own ability to assess products, not about the products.

And that is exactly where the World Bank’s economics become load-bearing. Vergara Cobos names six market failures in cybersecurity: non-internalised systemic and third-party risk · underinvestment in R&D · information asymmetry · vendor risk exposure · misaligned incentives · and unquantifiable returns (2024, pp. 73–74, 80–84). Two of them do most of the work here. “Unlike other cost-saving projects, the returns to cybersecurity investment are unquantifiable” (p. 74) — you cannot price the attacks that did not happen. And buyers cannot judge a product’s effectiveness before an attack, which, combined with low awareness, “creates downward pressure on both the prices and quality of resilient products” (p. 73). That is Akerlof’s market for lemons, stated by a development bank about a $200bn industry.

Put the two sides together and the lifecycle stops looking like a fashion cycle and starts looking like an equilibrium. Category creation and vendor consolidation are the same information problem solved from opposite ends. Under information asymmetry a buyer cannot evaluate the good, so it substitutes a proxy. Two proxies are available. One is the category label — if the thing belongs to a recognised class, it can be compared, budgeted and defended to an audit committee — and this is why vendors invent labels, because a label is the cheapest route to legibility. The other is the size and survival of the vendor — if a large company with a long history sells it, the assessment cost falls to almost nothing — and this is why buyers consolidate. Supply-side incentives proliferate categories; demand-side incentives absorb them. Deloitte predicts precisely this asymmetric outcome: the number of categories a customer buys will shrink even as the taxonomy stays wide (2024, p. 14, and the four M&A scenarios at p. 14: scale up for IPO readiness, acquisition by a multinational, merger into a titan, and failure).

The same economics produce three further effects that any European policymaker should recognise before designing an intervention.

Prices carry the losses. “Firms translate losses from cyber incidents into price hikes, which are assumed by consumers” (Vergara Cobos 2024, p. 73). The cost of insecurity is socialised through the price level, which is why private investment sits below the social optimum and stays there without regulation.

Interdependence makes rational actors insecure. The World Bank models it as a prisoner’s dilemma: both firms gain more from securing themselves than from free-riding, but the individually rational move is to stay insecure, because “the resilience of one digital asset is contingent on the resilience of others, and the overall resilience of cyberspace depends on the security of its most vulnerable components” (p. 80). This is the formal argument for mandatory baselines, and it is stronger than the usual appeals to national security because it survives the assumption that everyone is behaving rationally.

The small end of the market is being abandoned. Top vendors report falling sales to SMEs, and small organisations are three to four times less likely than large ones to hold cyber insurance (pp. 73, 78). More than four million cyber security posts were unfilled in 2023, and 78% of non-military government sectors worldwide reported staffing shortages (pp. xviii, 79). An unserved buyer with a real problem is the textbook definition of a segment — which is why the SMB and MSP layer in the previous point exists at all, and why it is the most under-appreciated opening for a mid-sized European industry.

Finally, the shakeout is real and should temper any national ambition modelled on the Israeli boom: “nearly 40% of companies within this sector have less than a 6-month runway”, 70% of the $10–30m-revenue growth-stage cohort last raised at 2021–22 peak valuations, and hyper-growth firms trade at 15–20x ARR while slow-growth firms are “reluctantly being valued at 4x-6x ARR” (Deloitte 2024, pp. 4, 10, 13). The industry that produced the cleanest segment taxonomy in the world is describing itself mid-shakeout. One further property matters for any imitator: the correlation between global and Israeli cyber capital raised is above 0.9 (p. 10). Israeli cyber is the Israeli sector least insulated from world conditions and least penalised by local ones — after 7 October it was recovering while the wider ecosystem was not. A segment strategy built on a global category is a hedge against your own country’s politics, and that cuts both ways.

IV · The Israeli definition in practice

Definitions become institutions through a small number of moves. Israel made four, and they can be described in order.

11. The concept was layered, so the duty was layered

Tabansky’s 2011 model of cyberspace has three layers — physical, logical, data (2011, pp. 77–78). The INCD’s concept of operations, published six years later, also has three layers, but they are layers of responsibility: Aggregate Cyber Robustness, where organisations repel routine attacks themselves and the state raises the baseline through guidance, regulation and incentives; Systemic Cyber Resilience, where the state detects, removes, recovers and “immunises” the market with a defence cycle designed to outpace the adversary’s; and National Cyber Defense, an all-of-government mix of diplomatic, legal, economic, military and cyber instruments used against attackers, “beyond Israeli borders when needed” (INCD 2017, p. 9; INCD 2021, pp. 8–9). All three rest on an explicit ecosystem layer of people, knowledge and facilities.

The layering of the object became the layering of the duty. Responsibility escalates from the organisation to the state as severity rises, which is exactly the eight-level ladder of hostile activity turned into an operating model. Successive Israeli strategies keep re-describing the same architecture — Raska’s 2014 “national cyber defensive envelope” modelled on Iron Dome’s radar–interceptor–command logic, the 2017 robustness/resilience/defence triad, the 2021 market-resilience/operational-response/national-defence formulation, and the 2025 “joint security, active security, resilience” strategy with a Cyber Dome and a National SOC. The labels move; the logic does not. That stability is what a published definition buys.

The boundary this draws inside the state is worth stating precisely. The Directorate is “not at all involved” in national defence in the third sense; that layer belongs to the IDF and the defence bodies, with INCD support (ETH CSS, reporting Unna). The civilian agency owns hygiene and recovery; the military owns the adversary. The definition, not an org chart, is what makes that separation legible to a bank, a hospital or a water utility.

12. The state layer and the sectoral regulators — light regulation is a design, not a gap

Israel’s second move was to decide that the state would set the definition and other people’s regulators would enforce it. Resolution 2443 (2015) placed cyber regulation inside the existing sectoral regulators rather than creating a general cyber law, and it regulated the supply side too — professionals, products and services — as well as the users. The INCD regulates named critical-infrastructure entities, not whole sectors. For everything else the instrument is a voluntary methodology.

The Israeli Cyber Defense Methodology is that instrument, and its diffusion mechanics are the most copyable thing in this angle. It spread by five mechanisms, none of which is legislation (NIST and INCD 2020, pp. 1–2):

• Proof of concept in government first. The state was its own first adopter, which produced both evidence and a procurement lever.

• Sectoral regulators writing it into laws that already exist. The Environment Protection sector wrote the ICDM into the Hazardous Materials Act, which made it binding on every company handling hazardous materials — without a cyber law and without a parliamentary fight.

• Shipping a control as a product, not as a paragraph. “Each control contains layers of information including the requirement, explanations and examples, links to best implementation practices, example templates, relevance to confidentiality/integrity/availability, selected standards and regulations compatibility.” Plus a free automation app, with the supply-chain module released first.

• Direct outreach and a hotline. CISO and C-level engagement, and CERT-IL’s 119 training.

• An English translation, explicitly to help Israeli companies sell abroad.

That last item is the tell, and it deserves to be stated plainly. Israel translated its national security methodology into English as an export instrument. The stated next step in 2019–20 was a national ICDM-based certification scheme harmonised with international standards, plus an organisational maturity model. Israel’s ultimate answer to “what is cyber, in the market” is a certification — which is to say, a tradeable object. The definition becomes a document, the document becomes a control set, the control set becomes a certificate, and the certificate becomes something a domestic vendor can sell in Frankfurt.

Two honest caveats. Light regulation leaves real gaps: essential-but-not-critical organisations are unregulated, and Israel’s comprehensive cyber bill has been stuck since 2018. And the governance risks are concentrated ones — a directorate inside the Prime Minister’s Office, a vague legal basis, and draft powers to seize equipment and monitor traffic without a court order have all drawn sustained criticism from Israeli legal scholars. A European state copying the diffusion mechanics should not copy the legal thinness; it has the NIS2 architecture to hang them on instead.

13. The civil defender who is not a spy

The third move is the one that makes the second possible. Resolution 3611 excluded the “special bodies” from the new bureau’s remit. Resolution 2444 created a civilian operational authority and deliberately denied it law-enforcement powers. Critical-infrastructure protection was moved out of the Shin Bet. CERT-IL runs a public 119 hotline, open to any citizen, from Beersheba, with a no-fault ethos that INCD officials have compared to a public water system. CyberNet links more than ninety partner CISOs in a trusted sharing network. The Directorate’s influence rests on competence rather than coercion.

The definitional point is that this is a choice about the referent object, not about powers. If cyber is defined as the security of the state’s own systems, the natural home is the security service. If it is defined, as Ben-Israel and Tabansky defined it, as a knowledge-economy phenomenon with a security expression — “a non-rival, partially excludable good” that is a new source of growth (2011, pp. 22–24) — then the natural home is a civilian body whose customers are companies, and whose currency is trust. Everything else follows: no-fault reporting works because the reporter is not talking to a police force; voluntary methodologies spread because the issuer has no power to compel and therefore has to be useful.

Report 2 treats this as Principle 3 and Report 3 as an operating feature. Here it is a definitional consequence, and that framing matters for transfer: a state that has defined cyber as a policing problem cannot fix the resulting distrust with a communications strategy. It has to change the definition.

14. The translation layer — how a state-scale problem becomes a product category

Now the reframe, with the evidence behind it.

Go back to Tabansky’s three groups of cyber weapons and read the dual-use middle again: network monitoring · vulnerability scanning · penetration testing · encryption · camouflage of content and communications (2011, p. 80). In 2011 that was a doctrinal category, written to explain why export control in this field is hard. Read as a market map in 2026, it is the spine of the industry:

• Network monitoring → live asset intelligence across IT, OT and medical: Armis, sold to ServiceNow at $7.75B; Axonius, correlating 1,400-plus sources.

• Vulnerability scanning → cloud posture and exposure: Orca’s agentless SideScanning, Wiz’s graph, Zafran’s exploitable-1% triage.

• Penetration testing → automated adversarial validation: Pentera running real exploits safely in production, Cymulate’s simulation at SaaS scale, XM Cyber’s attack-graph choke points.

• Encryption and data protection → Varonis, Cyera.

• Camouflage of content and communications → the enterprise browser and the governed last mile (Island), and its mirror image in lawful forensics (Cellebrite).

Israel’s 2011 list of dual-use cyber tools is, read fifteen years later, a list of product categories worth tens of billions of dollars. That is not a coincidence and it is not hindsight. It is the mechanism this report is named for. Cybertech is an institutional translation layer: a state defines a capability class for doctrinal reasons, trains thousands of people inside that class at national scale, releases them on a five-to-six-year cycle, and the capability class re-emerges as a market category because the people who leave have a shared vocabulary for what the problem is.

The dossiers show the translation happening at the level of individual firms. Claroty was founded inside the Team8 foundry in 2014–15 and turned industrial-process knowledge into distribution through Siemens, Rockwell and Schneider — the commercial form of the same domain-intelligence-plus-engineering fusion that Report 3 and the offensive literature describe behind Stuxnet. Sygnia sells ex-8200 breach responders into corporate crises, converting crisis wins into retainers. XM Cyber sells an offensive-intelligence mindset as a prioritisation engine. KELA sells fifteen years of underground collection to enterprises and police forces. Irregular sells frontier-model evaluation to OpenAI, Anthropic and Google DeepMind and co-writes the security-level scale that will govern model weights. Dream Security sells “sovereign cyber” to heads of state and carries the NSO lineage with it. Each of these is a national-security function with a price list.

And the translation runs in both directions, which is the part most imitators miss. The industry functions as a national sensor network — Report 6 makes that argument in detail — and the state’s own defence consumes commercial products built by people it trained. The INCD’s platforms for real-time risk exposure and threat sharing sit on top of an ecosystem it did not have to build. That loop is what a translation layer looks like when it works: the doctrine names the class, the class trains the people, the people build the products, the products defend the state, and the state’s next problem names the next class.

It is also where the model’s worst failure lives, and the failure is definitional rather than moral. Because cyber is defined by means, an intrusion tool and an assurance tool are the same object under different licences. The dual-use middle category is not a grey zone at the edge of the industry; it is the industry’s centre of gravity. That is why Israel accounts for 43.9% of the entities in the Atlantic Council’s global spyware dataset, and why of the 74 governments known to have bought commercial spyware or forensics tools, 56 bought from firms based in or connected to Israel (Feldstein and Kot, Carnegie 2023). A state that adopts a means-based definition of cyber inherits the export-control problem on day one, whether or not it has noticed. Report 2 argues that the guardrails must be built with the capability rather than retrofitted. This report adds the reason: the guardrail is not a policy attached to the industry, it is the other side of the definition that created it.

V · Why the definition decides the outcome

The claim in this section is stronger than “words matter”. It is that the definition of cyber a state adopts determines, mechanically and in a predictable order, four things it will later experience as facts about the world.

15. The definition chooses the agency

Craigen and his co-authors put it as a diagnosis rather than an aphorism: the absence of a shared definition “impedes technological and scientific advances by reinforcing the predominantly technical view of cybersecurity while separating disciplines that should be acting in concert” (2014, p. 13). Institutions inherit the scope of the sentence that created them.

Compare two founding documents. NIST CSF 2.0 defines cybersecurity as six outcomes and contains no adversary; an agency founded on that sentence will be excellent at maturity assessment and will have no view on Iran. Israel’s Resolution 3611 gave its new bureau nineteen goals, and the list is worth reading as a definition in disguise: an annual national threat of reference · promoting R&D in cyber and supercomputing · encouraging the cyber industry · a national emergency concept · national and international exercises · a combined intelligence picture and national situation status · public warnings · national education plans · international cooperation · legislation and regulation. That is not a CERT’s mandate. It is the mandate of a body that has defined cyber as a knowledge-economy phenomenon with a security expression, and it produced, over fifteen years, both a national defence architecture and an export industry — from the same programme, because the programme’s definition covered both.

The corollary for a mid-sized state is uncomfortable but actionable. If your national cyber strategy describes cyber security as the protection of information systems, then your agency’s education, industry, research and exercise functions are all extras that a future budget round can cut without contradicting the strategy. Anything not in the definition is discretionary, and discretionary functions do not survive austerity.

16. The definition chooses the budget, and there is no objective answer underneath

Tabansky’s most honest sentence is about money: “the relative importance of a computer system, and as a result, the amount of public investment required to defend it, are subject to a public discussion and a political fight” (2011, p. 84). There is no technical method that ranks what deserves protection. A definition is the instrument that decides which fights are winnable.

Two mechanisms follow. The first is the denominator. If cyber is defined as part of IT, spending is measured against the IT budget and competes with servers; if it is defined as business risk, it is measured against revenue and competes with insurance. Deloitte’s finding that financial institutions now measure cyber spend against revenue — 0.72% in 2021, 0.54% in 2023 — and that this is “a direct outcome of the broad impact of cyber on the entire business activities” (2024, p. 11) is a definitional change appearing as an accounting change. The same shift at national level is the difference between a cyber agency funded from the interior ministry’s IT line and one funded as a security service.

The second is state purchasing power. Per-capita government cyber budgets exceed US$30 in Canada and the United States and fall below US$1 in highly targeted developing countries like India and Mexico (Vergara Cobos 2024, p. 74), and governments are roughly 36% of global demand. Where a state defines a problem and then buys against it, a segment appears — Germany’s BSI standards are cited as setting de facto European market terms (p. 79). Procurement is the most under-used definitional instrument a mid-sized state possesses, because it converts a sentence into a revenue line for firms that do not yet exist.

17. The definition chooses the measurement — and most measurement is of existence, not quality

Three respectable bodies rank Israel three different ways, and the spread is not noise. The ITU’s Global Cybersecurity Index 2024 places Israel in Tier 2 at about 93.6 out of 100 — below Estonia, Finland, Singapore, the UK and the US, and in the same band as the Czech Republic. Harvard’s Belfer National Cyber Power Index places it outside the top ten, around nineteenth of thirty, and says explicitly that Israel is under-ranked because it keeps its capabilities opaque. The IISS net assessment places it at the top of the second tier alongside the UK, behind only the United States. On market measures it is second in the world.

The explanation is definitional, not methodological. Compliance indices score whether formal institutions and paperwork exist. Power indices score publicly demonstrated capability. Market measures score revenue. The ITU index says of itself that it does not measure the quality of actions; ENISA concedes that its own national framework measures maturity rather than effectiveness. A state that adopts the standards definition of cyber will find itself optimising against an index that rewards the existence of a document — and Czechia, which passed one of the world’s first comprehensive cyber security acts in 2014 and created NÚKIB in 2017, scores well on exactly that basis while its own 2026 strategy names the real gaps: too few people and too little money in both the public and private sectors, a state that is still reactive, and a “shortage of secure and competitive domestic technological alternatives, which deepens dependence on the technologies of foreign rivals”.

The instruction is the one Report 2 gave and this report can now justify from first principles: measure the thing your definition says cyber is for. If cyber is national capability, the indicators are capability indicators — operator-course graduates placed, paid pilots with young vendors, disclosures shipped with fixes, median time from disclosure to mitigation in regulated entities, and the Oxford model’s own top stage for a national cyber marketplace, “Domestic cybersecurity products are exported to other nations and are considered superior products” (Oxford GCSCC 2021).

18. The definition chooses the blind spot

This is the point the whole report has been walking towards, and it is short.

Every definition is a boundary, and a boundary has an outside. The means-based doctrinal definition puts psychological warfare and media management outside cyber — correctly. The standards definition puts the adversary outside — deliberately. The market definition puts everything unsaleable outside — structurally. The academic definition puts operational specificity outside — by design.

A state can survive any one of these exclusions. What it cannot survive is an exclusion nobody has been made responsible for, and that is the failure mode this series has documented twice. Israel’s cognitive gap is not a consequence of incompetence; it is the logical output of a precise definition that was never paired with a second mandate. The 2025 strategy names a resilient public mindspace as an objective and names no owner. The security service lacks the legal powers. Cooperation with civil society is “in its infancy”. Meanwhile the adversary runs both limbs under one command and does not use the word “cyber” at all.

So the operational test for any national definition is a single question, asked once, in the drafting room: what does this sentence put outside, and who owns that? If the answer to the second half is silence, the definition has just created a gap that will take a decade and a crisis to close.

VI · What this means for us

Four instructions and eight moves, for a mid-sized European state and for the founders and investors inside it. The Czech Republic is the home example; the logic generalises to any country with real talent, a competent agency and no category of its own.

Define before you institutionalise

The single cheapest transferable feature in this entire library is the order in which Israel did things: definitions in public first, institutions second. Nothing about it requires an army, a threat or a start-up scene. It requires the people who will run the programme to write down, in the open and under their own names, what they think the object is.

A European state writing that document now has an advantage Israel did not: it can write all four definitions in one act, and say which is which. The academic definition to fix scope and referent objects. The standards definition, adopted from NIST or its EU mappings, to govern organisations. The doctrinal definition, with layers, a severity ladder and the risks-to versus risks-through split, to allocate national responsibility. And an explicit statement that the market’s taxonomy is not the state’s.

Choose segments deliberately, instead of importing a category map

A national industry strategy that takes Deloitte’s sixteen categories or a vendor quadrant as its target list is optimising against someone else’s snapshot of someone else’s market. The three conditions from Point 9 are the better filter, and they can be applied in a workshop: is there an unclaimed control point; can deployment friction be removed to produce evidence in an afternoon; and can the thing be named before the analysts name it?

Applied to Czechia, the evidence in this library supports four candidates rather than sixteen. Operational technology and cyber-physical security, because the industrial base is real, because NÚKIB recorded Russian-speaking hacktivists attacking weakly secured water-utility OT in 2024, and because this is the one segment where hardware-enforced approaches still win (Waterfall’s gateways exist because NERC CIP, NRC and ANSSI rules reward them — regulation creates the category). Resolver, routing and DDoS resilience, because CZ.NIC’s Knot was one of the four resolvers patched in the global NXNSAttack remediation and Czech code is therefore already inside the internet’s disclosure loop — a credential most countries cannot buy. Identity for machines and agents, because it is eighteen months old, because Astrix and Zenity proved the naming play works, and because no incumbent has a defensible position yet. And the SMB and MSP layer, because the World Bank documents vendors abandoning that buyer and Deloitte shows the Israeli market ignoring it — an unserved buyer with a real problem is the definition of a segment, and European SMEs are a larger unserved population than American ones.

Read every market map as an administered artefact

Nasdaq’s committee meets quarterly, assigns each company to exactly one class on revenue grounds, and rules that companies “may not apply, and may not be nominated for inclusion”. Deloitte’s sixteen categories are built from a specific 300-company sample with listed and acquired firms excluded. ENISA’s value stack is a statutory instrument produced under Article 8(7) of the Cybersecurity Act. Each is a considered, defensible, useful artefact — and each has an owner, a method, an incentive and a revision cycle. None is a fact about the world.

For an official, the discipline is to ask three questions of any category before budgeting against it: who adjudicates membership, on what evidence, and how often is it redrawn. For a founder, the discipline is the mirror image: a category is a governed object, so entering one is a standards activity — publish, disclose, take the OWASP seat, co-author the scale — and creating one is cheaper than winning one.

Eight moves

1. Publish a one-page national definition of cyber, signed by the people who will run the programme, before the next institutional reform. Four parts: the layers of cyberspace; the risks-to versus risks-through split; the dual-use middle category of tools named as such; and an explicit statement of what is outside the definition and who owns it. Israel’s cost for this was two journal essays.

2. Adopt the international organisational taxonomy, and say out loud why. NIST CSF 2.0 or its EU mappings, for Unna’s reason — “an international cyber defense language which supports collaboration against global cyber threats” — which beats any sovereignty argument, and was good enough for a country with far more reason than Czechia to assert its own.

3. Ship controls as products, and diffuse through the regulators you already have. Copy the ICDM’s mechanics, not its content: government as first adopter; sectoral regulators writing the methodology into existing sectoral law, as the Environment Protection regulator did with the Hazardous Materials Act; each control shipped with explanations, templates, mappings and a free automation tool; the supply-chain module first; and an English version so domestic vendors can sell the compliance abroad.

4. Make market analysis a statutory duty of the national cyber agency, and run it annually. ECSMAF is explicitly designed to be run “with limited customisation, by organisations other than ENISA”. Running it once will answer a question NÚKIB cannot currently answer: whether Czechia has categories or only companies. Keep academia, training and awareness inside the value stack when you count, as ENISA does — a country that counts only vendors will conclude it has no industry at the exact moment it is building one.

5. Pick three or four segments and buy against them. Procurement is the definitional instrument with the shortest lead time. Paid pilots with young domestic vendors in OT, resolver and routing resilience, machine and agent identity, and the MSP layer — with published evaluation criteria, because the criteria are themselves a standards contribution and will be read by buyers abroad.

6. Name the owner of the cognitive domain in the same act that defines cyber. Not inside the cyber agency, which should not have speech powers, and not three years later in another ministry. Report 6 sets out the models: a small unit under the head of government on the VIGINUM pattern with a mandate to investigate and publish and no power to order removals, sharing one threat picture and one quarterly assessment with the technical agency.

7. Write the export-control regime at the same time as the industrial strategy, because they are two sides of one definition. A means-based definition makes the dual-use middle the industry’s centre of gravity, not its edge. Israel’s cost for discovering this late is 43.9% of the entities in the Atlantic Council’s spyware dataset and a reputational liability its own firms now manage around. Published criteria, published refusals, and a licensing decision that does not move with the week’s diplomacy.

8. Measure what the definition says cyber is for, and publish the scorecard. Capability indicators over compliance indicators; the ITU tier as a footnote rather than a target; and the Oxford marketplace stage — exported domestic products considered superior — as the honest long-run goal.

Close

The question this report was asked to answer was “what actually is cyber”. The answer is that the question has four correct answers and a state has to hold all of them at once.

Cyber is an interdisciplinary object whose referent is anything with meaning or value, and whose study is a plea for a cause. It is a taxonomy of six governed outcomes that can be audited, compared across borders and used to run an economy’s hygiene. It is a subset of information warfare defined by its means, sitting on a layered domain that did not exist before people built it, contested mostly below the threshold of violence in what is probably an intelligence contest rather than a war. And it is an administered market category, redrawn quarterly by committees, behaving like a market for lemons because its buyers cannot price what they are buying until after they have needed it.

Israel is the clearest case not because it got any one of these right but because it wrote all four down, in that order, before the institutions existed, and then kept them translatable — which is why one small country produces both a signals-intelligence unit and a $32B cloud-security company, and why its 2011 doctrinal list of dual-use tools reads today as a product catalogue. Cybertech is the translation layer: the machinery that converts an intelligence problem into a product category, and the state’s next problem into the next category. That machinery is what a mid-sized European state should be trying to build. Not the threat environment, which nobody should want, and not the fifty companies, which are an output.

The last thing to carry away is the warning, because it is the cheapest to act on and the most expensive to ignore. Every definition has an outside. Israel drew its boundary precisely and left the cognitive domain beyond it with no owner, and a Kremlin directorate has been operating in that space in Hebrew since April 2023 against the best technical cyber defence in the world outside the United States. A definition is not a description of a field. It is an allocation of responsibility, and the part you leave out is allocated to nobody. Write the sentence, and then — in the same document, on the same day — say who owns everything the sentence excludes.

That single asymmetry invalidates most of the received wisdom about how to build a company. The SaaS playbook of the 2010s — win distribution, charge per seat, make humans a little more productive, defend with switching costs — was written for a world where software was expensive to build and its job was to assist work. In the new world software is nearly free to build and its job is to do the work, which means the old advice doesn’t just underperform, it actively misleads. Pricing per seat leaves nine-tenths of the value on the table. Competing on having the best model is competing on an input that commoditizes to zero. Hiring an army is a liability when five people and a fleet of agents can out-ship a hundred. Almost every instinct from the last cycle has to be re-examined, and that is uncomfortable, because instincts are exactly the thing you don’t notice you’re using.

The trouble with principles, though, is that they sound obvious — and an obvious-sounding principle is dangerous, because it lets you nod along without ever changing what you do on Monday. “Own the loop the incumbent can’t cross.” Everyone agrees. Nobody can tell you what it means when you’re actually deciding which feature to build next, which customer to chase, how to price. A principle you cannot operationalize is a fortune cookie: pleasant, forgettable, useless. The gap between knowing a rule and being able to act on it is where almost all the value — and almost all the failure — actually lives.

So this report does the un-fun thing. It takes each of the 32 principles and refuses to leave them as slogans. For every one it asks the only three questions that matter to a builder: what does this actually look like inside a real company, what is the specific mechanic, and how do you tell the version that works from the version that’s just a nice slide? The answers are anchored to companies you can go study today — not “look at Stripe” as a vague gesture at greatness, but the exact move Stripe made, what it priced, what liability it absorbed, what it refused to do, and why that particular decision compounded into a giant. The examples are not decoration. They are the argument. If a principle can’t be shown through what a real team actually did, it has no business in a founder’s head.

Underneath all 32 sits one inversion, and it is the spine of the whole report: when intelligence becomes free, value flees to everything that isn’t free. The model is a tide — it lifts every boat equally, which is precisely why it decides no race. Your company is not the model you use or the wave you ride; it is the loop you own that the tide can’t wash away: the proprietary data your own operations generate, the trust your customer has learned to place in you, the system of record you’ve quietly become, the regulatory position you fought through, the distribution you locked, the mission that holds your team together through the grind. Build your company out of the things free intelligence cannot hand you, and the free intelligence becomes your engine instead of your executioner.

The stakes of getting this wrong are not abstract. A large share of the companies calling themselves “AI startups” right now are already dead and simply haven’t noticed — because they built their entire identity on an input that is racing to zero, with no loop around it that survives the model getting commoditized. They have a demo, a wrapper, and a runway, and when the next model release makes their one trick a free feature, they evaporate. The companies that endure are doing the opposite: using today’s cheap intelligence and their own speed to dig a hole no amount of future intelligence or speed can refill. The difference between the two is invisible on a pitch deck and total in the outcome, and it is exactly what these principles are meant to make visible.

The 32 are grouped into five movements, deliberately ordered from opportunity to endurance — from “what should I even build” all the way through to “how am I still standing in a decade.” The first movement is about choosing a game you can win; the second, the heart of the report, is about building a position that lasts when the product itself is copyable in weeks; the third is about team, speed, and craft inside an AI-native company; the fourth is about getting found and getting believed; the fifth is about the timing, conviction, and endurance to stay in the game long enough for the position to pay off. Each principle follows the same shape — the core idea and why it’s brutally true now, the exact operational mechanism, the concrete companies that live it, the failure mode that proves the rule, and the sharp takeaway you can act on.

A word on how to use it, and a warning. Read straight through, it’s a strategy education; kept on the desk and opened to one principle when you’re stuck on a real decision, it’s a tool — that’s the better way to use it. The warning: some of these examples cut against companies people admire, and some of the “winners” named here will stumble after this is written, because that is the nature of pointing at live companies in a moving market. Never canonize a logo. The point is always to isolate the mechanic — the repeatable move — so that when the specific companies change, and they will, you still hold the principle. What follows first is a four-line summary of all 32, so you can see the whole shape at a glance; then the deep breakdowns begin.

The 32 Principles at a Glance — eight points each

A scannable summary of all 32. The full breakdown, with the mechanics and failures, follows below.

I. What to Build

1. Build the worker, not the tool.

• The shift: software stops assisting work and starts doing it.

• Old vs new: a tool competes for the software budget; a worker competes for payroll.

• The test: don’t ask “how do I make this person 20% faster?” — ask “what job can an agent own end to end?”

• The mechanic: scope a complete, measurable unit of work and take full responsibility for the result.

• Pricing unlock: you can charge like labor ($2k/mo) instead of like software ($50/seat).

• Moat: owning the whole job means owning the data and the outcome, not a replaceable feature.

• Lives it: Sierra (resolves support tickets), Cognition/Devin (ships code).

• The trap: “copilots” that still need a human driving every step — a feature, not a company.

2. Sell the outcome, not the access.

• The shift: seat-based pricing taxes a world that no longer exists.

• The mechanic: charge for work delivered — the ticket resolved, the fraud stopped, the case won.

• Why it wins: you capture a fraction of value, not a fraction of a software budget line.

• The math: replacing a $6k/mo task lets you charge $2k and still be a bargain.

• Alignment: your revenue scales with the customer’s volume, not their headcount.

• Moat: to price on outcomes you must own the outcome, which is hard to rip out.

• Lives it: Intercom Fin (per resolution), Harvey, Cohere Health.

• The trap: building an agent that does the work but still pricing it per seat.

3. Aim at payroll, not the IT budget.

• The shift: the market moved from a few trillion in IT spend to tens of trillions in labor.

• The test: always ask which budget line you come out of — then pick the bigger one.

• The size: redirecting payroll into software is a ~10× larger prize than SaaS chased.

• The mechanic: frame and price against the fully-loaded cost of the role you replace.

• Buyer: you’re selling to a P&L owner counting heads, not an IT admin counting licenses.

• Moat: own enough of the role that removing you means re-hiring humans.

• Lives it: vertical agents that replace a function, not a tool.

• The trap: selling “productivity” into the IT line and capping your own ceiling.

4. The best wedge is a boring, expensive, hated job.

• The shift: glamour is crowded and cheap; drudgery is defensible and rich.

• Why now: AI can finally do the tedious text-and-decision work that was un-automatable.

• The rule: the more tedious, high-stakes, and regulated the task, the weaker the incumbent.

• Where: prior authorization, tax reconciliation, compliance evidence, claims, freight quoting.

• The mechanic: absorb a specific painful job so completely the customer forgets it existed.

• Moat: the difficulty and ugliness is the barrier that keeps the next entrant out.

• Lives it: EvenUp (injury demand letters), Cohere Health, ServiceTitan.

• The trap: chasing the demo-friendly, everyone-is-already-there problem.

5. Go vertical and deep before horizontal and wide.

• The shift: a general assistant is a demo; a specialist that owns one industry’s job is a business.

• The mechanic: learn the language, integrate the systems of record, absorb the edge cases — then expand.

• Why: depth compounds into a moat; breadth is a landgrab you lose to whoever went deep.

• Sequencing: win one vertical to indispensability, then widen from a position of strength.

• Data: a narrow domain gives you a proprietary dataset a horizontal player can’t match.

• GTM: a vertical has its own channels, conferences, and word-of-mouth you can dominate.

• Lives it: ServiceTitan, Procore, Toast.

• The trap: “horizontal AI for everyone,” defensible to no one, sold to no one specific.

6. Automate the workflow; don’t digitize it.

• The shift: last cycle moved paper onto screens; this cycle deletes the process.

• The test: if a human still drives every step, you’ve digitized, not automated.

• The mechanic: don’t build a nicer interface for the task — build the thing that removes the task.

• Why now: agents can execute multi-step work, not just record it.

• Value: deleting a workflow captures the labor cost, not just a software fee.

• Moat: once the process runs itself through you, you become the process.

• Lives it: Ramp (deleted the expense report), Deel, autonomous back-office startups.

• The trap: a prettier dashboard bolted onto the same broken manual workflow.

7. Hunt where a constraint is creating scarcity.

• The shift: cheap creation makes most things abundant, which crushes margins.

• The rule: build where something is scarce — scarcity is where pricing power lives.

• The scarcities: power for AI, firm clean energy, clearances, licenses, rare earths, trusted identity.

• Why now: AI’s demand for electricity turned sleepy energy into the hottest arena in decades.

• The mechanic: own or orchestrate the scarce input everyone downstream is desperate for.

• Moat: a wall that stops everyone else becomes your foundation.

• Lives it: CoreWeave (compute), Crusoe (stranded power), Base Power (firm home power).

• The trap: competing in the abundant, commoditized middle where price goes to zero.

8. Enter the layer that is underbuilt today.

• The shift: value sits in infrastructure early in a wave and migrates up to apps as it matures.

• The mechanic: build the picks-and-shovels everyone will need next year, not last year’s app.

• Reading it: find the missing layer — memory for agents, power orchestration, agent identity.

• Timing: enter the layer that’s underbuilt now and ride it up the stack.

• Leverage: infrastructure sells to everyone building on the wave, not one end customer.

• Moat: become the default rail and you tax the whole ecosystem above you.

• Lives it: Scale AI (data), Pinecone (vectors), Databricks (the lakehouse).

• The trap: building the fancy application before the boring infrastructure it needs exists.

II. Where the Moat Lives

9. Own the loop the incumbent cannot cross.

• The master principle: in a world of week-one copies, the moat is the loop a rival structurally can’t replicate.

• The three loops: proprietary operational data, the liability the customer won’t hold, the system of record.

• The test: “we used a good model” is not a moat — it’s a countdown to being copied.

• The mechanic: design so your advantage grows from running the business, not from a one-time build.

• Why now: intelligence is a commodity, so the durable edge has to live outside the model.

• Compounding: the loop should widen every quarter you operate, not stay flat.

• Lives it: Tesla (fleet data), Nvidia (CUDA lock-in), Stripe (financial graph).

• The trap: a thin wrapper with nothing compounding underneath it.

10. Data you generate beats data you scraped.

• The shift: everyone can train on the internet; only you have your product’s real-world exhaust.

• The mechanic: every transaction, correction, and deployment must make your system uniquely better.

• Why it’s durable: scraped data is a commodity; generated data is a fingerprint no one can copy.

• Design point: build the capture loop into the core product, not a later analytics bolt-on.

• Flywheel: better system → more usage → more proprietary data → better system.

• Moat: a rival starting today can’t retrofit the years of data you’ve been compounding.

• Lives it: Tesla (shadow mode), Scale (labeling loop), Midjourney (preference data).

• The trap: depending on data anyone can buy, license, or crawl.

11. Take on the liability your customer refuses to.

• The shift: enterprises won’t let an agent touch money, patients, or filings for fear of being blamed.

• The mechanic: absorb that fear — guarantee it, insure it, own the consequences.

• The reframe: you stop selling software and start selling the removal of risk.

• Why it sticks: once you carry the liability, ripping you out re-exposes the customer.

• Sequencing: earn small increments of trusted autonomy, then take on more risk over time.

• Pricing: owning the downside justifies premium, outcome-based pricing.

• Lives it: Coalition (cyber insurance), Cohere Health (payer decisions), Anduril (mission outcomes).

• The trap: shipping the capability while carefully dodging the accountability.

12. Become the system of record.

• The shift: tools get swapped; systems of record get inherited.

• The mechanic: be the authoritative place a company’s work, data, and decisions live.

• Why it compounds: switching costs rise and every adjacent workflow becomes yours to take.

• Land-and-expand: own the record, then sell payments, analytics, and agents on top of it.

• Gravity: the record pulls integrations toward you and pushes competitors to the edge.

• Moat: ripping out a system of record means re-platforming the whole business.

• Lives it: Rippling (employee record), Toast (restaurant OS), Salesforce (customer record).

• The trap: orbiting someone else’s source of truth as a replaceable satellite feature.

13. The model is a rental; the moat is everything around it.

• The shift: foundation models are converging and commoditizing toward zero.

• The bet to avoid: staking the company on having the smartest model is a coin flip you don’t control.

• The mechanic: treat intelligence as a cheap, swappable input and build durability elsewhere.

• Where the moat is: the data, the workflow, the trust, the distribution, the integrations.

• Design point: stay model-agnostic so you ride every upgrade instead of betting on one.

• Why now: each new model release turns yesterday’s clever trick into a free feature.

• Lives it: Cursor, Perplexity, Harvey (durable products on swappable models).

• The trap: Jasper — a thin wrapper the platform simply absorbed.

14. Regulation is a moat once you’re through it.

• The shift: compliance, licensing, and clearances look like friction — which is exactly the point.

• The mechanic: route through regulation, not around it, and pull the ladder up behind you.

• Why it protects you: the pain of getting certified is the wall that blocks the next entrant.

• Where: licensed finance, defense clearances, healthcare/HIPAA, audited compliance.

• Compounding: each certification opens buyers competitors legally can’t serve.

• Timing: early regulatory pain buys years of protected growth later.

• Lives it: Coinbase (licenses), Tempus (clinical), Anduril (clearances).

• The trap: offshore or unregulated shortcuts (see FTX) that implode and take you with them.

15. Distribution is a moat, not an afterthought.

• The shift: cheap creation means a thousand teams can build your product; few can get it adopted.

• The mechanic: embed in the tool people already use, or ride a partner’s rail.

• Why it wins: a locked channel beats a cleverer feature every time.

• Design point: engineer the go-to-market as deliberately as the technology.

• Loops: bottom-up PLG, viral sharing, or a network that compounds each new user.

• Moat: owning distribution means a copycat product can’t reach your customers.

• Lives it: Ramp, Figma (multiplayer sharing), Stripe (developer distribution).

• The trap: a great product with no wedge into an existing loop, dying in obscurity.

16. Compounding beats clever.

• The shift: a clever one-time trick gets copied; a compounding loop pulls away and never gives the lead back.

• The test: ask of every decision — does this compound, or is it a flat one-off?

• The engines: network effects, data flywheels, brand, switching costs, ecosystem.

• The mechanic: wire the advantage so it grows while you sleep, from usage itself.

• Time: small compounding edges become unbridgeable over years.

• Why now: when features are copyable in weeks, only compounding advantages survive.

• Lives it: Uber (liquidity), Amazon (flywheel), Scale (data).

• The trap: one-hit viral apps with no mechanic to hold the gain they spiked.

III. How to Build

17. Stay small on purpose.

• The shift: a handful of people plus a fleet of agents now do what once took hundreds.

• The reframe: headcount is a liability, not a trophy — it slows decisions and burns runway.

• The math: the winners post extreme revenue-per-employee, not the biggest org charts.

• The mechanic: keep the team the smallest that can do the job, and automate the rest.

• Speed: small teams decide and ship faster than any competitor with a hierarchy.

• Ownership: fewer people means higher standards and more skin in the game.

• Lives it: Midjourney, Cursor, Telegram (huge revenue on tiny teams).

• The trap: Fast — headcount and burn scaled ahead of any real moat, then collapsed.

18. Be AI-native inside, not just AI-branded outside.

• The shift: don’t only sell agents — run on them.

• The mechanic: rebuild support, research, ops, and first drafts of everything around AI.

• Why it wins: an AI-native operating model out-executes AI bolted onto a 2015 org chart.

• Credibility: eating your own thesis is proof the product actually works.

• Cost: AI-native ops means far lower cost to serve and faster iteration.

• Culture: teams that live with agents build better ones.

• Lives it: Klarna (AI support), Ramp, Shopify.

• The trap: an “AI company” quietly run like a legacy one, all marketing, no metabolism.

19. Ship to learn; iteration is nearly free now.

• The shift: the cost of building and rebuilding collapsed, so learning speed is the whole game.

• The loop: ship the smallest real thing → real user → watch it break → go again, in days.

• The truth: planning is a poor substitute for contact with reality.

• The mechanic: instrument everything so every release teaches you something specific.

• Advantage: whoever learns fastest wins, and shipping is how you learn.

• Cadence: weekly or daily releases beat quarterly roadmaps.

• Lives it: Cursor, Bolt, Midjourney (relentless shipping cadence).

• The trap: Quibi/Glass — big-bang launches with no learning loop, wrong and expensive.

20. Verify everything; automation manufactures its own demand for proof.

• The shift: every unit of machine-speed work creates a unit of doubt — did it do it right?

• The mechanic: build checking, tracing, and testing into the core, not the margins.

• Why it sells: systems that show their work get trusted with real stakes.

• The reframe: verification isn’t overhead — it is the product in high-stakes domains.

• Design point: make outputs auditable and reversible by default.

• Trust ramp: proof is what earns each next increment of autonomy.

• Lives it: Harvey (citations), Dropzone (evidence trails), Devin (test loops).

• The trap: the sanctioned lawyer who filed an AI answer no one verified.

21. Your evals are your real IP.

• The shift: what you can measure, you can improve, price, and be trusted on.

• The asset: a rigorous, proprietary way to know if output is good — for your job — is harder to copy than any model.

• The mechanic: build a domain-specific evaluation harness and guard it like source code.

• Why now: with swappable models, your eval is the constant that defines quality.

• Improvement: you can’t optimize what you can’t measure — evals are the steering wheel.

• Trust: evals let you prove quality to a skeptical enterprise buyer.

• Lives it: OpenAI, Anthropic, Scale (evaluation as core IP).

• The trap: shipping on vibes, unable to prove or systematically improve quality.

22. Build the data flywheel before you need it.

• The shift: the moment to design your data loop is line one of code, not the Series B.

• The mechanic: make every early interaction either train the flywheel or it’s wasted.

• Why it’s urgent: you cannot retrofit a compounding data edge a rival baked in from day one.

• Design point: instrument capture, feedback, and correction from the first user.

• Payoff: early data advantages become unbridgeable at scale.

• Discipline: resist shipping features that don’t feed the loop.

• Lives it: Tesla, Midjourney, Cursor (flywheels from day one).

• The trap: “we’ll think about data once we have scale” — by then it’s too late.

23. Taste and judgment are the last human moat.

• The shift: when anyone can generate competent output, the scarce skill is knowing which output is right.

• The mechanic: hire and promote for taste, standards, and judgment, not just throughput.

• Why it grows: machines make the average free, so the exceptional becomes more valuable.

• Where it shows: product design, curation, editorial calls, knowing what to cut.

• Defensibility: taste can’t be prompted, copied, or commoditized.

• Culture: a team with taste ships things people love, not just things that work.

• Lives it: Apple, Linear, Superhuman (obsessive craft).

• The trap: flooding users with infinite mediocre output no one curated.

24. Build the boring reliability, not the beautiful demo.

• The shift: demos are free and everywhere; the last mile is where products actually die.

• The gap: the distance between “impressive” and “dependable” is where defensible companies live.

• The mechanic: grind the edge cases, error handling, and integration reality the 99.9%.

• Why now: AI demos are easy; deployable AI is rare, and rarity is value.

• Trust: reliability is what turns a pilot into a contract.

• Moat: competitors chase the flashy demo and never do this unglamorous work.

• Lives it: Waymo (reliability first), Stripe (uptime), Ramp.

• The trap: a viral demo that never survives contact with production.

IV. Distribution & Trust

25. Meet the work where it already happens.

• The shift: don’t ask people to come to a new place — insert yourself where the job is already done.

• The surfaces: the editor, the EHR, the ledger, the inbox, the procurement rail.

• The mechanic: become a native part of an existing loop, not a destination begging for traffic.

• Why it wins: zero behavior change is the shortest path to adoption.

• Wedge: ride the incumbent tool’s distribution instead of fighting it head-on.

• Retention: being in the flow of work makes you a habit, not a visit.

• Lives it: GitHub Copilot (in the IDE), Abridge (in the visit), Ramp.

• The trap: a standalone tool demanding a brand-new habit and a fresh login.

26. Trust is earned in the workflow, not the pitch.

• The shift: no enterprise hands an agent real authority because of a good deck.

• The mechanic: accrue trust from small things done right, over and over.

• The ramp: start narrow and supervised, prove reliability, then expand autonomy.

• Why now: high-stakes AI adoption is a relationship, not a transaction.

• Design point: make the agent’s wins visible and its mistakes cheap and reversible.

• Payoff: earned trust becomes the permission to take over more of the job.

• Lives it: Harvey, Sierra, Dropzone (supervised-to-autonomous ramps).

• The trap: demanding full autonomy on day one and getting rejected on day one.

27. In a world of infinite content, authenticity is the premium.

• The shift: when generation is free, the scarce thing is proof of what’s real.

• The value: verifiable authorship, provenance, and human connection command a premium.

• The mechanic: build the trust layer — credentials, provenance, verified identity, real community.

• Why now: deepfakes and AI slop make “is this real?” a paid question.

• Regulation: transparency mandates (EU AI Act) turn provenance into a requirement.

• Moat: standards adoption and a detection data loop compound.

• Lives it: Cara (human-made art), C2PA/Content Credentials, Truepic.

• The trap: competing on volume in a zero-cost content flood you can’t win.

28. Design for the buyer’s fear, not just their desire.

• The shift: every adoption is a tug-of-war between upside wanted and risk feared.

• The truth: in high-stakes domains, fear wins by default and kills deals.

• The mechanic: make the product auditable, reversible, guaranteed — remove the career risk.

• The reframe: sell the safety, and the desire follows.

• Why now: buyers are terrified of being the one who let an agent cause a disaster.

• Positioning: “you won’t get blamed” beats “look how powerful this is.”

• Lives it: Vanta, Drata, Wiz (selling to the fear).

• The trap: pitching only upside into a room full of people protecting their jobs.

V. The Founder & the Long Game

29. Time the wedge.

• The shift: every idea has a moment when the tech crosses from “impressive” to “cheaper and better.”

• Too early: you evangelize a market that isn’t ready until the cash runs out.

• Too late: it’s already won by whoever timed it right.

• The mechanic: read the specific “why now” and enter exactly at the inflection.

• Why it matters: timing the wedge is worth more than the idea itself.

• Signal: watch for the cost or capability curve that just crossed the usable line.

• Lives it: Uber, DoorDash (smartphone + GPS timing).

• The trap: Webvan and General Magic — right idea, a decade too early, bankrupt.

30. Be contrarian and right.

• The shift: consensus opportunities are already priced; the returns are competed away before you arrive.

• The mechanic: find the truth that’s real but not yet obvious, and hold it with conviction.

• Where: the market others dismiss, the wedge they call too small, the domain they find boring.

• Why now: if everyone agrees it’s the future, you’re too late to the future.

• Both words matter: contrarian and right — conviction without truth is just being wrong loudly.

• Endurance: a non-consensus bet needs conviction to survive the years of doubt.

• Lives it: Airbnb, Anduril, SpaceX (dismissed, then dominant).

• The trap: Theranos — contrarian and wrong, conviction with no truth beneath it.

31. Build for the world after the technology is cheap.

• The shift: design for what intelligence, compute, and robots will cost in three years — when you’re at scale.

• The mechanic: assume the model is 10× cheaper, the agent 10× more reliable, the robot 10× more capable.

• Why: the winners are built for the world arriving, not the one leaving.

• Positioning: what looks uneconomic today becomes obvious once the curve bends.

• Risk: get the curve’s timing wrong and you’re early-and-dead, so pair with Principle 29.

• Advantage: competitors building for today’s costs get lapped when costs fall.

• Lives it: SpaceX, Starlink, OpenAI (built ahead of the cost curve).

• The trap: Better Place — built for a cost curve that never actually arrived.

32. Make the mission the moat.

• The shift: in a cycle this fast and hard, what keeps the best people is that the work matters.

• The mechanic: a real mission recruits talent money can’t buy and survives the pivots.

• Why it’s a moat: mission-driven teams out-endure and out-recruit funded competitors.

• Talent: the best engineers choose meaning over the highest bidder.

• Endurance: mission carries you through the years of grind and the near-death moments.

• Authenticity: it only works if the mission is real, not a slogan.

• Lives it: SpaceX, Anduril, Anthropic (mission as recruiting and staying power).

• The trap: WeWork — a grand mission narrative with no substance beneath it.

Read this if the manifesto felt too clean

Principles are dangerous precisely because they sound obvious. “Own the loop the incumbent can’t cross” — sure, everyone nods, nobody knows what it means on a Tuesday when you’re deciding what to build next. A principle you can’t operationalize is a fortune cookie. So this report does the un-fun thing: it takes each of the 32 principles and asks the only questions that matter — what does this actually look like inside a real company, what is the specific mechanic, and how do you tell the version that works from the version that’s just a nice slide?

Every principle here is anchored to companies you can go study today. Not “look at Stripe” as a vague gesture at greatness, but the specific move: how Stripe priced, what it absorbed, what it refused to do, and why that particular decision compounded into a $90B+ business. Not “AI agents are the future,” but how Sierra structures a per-resolution contract so that its revenue scales with the customer’s call volume instead of their seat count, and why that single pricing choice changes the size of the company it can become. The examples are the argument. If a principle can’t be shown through what a real team actually did, it doesn’t belong in a builder’s head.

The five brutal truths underneath all 32

Before the breakdown, the frame. Everything in this report descends from five facts about the age we’ve entered — facts that were not true in the last cycle and that quietly invalidate most of the received wisdom about how to build a company:

One: intelligence is becoming free, and free things don’t make you special. The smartest model you can access is roughly the smartest model your competitor can access, and both get cheaper and better every quarter without either of you lifting a finger. This is why so many “AI startups” are already dead and don’t know it — they built their whole identity on an input that is commoditizing to zero. The entire first half of this report (principles 1–16) is really one long answer to the question: if the intelligence is free, where does the value go? It goes to the workflow, the data, the trust, the system of record, the distribution — everything the model can’t give you.

Two: the market moved from IT budgets to payroll. When software merely assisted work, it competed for a slice of a company’s technology spending — a few percent of revenue. When software can do the work, it competes for a slice of the company’s labor spending — the largest line item in the economy. This is not a marginal expansion of the opportunity; it is a roughly 10× enlargement of the pool, and it is why the companies that price and position against payroll will make the SaaS champions of the 2010s look small.

Three: energy and trust became the binding constraints. AI’s exponential runs into two walls — the physical wall of electricity (data centers now compete with nations for power) and the human wall of trust (no one lets an autonomous system touch anything that matters without proof it won’t blow up). Constraints are where pricing power lives. Whole categories in this report exist only because these two walls exist.

Four: the cost of building collapsed, so building is no longer the moat. A team of five with agents can now produce what took a hundred people a decade ago. Wonderful — and terrifying, because it’s equally true for the five people building the exact same thing as you. When creation is cheap, the scarce and defensible things are the ones that can’t be cheaply created: proprietary data from real operations, earned trust, regulatory position, a distribution loop, a mission that holds a team together through the grind.

Five: verification is the shadow that automation casts. Every unit of work a machine does at machine speed generates an equal unit of doubt — did it do it right? — and someone has to sell the answer. The more the world automates, the larger the market for proof: evals, identity, provenance, security, compliance, audit. If you understand this one, you understand why the “boring” verification companies will be worth as much as the exciting generation companies they check.

How to use the breakdowns

The 32 principles are grouped into five movements, and they are deliberately ordered from opportunity to endurance — from “what should I build” all the way through to “how do I still be standing in a decade”:

• I. What to Build (1–8) — choosing the right thing: the worker not the tool, payroll not IT, the boring
  hated job, the underbuilt layer.

• II. Where the Moat Lives (9–16) — the sixteen-hundred-pound gorilla of the age: defensibility when the
  product is copyable in weeks.

• III. How to Build (17–24) — team, speed, and craft in an AI-native company.

• IV. Distribution & Trust (25–28) — getting found and getting believed.

• V. The Founder & the Long Game (29–32) — timing, conviction, and what carries you through.

Each of the 32 follows the same shape: the core idea and why it’s brutally true now; the exact operational mechanism; the concrete companies that live it, with the specific move they made explained in the text; the failure mode — a company or pattern that got it wrong and what it cost; and the sharp takeaway you can act on. Read it straight through and it’s a strategy education; read one principle when you’re stuck on a real decision and it’s a tool.

A warning before we start: some of these examples cut against companies people admire, and some of the “winners” here will stumble after this is written — that’s the nature of naming live companies in a moving market. The point is never to canonize a logo. It’s to isolate the mechanic — the repeatable move — so that when the specific companies change, you still have the principle. Let’s break them.

I. What to Build — the opportunity, in depth

1. Build the worker, not the tool.

The tool is a feature; the worker is a company. That sentence sounds like a slogan until you watch it decide who lives and dies. A tool waits for a human to pick it up, aim it, and pull the trigger — its ceiling is however much time that human is willing to spend inside it. A worker owns the job. It wakes up, sees the queue, does the task, and hands back a finished result. The brutal truth of this moment is that for the first time the second thing is buildable, and the moment it becomes buildable in a category, the tool vendors in that category are dead men walking — they’re selling a faster horse to people who can now buy a driver.

The operational mechanism is a shift in the unit of delivery from keystrokes saved to tasks closed. You stop shipping an interface and start shipping a job function with a spec, a definition of done, and an accountability surface. That means owning the whole loop: ingesting the work, doing it, checking it, and escalating only the genuine edge cases to a human. The design question is no longer “what screen does the user need?” but “what would I put in a job description, and can an agent satisfy every line of it?”

Look at how the best executors draw the line. Sierra, Bret Taylor’s company, doesn’t sell a “better chatbot builder” to support teams — it deploys a branded agent that resolves the customer’s issue, and it prices per resolution, so the product only makes money when the worker actually finishes the job. Intercom’s Fin did the same thing to its own predecessor: Intercom spent a decade selling a support inbox — a tool — and then pointed Fin at the exact same tickets and charged $0.99 per resolution, cannibalizing its seat business on purpose because it understood the worker eats the tool. Cognition’s Devin was marketed, aggressively and prematurely, as a “software engineer” you assign a ticket to, not an autocomplete you supervise keystroke by keystroke — an agent that clones the repo, plans, writes, runs the tests, and opens the PR. Even where the framing was oversold, the shape is the tell: an entity that owns a Jira ticket end to end is a fundamentally different business than a plugin that finishes your line.

Contrast that with what a tool company looks like when it tries to defend itself: it adds “AI features.” A settings toggle, a summarize button, a sidebar assistant. Every one of those is an admission that the human is still the worker and the software is still the tool — you’ve made the pilot’s seat more comfortable while your competitor is building the plane that flies itself. The architectural fork is whether your system has an inbox of its own. A worker has a queue it is accountable for; a tool has a user it waits on. Cursor’s leap past being “VS Code with autocomplete” was exactly this: its Agent mode takes a task, edits across files, runs commands, and iterates until the change works — the developer reviews a finished diff instead of steering every token. That is the difference between a thing you use and a thing that reports to you.

The failure mode is seductive because it demos beautifully and ships easily: build the copilot. GitHub Copilot is the honest cautionary tale — a genuinely great tool, hundreds of millions in revenue, and yet by staying a suggestion-in-the-margin it left the worker territory wide open for Cursor and Cognition to charge into, because a co-pilot by definition assumes a pilot who must stay in the seat. The subtler graveyard is full of “AI-powered” SaaS that bolted a chat box onto a 2015 dashboard and still required the human to drive every decision — Jasper is the canonical wound, a $1.5B copywriting tool whose moat evaporated the instant ChatGPT let the user summon the same output without the wrapper, precisely because Jasper had built a tool around a model instead of a worker that owned an outcome.

The founder takeaway is a knife: write the job description first. If you cannot name the role your product replaces or augments-to-obsolescence — “the tier-1 support rep,” “the SDR,” “the junior paralegal,” “the AP clerk” — and cannot draw the closed loop from work-in to work-done without a human turning the crank at every step, you are building a tool, and you should assume that within eighteen months someone will build the worker on top of you and take your customers. The tool is a feature of the worker. Decide which one you are before the market decides for you.

2. Sell the outcome, not the access.

Seat-based pricing is a tax on a world that no longer exists. It was invented for a world where software was a lever a human pulled, so charging per lever-puller made sense — more seats meant more value extracted. But when your product does the work rather than assisting it, the seat is a lie: it caps your revenue at the number of humans in the room precisely as your whole thesis is that you need fewer of them. Worse, it aligns your price against your value — you charge for logins while your customer measures you in labor removed. Outcome pricing is the single largest value-capture unlock of the age because it lets you charge a fraction of what you save instead of a fraction of a shrinking software budget, and the two numbers differ by an order of magnitude.

The mechanism is to find the atomic unit of delivered value — the resolved ticket, the stopped fraud, the collected invoice, the supplied megawatt — meter it, and price a slice of it. This demands two things most SaaS companies never built: the instrumentation to prove the outcome happened (attribution is the hard part), and the confidence to put your revenue downstream of your own performance. It is scarier and it is better, because it makes your price self-justifying: every dollar you charge is stapled to a larger dollar you saved.

The executors are rewriting the pricing page in real time. Intercom’s Fin charges $0.99 per resolution — not per agent, not per seat, per job done — so a customer with seasonal volume pays in exact proportion to the labor Fin absorbed. Sierra prices per successful resolution of the customer’s own inquiries, explicitly refusing to bill for conversations it didn’t resolve, which turns the pricing model itself into a proof-of-value engine. Chargeflow, in the chargeback-dispute world, took it to the logical extreme: it charges only on disputes it wins, a pure success fee, which means the buyer’s downside is zero and the vendor’s incentive is perfectly welded to the outcome. Harvey and the legal-AI cohort are the interesting tension case — they still largely sell per-seat into law firms because the billable hour is the incumbent unit and firms understand seats, which shows the gravitational pull of the old model even where outcome pricing would capture more.

There is a second-order reason outcome pricing wins that founders underrate: it collapses the buyer’s risk to near zero, which collapses the sales cycle. A seat license asks the customer to bet budget on a promise and then prove the ROI themselves in a quarterly review. An outcome price inverts the burden — the customer pays after the value lands, so the “will this work?” objection that stalls enterprise deals for months simply evaporates. This is why Salesforce’s Agentforce launched at roughly $2 per conversation rather than a per-seat SKU: even the incumbent that invented seat-based SaaS is retreating from its own model because it can read where value capture is going, and a per-conversation meter lets a nervous buyer start without a headcount-sized commitment.

The failure mode is charging for access to intelligence as if it were a metered utility when you don’t control the utility. The pure “per-API-call” or “per-token” wrappers got crushed from both sides — the model providers cut prices under them while customers realized they were paying a markup on a commodity they could buy direct. And the seat-clingers left staggering money on the table: any legacy vendor still charging $40/seat/month while its agent quietly does the work of three FTEs is charging one-fiftieth of the value it delivers and has painted a target on its own back for a competitor who prices the outcome. The one real trap in outcome pricing is picking an outcome you can’t cleanly attribute — if the customer can plausibly argue the result would have happened anyway, your invoice becomes a negotiation, which is why the winners choose outcomes with unambiguous, machine-verifiable proof.

The founder takeaway: identify the one number your customer’s CFO already tracks — cost per ticket, cost per hire, loss rate, days-sales-outstanding — and price against that number, not against your software category. If you can’t yet measure the outcome cleanly, building that measurement is not a distraction from the product; it is the product’s value-capture layer, and it is worth more than another feature. Charge for the work. Access was the last era’s product; the outcome is this one’s.

3. Aim at payroll, not the IT budget.

The addressable market of software was a few trillion dollars of global IT spend, and every SaaS company in history fought over slices of it — which is why the category is a knife fight of near-substitutes all haggling over the same line item. The addressable market of agents is the tens of trillions the world spends on labor. That is not a bigger version of the same market; it is a different market, roughly ten times larger, governed by a different buyer, a different justification, and a different psychology. The brutal insight is that the money to pay for your product does not have to come from the CIO’s constrained tooling envelope — it can come from the org’s largest expense line, the one every CEO is under permanent pressure to bend. The companies that redirect payroll into software will dwarf the ones that competed for the software line item, because they’re eating from a table fifty times the size.

The mechanism is to price and position against a wage, not against a subscription. Instead of “we’re cheaper than the incumbent SaaS,” the pitch becomes “we do the work of an FTE that costs you $70,000 a year, and we cost $20,000.” That reframing does two things: it makes your product a savings rather than a cost, and it moves the buying decision from the IT gatekeeper — whose job is to say no to new tools — to the P&L owner whose job is to lower cost of labor. It also uncaps your price: a tool competes down toward the marginal cost of software; a worker competes down toward the fully-loaded cost of a human, which is vastly higher.

The vertical-software winners built the on-ramp for exactly this, even before agents. ServiceTitan owns the operating system of the trades — HVAC, plumbing, electrical — and because it runs dispatch, invoicing, and payroll for those contractors, it sits directly on the labor spend of the industry and can progressively automate the dispatcher, the call-center booker, the accounts clerk, converting wage line into software line. Toast did the same in restaurants: by owning payroll and scheduling for its restaurants, it is positioned to sell the labor-replacing layer straight out of the labor budget it already administers. And the pure-play agents make the aim explicit — 11x sells “Alice” and “Jordan” as digital workers priced against the cost of an SDR, and Artisan’s entire billboard-baiting brand (”Stop Hiring Humans”) is a naked pitch to the CFO’s headcount plan, not the CIO’s tool stack. Whether or not those companies endure, their positioning is the textbook: they invoice against a salary.

The failure mode is aiming a genuinely labor-replacing product at the IT budget out of habit, and thereby capping it. Countless RPA-era and “workflow automation” vendors did work worth a salary and priced it like a seat license, then wondered why procurement ground them down — they let themselves be filed under “software tools,” subjected to the tool-buying committee, and benchmarked against other tools instead of against the humans they replaced. UiPath is the instructive scale-up: enormously valuable automation, but sold and valued as enterprise software, which anchored its pricing and its multiple to the IT-spend world rather than the labor-spend world its bots actually operate in — a self-imposed ceiling.

There’s a strategic dividend to aiming at payroll that goes beyond price: it changes who your competitors are and how many there are. In the IT-budget arena you’re one of forty vendors on a procurement shortlist. In the payroll arena your competition is the status quo of hiring more people — a slow, expensive, painful default that every operator is desperate to escape. You’re not out-featuring a rival; you’re out-competing a req that takes ninety days to fill and comes with benefits, management overhead, and attrition. That is a far softer target. It is also why the durable version of this play is to become the system of record for the labor itself — the way ServiceTitan and Toast administer payroll and scheduling — because once you sit on the wage data, you can see exactly which roles are ripe to convert and sell the replacement from inside the customer’s own cost accounting.

The founder takeaway: before you write your pricing page, find out what the human doing this job costs fully loaded, and make that your reference price and your sales narrative. Sell to the person who owns that headcount line, not the person who owns the tool catalog. If your product is defensible enough to do a job, the worst commercial mistake you can make is to let it be bought like a tool — you’ll have built a fifty-trillion-dollar product and pointed it at a two-trillion-dollar wallet.

4. The best wedge is a boring, expensive, hated job.

Glamour is crowded and cheap; drudgery is defensible and rich. Every founder’s instinct is to chase the exciting frontier — the creative co-pilot, the sexy consumer surface, the general assistant — which is exactly why those arenas are pile-ups of well-funded near-identical teams competing the returns to zero. The non-obvious, brutally true move is to run toward the work nobody wants: prior authorization, tax reconciliation, compliance evidence collection, freight quoting, claims adjudication, permitting, medical coding, KYC review. The more tedious, high-stakes, and regulated the task, the weaker the incumbent (nobody built a great product for a job everyone hates), the higher the willingness to pay (it’s expensive misery the customer is desperate to offload), and the wider the moat (the edge cases and regulatory scar tissue that make it boring are exactly what a fast follower can’t casually replicate).

The mechanism is to pick a task with three properties stacked together: it is high-volume and repetitive enough to be worth automating, expensive enough — usually because it’s done by skilled or licensed humans, or done badly at great cost — that removing it pays for you many times over, and hated enough that no human defends their ownership of it when your agent shows up. That last property is the quiet superpower: automation usually meets antibodies because people protect their jobs, but when you automate the task everyone loathes, your buyer, the users, and the budget-owner are all on your side. The regulation that makes the job miserable becomes your moat the moment you’re through it.

The executors chose their swamps deliberately. In US healthcare, the single most hated administrative task is prior authorization — the insurer-mandated paperwork gauntlet before a treatment is approved — and companies like Cohere Health and a wave of agentic startups aim directly at it precisely because it is high-volume, regulated, expensive, and universally despised by clinicians and payers alike; nobody will miss doing it, everybody will pay to make it disappear. In tax and accounting, the drudgery of reconciliation and close is the wedge — this is where the agentic-accounting cohort digs in, because the work is boring, deadline-driven, error-costly, and structurally short of humans willing to do it. In freight, quoting and dispatch is grinding phone-and-spreadsheet toil, which is exactly why an agent that generates quotes and books loads has a wide-open lane against exhausted incumbents. And EvenUp built a fast-growing business by aiming at personal-injury legal demand packages — mind-numbing, high-stakes document assembly that law firms hate doing and will happily hand to software.

The failure mode is the mirror image: chasing the glamorous general job and getting eaten by the frontier labs or drowned in clones. The graveyard of “general AI assistant” and “AI for creativity” startups is enormous — thin wrappers on a foundation model, no defensible task, competing on vibes against OpenAI’s next release. Adept is the cautionary tale worth naming: a superb team and a sweeping, glamorous mission — a universal agent to operate any software — that was so broad and so undifferentiated against the labs’ own trajectory that it couldn’t find a defensible wedge and was effectively absorbed, its ambition too wide to be a moat. The lesson isn’t that they were wrong about the future; it’s that “do everything for everyone” is the opposite of a wedge.

There is also a moat mechanic hiding inside the boredom. A hated, regulated job is dense with tacit rules, exceptions, and failure consequences that never got written down because nobody enjoyed documenting them either. When you own that job end to end, every case you process teaches you an edge case a newcomer would have to relearn from scratch, and every regulatory approval you clear is a wall the next entrant has to climb from zero. That is why the vertical drudgery players compound: a prior-auth agent that has seen a million denials knows the exact language each payer accepts; a medical-coding agent that has closed a million charts has an error profile no eighteen-month-old competitor can match. The glamour markets have no such accumulation — a clever prompt is copied in a weekend, but a decade of a payer’s arbitrary rules is not.

The founder takeaway: make a list of the tasks in your target industry that people apologize for making someone do — the ones that get outsourced to the cheapest possible labor, that generate the most complaints, that are governed by the thickest binder of rules. Then pick the one with the biggest budget and the strongest hatred, and own it end to end before you dream of expanding. Boring is defensible. Hated is un-defended. Expensive is the whole point. Run at the drudgery everyone else runs from.

5. Go vertical and deep before horizontal and wide.

The horizontal assistant is the most seductive trap of this cycle, because the demo is always spectacular and always the same: one prompt, and the machine drafts an email, summarizes a document, writes a function. It looks like a company. It is a feature. The reason is structural — a general tool competes directly with the foundation model that powers it, and every quarter that model gets better, cheaper, and more general, eating the thin layer of “convenience” the horizontal startup added. You are renting your entire value proposition from a landlord who is also your competitor. The vertical specialist escapes that gravity by owning things the model can never learn from the open internet: the tacit rules of one industry, the integrations into its systems of record, the edge cases that took a decade of operating to discover, and the trust of buyers who will never hand real authority to a generalist.

The mechanism is to pick one industry, learn its language until you speak it better than the customer, wire yourself into the software it already runs on, and absorb the thousand exceptions that separate a demo from a deployment. ServiceTitan is the canonical proof. It did not build “AI for small business” — it built the operating system for the residential HVAC, plumbing, and electrical trades, and it did it by embedding into the exact texture of a contractor’s day: dispatching a technician, quoting a job at the kitchen table, pulling the customer’s equipment history, financing the repair, and reconciling the books at night. The mechanic that made it uncopyable was pricing tied to the customer’s own success — it charges per technician seat plus a cut of the payments and financing that flow through the platform, so as a contractor grows from six trucks to sixty, ServiceTitan’s revenue per account compounds without a single new sale. That land-and-expand loop is why it went public in December 2024 and quickly carried a valuation in the range of nine to twelve billion dollars off a business a horizontal CRM could technically have served but never would have, because it never would have learned that a plumbing business lives and dies on first-call-resolution and same-day dispatch, or that the money is in the consumer-financing attach at the kitchen table. Procore did the identical thing to commercial construction — it became the place where the general contractor, the subs, the architect, and the owner all meet, so the drawings, RFIs, change orders, and payment applications live in one system, and it priced by annual construction volume run through the platform rather than per seat, which let it give unlimited free logins to every subcontractor and thereby make itself impossible to rip out mid-project without throwing the entire job into chaos. Toast did it to restaurants, fusing point-of-sale, payroll, and payments into hardware bolted to the counter, then earning the majority of its revenue from payment processing on every meal — a take rate that turns each additional table into an annuity.

The failure mode is the founder who mistakes a broad market for a big one. “We can sell to any company with a sales team” sounds like a larger opportunity than “we sell to independent HVAC contractors,” but the broad pitch means you are shallow everywhere, defensible nowhere, and interchangeable with the next well-funded team that ships the same generic workflow. The graveyard is full of the concrete version of this: the horizontal “AI meeting assistant” and “AI email writer” companies of 2023 that raised on stunning demos, hit a few million in revenue, and then watched OpenAI and Microsoft fold the exact feature into ChatGPT and Copilot for free — Jasper is the cautionary tale, a general AI-copywriting tool that reportedly reached a 1.5-billion-dollar valuation in 2022 and then cut its internal valuation and laid off staff within a year once ChatGPT commoditized the generic-text use case it was built on. The lesson cost hundreds of millions in destroyed enterprise value: it had no vertical data loop, no system-of-record integration, no industry-specific trust, so the moment the model underneath got good enough, there was nothing left to defend. The takeaway is brutal and simple: depth is a moat, breadth is a landgrab, and in a world where the generic product is cloned in weeks, the only durable position is to be so deep in one vertical that leaving you means rebuilding the customer’s entire operation. Win the beachhead completely, learn the pricing hook that compounds with the customer’s growth, and only then let the adjacent verticals come to you. The operational tell that you have gone deep enough is uncomfortable: your product roadmap starts to read like an industry-specific compliance manual — permit lookups, union labor rules, warranty registration, insurance-claim codes — the unglamorous connective tissue no generalist will ever bother to build, and precisely the tissue that raises the switching cost from a data export to a business shutdown.

6. Automate the workflow; don’t digitize it.

Two decades of SaaS were built on a quiet lie: that moving a paper process onto a screen was progress. It was progress — for the era where the constraint was that data lived in filing cabinets. But digitizing a workflow leaves the human as the engine of every step; the software just gives them a prettier dashboard to drive. Concur did not eliminate the expense report — it made you fill one out on a laptop instead of paper, still snapping receipts, still coding line items, still routing for approval, still reconciling. The task survived; it merely got a nicer coffin. In an age where intelligence is nearly free, that is leaving the entire prize on the table, because the real value was never in a better form. It was in making the form disappear.

The mechanism is to attack the reason the work exists rather than the interface to it, and to design so that the default state is “done” and the human is the exception handler, not the operator. Ramp is the cleanest example of the difference. It did not build a slicker expense app; it deleted the expense report. Because Ramp is the corporate card itself, it sees the transaction at the moment of swipe — merchant, amount, employee, department — and it collects the receipt by texting the employee, matches it, codes the expense against the general ledger, checks it against policy, and closes the books, all without a human assembling a report at month’s end. The business model is the tell: Ramp is free software, monetized on interchange — roughly the standard cut of every dollar swiped — plus savings it finds in the customer’s spend, which means it makes money precisely by removing the finance labor rather than by selling seats to perform it. Ramp used that model to cross into the billions in valuation (reported around thirteen billion in 2024 and climbing) while charging its users nothing for the software, because the value it captures is the headcount and the days of month-end close it deleted. Look at what it deleted, not what it displayed. In healthcare, Cohere Health does the same to prior authorization — instead of a portal where a nurse manually submits and chases an approval, it evaluates the clinical case against the payer’s rules and returns a decision, collapsing a multi-day human relay into near-instant, and it is paid per-authorization by the health plan for the labor removed, not per-login. In legal, Harvey does not give a lawyer a better search box over case law; it drafts the memo, the diligence summary, the first-pass contract markup, and prices per professional seat at enterprise firms precisely because it produces the associate-hour of output rather than assisting it.

The failure mode is the “AI copilot” bolted onto an existing tool — the sidebar that suggests, summarizes, and autocompletes while the human still performs every real step. It demos beautifully and changes nothing, because if a person still has to drive each stage, you have digitized with extra steps and a subscription. The cost of getting this wrong is not abstract: a wave of “AI copilot” features shipped by legacy SaaS incumbents in 2023–24 posted single-digit attach and near-invisible retention, because a customer will not pay a second subscription for a helper that leaves the actual job on their desk — and the churn showed up the moment the renewal came due and the buyer could not point to a single task the copilot had removed from anyone’s headcount. Contrast that with the outcome-priced automators who bill for the deleted work and see net revenue retention north of 120 percent because the value compounds as they take over more of the workflow. The takeaway: ask whether your product removes the work or merely decorates it, and price accordingly — per outcome, per transaction, per case closed, never per seat that still has to do the job. If the customer still does the work and you just made it cozier, a competitor who deletes the job entirely will take your market and charge for the labor, not the license. The concrete diagnostic to run before you write a line of code: name the human role your product is supposed to help, then ask whether, at full adoption, that role’s headcount goes down or stays flat. If it stays flat, you have built a copilot and your ceiling is a seat license the buyer will question at every renewal. If it goes down, you have built an automator, and you can price against the fully loaded cost of the person you replaced — which is why the automators sell into the budget line that used to fund salaries, an order of magnitude larger than the software line copilots fight over.

7. Hunt where a constraint is creating scarcity.

Cheap creation is an acid that dissolves margins. When anyone can spin up an app, generate the content, or clone the feature over a weekend, the price of the abundant thing races toward its marginal cost, which is now approximately zero. Pricing power does not live in abundance; it lives in scarcity — in the one input everyone suddenly needs and no one can conjure. The defining scarcity of this cycle is physical: electricity, the power to deliver it, the land and cooling to house compute, the licenses and clearances that gate regulated markets. A constraint that looks like a wall to everyone else is the foundation of a moat, because a wall keeps competitors out as reliably as it keeps you in.

The mechanism is to identify the bottleneck upstream of the gold rush and own it, so that you are paid regardless of which prospector strikes it rich. CoreWeave is the sharpest instance: it saw that the true scarcity behind the AI boom was not models but access to clustered GPUs at scale, and it turned a pile of Nvidia chips and the ability to network, power, and cool them into a business that went from a crypto-mining also-ran to a public company at a March 2025 IPO carrying a valuation in the tens of billions, precisely because everyone building AI needed the compute and could not get it fast enough elsewhere. The mechanic underneath is worth studying: CoreWeave locked in multi-year, take-or-pay contracts with a handful of AI-hungry customers (Microsoft alone reportedly accounted for well over half its revenue), then used those signed contracts as collateral to raise billions in debt to buy the next tranche of scarce GPUs — a self-reinforcing loop where owning the scarce asset lets you finance more of the scarce asset. Crusoe attacked an adjacent scarcity — cheap firm power — by planting modular data centers directly on stranded energy, originally the flared natural gas burning off at oil wellheads that had no buyer, converting a wasted, negative-value input into the exact commodity the AI build-out was starving for, and later pivoting that same instinct into building gigawatt-scale AI data-center campuses on power nobody else could source. Base Power goes at the grid constraint from the demand side, deploying home battery fleets that stitch together into a distributed power plant, monetizing the scarcity of firm, dispatchable capacity that a strained grid can no longer guarantee — it gives homeowners cheap backup power and captures the value of the aggregated, dispatchable megawatts it can sell back when the grid is desperate. Each one found the choke point and installed a tollbooth.

The failure mode is building yet another abundant thing next to the scarce one — the thousandth wrapper on a commodity model, competing on features in a market where features are free, while the margin quietly evaporates. Watch what happened to the crowd of “AI image generator” and “AI writing” wrappers that spun up on top of Stable Diffusion and GPT in 2023: with no ownership of any scarce input, they competed on prompt-templating and UI polish, saw gross margins compress as their underlying API bill rose and their subscription price fell, and most either flatlined or shut down within eighteen months when the model providers shipped the same capability natively — the ones that raised at frothy multiples handed investors near-total losses because there was no scarce asset under the company to hold value. The contrast is stark: the wrapper rents a commodity and prays the landlord stays kind; the tollbooth owner sells the one thing the landlord also needs. The takeaway is to trace the value chain until you hit the thing that cannot be manufactured on demand — the megawatt, the interconnect queue slot that now runs years long, the regulatory clearance, the licensed spectrum — and build there, ideally financing the scarce asset against the very contracts the scarcity lets you sign. Scarcity is where pricing power hides, and in an age of infinite supply, the founder who owns the constraint owns the market’s throat. The practical test is duration: ask how long it would take a well-funded competitor to manufacture the thing you sell. If the answer is a weekend, you own nothing; if the answer is a three-year interconnection queue, an eighteen-month lead time on high-voltage transformers, or a regulatory approval that takes a decade to earn, the clock itself is your moat, and every month of the shortage is a month of pricing power no amount of rival capital can buy its way past.

8. Enter the layer that is underbuilt today.

Value migrates through a technology stack on a predictable arc. Early in a wave it pools at the bottom — in the models, the rails, the raw compute — because that layer is hardest to build and everyone needs it. As the wave matures, value climbs back up to the applications, once the foundations are commoditized and the differentiation moves to the last mile. The strategic error is to fight the last war: to build the application layer while the picks-and-shovels are still missing, or to build infrastructure after it has already consolidated into three giants. The winning move is to read where the stack is underbuilt right now and supply the shovel the next wave of prospectors will all need, before they know they need it.

The mechanism is to look one layer beneath the current frenzy and build the missing primitive. Scale AI is the archetype: while everyone raced to train models, the unglamorous, underbuilt layer was labeled data — the human-annotated, RLHF-graded fuel the models could not exist without — and Scale built the operation to supply it, becoming so essential that Meta paid roughly fourteen to fifteen billion dollars in 2025 for a large minority stake and to absorb founder Alexandr Wang, a price that only makes sense because Scale had quietly become the choke point through which frontier training data flowed. The vector database is the same story one layer up: when retrieval-augmented generation became the default pattern for giving models memory and grounding, there was no standard place to store and search embeddings at scale, so Pinecone built that layer and rode the sudden, universal need to a reported 750-million-dollar valuation, monetizing on managed, usage-based storage-and-query pricing that scales with every RAG app its customers ship. Databricks read the arc earlier still, becoming the underbuilt data-and-training platform that sits beneath enterprise AI, and its roughly 1.3-billion-dollar acquisition of MosaicML in 2023 was an explicit bet on owning the model-training layer the application boom would require — a bet that helped carry Databricks to a valuation above sixty billion. Each entered a layer that was invisible until the wave above it created the demand, and each priced by consumption so that revenue grew automatically as the layer above scaled.

The failure mode cuts both ways, and both edges have drawn blood. Enter too high too early and you build a beautiful app on infrastructure that does not yet exist, spending your runway inventing plumbing instead of product — the fate of countless 2021-era “AI agent” startups that had to hand-roll their own orchestration, memory, and tool-calling because none of it existed yet, burned their capital building the missing substrate, and were lapped by the teams that waited eighteen months until LangChain, vector stores, and function-calling APIs turned that plumbing into a weekend import. Enter a layer after it has already crystallized — another undifferentiated GPU cloud, another me-too vector store once three incumbents own the category and the model providers ship embeddings natively — and you are a commodity from day one, competing on price against balance sheets that can outspend you, which is exactly why the second and third waves of copycat vector databases struggled to raise a follow-on and quietly folded into acquihires. The takeaway: the money is in the layer that is obviously necessary in hindsight and not yet obvious today. Skate to where the stack is thin. Build the memory layer for agents, the identity and authentication layer for autonomous software that has to prove who it is and what it may touch, the orchestration and billing layer for data-center power — the boring, essential thing that every builder in next year’s wave will be forced to buy from someone, and price it by usage so you compound with their growth. Be the someone.

9. Own the loop the incumbent cannot cross.

This is the master principle of the age, and it deserves the harshest possible statement: in a world where the obvious product is reverse-engineered in six weeks and any competent team can wire a frontier model to a nice interface, the only thing that survives is a loop your competitor is structurally forbidden from running. Not a loop they haven’t gotten around to — a loop they cannot enter without unwinding their own business. The brutal truth of 2026 is that “we built it first” and “we have the best model” are both worth roughly nothing, because the first is copied and the second is rented from the same three labs everyone else rents from. What is not copyable is a position the incumbent’s own structure makes illegal for them to occupy.

The mechanism is to find the thing a would-be competitor loses by matching you. Tesla is the canonical case: every car it sells is a sensor rig that phones home, so its self-driving stack improves from billions of miles of real fleet behavior — edge cases, disengagements, weird intersections — that no lab can scrape and no rival can buy, because the rival doesn’t have a million cars on the road generating the exhaust. As of 2024 Tesla had accumulated well over a billion miles on FSD; a legacy automaker cannot cross that loop without first selling a decade of instrumented vehicles it never built, and the moment it tries, it discovers its dealers own the customer relationship and its cars were never wired to phone home in the first place. The loop is illegal for them because their entire distribution structure was built to sell metal and walk away. Scale AI ran a different version: by becoming the labeling and eval layer sitting between the frontier labs and their training runs, it saw the shape of what the whole industry was trying to teach its models, a vantage point no single lab could replicate because no single lab is neutral across all of them — a position so valuable Meta paid roughly $14B for a stake in 2025 to pull that vantage in-house. Stripe’s loop is that once you process payments through it, its Radar fraud model learns from the aggregate signal of millions of businesses — a card that just defrauded a startup in Ohio is flagged the instant it hits a merchant in Berlin — and a new entrant starts with a cold model against Stripe’s warm one. The incumbent bank can’t cross it because its data is siloed per-institution by the very structure of banking and regulation; each bank sees only its own tenant, so its fraud model is permanently myopic by law.

There is a subtler version worth naming, because the best founders build it deliberately: the loop can run on trust and integration rather than data. Once Ramp sits inside a company’s card spend, accounting close, and vendor contracts, its savings engine learns from aggregate purchasing across thousands of customers — it knows the going rate for your SaaS renewal because it watches everyone’s — and a rival can copy the card but not the cross-customer benchmark, and cannot get invited into the general ledger without a switching event the CFO dreads. The illegal-for-the-incumbent version there is the bank: an issuing bank makes money on interchange and float, so it is structurally forbidden from building software whose entire purpose is to reduce the customer’s spend. Its business model forbids the loop.

The failure mode is mistaking a feature for a loop, and it is the single most common way capital dies in this cycle. A wrapper that summarizes documents beautifully has no loop; every summary it produces evaporates, teaching the system nothing, locking in no one, and the day the base model gets better at summarizing, the wrapper’s entire reason to exist is absorbed upstream. Jasper is the cautionary tale with a number attached: it rode GPT-3 copywriting to a reported $1.5B valuation in 2022, and when ChatGPT shipped a free, better version of the same core loop months later, Jasper reportedly cut its internal valuation by ~20% and spent the next two years scrambling to rebuild as a “workflow” company — the feature was absorbed, and the countdown clock had been running since line one. That is not a company, it is a countdown. The takeaway: before you write a line of code, answer one question honestly — what does a competitor have to give up to copy me? If the answer is “nothing, they just build it too,” you have a product, not a moat, and you are already dead, you just haven’t gotten the invoice yet.

10. Data you generate beats data you scraped.

The whole internet has been scraped, distilled, and trained on, several times over, by everyone. That means public data is now a commodity input available equally to you and to your best-funded competitor — it advantages no one, exactly like the model itself. The scarce, uncopyable asset is the exhaust of your own product running in the real world: the corrections your users make, the outcomes your deployments produce, the failures your system logs, the human judgments captured in the moment work actually happens. Nobody outside your operation has that stream, and no amount of capital buys it retroactively. This is why the durable moat of the age is not what you know at launch but what your product learns that no one else can see.

The mechanism is to design the flywheel into the core transaction so that every use makes the system measurably better in a way rivals can’t match. Nvidia does this at the ecosystem layer: CUDA has absorbed nearly two decades of developer behavior — kernels, libraries, Stack Overflow answers, and bug reports across roughly four million registered developers — so every new workload run on Nvidia hardware feeds an optimization and tooling loop that a competitor selling equivalent silicon simply has no access to. AMD’s MI300 can match the FLOPS on a spec sheet and still lose the deal, because the chips are catchable and the accumulated software exhaust is not; the switching cost is the ten thousand CUDA kernels your team already wrote. Tesla, again, is the purest data-generation machine: the fleet doesn’t just drive, it runs “shadow mode,” silently comparing what the neural net would have done against what the human actually did, harvesting only the disagreements — the exact moments the model is wrong — and pipes those back as high-value training signal, so the moat compounds with every mile driven rather than every dollar raised. Midjourney built a quieter version of the same thing — hundreds of millions of user actions ranking, re-rolling, and selecting outputs in a Discord loop, generating a preference dataset about what people actually find beautiful that no scraped image corpus contains, and that human-taste signal is what keeps its aesthetic ahead while it runs on a famously small team with no outside funding to burn. Waymo generates its own edge-case library through instrumented urban driving that it can then replay in simulation — over 20 billion miles simulated against tens of millions driven — turning the rarest and most dangerous real-world moments into a proprietary corpus it can rehearse a million times before it ever kills anyone.

There is an operational discipline hiding inside this principle that most teams skip: the signal has to be labeled by the work itself, not by a data-labeling budget bolted on later. The reason Tesla’s shadow mode and Stripe’s chargebacks are so powerful is that the ground truth arrives for free — the human’s actual steering input, the bank’s actual fraud verdict — attached to the exact prediction it corrects. Compare a legal-AI startup that has to pay associates to review its outputs to know if they were right: its data loop costs money per datapoint, so it slows as it scales, the opposite of a flywheel. The best loops are the ones where the customer’s normal behavior is the label, at zero marginal cost, which is why “does using the product naturally produce its own answer key?” is the question that separates a compounding asset from an expensive data-annotation habit.

The failure mode is the company that “will add the data loop later,” after it has scale — and discovers that its competitor baked the flywheel into line one and cannot be caught, because the loop is a compounding asset and you cannot retrofit three years of compounding. This is why so many well-funded “AI copilots” stall: they logged the prompt and the output, threw away the human’s edit, and three years in have a data lake full of nothing that teaches them anything. The edit was the signal, and they deleted it every single time. Equally fatal is designing a product whose every interaction evaporates, teaching you nothing; the interaction volume looks like traction on a dashboard and is worth zero as an asset. The takeaway: architect from day one so that using your product is training your product, and so that the training signal is yours alone. If your data advantage is something a rival could also download, it is not an advantage — it’s a shared utility.

11. Take on the liability your customer refuses to.

Here is the real reason enterprises won’t let an agent touch their money, their patients, their filings, or their infrastructure, and it has nothing to do with capability: it is fear of being blamed when the machine is wrong. The buyer is not evaluating whether your product works; they are evaluating whether they personally get fired when it fails. In high-stakes domains, this fear beats every upside by default, which is why the single most valuable thing you can do is not build a better model but absorb the consequence — guarantee the outcome, insure it, indemnify the customer, stand in front of the liability they refuse to hold. When you do that, you stop selling software and start selling the removal of risk, and risk-removal is impossible to rip out.

The mechanism is to move your business model from “we provide a tool, you own the result” to “we own the result.” Anduril is a sharp version in defense: it doesn’t sell the Pentagon a components catalog and wish it luck integrating them, it takes mission responsibility for an autonomous outcome — its Lattice software fuses the sensors, the drones detect, the system decides, and Anduril stands behind the performance in a domain where failure is measured in lives, which is precisely why a hardware vendor selling parts can’t compete with a company selling accountability. Anduril bids fixed-price, product-line contracts rather than cost-plus programs specifically to signal it eats the risk of delivery — the exact opposite of the primes who bill the taxpayer for their own overruns. In healthcare, a payer-facing AI like Cohere Health inserts itself into prior authorization and effectively tells the health plan: we will stand behind these determinations, absorb the compliance exposure, and carry the audit risk — the plan’s terror of a wrongful-denial lawsuit and a regulator’s audit is exactly the fear being neutralized, and neutralizing it is the product, which is why Cohere can charge for outcomes rather than seats. In cyber, companies like Coalition and At-Bay fused insurance with security tooling: they don’t just tell you you’re exposed, they underwrite the breach, putting their own balance sheet behind the risk — Coalition writes the policy and runs the scanner, so it is financially motivated to prevent the claim it would otherwise pay, aligning it with the customer in a way a pure scanner selling a PDF of findings never can. Even at the infra layer, Cloudflare’s guarantee to simply absorb a DDoS attack of any size, unmetered — “it’s our problem now” — is the same move: eat the liability the customer dreads and price it into the subscription.

The operational trick that makes this survivable is to earn the right to eat liability in stages, using your own data loop to price the risk before you underwrite it. Coalition did not open by insuring the world; it ran its scanner across prospects for months, built an actuarial picture of which security postures actually correlated with claims, and only then priced policies against a risk it could measure — the data loop from Principle 10 is what makes the liability transfer of Principle 11 safe rather than suicidal. Cohere Health shadowed prior-auth decisions and proved its determinations matched or beat the plan’s reviewers before it stood behind them. The sequence matters: measure the outcome silently, prove the model on the customer’s own history, then convert accuracy into a guarantee. Founders who skip straight to “we guarantee it” without the measurement phase are the ones who become the next Zillow — they signed for a tail they never modeled.

The failure mode is the vendor who hides behind a terms-of-service disclaimer — “the AI’s output is provided as-is, you assume all risk.” That company will lose every serious deal to the one willing to sign for the outcome, because it has handed the fear back to the buyer instead of eating it; the procurement committee reads the indemnification clause before it reads the feature list, and an “as-is” clause is an instant disqualification in any regulated buy. But the counter-warning is just as brutal and has its own body count: only absorb liability you can actually price and survive. Zillow is the monument here — its iBuying arm, Zillow Offers, effectively took on the liability of guaranteeing home prices, its pricing model drifted from reality in a turning market, and in 2021 it wrote down over $500M, shuttered the unit, and cut 25% of its staff. That is what selling insurance you can’t underwrite looks like: you don’t lose a deal, you lose the company. The takeaway: find the specific consequence your customer is most afraid of owning, own it yourself — but only after you can model the tail and survive the worst case — because that transfer of fear is the deepest lock-in in the enterprise, and the deepest hole if you misprice it.

12. Become the system of record.

Tools get swapped on a whim; systems of record get inherited by whoever runs the company next. The distinction is everything. A satellite app that reads from someone else’s source of truth is a tenant, evictable the moment the landlord ships the same feature — but the product that becomes the authoritative place where a business’s work, data, and decisions actually live is load-bearing, and ripping it out means ripping out the company’s memory. Switching costs there don’t add, they compound, because every adjacent workflow, every integration, every report, and every audit trail gets built on top of you. The brutal implication: in a world where the app layer is cheap to clone, being the system of record is one of the few positions that cannot be cloned, because it is a position of accumulated trust and accumulated data, not features.

The mechanism is to win the source-of-truth fight in one workflow, then use that authoritative position to annex the adjacent ones. ServiceTitan did this in the trades: it started as the operational backbone for HVAC and plumbing contractors — the place every job, dispatch, invoice, and customer record lived — and once it was the business’s brain, it expanded outward into payroll, financing, marketing, and payments, each new module trivial to attach because ServiceTitan already held the ground truth those modules needed. The proof is in the take rate: by its 2024 IPO it was compounding revenue past $600M ARR with net revenue retention above 110%, because a contractor who runs his whole shop on it cannot leave without re-entering a decade of customer history somewhere else. Toast ran the identical play in restaurants: become the point-of-sale system of record where every order and transaction lives, then expand into payroll, lending, and supplier ordering — and here the system-of-record advantage becomes literal underwriting, because Toast Capital originates loans off the transaction data it already holds, so it knows a restaurant’s real daily cash flow and can lend against it with a default risk a bank guessing from tax returns can’t touch. None of those modules can be easily contested, because Toast owns the data spine they’d all have to plug into. Rippling is the most deliberate version: Parker Conrad built it explicitly around the employee record as the atomic system of record, arguing that once you own the authoritative source of who works here, every downstream product — payroll, devices, benefits, app provisioning, corporate cards — inherits from that single object, so Rippling can enter category after category from a position no point-solution can match, launching a spend-management product overnight because it already knows every employee, role, and approval chain. Salesforce built a thirty-year, $300B-plus empire on the same insight: own the customer record, and every adjacent tool becomes yours to sell.

The failure mode is contentment as a satellite — the beautifully designed app that sits around someone else’s system of record, adding a feature the incumbent will eventually absorb, forever a guest in a house it doesn’t own. The graveyard is full of them: every slick app built purely on top of the Salesforce or Workday object model that got “sherlocked” the quarter the platform decided the feature was strategic, at which point the satellite had no data gravity to resist with and evaporated, its users migrating in an afternoon because nothing of theirs actually lived in the satellite. When Microsoft bundles the same capability into a license the customer already pays for, “better UX” is not a defense — the switching cost of the satellite was always zero, and zero is exactly what it was worth. The takeaway: fight, from the first customer, to be the authoritative source of truth for something that matters — the record others must read from — because the system of record is inherited, defended by data gravity, and expands outward on its own, while everything orbiting it lives at the pleasure of whoever owns the center.

13. The model is a rental; the moat is everything around it.

Here is the trap that will bankrupt more AI startups than any other single mistake: mistaking access to intelligence for ownership of a business. The frontier labs are locked in a spending war that drives the cost of raw cognition toward zero and the quality of the median model toward parity. GPT, Claude, Gemini, Llama, and whatever open-weight model DeepSeek ships next quarter are converging on the same capability envelope from below, and the price per token falls by roughly an order of magnitude a year. If your company’s core asset is “we called the smartest model,” you are renting your soul from a landlord who can raise the rent, cut you off, or launch your product as a feature next Tuesday. The intelligence is a utility. You do not build a durable company on the electricity; you build it on the factory the electricity runs.

The mechanism that separates the survivors is brutally simple: everything the model cannot provide on its own. The model has no memory of your customer’s last ten thousand transactions. It has no integration into the thirty-year-old system of record the enterprise runs on. It carries no liability, holds no license, and has earned no trust. So the moat is precisely the accumulated, hard-won context and plumbing that turns a generic reasoning engine into an indispensable worker for one specific job. Swappability is the tell. If you have built correctly, you should be able to rip out one foundation model and drop in a cheaper one over a weekend, and your customers should never notice — because the value was never the model.

Look at how the best model-agnostic companies build. Cursor, the AI coding environment that scaled to hundreds of millions in revenue faster than almost any software company in history, does not own a model — it routes across Anthropic, OpenAI, and its own fine-tuned smaller models depending on the task. Its durability is the codebase context engine: the retrieval layer that understands your repository, the low-latency autocomplete infrastructure, the editor workflow developers live inside eight hours a day, and the accumulated telemetry of which suggestions get accepted. Pull out any single LLM and Cursor still works; that is the point. Perplexity is the same story wearing a different suit — it swaps freely across models, and its moat is the real-time retrieval-and-citation pipeline, the answer-ranking, the index, and the consumer brand for “AI search,” none of which the model provides. Harvey, the legal AI valued in the billions, is not defensible because it uses a good model — every competitor uses the same one — but because of its fine-tuning on legal work product, its integrations into law-firm document systems, and the trust it has earned inside white-shoe firms who will not hand confidential matters to an unvetted tool.

The counter-example is the graveyard of “GPT wrapper” companies that raised on a slick demo in 2023 and were dead by 2024. Jasper is the cautionary tale everyone cites: a marketing-copy tool that reached a $1.5 billion valuation as an elegant layer on top of OpenAI, then watched its moat evaporate the moment ChatGPT shipped a free consumer product that did the same thing, cutting its internal targets and forcing a painful reset. It had the model access and nothing around it — no proprietary data loop, no system-of-record lock-in, no distribution the incumbent couldn’t cross. When the landlord became the competitor, there was no factory left standing.

The sharp takeaway: assume the intelligence is free, commoditized, and controlled by someone who may compete with you. Then ask what remains. If the honest answer is “not much,” you don’t have a company — you have a countdown timer on someone else’s roadmap. Build the data, the workflow, the integrations, the liability absorption, and the trust that the model can never supply, and treat the model itself the way a factory treats grid power: essential, invisible, and utterly replaceable.

14. Regulation is a moat once you’re through it.

Founders are trained to hate regulation. It is slow, expensive, opaque, and staffed by people whose job is to say no. Every instinct in a fast-moving technologist says route around it, disrupt it, ask forgiveness not permission. That instinct is correct in consumer software and catastrophically wrong in the domains where the largest durable AI businesses are being built. Because the exact same wall that makes a market painful to enter is the wall that keeps the next entrant out after you have climbed it. Regulation is a one-time tax that converts into a permanent tariff on your competitors. The pain is the point. You want the moat that is measured in years of certification and millions in legal spend, precisely because your would-be disruptor has to pay it too, and most of them will die on the climb.

The mechanism is that compliance costs are front-loaded, non-linear, and non-transferable. Getting a banking charter, a FedRAMP authorization, a security clearance, an FDA clearance, or a state-by-state insurance license takes calendar time that cannot be compressed with more capital or a smarter model. A16z can wire you fifty million dollars tomorrow; it cannot buy you the three years it takes the Defense Counterintelligence and Security Agency to clear your engineers. And once you hold the license, it becomes a gate you stand inside and everyone else stands outside of. The regulator, having certified you, now has an interest in your continuity. Your compliance infrastructure — the audit trails, the controls, the relationships with the agency — is a standing asset that a new competitor must rebuild from scratch while you are already selling.

Anduril is the sharpest example in defense. Palmer Luckey’s insight was not primarily technological; it was that the moat in defense is the accreditation, the security clearances, the ITAR compliance, and the ability to navigate the Pentagon’s byzantine procurement and program-of-record process. Anduril spent years and enormous capital building cleared facilities, cleared personnel, and the compliance apparatus to sell autonomous systems to the U.S. government — and that apparatus is now a wall that a brilliant new drone startup cannot climb in under half a decade, no matter how good its software is. Coinbase did the identical thing in crypto: while competitors raced offshore to avoid regulators, Coinbase deliberately embraced U.S. compliance, acquired money-transmitter licenses in nearly every state, built the surveillance and reporting infrastructure, and made itself the regulated on-ramp. When the SEC crackdowns and the FTX collapse detonated the offshore world, Coinbase’s regulatory posture — the thing that had slowed it down for years — became the reason institutions could only touch crypto through it. Tempus, Eric Lefkofsky’s cancer-genomics company, does it in healthcare: its moat is the CLIA-certified labs, the FDA-cleared diagnostics, and the regulatory-grade data pipeline that let it become the connective tissue between sequencing and clinical decisions, a position no purely-software AI health startup can replicate without building the same regulated physical and legal infrastructure.

The failure mode is treating regulation as an obstacle to be evaded rather than a wall to be occupied. The offshore crypto exchanges that fled U.S. oversight optimized for speed and got FTX — spectacular growth followed by spectacular collapse, because they built no defensible position, only a temporary arbitrage on rules they were dodging. The lesson is not that rules are good; it is that rules you have satisfied and your competitor has not are the most durable moat in existence.

The sharp takeaway: in any domain where an agent touches money, medicine, weapons, or the law, do not ask how to avoid the regulatory burden — ask how to be the first to fully carry it, and then pull the ladder up behind you. The certification that costs you two years and your sanity is the same certification that costs every future competitor two years and their runway. Route through the wall, not around it, and let the wall do your defending.

15. Distribution is a moat, not an afterthought.

The most expensive lie in the founder’s head is “if we build something great, people will find it.” In the last cycle that was already mostly false; in this one it is suicidal. When creation is nearly free and a competent product can be assembled by a small team and a fleet of agents in weeks, the scarce resource is no longer the ability to build the thing — it is the ability to get it adopted. A thousand teams can now build your feature. Two of them can get it into the hands of a million users. The distribution channel — owned, defensible, compounding — is worth more than any cleverness in the product, because the clever product without distribution is a tree falling in an empty forest, and the mediocre product with distribution is a business.

The mechanism is that distribution, done right, is itself a compounding moat rather than a cost line. There are a handful of durable channels: being embedded inside a tool the user already lives in, riding a partner’s rail that reaches customers you never could, a bottom-up product-led motion where the product sells itself and each user recruits the next, or a network that grows more valuable with every node. Each of these, once established, is nearly impossible for a competitor to dislodge, because the competitor would have to rebuild not just the product but the entire adopted position. The company that treats go-to-market as a first-class engineering problem — designing the viral loop, the integration, the self-serve funnel with the same rigor as the core technology — pulls away from the company that ships a great model and hopes.

Ramp is the canonical case of distribution as a weapon rather than an afterthought. Its corporate card and spend-management product is genuinely good, but its ascent to a multi-billion-dollar valuation in record time was driven by a distribution machine: aggressive, data-driven performance marketing, a self-serve motion that lets a finance team be live in minutes, an explicit savings-based hook that gives every customer a reason to evangelize, and a relentless content-and-SEO engine. Ramp designed adoption as carefully as product. The developer-tools world shows the purest version — Stripe, Twilio, and their descendants won through product-led growth where the distribution is the product: a developer drops seven lines of code, it works, they tell their team, the team adopts it, and the usage compounds organically without a salesperson ever calling. Figma did it inside design: the browser-based, multiplayer-by-default architecture meant that sharing a file was the marketing — every design review invited new users into the tool, turning the collaboration surface into a viral distribution loop that Adobe, with a superior legacy product and a desktop-download motion, could not match, which is precisely why Adobe tried to pay twenty billion dollars to buy it.

The failure mode is the technically-superior product that assumed distribution would take care of itself and lost to a worse product that owned the channel. The history of software is littered with better search engines, better social networks, and better databases that died because someone else had default distribution — a pre-installed position, a bundled deal, an existing user base. In AI specifically, the wrapper startups with beautiful demos and no distribution strategy were annihilated the moment an incumbent with a hundred million existing users shipped a good-enough version to its installed base for free.

The sharp takeaway: design the go-to-market with the same seriousness you design the architecture, from day one. Ask where your users already are and how you become a native part of that loop, ask what makes each user recruit the next, and ask what channel a competitor structurally cannot copy. In an age where anyone can build the thing, the company that wins is the one that owns the road to the customer.

16. Compounding beats clever.

Cleverness is a depreciating asset. A brilliant one-time trick — a novel prompt, a slick feature, a pricing gimmick, a growth hack — generates a burst of advantage and then gets copied, because in a world of near-free creation and instant reverse-engineering, any static edge has a half-life measured in months. The only advantages that survive are the ones that get stronger with use — the loops where every customer, every transaction, every day of operation widens the gap between you and everyone else. This is the deepest principle of durability in the age of commodity intelligence: stop optimizing for how good you are today and start optimizing for how much better you get tomorrow, automatically, while you sleep. Ask of every design decision one question — does this compound? — and ruthlessly prefer the choice that does, even when the clever choice looks better in the demo.

The mechanism is the flywheel, and it comes in a few durable shapes. Network effects: each new user makes the product more valuable to every other user, so the leader’s lead widens with scale. Data flywheels: each interaction generates proprietary data that improves the product, which attracts more usage, which generates more data. Switching costs and system-of-record lock-in: the longer a customer stays, the more embedded and irreplaceable you become. Brand and ecosystem: accumulated trust and third-party investment that a new entrant cannot buy. What these share is a positive feedback loop where the output feeds the input, so the advantage is not a wall of fixed height but a wall that builds itself higher every day. The clever competitor who copies your feature is copying a snapshot of a system that has already moved on.

Uber is the textbook compounding machine: more riders attract more drivers, which shortens wait times and lowers prices, which attracts more riders — a two-sided network effect that, combined with density economics in each city, made the marketplace leader’s position self-reinforcing and left a hundred better-funded clones unable to catch a moving target. Scale AI built a data flywheel: the more labeling and evaluation work it did for frontier labs, the better its tooling, quality systems, and workforce became, which won it more of the highest-value data work, which deepened its position as the connective tissue of AI training data. Tesla runs the most-cited operational flywheel of the age: every car on the road is a sensor generating real-world driving data, which trains better autonomy models, which makes the product more valuable, which sells more cars, which generate more data — a loop no competitor without a comparable fleet can enter, and a moat that literally compounds with every mile driven. And the classic: Amazon’s flywheel, where lower prices drew more customers, which drew more sellers, which improved selection and further lowered cost, a self-reinforcing loop Bezos sketched on a napkin and rode for two decades.

The failure mode is the clever, non-compounding business that mistakes an early spike for a moat. The one-hit viral consumer apps — the Q&A app, the anonymous-messaging app, the AI-avatar app — that shot to the top of the charts on a clever mechanic and collapsed within a year because there was no loop underneath: nothing about acquiring the millionth user made the product better for the next one, so growth was a sugar high, not a flywheel, and the moment novelty faded there was nothing left. Cleverness got them in the door; the absence of compounding threw them out.

The sharp takeaway: interrogate every product and go-to-market decision for whether it compounds or merely impresses. A feature that dazzles today and is copied next quarter is worth less than a loop that is boring today and unbeatable in three years. Build the mechanics of an unfair advantage that grows on its own — the network, the data flywheel, the switching costs, the brand — because in a cycle this fast, the only lead nobody can take back is the one that widens itself.

17. Stay small on purpose.

For the whole history of the software industry, headcount was the proxy for ambition. You raised a round, you hired against it, and the size of your org chart was the evidence that you were serious. That equation has snapped. When a handful of people plus a fleet of agents can do what once took a department, every additional hire is a decision that has to be earned against the alternative of writing a prompt. Headcount slows decisions, dilutes ownership, blurs accountability, and — most brutally — burns the one resource you can’t refill, which is time. The advantage now goes to the smallest team that can do the job, not the biggest one that can afford to carry the people who can’t.

The mechanism is revenue-per-employee, and the numbers have gone vertical. Midjourney built one of the most-used generative products on earth — hundreds of millions in revenue, widely reported around $500M at its peak run-rate — with a team that hovered around 40 people and took no outside capital. That’s north of ten million dollars of revenue per head, a figure that would have been a rounding error away from impossible in the SaaS era, where the best public software companies celebrated crossing $400-600K of revenue per employee. Cursor, built by Anysphere, crossed $100M of ARR and then blew past $200M with well under sixty employees, making it one of the fastest-scaling software companies ever measured — and it did it by letting its own coding agents absorb the work a hundred junior engineers used to do. Do the arithmetic: at roughly $200M ARR across fewer than sixty heads, Anysphere books more than $3M of revenue per employee, and it got there in under two years rather than the decade a traditional dev-tools company would have needed to staff up a comparable engineering, sales, and support org. Telegram serves close to a billion users with a core engineering team you could fit in a conference room — famously around thirty people — because the founders treated every hire as a tax on velocity rather than a badge of scale; that is on the order of thirty million users served per engineer, a ratio no traditional consumer-platform staffing model could touch. The lineage runs back to WhatsApp’s 55 employees at a $19B acquisition and Instagram’s 13 at a billion; the difference is that what was once a freak outlier is now the design target. Lovable reached a $100M revenue run-rate in roughly eight months with a few dozen people, because the product itself is the labor — the same code-generation engine it sells to customers is what lets it operate a support and engineering footprint a fraction of the size a $100M SaaS business used to carry.

The operational discipline underneath the number is worth naming, because “stay small” is not a passive state — it’s an active refusal repeated daily. The pattern in these companies is that the default answer to any new workload is a workflow, an internal tool, or an agent, and only when that provably fails does a role open. Whole functions that used to be someone’s job — first-line support, QA triage, data cleanup, release notes, competitor monitoring, even large parts of recruiting screens — are absorbed by software the founders build and maintain themselves. The org chart stays flat, so decisions travel in hours instead of surviving a gauntlet of approvals; every person on the team is an owner with the whole context in their head rather than a coordinator managing the interfaces between other people. That is the real compounding advantage: a five-person team where everyone can see the entire system out-decides a fifty-person team where knowledge is fragmented across departments and half the calendar is spent synchronizing.

The failure mode is the seduction of the round. When Fast, the one-click-checkout startup, raised big, it hired past 400 people and burned north of $10M a month against almost no revenue — reportedly on the order of a few hundred thousand dollars in the year it was spending over a hundred million — the headcount was the story, and when the story ran out, the company collapsed inside two years, with the staff learning the business was over almost overnight. The counter-example rhymes across the SaaS graveyard: companies that treated a fundraise as a mandate to grow the team, watched burn outrun learning, and discovered too late that a bloated org is not an asset you can pause — it’s a liability that has to be paid every two weeks regardless of whether the product is working. The takeaway: treat every hire as an admission that you couldn’t solve the problem with software, and make that admission expensive to yourself. Small isn’t a constraint you tolerate; it’s a strategy you choose, because a lean team of owners will out-decide a large team of coordinators every single time.

18. Be AI-native inside, not just AI-branded outside.

There is a widening gap between companies that sell AI and companies that run on it, and it is the gap that will decide who out-executes whom. It is trivially easy to bolt a chatbot onto a 2015 org chart and put “AI” in the pitch deck. It is much harder — and far more consequential — to rebuild your own operating model so that agents do the support, the research, the ops, the recruiting screens, the first draft of every document, the reconciliation, the triage. The reason it matters is compounding internal leverage: a company whose every function is quietly staffed by software gets faster and cheaper as it grows, while its AI-branded competitor still scales its costs linearly with its people. Eat your own thesis, or watch someone who does eat your lunch.

The mechanism is visible wherever an incumbent has torn out a manual function and rebuilt it as an agent, and the tell is that the internal metrics move, not just the marketing. Klarna is the loudest case: its OpenAI-powered assistant took over roughly two-thirds of its customer-service chats, doing the work of about 700 full-time agents, resolving issues in an average of under two minutes versus the eleven minutes the human queue took, cutting repeat inquiries by a quarter, and the company projected a $40M profit swing in a single year while its overall workforce fell by around a fifth, from roughly 5,000 toward 3,800 as it slowed hiring and let attrition run. The point is not that they fired people; it’s that they redesigned the function — the agent handles the tier-1 volume across dozens of languages instantly, and the humans move up the stack to the hard cases. Ramp built internal agents across sales, support, and back-office finance so that the same team could underwrite and service far more spend — the finance product it sells to customers is the same automation philosophy it runs on itself, which is why it can operate expense and bill-pay for a large customer base without a proportional back office. The pattern has become explicit policy at the top: Shopify’s Tobi Lütke told his company that before any team is granted more headcount, it must first prove the work can’t be done by AI, making agents the default and humans the exception, and folding “reflexive AI usage” into how performance is reviewed; Duolingo’s Luis von Ahn declared the company “AI-first” and began moving contractor work — content generation, translation — into models, treating headcount as the last resort rather than the first.

The discipline that separates AI-native from AI-washed is architectural: the agent is wired into the system of record with the permissions and data to actually do the job end to end, and there is a measured human escalation path for the fraction it can’t. That is the difference between Klarna’s assistant, which can look up an order, issue the refund, and close the ticket, and a bolt-on bot that can only answer FAQs and hand off — the first replaces the work, the second just adds a layer in front of it. The failure mode is instructive precisely because it’s a nuance, not a contradiction: Klarna later walked part of its automation back, publicly acknowledging it had cut too far and rehiring for the cases where an over-eager agent had degraded quality, standing up a model where human agents work alongside the AI for the interactions that need a person. That correction cost real money and public credibility, and it is the sharpest lesson available — AI-native inside doesn’t mean human-free, it means every function is redesigned around the agent with a human on the escalation path, not left untouched with a bot glued on top, and not stripped of humans past the point where quality holds. The takeaway: if your internal operations still look like a headcount-scaling services firm while your marketing says “agentic,” the market will eventually price you as the former, because the cost curve doesn’t lie. Run on the thing you sell.

19. Ship to learn; iteration is nearly free now.

Planning was rational when building was expensive. When a feature took a quarter and a rewrite took a year, you thought hard before you moved, because every wrong turn was measured in months and salaries. That cost structure is gone. When an agent can scaffold a feature in an afternoon and rebuild it the next morning, the calculus inverts: the constraint is no longer the cost of building, it’s the cost of being wrong about what to build — and the only cure for that is contact with a real user. The winning loop is now: ship the smallest real thing, put it in front of someone who has the problem, watch exactly what breaks, and go again, in days rather than quarters. Whoever compresses that loop tightest learns fastest, and in this age learning speed is the competitive advantage.

The mechanism is a shipping cadence that would have looked reckless a decade ago, run on top of an instrumentation habit that treats every release as an experiment with a readout. Cursor ships meaningful releases roughly weekly, treating its own user base of engineers as a live experiment and letting usage data — which completions get accepted, which prompts get retried, where users drop the agent and finish by hand — not a roadmap committee, decide what hardens into the product; that tight loop is a large part of how a team under sixty people stayed ahead of far bigger incumbents shipping on quarterly trains. The company dogfoods relentlessly, building Cursor in Cursor, so the people writing the product feel every rough edge before a customer does, which collapses the distance between noticing a problem and fixing it to a matter of hours. Midjourney ran its entire early development inside a Discord community, pushing new model versions and style parameters to tens of thousands of users at once and reading the reaction in real time — the “v2 to v3 to v4” cadence was a public, weekly conversation with the people generating the images, with the community’s reactions and re-rolls serving as a continuous preference signal, which is why the aesthetic improved faster than any lab shipping on a private schedule. Lovable and Bolt built their entire growth on this: put a code-generating agent in front of non-developers, watch which prompts fail and where the generated app breaks on the first run, patch the failure, ship the same day — and ride the compounding improvement to nine-figure run-rates inside a year, Lovable to a $100M run-rate in roughly eight months by turning every failed generation into training signal for the next.

The operational specifics matter because “ship fast” degrades into thrash without them. The teams that win this way instrument the product so failure is visible — they can see the exact prompt that produced garbage, the step where the agent stalled, the screen where the user rage-quit — and they keep the release mechanism cheap enough that shipping a fix is not an event. Feature flags, fast rollback, and a small enough blast radius that a bad release costs minutes, not the quarter, are what make daily iteration safe rather than chaotic. The loop is: instrument, ship a small real thing, read the signal, patch, repeat — and the whole point is that the cost of being wrong is now measured in a morning, so you buy your learning cheaply and often instead of expensively and once.

The failure mode is spending enormous capital to ship once, big, without ever touching reality on the way. Quibi raised and burned nearly $1.75B and launched a fully-formed product to almost no one, because it treated a mobile-video thesis as something to be planned rather than discovered — no iteration loop, no early contact, no chance to learn it was wrong until it was fatally wrong, and it shut down about six months after launch with most of that capital gone. Google Glass rhymes: a years-long, secretive, big-bang launch of a product that met the real world only after the bet was fully committed, and got rejected on contact. Both are the same lesson written large — every month of private perfection is a month of zero learning, and the market does not grade you on how polished your first contact was, only on how fast you closed the gap afterward. The takeaway: shipping is not the reward at the end of planning, it’s the instrument of planning. Every week you spend perfecting something in private is a week you learned nothing, and someone with a worse first version and a faster loop is already ahead of you.

20. Verify everything; automation manufactures its own demand for proof.

Here is the paradox at the center of the agentic economy: every unit of work an agent produces creates a matching unit of doubt. When a human did the task, trust rode on a person’s judgment and accountability. When software does it at machine speed and machine scale, the question “but did it actually do it right?” multiplies with every action — and in any domain where the stakes are real, that question is the entire barrier to adoption. Which means verification isn’t a compliance checkbox bolted onto the margins; it is the product. The systems that will be trusted with money, medicine, law, and code are the ones that can show their work — trace every step, cite every source, test every output, and prove it — because at machine speed, unverified action is not a feature, it’s a liability waiting to detonate.

The mechanism is building the checking into the core, as an architectural layer with as much engineering behind it as the generation itself. Harvey, the legal-AI company working with firms like Allen & Overy and PwC, doesn’t win on having a smarter model — it wins because its outputs are grounded in verifiable sources with citations a lawyer can click and check, backed by proprietary evaluation harnesses built with actual attorneys to measure whether an answer is correct for a specific legal task, including benchmark work like BigLaw Bench that scores answers the way a supervising partner would. That eval-and-cite layer is what lets a partner put their name on the work and bill it, because the value delivered isn’t the draft — it’s the draft plus the ability to check it in minutes instead of re-doing it in hours. The emerging class of AI security-operations companies — Dropzone AI, Prophet Security — win the same way: an autonomous SOC analyst that just says “this alert is benign” is useless, but one that lays out its full investigation, the evidence it pulled, every log and lookup, and the reasoning chain so a human analyst can audit the verdict in seconds becomes trustworthy enough to run at 3 a.m. across thousands of alerts. Coding agents make verification literal: Cursor and Devin lean on tests and CI as the proof layer, running the generated code against a passing suite before it ships, because generated code that isn’t verified against a test is just a confident guess — and the whole productivity claim collapses the moment an unchecked hallucination reaches production and a human has to spend a day finding it.

The structural point is that verification is where the durable moat lives, not the model. Anyone can call the same frontier API; what’s hard to copy is the accumulated evaluation harness, the labeled corpus of correct-versus-wrong outputs for a specific high-stakes task, the citation and audit trail plumbing, and the human-in-the-loop escalation design that together let a customer trust the output enough to act on it. That trust infrastructure is expensive to build and compounds with every correction, which is precisely why it’s defensible. Harvey’s edge is not that a partner can generate a memo — any associate with a frontier model can do that — it’s that the partner can verify the memo faster than they could write it, click every citation, and sign it with their name on the line. Strip out the eval harness and the clickable sources and you are left with a faster way to produce work that still has to be checked by hand, which is no productivity gain at all in a domain where being wrong is catastrophic. The verification layer is the entire value.

The failure mode is skipping the proof and inheriting the liability, and the case law is already being written. Air Canada’s chatbot invented a bereavement-refund policy, and a tribunal held the airline legally bound to the hallucination, ordering it to pay — the company’s argument that the bot was a separate entity responsible for its own words was rejected outright. A New York lawyer filed a brief full of fabricated case citations his AI had confidently produced, and he and his firm were sanctioned by the court and fined, their names now a cautionary citation of their own. Both are the same lesson: an unverified agent doesn’t remove work, it relocates the work to the moment things go wrong, at maximum cost — a fine, a sanction, a headline, a customer who never comes back. The takeaway: build the verification loop before you build the scale, because in the age of machine-speed action, the company people trust is not the one with the most impressive agent — it’s the one that can prove its agent was right.

21. Your evals are your real IP.

In the old world, your intellectual property was the code — the algorithm, the schema, the clever architecture you could patent or hide. In a world where the model is a rented commodity and any competent team can wire up the same foundation model you use, that IP has evaporated. What remains, and what almost nobody is investing in with the seriousness it deserves, is your ability to know whether the output is good. An evaluation suite — a rigorous, proprietary, domain-specific way of scoring whether an agent did the job correctly — is the one artifact that a competitor cannot copy off your GitHub, cannot lift from a paper, and cannot buy from a vendor. It encodes years of accumulated judgment about what “right” means in your specific corner of the world, and it is the engine that lets you improve, price, and be trusted. What you can measure, you can improve; what you cannot measure, you can only hope about.

The mechanism is brutally simple and almost universally underrated. Progress in an AI product is a function of iteration speed, and iteration speed is gated entirely by how fast and how honestly you can tell whether a change made things better or worse. Without a good eval, you are flying blind: you tweak a prompt, it looks better on the three examples you happened to check, you ship it, and you find out three weeks later that it silently broke a whole category of cases. With a great eval — hundreds or thousands of graded, realistic, adversarial cases that mirror your actual production distribution — every change becomes a measured experiment. The team with the better eval harness isn’t just slightly faster; it compounds, because every day it learns something true while its competitor learns something they only think is true.

Look at how the frontier labs actually behave. OpenAI and Anthropic pour enormous internal resources into evaluation — not the public benchmarks everyone games, but private, carefully-constructed eval sets that measure the behaviors they care about, and both treat these as tightly-held assets rather than marketing. Anthropic’s public writing on “model evals” and constitutional testing gestures at a discipline that is far deeper internally; the real scoring rubrics are the crown jewels, because they define what the model is being optimized toward. Scale AI built an entire multibillion-dollar business on exactly this insight: its most defensible product isn’t data labeling, it’s the evaluation and red-teaming layer — SEAL leaderboards, private held-out test sets, human-expert grading pipelines — that labs and enterprises pay for precisely because a trustworthy measurement of model quality is scarcer and more valuable than the models themselves. And at the application layer, the vertical winners are quietly the same: a company like Cursor or a medical-scribe firm like Abridge lives or dies on an internal eval that captures the ten thousand ways a code edit or a clinical note can be subtly wrong, graded against ground truth its competitors don’t have.

The failure mode is seductive and everywhere: teams that treat evals as a compliance checkbox, run the public benchmarks, post a nice number, and move on. They optimize for MMLU or a leaderboard that has nothing to do with their real job, overfit to it, and ship a product that scores well and works badly. The counter-example that should haunt every founder is the demo that dazzles and then dies in production because the team never built the measurement to catch the failures that only appear at scale. The takeaway: build your eval like it’s the engine of the company, because it is. The model is the fuel — cheap, swappable, available to everyone. Your evals are the thing that tells you where you’re going and whether you’re winning, and that is the last piece of IP the tide can’t wash away.

22. Build the data flywheel before you need it.

The single most expensive mistake a founder can make in this age is treating proprietary data as a problem for later — something you’ll “figure out once we have scale.” By the time you have scale, the architecture of your product has already decided whether every user interaction makes you permanently better or simply evaporates. The data flywheel is not a feature you bolt on at the Series B; it is a design decision you make in the first hundred lines of code, and it is almost impossible to retrofit. The question to ask on day one is merciless: does every transaction, every correction, every edge case my product encounters get captured, structured, and fed back so the system improves in a way no competitor can match? If the answer is no, you are building a depreciating asset while your competitor builds a compounding one.

The mechanism is a loop: usage generates proprietary data, that data improves the product, a better product attracts more usage, and the gap between you and everyone else widens every single day you both operate. What makes it a moat rather than merely a nice feature is that the data is generated by your own operation and is therefore structurally unavailable to anyone else. The internet is a commons everyone can scrape; the exhaust of your specific product running against real users in the real world is yours alone. The founders who understand this design the capture mechanism first and the flashy surface second, because they know the surface is copyable in a weekend and the accumulated data is not.

Tesla is the canonical example and it is worth being precise about why. From the beginning, every Tesla on the road was an instrumented data-collection device: the fleet captured the exact disengagements, the weird intersections, the edge cases where the driver overrode the system, and shadow-mode comparisons between what the car would have done and what the human did. Billions of real-world miles no competitor could access became the training substrate for the next model — a flywheel deliberately engineered years before it paid off. Midjourney did the same in a completely different domain: by running inside Discord where every generation is public, every “upscale this one,” every re-roll, and every variant selection is a human preference signal, so the product’s entire usage surface is a continuous, proprietary dataset of what people find beautiful — which is exactly why its aesthetic pulled away from open-source image models trained on the same public images. Cursor built its flywheel into the act of coding itself: every time a developer accepts, rejects, or edits a suggestion, the system learns which completions are actually useful in real repositories, a preference stream that a company shipping a generic coding assistant simply never collects. In each case the flywheel predated the scale — it was baked in when the product was small and nobody was watching.

The failure mode is the team that builds a beautiful wrapper over a foundation model, gets early traction, and only then realizes it has no proprietary data loop at all — every insight it generated flowed back to the model provider or to nobody, and a better-funded competitor with the same idea and an actual flywheel eats it alive. You cannot go back and re-instrument a year of interactions you didn’t capture; that data is gone forever. The takeaway is a discipline: before you write the product, design the loop. Decide what signal every interaction will leave behind, how you’ll capture it, and how it feeds back. The companies that win the decade baked the flywheel in on day one, when it felt premature and unnecessary — which is precisely the moment it had to be done.

23. Taste and judgment are the last human moat.

When the machine can generate infinite competent output, competence stops being scarce and therefore stops being valuable. Anyone can now produce a passable landing page, a decent function, a serviceable brand identity, a fine essay — the average is free and instant. What becomes precious in that world is the opposite skill: the ability to look at ten competent options and know which one is right, to feel the difference between “fine” and “excellent,” to hold a standard and defend it against the seductive pull of good-enough. Taste and judgment — the curatorial, editorial, standard-setting faculty — are the one thing the machine democratizes away from, because they are exactly what it cannot supply. The scarce resource has moved from making the thing to knowing which thing to make, and humans who possess that knowing become more valuable as generation gets cheaper, not less.

The mechanism is a flip in where the bottleneck sits. When output was expensive, the constraint was production — you hired more people to make more stuff. Now that output is nearly free, the constraint is selection and direction: with a thousand possibilities generated in seconds, the value-creating act is the discernment that picks the one that’s right and the standard that rejects the ninety-nine that are merely acceptable. This is why the winning teams increasingly hire not for the ability to produce but for the ability to judge — people with opinions, with a refined sense of quality, with the confidence to say “no, this isn’t good enough” when everything technically works.

Apple is the enduring proof: its defensibility has never been that it could manufacture — contract manufacturers can build anything — but that a small group of people with ferocious taste decided which details mattered, killed the ninety-nine designs that were fine to ship the one that was right, and refused to compromise on the feel of a scroll or the radius of a corner. That judgment, not any patent, is why people pay a premium. Linear brought the same religion to developer tools: in a category full of feature-equivalent project trackers, it won by an obsessive, opinionated sense of craft — the speed, the keyboard flow, the restraint about what not to build — that competitors with larger teams and identical technology could not replicate, because you cannot hire taste by the dozen. Superhuman built an entire company on the premise that an email client could be worth thirty dollars a month purely on the basis of feel — the sub-hundred-millisecond interactions, the designed-down-to-the-keystroke experience — a wager that only pays off if you believe judgment about quality is a moat, which it turned out to be.

The failure mode is the organization that mistakes volume for value: it uses AI to ten-times its output and floods the world with competent, forgettable, indistinguishable content, shipping more while mattering less, because it removed the human filter exactly when the filter became the whole point. The counter-example is any team that let the machine generate and forgot to have anyone with taste decide. The takeaway: in the age of infinite competent output, hire the people who know the difference between competent and exceptional, give them the authority to reject, and protect their standard like the asset it is. Machines make the average free. Humans who can define and defend the exceptional are the last moat — build a team of them.

24. Build the boring reliability, not the beautiful demo.

Every AI product is born as a demo, and the demo is a lie of omission. It shows the happy path — the one input that works, the case that dazzles the investor and the crowd — and it hides the ninety-nine other cases where the thing hallucinates, times out, mangles the edge case, or silently corrupts the data. The demo is free; everyone has one; the gap between having an impressive demo and having a product a customer will actually deploy with real money and real stakes on the line is the entire game, and it is made of the least glamorous work in software: error handling, retries, fallbacks, integration grime, the malformed input on row 4,000, the API that returns a 500 at 3 a.m., the 0.1% of cases that would be catastrophic if they slipped through. Most AI companies die in exactly this gap, and the ones that survive are the ones that fell in love with the boring last mile that everyone else skipped.

The mechanism is that trust in high-stakes domains is not granted for brilliance; it is granted for dependability, and dependability is a property of the tail, not the average. A system that works 95% of the time is a wonderful demo and a useless product for anything that matters, because the 5% is where the lawsuits, the outages, and the ripped-out contracts live. Getting from 95% to 99.9% costs more engineering than getting from 0% to 95% did, produces nothing you can show off in a keynote, and is precisely why it’s defensible: your competitors would rather build the next flashy feature than grind out the reliability, so the moat is the unglamorous work itself.

Waymo is the definitive case. Dozens of companies produced jaw-dropping self-driving demos a decade ago; Waymo is one of the few running real driverless commercial service, and the reason is that it spent years — and billions — on the boring, invisible last mile: the redundant sensors, the remote-assistance fallback, the exhaustive handling of construction zones and emergency vehicles and the once-in-a-million weird scenario, the relentless work of turning an impressive demo into a system safe enough to carry a stranger with no one in the driver’s seat. Ramp did the same in fintech, where the flashy pitch is “AI that automates your finance work” but the actual moat is the unsexy reliability underneath — accounting integrations that don’t break, transactions that reconcile correctly every time, controls that a CFO can trust with the company’s money — the grinding correctness that lets a finance team hand over real authority. Stripe built a generational company on this exact principle before the AI wave: the demo of “accept a payment” is trivial, but the last mile — the fraud handling, the retries, the edge cases of a hundred currencies and card networks, the API that simply never goes down — is what made it the default, because reliability at the tail is worth more than any feature at the front.

The failure mode is the well-funded team that ships the beautiful demo, wins the launch-day headlines, and then watches enterprise pilots quietly die because the thing wasn’t dependable when it touched real workflows — impressive in the keynote, un-deployable in production. The takeaway is a temperament as much as a tactic: the defensible companies are built by people who find the unglamorous last mile more interesting than the demo, who treat the edge case as the product rather than the afterthought. Demos are everywhere and worth nothing. The 99.9% that makes a system trustworthy with real stakes is where the durable companies live — do the boring work everyone else skips.

25. Meet the work where it already happens.

The instinct of every founder is to build a destination — a shiny new app, a dashboard, a place users are supposed to log into and love. It is the single most expensive mistake in the age of free creation, because the scarce resource was never the software; it was the human attention required to change where work gets done. People do not want a new tab. They want the job finished inside the loop they already live in. The winning move is not to pull the user to you — it is to inject yourself into the exact surface where the work is already flowing, so that adoption costs nothing because nothing has to change except that the work gets better.

Look at how the fastest-adopted AI products of this cycle actually spread. GitHub Copilot did not build a “prompt-engineering studio” and ask developers to leave their editor; it embedded as an inline autocomplete directly inside VS Code, JetBrains, and Neovim — the developer keeps typing where they always typed, and the suggestion appears in the flow of the keystroke. There is no context switch, no new muscle memory, no adoption tax. That native placement, more than any raw model quality, is why Copilot reached millions of paying developers faster than almost any developer tool in history. Abridge did the same thing in medicine: rather than asking exhausted clinicians to open a separate transcription app, it built directly into the Epic EHR workflow, so the ambient recording, the structured note, and the billing codes land inside the system the doctor already documents in. The clinician does not adopt a new tool — the note simply writes itself in the place the note always went. Cursor took the opposite tactic to the same end: it forked the entire editor so the AI is not a plugin but the substrate of where code is written, meeting developers so completely inside their work that the environment is the product.

The mechanism is that every existing workflow already has a system of record and a habituated surface — the IDE, the EHR, the ledger, the CRM, the procurement rail, the ticket queue. Whoever renders their intelligence at that surface inherits the distribution the incumbent spent a decade building, for free. You are not competing for a new behavior; you are riding an old one. This is why the integration is often the whole company: Abridge’s real moat is not its transcription model — that is rentable — it is the deep, certified Epic embedding that a competitor cannot casually replicate. The work-surface integration is the distribution moat and the switching-cost moat at once.

There is a subtler version of the same principle that most founders miss: the surface of the work is not just an app, it is a rail. Ramp built a finance-automation empire not by asking CFOs to visit a new analytics site but by sitting on the corporate-card and bill-pay rail where the spend already flowed, so every transaction became a place to insert an agent that categorizes, flags, and closes the books in the ledger the finance team already reconciles against. In government, the leverage is the procurement rail; in logistics, the load board and the TMS; in healthcare revenue, the clearinghouse. In each case the durable move is the same: find the pipe the work already runs through and become a native segment of it, rather than building a parallel pipe and begging traffic to switch over.

The failure mode is the “AI destination” that demands migration. A parade of well-funded startups built beautiful standalone AI workspaces — a separate chat app for your company’s knowledge, a new hub for your team’s documents — and watched engagement crater because the work never actually moved there. The knowledge lived in Slack and the ticket got resolved in Zendesk, so the shiny hub became a graveyard. The counter-lesson is Microsoft Copilot’s brute-force advantage: however mediocre a given feature, it appears inside Word, Excel, Teams, and Outlook where a billion people already are, and proximity beats brilliance. Adjacency to the work wins over superiority in a place no one visits.

The takeaway: the shortest path to adoption is not a better product in a new place — it is a good-enough product in the place the work already happens. Build the plug, not the destination, and let the existing loop carry you.

26. Trust is earned in the workflow, not the pitch.

No enterprise hands an autonomous agent real authority over its money, its patients, or its legal exposure because a founder gave a compelling demo. In high-stakes domains, the deck is worthless and the pilot is everything. Trust is not granted; it is accrued — one small, correct, verifiable action at a time — until the buyer has watched the agent be reliable so many times that expanding its mandate feels safe rather than reckless. The product’s real job in year one is not to be impressive. It is to be boringly right, over and over, in a narrow lane, while the human watches. That is the substrate on which autonomy is later granted.

This means the correct go-to-market shape is a trust ramp, engineered deliberately: start narrow, start supervised, prove reliability on the low-stakes slice, then earn each increment of autonomy. Harvey, the legal AI company, is the canonical case. It did not walk into Allen & Overy (now A&O Shearman) and PwC promising to replace lawyers; it embedded as a supervised drafting and research assistant whose every output a partner reviewed, and it earned trust by being consistently useful on contract analysis and due diligence before ever being trusted with anything unsupervised. The human-in-the-loop was not a limitation to apologize for — it was the mechanism by which the firm’s confidence, and Harvey’s expanded scope, compounded. The AI security-operations companies run the same play: an autonomous SOC analyst like Dropzone AI or Prophet Security does not begin by auto-remediating threats and locking accounts. It begins by triaging tier-1 alerts and writing up its reasoning for a human SOC analyst to approve. Every alert it investigates correctly is a deposit in the trust account; only after months of demonstrated accuracy does the customer let it close tickets or take action on its own. Sierra, Bret Taylor’s customer-service agent company, structures its very pricing around this — it charges on resolved outcomes precisely because it has to prove, resolution by resolution, that the agent handled the customer correctly before the enterprise widens its remit.

The mechanism beneath all of this is that trust is a function of observed reliability over time, and reliability can only be observed in the workflow — in production, on the customer’s real cases, with real consequences visible. That is why verification, traceability, and the ability to show the agent’s work are not features but the load-bearing wall of the whole business. The systems that earn autonomy are the ones that can prove each action was correct, so the human’s supervision burden falls as confidence rises. The trust ramp and the verification layer are the same investment.

This reframes what the enterprise pilot actually is. Founders treat the pilot as a sales obstacle — a hoop to clear before the real contract. It is the opposite: the pilot is the product, because it is the machinery by which trust is manufactured. The company that instruments its pilot to surface every correct action, quantify its accuracy against the human baseline, and hand the buyer a defensible reliability record is not doing pre-sales busywork — it is building the exact evidence the buyer’s risk committee needs to say yes to expansion. Sierra’s outcome-based pricing works because it aligns the vendor’s incentive with this reality: the vendor only wins when the agent is genuinely reliable, so the vendor is motivated to ramp scope at exactly the pace trust can bear, no faster. The pricing model and the trust ramp reinforce each other.

The failure mode is demanding trust the workflow has not yet earned — the “full autonomy on day one” pitch. Early autonomous-agent launches that promised to book, buy, and act with no supervision hit a wall the moment they made a single expensive, public mistake, because they had built no reservoir of demonstrated reliability to absorb it. One hallucinated legal citation, one wrongly closed security incident, and the mandate is not just paused — it is revoked, and often the vendor with it. Trust is asymmetric: it accrues linearly and collapses instantly.

The takeaway: adoption is a relationship, not a transaction. Design the trust ramp as deliberately as the product — narrow, supervised, provable, expanding only as fast as reliability is demonstrated — because in high-stakes work, the company that wins is not the one with the boldest demo but the one that earned the next increment of autonomy the honest way.

27. In a world of infinite content, authenticity is the premium.

When generation becomes free, content becomes worthless in aggregate and the scarce, priceable thing inverts to its opposite: proof that something is real. Real authorship, real provenance, real human origin, real connection. This is a straightforward consequence of abundance economics — the marginal AI-generated image, article, voice, or profile now costs essentially nothing to produce at infinite scale, which crushes the value of “content” as a category and simultaneously creates enormous willingness to pay for the one thing the flood cannot supply: verified genuineness. The differentiated position across media, identity, commerce, and community is no longer “more content.” It is authenticated content — and building the rails of verifiable authenticity is one of the great business opportunities of the age.

The clearest signal came from the artists themselves. Cara, the portfolio community founded by photographer Jingna Zhang, exploded from a small following to hundreds of thousands of users almost overnight in 2024, entirely on the promise of being a human-made space — it bans undisclosed AI art and integrates the University of Chicago’s Glaze and Nightshade tools to protect original work from being scraped for training. Its entire value proposition is authenticity as a feature: a place where you can trust the art was made by a person. The provenance-infrastructure players monetize the same premium from the supply side. The C2PA standard and Adobe’s Content Credentials attach cryptographically signed origin metadata to media — a tamper-evident record of who made an image and how — and Adobe has woven it through Photoshop and Firefly because it understands that in a synthetic world, verifiable provenance is what lets professional and commercial content command trust and price. Truepic built an entire business on camera-level capture authentication, proving a photo is a real, unaltered image of a real scene — sold into insurance, lending, and warranty claims where a faked photo is fraud. And the proof-of-personhood layer — Tools for Humanity’s World ID, whatever one thinks of its methods — exists precisely because “are you a real human, once” becomes a scarce and valuable primitive when bots and synthetic identities are free to spin up at infinite scale.

The mechanism is that authenticity is a moat that free creation cannot cross by definition — a competitor with a better model cannot manufacture realness, because realness is exactly the property their manufacturing negates. Provenance, verified human origin, and genuine relationship are structurally uncopyable by the abundance machine. That is why they compound in value as the flood rises. The businesses here are the verification rails (provenance, watermarking, personhood), the human-curated spaces that guarantee genuineness, and the trust marks that let real things charge a premium over the synthetic average.

It is worth naming the demand side precisely, because it is broadening fast. Regulators are beginning to mandate disclosure of synthetic media; the EU AI Act requires AI-generated content to be labeled, which converts provenance from a nice-to-have into a compliance requirement and hands a tailwind to every C2PA and watermarking vendor. Advertisers and news organizations, terrified of their brands appearing beside or as synthetic fabrications, will pay for signed provenance the way they pay for brand-safety verification today. Marketplaces bleeding from AI-generated fake reviews and counterfeit listings need proof-of-human and proof-of-origin to survive. And on the human-connection axis, the premium is already visible in the resurgence of curated, verified, small-scale community — the paid newsletter with a named human author, the invite-only space that guarantees you are talking to real people. In every one of these, the willingness to pay is not for more, but for provably real.

The failure mode is chasing the abundance rather than the scarcity — building yet another AI content-generation firehose into a market already drowning, where your output is instantly commoditized and indistinguishable from ten thousand others. The counter-example cuts deeper: platforms that let synthetic content pollute the well without provenance controls actively destroy their own trust and, with it, their pricing power — the flood of AI-generated slop and fake reviews has made “verified real” the thing users now hunt for, and the platforms that cannot supply it bleed credibility.

The takeaway: abundance makes the genuine article worth more, not less. When everyone can generate, the premium migrates to whoever can prove — so build the verification, the provenance, and the human trust that the infinite-content machine can never counterfeit.

28. Design for the buyer’s fear, not just their desire.

Every enterprise adoption decision is a tug-of-war between two forces: the upside the buyer wants and the risk the buyer fears. Founders, being optimists selling their own creation, obsess over the upside — faster, cheaper, smarter — and systematically under-weight the fear. This is a fatal miscalibration, because in exactly the high-stakes domains where the value is largest, fear wins by default. The person who signs the contract is rarely rewarded for the upside but is absolutely blamed for the downside; their asymmetric incentive is to not get fired. The product that removes their fear — auditable, reversible, guaranteed, “you personally will not be blamed when this touches production” — beats the product with the flashier capabilities every time. Sell the safety, and the desire follows in its wake.

The two most valuable security-and-compliance companies of the cycle are pure fear businesses, and their trajectories prove the thesis. Vanta and Drata do not sell the desire to have great security — no one wakes up wanting a SOC 2 report. They sell the removal of a specific, acute fear: the deal you will lose, the audit you will fail, the enterprise customer who will walk if you cannot produce compliance evidence on demand. Vanta automates the continuous collection of that evidence so the buyer is never caught exposed, and it built a multi-billion-dollar business on that single anxiety. Wiz sells to an even sharper fear — the catastrophic cloud breach that ends the CISO’s career — by continuously mapping the “attack paths” an intruder could actually exploit and telling the buyer exactly what to fix first. It framed its entire product around the executive’s nightmare, not around abstract security features, and it grew from zero to the fastest-scaling software company in history, culminating in Google’s agreement to acquire it for roughly 32 billion. The mechanism is identical in both: name the buyer’s specific fear precisely, then be the auditable, provable removal of it.

The mechanism generalizes far beyond security. In any domain where an agent touches money, health, law, or safety, the buyer’s fear is being blamed for the machine’s mistake — and the products that win are architected around defusing that. This is why absorbing liability (standing behind the outcome, guaranteeing it, insuring it) is so powerful, why traceability and reversibility matter more than raw capability, and why the human-in-the-loop is often a feature the buyer pays for rather than a limitation. The design principle is concrete: make every action auditable, make it reversible, make the blame land on the vendor and not the buyer. Build the product the anxious approver can defend to their board when something goes wrong — because something eventually will, and their fear is entirely about that day.

There is a hard commercial lesson hidden here about who you are actually selling to. In a high-stakes enterprise, the user who loves your agent and the executive who fears it are different people with opposed incentives, and the fearful one holds the veto. Your entire go-to-market has to be built to arm the champion with the ammunition to defeat the skeptic internally — the audit log they can show the risk committee, the reversibility they can promise legal, the vendor indemnification they can wave at procurement, the reference customer in the same regulated industry who already survived the leap. Vanta and Drata implicitly understand this: the artifact they produce, the compliance report, is itself a piece of ammunition their buyer uses to remove someone else’s fear — the enterprise customer demanding proof. They sell fear-removal that their buyer then resells up the chain. That is the deepest version of this principle: build a product that does not merely soothe your buyer’s fear but becomes the instrument by which your buyer soothes everyone else’s.

The failure mode is the capability-maximalist product that dazzles in the demo and dies in procurement. Founders watch the technical buyer light up at the autonomy and the speed, mistake that enthusiasm for a deal, and then get strangled in security review, legal, and risk — because the economic buyer and the risk committee were never sold. The most impressive agent in the world does not ship if it cannot answer “what happens when it’s wrong, and who gets blamed?” The counter-example is every startup that led with “fully autonomous” into a regulated buyer and lost to a slower competitor that led with “auditable, supervised, and you stay in control.”

The takeaway: in high-stakes domains, fear is the gatekeeper, not desire. Design for the anxious approver — auditable, reversible, guaranteed, blame-absorbing — because the product that lets the buyer feel safe is the product that gets bought, and the safety is what makes the upside reachable at all.

29. Time the wedge.

Every great company is a correct bet on when, not just what. The idea is almost never the scarce thing — dozens of teams saw ride-hailing, video streaming, and food delivery years before anyone made money on them. What separates the winner is entering at the exact moment the underlying technology crosses from “impressive” to “cheaper and better than the status quo.” Too early, and you spend your entire runway evangelizing a market that isn’t ready; too late, and the loop is already owned. The whole game is reading the inflection — the “why now” — correctly, because the inflection is worth more than the insight.

The mechanism is that a new company rides an exogenous cost curve it did not create and cannot control, and its only job is to be positioned when that curve crosses the line where the new way beats the old way for a normal customer. Miss the crossing in either direction and the same idea kills you. Uber is the canonical case. The idea of summoning a car from your phone was obvious; what made it possible in 2009 and not 2005 was a stack of enabling technologies maturing at once — the iPhone shipped in 2007, the App Store in 2008, GPS in every pocket, mobile data cheap enough to stream location, and cloud infrastructure to dispatch at scale. Uber didn’t invent any of those; it recognized that their simultaneous arrival meant a two-sided marketplace for real-time transportation was suddenly buildable, and it moved before the incumbents understood the smartphone was a dispatch terminal. Look at the exact timing: in 2005 there was no App Store to distribute the driver app, no in-pocket GPS to locate a rider to the curb, and mobile data ran at EDGE speeds that could not stream a live map — the identical idea in 2005 would have died in the demo. By 2010, when Uber turned on UberX, smartphone penetration had crossed roughly a third of US adults and was climbing on an exponential; the crowd still thought “a black-car booking app” was a niche luxury toy for San Francisco, and that dismissal is exactly why Uber had a two-year head start to build liquidity in city after city before the incumbents woke up. DoorDash timed a second, subtler wedge: it launched in 2013 into suburbs where earlier delivery plays had ignored, then rode the same smartphone-plus-GPS curve to a logistics network, and crucially it was positioned when COVID turned delivery from convenience to necessity — the wedge it had spent seven years sharpening met a demand shock and it took the market. The contrarian read there was geographic: the crowd chased dense urban cores where courier economics looked best on a spreadsheet, and DoorDash bet that suburban households with higher order values and less competition were the better wedge, which is why it passed Grubhub and Uber Eats in US share by 2019 before the pandemic even hit. Airbnb is timing plus a crisis: it launched in 2008 into the teeth of the financial collapse, exactly when hosts needed the income and travelers needed the discount, so the recession that killed other startups was the demand-side “why now” that made couch-renting suddenly reasonable. The mechanic there is a demand-side inflection rather than a technology one: the same product pitched in the 2006 boom, when no homeowner needed to rent a spare room to make rent, would have found neither supply nor a socially acceptable reason to exist, and the crisis manufactured both sides of the marketplace in a single stroke.

The failure mode is being right about what and catastrophically wrong about when — and it is the most common way visionary founders die. Webvan raised over a billion dollars and burned it building automated grocery-delivery warehouses in 1999, a full decade before smartphone penetration, cheap logistics software, and consumer habit existed to support it; the identical thesis made Instacart and DoorDash worth tens of billions once the enabling curves finally crossed. Webvan wasn’t wrong — it was early, which in venture is indistinguishable from wrong. Trace the money: it spent $1 billion building automated warehouses and signed a $1 billion Bechtel contract to build distribution centers in 26 cities, committing capital against demand that did not yet exist, and it was liquidated in 2001 having burned roughly $800 million of investor money for want of a market that showed up ten years late. General Magic in the early 1990s designed the smartphone before the components, networks, or market existed to make it real — its Magic Cap devices needed cheap wireless data, capacitive touch, and app ecosystems that were fifteen years out, so a team that literally invented the future shipped into a void and folded, while the same vision minted trillions for Apple once the curve caught up. The takeaway is brutal: pioneering the market and building the winning company are usually different jobs done by different companies a decade apart. Do not fall in love with an idea whose enabling cost curve hasn’t crossed yet — track the curve, and strike at the inflection, not before.

30. Be contrarian and right.

Consensus opportunities are already priced. If everyone in the room agrees a market is the future, the capital, talent, and competition have already flooded in, and the excess returns are gone before you arrive. The outsized outcomes come from a specific and uncomfortable place: the thing that is true but not yet obvious — the market others dismiss as too small, the wedge they think is a toy, the “boring” or “unfundable” domain they overlook. The formula, as Peter Thiel put it, is a secret: something you believe that few people agree with. Being contrarian alone makes you a crank; being right alone makes you consensus. The money is only in the narrow overlap — contrarian and right — and it feels lonely by construction, because if it felt comfortable, it would already be crowded.

The mechanism is that markets misprice ideas that violate the current story of what’s respectable, valuable, or possible, and the mispricing is your entry point and your head start. Airbnb was rejected by nearly every top investor in 2008 because the consensus was obvious and wrong: no one will sleep in a stranger’s home, and no stranger will let them. One well-known Y Combinator-era passed term sheet valued the company at a level that would later look like a rounding error; the founders were contrarian on human trust and right about it, and they got a category to themselves precisely because the smart money laughed. Anduril is the sharpest recent case. The Silicon Valley consensus for a decade was that defense was morally toxic, procurement was unwinnable, and no venture-backed startup could break the primes’ grip on the Pentagon — so Palmer Luckey and team ran directly at it in 2017, self-funding product and selling finished capability instead of billing cost-plus for R&D. That business-model inversion was the real contrarian bet: the primes make money on cost-plus development contracts where the government owns the IP and pays for every hour, and Anduril instead built products on its own dime, kept the IP, and sold them like software — a model the crowd said the Pentagon would never buy. The contrarian bet that a software-first company could take defense primes head-on was validated into a valuation that has climbed past thirty billion dollars, and the consensus that made everyone else stay away is exactly why Anduril had so little competition when it mattered. SpaceX is the same shape at a larger scale: the settled belief in 2002 was that rockets were the exclusive domain of nation-states and giant contractors, that reusability was impossible, and that a software entrepreneur had no business in orbit. Musk was contrarian on reusable rockets and right, and the reward for holding a truth everyone else dismissed was a functional monopoly on cheap access to space — by the 2020s SpaceX was launching the majority of all mass to orbit on Earth while the incumbents who “knew” reusability was impossible were left buying rides.

The failure mode has two faces. One is contrarian and wrong — Theranos was gloriously non-consensus about a blood-testing breakthrough that simply didn’t work, and conviction without truth is just fraud or delusion; it raised money at a $9 billion valuation on a secret that was not true, and the entire edifice was worth zero the moment the physics was checked, because being different from the crowd is worthless if the crowd is right. The other, quieter failure is being right but consensus — arriving at a true thesis after everyone else already holds it, where you get the satisfaction of being correct and none of the returns, because the opportunity was competed away before you moved. The graveyard of “me-too” AI wrappers launched in 2023, each correct that large language models were transformative and each indistinguishable from forty competitors, is the consensus-and-right failure at industrial scale: a true thesis held by everyone is a commodity, and commodities don’t return a fund. The takeaway: the goal is not to be different for its own sake, and not to be safely correct with the crowd — it is to find the specific true thing the smart people around you are confidently wrong about, and to hold it long enough to be proven right alone.

31. Build for the world after the technology is cheap.

Do not build for today’s cost of intelligence, compute, launch, or robotics — build for what they will cost in three years, because three years is when you’ll actually be at scale. The trap is designing a company around the current price of the key input, optimizing painfully around a constraint that is about to evaporate, and then being structurally out-positioned by the founder who assumed the cheap world and built for it from day one. Assume the model is 10× cheaper, the agent 10× more reliable, the robot 10× more capable, the electron and the launch 10× less expensive. The companies that win are designed for the world that is arriving, not the one that is leaving — they skate to where the cost curve is going.

The mechanism is that in a technology wave, the dominant input cost falls on a predictable exponential, and a business model that is uneconomic at today’s price becomes wildly profitable at tomorrow’s — so the founder who builds for the future price gets to scale into an economic reality their competitors were too cautious to assume. SpaceX is the purest expression. Reusability was insane at the launch prices of the 2000s, but Musk built the entire company around the belief that landing and reflying boosters would collapse cost-per-kilogram by an order of magnitude — and the math bears it out: expendable heavy-lift ran on the order of $10,000–$20,000 per kilogram to orbit, and Falcon 9 reuse drove marginal cost toward the low thousands, with Starship targeting a further order of magnitude below that. Then Starlink is the second-order bet layered on top: a satellite-internet constellation that only closes as a business because SpaceX drove its own launch costs down first — a constellation of thousands of satellites is a fantasy at $10,000/kg and a business at $1,500/kg, so Starlink is a company built for the world after cheap launch, made possible by the company that made launch cheap. OpenAI is the same logic in software: it committed to the scaling hypothesis — that pouring exponentially more compute and data into transformers would keep yielding capability — and built the organization, the infrastructure deals, and the product roadmap around a future where frontier intelligence is abundant and cheap, years before the market believed it, when the per-token cost of a capable model was still hundreds of times what it would become. They built for the after-world and it arrived; inference costs for a given capability level have since fallen by more than 10× per year in several bands, exactly the curve they underwrote. Anduril designs its autonomy stack and Lattice platform on the assumption that edge compute and capable sensors keep getting cheaper, so a swarm of cheap autonomous systems replaces a few exquisite manned platforms — a bet that a thousand attritable drones at falling silicon prices beats one exquisite platform, which is a bet on a cost curve, not a single product.

The failure mode is the mirror image of Principle 29: building for the current cost and getting stranded when the curve moves, or conversely betting the cheap world arrives faster than it does and starving before it lands. Many early autonomous-vehicle and solar companies assumed sensor, battery, or panel costs would fall on a schedule that slipped by years, and the ones who spent against the aggressive timeline ran out of money one curve-crossing too early. Better Place is the cautionary monument: it raised roughly $850 million to build a battery-swapping network for electric cars around a bet that battery costs and EV adoption would arrive on its aggressive timeline, spent against that assumption at full tilt, and filed for bankruptcy in 2013 having sold barely more than a thousand vehicles — the cheap world it built for did arrive, but years after its cash ran out, and the assets sold for pennies. That is the exact symmetry to watch: being early to the cheap world is as fatal as being late to it. The discipline is holding two truths at once: the cheap world is coming, and you must survive until it does. The takeaway: underwrite the exponential, design your unit economics for the price three years out, but keep enough runway to still be standing when the curve finally crosses.

32. Make the mission the moat.

In a cycle this fast, this crowded, and this brutal, the thing that keeps your best people through the years of grind is not the size of the market — it’s the sense that they are building something that genuinely matters. A real mission is not a poster in the lobby; it is a functional recruiting weapon, a retention mechanism, and a source of endurance that money cannot buy and competitors cannot copy. It recruits talent that would otherwise cost you double, it survives the pivots that would break a company organized only around a product, and it outlasts the hype cycles that come and go. In an age where the technology is a commodity tide that lifts everyone, the mission is one of the few advantages that is genuinely yours.

The mechanism is a labor-market arbitrage: the scarcest resource in a technology wave is not capital but the small number of people who can actually build at the frontier, and those people are disproportionately motivated by meaning, so a credible mission lets you win and hold talent that a pure paycheck cannot. SpaceX runs its workforce brutally hard for a reason that has nothing to do with compensation — “making humanity multiplanetary” recruits engineers who could earn more elsewhere and keeps them through eighty-hour weeks and explosion after explosion, because they are not doing a job, they are joining a cause. The mechanic is concrete: a top propulsion engineer with a standing offer from a FAANG company at a materially higher cash-and-equity package chooses to weld tanks in Boca Chica for less, because the mission buys the delta that money would otherwise have to, and it holds that engineer through four Starship test articles exploding on camera — a sequence of public failures that would trigger a talent exodus at a company organized only around a product. Anduril converted a moral stance — that serious people should build the tools that defend the West and its allies — into a hiring magnet, pulling talent that Silicon Valley’s anti-defense consensus had left on the table, and that shared conviction is what holds a team together through the grind of unseating entrenched primes; the very Google engineers who signed the 2018 letter that killed the company’s Project Maven contract were the supply that Anduril’s mission was positioned to absorb, turning a competitor’s moral squeamishness into its own recruiting funnel. Anthropic is the clearest case in AI: it was founded in 2021 by people who left OpenAI over safety disagreements, and its mission — building AI that is safe and beneficial as capability scales — is precisely why a specific and highly sought-after class of researcher chooses it over better-funded rivals. The mission does double duty: it recruits the safety-motivated frontier talent that is the actual bottleneck, and it functions as brand and trust in the market. The mission is the moat and the go-to-market.

The failure mode is the fake mission — mission-washing a company whose real driver is the exit — which the best people detect instantly and which evaporates the moment the market turns, taking your talent with it. WeWork wrapped a commercial-real-estate arbitrage in the language of “elevating the world’s consciousness,” and when the numbers cracked, there was no genuine purpose underneath to hold anyone; the mission was marketing, and marketing doesn’t survive a down round. Put a number on it: a company that raised at a $47 billion valuation on the strength of a purpose narrative saw that valuation collapse below $10 billion in weeks once the S-1 exposed the economics, and the senior talent that had been recruited on the vision walked, because there was no real cause to stay for once the equity story died. The counter-lesson is that a real mission is costly and constraining by design — it makes you turn down money, customers, and shortcuts that betray it, and that cost is exactly what makes it credible and therefore defensible. Anthropic publishing safety research that helps its competitors, or turning down deployments that violate its stated principles, is the credibility-buying cost in action: a fake mission never pays it, which is precisely how the frontier talent tells the difference. The takeaway: build a company whose purpose you would be genuinely proud to have spent a decade on, because you will spend a decade on it, and in a race this hard the teams that endure are the ones that were never only in it for the money.

Conclusion — the meta-mechanic behind all 32

Read all thirty-two breakdowns and a single shape keeps repeating under the specifics. Strip away the particular company, the particular market, the particular year, and every principle in this report is a variation on one move: find the thing the free, abundant input can’t give you — and own it.

The free input changes by decade. In the last cycle it was the marginal cost of software distribution (the internet drove it to zero, and the winners were the companies that owned the network effect, the data, or the brand that distribution alone couldn’t manufacture). In this cycle the free input is intelligence itself. The mechanic is identical. OpenAI can write your code, but it can’t hand you the proprietary exhaust of your product running in ten thousand real deployments. Any competitor can wrap the same model, but they can’t inherit the system of record you’ve become or absorb the liability your customer has learned to trust you with. The model is the tide; it lifts every boat, which is exactly why it decides no race.

That is why the sixteen principles about what to build and where the moat lives matter more than the sixteen about how. Craft and speed and taste are necessary — a sloppy team loses even with a great position — but they are not sufficient, and they are not durable. You can out-execute someone for a year; you cannot out-execute them forever. Position is what compounds. The companies in this report that will still be standing in 2035 are not the ones that had the best model or shipped the fastest in 2026. They are the ones that used their speed and their model to dig a hole no amount of speed or model access could later fill: a data flywheel, a regulatory moat, a distribution lock, a system of record, a brand of trust, a mission that kept the right people in the building.

There is a hierarchy hidden in the ordering, too. The principles at the start — build the worker, aim at payroll, take the boring job — are about choosing a game you can win. The middle — own the loop, own the data, own the record — are about building a position that lasts. The end — time the wedge, be contrarian, build for the cheap future, make the mission the moat — are about having the judgment and the endurance to stay in the game long enough for the position to pay off. Most founders obsess over the first set, neglect the second, and never think about the third until it’s too late. Reverse the emphasis. The opportunity is the easy part; almost everyone can see the same waves. The durable position and the decade of endurance are where the actual companies are won and lost.

And here is the uncomfortable through-line for anyone who came to this report looking for the hot thing to build: the hot thing is a trap. By the time a topic is obviously the future — by the time it’s on every deck and in every headline — the intelligence to build it is free, the opportunity is consensus, and the only thing left to compete on is the position, which the early, contrarian, unglamorous teams already took while everyone else was still admiring the demo. The winners of this age will not be the people who saw AI coming. Everyone saw AI coming. The winners will be the people who, while the crowd was mesmerized by the free intelligence, quietly built the loop the free intelligence couldn’t touch — and then let the tide lift them past everyone who mistook the tide for the boat.

That is the whole game. Thirty-two principles, one mechanic: intelligence is becoming free, so build your company out of everything that isn’t.

1. Intelligence became a raw material. For the first time, cognition — reading, writing, reasoning,

   deciding, coding, designing — can be summoned on demand at a marginal cost that falls roughly an order of
   magnitude every year. Software used to help people do knowledge work. Now software can do the work.
   That single change moves the addressable market of technology from the world’s IT budgets (a few
   trillion dollars) to the world’s payroll (tens of trillions). The prize is 10× bigger than the one the
   cloud generation chased.

2. The physical world got a brain. The same transformer architecture that solved language is now solving

   perception and action. Robots that learn instead of being programmed, cars that finally drive themselves,
   drones that coordinate, factories that run lights-out — the atoms are catching up to the bits. The bottleneck
   is no longer whether a machine can do a physical task; it’s data, reliability, and cost.

3. The old certainties broke. Cheap energy, frictionless globalization, and stable geopolitics — the

   quiet assumptions under the last cycle — are gone. Electricity is now the binding constraint on
   intelligence. Supply chains are being re-shored and re-armed. Money itself is being re-platformed onto new
   rails. Scarcity and sovereignty are back, and scarcity is where fortunes are made.

Stack these three shifts and you get the defining feature of this era: the cost of creating things collapses
while the value of trust, energy, data, and physical execution soars. That asymmetry is the engine under
every one of the 48 topics that follow.

Why “topics” and not “predictions”

Anyone can list technologies. The point of this report is to be useful to a builder — so each topic is
framed not as a prediction but as a buildable opening. For every one of the 48 we answer the same five
questions, because these are the five a founder actually needs:

• The shift — what is actually changing, stated plainly.

• Why now — the specific unlock in the last ~24 months that makes this the right moment, not five years
  ago and not five years from now. Timing is the whole game; a great idea at the wrong time is a graveyard.

• Why it’s a startup goldmine — the size of the pool, what incumbent or manual process it drains, the
  pricing/margin unlock, and — critically — what stays defensible after the obvious version gets copied.

• Where the opening is — the sharp wedge. Not “build in AI,” but the specific narrow, painful, valuable
  beachhead a small team can take and expand from.

• The signal — real companies, many of them in this very library’s Past Unicorns and Hundred Million Corns folders, that prove the topic is already compounding.

The seven meta-patterns that run through all 48

Read the 48 topics and the same deep structures keep surfacing. If you internalize these seven, you can
evaluate any opportunity — including ones not on this list:

1. Value is priced as outcomes, not access. The defining commercial move of this cycle is charging for
the work delivered — a percentage of the labor replaced, the fraud prevented, the megawatt delivered —
rather than a monthly seat. A SaaS tool that “helps” with a $6,000/month job caps out at $50/seat. An agent
that does that job can charge $2,000/month and still be a bargain. The topics that let you price on outcomes
are the ones that mint the biggest companies.

2. The value migrates down the stack, then back up. Early in every wave the money is in
infrastructure — the models, the rails, the launch vehicles, the picks and shovels. As the wave matures it
moves to applications and the system of record. The winning move is to enter at the layer that is
underbuilt right now and ride it up. Several of these 48 are infrastructure plays that are underbuilt today;
several are application plays where the infrastructure just got cheap enough.

3. The moat is the loop the incumbent can’t cross. In a world where the obvious product is copied in
weeks, defensibility comes from three places: proprietary data generated by your own operations, the
liability and trust the customer will not take on themselves, and becoming the system of record.
Every durable company on this list owns at least one.

4. The best wedge is a boring, expensive, hated job in a big industry. The narrower and more painful the
beachhead, the better. “AI for legal” loses; “an agent that drafts and files the personal-injury demand
letter” wins. The unglamorous, high-friction, regulation-heavy corners are exactly where incumbents are weak
and where a focused team can plant a flag.

5. Regulation and scarcity are tailwinds, not obstacles. Compliance load (DORA, NIS2, the AI Act),
energy scarcity, supply-chain sovereignty, security clearances — these look like walls, but a wall you can
climb becomes a moat once you’re on the other side. Many of the richest topics here are created by
constraints.

6. Verification is the shadow of automation. As AI generates action, code, and content at machine speed,
the scarce resource becomes proof that it was done right. Every wave of automation creates an equal-and-
opposite wave of demand for trust, identity, evals, provenance, and compliance. Whole categories on this list
exist only because the others exist.

7. Distribution is destiny. Cheap creation means the bottleneck is no longer building — it’s getting
found, trusted, and adopted. The topics where a founder can bolt onto an existing distribution loop (a
developer’s editor, a payment flow, a health system’s EHR, a government’s procurement rail) beat the ones
that require building an audience from zero.

How to read this report

The 48 topics are grouped into six clusters:

• Cluster 1 — AI Foundations & Agents (topics 1–8): the intelligence layer itself.

• Cluster 2 — AI Applications & Knowledge Work (9–16): AI doing the world’s expensive text-and-decision jobs.

• Cluster 3 — Physical & Frontier Tech (17–24): robots, mobility, space, and the deep-tech frontier.

• Cluster 4 — Energy, Climate & Bio (25–32): the atoms — power, materials, and engineered biology.

• Cluster 5 — Money, Fintech & Trust (33–40): programmable money and the verification layer.

• Cluster 6 — Platforms, Infrastructure & New Models (41–48): the connective tissue and the new company shapes.

No single founder should chase all six. The clusters are ordered from the softest, fastest-moving,
lowest-capital opportunities (AI software) to the hardest, most capital-intensive, most defensible ones
(energy, bio, deep tech). Where you play should be a function of who you are — your unfair advantages, your
tolerance for capital and time, and the distribution you can credibly reach. The conclusion
draws the through-lines back together and offers a way to choose.

A note on honesty: not all 48 are equally ripe, and several are partly hype. Throughout, the “why now” and
“where the opening is” sections try to separate the durable from the frothy — because the difference between a
trend and a timed trend is the difference between a unicorn and a cautionary tale. Let’s begin.

Cluster 1 — AI Foundations & Agents

The models are commoditizing; the value is migrating to the layer that turns raw intelligence into reliable, autonomous work. This cluster covers the eight foundational shifts — from goal-driven agents and the compute that runs them, down to memory, orchestration, and the sovereignty fight over who owns the weights — that together form the substrate every other startup in this report will stand on.

1. Agentic AI (goal-driven autonomous agents)

The shift: Software stops waiting for prompts and starts pursuing goals. Agentic AI is the move from a chatbot that answers a question to a system you hand an objective — “reconcile last month’s invoices,” “ship this feature,” “book the whole trip” — that then plans, calls tools, observes results, and loops until the goal is met. The unit of interaction is no longer a message; it’s a completed task.

Why now: Three things converged inside 24 months. Models crossed the reliability threshold on multi-step tool use — function calling became structured and dependable rather than a party trick. Context windows blew past the point where a full task history, codebase, or document set fits in working memory. And the emergence of standard tool protocols (MCP and its descendants) meant an agent could reach into arbitrary systems without a bespoke integration for each. Reliability on 10-step chains went from “amusing demo” to “runs unattended overnight.”

Why it’s a startup goldmine: This is the largest TAM in software because it isn’t software’s TAM — it’s labor’s. Agentic systems don’t compete with the $650B SaaS market; they compete with the tens of trillions in global services and payroll. The margin unlock is brutal for incumbents and beautiful for founders: a task that cost a $60/hour analyst now costs cents of inference. Defensibility comes not from the model — everyone rents the same frontier — but from the execution scaffolding: the eval harness that proves the agent is right, the recovery logic when it’s wrong, and the proprietary workflow data that makes your loop converge faster than a generic one.

Where the opening is: Pick a domain where the task is high-frequency, verifiable, and currently done by expensive humans — then own the last mile of reliability, not the model. The wedge is trust: be the agent a CFO or a hospital will actually let run unsupervised, because you’ve solved observability and rollback, not because your demo is flashy.

Signal — startups & scaleups to watch:

• OpenAI — Operator & agentic o-series

• Anthropic — Claude computer use, Agent SDK

• Google DeepMind — Gemini agents, Project Mariner

• Microsoft — Copilot agents

• Cognition — Devin autonomous engineer

• Sierra — enterprise conversational agents

• Adept — action models for workflows

• Imbue — robust reasoning agents

• Manus — general autonomous agent

• Genspark — autonomous super-agent

• H Company — computer-use web agents

• Reflection AI — autonomous coding agents

• Factory — autonomous software droids

• Lindy — no-code AI assistants

• MultiOn — web-action agents

• Relevance AI — AI workforce builder

• Emergence AI — autonomous web agents

• Ema — universal AI employee

• Rabbit — consumer action agent

• CrewAI — agent-crew framework

• xAI — Grok agents

2. Vertical AI agents (labor replacement, priced as work not seats)

The shift: The most important pricing revolution since SaaS: charging for outcomes, not access. A vertical AI agent goes deep into one job function — a legal associate, an SDR, a claims adjuster, a medical coder — and is sold not as a tool that a human uses but as the worker itself, billed per resolved ticket, per booked meeting, per adjudicated claim.

Why now: Horizontal agents proved capability; verticals prove reliability. The unlock was realizing that a narrow domain lets you build the thing generic agents lack — a tight eval loop, domain-specific guardrails, and integrations into the ten systems that job actually touches. Once you can guarantee an SDR agent books meetings at human quality, the customer stops asking “how many seats?” and starts asking “how much per meeting?” That reframing is worth a 10x expansion in contract value.

Why it’s a startup goldmine: Seat-based SaaS caps you at the number of humans in a role. Work-based pricing uncaps you at the total spend on that role — you can capture 30-50% of a fully-loaded salary and still be a bargain. A support SaaS tool charges $100/agent/month; a support agent that resolves tickets can charge $1-2 per resolution and address the entire support payroll. Gross margins run 70-90% because inference is the only real COGS. Defensibility is the workflow moat: the integrations, the domain evals, and the feedback data from millions of resolved cases that a horizontal player will never accumulate in your niche.

Where the opening is: Find a role with (a) a clear success metric, (b) painful labor cost, and (c) a system-of-record you can plug into, then price on the metric from day one. Don’t sell “AI for X”; sell the completed unit of X-work with an SLA.

Signal — startups & scaleups to watch:

• Sierra — customer-service agents

• Harvey — legal copilot

• Decagon — customer-support agents

• 11x — AI sales reps

• Artisan — AI SDR “Ava”

• Abridge — clinical documentation

• Ambience Healthcare — medical scribe

• Nabla — clinical note assistant

• Suki — voice clinical assistant

• Hippocratic AI — healthcare voice agents

• Cresta — contact-center AI

• Ada — customer-service automation

• Parloa — contact-center agents

• Observe.AI — contact-center intelligence

• EvenUp — injury-claim drafting

• Eve — plaintiff-firm legal AI

• Norm Ai — regulatory compliance agents

• Rogo — financial analyst AI

• Hebbia — finance research agents

• Tennr — healthcare referral automation

• EliseAI — housing & property agents

• DevRev — support & product agents

3. AI inference infrastructure & the compute layer

The shift: The center of gravity in AI economics is moving from training to inference. Training a frontier model is a one-time capital event; running billions of agentic calls a day is a perpetual operating cost — and that recurring spend is where the durable, high-volume business lives. Whoever makes tokens cheaper, faster, and more reliable to serve owns the toll road under the entire agent economy.

Why now: Agents changed the math. A chatbot makes one call per human message; an agentic workflow makes dozens or hundreds of calls per task, many of them reasoning-heavy. Inference demand is exploding super-linearly with adoption, and it’s increasingly latency- and cost-sensitive because agents run in loops. Meanwhile the GPU bottleneck, custom silicon (TPUs, Trainium, Groq/Cerebras-class accelerators), and techniques like speculative decoding, quantization, and KV-cache optimization opened real headroom for specialists to beat the hyperscalers on price-per-token.

Why it’s a startup goldmine: This is a market measured in hundreds of billions of annual compute spend, and it’s structurally recurring — you get paid every time anyone’s agent thinks. The margin unlock is efficiency arbitrage: a 3-5x improvement in tokens-per-dollar through better batching, routing, and hardware utilization flows straight to gross margin or to a price advantage that wins share. Defensibility lives in the systems software — the inference engine, the scheduler, the model-routing layer — and in hardware relationships that let you serve at a cost basis competitors can’t touch.

Where the opening is: Don’t build a foundation model; build the fastest, cheapest, most reliable way to serve everyone else’s. The sharp wedges are inference-optimized serving (own latency-critical workloads), intelligent model routing (send each call to the cheapest model that can handle it), and GPU orchestration for the mid-market that can’t get hyperscaler allocation.

Signal — startups & scaleups to watch:

• Together AI — inference & training cloud

• Fireworks AI — fast inference platform

• Baseten — model serving

• Modal — serverless GPU compute

• Replicate — run models via API

• Fal — fast generative inference

• DeepInfra — low-cost model API

• Anyscale — Ray-based scaling

• Groq — LPU inference chips

• Cerebras — wafer-scale AI chips

• SambaNova — AI chip & platform

• Etched — transformer ASIC

• Tenstorrent — RISC-V AI chips

• d-Matrix — in-memory inference chips

• CoreWeave — GPU cloud

• Crusoe — AI-focused cloud

• Lambda — GPU cloud

• Nebius — AI cloud platform

• RunPod — GPU rental cloud

• Vast.ai — GPU marketplace

• Predibase — fine-tune & serve

4. Small, efficient & on-device models

The shift: Not everything needs a frontier brain. A large share of real-world AI tasks — classification, extraction, routing, structured generation, function-call selection — can be handled by a model 1/100th the size, run locally, for a fraction of the cost and latency. The industry is discovering that the right question isn’t “how big can we go?” but “how small can we get away with?”

Why now: Distillation, quantization, and better training data made 1-8B parameter models shockingly capable — a well-tuned small model now matches a 2023 frontier model on narrow tasks. Simultaneously, on-device silicon (Apple Neural Engine, NPUs in every new laptop and phone) crossed the threshold to run these models locally in real time. The result: a genuine tier of intelligence that is free at the margin, private by default, and works offline.

Why it’s a startup goldmine: The economics invert the whole stack. On-device inference has zero marginal compute cost to the vendor, which enables entirely new price points and business models — including ones the API-metered giants can’t match. The disrupted incumbents are the cloud-inference bills themselves. Defensibility is the hard engineering of squeezing quality into constrained hardware and the vertically-tuned small models that outperform general giants on a specific task while costing nothing to run. Privacy and latency are the durable pull: data that never leaves the device is a feature no cloud model can offer.

Where the opening is: Own a task class where privacy, latency, or offline operation is non-negotiable — healthcare, defense, industrial, personal assistants — and ship a small model that runs on the user’s hardware. Or build the tooling layer: the distillation, fine-tuning, and deployment pipeline that lets everyone else make their own small models.

Signal — startups & scaleups to watch:

• Mistral AI — open small models

• Meta Llama — open Llama models

• Microsoft — Phi small models

• Apple — on-device foundation models

• Hugging Face — open model hub

• Ollama — run local models

• LM Studio — desktop local LLMs

• Liquid AI — efficient LFM models

• Arcee AI — small enterprise models

• Nomic AI — open embeddings & models

• Nexa AI — on-device model runtime

• Cartesia — on-device voice models

• Unsloth — fast local fine-tuning

• Edge Impulse — edge ML platform

• Predibase — small fine-tuned models

• Together AI — fine-tuning stack

• Fireworks AI — small-model serving

• Qualcomm — on-device AI silicon

5. Reasoning models & world models

The shift: From models that pattern-match to models that think — and from models that predict text to models that predict how the world behaves. Reasoning models spend inference-time compute to deliberate, plan, and self-correct before answering, cracking problems that instant next-token prediction never could. World models go further: they learn a predictive simulation of physical or environmental dynamics, letting an agent imagine consequences before acting.

Why now: The reasoning unlock was test-time compute — the discovery that letting a model “think longer” (chain-of-thought at scale, reinforced by verifiable rewards) buys a new scaling axis independent of parameter count. This is why math, code, and multi-step planning capabilities leapt in 2024-2025. World models rode the wave of video and simulation training — models that watch enough of reality start to internalize physics, enabling robotics and autonomous systems to plan in a learned simulator rather than the expensive real world.

Why it’s a startup goldmine: Reasoning is what makes agents trustworthy on hard, high-stakes work — the difference between an agent that drafts a contract and one that can actually reason about liability. That reliability is what unlocks the highest-value verticals (law, finance, engineering, science). World models are the missing piece for the entire robotics and autonomy TAM — a multi-trillion-dollar prize gated on machines that can predict outcomes. Defensibility is in the verifiable-reward training loops, the domain-specific reasoning data, and, for world models, proprietary simulation and sensor data.

Where the opening is: For reasoning, build the verification and reward infrastructure that makes reasoning trainable in a domain — the “gym” for a vertical. For world models, own a physical domain (warehouse robotics, autonomous machines, drug interaction) where a learned simulator collapses the cost of trial and error.

Signal — startups & scaleups to watch:

• OpenAI — o-series reasoning

• Anthropic — extended thinking

• DeepSeek — open reasoning models

• Google DeepMind — Gemini thinking, Genie

• xAI — Grok reasoning

• Mistral AI — Magistral reasoning

• Moonshot AI — Kimi reasoning models

• Z.ai — GLM reasoning models

• Physical Intelligence — robot foundation models

• Skild AI — robot foundation model

• Wayve — driving world models

• Waabi — autonomous-driving simulation

• World Labs — large world models

• Decart — real-time world models

• Runway — general world models

• Nvidia — Cosmos world models

• Figure — humanoid robot intelligence

• 1X — humanoid robots

6. Multi-agent systems & orchestration

The shift: One agent is a worker; many coordinated agents are an organization. Complex goals decompose better when specialized agents — a planner, a researcher, a coder, a critic — collaborate, hand off, and check each other’s work, orchestrated by a layer that routes tasks, manages state, and resolves conflicts. The frontier is no longer a smarter single agent but a better-run team of them.

Why now: As soon as agents could reliably complete single tasks, the ceiling became coordination. Practitioners found that a critic agent reviewing a worker’s output, or parallel agents exploring different approaches, beat any monolithic prompt. The tooling to make this practical — durable execution frameworks, agent-to-agent protocols, shared memory and message buses — matured just as the need became acute. Orchestration turned out to be the hard, valuable, and under-built part of the stack.

Why it’s a startup goldmine: Orchestration is the operating system of the agent economy, and OS layers become deeply entrenched, high-switching-cost platforms. The market is every company that wants to run more than one agent — which will be every company. The value unlock is reliability at scale: multi-agent designs with checks and redundancy are how you get from 80% task success (a demo) to 99% (a product). Defensibility is the platform lock-in — once a company builds its agent workflows, evals, and observability on your orchestration layer, ripping it out means rebuilding its digital workforce.

Where the opening is: Build the control plane — the durable orchestration, state management, observability, and inter-agent protocol layer that turns a pile of agents into a governable system. The sharpest wedge is reliability and debuggability: be the layer engineers trust to run agent fleets in production, with tracing, replay, and guardrails they can audit.

Signal — startups & scaleups to watch:

• LangChain — LangGraph orchestration

• LlamaIndex — data agents framework

• CrewAI — multi-agent crews

• Microsoft — AutoGen framework

• Temporal — durable agent execution

• Inngest — durable workflow engine

• Prefect — orchestration framework

• Orkes — Conductor orchestration

• Restack — agent backend framework

• E2B — agent code sandboxes

• Composio — agent tool integrations

• AutoGPT — autonomous agent platform

• Sema4.ai — enterprise agent platform

• Relevance AI — agent workforce

• Griptape — agent framework

• Vellum — agent dev platform

• Stack AI — no-code agent builder

• Lyzr — enterprise agent SDK

• Gumloop — agent workflow automation

• Dify — LLM app orchestration

• Flowise — visual agent builder

• n8n — workflow automation

7. AI memory & context engineering

The shift: Intelligence without memory is a brilliant amnesiac. The next unlock isn’t a smarter model but one that remembers — that accumulates knowledge about your company, your preferences, and its own past actions, and surfaces exactly the right context at the right moment. Context engineering — deciding what an agent should know at each step — is emerging as the discipline that most determines whether an agent is useful or hopeless.

Why now: Bigger context windows helped but also exposed the real problem: more context isn’t better context. Stuffing a million tokens degrades reasoning and cost. The field pivoted from “retrieve everything” (naive RAG) to engineered memory — structured long-term stores, hierarchical summarization, learned relevance, and retrieval that understands the task. Agents that run for hours or persist across sessions made memory non-optional: an agent that forgets what it did five steps ago can’t be trusted with anything real.

Why it’s a startup goldmine: Memory is the deepest moat in AI. A model is rentable and swappable; the accumulated context about a user or an enterprise is not — it’s the switching cost that turns a tool into a system of record. Whoever owns the memory layer owns the relationship. The market is every agent and every AI application, all of which need somewhere to remember. The margin story is stickiness: memory compounds, so the product gets better the longer a customer stays, which crushes churn. Defensibility is the proprietary context graph itself — the more it holds, the more painful it is to leave.

Where the opening is: Build the memory layer as infrastructure — a persistent, queryable, permission-aware store that any agent can plug into — or own the context graph inside a specific enterprise so deeply that switching means starting over. The wedge is being the place where an organization’s institutional knowledge accretes.

Signal — startups & scaleups to watch:

• Mem0 — agent memory layer

• Letta — stateful agents (MemGPT)

• Zep — agent memory service

• Supermemory — memory API

• Cognee — agent memory graphs

• Graphlit — context platform

• Pinecone — vector database

• Chroma — open-source vector DB

• Weaviate — vector database

• Qdrant — vector search engine

• Zilliz — Milvus vector database

• LanceDB — embedded vector DB

• Turbopuffer — object-storage search

• Marqo — vector search engine

• Vectara — RAG-as-a-service

• Contextual AI — enterprise RAG

• LlamaIndex — retrieval framework

• Unstructured — data prep for LLMs

• Ragie — managed RAG API

• Redis — vector & memory store

• MongoDB — vector search DB

• Neo4j — knowledge graphs

8. Open-weight & sovereign AI models

The shift: Not everyone will — or can — run their intelligence on a handful of American closed APIs. A parallel ecosystem of open-weight models you can download, inspect, fine-tune, and self-host is becoming the foundation for anyone who needs control: nations building sovereign capability, enterprises that can’t send data to a third party, and developers who want to own their stack. Weights are becoming a strategic asset, like a national grid.

Why now: Open-weight models closed the gap. What was a two-year lag behind the frontier compressed to months, with releases from Meta, Mistral, DeepSeek, and Qwen reaching capability tiers that are more than good enough for the vast majority of production workloads. Simultaneously, geopolitics turned AI into infrastructure of national interest — governments now treat dependence on a foreign closed model the way they treat dependence on foreign energy. The combination of “good enough and free to run” plus “strategically necessary to control” created a real market overnight.

Why it’s a startup goldmine: The disrupted incumbent is the closed-API oligopoly and its pricing power. The TAM is every regulated industry (healthcare, defense, finance, government) and every nation that wants its own AI — a category that barely existed two years ago and is now a line item in national budgets. The margin unlock for builders is owning the deployment layer: sovereign clouds, on-prem fine-tuning, compliance and localization services that closed providers structurally cannot offer. Defensibility is trust, data residency, and the integration depth of running inside a customer’s own walls.

Where the opening is: Be the company that operationalizes open weights for those who need sovereignty — the sovereign-AI stack for a nation, the compliant self-hosted deployment for a regulated enterprise, or the fine-tuning and localization layer that turns a generic open model into a domain- or language-specific asset. The wedge is control: sell the customers who legally or geopolitically cannot use a closed API.

Signal — startups & scaleups to watch:

• Mistral AI — European open models

• Meta Llama — open Llama family

• DeepSeek — Chinese open frontier

• Qwen — Alibaba open models

• Z.ai — Zhipu GLM open models

• Moonshot AI — Kimi open models

• 01.AI — Yi open models

• Cohere — enterprise open weights

• Nous Research — open fine-tunes

• Allen Institute for AI — fully-open OLMo models

• EleutherAI — open research models

• Prime Intellect — decentralized open training

• Reka AI — multimodal models

• Poolside — sovereign coding models

• Black Forest Labs — open image models (Flux)

• Aleph Alpha — German sovereign AI

• LightOn — European enterprise models

• TII — Falcon open models (UAE)

• G42 — Gulf sovereign AI

• Sarvam AI — Indian sovereign models

• Krutrim — Indian AI stack

• AI Singapore — SEA-LION models

• Together AI — open-model cloud

Cluster 2 — AI Applications & Knowledge Work

This is where the models cash out. The frontier labs built the engine; the companies below are the ones bolting it to a specific, expensive, hated job and charging for the outcome — and they are the fastest-scaling software businesses in history.

9. AI software engineering / coding agents

The shift: from autocomplete to a colleague that ships. Coding is moving from “the IDE suggests the next line” to “you hand a ticket to an agent and it opens a reviewed pull request.” The engineer becomes an orchestrator and reviewer of machine labour, not the typist of every keystroke.

Why now: code is the ideal agent substrate — it has a compiler, a test suite, and a linter, which means the agent gets a hard, automatic verification signal on every attempt. That closes the loop that every other domain is missing. Add context windows large enough to hold a real repo, cheap enough inference to run hundreds of speculative attempts, and the arrival of asynchronous background agents in 2025, and the reliability crossed the line from toy to load-bearing.

Why it’s a startup goldmine: global developer spend is a trillion-dollar pool of salaries, and this is the one category where AI already visibly moves the needle on output. Cursor (Anysphere) went from zero to a reported $500M+ ARR faster than any SaaS company ever, which tells you the willingness to pay is nearly unbounded. The pricing unlock is that you can charge per seat and per task — and eventually meter the work itself, capturing a slice of a $150k engineer rather than a $20 tool budget; the ceiling isn’t the IT line item any more, it’s the engineering payroll. Defensibility is thin at the model layer, which is exactly why the labs keep leapfrogging each other, but it’s real at the workflow layer: the harness that manages context across a sprawling repo, runs the test-fix loop, integrates with the CI/CD and ticketing stack, and — hardest of all — earns the organizational trust to merge without a human is where the moat lives. Distribution matters too: the tool developers already have open is the one they’ll let write their code.

Where the opening is: own the parts of the SDLC the incumbents ignore — the agent that does migrations, dependency upgrades, flaky-test triage, incident response, security-patching, or brownfield legacy modernization end-to-end. The wedge is the unglamorous maintenance backlog every CTO wants to clear but can’t staff; it is a genuine budget line, it has a crisp definition of done, and the incumbents are too busy chasing greenfield autocomplete to want it. There’s a second wedge underneath: the coding agent aimed at non-engineers — the “prompt-to-app” builders letting a PM or a founder ship a real internal tool — which quietly expands the TAM from developers to everyone who ever filed a ticket with IT.

Signal — startups & scaleups to watch:

• Cursor (Anysphere) — runaway AI-native IDE

• Cognition (Devin) — autonomous coding agent

• Windsurf — agentic coding IDE

• GitHub Copilot — incumbent pair programmer

• Claude Code — terminal coding agent

• OpenAI Codex — lab’s coding agent

• Poolside — frontier code models

• Magic — long-context code models

• Lovable — prompt-to-app builder

• Replit — cloud IDE plus agent

• Bolt (StackBlitz) — prompt-to-web-app

• Vercel v0 — generative UI builder

• Sourcegraph (Amp) — code search and agent

• Tabnine — enterprise code assistant

• Augment Code — enterprise coding agent

• Factory — autonomous dev droids

• Codegen — software-engineering agents

• Qodo — code-integrity and test agents

• Continue — open-source IDE assistant

• Zencoder — enterprise coding agents

• Warp — agentic terminal

• Aider — open-source CLI coding

• Tessl — spec-driven AI software

10. Generative media (video, voice, music, image, 3D)

The shift: the marginal cost of professional-grade content is collapsing to zero. Voice, image, video, music, and now navigable 3D worlds are becoming things you type into existence rather than shoot, record, or hire a studio to make.

Why now: generation quality crossed the “good enough to ship commercially” line in 2024–2025. Video went from uncanny two-second clips to coherent, direction-following minutes; voice became indistinguishable and real-time; music generation reached radio quality. Diffusion and transformer video models plus cheap GPU inference mean a marketer, game studio, or solo creator can produce in an afternoon what used to take a crew a month.

Why it’s a startup goldmine: the addressable market is the entire creative-services and advertising economy — hundreds of billions in production budgets — plus a long tail of content that was never economical to make at all, from personalized ads to indie-game assets to localized training videos. Margins are software margins once you own the model, and demand is voracious because content is the one input every business needs continuously. The disruption target is stock media, dubbing houses, ad agencies, voiceover talent, and eventually parts of film and games. The catch, and it’s the whole game, is defensibility: raw model quality commoditizes within months, and there is always a free open-weight checkpoint nipping at the leader’s heels. Winners own a proprietary distribution loop, a professional workflow, or a rights/data moat — not just a good model — which is why the smart money in this wave bets on the companies wrapping generation in an editor, a pipeline, or a licensing business rather than the ones racing on raw fidelity alone.

Where the opening is: go vertical and own the workflow. The dubbing-and-localization pipeline for studios, the ad-creative engine wired into ad accounts with closed-loop performance feedback, the game-asset pipeline, the enterprise avatar/training-video platform. Boring, workflow-locked, contract-backed beats another general text-to-video toy. The other durable position is the rights layer — the company that licenses real artists’ voices and likenesses and pays them, which turns the biggest legal liability of the category into a moat and a distribution partnership. Whoever cleanly solves consent and provenance for synthetic media sells a compliance rail to everyone else in the wave.

Signal — startups & scaleups to watch:

• ElevenLabs — voice and audio platform

• Runway — AI video generation

• Pika — AI video generation

• Suno — AI music generation

• Udio — AI music generation

• Synthesia — AI avatar video

• HeyGen — AI avatar video

• World Labs — 3D world models

• Krea — creative generation workflow

• Freepik — creator asset platform

• Luma AI — video and 3D generation

• Midjourney — image generation

• Black Forest Labs — Flux image models

• Stability AI — open image models

• Ideogram — text-in-image generation

• Leonardo AI — image and asset generation

• Cartesia — real-time voice models

• Higgsfield — cinematic AI video

• Descript — AI audio/video editing

• Captions — AI video creation

• Hedra — character video generation

• Recraft — design and graphics generation

• Kling AI — AI video model

• Resemble AI — voice cloning

• Photoroom — AI image editing

11. AI in clinical care (ambient scribing, care ops)

The shift: the computer stops being the thing between the doctor and the patient. Ambient AI listens to the visit and writes the note, the order, the referral, and the billing code — dissolving the documentation burden that drives half of physician burnout.

Why now: speech recognition finally handles cross-talk, accents, and medical jargon in noisy rooms, and LLMs turn a messy transcript into a structured, billable, defensible clinical note. The ROI is immediate and measurable — clinician time saved, more patients seen, cleaner coding — so hospital systems that never move fast are signing enterprise deals in months, not years. This is the AI use case healthcare actually trusts because a human still signs off.

Why it’s a startup goldmine: US healthcare is a $4.5T system whose administrative overhead is a national scandal; documentation and revenue-cycle work alone is a massive line item. Ambient scribing is the beachhead, but the real prize is expanding into care operations — coding, prior authorization, referral management, quality reporting. Pricing is per-clinician-per-month with land-and-expand into the whole revenue cycle. Defensibility comes from EHR integration depth (Epic/Cerner), health-system trust, clinical accuracy data, and the compliance moat that keeps generic chatbots out.

Where the opening is: move past the note into the money. The agent that closes the loop on coding and prior authorization — the workflows that literally determine whether a hospital gets paid — is stickier and higher-value than transcription, which is racing toward commodity as the labs offer scribing for free. There is a parallel opening on the patient side: the ambient system for nursing, home health, and behavioral care, where documentation burden is just as brutal but the incumbents have barely arrived. Land on the ambient mic, expand across the entire revenue cycle, and you become the operating layer of the clinic rather than a feature.

Signal — startups & scaleups to watch:

• Abridge — enterprise ambient scribing

• Ambience Healthcare — scribing plus coding

• Suki — AI clinical assistant

• Nuance (Microsoft DAX) — incumbent ambient scribe

• OpenEvidence — clinical decision support

• Commure — health-system operating layer

• Nabla — ambient clinical notes

• DeepScribe — ambient medical scribe

• Corti — clinical conversation AI

• Heidi Health — ambient scribe

• Freed — AI scribe for clinicians

• Augmedix — ambient documentation

• Tortus — clinical AI assistant

• Hippocratic AI — patient-facing care agents

• Navina — AI clinical copilot

• Notable — healthcare workflow automation

• Innovaccer — health data and AI

• Cohere Health — prior-authorization AI

• CodaMetrix — autonomous medical coding

• Rad AI — radiology reporting AI

• Aidoc — radiology imaging AI

• Viz.ai — care coordination AI

• Ellipsis Health — vocal-biomarker behavioral AI

12. AI drug discovery & techbio

The shift: biology becomes a design problem. Instead of screening millions of compounds by brute force, models propose molecules, proteins, and antibodies that are likely to work — turning the wet lab from a search engine into a fabrication line for pre-designed hypotheses.

Why now: AlphaFold was biology’s GPT moment, and the generation of protein-design and molecular models that followed can now generate binders and structures that hold up experimentally. Simultaneously, lab automation and cheap sequencing/synthesis close the design–build–test–learn loop fast enough that the AI actually learns from its own experiments. The bottleneck shifts from “can we imagine this molecule” to “how fast can we test and feed the data back.”

Why it’s a startup goldmine: pharma R&D is a $250B+ annual spend defined by a brutal statistic — most drug candidates fail, and each failure costs years and hundreds of millions. Even a modest improvement in hit rate or timeline is worth a fortune, which is why the platform deals with big pharma are enormous. The margin unlock is owning IP on the molecules themselves, not just selling software. Defensibility is the AI + wet-lab flywheel: proprietary experimental data generated in-house that no competitor and no foundation model can replicate.

Where the opening is: don’t try to be a full-stack pharma company on seed money. The sharp wedge is a specialized model-plus-data platform for a hard modality — antibody design, protein engineering, delivery, or a specific disease area — sold to pharma as a discovery engine while keeping equity or royalties in the assets it generates. The lean-founder version is even narrower: sell the design tool to the hundreds of biotechs and academic labs that can’t build their own model, generating proprietary usage data from every customer’s experiments. That data flywheel, not the model architecture, is what compounds into a moat while the underlying models commoditize.

Signal — startups & scaleups to watch:

• Xaira Therapeutics — model-native drug discovery

• Isomorphic Labs — DeepMind drug-discovery spinout

• EvolutionaryScale — protein language models

• Chai Discovery — molecular structure models

• Cradle — protein-engineering platform

• Generate Biomedicines — generative protein therapeutics

• Recursion — AI drug-discovery platform

• Insilico Medicine — generative drug discovery

• Genesis Therapeutics — molecular AI models

• Iambic Therapeutics — AI drug design

• Absci — generative antibody design

• Profluent — protein-design AI

• Latent Labs — generative protein design

• Basecamp Research — biodiversity data plus AI

• Enveda — AI natural-product drugs

• Bioptimus — biology foundation model

• Nabla Bio — AI antibody design

• Charm Therapeutics — 3D deep-learning drugs

• Atomwise — structure-based AI screening

• Deep Genomics — RNA-therapeutics AI

• Relay Therapeutics — protein-motion drug design

13. AI for science / research automation

The shift: the scientific method gets an autonomous operator. AI moves from analyzing data to running the loop — generating hypotheses, designing experiments, reading the entire literature, and in robotic labs, executing and iterating without a human at each step.

Why now: models can read and synthesize far more literature than any human researcher, reason across disciplines, and now plan multi-step experimental campaigns. Cloud labs and lab robotics make physical execution programmable. Reasoning models that can check their own work make the difference between a plausible-sounding hallucination and a real, reproducible result — the gating requirement for anything scientific.

Why it’s a startup goldmine: R&D is a multi-trillion-dollar global activity — pharma, materials, chemicals, energy, academia — and it is stunningly inefficient, bottlenecked on scarce PhD attention. Automating even the literature-review, hypothesis-generation, and experiment-design layers compresses discovery timelines that translate directly into value. This category also sells to a rare buyer: national labs, universities, and corporate R&D with real budgets and a mandate to move faster. Defensibility is proprietary experimental data and integration into the physical lab.

Where the opening is: start with the layer that has a verification signal and a clear buyer — automated literature synthesis and the “AI research assistant” for a specific field (materials, chemistry, bio), then earn the right to design and run experiments in a cloud lab. The wedge is the grunt work that burns most of a scientist’s week: reading, summarizing, coding analysis, and searching for what’s already been tried. Own that, accumulate the proprietary result data no one else has, and you graduate from tool to autonomous discovery platform — the highest-value position of all.

Signal — startups & scaleups to watch:

• FutureHouse — autonomous biology research

• Lila Sciences — scientific superintelligence lab

• Periodic Labs — AI-run physical experiments

• Emerald Cloud Lab — programmable wet lab

• Orbital Materials — AI materials discovery

• Elicit — AI research assistant

• Consensus — AI literature search

• Undermind — AI literature co-researcher

• SciSpace — research reading and writing AI

• Scite — citation-analysis AI

• ResearchRabbit — literature discovery

• Causaly — biomedical research AI

• Iris.ai — scientific research assistant

• Scholarcy — paper summarization

• Julius — AI data analysis

• Semantic Scholar (Ai2) — scholarly search engine

14. Legal & professional-services AI

The shift: the billable hour meets its solvent. Legal, tax, audit, and consulting are made of expensive, structured, text-and-judgment work — exactly what agents do — and the industry is moving from “AI helps a lawyer research faster” to “an agent drafts, reviews, and diligences the document.”

Why now: models became good enough at long-document reasoning, citation, and structured drafting to be trusted on real matters — with a professional in the loop for liability. The economics are irresistible: professional services runs on leveraging junior labor at enormous markups, and AI attacks that leverage model directly. Elite firms, historically the slowest adopters, are now buying because their clients demand it and competitors are.

Why it’s a startup goldmine: legal services alone is a ~$1T global market; add tax, audit, and consulting and you’re looking at the richest per-hour knowledge work on earth. The pricing unlock is you can charge as a fraction of the labor replaced — a fortune relative to a per-seat SaaS license — because the alternative is a $1,000/hour associate. Defensibility is proprietary workflow depth, becoming the system of record for a matter type, the trust and security posture that elite firms require, and the liability structure clients won’t take on themselves.

Where the opening is: own a specific high-value document workflow end-to-end — M&A diligence, contract lifecycle, patent prosecution, tax provisioning, compliance filings. Or skip the incumbent firms entirely and go direct to the in-house corporate legal and finance teams who’d rather buy the agent than the outside counsel — a route that also sidesteps the billable-hour incentive problem, since a law firm is structurally conflicted about a tool that shrinks its own hours. The most disruptive version of all is the agent sold to the underserved: the litigation platform for plaintiffs’ firms, the tax agent for small businesses, the compliance agent for companies that never could afford a Big Four engagement.

Signal — startups & scaleups to watch:

• Harvey — legal AI for elite firms

• Legora — transactional legal AI

• Robin AI — contract review AI

• Hebbia — finance and pro-services document AI

• EvenUp — personal-injury demand automation

• Eudia — in-house legal AI

• Crosby — AI-powered law firm

• Spellbook — contract drafting AI

• Luminance — contract intelligence

• Ironclad — contract lifecycle plus AI

• Leya — legal workflow AI

• Supio — litigation and personal-injury AI

• Darrow — legal intelligence for plaintiffs

• LegalOn — contract review AI

• Clio — legal practice management plus AI

• Norm Ai — regulatory compliance agents

• Rogo — finance research AI

• Basis — accounting AI agents

• Definely — legal drafting tools

• Genie AI — legal document automation

• Filevine — legal case management

• Wordsmith — in-house legal AI

• CoCounsel (Casetext) — legal research AI

15. Customer support & sales AI (CX/GTM agents)

The shift: the front office gets automated, not assisted. Customer support and sales development are moving from “AI suggests a reply to the human agent” to “the agent resolves the ticket or books the meeting itself” — end-to-end, measured on outcomes.

Why now: support is a near-perfect agent domain — high volume, repetitive, with a clear success signal (was the issue resolved?) and existing knowledge bases to ground on. Models crossed the reliability bar for multi-turn resolution with tool use in 2024–2025, and the willingness of enterprises to route real customers to an AI followed once resolution rates and guardrails proved out. Sales followed the same curve.

Why it’s a startup goldmine: support and contact-center is a multi-hundred-billion-dollar labor market — much of it outsourced to BPOs precisely because it’s costly and painful — and it’s the clearest place in all of software to price AI as labor replaced. Sierra’s outcome-based pricing — charging per successful resolution rather than per seat — is the template for the whole cycle: your revenue scales with the payroll you remove, not with the license count, which means a single enterprise logo can be worth what a hundred SaaS seats used to be. The disruption target is the BPOs, the call centers, and the per-seat helpdesk software that only assists the human. Defensibility is integration depth into the systems of record (CRM, ticketing, billing, order management), the resolution-quality data flywheel that makes your agent better than a competitor’s on the same model, and — decisively — owning the outcome and the liability that comes with letting an AI speak for the brand.

Where the opening is: go vertical or go outcome-priced. The support agent purpose-built for a hard domain (healthcare, fintech, telco) with the compliance and integrations that generic bots lack — or the GTM agent that runs the full outbound-to-booked-meeting motion, not just drafts emails. The voice channel is a specific, wide-open front: the AI phone agent that actually holds a multi-turn call, handles interruptions, and takes real actions is only now becoming reliable, and it attacks the single largest pool of front-office labor — the call center — head-on. Whoever owns the outcome, the integration, and the resolution-quality data becomes impossible to rip out.

Signal — startups & scaleups to watch:

• Sierra — outcome-priced CX agent

• Decagon — enterprise support automation

• Intercom (Fin) — incumbent support agent

• Clay — GTM data and enrichment

• 11x — AI sales reps

• Cresta — contact-center AI

• Parloa — voice contact-center AI

• Ada — customer-service automation

• Forethought — support AI

• Lorikeet — complex support agent

• Crescendo — CX outcome service

• PolyAI — voice customer assistants

• Cognigy — enterprise conversational AI

• Artisan — AI sales BDR

• Unify — GTM automation

• Qualified — pipeline and AI SDR

• Bland AI — AI phone calls

• Retell AI — voice-agent platform

• Vapi — voice AI developer platform

• Observe.AI — contact-center intelligence

• Maven AGI — enterprise support agent

• Ema — universal AI employee

• Replicant — voice contact-center automation

16. AI-native consumer apps & companions

The shift: software you talk to instead of operate. A new generation of consumer products is being built with the model as the core interaction — companions, tutors, therapists, coaches, assistants — creating relationships and habits, not just features. This is the first genuinely new consumer paradigm since the mobile app.

Why now: models became conversational, memory-capable, multimodal, and cheap enough to run in a consumer free tier. Voice made them ambient. And crucially, a generation now defaults to talking to AI for companionship, learning, and emotional support — behaviors that didn’t exist three years ago and are now measured in hours per day. ChatGPT itself became the fastest consumer app in history, proving the appetite.

Why it’s a startup goldmine: consumer is winner-take-most with venture-scale upside — a single breakout app can reach hundreds of millions of users and command real subscription revenue at software margins. The categories in play (companionship, education, wellness, personal productivity) are each enormous, and AI makes previously impossible experiences — an infinitely patient tutor, an always-available companion — suddenly real. The disruption target is everything from Duolingo to dating to therapy. Defensibility is the hardest question: distribution, brand, personalization data, memory, and network effects, because the model alone is rentable by anyone.

Where the opening is: own a specific relationship and the data that deepens it over time. Companionship, an AI tutor that actually moves measurable outcomes, a wellness/therapy companion, or a personalized life assistant — where accumulated memory and habit make switching painful. The wedge is emotional stickiness, not feature count: a product the user talks to daily, that remembers, and that gets more valuable the longer you use it. The other opening is native multimodality — the always-on voice or wearable companion that lives in your ear or on your body, a form factor the incumbent chat apps aren’t built for and that a focused startup can define.

Signal — startups & scaleups to watch:

• Character.AI — companionship at scale

• Replika — original AI companion

• ChatGPT (OpenAI) — default consumer assistant

• Perplexity — AI answer engine

• Grok (xAI) — consumer AI assistant

• Google Gemini — consumer AI assistant

• Meta AI — assistant and companion

• Pi (Inflection) — personal AI companion

• Speak — AI language tutor

• Praktika — AI avatar language tutor

• Duolingo — AI language learning

• Khan Academy (Khanmigo) — AI tutor

• Synthesis — AI tutor for kids

• Slingshot AI (Ash) — AI therapy companion

• Ada Health — AI symptom and health

• Wysa — mental-health chatbot

• Headspace — AI-assisted wellness

• Friend — wearable AI companion

• Tolan (Portola) — voice AI companion

• Nomi — AI companion

• Kindroid — AI companion

• Chai — AI chat companions

Cluster 3 — Physical & Frontier Tech

The last decade of venture capital hid from atoms. This decade runs straight at them: the same AI that conquered language is now conquering motion, the West is re-industrializing under geopolitical duress, and compute itself is being rebuilt out of new physics. These are harder, more capital-intensive, and slower than SaaS — which is exactly why the winners will be near-impossible to copy.

17. Humanoid robots & embodied AI

The shift: Robotics is moving from programmed to learned — a general-purpose body that can be taught tasks the way you’d teach a person, rather than hand-coded for one.

For fifty years a robot could only do what an engineer explicitly scripted inside a fixed cage. The vision-language-action (VLA) model breaks that ceiling: a single neural net that maps camera pixels and a spoken instruction directly to motor commands, and — crucially — generalizes to objects and tasks it never saw in training. The body becomes a peripheral; the value migrates to the policy running on it.

Why now: Three curves crossed at once. The transformer that solved language turned out to solve action too, given enough demonstration data. Teleoperation, simulation, and internet-scale human video finally supply that data at the volume VLAs need. And China’s supply chain collapsed the cost of actuators, harmonic drives, and motors by an order of magnitude, so a capable humanoid platform now costs tens of thousands, not millions. On the demand side, structural labor shortages in logistics, elder care, and manufacturing have made “a body that shows up” worth real money.

Why it’s a startup goldmine: The addressable market is not the robotics budget — it’s the global wage bill for physical labor, tens of trillions of dollars. Pricing flips from capex to robot-as-a-service: charge a monthly rate below the loaded cost of the human shift it replaces, and the ROI math sells itself. Defensibility lives in the data flywheel — every deployed robot streams manipulation data back into the foundation policy, so the leader’s robots get smarter faster than a follower can catch up. Fleet learning, not the sheet metal, is the moat.

Where the opening is: Be honest — building the humanoid itself is brutally capital-hungry and slow, a game for the well-funded. The sharper wedges: the robot foundation model / data layer (be the “OpenAI for actions” that others license), teleoperation-to-autonomy pipelines that convert cheap human remote-operation into training data, simulation and eval infrastructure, and hands/tactile-sensing components. Or go narrow: one dexterous task in one industry where the ROI is undeniable.

Signal — startups & scaleups to watch:

• Figure — humanoids for logistics

• 1X — home-oriented humanoids

• Physical Intelligence — robot foundation models

• Skild AI — cross-embodiment robot brain

• Tesla — Optimus vertically integrated humanoid

• Apptronik — Apollo warehouse humanoid

• Agility Robotics — Digit bipedal robot

• Sanctuary AI — dexterous humanoid hands

• Boston Dynamics — Atlas humanoid

• Unitree — low-cost humanoids, quadrupeds

• Covariant — foundation-model manipulation

• Field AI — foundation models for robots

• Neura Robotics — cognitive service robots

• Robust AI — collaborative warehouse robots

• Mentee Robotics — AI-native humanoid

• Wayve — embodied driving intelligence

18. Industrial, warehouse & logistics automation

The shift: The boring, high-ROI cousin of humanoids — purpose-built machines that pick, sort, move, and inspect inside the four walls of a warehouse or factory, reaching production scale today while humanoids are still demos.

This is where embodied AI actually ships revenue. A picking arm that clears bins, an autonomous forklift, a mobile robot that ferries totes — narrow, unglamorous, and deployed by the thousand. The AI unlock (grasping novel SKUs, adapting to messy real environments) is the same VLA advance driving humanoids, but the form factor is constrained enough to be reliable now.

Why now: E-commerce permanently raised throughput expectations while warehouse labor got scarcer, more expensive, and harder to retain — turnover in fulfillment centers routinely tops 100% a year. Perception models finally handle the “any object, any orientation” problem that defeated a decade of rules-based vision systems. And post-COVID, operators treat automation as resilience, not just cost-cutting.

Why it’s a startup goldmine: Warehouse automation is a multi-hundred-billion-dollar market with a labor problem that only worsens. The pricing unlock is again RaaS — Amazon-scale operators will pay per-pick or per-hour rather than buy capex, converting robotics into a recurring, high-margin software-like revenue stream. Defensibility comes from integration depth: once your robots and warehouse-execution software are wired into a customer’s operations and SLAs, ripping them out is a nightmare. Switching costs are the moat.

Where the opening is: Own a specific station in the flow — depalletizing, induction, each-picking, truck unloading — with a system that beats human unit economics on day one. The best wedge is often the software orchestration layer that makes heterogeneous robot fleets work together, since most warehouses will run mixed hardware from many vendors. Capital intensity is real but far lower than humanoids: you’re selling a bounded, provable ROI.

Signal — startups & scaleups to watch:

• Symbotic — warehouse system automation

• Dexterity — robotic palletizing, picking

• Ambi Robotics — AI parcel sortation

• Locus Robotics — warehouse mobile robots

• Exotec — Skypod goods-to-person

• Geek+ — autonomous fulfillment robots

• GreyOrange — fulfillment robotics, software

• Berkshire Grey — pick-and-pack robotics

• RightHand Robotics — piece-picking arms

• Nimble Robotics — autonomous fulfillment

• Pickle Robot — autonomous truck unloading

• Mujin — intelligent robot controllers

• Plus One Robotics — parcel induction robots

• Vecna Robotics — autonomous forklifts, pallet jacks

• inVia Robotics — goods-to-person automation

• Third Wave Automation — autonomous forklifts

• Dexory — warehouse inventory robots

• Verity — autonomous inventory drones

• Agility Robotics — Digit material handling

19. Autonomous vehicles & mobility

The shift: After a decade of overpromising, autonomy quietly started working — robotaxis now run driverless, paid, at scale in real cities, and the question flipped from “can it work” to “how fast does it scale.”

Waymo crossed the threshold from science project to service: millions of paid, fully driverless rides, expanding city by city. That changes the entire narrative. Autonomy is no longer a bet on a future — it’s an operating business whose only remaining variables are cost curve, geographic expansion, and regulatory pace.

Why now: Foundation models and vastly better perception cracked the long tail of edge cases that stranded the field for years. Sensor costs (especially lidar) fell dramatically. And an end-to-end, learning-based stack — pixels to controls — is proving more robust than the brittle modular pipelines of the 2010s, echoing the same VLA thesis driving robotics writ large.

Why it’s a startup goldmine: The prize is trillions in global mobility and freight spend. But the robotaxi race itself is a capital bloodbath won by giants (Waymo, and Tesla’s camera-only bet). The startup money is in the arms dealers and the adjacent lanes: the simulation and validation tooling every AV program must buy, autonomous trucking on the simpler highway domain, and the sensor/compute components. Margins in tooling are pure software; margins in the fleet are a decade of capex away.

Where the opening is: Sell picks and shovels to the AV industry — Applied Intuition’s playbook of simulation, validation, and developer tooling that every OEM and autonomy team needs regardless of who wins. Or attack a constrained domain (highway trucking, yard trucks, mining, ports) where the driving problem is bounded and the labor shortage is acute. Avoid trying to out-Waymo Waymo in open urban robotaxi — that ship has sailed for the underfunded.

Signal — startups & scaleups to watch:

• Waymo — proven driverless robotaxi

• Applied Intuition — AV simulation, tooling

• Aurora — autonomous trucking

• Kodiak — driverless trucks

• Waabi — generative AI trucking

• Nuro — licensing its autonomy driver

• Zoox — purpose-built robotaxi

• Gatik — middle-mile autonomous delivery

• Pony.ai — robotaxi and trucking

• WeRide — robotaxi, robobus

• Wayve — end-to-end driving AI

• Mobileye — ADAS and autonomy

• May Mobility — autonomous shuttles

• Oxa — autonomy software platform

• Einride — autonomous electric freight

• Plus — autonomous trucking software

• Torc Robotics — self-driving trucks

• Helm.ai — AV foundation software

• Foretellix — AV verification, validation

20. Drones & counter-drone systems

The shift: Ukraine turned the cheap FPV drone into the defining weapon of modern war and, simultaneously, exposed the West’s near-total lack of affordable defenses against them — creating twin gold rushes in autonomous drones and counter-drone systems.

The battlefield of the 2020s is a drone battlefield: swarms of sub-$1,000 quadcopters destroying multimillion-dollar armor, ISR drones providing persistent overwatch, and loitering munitions replacing artillery. Every military on earth is now scrambling to both field these systems at scale and defeat the enemy’s. It’s the fastest-moving procurement shift in a generation.

Why now: Ukraine is a live, three-year proof of concept that rewrote doctrine. Chinese commercial drone dominance (DJI) became a national-security liability the West must domestically replace. Cheap autonomy — onboard AI for navigation, targeting, and jamming resistance — turned drones from remote-controlled toys into autonomous agents. And defense budgets are re-opening to fast, cheap, attritable hardware after decades of exquisite, unaffordable platforms.

Why it’s a startup goldmine: Defense procurement is a trillion-dollar arena finally willing to buy from startups, thanks to Anduril proving the model. Attritable drones invert the classic defense cost curve — you want the unit to be cheap and expendable, which favors software-defined, mass-manufacturable designs over gold-plated primes. Counter-drone (detection, tracking, kinetic and electronic kill) is an almost greenfield market with desperate, immediate demand. Defensibility is autonomy software plus defense-grade manufacturing plus the security clearances and program relationships that take years to build.

Where the opening is: Two clean wedges — autonomous drone platforms built for attritable mass (not exquisite one-offs), and the counter-UAS layer where Western militaries are most exposed. Software-defined autonomy that works under jamming and GPS-denial is the durable edge. Capital intensity is high and sales cycles are long, but non-dilutive government funding and committed offtake soften the curve.

Signal — startups & scaleups to watch:

• Anduril — Lattice autonomy, drones

• Shield AI — Hivemind GPS-denied autonomy

• Saronic — autonomous surface vessels

• Skydio — autonomous reconnaissance drones

• Helsing — AI defense, strike drones

• Quantum Systems — reconnaissance UAS

• AeroVironment — Switchblade loitering munitions

• Mach Industries — attritable munitions, drones

• Auterion — open drone operating system

• Zipline — autonomous delivery drones

• Percepto — autonomous industrial drones

• Wingtra — mapping and survey drones

• Dedrone — counter-drone detection

• DroneShield — counter-UAS defeat systems

• Fortem Technologies — DroneHunter counter-UAS

• Epirus — directed-energy counter-drone

21. The space economy (launch, satellites, defense space)

The shift: Cheap, reusable launch collapsed the cost of reaching orbit by roughly 20x, turning space from a government-only frontier into a commercial platform layer — and a contested military domain.

When it costs a fraction of what it used to per kilogram to orbit, everything downstream becomes economically viable that wasn’t before: massive satellite constellations, in-space manufacturing, Earth observation at continuous cadence, and orbital defense. SpaceX didn’t just win launch — it created the enabling infrastructure for an entire industry, the way AWS enabled a generation of software companies.

Why now: Reusability is proven and being pushed toward full reuse, driving cost toward a further order-of-magnitude drop. Starlink demonstrated that a space-based service can be a real, cash-generating consumer and defense business, not a science mission. And great-power competition has reopened defense space budgets — resilient constellations, space domain awareness, and missile tracking are urgent national priorities.

Why it’s a startup goldmine: The space economy is on a trajectory to $1T+ by the 2030s, and the application layer is wide open now that launch is commoditized. Earth observation with AI analytics, satellite communications, in-space logistics, and defense payloads all have real customers and, increasingly, real revenue. The margin unlock is that launch access is now a purchasable commodity — you no longer need to be a nation-state. Defensibility comes from constellation network effects, exclusive data, and defense contracts.

Where the opening is: Don’t build a rocket unless you’re SpaceX-scale funded. Build on top of cheap launch: Earth-observation data and analytics, satellite servicing and logistics, defense-space payloads and space domain awareness, and ground-segment/software infrastructure. The picks-and-shovels layer — components, propulsion, software — is capital-lighter than launch and still riding the same wave.

Signal — startups & scaleups to watch:

• SpaceX — Starship, Starlink platform

• Rocket Lab — launch and space systems

• Firefly Aerospace — launch and lunar landers

• Relativity Space — 3D-printed rockets

• Stoke Space — fully reusable rocket

• K2 Space — large low-cost satellites

• Impulse Space — orbital transfer logistics

• Vast — commercial space stations

• Varda Space — in-space manufacturing

• Astranis — small GEO comms satellites

• Apex Space — productized satellite buses

• Muon Space — Earth-observation constellations

• Planet Labs — daily Earth imaging

• Albedo — ultra-high-resolution VLEO imagery

• ICEYE — SAR Earth observation

• Capella Space — SAR satellite imagery

• Umbra — high-resolution SAR

• True Anomaly — space-superiority spacecraft

• Turion Space — space domain awareness

• Astroscale — debris removal, servicing

• Axiom Space — commercial space station

• Sierra Space — Dream Chaser, stations

22. Advanced manufacturing & Western reshoring

The shift: Geopolitics ended the era of frictionless offshoring — the West is now re-industrializing under duress, and software-defined, AI-native factories are the only way to make domestic manufacturing economically competitive.

Decades of moving production to China created a strategic dependency the West is now urgently unwinding: semiconductors, batteries, pharmaceuticals, defense components, critical minerals. But reshoring to high-wage countries only pencils out if the factory is radically more automated and software-driven than its offshore predecessor. The reshoring wave and the automation wave are the same wave.

Why now: COVID and the Taiwan risk exposed supply-chain fragility as an existential vulnerability. Industrial policy — the CHIPS Act, the IRA, European sovereignty pushes — is pouring hundreds of billions into domestic capacity. Simultaneously, AI-driven robotics, generative design, and modern manufacturing software finally make high-mix, low-volume domestic production viable. Labor scarcity forces the automation that makes reshoring affordable.

Why it’s a startup goldmine: Manufacturing is a multi-trillion-dollar sector running on decades-old software and manual processes — a target-rich environment for AI-native disruption. The disruption is replacing brittle legacy MES/ERP, manual quality inspection, and human-limited process control with software and robotics. The margin unlock: software attach to physical production, and the ability to win contracts that must be domestic for security reasons. Defensibility is deep process expertise, regulatory qualification, and integration into physical supply chains that are painful to switch.

Where the opening is: AI-native factory software (MES, quality, scheduling), machine-vision inspection that replaces manual QA, generative and simulation-driven design tools, and vertically integrated “new-prime” manufacturers that own production of a critical component (chips, batteries, munitions, drones). Capital intensity varies wildly — software-thin at one end, fab-heavy at the other; pick your altitude deliberately.

Signal — startups & scaleups to watch:

• Hadrian — automated aerospace parts factories

• Machina Labs — robotic sheet-metal forming

• Anduril — Arsenal defense manufacturing

• Instrumental — AI manufacturing inspection

• Bright Machines — software-defined assembly

• Path Robotics — autonomous robotic welding

• Standard Bots — affordable robotic arms

• Divergent — digital metal manufacturing

• Gecko Robotics — industrial inspection robots

• Tulip — frontline operations apps

• Chef Robotics — food assembly robotics

• Nominal — hardware test, telemetry

• Ursa Major — rocket propulsion manufacturing

• MP Materials — rare earths and magnets

• Niron Magnetics — rare-earth-free magnets

• Redwood Materials — battery materials recycling

• Sila — silicon battery anodes

• Form Energy — iron-air grid batteries

23. Quantum computing

The shift: Quantum computing crossed from physics experiment toward engineering roadmap — error correction is finally working, and the first logical, fault-tolerant qubits are appearing, putting commercial utility on a credible timeline.

For years quantum was a perpetual “ten years away.” That’s changing: demonstrations of quantum error correction that improves as you scale, credible fault-tolerance roadmaps from multiple hardware approaches, and real capital committing to specific architectures. The machine that breaks encryption and simulates molecules is no longer purely hypothetical — it’s an engineering program with milestones.

Why now: Error correction is the whole game, and 2024–2025 produced the first convincing evidence that adding physical qubits actually reduces logical error rates — the threshold theorem working in practice. Photonic, neutral-atom, and superconducting approaches each have a path to scale. And the security implications (”harvest now, decrypt later”) are forcing governments and enterprises to fund the field seriously regardless of exact timing.

Why it’s a startup goldmine: The prize is enormous and winner-take-few: molecular simulation for drugs and materials, optimization, and cryptography represent markets worth hundreds of billions. Whoever reaches useful fault-tolerance first owns a genuine platform monopoly. The margin structure is extreme — a working fault-tolerant machine is close to irreplaceable IP. Defensibility is the hardest and deepest in all of tech: physics, fabrication, and error-correction expertise that takes a decade and a fortune to assemble.

Where the opening is: Be honest — the core hardware race is a capital-and-physics marathon for the deep-pocketed (PsiQuantum’s photonic bet, QuEra’s neutral atoms, IBM/Google internally). The startup-friendly wedges: the enabling layer (control systems, cryogenics, error-correction software, quantum-classical middleware), post-quantum cryptography for the security transition happening now, and quantum-algorithm/application software that will be valuable the moment hardware matures. Sell shovels into the race.

Signal — startups & scaleups to watch:

• PsiQuantum — photonic fault-tolerance at scale

• QuEra — neutral-atom logical qubits

• IonQ — trapped-ion quantum computers

• Quantinuum — trapped-ion quantum systems

• Rigetti — superconducting quantum

• Atom Computing — neutral-atom qubits

• Pasqal — neutral-atom quantum

• Infleqtion — cold-atom quantum tech

• Alice & Bob — cat-qubit error correction

• Oxford Ionics — trapped ions on chips

• Diraq — silicon spin qubits

• Quantum Brilliance — diamond quantum

• Nord Quantique — error-corrected qubits

• SEEQC — digital quantum control

• Quantum Machines — quantum control systems

• Q-CTRL — quantum control software

• Classiq — quantum algorithm software

• Multiverse Computing — quantum-inspired software

• Xanadu — photonic quantum computing

• SandboxAQ — post-quantum crypto, sensing

• PQShield — post-quantum cryptography

• QuSecure — post-quantum security

24. Photonics & new compute substrates

The shift: The AI compute crunch — power, heat, and bandwidth walls that silicon can no longer scale past — is forcing a rethink of the substrate itself, and light-based (photonic) computing and interconnect is the leading candidate to break through.

AI’s insatiable compute demand is colliding with physics: data centers are constrained by power delivery, cooling, and the bandwidth of moving data between chips. Electrons over copper are hitting hard limits. Photonics — computing and, especially, moving data with light — offers dramatically lower energy per bit and higher bandwidth, exactly where the bottleneck now is. The substrate, not just the model, becomes a frontier.

Why now: The AI buildout made data-center power and interconnect the limiting factor, with training clusters constrained by how fast chips can talk to each other. Silicon photonics manufacturing matured enough to integrate optics with electronics at scale. And energy cost became a first-order economic driver of AI — anything that cuts joules per token or per training step is worth billions. The pain is acute and the buyers are the deepest-pocketed companies on earth.

Why it’s a startup goldmine: The AI-infrastructure market is measured in the hundreds of billions and every hyperscaler is desperate for more efficient compute and interconnect. Optical interconnect and co-packaged optics disrupt the electrical networking that dominates data centers today; optical compute could eventually disrupt the GPU itself for specific workloads. The margin unlock is enormous — even incremental efficiency at data-center scale translates to gigawatts and billions saved. Defensibility is hard photonics IP, foundry relationships, and integration know-how.

Where the opening is: Optical interconnect and co-packaged optics are the near-term, revenue-now wedge — the bottleneck is bandwidth between chips, and that’s where photonics wins first and most cleanly. Longer-dated but larger: analog optical compute for matrix multiplication (the core of AI). Also adjacent substrates — analog in-memory compute and novel materials. Capital intensity is high and foundry-dependent, but hyperscaler demand and strategic investment de-risk the path.

Signal — startups & scaleups to watch:

• Lightmatter — photonic interconnect, compute

• Ayar Labs — optical I/O chiplets

• Celestial AI — photonic memory fabric

• Lightelligence — photonic computing

• POET Technologies — optical interposer platform

• d-Matrix — digital in-memory compute

• EnCharge AI — analog in-memory AI

• Mythic — analog compute chips

• Groq — deterministic inference LPUs

• Cerebras — wafer-scale AI compute

• SambaNova — reconfigurable dataflow chips

• Tenstorrent — RISC-V AI compute

• Etched — transformer-specialized ASIC

• Axelera AI — in-memory edge AI

• Extropic — thermodynamic computing

• BrainChip — neuromorphic Akida processor

• Innatera — neuromorphic sensing chips

Cluster 4 — Energy, Climate & Bio

The two hardest problems on Earth — where the electrons come from and how the body decays — are becoming venture problems, because AI turned power into the binding constraint on the economy and because biology finally became programmable. This cluster is where atoms, not just bits, get repriced, and where the winners look less like the cleantech flameouts of 2010 and more like software companies wrapped around a physical asset. The unifying lesson across all eight topics: the market is no longer the bottleneck — the demand is contracted, subsidized, or desperate — so the game is execution, defensibility, and finding the capital-light wedge into a capital-heavy domain.

25. Nuclear (SMRs) & fusion

The shift: After thirty years of stagnation, firm zero-carbon baseload is being re-engineered as a manufactured product — small modular reactors built on an assembly line, and fusion moving from a physics experiment to an engineering roadmap with commercial off-take.

The old nuclear model was a one-off, decade-long, over-budget megaproject. The new model is factory-built reactors of 50–300 MW that ship as modules, plus fusion machines whose economics finally close on high-temperature superconducting magnets. Nuclear stopped being a climate story and became an electricity-supply story.

Why now: AI data centers created a step-change in electricity demand that no other source can serve cleanly, firmly, and 24/7. Hyperscalers signed the first-ever corporate nuclear off-take deals in 2024–2025 — Microsoft reviving Three Mile Island, Amazon and Google contracting SMR fleets before a single unit is built. Regulatory tailwinds (ADVANCE Act, DOE loan guarantees), a decade of high-temperature-superconductor magnet progress, and desperate utilities have collapsed the willingness-to-pay barrier. For the first time in a generation, the customer is pulling the technology forward rather than the technology begging for a market — buyers now sign contracts for power that does not yet exist.

Why it’s a startup goldmine: The global power market is measured in the tens of trillions; firm clean baseload is the scarcest slice of it and commands premium pricing precisely because intermittent renewables can’t provide it. A working SMR or fusion plant disrupts the entire merchant-power and PPA stack, and the margin unlock is the shift from bespoke construction to learning-curve manufacturing — each unit cheaper than the last. Defensibility is brutal and real: nuclear licenses, fuel supply chains, magnet IP, and multi-decade off-take contracts are the deepest moats in energy.

Where the opening is: Most founders shouldn’t build a reactor. The wedge is the picks and shovels — advanced fuel (HALEU) supply, digital-twin and simulation software that compresses licensing timelines, reactor-grade component manufacturing, and the software layer that matches new firm generation to data-center load. Whoever de-risks NRC licensing with software owns a chokepoint.

The deeper point: the last time capital tried nuclear, it drowned in construction risk and public fear. This time the demand is contracted, the units are factory-repeatable, and the buyers are the most creditworthy companies on Earth. That inversion of who bears the risk is what makes it investable.

Signal — startups & scaleups to watch:

• Commonwealth Fusion Systems — HTS-magnet tokamak (SPARC)

• Helion Energy — direct-electricity fusion

• TAE Technologies — beam-driven fusion

• Zap Energy — sheared-flow Z-pinch fusion

• Type One Energy — stellarator fusion

• Tokamak Energy — spherical-tokamak fusion

• Proxima Fusion — stellarator fusion, Germany

• Marvel Fusion — laser inertial fusion

• Xcimer Energy — laser inertial fusion

• General Fusion — magnetized target fusion

• First Light Fusion — projectile inertial fusion

• Kairos Power — molten-salt SMR

• X-energy — pebble-bed HALEU SMR

• Oklo — fast microreactors

• TerraPower — Natrium sodium reactor

• NuScale Power — light-water SMR

• Terrestrial Energy — molten-salt SMR

• Last Energy — factory-built micro-SMR

• Radiant — portable microreactor

• Aalo Atomics — modular microreactor

• Valar Atomics — gas microreactor

• newcleo — lead-cooled fast reactor

26. Grid-scale & long-duration energy storage

The shift: Storage is graduating from four-hour lithium batteries that shave daily peaks to multi-day systems that let renewables act like baseload — turning intermittent wind and solar into firm, dispatchable power.

Lithium-ion solved the daily arbitrage problem. It cannot economically solve the multi-day and seasonal problem — the windless, cloudy week. Long-duration energy storage (LDES) using iron-air, flow chemistries, thermal, and gravity systems targets 10–100+ hour discharge at a fraction of lithium’s cost per kilowatt-hour.

Why now: Grids are hitting the point where adding more solar and wind without storage is worthless — curtailment and negative pricing are now routine in California and Texas. AI-driven load growth means utilities need firm capacity fast, and new transmission takes a decade, so storage becomes the fastest deployable firm resource. IRA manufacturing credits and capacity-market reforms finally pay for the duration that grids actually need.

Why it’s a startup goldmine: The storage TAM runs to trillions as the grid electrifies transport and heat. LDES disrupts the peaker-plant and gas-turbine business that has owned grid balancing for a century. The pricing unlock is capacity payments and multi-hour arbitrage that four-hour batteries physically cannot capture. Defensibility comes from novel electrochemistry and — critically — using cheap, earth-abundant inputs (iron, salt, air) that sidestep the lithium and critical-mineral supply crunch entirely.

Where the opening is: Beyond the cell chemistry itself, the software wedge is enormous: bidding-and-dispatch optimization that turns a battery into a trading desk, virtual power plants aggregating distributed storage, and the AI that forecasts prices and degradation. A founder can build a capital-light software layer on top of everyone else’s steel.

The tell of the winner is not who has the cheapest cell in a lab but who can finance, site, and cycle it profitably across thousands of grid events. The company that pairs a novel cheap chemistry with a merchant-trading software stack captures both the asset margin and the market spread.

Signal — startups & scaleups to watch:

• Form Energy — 100-hour iron-air storage

• ESS Inc. — iron flow batteries

• Eos Energy — zinc-based long-duration storage

• Antora Energy — thermal battery for industry

• Rondo Energy — heat-brick thermal battery

• Fluence — grid storage software + integration

• Tesla — Megapack grid storage

• Energy Vault — gravity and hybrid storage

• Ambri — liquid-metal battery

• Highview Power — liquid-air storage

• Quidnet Energy — geomechanical pumped storage

• Invinity Energy Systems — vanadium flow batteries

• EnerVenue — nickel-hydrogen batteries

• Natron Energy — sodium-ion batteries

• Peak Energy — sodium-ion grid storage

• Alsym Energy — non-flammable sodium-ion cells

• Nostromo Energy — ice-based thermal storage

27. Data-center power & behind-the-meter energy

The shift: The hyperscaler build-out has broken the grid’s ability to connect new load, so compute is going behind the meter — data centers now come with their own dedicated generation, and power availability, not chips, has become the binding constraint on AI.

Interconnection queues stretch five to seven years in the key markets. A gigawatt data center can’t wait. So the industry is bringing power on-site — gas turbines, fuel cells, on-site solar-plus-storage, and eventually SMRs — and co-locating compute next to stranded generation. The unit of competition in AI is quietly becoming megawatts delivered per quarter.

Why now: Data-center electricity demand is projected to double or more by 2030, and the grid simply cannot connect it on the required timeline. This is the single sharpest “why now” in energy: an unlimited-budget buyer (hyperscalers, neoclouds) with an acute, right-now scarcity and no patience for the utility interconnection process.

Why it’s a startup goldmine: Every gigawatt of AI compute needs roughly a gigawatt of firm power, and the buyers have effectively infinite balance sheets and zero price sensitivity relative to the value of the compute. This disrupts the regulated utility monopoly on new connections. The margin unlock is selling speed — behind-the-meter power that comes online in 18 months instead of 84. Defensibility is site control, grid-interconnection rights, and long-term generation contracts locked up before competitors move.

Where the opening is: The consumer-and-SMB analog is the sharpest wedge — a “Base Power” model that installs distributed generation and storage and sells power-as-a-service, or software that finds and permits stranded-power sites, manages behind-the-meter microgrids, and arbitrages on-site generation against the grid. The founder wedge is turning power procurement into a SaaS-and-services product for anyone who can’t wait in the queue.

This is the purest arbitrage in the whole cluster: the value of a megawatt to an AI company is set by the compute it unlocks, not by the wholesale price of electricity, so whoever delivers firm power fastest captures a spread that will not compress for years.

Signal — startups & scaleups to watch:

• Base Power — home battery power-as-a-service

• Crusoe — energy-first AI data centers

• Bloom Energy — on-site fuel cells

• Fervo Energy — enhanced geothermal power

• Sage Geosystems — geothermal power and storage

• Quaise Energy — deep geothermal drilling

• Exowatt — solar-thermal for data centers

• Mainspring Energy — linear-generator power

• Enchanted Rock — on-site backup microgrids

• VoltaGrid — mobile natural-gas generation

• Emerald AI — grid-flexible AI compute

• Oklo — microreactors for data centers

28. Carbon removal & industrial decarbonization

The shift: Carbon is becoming a managed commodity — captured, removed, and re-priced — while the hardest-to-abate industries (steel, cement, chemicals) get rebuilt around clean processes, turning emissions from an externality into a line item with a market.

There are two moves here. Carbon removal (direct air capture, enhanced weathering, biochar, mineralization) creates durable, verifiable tonnes buyers will pay a premium for. Industrial decarbonization replaces the coal and gas at the heart of heavy manufacturing — green hydrogen for steel, novel cement chemistries, electrified process heat.

Why now: A durable-removal demand market appeared almost overnight — Frontier’s ~$1B advance-purchase commitment, Microsoft’s multi-megatonne offtakes, and the maturing 45Q tax credit created guaranteed buyers before the supply existed. Corporate net-zero commitments plus tightening carbon border adjustments (CBAM) turned decarbonization from voluntary PR into a regulatory and trade requirement.

Why it’s a startup goldmine: The addressable market is every tonne of hard-to-abate emissions on Earth — gigatonnes at premium prices as CBAM and net-zero mandates bite. It disrupts the incumbent carbon-intensive commodity producers who cannot decouple from their emissions. The pricing unlock is that early durable tonnes sell for hundreds of dollars, funding the cost-down curve. Defensibility is process IP, cheap energy contracts, and verified, high-integrity carbon accounting.

Where the opening is: Hardware DAC is capital-hungry; the software-and-services wedges are where lean startups win — MRV (measurement, reporting, verification) that makes a tonne trustworthy and bankable, carbon-removal marketplaces, and the accounting-and-procurement layer corporates need to buy credibly. Whoever becomes the trust layer for a tonne of carbon owns the market.

The uncomfortable truth is that most removal today is expensive and unverifiable, which is exactly why the trust-and-measurement layer is where durable value accrues — the market cannot scale until a tonne is as bankable as a barrel of oil, and someone has to build that standard.

Signal — startups & scaleups to watch:

• Climeworks — direct air capture

• Heirloom Carbon — limestone-based DAC

• CarbonCapture Inc — modular DAC

• Charm Industrial — bio-oil sequestration

• Lithos Carbon — enhanced rock weathering

• Mati Carbon — enhanced weathering on farms

• Terradot — enhanced rock weathering

• Vaulted Deep — biomass slurry injection

• Graphyte — biomass carbon casting

• Living Carbon — engineered carbon-capturing trees

• 44.01 — mineralizing CO2 in rock

• Captura — ocean carbon capture

• Ebb Carbon — ocean alkalinity removal

• Equatic — seawater carbon removal

• Isometric — carbon-removal registry and MRV

• Sylvera — carbon-credit ratings

• Frontier — advance-market demand aggregation

• Sublime Systems — electrochemical clean cement

• Brimstone — carbon-negative cement

• Fortera — CO2-mineralized cement

• CarbonCure — CO2 injection into concrete

• Boston Metal — green-steel electrolysis

• Electra — low-temperature clean iron

• Stegra — green-hydrogen steel

• Twelve — CO2-to-fuels and chemicals

• LanzaTech — carbon-recycling fermentation

• Svante — carbon-capture filters

29. Critical minerals & battery materials

The shift: The electrification and AI build-out runs on lithium, copper, nickel, and rare earths — and the West’s near-total dependence on Chinese processing has turned materials from a mining afterthought into a matter of national security and a venture-scale opportunity.

Every battery, motor, transformer, and data center is a claim on refined minerals. Demand is exploding while supply is concentrated in geopolitically fraught hands — China controls the majority of processing for most critical minerals. The response is a full-stack rebuild: new extraction, domestic refining, and recycling to close the loop.

Why now: Export controls became a live weapon in 2023–2025 as China restricted gallium, germanium, graphite, and rare-earth processing. Simultaneously, EV and grid-storage demand curves went vertical and Western governments opened enormous subsidy and offtake programs (IRA, Defense Production Act, EU Critical Raw Materials Act). The buyer of last resort is now the government itself.

Why it’s a startup goldmine: The materials market is a multi-hundred-billion-dollar flow growing with every electrified thing, and secure Western supply commands a strategic premium. It disrupts the incumbent Chinese processing monopoly and legacy mining majors. The margin unlock is novel extraction (direct lithium extraction, e-waste and battery recycling) that produces at lower cost and footprint than conventional mining. Defensibility is resource control, proprietary separation chemistry, and government-backed offtake.

Where the opening is: The software wedges are underrated — AI-driven mineral exploration that finds deposits from geological data, battery-recycling logistics and pre-processing, and supply-chain-traceability software that proves provenance for compliance. The hard-tech wedge is direct lithium extraction and rare-earth separation that doesn’t need China.

The strategic frame matters: this is one of the few venture categories where the state is an active co-investor and guaranteed customer, which de-risks the capital intensity that killed earlier materials startups. A founder who aligns a technical edge with that policy tailwind is building with a wind at their back.

Signal — startups & scaleups to watch:

• KoBold Metals — AI mineral exploration

• Redwood Materials — battery recycling

• Li-Cycle — lithium-ion recycling

• Ascend Elements — cathode from recycled batteries

• Lilac Solutions — direct lithium extraction

• EnergyX — direct lithium extraction

• Standard Lithium — brine lithium extraction

• Ioneer — lithium-boron mine

• Mangrove Lithium — modular lithium refining

• MP Materials — rare-earth mine-to-magnet

• Niron Magnetics — rare-earth-free magnets

• Noveon Magnetics — recycled permanent magnets

• Cyclic Materials — rare-earth recycling

• Phoenix Tailings — rare earths from mine waste

• Magrathea Metals — clean magnesium from brine

• Nth Cycle — critical-metal refining

• 6K Energy — plasma battery materials

• Group14 Technologies — silicon battery anodes

• Sila Nanotechnologies — silicon anode materials

• Novonix — synthetic graphite anodes

30. Longevity & healthspan

The shift: Aging is being reframed from an inevitability into a treatable process — a set of biological mechanisms (cellular senescence, epigenetic drift, mitochondrial decline) that can be measured, slowed, and potentially reversed, turning healthspan into a consumer and clinical market.

The old model treated diseases one at a time as they appeared. The longevity thesis targets the upstream driver — aging itself — on the logic that slowing biological aging prevents the whole downstream cascade of cancer, heart disease, and dementia at once. It spans serious science (partial reprogramming, senolytics) and a booming consumer wellness layer.

Why now: Aging biomarkers matured — epigenetic clocks now measure biological age, giving a quantifiable target and endpoint. Ozempic and the GLP-1 revolution proved that a metabolic drug can produce broad, systemic health benefits and that consumers will pay cash for healthspan. AI-driven biology and cheap sequencing made the underlying research tractable, and an aging-and-affluent demographic is desperate to spend.

Why it’s a startup goldmine: The longevity-and-wellness market is already tens of billions and structurally uncapped — everyone ages, and the willingness-to-pay for more healthy years is nearly infinite among the affluent. It disrupts reactive sick-care with proactive healthspan. The pricing unlock is cash-pay consumer medicine that bypasses insurance entirely, plus eventual pharma-scale therapeutics. Defensibility is clinical data, proprietary biomarkers, and brand trust.

Where the opening is: The consumer-and-data wedge is sharpest — full-body diagnostic and biomarker platforms (the “annual physical, reinvented”), longevity clinics with recurring memberships, and the software that turns continuous biological data into personalized protocols. On the therapeutics side, partial cellular reprogramming is the moonshot. The wedge is owning the measurement layer of aging.

The category has a credibility problem — it sits between rigorous science and snake oil — which is precisely the opening: the company that brings clinical-grade rigor and beautiful consumer experience to healthspan will define the market the way Peloton or Oura defined theirs, but with a far larger and more durable willingness to pay.

Signal — startups & scaleups to watch:

• Neko Health — full-body preventive scanning

• Function Health — cash-pay biomarker testing

• Fountain Life — preventive diagnostics clinics

• Human Longevity — genomic health screening

• Superpower — consumer healthspan platform

• Levels — continuous metabolic monitoring

• Tally Health — epigenetic-age testing

• Elysium Health — longevity supplements

• Altos Labs — cellular reprogramming

• Retro Biosciences — cellular reprogramming

• NewLimit — epigenetic reprogramming

• Turn Biotechnologies — mRNA reprogramming

• Shift Bioscience — reprogramming discovery

• Life Biosciences — partial reprogramming therapies

• BioAge Labs — aging-biology drugs

• Unity Biotechnology — senolytic therapies

• Cambrian Bio — aging drug pipeline

• Gordian Biotechnology — in-vivo aging screens

• Rejuvenate Bio — gene-therapy aging

• Loyal — canine longevity drugs

• Gero — AI aging biology

• Insilico Medicine — AI drug discovery for aging

• Juvenescence — longevity drug developer

• Calico Labs — aging research (Alphabet)

31. Programmable biology / synthetic biology

The shift: Biology is becoming an engineering discipline — cells programmed like computers to manufacture chemicals, materials, foods, and drugs, with AI now designing the genetic code and proteins directly rather than discovering them by trial and error.

The first synbio wave over-promised and stumbled on the gap between designing a cell and manufacturing at scale. The new wave is different because AI closed the design loop: models now generate novel proteins, enzymes, and genetic circuits computationally, and lab automation tests thousands of designs per week. The bottleneck moved from “what do we build” to “how fast can we iterate.”

Why now: AI protein and genome models (the AlphaFold lineage, generative protein design) turned biology into a design problem software can attack. DNA synthesis and sequencing costs kept collapsing, foundation models for biology arrived, and automated “self-driving labs” made the design-build-test-learn loop fast and cheap. Biology finally has its own scaling laws — more data and compute reliably yield better molecules — which is the signal that a field is about to compound the way software did.

Why it’s a startup goldmine: The addressable market is essentially all of chemistry, materials, and manufacturing — a multi-trillion-dollar substitution of engineered biology for petrochemical and extractive processes, plus every drug. It disrupts industrial chemistry and traditional drug discovery. The margin unlock is designing a molecule in silico and brewing it in a vat instead of a refinery. Defensibility is proprietary design models, strain libraries, and manufacturing know-how.

Where the opening is: The AI-drug-design layer is the hottest wedge — companies applying generative models to design therapeutics faster and cheaper than the pharma pipeline. Adjacent wedges: bio-manufacturing infrastructure (the “AWS for biology”), enzyme and materials design, and the tooling-and-data layer feeding the models. Software founders can enter biology through the design and data stack without owning a fermenter.

The lesson of the first synbio cycle is that design is necessary but not sufficient — scale-up is where value is won or lost. The winners of this cycle will be the ones who treat manufacturing as a first-class engineering problem, not an afterthought, and who own the proprietary data that makes their design models compound over time.

Signal — startups & scaleups to watch:

• Xaira Therapeutics — AI-native drug design

• Isomorphic Labs — AI drug design

• Generate Biomedicines — generative protein design

• Chai Discovery — AI antibody design

• Profluent — AI protein design

• Cradle — AI protein engineering

• EvolutionaryScale — protein foundation models

• Basecamp Research — biodiversity protein data

• Dyno Therapeutics — AI-designed gene-therapy capsids

• Absci — generative antibody design

• Recursion — AI drug discovery via phenomics

• Arzeda — computational enzyme design

• Ginkgo Bioworks — cell-programming foundry

• Solugen — enzymatic green chemicals

• LanzaTech — gas-fermentation manufacturing

• Twist Bioscience — synthetic DNA

• Synthego — CRISPR genome engineering

• bit.bio — programmed human cells

• Pivot Bio — engineered nitrogen microbes

• Culture Biosciences — cloud bioreactors

32. Precision & preventive medicine

The shift: Medicine is moving from population-average, reactive treatment to individualized, predictive care — diagnosing and intervening before disease manifests, using genomics, multi-omics, continuous monitoring, and AI to tailor treatment to the single patient.

Standard medicine treats the average patient with the average drug after they’re already sick. Precision medicine uses your genome, your biomarkers, and your continuous physiological data to predict your risk and pick your therapy — and preventive medicine pushes the whole intervention upstream, catching cancer and cardiovascular disease years earlier when they’re cheap and curable.

Why now: Whole-genome sequencing fell below the cost of a routine lab test, multi-cancer early-detection blood tests (liquid biopsy) reached clinical validation, and wearables turned every patient into a continuous data stream. AI can finally integrate genomics, imaging, and longitudinal data into a real risk model. The economic logic is overwhelming: preventing disease is vastly cheaper than treating it.

Why it’s a startup goldmine: Healthcare is a $4-trillion-plus market in the US alone, and the value of shifting spend from late-stage treatment to early detection is enormous. It disrupts the reactive fee-for-service model. The pricing unlock spans cash-pay screening, value-based contracts that share the savings from prevention, and diagnostics with software margins. Defensibility is clinical validation, proprietary datasets, and payer and provider integration.

Where the opening is: The wedge is the screening and risk-stratification layer — multi-cancer early detection, AI diagnostics that read scans and pathology better than humans, and preventive platforms that combine genomics with continuous monitoring into an actionable risk score. The software founder enters through the data-integration and decision-support layer that sits on top of the diagnostics.

The reimbursement question is the whole game: prevention saves money in aggregate but the savings and the costs land on different balance sheets, so the winners will be those who crack either cash-pay demand or value-based contracts that let a payer share in the downstream savings. Solve the business model and the clinical value is already proven.

Signal — startups & scaleups to watch:

• GRAIL — multi-cancer early detection

• Tempus — AI precision oncology

• Guardant Health — liquid-biopsy cancer tests

• Freenome — blood-based cancer screening

• Exact Sciences — Cologuard cancer screening

• Delfi Diagnostics — blood-based lung screening

• Harbinger Health — early cancer detection

• Natera — molecular residual-disease testing

• Foundation Medicine — tumor genomic profiling

• Neko Health — full-body preventive scans

• Function Health — cash-pay biomarker panels

• Prenuvo — whole-body MRI screening

• Ezra — AI-guided MRI screening

• Nucleus Genomics — consumer whole-genome testing

• Color Health — population genomics and screening

• Cleerly — AI coronary plaque analysis

• HeartFlow — AI coronary artery analysis

• Viz.ai — AI acute-care imaging

• Aidoc — AI radiology triage

• PathAI — AI pathology diagnostics

• Paige — AI cancer pathology

• Owkin — AI biomarker discovery

• Karius — genomic infection diagnostics

• Q Bio — whole-body digital-twin scans

Cluster 5 — Money, Fintech & Trust

Money is the oldest software category and the one most violently re-plumbed by AI and crypto at once. Two forces collide here: value that finally moves like data (stablecoins, embedded rails, programmable money), and a trust stack that has to be rebuilt from scratch now that anyone — human or agent — can forge, transact, and impersonate at machine speed. The eight topics below are the arbitrage between those two forces. The through-line: the winners will not be the ones with the flashiest consumer app but the ones who own a rail, a system of record, or a standard — the boring, load-bearing infrastructure that every other player has to route through and can never cheaply leave.

33. Stablecoins & programmable money

The shift: Dollars stopped being a banking-hours, batch-settled, correspondent-bank artifact and became an internet-native object that moves 24/7, settles in seconds, and carries code. Stablecoins turned the dollar into an API call — and in 2025 that call became legal.

Why now: The GENIUS Act gave the US its first federal stablecoin framework, converting a regulatory grey zone into a licensed asset class with reserve, audit, and redemption rules. Regulatory clarity is the single most powerful unlock in fintech, because it moves a product from “compliance can’t sign off” to “compliance requires a plan” overnight. The moment banks, card networks, and Fortune 500 treasuries got legal cover, adoption stopped being a crypto story and became a payments story — Visa, Mastercard, PayPal, and Stripe all shipped stablecoin settlement, and Walmart-scale merchants started evaluating stablecoin checkout to escape interchange. Stablecoin transfer volume now rivals or exceeds the card networks on a settled-value basis, and the marginal cost of moving a dollar cross-border collapsed toward zero.

Why it’s a startup goldmine: Cross-border B2B payments alone is a multi-trillion-dollar flow paying 3–7% in fees and days of float to correspondent banks. A stablecoin rail collapses that to sub-1% and sub-minute — a classic 10x cost-and-speed unlock where the disruptor keeps a fat margin and still undercuts incumbents 5x. The float alone — the money that today sits idle in the correspondent-banking system for days — is a prize worth billions once it’s freed and settled instantly. Defensibility comes from the on/off-ramp licences (genuinely hard, slow, and jurisdiction-by-jurisdiction to acquire), the treasury and compliance tooling wrapped around the token, and being the settlement layer other fintechs build on so that switching means re-plumbing their money movement. Programmability — escrow, streaming payroll, conditional release, agent-initiated micropayments — is a whole new product surface that legacy rails structurally cannot offer, and it turns a payment from a one-time transfer into a piece of software you can attach logic to.

Where the opening is: Not issuing another stablecoin (Circle and Tether won that) but building the orchestration layer — the Stripe for stablecoins that lets any company accept, convert, and settle in stablecoins without touching a blockchain, plus the treasury/FX/compliance middleware that makes CFOs comfortable. The agentic wedge is the sharpest of all: stablecoins are the only rails an autonomous agent can actually hold and spend. When millions of agents start transacting — buying data, compute, and services from each other in sub-cent increments — they will not open bank accounts or hold Visa cards. They will hold programmable dollars. The company that becomes the wallet-and-settlement layer for agent-to-agent commerce is underwriting a machine economy that doesn’t exist yet but is arriving fast.

Signal — startups & scaleups to watch:

• Circle — USDC issuer, now public

• Tether — largest stablecoin issuer

• Stripe — payments giant, stablecoin push

• Bridge — stablecoin orchestration (Stripe-owned)

• Privy — embedded wallet infrastructure

• BVNK — stablecoin settlement rails

• Sphere — global stablecoin payments API

• Mesh — crypto payments network

• Paxos — regulated stablecoin infrastructure

• Zero Hash — embedded crypto/stablecoin rails

• Fireblocks — digital-asset custody and infra

• Ripple — RLUSD, cross-border settlement

• Coinbase — exchange, USDC co-issuer

• Ondo Finance — tokenized treasuries

• Agora — white-label stablecoins (AUSD)

• Catena Labs — AI-agent-native financial institution

• Conduit — stablecoin cross-border payments

• Brale — stablecoin issuance platform

• Rain — stablecoin-powered card issuing

• Skyfire — agent identity and payments

• Payman — agent-controlled payments

• Crossmint — agent wallets and payments

34. AI-native financial services (AI CFO, AI underwriting)

The shift: Finance functions built as workflows for humans to operate are being rebuilt as agents that operate the function. The AI CFO doesn’t dashboard your numbers — it closes the books, forecasts, flags anomalies, and drafts the board deck. AI underwriting doesn’t score an application — it reads the full evidentiary record and issues the decision.

Why now: Financial work is the ideal agent substrate — structured, text-and-number heavy, auditable, and expensive per hour. Models crossed the reliability bar for multi-step reconciliation and document reasoning in 2024–2025, and the data (ledgers, bank feeds, invoices) is already digital and API-accessible via Plaid-style connectivity. Underwriting in particular is a decision with a clean feedback loop, which is exactly where AI compounds.

Why it’s a startup goldmine: This is a payroll-sized TAM, not a software-sized one. A finance team is a $500k–$5M/year cost centre; an AI CFO priced at a fraction of that with agent-level throughput is an obvious buy, and the buyer measures value in heads not saved but redeployed. Underwriting is even sharper — faster, cheaper, and more accurate decisions directly expand a lender’s approvable population and cut loss rates, so the vendor can price on outcomes (basis points of loans underwritten) rather than seats. That is the durable moat: an underwriting agent that sees more loans gets better at pricing risk, which wins more lenders, which feeds it more loans — a data flywheel that compounds and cannot be bought off the shelf. Defensibility beyond the flywheel: owning the system of record, the audit trail, and the regulatory sign-off that a bank’s risk committee will actually accept.

Where the opening is: Vertical, liability-bearing agents that own one financial job end-to-end — an AI controller for SMBs, an AI underwriter for a specific asset class (SMB loans, insurance, trade credit), an AI FP&A analyst — priced as labour and standing behind their output. The winning wedge is the unglamorous, high-frequency, rules-heavy job that a mid-market company currently staffs with two or three analysts: monthly close, invoice reconciliation, expense audit, credit decisioning. Start where the ground truth is machine-checkable and the mistakes are recoverable, earn the right to the judgment calls, and expand outward from the ledger you now own.

Signal — startups & scaleups to watch:

• Ramp — spend into autonomous finance ops

• Brex — corporate cards and finance ops

• Basis — AI accounting agents

• Puzzle — AI-native accounting

• Zest AI — AI credit underwriting

• Upstart — AI lending marketplace

• Concourse — AI agents for finance teams

• Rillet — AI-native ERP

• Casca — AI loan origination

• Digits — AI accounting automation

• Pilot — bookkeeping and finance ops

• Truewind — AI bookkeeping and close

• Numeric — AI-assisted accounting close

• Taktile — automated credit decisioning

• Ocrolus — document automation for lending

• Vic.ai — AI accounts-payable automation

• FloQast — accounting close automation

• Trullion — AI accounting and audit

35. Embedded finance & B2B payments

The shift: Financial products stopped being things you go to a bank for and became features embedded inside the software you already use to run your business. The vertical SaaS you use for your dental practice or trucking fleet now issues the cards, extends the credit, and moves the money — and captures the economics.

Why now: BaaS infrastructure matured past its 2023 compliance reckoning; the survivors (properly bank-partnered, KYC-native) made it genuinely turnkey to embed accounts, cards, and lending without a startup having to become a chartered bank. Simultaneously, B2B payments — still shockingly stuck on paper checks and ACH in the US, where roughly a third of business payments still move by check — became the last giant analog flow ripe for software, and AI finally made invoice-to-pay automation actually work end-to-end rather than dumping edge cases back on a human. The two trends reinforce: once a vertical platform moves the money, automating the accounting on top of it becomes trivial.

Why it’s a startup goldmine: Embedded finance can 2–5x the revenue-per-customer of a vertical SaaS company, turning a $200/month tool into a $1,000/month payments-and-lending relationship — the highest-leverage business-model unlock in software. B2B payments is a multi-trillion-dollar flow with take-rate economics attached. Defensibility comes from owning the workflow the money flows through (the system of record) plus the compliance and risk infrastructure that’s genuinely hard to build.

Where the opening is: Two wedges. First, be the embedded-finance infrastructure for a specific vertical where generic BaaS is too generic (construction, healthcare, logistics have unique money-movement needs). Second, attack B2B accounts-payable/receivable with AI agents that read invoices, reconcile, and initiate payment — the “AP is now autonomous” pitch.

The deeper play is to combine both: a vertical software company that lands with a workflow, then embeds the money movement, then automates the AP/AR with agents — each layer raising switching costs and net revenue retention.

Signal — startups & scaleups to watch:

• Stripe — payments platform layer

• Adyen — global payments platform

• Ramp — corporate cards plus AP

• Mercury — startup banking stack

• Parafin — embedded lending infrastructure

• Pipe — embedded capital for platforms

• Toast — restaurant embedded finance

• Squire — barbershop embedded payments

• Unit — banking-as-a-service

• Marqeta — card issuing platform

• Modern Treasury — payment operations

• Melio — SMB B2B payments

• BILL — AP/AR automation

• Tipalti — payables automation

• Highnote — embedded card issuing

• Lithic — card issuing API

• Increase — banking API

• Column — bank infrastructure

• Treasury Prime — banking-as-a-service

• Finix — payment processing infrastructure

• Slope — B2B payments and BNPL

• Settle — AP plus working capital

• Rainforest — embedded payments for software

36. Emerging-market fintech & financial inclusion

The shift: The next billion financial customers are being onboarded mobile-first, cash-out, and leapfrogging the entire branch-banking era — the way they leapfrogged landlines for mobile. The bank branch is being skipped, not digitized.

Why now: Smartphone penetration and cheap data crossed the threshold across Latin America, Southeast Asia, Africa, and India simultaneously. Public digital-payment rails — India’s UPI, Brazil’s Pix, and their imitators now spreading across Africa and Asia — created instant, free, interoperable money movement that private incumbents in the West still lack, giving builders a public rail to innovate on top of the way US fintechs once built on ACH but faster and cheaper. Stablecoins add a dollar-access layer where local currencies are unstable, letting a Nigerian or Argentine hold and transact in dollars from a phone. And AI slashes the cost of serving low-ARPU customers profitably — support, underwriting, and fraud that were uneconomic to staff for a $3/month customer become viable when an agent handles them, which is what finally makes the bottom of the pyramid a real business rather than a development project.

Why it’s a startup goldmine: Billions of underbanked people and tens of millions of underserved SMBs represent a greenfield of the size the West saw a century ago — but compressed into a decade. Because there’s no legacy to rip out, unit economics can be structurally better than incumbents from day one. Nubank proved a fintech can reach 100M+ customers and serious profitability in this terrain. Defensibility: distribution, local trust and compliance, and the low-cost-to-serve model AI enables.

Where the opening is: SME banking and credit in specific markets (the underbanked-business gap is even wider than the consumer one), remittances and dollar-access rebuilt on stablecoins, and cross-border commerce infrastructure for the region-to-region trade the West ignores.

The pattern to copy from Nubank: pick a market where incumbents are lazy, expensive, and hated; enter with one wedge product (a fee-free card, a merchant account); use radically lower cost-to-serve to grow virally; then cross-sell the full financial stack once you own the relationship and the data.

Signal — startups & scaleups to watch:

• Nubank — LatAm neobank archetype

• Mercado Pago — LatAm payments giant

• Flutterwave — African payments infrastructure

• Moniepoint — Nigerian business banking

• Wave — West Africa mobile money

• Chipper Cash — pan-African payments

• OPay — Nigerian fintech super-app

• PalmPay — Nigerian payments app

• Kuda — Nigerian neobank

• Ualá — Argentine neobank

• Clip — Mexican payments

• Konfío — Mexican SME lending

• dLocal — emerging-market payments

• Bitso — LatAm crypto exchange

• Yellow Card — African stablecoin rails

• Tala — emerging-market credit

• Belvo — LatAm open finance

• Pomelo — LatAm card infrastructure

• Djamo — Francophone Africa neobank

• LemFi — immigrant remittances

• TymeBank — South African digital bank

37. Cybersecurity for the AI era

The shift: The attack surface and the attacker both changed. AI lets adversaries generate exploits, phishing, and polymorphic malware at machine scale — and every AI application a company deploys is itself a new, poorly-understood attack surface. Security has to defend at machine speed against machine-speed attacks.

Why now: Two curves crossed. Offense got cheap — an attacker with an LLM runs personalized, adaptive campaigns that used to require a team, and the volume of machine-generated phishing and exploit code jumped an order of magnitude. And defense got a new frontier — prompt injection, model exfiltration, poisoned training data, and agent hijacking are live threats with no mature tooling and no established playbook. Boards that treated AI security as theoretical in 2024 saw real incidents in 2025, and the asymmetry is brutal: defenders still operate at human speed against attacks that now scale like software, which is precisely why defense itself has to become autonomous.

Why it’s a startup goldmine: Security spend is non-discretionary and grows with every new surface, and AI just minted two of them (AI-powered attacks, and securing AI itself). Wiz’s $32B exit to Google shows the ceiling. The pricing unlock is that AI-native defense can be sold as an autonomous SOC analyst — outcome-priced labour replacing a $150k security hire — rather than another dashboard. Defensibility: proprietary threat data, the model tuned on it, and deep integration into the customer’s stack.

Where the opening is: The autonomous SOC (agents that triage, investigate, and remediate alerts end-to-end), and the entirely new category of AI application security — scanning for prompt injection, testing agents adversarially, and runtime-monitoring what deployed models actually do.

The structural tailwind: as companies deploy their own agents, every one of those agents is a new privileged insider that can be socially engineered, prompt-injected, or turned into an exfiltration vector — so the security budget grows in lockstep with the agent rollout it is meant to protect.

Signal — startups & scaleups to watch: