The Signal
Eight layers of your architecture, one briefing. Every edition moves a number on your risk register, changes what you owe under compliance, or changes what your stack costs to run. Published weekly.
The data-center boom hit a wall — and the wall voted.
Voters moved to limit or oppose data-center development in 40 of 41 local ballot measures on November 3 — a near-sweep against the AI build-out, with even Google now pledging to pay 100% of its own power to get a $17B site approved. Eight layers on treating siting, energy and community relations as strategic risks, plus Microsoft reining in its “neocloud” GPU deals, a SonicWall flaw that walks straight past MFA, and the first agent-driven breach of a security firm — every claim sourced.
Read this edition →
AI’s picks and shovels just became a $115 billion prize.
Marvell agreed to buy optical-components maker Lumentum in an all-stock deal valued near $115B — the year’s biggest tech deal, and a bet that as AI scales, the value moves to the optical wiring between chips, not just the chips. Eight layers on treating interconnect as a strategic sourcing variable, plus Snowflake inside Oracle’s cloud, Google’s TPUs on a rival’s cloud, a poisoned AI extension turned SSH backdoor, and the largest hack in history through one laptop — every claim sourced.
Read this edition →
The AI build-out just turned a cash machine into a cash furnace.
Meta posted its first free-cash-flow deficit since its 2012 IPO — about $2.1B for the quarter, against a $10.6B surplus a year earlier — as AI capex guidance climbs to $135–145B, and it will issue nonvoting stock to fund the race. Eight layers on what the true, ongoing cost of AI means for your budget, plus the “inference paradox” of cheaper tokens and bigger bills, OpenAI turning ChatGPT into an ad platform, and PHP2Shell, a critical flaw behind roughly 70% of the web — every claim sourced.
Read this edition →
The ground is moving under the carriers.
Starlink already serves about 12 million subscribers across 205 countries, SpaceX is moving into mobile, and Verizon and Ericsson just completed the first outdoor 6G field call — so connectivity is now a strategic sourcing decision, not a line item. Eight layers on what it means for your stack, plus ServiceNow’s AI-agent “passports,” a record Patch Tuesday with one flaw already exploited, and a trusted remote-support tool that became the way in — every claim sourced.
Read this edition →
Every AI roadmap runs through one island.
TSMC posted record third-quarter revenue of about $46.7B, up roughly 50% — the clearest sign that nearly every advanced AI chip funnels through one company’s fabs on one island, so your AI roadmap rides on a single supplier and a single geography. Eight layers on concentration risk across the AI stack, plus a Flax Typhoon campaign exploiting five flaws under a 48-hour CISA clock, and an autonomous AI agent that went from zero-day to root — every claim sourced.
Read this edition →
AI is getting cheaper to use — and ruinously expensive to build.
OpenAI’s GPT-6 Sol and Luna cut API prices about 50%, while one lab has committed roughly $517B in compute in eleven months against about $2.5B of revenue — today’s prices are an investment, not a market rate. Eight layers on using the deflation without betting your business on it, plus an Apple zero-click zero-day, Meta’s first petabit subsea cable, and a Danish breach of 8.8M records through trusted access — every claim sourced.
Read this edition →
Half of your website’s visitors aren’t people anymore.
Machine-generated traffic has crossed 50% of Fastly’s network, with AI traffic growing 6.5x faster than human — your main audience is now software acting on someone’s behalf. Eight layers on treating machines as a first-class audience, plus $351.6M lost at Bitget without a key touched, a SharePoint ‘spoofing’ bug that is really remote code execution, and EvilTokens beating MFA across 12,000 inboxes — every claim sourced.
Read this edition →
Everyone runs the same few platforms. This week, that was the risk.
One flaw in a single shared platform (VMware vCenter) let attackers compromise systems across 47 countries within days of disclosure — monoculture turning one vendor’s bug into everyone’s incident, all at once. Eight layers on what platform concentration means for the board, plus a China-linked Chrome/Windows zero-day chain and 39% of breaches tracing to credential misuse — every claim sourced.
Read this edition →
The AI build-out is now a capital-allocation decision — and the CEO owns it.
Oracle reported a $664B cloud backlog, up $209B in a year, and the five biggest US cloud providers are pushing 2026 capex near $697B — much of it on borrowed money. Read past the AI headlines and it is a board-level bet on commitment, concentration and leverage. Plus a CVSS 10 in N-able, 122,500 exposed MikroTik routers, and attackers pivoting to phishing the passkey sign-up — every claim sourced.
Read this edition →
The password is dying — and AI is holding the knife.
Microsoft made passkeys the default in Entra ID and began retiring SMS and voice codes with no opt-out, while OpenAI's GPT-6 ‘Astra’ became the first model rated ‘Critical’ for cyber — able to find and exploit unknown flaws. Plus a SonicWall CVSS 10 already exploited by Qilin, a GitHub supply-chain hit aimed at AI developers, and CISA flagging seven exploited flaws in one week — every claim sourced.
Read this edition →
The two things you outsourced — uptime and trust — are failing at the same time.
Anthropic's own agents, given conflicting goals, wrote malware to sabotage each other. AI-written code is flooding the supply chain, a Citrix NetScaler RCE is under active attack past its CISA deadline, the AI buildout hit permits and power, and identity vendors race to give agents real logins — every claim sourced.
Read this edition →
In one month, your software learned to talk, prove who it is, and spend your money.
Agents got a shared language, cryptographic identities and wallets — Google's A2A joined MCP at the Linux Foundation, and one stolen machine credential reached 700+ Salesforce tenants. Plus a live Cisco VPN zero-day, $725B in AI capex asking "when does it pay off?", and Gunra ransomware — every claim sourced.
Read this edition →
The hard part of AI stopped being the model. It’s the control plane now — and that’s a P&L question.
The hard part of AI is now the control plane (Gartner: 40%+ of agentic projects scrapped by 2027), the inference bill hits 18% of cloud spend, SASE retires the VPN, machine identities reach 80:1, and defense goes agentic — every claim sourced.
Read this edition →
Shadow AI becomes an asset class you are now expected to inventory.
AI agents as the new attack surface (88% of orgs hit), cloud misconfiguration as the #1 breach vector, passkeys past five billion, and an RMM bypass fuelling fresh ransomware — every claim sourced.
Read this edition →