On my way to SF for another fun and intense week at RSA. So looking forward to it with our annual Sunday night kick off event with portfolio companies Keycard AI, Surf AI, and Gain Security and also pumped to be a cosponsor for the Piper Event on Monday with Nikesh from Palo Alto Networks as the keynote speaker.

For the Sunday night kickoff event, we have 3 spots open for those interested…click below to get on the list…

In advance of the week, I wanted to share a couple of big launches from the portfolio with:

• Surf AI emerging from stealth with $57M to build the agentic operating model for security operations – ties directly to my Execution Intelligence Layer theme I wrote about a few months ago

• Keycard launched Keycard for Coding Agents – replacing god mode access with scoped, short-lived credentials and real governance for AI tools like Claude Code and Cursor.

Needless to say, these are massive problems CISOs are facing as agents proliferate across their enterprises. I look forward to going deeper on the sights and sounds of RSA in next week’s issue.

But here’s the tension: we simply have way too many cybersecurity companies right now. And it’s about to get worse. Every platform vendor is adding security features. Every security vendor is expanding into adjacent categories. The capital pressure alone forces it – raise at a massive valuation and you must go multiproduct to justify it. And the cost to do so has never been lower.

Zooming out, this isn’t just a cybersecurity problem. When the cost to add a new feature or go multiproduct is near zero, everyone ends up competing with everyone else. Lovable went from app builder to data science, marketing, and decks overnight.

I’m calling it The Law of Agent Cannibalism 👇🏻

And as every company goes multiproduct, here’s the enterprise consequence: why sign up for a 3-year contract when an adjacent company is creeping into your vendor’s market?

As carrynointerest puts it:

If you look like Rippling, and you have a very talented group of people like their employees, they can attack so many parts of the HR platform space now that they simply couldn’t 3 years ago.

That’s a lot scarier than vibe coding, than somebody just whipping up [a clone] and going out with a bunch of cold emails. It’s the adjacency threats in the market map. Because now, who’s Rippling going to go after?

As always, 🙏🏼 for reading and please share with your friends and colleagues!

Scaling Startups

#👀 priced to perfection…those were the days

#how to make an amazing launch video

#💯

#narratives matter – a16z hiring a partner for storytelling to LPs 👀

#revisiting theme of last couple weeks

Enterprise Tech

#exactly what I’m hearing from my conversations with F500 tech leaders

#been writing about the execution intelligence layer and how context is king – super pumped about port co Surf AI coming out of stealth with $57M of initial funding from Accel who led the Series A and my firm boldstart ventures and Cyberstarts co-leading the Inception round – this is a huge idea – i share some of the “what we saw” from our first meeting and why I’m so excited…watch the product video 👇🏻

#wrote about this last week but enterprises need an easy button for agents and while Anthropic is amazing, open, private, secure and customizable on-prem is also needed – so 🔥 up for this and more importantly how founders can leverage this ecosystem

#fake it till you make it until you get called out as fraudulent? turns out when things sound too good to be true, well, they usually are

#to an extent – question is what’s the ROI from this versus hiring X more number of people, how fast you can ship a new product…going to need some serious monitoring tools to cap token consumption

#huge launch out of Keycard in advance of RSA.

#turns out focus matters…Anthropic crushing with maniacal focus on coding and business, OpenAI fighting wars on too many fronts

#yes more security issues as agents proliferate in the wild

#Stitch is really good – been playing around with how to update our website – and as Sheel pointed out, Figma took another hit, down 8% on day of release

#if skills.md codify how your company operates, then will need this as well – so much scaffolding to build (see last week’s newsletter as well) from package management, collaboration with humans and AI, vuln scans, version control…

#how it’s done at Uber from its CTO

#you can’t change culture with just layoffs, need AI driven leadership as well – 🔑 point

CTO Rajeev Rajan is out (no comment yet), and in his place, they’ve split the role between two CTOs. Atlassian described them as next generation AI talent.

#💯 2nd derivative of AI generated code…

#Cursor has own model…well built on top of open source Kimi – if Cursor can raise a new round at $50B with open source at its foundation, then what else can people build? great to see – one point though – they should have given Kimi props from beginning

Markets

#AI credit bubble?

#👀

#🎯