Breaking Analysis with Dave Vellante

Backup and recovery evolved into data protection then security, cyber recovery and now business resilience. The scope continues to expand and now includes how attackers use AI; and how defenders can leverage AI to better protect their assets. In our new field research with our partner Qualitate, we explored a number of issues, including one of the less frequently discussed risks around what happens when the AI inside an enterprise makes a mistake. Broadly, our research indicates that confidence in recovery is running well ahead of capabilities. Our field work underscores the immaturity of cyber resilience and AI security and specifically, how agentic AI is putting more pressure on practitioners to not only secure their data but re-create an agent’s intent and confidently recover the state of a business.

The AI buildout is making an enormous bet on what businesses will eventually be
willing to pay for intelligence. In our research this summer on Forecasting the
AI Bubble, we argued that a key indicator to watch is productive utilization by
enterprise customers. Specifically, we said if infrastructure supply catches up
before productive monetization materializes, the risk of a bubble pop increases
to dangerous levels. We forecast that supply constraints and healthy capital
funding appetites could provide the conditions for a “soft landing” and we
pegged 2029 as the high risk year. That brings us to the next obvious question:
what has to happen inside mainstream enterprises for their AI investments to
become economically self-funding? Michael Burry’s analysis of Anthropic
highlights the scale and interconnected nature of the commitments. Apollo’s
research by Torsten Slok raises questions about how broadly the financial
benefits are showing up today. And the history of the PC and internet eras
reminds us that productivity gains are not immediate - and that powerful
technology can coexist with what initially seem to be poor investment returns
that take time to appear.

In Breaking Analysis 322, we shared with you that our forecast of a $1T silicon business arrived 2 years earlier than we had forecast. The reason for our twenty-four month miss was the bottleneck had moved from GPUs to memory. Micron gave us a remarkable datapoint in its FY Q3: DRAM prices rose by more than sixty percent sequentially in the quarter, while the number of bits shipped barely grew. Today we address what that means. The key questions are: Is this temporary scarcity or a structural change in the economics of memory? We believe both forces are at work. This week we participated in a Webcast with Micron President and Chief Technology and Products Officer, Scott DeBoer. The roadmap he showed us underscores the importance of memory with respect to AI performance. New customer take or pay agreements change how risk is shared. At the same time, customers are being forced to adapt to higher costs. Qualitate’s proprietary research gives us a window into those decisions. Our question is whether these changes can make memory less cyclical, and what evidence would tell us that the familiar cycle is returning.

ServiceNow is making one of the more consequential and visible bets in enterprise AI. The company says AI Control Tower can discover and govern any agent, work across models and clouds, track cost and value, and shut down behavior that violates policy.
That sales pitch plays directly to ServiceNow's greatest asset – its installed base. ITSM, CMDB, risk workflows, security operations and years of operating context give the company a distribution and data advantage most AI governance vendors do not have.
Our research suggests that moat is real. But proprietary customer data shows a more nuanced picture. Control Tower is already strong as a governance workflow and system of action. It can inventory AI assets, connect risks to owners, route approvals and remediation, and preserve an audit trail.
What the field has not broadly validated is the claim that Control Tower is a complete technical governance and runtime enforcement plane across the heterogeneous enterprise.

In this week’s episode, we explore the AI control gap and the starting point for addressing AI safety, namely alignment. We question prevailing narratives and propose a public policy regime that has more teeth than what has been put forth thus far.