a16z's "Patch or Die" memo: every AI agent is an insider threat
a16z Newsletter · rss · 2026-10-23
a16z's "Patch or Die" Security Memo
a16z's infra team sent portfolio company CEOs a memo on the current cybersecurity emergency. Core thesis: vulnerabilities are being discovered and exploited at an unprecedented rate, and AI agents adopted at scale multiply the risk—every agent is an insider threat, since environments are built to withstand outside attacks, not attacks from within.
Recommendations for leadership
- Double security spend: enterprises allocate 10% of tech spend to security on average; double it. Security through obscurity no longer works
- Zero tolerance for new features: re-examine launch schedules; delay releases until vulnerabilities are patched
- Double-tap the zombies: shut down neglected labs, test environments, and zombie CI/CD projects not tied to revenue
- End risk acceptance: over 10 years it has morphed from enabling the business into justifying never fixing issues
- Scale agents, not people: the threat moves at machine speed; push security teams to automate detection and response
More from Companies & People
- AI hiring cools: PhD with six top papers gets only 5-6 offers from 20+ firms — dotey · 2026-10-23
- Investor Angela joins FirstMark to lead growth investing strategy — mattturck · 2026-10-23
- Chris Lattner announces new alliance to push open, community-driven AI compute ecosystem — clattner_llvm · 2026-10-23
- CIO survey: 54% of firms deployed AI without any ROI tracking — BenBajarin · 2026-10-23
- How Vercel used AI to turn its entire brand design team into Creative Engineers — evilrabbit_ · 2026-10-23
- Supabase uploads all Select 26 talks, starting with the cofounders' keynote — dshukertjr · 2026-10-23