Latest / DX Today | No-Hype Podcast & News About AI & DX / Executive Briefing: ADT Buyout, Agent Code, UK Grid Pact, VAPOR PANDA
Transcript
- 0:00SPEAKER_00: Welcome to the DX Today Executive Briefing.
- 0:02SPEAKER_00: Today is Friday, October 30th, 2026.
- 0:06SPEAKER_00: I'm Elena, and this is the show where we take the Tuesday and Friday edition of the DX Today newsletter and go deep on every story.
- 0:13SPEAKER_00: So the leaders who make AI decisions walk away knowing what changed and what to do about it.
- 0:19SPEAKER_01: And I'm Marcus.
- 0:20SPEAKER_01: My job is to ask the Monday morning question.
- 0:23SPEAKER_01: Once the headline fades, who in your organization owns this?
- 0:26SPEAKER_01: What breaks when it scales?
- 0:28SPEAKER_01: And what should you be asking your vendors before you sign anything?
- 0:32SPEAKER_00: And this edition gives us plenty to work with.
- 0:34SPEAKER_00: The newsletter opens with the line, I want to read, because it frames the whole hour.
- 0:38SPEAKER_00: And I'm quoting the edition here.
- 0:40SPEAKER_00: The common thread is that AI has stopped being a feature and started being an operating model for buyers, builders, governments, and adversaries alike.
- 0:50SPEAKER_01: That is a big claim for a Friday morning.
- 0:52SPEAKER_01: Buyers, builders, governments, and adversaries.
- 0:56SPEAKER_01: So we have four stories, and I assume one of each.
- 0:59SPEAKER_00: Exactly one of each.
- 1:01SPEAKER_00: And that is what makes this edition so tidy.
- 1:03SPEAKER_00: First, the buyers.
- 1:04SPEAKER_00: Thrive Holdings, an AI-focused holding company backed by OpenAI, has agreed to take ADT private in a deal with an enterprise value of$15.3 billion.
- 1:16SPEAKER_00: Second, the builders.
- 1:17SPEAKER_00: GitHub published its Octoverse 2026 report.
- 1:20SPEAKER_00: And it says agents now start more than 40% of pull requests on the platform.
- 1:25SPEAKER_00: GitHub also launched something called Copilot Fusion, which routes coding work across multiple models.
- 1:32SPEAKER_01: And I already have questions about the 40%.
- 1:34SPEAKER_01: Keep going.
- 1:35SPEAKER_00: Third, the governments.
- 1:36SPEAKER_00: The United Kingdom published its data center covenant, which trades faster access to the electricity grid for commitments on efficiency, community benefit, and security.
- 1:46SPEAKER_00: And fourth, the adversaries.
- 1:48SPEAKER_00: CrowdStrike exposed a China Nexus actor that calls Vapor Panda, which used an agenic framework called RTEx to target more than 200 organizations in about 11 days.
- 2:13SPEAKER_01: That is not a pilot program anymore.
- 2:15SPEAKER_00: That is the newsletter's point, almost word for word.
- 2:18SPEAKER_00: It says the last few days delivered a clear message to anyone still treating AI as a pilot program.
- 2:24SPEAKER_00: We will take the stories in the editions order.
- 2:27SPEAKER_00: We will pull out the strategic takeaway for each one, and then we will connect them through the edition's bottom line.
- 2:33SPEAKER_00: We will finish with what to do this week and what to watch.
- 2:36SPEAKER_01: And I will push back where I think the hype is running ahead of the evidence.
- 2:41SPEAKER_01: Fair warning.
- 2:42SPEAKER_00: I would expect nothing less.
- 2:44SPEAKER_00: Let's start with the deal.
- 2:46SPEAKER_00: On October 29th, 2026, ADT announced it had agreed to be acquired by Thrive Holdings.
- 2:53SPEAKER_00: The terms are$10 per share in cash.
- 2:56SPEAKER_00: That works out to an equity value of about$7.6 billion and an enterprise value of$15.3 billion.
- 3:04SPEAKER_01: And the number I would anchor on is the enterprise value, because that is the size of the whole business changing hands.
- 3:10SPEAKER_01: This is a bet of about$15 billion, not seven.
- 3:14SPEAKER_00: That is a fair way to put it.
- 3:17SPEAKER_00: And the premium is the part that caught my eye.
- 3:20SPEAKER_00: According to ADT's own release, the price represents a 45.6% premium to the company's unaffected closing price of$6.87 on October 27, 2026.
- 3:33SPEAKER_00: And it is a 52.1% premium to the 30-day volume-weighted average price.
- 3:39SPEAKER_01: A premium of nearly half.
- 3:41SPEAKER_01: That is not a buyer haggling over a mature asset.
- 3:45SPEAKER_01: That is a buyer who thinks they can see something the public market was not pricing in.
- 3:49SPEAKER_00: And the thing they think they can see is AI.
- 3:53SPEAKER_00: That is what makes this different from a conventional take private.
- 3:56SPEAKER_00: As TechCrunch reported, Thrive Holdings is a spin-out of Josh Kushner's venture firm, Thrive Capital.
- 4:03SPEAKER_00: And OpenAI is both its partner and an investor.
- 4:07SPEAKER_00: OpenAI supplies AI models, technology, and forward-deployed engineers to Thrive's companies.
- 4:13SPEAKER_01: Forward-deployed engineers is the phrase I want people to notice.
- 4:17SPEAKER_01: That is not a software license.
- 4:18SPEAKER_01: That is engineers sitting inside the operating companies, rebuilding how the work gets done.
- 4:24SPEAKER_01: It is closer to a consulting model with a model provider attached.
- 4:29SPEAKER_00: And TechCrunch's earlier reporting adds some background on the relationship.
- 4:33SPEAKER_00: OpenAI took an ownership stake in Thrive Holdings in December 2025, and Thrive Holdings raised$2 billion at a$12 billion valuation in August 2026.
- 4:45SPEAKER_01: So the holding company itself is valued at$12 billion, and now it is buying a business with an enterprise value above that.
- 4:52SPEAKER_01: That is a step change in ambition.
- 4:55SPEAKER_00: It is, and the addition makes the size of the jump clear.
- 4:59SPEAKER_00: The playbook so far has focused on professional services.
- 5:03SPEAKER_00: According to TechCrunch, Thrive Holdings accounting platform called Current has more than 50 firms and over 2,000 professionals.
- 5:12SPEAKER_00: Its IT platform called SHIELD has around 20 companies.
- 5:16SPEAKER_01: And then ADT, which is a household name in home security.
- 5:20SPEAKER_00: The company's release says ADT has more than 12,000 employees.
- 5:24SPEAKER_00: And ADT says it will form the foundation of Thrive Holding's smart home security business.
- 5:30SPEAKER_00: So we are going from accounting practices and IT shops to a large consumer-facing brand.
- 5:37SPEAKER_01: Here is where I want to test the thesis.
- 5:40SPEAKER_01: Accounting firms and IT service shops are knowledge work.
- 5:44SPEAKER_01: You can see how AI changes the economics there.
- 5:48SPEAKER_01: Drafting, reconciliation, ticket handling, documentation.
- 5:52SPEAKER_01: Home security, as I think about it, involves a lot of physical work in the field.
- 5:58SPEAKER_01: How much of a 12,000-person workforce is actually exposed to the kind of change that justifies a premium of 45%?
- 6:07SPEAKER_00: That is the right question.
- 6:08SPEAKER_00: And I will give you the strategist's answer.
- 6:11SPEAKER_00: My reasoning is that a security company is not only field work.
- 6:16SPEAKER_00: I would expect monitoring, customer service, sales, scheduling, and billing to be high-volume, repeatable workflows.
- 6:23SPEAKER_00: And that is exactly where an AI operator would look for margin.
- 6:27SPEAKER_00: But I will grant you that the addition does not tell us which parts of the business Thrive plans to change.
- 6:33SPEAKER_01: And that is my point.
- 6:35SPEAKER_01: TechCrunch noted that neither company announced specific new AI-powered security products as part of the deal.
- 6:41SPEAKER_01: So the market is being asked to pay for a transformation that has not been described yet.
- 6:47SPEAKER_00: True, but buyers rarely publish their value creation plan on announcement day.
- 6:53SPEAKER_00: I would read the silence as normal deal discipline rather than an absence of a plan.
- 6:59SPEAKER_00: Where I think the addition is most useful is on the money behind it.
- 7:03SPEAKER_00: ADT describes the deal as all cash with no financing condition, and says the financing commitments come solely from funds managed by affiliates of Apollo Global Management.
- 7:14SPEAKER_01: Private credit.
- 7:18SPEAKER_00: The newsletter does too.
- 7:19SPEAKER_00: Its reading is that private credit is now underwriting the thesis that AI can lift the economics of a mature services business enough to justify a premium of this size.
- 7:30SPEAKER_00: In other words, the people lending the money believe the AI story enough to put their capital behind it.
- 7:37SPEAKER_01: Or they believe in the cash flows of a subscription security business and the AI story is the cherry on top.
- 7:44SPEAKER_01: Lenders are not romantics.
- 7:46SPEAKER_01: I would want to know how much of the underwriting is the existing recurring revenue and how much is the transformation.
- 7:53SPEAKER_00: That is a fair caution, and nothing in the edition settles it.
- 7:57SPEAKER_00: What the edition does say is that there are still open questions.
- 8:00SPEAKER_00: ADT's board of directors unanimously approved the agreement, but the transaction requires ADT stockholder approval and United States antitrust approval.
- 8:10SPEAKER_00: And it is expected to close in the first quarter of 2027.
- 8:14SPEAKER_00: After that, ADT stock will stop trading on the New York Stock Exchange.
- 8:18SPEAKER_00: And there is a GoShop?
- 8:20SPEAKER_00: There is.
- 8:20SPEAKER_00: ADT has a 30-day GoShop period during which it may solicit competing acquisition proposals.
- 8:26SPEAKER_00: The addition notes that leaves a window for arrival bid.
- 8:29SPEAKER_01: Which is worth watching because if another buyer shows up, that tells you the AI thesis is not unique to Thrive.
- 8:37SPEAKER_01: If nobody shows up, it tells you Thrive is paying for something only Thrive thinks it can do.
- 8:43SPEAKER_00: That is a neat way to frame it.
- 8:45SPEAKER_00: Now the issue I think matters most for everyone outside the deal is data.
- 8:50SPEAKER_00: ADT says its data and privacy policies will remain unchanged, and that no new data sharing will occur without customer permission.
- 8:59SPEAKER_01: And this is where I get uneasy in a constructive way.
- 9:02SPEAKER_01: A home security network sits inside people's homes.
- 9:06SPEAKER_01: I would count that among the most sensitive kinds of data a company can hold.
- 9:24SPEAKER_00: So the commitment is not a footnote.
- 9:26SPEAKER_00: It is going to be tested.
- 9:35SPEAKER_01: The cleanest AI gains might come from using that data.
- 9:39SPEAKER_01: And the promise says you cannot without permission.
- 9:42SPEAKER_01: How Thrive handles that tension will tell us a lot about whether this model works with consumer brands at all.
- 9:48SPEAKER_00: And the edition names the people whose execution we should watch.
- 9:52SPEAKER_00: Jim DeVries, ADT's chairman, president, and chief executive officer, and the Thrive Holdings partners Karim Zaki and Anoj Menderah.
- 10:02SPEAKER_00: The edition says their execution over the next several years will show whether the AI holding company model can scale from accounting practices and IT shops to an established security brand with a large workforce.
- 10:24SPEAKER_00: Agreed.
- 10:25SPEAKER_00: So let's get to the strategic takeaway, which the edition addresses to CEOs, CFOs, and corporate development leaders.
- 10:34SPEAKER_00: The headline is a sentence I keep coming back to, and I'm quoting the addition here.
- 10:39SPEAKER_00: AI is no longer only a tool you buy, it is becoming a reason someone else buys you.
- 10:46SPEAKER_01: That is a sharp line and a little uncomfortable if you run a mature services company.
- 10:52SPEAKER_00: It is meant to be uncomfortable.
- 10:54SPEAKER_00: The addition's argument is this: if an AI-backed holding company with private credit behind it can pay a 45.6% premium for a mature services business, boards in similar sectors should assume their cost structures are being modeled by outside buyers right now.
- 11:13SPEAKER_01: And the advice is to do that modeling yourself before someone else does it for you.
- 11:20SPEAKER_00: Run that analysis first.
- 11:22SPEAKER_00: Identify where AI could change margins in your own operations, and decide whether you will capture that value yourself or leave it on the table for an acquirer.
- 11:32SPEAKER_01: I like that framing because it is a governance question, not a technology question.
- 11:37SPEAKER_01: The board does not need a demo, it needs a credible view of what its own business looks like with AI applied by someone motivated and well-funded.
- 11:45SPEAKER_01: If management cannot produce that view, an outside buyer will, and the shareholders will happily take the premium.
- 11:52SPEAKER_00: And I would add one wrinkle.
- 11:54SPEAKER_00: The premium in this deal is a signal of how much value the buyer believes is trapped inside the operating model.
- 12:01SPEAKER_00: If you are a CFO, that is a number you can use internally.
- 12:04SPEAKER_00: It tells you roughly how big the price might look to someone on the outside.
- 12:09SPEAKER_01: Fair, though I would caution against treating one deal as a price list for your sector.
- 12:15SPEAKER_01: Every business is different, and we do not know the details of Thrive's plan.
- 12:19SPEAKER_01: Use it as a prompt, not a benchmark.
- 12:22SPEAKER_00: That is a reasonable distinction, and I will take it.
- 12:25SPEAKER_00: Prompt, not benchmark.
- 12:27SPEAKER_01: Let's move to the builders, because this one lands directly on my side of the house.
- 12:33SPEAKER_00: The edition says the software development lifecycle passed a milestone this week.
- 12:38SPEAKER_00: At GitHub Universe on October 28, 2026, GitHub published its October 2026 report.
- 12:45SPEAKER_00: The headline figure is that more than 40% of pull requests in September 2026 began with an agent's first draft.
- 12:53SPEAKER_00: That is up from 17% in March 2026.
- 12:56SPEAKER_01: 17 to more than 40 in six months.
- 13:00SPEAKER_01: That is not a trend line.
- 13:02SPEAKER_01: That is a cliff.
- 13:57SPEAKER_01: Right.
- 13:57SPEAKER_01: But here is my second point, and it cuts the other way.
- 14:00SPEAKER_01: GitHub says the count is a floor.
- 14:03SPEAKER_01: So if anything, the real share of agent-started work is higher.
- 14:07SPEAKER_01: Which means my skepticism is about what the number measures, not about whether the shift is real.
- 14:12SPEAKER_01: The shift is real.
- 14:32SPEAKER_01: Those are numbers that only make sense at platform scale.
- 14:35SPEAKER_00: Aaron Powell And GitHub says it serves more than 225 million developers, including 38.3 million in the United States and 32 million in India.
- 14:45SPEAKER_00: On languages, TypeScript ranks first by monthly contributors, followed by Python and JavaScript.
- 14:52SPEAKER_01: The India number is worth a pause for anyone planning global engineering teams.
- 14:57SPEAKER_01: Close to the United States figure.
- 14:59SPEAKER_01: But let's get to the product, because copilot fusion is the part that changes buying decisions.
- 15:05SPEAKER_00: Alongside the data, Jay Parik, executive vice president of Core AI at Microsoft, announced Copilot Fusion, which the edition describes as a multiple model orchestration feature.
- 15:17SPEAKER_00: According to GitHub, Fusion assesses a task across reasoning, code generation, debugging, and tool use, then runs it across one or more models.
- 15:26SPEAKER_01: So instead of the developer choosing a model, the platform chooses step by step.
- 15:31SPEAKER_00: That is the idea.
- 15:33SPEAKER_00: And GitHub made a performance claim.
- 15:35SPEAKER_00: GitHub claims Copilot Fusion Max scored within two points of Opus 5.5 Max on the artificial analysis coding agent index at half the cost and with 40% less time per task.
- 15:48SPEAKER_01: And this is where I put my vendor hat on, or rather take it off.
- 15:53SPEAKER_01: Within two points, half the cost, 40% faster.
- 15:57SPEAKER_01: Every one of those is a vendor figure on a benchmark the vendor chose to highlight.
- 16:02SPEAKER_00: The edition says exactly that.
- 16:04SPEAKER_00: It calls them vendor figures and says engineering leaders should test them against their own workloads before rewriting budgets.
- 16:10SPEAKER_00: So you and the newsletter are in agreement.
- 16:31SPEAKER_00: Let me push on that a little though.
- 16:33SPEAKER_00: I think the more interesting point in this story is not the benchmark.
- 16:38SPEAKER_00: It is the behavior that came before the product.
- 16:41SPEAKER_00: GitHub's own data shows that in September 2026, 61% of co-pilot users who selected a model themselves used more than one model.
- 16:51SPEAKER_00: That is up from 50% four months earlier.
- 16:55SPEAKER_01: So developers were already doing this by hand.
- 17:05SPEAKER_00: Developers were already routing work across models by hand.
- 17:09SPEAKER_00: Fusion is GitHub's attempt to make that routing automatic and to own the decision layer that sits above any single model provider.
- 17:17SPEAKER_01: Own the decision layer.
- 17:19SPEAKER_01: That is the strategic sentence in this story.
- 17:21SPEAKER_01: Whoever decides which model runs each step controls the relationship with the developer and arguably controls a lot of the spending.
- 17:29SPEAKER_00: And that is why I think this matters beyond engineering.
- 17:32SPEAKER_00: If the routing layer becomes the place where model choice happens, then model providers are competing for the router's favor, not the developers.
- 17:41SPEAKER_00: That shifts bargaining power toward the platform.
- 17:44SPEAKER_01: I agree with the direction, but I would not overstate it yet.
- 17:49SPEAKER_01: Enterprises with serious security and compliance requirements may want to pin certain models for certain work, regardless of what a router prefers.
- 17:57SPEAKER_01: The routing layer will have to respect policy, and that is where a lot of the real engineering is.
- 18:03SPEAKER_00: That is a fair constraint.
- 18:04SPEAKER_00: Now, the commercial change is the part I would underline for every CFO listening.
- 18:09SPEAKER_00: GitHub says that starting October 28, 2026, GitHub enterprise customers can use copilot features without buying a separate copilot subscription and pay for the AI usage they consume.
- 18:21SPEAKER_00: Access runs through GitHub sales now with self-serve access coming soon.
- 18:25SPEAKER_01: Aaron Powell So the seat license is no longer the gate.
- 18:28SPEAKER_00: Right.
- 18:28SPEAKER_00: And the addition spells out the implication.
- 18:31SPEAKER_00: For finance teams, this is a shift from a predictable per seat line item to a consumption model that tracks how much agent work actually runs, which demands new forecasting and guardrails.
- 18:42SPEAKER_01: Aaron Powell And this is the Monday morning problem in its purest form.
- 18:46SPEAKER_01: Per seat pricing is boring and predictable.
- 18:49SPEAKER_01: You know your headcount, you know your bill.
- 18:51SPEAKER_01: Consumption pricing means your bill depends on how many agents your engineers start, how long those agents run, and which models they call.
- 18:59SPEAKER_01: One enthusiastic team can move the number a lot.
- 19:02SPEAKER_00: Aaron Powell, which is not necessarily bad.
- 19:05SPEAKER_00: If the agent work is valuable, you want more of it.
- 19:08SPEAKER_00: The question is whether you can see it and steer it.
- 19:12SPEAKER_01: Exactly.
- 19:12SPEAKER_01: Visibility first, then limits.
- 19:14SPEAKER_01: Who owns the budget, who gets the alert when spending spikes, and who decides whether a spike was worth it?
- 19:20SPEAKER_01: Most engineering organizations do not have that muscle yet.
- 19:24SPEAKER_00: Then there is quality.
- 19:25SPEAKER_00: The edition says GitHub's new co-pilot code review Max Tier posted the highest F1 score on review bench for high severity issues, with light and balanced options remaining for everyday reviews.
- 19:38SPEAKER_01: And this is the part I think deserves the most attention.
- 19:40SPEAKER_01: If agents are drafting a large share of changes, the bottleneck moves to review.
- 19:45SPEAKER_01: Humans can only read so much code in a day.
- 19:48SPEAKER_00: That is the addition's argument too.
- 19:51SPEAKER_00: When agents draft a large share of changes, review capacity becomes the bottleneck.
- 19:55SPEAKER_00: And a tiered review model is GitHub's answer to that pressure.
- 19:59SPEAKER_01: My only worry is the obvious one.
- 20:02SPEAKER_01: If the same ecosystem drafts the code and reviews the code, you want independent checks somewhere in the chain.
- 20:09SPEAKER_01: Automated review is valuable, but it should be one gate among several, not the only gate.
- 20:36SPEAKER_01: That tells you how different agent workloads are from human ones.
- 20:40SPEAKER_00: The edition says agent workloads run longer and generate more activity than human developers.
- 20:46SPEAKER_00: And the platform is scaling accordingly.
- 20:48SPEAKER_00: So the infrastructure build-out is itself evidence that the shift is real.
- 20:53SPEAKER_01: Fair.
- 20:53SPEAKER_01: You do not add 4 million cores for a fad.
- 20:57SPEAKER_00: So the strategic takeaway which the edition addresses to CTOs, vice presidents of engineering, and software development leaders.
- 21:05SPEAKER_00: It says that when agents start more than 40% of pull requests on the platform, your engineering metrics, review process, and cost model were built for a world that no longer exists.
- 21:17SPEAKER_01: That is strong, but I think it is right.
- 21:20SPEAKER_01: Think about the metrics most teams still track: pull requests per engineer, commits per week, cycle time.
- 21:28SPEAKER_01: If an agent can open a pull request in seconds, those numbers stop measuring what they used to measure.
- 21:35SPEAKER_00: And the additions prescription has three parts.
- 21:38SPEAKER_00: Move from per seat thinking to consumption budgets with clear limits, invest in review capacity and automated quality gates for agent drafted code, and benchmark multiple model routing against your own repositories before accepting any vendors' cost and speed claims.
- 22:00SPEAKER_01: To start this week, it is the benchmark.
- 22:03SPEAKER_01: Take a representative slice of your own work, run it through the routing and through your current setup, and measure cost, time, and the review effort afterward.
- 22:12SPEAKER_01: That last part is the one people forget.
- 22:15SPEAKER_00: The review effort is the hidden cost.
- 22:17SPEAKER_00: A cheap draft that takes an hour to fix is not cheap.
- 22:21SPEAKER_01: Exactly.
- 22:21SPEAKER_00: Cheap to generate and expensive to trust is a bad trade.
- 22:25SPEAKER_00: Let's go to the governments and to a story that I think is underrated by most technology leaders.
- 22:31SPEAKER_00: The edition opens it with a line I love.
- 22:34SPEAKER_00: Governments are learning that AI policy is increasingly energy policy.
- 22:40SPEAKER_01: That has been true inside every data center planning meeting for a while.
- 22:44SPEAKER_01: It is interesting to see a government say it out loud.
- 22:47SPEAKER_00: And put it in writing.
- 22:48SPEAKER_00: On October 28, 2026, HM Treasury published the Data Center Covenant as a policy paper, according to Pinson Mason's.
- 22:58SPEAKER_00: Chancellor John Healy announced it in his budget the same day.
- 23:01SPEAKER_00: The premise is a trade.
- 23:03SPEAKER_00: Faster, more certain delivery of data centers in return for responsible development.
- 23:09SPEAKER_01: A trade.
- 23:19SPEAKER_00: And the scale of the need is in the document.
- 23:22SPEAKER_00: The government estimates the country needs six gigawatts of AI data center capacity by 2030.
- 23:28SPEAKER_01: So what is the thing developers want?
- 23:31SPEAKER_01: I assume it is not planning permission alone.
- 23:33SPEAKER_00: It is the grid.
- 23:34SPEAKER_00: The edition says the offer to developers is aimed squarely at the grid connection queue, which has become one of the most important constraints on new capacity, both for developers and for the hyperscale customers that depend on them.
- 23:47SPEAKER_01: Aaron Powell And that matches everything I would expect.
- 23:50SPEAKER_01: You can raise the money, you can order the hardware, and then you wait for a connection that may be years away.
- 23:56SPEAKER_01: The queue is the real gatekeeper.
- 23:57SPEAKER_00: Aaron Powell So here is what the government says it will do: it will use Planning and Infrastructure Act powers to reserve future grid capacity for strategic data centers, reassign capacity released by other projects, and transfer existing connection contracts dated before 2030 where needed.
- 24:14SPEAKER_01: Aaron Powell Transfer existing connection contracts.
- 24:17SPEAKER_01: That is a bold sentence.
- 24:19SPEAKER_01: Somebody already holds those contracts.
- 24:21SPEAKER_00: It is bold, and the addition does not tell us how those transfers would work in practice.
- 24:26SPEAKER_00: That is one of the open details.
- 24:28SPEAKER_00: The government is also creating a ministerial control center chaired by the Minister for AI with the exchequer secretary to the Treasury to consider speeding grid connection and planning for the most strategic sites.
- 24:40SPEAKER_01: Aaron Powell A Ministerial Control Center for Data Center sites.
- 24:45SPEAKER_01: I will admit that is not a sentence I expected to read this year.
- 24:50SPEAKER_00: It tells you how high this has moved up the agenda.
- 24:53SPEAKER_00: And then there is a provision for projects that cannot wait.
- 24:56SPEAKER_00: The Covenant proposes a tightly controlled framework allowing temporary on-site generation for exceptionally strategic projects until a grid connection is secured.
- 25:07SPEAKER_01: Build your own power while you wait for the grid.
- 25:10SPEAKER_00: Temporarily and only for exceptionally strategic projects.
- 25:13SPEAKER_00: But the addition calls it a notable acknowledgement that the grid timeline, not capital or chips, is often what decides whether a project gets built on schedule.
- 25:23SPEAKER_01: That is the line I would put in front of any board approving a data center investment.
- 25:28SPEAKER_01: Not capital, not chips, the grid.
- 25:31SPEAKER_00: Now, the other side of the trade, the obligations are specific.
- 25:35SPEAKER_00: New facilities should be designed to achieve a power usage effectiveness of 1.3 or better.
- 25:42SPEAKER_01: That is an efficiency target written into the design stage, which means the decision gets made before the first rack is installed, not after the energy bill arrives.
- 25:51SPEAKER_01: I like that it is measurable.
- 25:53SPEAKER_00: Thank you.
- 25:53SPEAKER_00: And it goes beyond efficiency.
- 25:56SPEAKER_00: Strategic data centers should report annually on energy and water use, while other operators are encouraged to publish the same data.
- 26:03SPEAKER_00: Strategic data centers are expected to agree a local benefit plan with local communities, with investment linked to the development size, and to capture waste heat where practical.
- 26:23SPEAKER_00: And there is a national security element.
- 26:26SPEAKER_00: The Covenant also asks operators to provide secure compute for the NHS and public services, and to work with the National Cybersecurity Center.
- 26:35SPEAKER_01: So the list is efficiency, transparency, community benefit, and security.
- 26:41SPEAKER_01: That is a lot of conditions attached to a grid connection.
- 26:45SPEAKER_00: It is.
- 26:45SPEAKER_00: And the legal status matters here.
- 26:48SPEAKER_00: The edition calls it a hybrid.
- 26:50SPEAKER_00: All data centers are encouraged to meet the covenant tests, but strategic data centers must meet them to qualify for additional government support.
- 26:59SPEAKER_00: And the government says it will define what counts as strategic later.
- 27:03SPEAKER_01: Later.
- 27:04SPEAKER_01: That is the word that would keep me up at night if I were planning a site.
- 27:07SPEAKER_01: The most important definition in the whole document has not been written.
- 27:11SPEAKER_00: The edition shares your caution.
- 27:13SPEAKER_00: It says developers should read the covenant as a direction of travel rather than a finished rule book.
- 27:20SPEAKER_00: Much of the value depends on detail that has not yet been published, including how quickly the new grid powers will actually shorten connection timelines in practice.
- 27:31SPEAKER_01: And until the government defines strategic sites and the control center starts making decisions, it is a framework, not a guarantee.
- 27:39SPEAKER_00: Those are almost exactly the edition's words.
- 27:42SPEAKER_00: Alongside the Covenant, the government will publish a draft data center national policy statement for consultation, support OFGIM's data center commitment fee, and continue delivering five AI growth zones across England, Scotland, and Wales.
- 27:57SPEAKER_01: Let me offer the skeptical view of the whole thing, and you tell me where I am wrong.
- 28:03SPEAKER_01: Governments love frameworks.
- 28:05SPEAKER_01: The announcement is the easy part.
- 28:07SPEAKER_01: The hard part is a grid operator actually moving a project up the queue.
- 28:12SPEAKER_01: Until I see a specific site connected faster because of this, I treat it as an intention.
- 28:19SPEAKER_00: I think you are right on the timing and wrong on the significance.
- 28:24SPEAKER_00: Even as an intention, it changes how developers should plan.
- 28:28SPEAKER_00: The addition's view is that the direction is unmistakable.
- 28:31SPEAKER_00: The United Kingdom is turning compute capacity into a negotiated public good, where access to scarce grid capacity comes with conditions on efficiency, transparency, local benefit, and national security.
- 28:45SPEAKER_01: A negotiated public good.
- 28:48SPEAKER_01: That is a real shift in how we think about compute.
- 28:51SPEAKER_00: And the addition expects it to spread.
- 28:53SPEAKER_00: It says other governments facing the same power constraints are likely to study this model closely, and multinational operators should expect the terms of these bargains to become a standard part of site negotiations.
- 29:06SPEAKER_01: That is the part I fully accept.
- 29:08SPEAKER_01: If your site selection team is still comparing locations on land cost, tax, and fiber, they are missing the column that will decide the outcome.
- 29:17SPEAKER_01: What does the government want in exchange for the power?
- 29:20SPEAKER_00: Aaron Powell Which brings us to the strategic takeaway aimed at chief infrastructure officers, data center strategy leaders, and public policy teams.
- 29:29SPEAKER_00: The edition puts it plainly: grid access is becoming the currency of AI infrastructure, and governments will increasingly price it in commitments rather than cash.
- 29:40SPEAKER_01: Commitments rather than cash.
- 29:42SPEAKER_01: I think that is the most useful sentence in this story.
- 29:45SPEAKER_00: And the specific advice is this: if your organization plans or leases capacity in the United Kingdom, model the covenant's 1.3 power usage effectiveness design target, annual energy and water reporting, and local benefit obligations into site selection now.
- 30:04SPEAKER_00: And prepare to make the case that your project is strategic before the definition is written, and expect similar bargains in other markets.
- 30:12SPEAKER_01: Make the case before the definition is written.
- 30:15SPEAKER_01: That is a policy team's job, and it is a reminder that infrastructure strategy now needs people who can talk to governments, not just to utilities and landlords.
- 30:25SPEAKER_00: And I would add that this is not only for companies that build data centers.
- 30:29SPEAKER_00: If you lease capacity, your provider's ability to meet these conditions becomes your risk.
- 30:36SPEAKER_00: Ask them how they plan to meet the efficiency target and the reporting obligations.
- 30:41SPEAKER_01: Good.
- 30:42SPEAKER_01: That is a vendor question you can ask next week.
- 30:44SPEAKER_00: Our fourth story is the adversaries.
- 30:48SPEAKER_00: And it is the one I would ask every CISO to listen to twice.
- 30:52SPEAKER_00: The edition says the agentic era of cyber espionage now has another named actor.
- 30:58SPEAKER_01: Another.
- 30:59SPEAKER_01: That word matters.
- 31:00SPEAKER_00: It does.
- 31:01SPEAKER_00: On October 29th, 2026, CrowdStrike said its Overwatch team found the China Nexus actor VaporPanda running several simultaneous intrusions with RTEx and agentic AI framework.
- 31:15SPEAKER_00: And CrowdStrike says the activity is separate from the R-Tex campaign Microsoft reported under its own storm designation.
- 31:22SPEAKER_01: Which means the same class of tooling is now in the hands of more than one operator.
- 31:27SPEAKER_01: That is the real headline.
- 31:28SPEAKER_01: It is not one group with a clever tool, it is a tool category spreading.
- 31:33SPEAKER_00: That is exactly how the edition reads it.
- 31:35SPEAKER_00: And the scale is what security leaders should focus on.
- 31:38SPEAKER_00: According to CrowdStrike, the campaign began October 17th, 2026, and targeted more than 200 organizations, with activities spanning at least 14 countries within an 11-day window.
- 31:57SPEAKER_00: And the target list is broad.
- 32:00SPEAKER_00: Foreign ministries in Latin America, Europe, Asia, and the Middle East, United States semiconductor, defense, pharmaceutical, nuclear, and financial organizations, United States think tanks, and telecommunications providers.
- 32:16SPEAKER_01: That is a list built for intelligence collection across government, industry, and policy.
- 32:22SPEAKER_01: Nobody on that list should assume they were a random hit.
- 32:26SPEAKER_00: CrowdStrike confirmed post-exploitation at nine organizations, where the actor deployed the blood alchemy backdoor, a tool first documented in October 2023.
- 32:37SPEAKER_00: CrowdStrike says VaporPanda has targeted government, think tank, energy, and extractive organizations in Europe, North America, Oceania, and the United Kingdom since 2021.
- 32:49SPEAKER_00: This campaign is its first observed use of AI-driven intrusion tooling.
- 32:54SPEAKER_01: So an established actor with a known backdoor adding an agentic layer on top.
- 33:01SPEAKER_01: That is a useful reminder.
- 33:03SPEAKER_01: The agent did not replace the old tradecraft, it accelerated it.
- 33:08SPEAKER_00: And the architecture explains the speed.
- 33:10SPEAKER_00: CrowdStrike says RTEX coordinates a main agent with planner and worker subagents that share a graph of facts, findings, and goals.
- 33:25SPEAKER_01: A coordinator, planners, workers, and a shared memory of what has been learned.
- 33:30SPEAKER_01: The defenders and the attackers are converging on the same design.
- 33:34SPEAKER_00: Aaron Powell, which is a sobering thought.
- 33:36SPEAKER_00: The actor ran it mainly on the DeepSeek model, plus a second subscription-based commercial model that CrowdStrike could not identify.
- 33:44SPEAKER_00: And in one intrusion, the planning agents alone consumed roughly 1.4 billion input tokens.
- 33:53SPEAKER_01: 1.4 billion input tokens on one target.
- 33:58SPEAKER_01: The edition calls that a measure of how much automated reasoning is now being spent on a single target.
- 34:04SPEAKER_01: I would call it a budget line.
- 34:06SPEAKER_01: Somebody decided that one intrusion was worth that much compute.
- 34:11SPEAKER_00: And here is the part the edition calls uncomfortable.
- 34:14SPEAKER_00: The techniques themselves were not exotic.
- 34:17SPEAKER_00: CrowdStrike says that in one intrusion, an unsigned SAML assertion combined with an XML external entity flaw was used to query cloud instance metadata.
- 34:28SPEAKER_00: In another, an unauthenticated orchestration service gave root access in a production container environment.
- 34:35SPEAKER_01: Unsigned assertions and unauthenticated services.
- 34:39SPEAKER_01: Those are findings that show up in ordinary security reviews.
- 34:42SPEAKER_01: They're not zero-day magic.
- 34:45SPEAKER_00: And the third example is the one that stuck with me.
- 34:48SPEAKER_00: At a Greek government target, an operator supplied a 2022 directory export containing keys that were likely never rotated.
- 34:57SPEAKER_00: The agent forged an administrator token, and VPN material from a May 2024 email leak was used to reach the internal network.
- 35:16SPEAKER_00: And then there is the detail I think captures the whole shift.
- 35:19SPEAKER_00: CrowdStrike says the operator told the RTEX agents to find Windows machines without the Falcon sensor.
- 35:27SPEAKER_01: Find the machines we cannot see.
- 35:30SPEAKER_01: That is a remarkable instruction to give an agent.
- 35:34SPEAKER_00: The edition says it is a small detail with large implications because it shows the operator delegating not just tasks but judgment about where defenders cannot see.
- 35:45SPEAKER_00: An agent can tirelessly enumerate every unmonitored machine and every stale credential, turning ordinary hygiene gaps into entry points at a scale no human team could match.
- 35:57SPEAKER_01: Let me play devil's advocate on one thing, though.
- 36:00SPEAKER_01: There is a risk that stories like this push security teams toward buying new AI defense products when the lesson here is almost the opposite.
- 36:09SPEAKER_01: The techniques were basic.
- 36:11SPEAKER_01: The fix is mostly hygiene.
- 36:28SPEAKER_00: Enforce SAML signature validation, and require IMDS version 2 on cloud instances.
- 37:05SPEAKER_01: If the attacker can enumerate every stale credential in an afternoon, you cannot find yours with a quarterly spreadsheet.
- 37:20SPEAKER_00: So the strategic takeaway addressed to CISOs, security operations leaders, and risk officers.
- 37:26SPEAKER_00: The edition says agentic intrusion frameworks are spreading across threat actors, and they turn old hygiene debt into immediate risk.
- 37:36SPEAKER_00: Treat every stale key, unrotated credential, and unmonitored server as already discovered.
- 37:42SPEAKER_01: Already discovered.
- 37:45SPEAKER_00: And the priorities are concrete.
- 37:47SPEAKER_00: Prioritize an inventory of credentials in backups and directory exports, close EDR coverage gaps on internal servers, and test your detection against automated multiple target campaigns rather than a single patient human operator.
- 38:02SPEAKER_01: That last one is the one most red team programs will need to rethink.
- 38:06SPEAKER_01: Most exercises still simulate a careful human moving slowly.
- 38:10SPEAKER_01: The threat in this story is fast, parallel, and tireless.
- 38:14SPEAKER_01: If your detection is tuned to catch the patient human, it may miss the noisy machine or it may drown in the alerts.
- 38:21SPEAKER_00: And for boards, I would frame it this way: the question is no longer whether you have a backlog of hygiene issues.
- 38:27SPEAKER_00: Everyone does.
- 38:29SPEAKER_00: The question is how fast you are burning it down compared to how fast an agent can find it.
- 38:40SPEAKER_01: Let's step back and connect the four stories, because the edition's bottom line does that well.
- 38:46SPEAKER_00: It says, taken together, this edition shows AI moving into the foundations of business.
- 38:51SPEAKER_00: An AI-backed holding company is buying an established security brand with private credit.
- 38:57SPEAKER_00: Agents are drafting a large share of the world's code changes.
- 39:01SPEAKER_00: Governments are rationing grid capacity in exchange for public commitments, and adversaries are pointing agentic frameworks at hundreds of organizations at once.
- 39:11SPEAKER_01: Foundations is the right word.
- 39:13SPEAKER_01: Ownership, software, power, and security, those are not features.
- 39:17SPEAKER_01: Those are the floor of the building.
- 39:20SPEAKER_00: And the executive implication, in the additions words, is that the speed and scale advantages of AI cut in every direction.
- 39:29SPEAKER_00: The same automation that lets an acquirer model your margins or lets your engineers ship faster also lets an attacker probe every forgotten credential in your environment.
- 39:40SPEAKER_01: That sentence connects stories one, two, and four in a single breath.
- 39:45SPEAKER_01: And I think it is the most important idea in the edition.
- 39:49SPEAKER_01: Speed is not a strategy you own.
- 39:51SPEAKER_01: Everyone around you gets it at the same time, including the people you would rather did not.
- 39:56SPEAKER_00: Aaron Powell And Story 3 fits too because the government is effectively saying that the infrastructure underneath all that speed is scarce and it will be allocated on conditions.
- 40:07SPEAKER_00: The edition concludes that strategy, infrastructure, and security can no longer be planned on separate timelines.
- 40:14SPEAKER_01: Let me make that concrete because I think it is the hardest thing in the edition to actually do.
- 40:20SPEAKER_01: In most companies, strategy runs on an annual planning cycle.
- 40:24SPEAKER_01: Infrastructure runs on a multi-year capital cycle, and security runs on an incident cycle.
- 40:31SPEAKER_01: Three different clocks, three different owners.
- 40:33SPEAKER_00: Aaron Ross Powell And this edition is saying those clocks have to be synchronized.
- 40:38SPEAKER_01: Right.
- 40:39SPEAKER_01: If engineering moves to consumption pricing for agents, that changes the infrastructure forecast.
- 40:45SPEAKER_01: If agents are drafting code, that changes the attack surface the security team defends.
- 40:50SPEAKER_01: If an acquirer is modeling your margins, that changes the strategic urgency of all of it.
- 40:56SPEAKER_01: You cannot plan one without the other two.
- 40:58SPEAKER_00: Aaron Ross Powell I would add the money thread, because it runs through every story.
- 41:03SPEAKER_00: Private credit is funding the ADT deal.
- 41:05SPEAKER_00: Consumption pricing is changing how engineering spends.
- 41:09SPEAKER_00: Governments are pricing grid access and commitments rather than cash.
- 41:13SPEAKER_00: And the attackers spent roughly 1.4 billion input tokens on one intrusion.
- 41:18SPEAKER_00: In every case, someone is putting a price on AI capability, and the price is showing up in a new place.
- 41:25SPEAKER_01: That is a good catch.
- 41:27SPEAKER_01: The cost of AI is moving out of the IT budget and into the deal model, the cloud bill, the site negotiation, and the threat model.
- 41:35SPEAKER_00: And that leads to the edition's final paragraph, which I think is its prescription.
- 41:40SPEAKER_00: And I'm quoting the edition here.
- 41:41SPEAKER_00: The organizations that win the next phase will be the ones that treat AI as an operating model, with governance built in, consumption budgets with guardrails, infrastructure plans that account for power and policy, and security programs that assume the attacker is already automated.
- 41:58SPEAKER_01: Governance built in, not bolted on afterward.
- 42:02SPEAKER_01: I would put that on a slide for every leadership off-site this quarter.
- 42:06SPEAKER_00: And notice that each of the three examples maps to a story.
- 42:09SPEAKER_00: Consumption budgets with guardrails is GitHub.
- 42:12SPEAKER_00: Infrastructure plans that account for power and policy is the Covenant.
- 42:15SPEAKER_00: Security programs that assume the attacker is already automated is VaporPanda.
- 42:20SPEAKER_01: And the ADT deal is the reason to do all three.
- 42:24SPEAKER_01: Because if you do not run your business as if AI is the operating model, someone with the capital to do it may run it for you.
- 42:31SPEAKER_00: That is a slightly ominous way to end the analysis, but I think it is accurate.
- 42:36SPEAKER_01: I aim for accurate.
- 42:37SPEAKER_01: Ominous is a side effect.
- 42:39SPEAKER_00: Let's turn this into action.
- 42:41SPEAKER_00: What to do this week?
- 42:42SPEAKER_00: I have four, one for each story, and each one goes to a team that already exists in most large organizations.
- 42:48SPEAKER_00: Marcus, you start.
- 42:50SPEAKER_01: The first one goes to corporate development and the CFO's office, and it comes from the ADT story.
- 42:55SPEAKER_01: Before the end of next week, build a simple view of where AI could change the margins in your own operations.
- 43:02SPEAKER_01: Not a transformation program, just an honest outside-in analysis, the kind an acquirer would run.
- 43:09SPEAKER_01: Then put one question to the executive team.
- 43:11SPEAKER_01: Are we going to capture that value ourselves or are we leaving it for someone else?
- 43:16SPEAKER_01: The additions line is that AI is becoming a reason someone else buys you.
- 43:21SPEAKER_01: Make sure your board has seen the answer before a buyer has.
- 43:25SPEAKER_00: The second goes to engineering leadership and finance together from the GitHub story.
- 43:31SPEAKER_00: If you are a GitHub enterprise customer or any customer moving toward usage-based AI pricing, set up a consumption budget with clear limits before the usage grows on its own.
- 43:42SPEAKER_00: Decide who owns that budget, what the alert thresholds are, and who approves an increase.
- 43:49SPEAKER_00: And alongside it, pick a representative slice of your own repositories and benchmark multiple model routing against your current setup, measuring cost.
- 44:00SPEAKER_00: Time and the review effort afterward.
- 44:03SPEAKER_00: Do not accept the vendor's cost and speed claims until your own numbers agree.
- 44:08SPEAKER_01: Third goes to infrastructure and public policy from the Data Center Covenant.
- 44:14SPEAKER_01: If you plan or lease capacity in the United Kingdom, add a column to your site selection model for the Covenant's tests, the 1.3 power usage effectiveness design target, annual energy and water reporting, and a local benefit plan.
- 44:30SPEAKER_01: Then ask your policy team to start drafting the case that your project is strategic before the government writes the definition.
- 44:37SPEAKER_01: And if you lease, ask your provider this week how they intend to meet those conditions.
- 44:43SPEAKER_00: And the fourth goes to the security operations team from the CrowdStrike story.
- 44:48SPEAKER_00: Start an inventory of credentials that live in backups and directory exports, because that is exactly where the Greek government intrusion found its keys.
- 44:57SPEAKER_00: Rotate any signing keys and service credentials that may have been exposed.
- 45:01SPEAKER_00: Check SAML signature validation and make sure IMDS version 2 is required on your cloud instances.
- 45:08SPEAKER_00: And find out which of your internal servers are missing your endpoint detection agent, because the attacker in this story asked its agents to look for exactly that.
- 45:17SPEAKER_01: And if your security team only has capacity for one thing, I would pick the coverage gaps.
- 45:23SPEAKER_01: The attacker literally asked for a list of the machines you cannot see.
- 45:28SPEAKER_01: Produce that list yourself first.
- 45:31SPEAKER_00: That is a good place to land the actions.
- 45:33SPEAKER_00: Now what to watch?
- 45:34SPEAKER_00: These are the next tests the addition points to.
- 45:37SPEAKER_00: On the ADT deal, the 30-day go shop period.
- 45:40SPEAKER_00: If a rival bit appears, that tells us the AI buyout thesis has more than one believer.
- 45:46SPEAKER_01: Also on ADT, stockholder approval and United States antitrust approval, ahead of an expected close in the first quarter of 2027.
- 45:55SPEAKER_01: And I would watch whether Thrive or ADT ever describes specific AI-powered products, because TechCrunch noted that none were announced.
- 46:04SPEAKER_01: And of course, whether the promise of no new data sharing without customer permission holds.
- 46:36SPEAKER_01: Then the first decisions from the Ministerial Control Center, the draft data center national policy statement going out for consultation, and whether the new grid powers actually shorten connection timelines.
- 46:47SPEAKER_00: And on the security front, the addition signal is that agentic intrusion frameworks are spreading across threat actors.
- 46:54SPEAKER_00: We now have VaporPanda and the separate campaign Microsoft reported.
- 46:58SPEAKER_00: Watch for a third named operator because each new one confirms that this is a category, not an anomaly.
- 47:05SPEAKER_00: And watch your own logs.
- 47:06SPEAKER_01: That is the one test nobody else can run for you.
- 47:09SPEAKER_00: Well said.
- 47:10SPEAKER_00: That is our deep dive on the Friday, October 30th, 2026 edition of the DX Today newsletter.
- 47:17SPEAKER_00: Four stories, one thread.
- 47:19SPEAKER_00: AI has stopped being a feature and become an operating model for buyers, builders, governments, and adversaries.
- 47:28SPEAKER_00: Thank you for spending this time with us.
- 47:30SPEAKER_00: This has been the DX Today Executive Briefing, and we will be back on Tuesday with a review of the next edition.
- 47:37SPEAKER_00: I'm Elena.
- 47:38SPEAKER_01: And I'm Marcus.
- 47:39SPEAKER_01: Thanks for listening to the DX Today Executive Briefing, and we'll see you Tuesday.