a16z

Introducing Cosign. cosign.co

“Founded by Ben and Felicia Horowitz, the Paid in Full Foundation honors the hip-hop immortals whose artistic contributions far outweigh the financial remuneration they received in return.” “As Ben described Eric B. & Rakim’s debut masterpiece, the foundation’s namesake Paid in Full: ‘I bought it for $10 and got at least $5 million worth of value out of it. It needed to be paid back.’” “Each honoree receives a five-year grant with no strings attached. Inspired by Quincy Jones’ work with the Jazz Foundation, the grants have allowed past recipients, among them Rakim, Scarface, George Clinton, Roxanne Shanté, Grandmaster Caz, Kool Moe Dee, Grand Puba, and Kool G Rap, to purchase homes, pay off medical bills, and finish long-delayed creative projects.” “Of course, a few grants a year can’t repay an entire generation, but they’re a start. Paid in Full refuses to let these cultural giants languish in our midst, and its grants have fundamentally changed the artists’ lives, though still not as much as the artists changed ours.” Full piece from acclaimed music journalist Jeff Weiss on the Paid in Full Foundation’s 2026 Hip Hop Grandmaster Awards: a16z.news/p/hip-hop-has-no-s… @Passionweiss

Some of the biggest openings in security have nothing to do with patching How breaches began, per a 2026 report: - 31% exploited a vulnerability - 35% used phishing, stolen logins or impersonation scams And nearly half now involve a vendor or partner, up 3x since 2024 Full piece from a16z's Asaf Ezra and Steph Zhang on six cybersecurity companies worth building: a16z.news/p/defense-in-depth…

John Somorjai of Salesforce on the exit math behind today's startup valuations, and a16z's Alex Immerman on the much bigger outcomes that now drive returns: John: "I think there's a lot of irresponsibility going on. The valuations are of course way too high." "When you think about investing, you want to think about, what are my exit opportunities? And not every company is going to go public. In fact, very, very few companies go public, probably 1% or less." "Once you get above $10 billion, for example, the buyer universe is so small, and yet you're seeing so many of these enormous multi-billion dollar valued companies out there, and there will be a reckoning that happens." "A lot of these companies have valuations that are not sustainable, that they won't be able to grow into, and are also, I think, going to be bad for their employees." Alex: "Part of my optimism comes from what a top one percent outcome was 10 years ago is very different from what a top one percent outcome is today... There have been these larger outcomes that drive the returns for the ecosystem at large." John: "I'm an optimist. I could not do my job if I wasn't an optimist. But just know that I see the thousands of companies every year that don't make it. Because they all come to us to try to be acquired." @jsomorjai @aleximm

Companies are more confident in their backups than they perhaps should be 90% of leaders say they can recover from a cyberattack, but only 28% of victims actually got all their data back Median recovery cost: - Backups survived: $375K - Backups hit: $3M Full piece from a16z's Asaf Ezra and Steph Zhang on six cybersecurity companies worth building: a16z.news/p/defense-in-depth…

Think different, CapEx edition: Since Q1 2023, Alphabet, Microsoft, Amazon, and Meta have increased CapEx 5-8x Meanwhile, Apple now spends 20% less than it did before the AI boom Charts of the Week: a16z.news/p/charts-of-the-we…

AI can now help turn a published fix into a working exploit in hours. Patching still takes weeks, and for many old routers, cameras, and supermarket fridges, a fix never arrives. "So the question isn't how to patch faster. It's how to stop needing to." Six openings for new cybersecurity companies today, each one making patching "unnecessary, or someone else's job": 1. Live fixes: blocks an exploit on running systems within hours, then has AI write and ship the real code fix 2. An AI first responder: spots attacks without hand-written rules and contains them as they unfold 3. Per-request access: checks every request from a person or their AI agents, with credentials that expire in minutes 4. Proven recovery: keeps restoring your backups in a sealed-off test environment to prove they work, with records insurers will accept 5. An install gateway: holds and sandboxes every package, extension and AI agent tool before it can run 6. Security for the long tail: one managed service for water utilities, clinics and others that will never have a security team Full piece from a16z's Asaf Ezra and Steph Zhang: a16z.news/p/defense-in-depth…

John Somorjai of Salesforce on what kills company acquisition deals, from attrition hiding behind ARR to a veto from the security team: "It's really important that you're ready and you're organized so that the data is flowing and it doesn't look like you're having trouble getting access to data." "One of the mistakes that a lot of founders are making these days is they focus on one metric alone, which is ARR. And ARR is a wonderful metric, but it masks attrition." "When you meet with a company that has very high attrition, that usually means that there are a lot of not just unhappy customers, but there might be some product quality issues as well." "We have 14 functions that we work with on all of our diligence processes, and security is the one function that can hold up the red flag and say, 'I'm killing this deal.'" "You definitely want to identify the vulnerabilities before we do." "Nothing goes better in a process when a company is totally buttoned up... But when they don't, that's when, you know, deals can die." @jsomorjai @aleximm

Salesforce's John Somorjai has spent more than 20 years doing deals for Marc Benioff, from Slack to six rounds of Anthropic, and runs a venture arm that has backed more than 750 companies. His playbook is finding great technology that's starved for distribution and plugging it into 15,000 sales reps. Salesforce piloted Fin on its own help site, where it went live in 14 days and now handles over 40% of the traffic, resolving 65% without a human. John joins a16z's Alex Immerman to discuss why Slack revenue is up almost 3x since the acquisition, how strong revenue can hide the churn that kills deals, the pen test that got into a CEO's laptop, and why robotics is where he's most excited to invest. 0:58 How Marc Benioff spots what to buy 3:48 The 3 tests for every acquisition 5:17 Salesforce's model as AI cuts seats 8:23 Fin resolves 65% with no human 10:32 The power of 15,000 sales reps 14:22 Founders who became product chiefs 17:34 Build vs buy when code is cheap 20:27 Why Salesforce bought Fin 22:58 Why Slack is perfect for AI agents 28:19 Salesforce Ventures' robotics bets 35:46 Why he's wary of new CRM startups 37:53 Why $10B+ startups have few buyers 39:32 Why he backed Anthropic six times 41:50 Red flags that kill acquisitions 44:27 The pen test that sank a deal 46:01 Growing up with a scientist father YouTube: youtu.be/y4BdOtm40SA @jsomorjai @salesforce @aleximm

Confirmed ransomware attacks on healthcare providers grew about 6x from 2018 to 2024 Average days a US provider was down per attack: - 2018: 4 - 2021: 17 - 2024: 18 Full piece from a16z's Asaf Ezra and Steph Zhang on AI and the patch gap: a16z.news/p/the-exploit-was-…

Figma CFO Praveer Melwani says AI acccess is now a recruiting tool, and the companies that win talent are the ones where you can see people building: "The policies that we created and the freedom we've given folks to explore are the reasons why some folks are like, 'I wanna stay here. I really, really like what I'm doing.'" "I don't know if folks are actually treating access to technology as a recruiting vehicle as much as they could or should. You know, I've at least started to do that in the recruiting conversations since I started to hear that from the team." "Especially when you're trying to pull from folks who are not necessarily in technology. They're like, 'Oh my gosh, this is my front entrance into an entirely new world, and if I'm empowered to learn, this is really cool.'" "If you get this feeling that you're joining an organization that's not just saying that they give access to these things, but they're actually building and that you can see it and you can feel it through the interview process, those are the places I'd gravitate to." @figma @IvanoMakSF

AI can write an exploit before most companies have read the advisory How long it took to turn a patched bug into a working attack: - 2017: about 3 weeks for a professional - 2023: about 1 week - 2025: an afternoon with AI Full piece from a16z's Asaf Ezra and Steph Zhang on AI and the patch gap: a16z.news/p/the-exploit-was-…

Figma CFO Praveer Melwani says AI makes a financial model easy to build, so his hiring case study tests whether you still did the thinking: "Right now I'm hiring for a VP of finance. And the case study part of the process for me is so, so sacred. I wanna both test for, how are you using the tools available to you... but how you actually piece those puzzle pieces together in a way that actually makes sense." "Have you really, really understood the structure that you've created?... Do you have a strong intuition on how the business is actually working using the tool that you've created? Can you effectively communicate that?" "Anyone can go and create like a model. Pick your favorite LLM. You can go and do that really, really easily. But are you using it as an effective tool that actually is enabling you to think?" "You don't wanna outsource your thinking today. I think you wanna use AI as a tool to help you and empower you. But it's really, really critical to still be that thinker." @figma

Bugs are piling up faster than attackers can use them Published vulnerabilities grew more than 3x since 2017, and confirmed exploits in the wild stayed under 900 a year Full piece from a16z's Asaf Ezra and Steph Zhang on AI and the patch gap: a16z.news/p/the-exploit-was-…

Figma CFO Praveer Melwani says his corp dev team now tests a target's moat by trying to vibe code its product, then runs the M&A memo past AI versions of Figma's leaders: "I think our team's gotten really damn good at some of this. You can get through some of the, you know, 'Is this a real thing? Is it not? How difficult is it or not?' There's obviously nuances to a whole bunch of these ideas, but it gives you like a solid intuition there." "More often than not, there are themes, there are similar questions, there are ways that we all as leaders tend to have a way of looking at problems. And what's been interesting is [the corp dev team has] gone and created unique [AI] personalities for each of us as leaders... that they can go and run their investment memos by." "They'll sit there kind of going back and forth and saying, 'Okay, this is what Praveer would say, and this is what [CEO] Dylan would say, and this is what Sean would say,' our CRO... It reduces the cycle time that we're all sitting together on." @figma @seema_amble @IvanoMakSF

AI's cyber skills are doubling every 4 to 5 months, on the same curve as coding Longest cyber task a frontier model can reliably finish, in expert time: - Late 2024: 5.5 minutes - Early 2026: 40 minutes - April 2026: 4.8 hours From a16z's Asaf Ezra and Steph Zhang: a16z.news/p/the-exploit-was-…

Figma CFO Praveer Melwani used to spend his days writing hundreds of lines of SQL just to get one set of numbers everyone trusted. Now his finance team builds its own AI tools to do that work. He sees the CFO's job shifting from traffic cop to business enabler, as long as the people doing the building still own their thinking. Praveer joins a16z's Seema Amble and Ivan Makarov, authors of "You Need a New CFO," to discuss the growth-stage finance team that built 40 to 50 agents in a month or two, what breaks when every rep vibe codes their own dashboard, and how finance went from sitting out hackathons to winning them. 0:00 From traffic cop to business enabler 8:48 Hire people who understand the model 12:20 Vibe coding a target to test moats 13:15 An AI Dylan Field reviews the memos 18:01 Let AI make the messy data calls 20:00 Unused agents still build the habit 20:46 The CIO's new job: scale what works 22:36 The rise of the finance engineer 26:24 Why the board trusts his numbers 30:25 AI tools as a recruiting perk 40:35 Why Excel is his "love language" 44:20 What to look for in your next CFO YouTube: youtu.be/9iAQdKxyiQc @figma @seema_amble @IvanoMakSF

For two decades, writing the exploit was the bottleneck in a cyberattack. AI made that step cheap, and patching hasn't gotten faster: - On average, attacks went from landing 63 days after disclosure in 2018-19 to 7 days before it in 2025 - A working exploit went from a skilled person's month to a few hours of machine time - The median time to fully fix a known-exploited bug rose to 43 days a16z's @asaf_ez and @steph_zhang expect a long, expensive worm era, hitting hardest where systems can't update fast: hospitals, schools, small water systems. "When attacking is nearly free, attackers no longer need to want a target." Full piece from Asaf Ezra and Steph Zhang: a16z.news/p/the-exploit-was-…

Recent US buyout funds would have done better just buying the stock market US buyout returns minus the Russell 3000, by vintage: - About 9.7 points a year ahead for 2001-05 vintages - About 2.0 points a year ahead for 2006-20 vintages - Behind for every vintage since 2019 "Buyout has trailed public stocks while carrying far more debt. Over the last 10 years, US Buyout returned 14.5% a year, underperforming the Russell 3000. In contrast, US venture as a whole returned 17.6% a year over the same period (pooled across all funds), 2.3 points ahead of the Russell 3000. Unlevered." Full piece from a16z's Jen Kha: a16z.news/p/is-private-equit… Not an offer or solicitation. None of the above should be taken as investment advice or an advertisement for investment services. Please see a16z.com/disclosures for more information.

a16z's Martin Casado on the four mindsets people bring to investing, and why knowing yours stops you from justifying your own bias: 1. Financial "The correct proxy for the health of a business is the market it's going into and its finances. That's what it is. What are the SaaS metrics? What is the size of the market? That is a proxy for the entire business." 2. Productive "You believe you're investing in a productive asset, and the productive asset is what's creating value. If you believe in that, as it creates value, it will create market... The type of diligence you do if you're a productive investor is more like, what is the technical approach? What are the adjacent markets?" 3. Frontier "I think this is the romantic, idealized version of VC from the 60s and 70s, which is kind of YOLO. It's like, founders know better than VCs, and they've seen something that I don't see, and they're gonna go out there and do it. And, like, who am I to second guess them?" 4. Speculative "It is always so surprising how prevalent it is... They don't even care about the asset. They just want to time a market, right?... They're like, 'Well, this looks cheap. It's clearly gonna go up in value' or, 'This is the top of the market, like, I'm gonna get out.'" "...You can justify any deal or not justify any deal. So if you don't know what your beliefs are, you'll always basically just kind of justify whatever personal bias you have." @martin_casado w/ @patrick_oshag on @InvestLikeBest

a16z's Anish Acharya and David Pawlan, creator of Assistant Benchmark, on the gap between people's stated and revealed preferences on privacy, and what that means for AI agent adoption: "I think in revealed preferences, consumers will share any amount of data for even the most trivial amount of upside." "People have been connecting their cards, their credit cards, and their bank accounts via Plaid since the Venmo era. But when you ask them, they're like, 'Oh, yes, I'm very concerned about trust and safety.'" "I think an example though of where consumers are very concerned about sort of trust and assumptions is around being embarrassed and social signaling... The social mechanics actually feel so much higher stakes than the actual, like, real-world implications." "[One company] offered a million dollars worth of pizza to anyone that wanted to use their product... In order to get that $30 of pizza, you were granting access to your entire Google Workspace, all of your emails, all of your data for 30 bucks." "It just proves it right there, that people are willing to just give up all that data for some free pizza." @illscience @DavidPawlan