A Decade Ago the Smart Money Decided Cybersecurity Was the Trade. Most of Those Companies Are Gone. The Same Money Is Now Buying AI Models — and a Model Is Becoming an Operating System: Two or Three Will Matter, and Most People Will Never Know Which One They're Running.

A decade ago capital poured into cybersecurity and mostly learned the product was never the point — the platform and the plumbing were. AI is running the same play, larger. A frontier model is not a product you can own; it is becoming an operating system, and operating systems settle into two or three that matter while everyone else goes open or disappears. Most people will never know which model they run. The money that makes sense sits above the model and below it — not in the middle, which is exactly where the market is pointing.

A decade ago the smart money decided cybersecurity was the trade, poured in, and mostly lost: the standalone products are gone, and the returns went to a few platforms and the plumbing underneath them. The same money is now doing the exact same thing to AI, and the same question applies: does any of this spend make sense? My answer — from someone who ran infrastructure through the last cycle and runs models locally in this one — is that most of it is aimed at the wrong layer. A frontier model is not a product you can own. It is becoming an operating system, and operating systems settle into two or three that matter and a long tail nobody remembers.

The cyber decade is the template

Look at where the cybersecurity money actually went, because the shape repeats. Billions chased hundreds of point-solution startups. A handful became platforms. The rest were bought for their teams or died quietly. Cisco alone spent $2.7 billion on Sourcefire in 2013^[1] and $28 billion on Splunk in 2024^[2] — bookends on a decade of consolidation in which a crowded field collapsed into a few standing platforms and an infrastructure layer beneath them. The capital was not wasted, exactly, but almost none of the return accrued to the thing everyone was buying at the top of the cycle — the standalone product. It accrued to whoever ended up owning the platform and the plumbing. AI is running the same play, faster and larger: startups raised roughly $150 billion in 2025^[3] and now take close to half of every venture dollar.^[4] Same movie, bigger budget.

A model is an operating system, not a product

Here is the claim stated plainly: a frontier model is an operating system. It is the substrate everything else runs on, it is enormously expensive to build, it is under relentless competition, and — the part the market keeps missing — its value to the person standing on top of it converges toward zero as it commoditizes. Operating systems were never won by having the best kernel. They settled into two or three that mattered — Windows, macOS, Linux; then iOS and Android — and everyone else went open or disappeared. There is no reason frontier models end differently. Two or three will be load-bearing. A few more will survive as open weights. The rest are spending billions to build the ninth-best operating system, and there was never a market for the ninth-best operating system.

The tell is the hobbyist — and that most people will never know

I run models locally, on my own hardware, the way a certain kind of person ran Linux in 1999: because I want to, because I can see the machine, because it costs nothing but time. That hobbyist layer always exists, and it is not the tell. The tell is everyone else. Most people will never know which model they are running, and will not care — exactly as they do not know or care which kernel is under their phone. The model disappears into the product the way the OS disappeared into the device. And when the substrate becomes invisible, it stops being where the money is, because you cannot charge a premium for something the user can no longer see.

So where does the spend actually make sense?

If the model is the OS, the money makes sense in the two places it always makes sense around an operating system: the layer above and the layer below. Above is the application — the room the model runs in, the context and verification and workflow that turn a commodity reasoner into something a specific customer will pay for. That is where the durable software businesses of this cycle will sit, the same way the durable software businesses of the PC era sat on top of the OS, not inside it. Below is the infrastructure — power, cooling, land, silicon, the compute now being financialized like a toll road. That layer is real, capital-hungry, and it is where the boring money has already moved. What does not make sense is the middle: funding one more frontier model as though the model itself were the product. The middle is the one layer that commoditizes, and it is being funded the hardest.

What it changes for how you underwrite

For anyone putting money in, stop underwriting the model as the asset and underwrite the layer instead. A company whose entire story is "we have the best model" is selling you the ninth operating system, or renting you one of the first three at a margin a price war will compress. A company that owns the room above — proprietary context, a verification layer, accumulated ground truth — or a hard asset below — power, a site, a scarce build capability — owns something that survives the model commoditizing. The question on the memo is not which model. It is which layer, and whether what they own gets deeper the longer it runs. This is the same reason we do not train a frontier model: that is the commodity, and it is a capital contest we would lose. We build the room.

The counter-case, held open

The honest objection is that operating systems were not a bad business at all — Microsoft and Apple are among the most valuable companies on earth, and owning one of the two or three that matter is one of the great franchises in the history of business. True. But that is the case for the two or three, not for the field, and it is a case almost no current entrant can credibly make. The second objection is that a model might become more than an OS — climbing the stack itself, absorbing the application layer and the reasoning that today lives above it. That trajectory is real and worth respecting. Even so, the infrastructure beneath does not commoditize, the ground truth a real domain runs on still lives in systems the model does not own, and the winners are still two or three, not thirty. The shape holds. The number of survivors is the whole argument.

The takeaway

A decade ago the money decided cybersecurity was the product and learned, expensively, that the product was the platform and the plumbing. AI is repeating the lesson at a larger scale. The model is becoming an operating system — essential, commoditizing, invisible, winnable by only two or three. The spend that makes sense sits above the model and below it. The spend that does not is aimed squarely at the middle, and the middle is exactly where the market is pointing.

The takeaway A DECADE OF CYBERSECURITY CAPITAL MOSTLY PROVED THE PRODUCT WAS NEVER THE POINT -- THE PLATFORM AND THE PLUMBING WERE. AI IS REPEATING IT AT A LARGER SCALE. A frontier model is an operating system: essential, commoditizing, invisible, and winnable by only two or three (Windows/macOS/Linux, then iOS/Android). Most people will never know which model powers their tools, the way they don't know their phone's kernel; hobbyists run their own locally and no one else notices. The capital that makes sense sits above the model (the application, the room) and below it (power, cooling, land, silicon). The middle -- funding one more frontier model as if the model were the product -- is the one layer that commoditizes, and it is exactly where the market is pointing.