20VC on AI Security, Software Deals and the Economics of Compute

Harry Stebbings opens with the reported sale of Airtable to Bending Spoons and figures for its revenue, growth and price. Rory O’Driscoll says the comparison with the company’s earlier private valuation can obscure the achievement of building a substantial business. The numbers and terms are those cited by the panel.

O’Driscoll considers the transaction from the buyer’s perspective: acquiring revenue at a lower multiple than the buyer’s own valuation could be attractive. This is his investment interpretation of the reported price, not a verified account of the buyer’s plans or eventual returns.

Jason Lemkin is surprised that the reported deal did not attract a higher competing bid. Nikesh Arora says he does not know the bidding process and raises a broader question: are low software multiples a temporary market dislocation, or do they reflect lower expected long-term growth?

Arora suggests some private-equity firms may already own enough software businesses needing attention. Lemkin argues that Airtable’s reported growth, cash position and AI-related work would appear attractive, but the panel cannot establish who bid or why a particular buyer prevailed.

Arora questions whether adding a few AI features is the same as fundamentally rethinking a product. He uses an automobile analogy: an established vehicle with new features differs from one designed around autonomous driving. He worries that well-funded startups could build products around a different architecture.

O’Driscoll argues that horizontal productivity applications may face competition when users can build custom tools with AI-assisted coding. He speculates that a buyer focused on established users and cash flow could be well suited to such an asset. His projections for revenue and cash flow are illustrative opinions.

The investors debate whether private-equity firms have the appetite for another software restructuring. Arora cautions against assuming they lack willingness; existing portfolios and competing demands on capital may also affect their choices.

Lemkin recalls Airtable and Notion as clever ways to make databases accessible through familiar interfaces. He considers how difficult it may be for a founder to rebuild after years of changes and restructuring. The panel’s comments about founder fatigue are conjecture, not an account of anyone’s personal motives.

O’Driscoll observes that venture-backed companies now often remain private longer than a technology platform cycle. A company founded for one generation of tools may confront a new platform before investors have an opportunity to exit. That timing creates different pressures for founders and funds.

The group contrasts application software with infrastructure products that may benefit as customers build AI systems. Arora cautions that current AI systems still make errors and struggle with edge cases, so enterprise deployments need supporting systems, data and safeguards.

Arora says incumbents must decide whether they can rebuild enough of that infrastructure and connect it to AI at an acceptable price. If they cannot adapt, a sale may become more attractive. This is his scenario for the market, not a forecast for any named company.

Stebbings asks whether the Airtable transaction establishes a valuation reference for other software companies. The panel says the market’s response is uncertain: it could start more conversations about selling or quickly be overtaken by other news.

Lemkin describes a possible wave of founders and investors accepting lower valuations than they once hoped for, while acknowledging that other boards are still choosing to invest for growth. He does not claim that a particular founder’s private deliberations are known.

Stebbings turns to reports about Leo Aschenbrenner’s investment fund, its leveraged public positions and a subsequent sale of assets. The figures and transactions are presented as reports, not independently established by the panel. O’Driscoll separates a thesis about AI investment from the risks of the portfolio used to express it.

O’Driscoll argues that borrowing against volatile, concentrated positions can make a fund vulnerable to a sharp loss even if its long-term thesis proves correct. The group discusses whether successful earlier returns might have reduced scrutiny of risk, without claiming knowledge of what investors actually knew.

The panel expresses sympathy for the people involved and discusses the possibility of recovery after a difficult investment outcome. Predictions about the manager’s future or potential disputes are speculative; no finding of wrongdoing is established in the discussion.

Lemkin asks whether investors knew how much leverage the fund used. The others say fund outcomes can vary substantially by entry date: someone who invested early may have a different result from someone who entered shortly before a loss. Their examples are hypothetical, not verified investor account statements.

O’Driscoll says fund terms and disclosures would matter if investors disputed what happened. He raises possible litigation as a risk, not an established lawsuit or conclusion. The larger point is that a headline fund return can conceal very different individual experiences.

The panel moves to reports of AI models finding or exploiting vulnerabilities in company systems. Arora says the capability could change the speed of security work and suggests model developers test their own environments carefully. The conversation does not independently establish the details or authorization of the reported incidents.

Arora contrasts the speed at which AI systems may identify vulnerabilities with the time organizations can take to patch them. He offers a patching-time estimate and predicts that attackers could adapt similar capabilities. Both the estimate and future timeline are his claims, not universal measured results.

Asked about customers, Arora says the reports have brought cybersecurity to more chief executives’ attention. He argues that software vulnerabilities and configuration errors make complete readiness difficult, and cites a vulnerability count from Palo Alto Networks’ own work. His company sells security products and has a commercial interest in the discussion.

Arora argues that preventing every intrusion is unrealistic and that organizations must also shorten detection and response times. He gives an estimated industry response time and contrasts it with a much faster target. Actual risk and response performance differ across organizations.

Lemkin recounts an incident in his own application development: after connecting tools, he says an agent read a personal ideas document and changed code without an obvious notification. This is his account of the behavior; the panel does not independently verify the cause, configuration or product responsibility.

The incident leads to a question about permissions across connected services. Arora says people experimenting with agents may not understand what data and credentials a system can access. He contrasts informal experimentation with the governance challenges enterprises face when employees connect tools.

The panel discusses how data handling and model training may vary between consumer and enterprise services. Arora warns users to understand their own settings, permissions and contractual terms. His broad comments should not be treated as proof that every product uses every user’s data for training.

Arora describes two layers of defense: blocking known threats at the perimeter and finding suspicious behavior that gets through. His framing is a simplified model of security; real systems also require prevention, monitoring, recovery and other controls.

He says AI may help classify content and identify malicious activity more quickly, while organizations still need enforcement points to block actions. He presents this as a reason his company’s products can incorporate models rather than necessarily being displaced by them.

Arora describes Palo Alto Networks ingesting a large volume of enterprise data and using rules and machine learning to search for anomalies. He cites his company’s processing volume, detection time and customer count as company claims, and says additional language-model analysis could help find unknown threats.

For Arora, agents introduce another problem when software can decide what to do next. He asks how to define identities, restrict access, intercept actions and provide a way to stop an agent. He distinguishes genuine autonomy from fixed workflows presented with an agent label.

Stebbings cites a reported Moonshot AI financing and valuation, then asks about the economics of open-weight models. O’Driscoll says such models may pressure prices but questions how their creators will sustain development and distribution without some form of monetization. The financing figures remain reported claims.

The panel considers charging for hosted inference, support or other services around models whose weights are available. O’Driscoll says the eventual mix remains unclear. An open model can reduce a user’s licensing cost without eliminating the cost of computing or running it.

Arora predicts that average AI capability will become cheaper and improve over time, while exceptional capability for difficult tasks may command a premium. He gives customer support and scientific problems as contrasting examples. The pricing and capability trajectory is his forecast, not an established market outcome.

Lemkin notes that customer support can require significant compute when cases become complex. Arora responds that turning a model into a reliable enterprise product requires more than the model itself: teams must collect context, handle edge cases and design appropriate controls.

Arora recalls an early experience with a self-driving vehicle to illustrate the long work between a convincing demonstration and handling a broad range of real-world situations. He expects similarly extensive data collection before organizations grant AI systems full autonomy in many use cases.

The investors discuss the share of an application’s cost attributable to tokens versus the surrounding product and support. They offer rough examples for customer support and coding, emphasizing that unit economics differ by use case. The percentages are their estimates, not a benchmark established in the interview.

The conversation turns to reported financing for nuclear-energy startup Valor Atomics and the demand for electricity from data centers. Arora argues that land, permits, power and compute could be valuable constraints over the next several years. His forecast does not establish a specific project’s cost or performance.

Arora describes an anecdote about turning agricultural waste into energy, and Lemkin recalls earlier work in energy storage. They argue that demand for compute can change the economics of previously marginal projects, but their examples do not establish that every technology or project will be profitable.

O’Driscoll distinguishes demonstrations of new nuclear technology from commercial deployment. He says projects still face a regulatory journey and argues for both innovation and appropriate caution. His view that nuclear is needed for cheap power is a policy opinion, not a universal finding.

The panel asks who will ultimately pay for the power and compute being built. The investments only earn a return if users or businesses pay for useful services at sufficient scale. Their references to very large future token spending are scenarios, not measured revenue commitments.

Stebbings asks whether the infrastructure ecosystem depends excessively on OpenAI and Anthropic meeting future targets. Arora argues that demand for AI could persist even if particular suppliers change. O’Driscoll responds that a sudden shift among major buyers could still cause substantial market disruption.

Arora speculates that compute may be reallocated between consumers and enterprises as providers seek revenue. He also points to potential consumer services such as travel booking. His demand shares and monetization examples are hypotheses, not independently measured market data.

O’Driscoll argues that the identity of the buyers matters in the near term because infrastructure investment may depend on a small number of customers. Arora replies that another model provider might use the capacity if a current leader falters. Both acknowledge the possibility of a dislocation.

Arora warns that an AI investment boom can lead people to assume every funded company will execute perfectly. He says access to a favorable trend does not remove operational risk. The panel cites changing perceptions of model providers as evidence that leadership can shift.

Lemkin suggests the market may ultimately care less about which provider wins if models become interchangeable for a given use. Arora agrees that differences between models could matter less for some tasks as organizations accumulate useful context. Both are discussing possible futures, not guaranteed outcomes.

Arora explains that a general model does not automatically know a customer’s infrastructure, configuration or previous support cases. His team is gathering this information so an AI system can answer questions with relevant context. He sees domain knowledge as a potential source of durable value.

He distinguishes raw model capability, context needed to answer a query and data needed to train a system. Arora says Palo Alto Networks is capturing past customer cases to improve its processes, while acknowledging that the team is still learning how to build and manage the system.

Lemkin asks whether an average enterprise without a large technical team can safely switch between models and expect consistent results. The discussion leaves that challenge unresolved. The panel treats model substitution as an operational problem as well as an architectural choice.

O’Driscoll returns to concentration risk: even if long-term AI demand is broad, a pause in spending by large buyers could affect the supply chain. Arora reiterates that the underlying opportunity may be larger than any one provider. They disagree about how disruptive a transition could be.

The investors discuss cloud company results and capital spending. O’Driscoll cites growth rates and market reactions as he understands them, contrasting firms with visible cloud revenues with those whose monetization is less clear. His figures and interpretation are not independently verified in the episode.

Lemkin points to Palantir’s reported growth and bookings as an example of demand for help applying AI to business data. He offers his own interpretation of its product and customers; his estimates and enthusiasm do not establish that all enterprises have the same needs or returns.

Arora describes a large capital-expenditure cycle and says current spending appears supported by large buyers and some revenue. He cautions that a mismatch could emerge if the money or revenues arrive too slowly. The scale figures are his broad estimates.

Arora predicts that many consumer and enterprise applications will be rebuilt around agents and context over the next five to ten years. He calls it a gold-rush moment, while acknowledging that the timing of infrastructure spending and returns may create a market dislocation.

He suggests power availability, permits and equipment supply could constrain deployment even when capital is available. These are possible bottlenecks rather than verified outcomes for any jurisdiction or project. O’Driscoll adds that enterprises may also struggle to absorb changes at the pace suppliers expect.

The panel asks whether organizations can continuously rebuild their systems as vendors and models change. Lemkin notes that some customers are making shorter commitments because of uncertainty. The question is whether rapid adaptation will become a lasting capability or a temporary response to upheaval.

Arora argues that enterprises must capture the reasoning behind employees’ decisions and customer support cases. He describes hundreds of thousands of annual cases at his company and says each can become a learning opportunity. The count and the likely benefits are his company-specific claims.

He estimates that creating this organizational knowledge could take years. A model that answers many cases correctly still poses a problem if the organization cannot identify the incorrect ones. He sees collecting examples, evaluating outcomes and improving reliability as core implementation work.

Arora says AI can also sift large collections of enterprise data for patterns and possible insights, which people can then evaluate. His example of improved revenue and margins is hypothetical; it illustrates a potential return rather than a measured result.

Stebbings mentions reported Scale AI revenue and the sale of DroneDeploy to Procore. Lemkin asks O’Driscoll about the latter, describing the transaction as a significant bet for the buyer. The deal figures and revenue multiples are panel estimates or reported terms.

O’Driscoll discloses his involvement with DroneDeploy and says the sale was not especially stressful from his side. He credits disciplined fundraising, profitability and patient founders, while noting that he cannot speak for the acquirer or disclose all terms. His account reflects the seller’s perspective.

He says physical-world technology took longer to develop than he expected, but argues that drones and robotics created a favorable direction for the business. He describes how combining construction software with physical inspection might expand the buyer’s market. That strategic benefit is his assessment.

Asked what makes an acquisition consequential, Arora says every deal should work for shareholders, though the largest carry special importance. He cites Palo Alto Networks’ own acquisition history and estimated success rate. These are his company-level claims, not independent evaluations of each transaction.

Arora discusses the CyberArk acquisition as a large strategic bet and explains his thesis that AI agents will need identities and privileged access controls. O’Driscoll agrees that the scope of an agent’s access must be clear when its precise actions are difficult to predict.

Arora cautions that restricting an agent to perfectly deterministic actions can reduce it to a conventional automated workflow. Lemkin says agents have been useful in his experience but acknowledges that a single destructive action can have serious consequences. They leave the balance between autonomy and control open.

O’Driscoll revisits his previous skepticism about Scale AI and says he underestimated its ability to continue operating after leadership and ownership changes. The group attributes its resilience to demand for data, while recognizing that their discussion of revenue and business prospects relies on reported figures and personal assessments.