Woo Ding

Cofounder of FUNDA
COO of FUNDA
Software Analyst

[Woo Ding @YuDing32583]

@Dive2win I think so. Much like defense spending, cybersecurity budgets rarely get cut. AI is accelerating each cycle of this endless offense-defense arms race, which could actually drive faster growth in cybersecurity spending—unless everyone simply gives up fighting back.

[Woo Ding @YuDing32583]

VulnZero (Zero Vulnerabilities) is the idea that AI scaling laws will eventually bring Mythos-class vulnerability detection and remediation to small, inexpensive models, making automated security checks a standard part of software development.

[Jason D. Clinton 🔸 @JasonDClinton]

@RothRottweiler vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.

[Woo Ding @YuDing32583]

CRWD, PANW, and NET as key beneficiaries. AI will commoditize vulnerability discovery, but enterprises will need platforms to remediate threats at scale across endpoints, networks, cloud, and APIs. Finding vulnerabilities gets cheaper. Securing enterprises becomes more valuable.

[Woo Ding @YuDing32583]

The real shift is where the value accrues. As detection costs fall, more of the cybersecurity profit pool will move toward platforms that own enterprise context, real-time telemetry, and enforcement capabilities.

[Woo Ding @YuDing32583]

The real shift is where the value accrues. As detection costs fall, more of the cybersecurity profit pool will move toward platforms that own enterprise context, real-time telemetry, and enforcement capabilities.

[Woo Ding @YuDing32583]

Over time, finding and fixing vulnerabilities will become increasingly commoditized. But cheaper vulnerability detection doesn’t mean less demand for cybersecurity.

[Woo Ding @YuDing32583]

Over time, finding and fixing vulnerabilities will become increasingly commoditized. But cheaper vulnerability detection doesn’t mean less demand for cybersecurity.

[Woo Ding @YuDing32583]

I agree with the thesis, but there’s an important timing mismatch. In the near term, AI will find vulnerabilities faster than enterprises can fix them. That gap should drive more security spending, particularly on runtime protection, attack surface management, and threat response

[Jason D. Clinton 🔸 @JasonDClinton]

@RothRottweiler vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.

[Woo Ding @YuDing32583]

I agree with the thesis, but there’s an important timing mismatch. In the near term, AI will find vulnerabilities faster than enterprises can fix them. That gap should drive more security spending, particularly on runtime protection, attack surface management, and threat response

[Jason D. Clinton 🔸 @JasonDClinton]

@RothRottweiler vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.

[FUNDA @FundaAI]

The PHP2Shell vulnerability is an important signal: AI is significantly lowering the barrier to discovering and analyzing sophisticated vulnerabilities. Over the next 12–24 months, we could see a wave of long-standing vulnerabilities that were previously too difficult to uncover.

This suggests that AI could create incremental demand for cybersecurity, rather than simply shifting existing spending.

AI labs excel at vulnerability discovery, while security platforms like $NET, $PANW, and $crwd specialize in detecting, preventing, and responding to threats in real-world environments.

Over the short to medium term, we see AI labs and security platforms as complementary rather than competitive.

[Woo Ding @YuDing32583]

Monday Asana and Attalassian, the market is still looking for software stocks with turnaround potential.

[FUNDA @FundaAI]

We're excited to announce that two popular FUNDA Plays, GPU Rental Price Tracker and Thematic Sector Rotation, are now available to all our followers, with no login required.

GPU Rental Price Tracker
Compare GPU rental prices across providers and lease types, including spot, on-demand, reserved, and capacity block pricing. The dashboard brings cross-vendor price indices and historical trends together to provide a consistent reference for monitoring changes in compute costs.
Start here: https://t.co/jiUt6HVW5e

Thematic Sector Rotation
Track relative strength and momentum across thematic sectors, compare daily rankings, and monitor shifts in market leadership. The dashboard brings rotation charts, leadership maps, and market-style indicators together to help assess how sector trends are evolving.
Start here: https://t.co/2bndUcfYtj

If you find these Plays valuable, subscribe to FUNDA to unlock the full capabilities of our research platform.

[FUNDA @FundaAI]

$ORCL and $CRWV face a repricing of credit risk, along with SoftBank in Japan.

Higher credit risk premiums → potentially higher costs on new financing → pressure on neoclouds’ purchasing power → a possible downgrade in AI hardware order growth.

$ORCL: 5Y CDS widened 26bp overnight to a record 288bp.

$CRWV: CDS broke through 1,000bp, and its 2032 bonds fell to 77 cents on the dollar.

CDS on Amazon, Alphabet, Meta and NVIDIA also hit record highs, though their spreads remain well below Oracle’s.

Our AI Capex Credit Watch:
https://t.co/XHJqXhDuub

[FUNDA @FundaAI]

Frontier labs are unlikely to have major impact on major security platforms. $CRWD $PANW

News broke today that OpenAI is acquiring Trail of Bits, a firm focused on software security research, vulnerability discovery, and open-source security audits. As OpenAI continues to gain traction in coding, expanding into code security is an almost inevitable next step. The capabilities gained through this acquisition will likely center on AI vulnerability discovery and remediation—using AI to identify and fix vulnerabilities.

The direct impact on major security platforms is likely to be relatively limited. However, as explained below, some companies could come under pressure.

[FUNDA @FundaAI]

The $zs Investor Day last week did not resolve the near-term growth debate (no guidance change), but materially strengthened the platformization thesis.

The newer businesses are becoming increasingly measurable: Branch and Cloud reached roughly $250M of ARR, Data Security about $410M, while Security for AI is emerging from a smaller base with strong bookings and pipeline growth.

At the same time, Z-Flex is helping convert Zscaler’s broader product portfolio into higher wallet share, deeper multi-product adoption and stronger retention.

The strategic direction is therefore becoming clearer: Zscaler is evolving beyond its core ZIA/ZPA franchise into a broader security platform spanning users, workloads, branches, data, AI and SecOps.

The key remaining question is whether these newer engines can reaccelerate consolidated ARR growth from ~17% (FY27) back toward 20%+.

[FUNDA @FundaAI]

In our latest cybersecurity note, in addition to reporting feedback from enterprises, we also offer our assessment of the strengths of 31 different cybersecurity vendors. Its nice to see senior employees at these companies become paid subscribers to engage with our content.

[FUNDA @FundaAI]

We're continuing to update readers on how enterprises are thinking about their cybersecurity spend.

https://t.co/3orIVao9XZ

[FUNDA @FundaAI]

South Korea's president told a cabinet meeting today there were signs AI models had been used in successful attacks on seven financial institutions.

A major attack in the US could significantly reshape cybersecurity budgets and the industry’s competitive landscape.

https://t.co/TuHh7B1cr6

[FUNDA @FundaAI]

We found that around 10% of self-reported use of Muse and Instinct relates to work and small businesses, like taxes, websites, ads, and finding leads.

[FUNDA @FundaAI]

Deep|$META Muse: The Software Companies Behind Its Actions (Part 1: Public Companies)

We went under the hood of Muse to see which software services it calls as it carries out a user’s request. We followed the steps from finding information and accessing accounts to making calls, managing bookings and returning a result, then linked those steps to the companies behind the software. This first part covers 25 products from 24 listed companies. It shows where Muse could bring more activity to existing communication, productivity, travel, commerce and connected-device services—and where we can currently confirm only that a connection exists.

Detailed Report
https://t.co/qUPGc4HHIx

[Woo Ding @YuDing32583]

NVIDIA android union

[Jensen Huang @JensenHuang]

Today, with over 100 industry partners, we introduced the NVIDIA Open Agent Safety Platform, bringing together OpenShell and Sentry.

Artificial intelligence is extraordinary technology that will advance discovery, productivity, security, health, and prosperity for generations to come.

But its full promise can only be realized when people have confidence that AI is being built to be safe and deployed with wisdom and responsibility.

This is bigger than a single product. It's the beginning of an open ecosystem to build the trust layer for safe agent systems.

Together, we are building the foundation of the AI economy.

Trust and innovation are not in conflict. Safety is how trust is earned. We must build not only the most capable AI, but the most trusted AI, so that this extraordinary technology can realize its enormous promise for the world. https://t.co/ugYWQ1MyRi

[FUNDA @FundaAI]

Deep|LLM: Jev Users Report 10× Faster and 54.5× Cheaper Than the Models They Replaced; Only 3.7% in Production

Jev is a “decision model” from TypeSafe AI, released September 15, 2026 and opened to all users on September 20. It does not generate text. It answers questions with a fixed answer set: pick an option, score on a scale, or judge true/false, and attaches a confidence score. The launch quickly gathered industry interests, and some investors were asking whether it’s a significant negative to compute demand. As we addressed in our report earlier, we disagree with that concern and believes Jev is more of an interesting trial with limited impact on LLM.

To analyze Jev further, we decided to have a deep dive into what Jev use cases are really about. This note covers 6,277 public discussions and use cases from the first 7 days; 2,153 are from people who actually used or tested it.

-Demand sits on fast decisions with a fixed answer set. No single use clears 20%. Of the 1,284 cases with an identifiable use, the largest groups are real-time control in games, robots and simulations (18.8%), agent control decisions (16.1%) and content classification (15.7%).

-Indie developers dominate the conversation; big-company engineers barely show up. Of the 2,140 authors whose role we could identify, 35.9% are indie developers, 23.4% are AI creators and KOLs, and just 2.7% are engineers at large companies.

-Speed: 10× faster than the model it replaced or was tested against. Median user-reported speed-up is 10× (n=72): 10× vs frontier models, 5× vs small models. In the 16 cases with latency for both Jev and the prior system, Jev’s median is 300 ms vs 2,924 ms. The vendor’s 193.6× is a peak against the most expensive model.

-Cost: 54.5× cheaper than the comparison model; the saving depends on what it replaced. Median user-reported cost multiple is 54.5× (n=56): 188× vs frontier models, 17× vs small models. The vendor’s own comparison with GPT-5.6 Terra is about 76×; the 444.6× in marketing is a peak against the most expensive model.

-Accuracy: Jev and the systems it replaced each win some head-to-heads; gaps are small. In the 17 cases with accuracy for both, Jev is ahead in 10 and behind in 7; median gap is 1.6 percentage points. Of 241 cases that assessed accuracy, 83 rated Jev better and 65 worse.

-Jev’s confidence scores miss by about 10 percentage points on average, and run clearly high on unfamiliar rating questions. Median user-measured ECE (expected calibration error: average gap between stated confidence and actual accuracy; 0 is perfect) is 0.097 (n=27). An independent test on unfamiliar tasks found 0.107 overall, but 0.325 on rating questions, where Jev was right only 44.7% of the time.

-Developers put cheap small models next to Jev almost as often as the strongest large ones. Of the 432 cases that name a comparison model, 48.6% mention open or small models and 59.7% mention frontier models.

-Criticism is common. Abandonment after trying Jev is not. 25.1% of all 6,277 cases contain criticism and 40.6% contain praise, but only 1 of the 2,153 hands-on cases ended with Jev being dropped.

-Production use is still rare. Most activity is experimental. 80 of 2,153 hands-on cases (3.7%) are in production; prototypes, side projects and trial demos make up 62.4%. Seven days of data: treat this as a baseline, not a run-rate.

Detailed Report
https://t.co/kFlyA7nT5g