Nearly a year ago, a CISO at a major insurance company called me.

“When you start your fund, I want to be your first investor.”

I told him I wasn’t starting a fund.

“Not today. But you will, and I’m your first check.”

He was right. And he wasn’t the only one. Hundreds more. Really a pull I was not expecting.

Getting here took an incredible amount of grit, a roll-up-your-sleeves-and-do-it mentality, patience, and willpower. There were days when people just said “good luck!” and there were days when people said “where do I sign?”

I grew up far from the rooms where venture capital is discussed. Yet, I have always had a deep passion for learning, technology, and people. Understanding how people think and what makes them tick is truly something that fills up my bucket.

I became a first-generation college graduate and earned my master’s at Harvard, but I broke into tech and venture capital without a network or a playbook. During my time at Asana, a recruiter called and said, “Just take the meeting.” So I did. From there, I listened and watched, and learned how great investors win deals, price them right and know when to lean in.

I went from being employee #23 at Asana to Innovation Endeavors and Glynn Capital, backing infrastructure companies like Chronosphere and Drata.

Early on, I started asking every CEO the same question:

“What do you need besides capital?”

The answer was almost always the same: “I’d love to meet the CIO at that company.” So I found a way to reach that person.

Then I started asking the CIOs, CTOs and CISOs a question of my own: “What’s breaking that nobody is fixing?”

They told me, and usually well before the market caught on. My best investments came from those conversations. The operators running security, engineering and IT inside the world’s largest companies see the next category before anyone else does.

Along the way, I noticed who was missing from the cap table. The operators who tested, bought and championed these products were almost never invited to invest. U&I Ventures Fund I changes that.

Today, our community includes 1,800 senior technology leaders who meet in small groups across San Francisco, New York, Tel Aviv and London. They tell us which problems enterprises are struggling to solve, and they’re among the first people our founders meet. We recently introduced one founder (that we backed!) to 68 CISOs in less than 24 hours.

None of this works without my partner, Kim Cooper. Google recruited her straight out of Stanford, and over the next 20 years she reported directly to Larry Page, Sergey Brin, Eric Schmidt and Susan Wojcicki, learning firsthand what it takes to build and scale one of the most important companies in history. We met more than a decade ago, when I was at Innovation Endeavors, and I’ve wanted to build with her ever since. Today, as our Founding Operating Partner, she leads our operator community and value creation platform, and works side by side with every founder we back.

Together, we spend our days in rooms with the people running security, engineering and IT at the world’s largest companies, many Fortune 500 names. Right now, the conversation is about AI. How the enterprise looks at risks, governance, optimization, and regulation within AI. What is new in the last 36 months is that agents now have the ability to have access to corporate credentials and sensitive systems and the underlying data. We have lively debates around who owns identity. Who monitors the agents. Who revokes access when something goes wrong? These are the problems we’re backing founders to solve. And the pace this is happening is at a speed the traditional enterprise is not used to. Innovation within AI has become a forcing function for boards to lean in, open up budgets, and modernize like we’ve never seen in history. We are excited to help fuel this early momentum.

What’s in our name. A lot, actually. U&I means two things. Urgent and important: the problems that can’t wait and the ones that matter most. That’s the filter for every company we back. And you and I, because none of this happens alone.

We built U&I to give this community a seat at the table. So if you’re an operator who sees what’s breaking before anyone else, or a founder building the fix, I’d love to meet you.

To the recruiter who said “just take the meeting,” the CISO who promised the first check before I knew I needed one, and every operator, founder, investor and friend who believed in U&I before it existed: thank you.

And to our partners and kids, who gave up more nights and weekends than we can count, and to the family members who became our very first LPs: you believed in us first. We couldn’t have done this without you.

-Kim Moore

Founder and General Partner

U&I Ventures

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

Important Disclaimer: This article is intended solely for informational and educational purposes. It does not constitute an offer to sell, a solicitation of an offer to buy, or a recommendation regarding any security, investment vehicle, or investment strategy. Any such offer may be made only pursuant to definitive offering documents and only in jurisdictions where permitted by law. Any references to U&I Ventures, current or prospective investment activities, companies, founders, operators, markets, sectors, or investment themes are illustrative in nature and should not be relied upon when making any investment decision. Certain statements contained herein may constitute forward-looking statements that involve risks, uncertainties, assumptions, and other factors that may cause actual results to differ materially from those expressed or implied. Past performance is not indicative of future results. There can be no assurance that any investment strategy will be successful or that any future investment will achieve results comparable to those discussed. Any views expressed are current as of the date of publication and are subject to change without notice. This publication is not intended as marketing material for any private investment fund. U&I Ventures does not accept capital through this publication and is not soliciting investors through this communication.

1. 48% of breaches now come through third parties, up 60% year over year.1

2. Enterprises are paying token bills nobody budgeted for. Even if they did budget, they have surpassed that number last week.

3. One SOC team found an agent method that was 90% cheaper than an incumbent with the same result.

U&I Ventures connected more than 250 CISOs and security leaders with founders in our ecosystem at our CISO & Security Leaders Summit that kicked off the week on Monday.

THE ROOM

Our Summit put builders and buyers at the same table by design. Cash is a commodity; what hot founders demand is trust, relationships, and direct access to the operators who implement their software. That is the entire U&I model (Urgent and Important, for those new here), and weeks like this are an example of what we mean.

We asked every founder on stage one question: what does it take to build a massive business in today’s noisy market? You can’t take a pitch out of a leader building a startup. So, yes, we heard pitches. And we got a front-row seat into how founders and field CISOs actually see the state of security right now.

Here’s what they shared they are doing about it:

Matt, CISO at Drata walked through purpose-built agents for GRC automation and a governance platform to discover and monitor the agents already running inside the enterprise.

Eddie, CEO at Lema is connecting vendor vulnerability posture to internal exposure, right as third-party breaches explode.

Shahar, CEO at Pluto Security revealed how enterprises can use agentless AI workspace security that can deploy in 30 minutes.

Stephan Goldberg, Co-Founder at ACT Security, shared how they are eliminating cloud access debt with one-to-many policies instead of one-to-one tickets.

Alon, CEO at Astelia, is prioritizing only the vulnerabilities an attacker can actually reach.

Shay, CEO at Ocean, built small and large language models to find evidence of phishing in every email, because AI has made attacks look nearly perfect.

Gal, CEO at Fig finds and fixes the broken security flows that silently block detection and response.

Etay, CEO at Bind Networks, is rebuilding SASE for a world where identities grow 100x from agents.

Ron, CEO at Vivid, is tackling resilience and recovery, however, you had to be in the room to know more because he is operating in stealth alongside his co-founder, Alon.

Tommy, CEO at Gradient, deploys tailored AI agents for GRC, vuln management, SOC, and identity, with engineers operating them directly in customer environments.

Every one of these founders is a domain expert solving a deep, hard problem for a specific buyer. That is the filter. That is what wins in a crowded market.

The sharpest go-to-market insight of the day came from Connor, CISO at Sysdig, citing Andy Ellis’s framework: name a real, urgent problem; confirm the buyer’s stakeholders believe it is their job to solve it; only then qualify on budget. Stop leading with “do you have budget?” Start with “do we have the right problem with the right people?”

WHAT THE CISOs TOLD US

Our fireside chat brought together Mandy Andress (CISO, Elastic) and Manju Mujde (CISO, U.S. Department of Treasury), moderated by Nadia Hansen from Salesforce’s global AI team. Three things stood out.

1/ Nobody budgeted for tokens. AI spend was not a meaningful line item when budgets were set, so near-term dollars are shifting from existing lines rather than arriving as new money. Long-term, the room agreed token spend becomes a standing budget line, the way cloud hosting did. CFOs and procurement are still catching up to the speed technologists need; we saw the same lag when the internet arrived, and again with cloud.

2/ Efficiency matters as much as spend. Elastic’s SOC team tested two agent methods and found one 90% cheaper for the same outcome. Teams that run structured tests on cost versus outcome will compound that advantage every quarter.

3/ The pace of change is outrunning corporate process. By the time a mitigation is designed and approved, the risk has already shifted. CISOs are moving investment toward fundamentals that will not change quickly, so their teams can react fast at the top. Meanwhile, visibility into what employees are actually doing with AI remains the core struggle, and the endpoint has not so quietly become the primary AI surface.

One surprise: enterprise AI adoption is slower than expected. Agents sitting on the org chart next to humans was supposed to be reality by 2026. It is not yet. For founders and investors, that gap between the discourse and the deployment is the map.

AROUND THE (MANY) DINNER TABLES

Some of the best conversations happened after hours, with security leaders talking careers across every stage, from interns to veterans of nine-figure BUs. A few threads:

1/ On your career - run to the fire and build a reputation as a fixer. Write down exactly who you want to be, because clarity saves a lifetime of wrong turns. Never get comfortable; a few years without learning quietly costs you your marketability. And find your release, whether that is fishing, lifting, or actually taking the PTO <- we were just talking about taking PTO this morning. Take it!

2/ On AI. It is a tool, not a replacement (the calculator transformed accountants; it did not eliminate them), but this shift is moving faster than any before it. Over-trusting AI on high-stakes decisions is a real risk. So is sitting it out.

THE CLOSE

Mandy’s advice to every leader: give your teams dedicated time to experiment with AI without pressure, and normalize failure; that is where the real evolution comes from. Manju, who oversees security across nine Treasury bureaus and took the job because “speed is my jam,” left us with this: cultivate the next generation, because digital natives are our future defenders.

We closed the Summit by asking every attendee to introduce themselves to three new people before leaving. Relationships compound. So does trust. That is the whole point.

Thank you to every CISO, founder, and operator who showed up and gave more than they took. And thank you to Mandy, Manju, Nadia, and the founders who took the stage.

Next up: our Trust Summit, September 30. See you there. This time we are trading recycled casino air for fresh air under the redwoods. Your lungs (and your calendar) will thank you. CISOs interested in joining can reach out to Kim Cooper.

Welcome to U&I Connect!

This is where we will share learnings from U&I Ventures on:

• Emerging technology trends, insights, and analysis within software infrastructure

• Career moves & open roles

• Events

You’re receiving this because we believe our updates align with your role in our community. Unsubscribe anytime.

Unsubscribe

We recently came across a quote that we love:

“Stop asking how many people you know. Start asking how many people would be genuinely happy to hear from you.”

It really captures how we build U&I Ventures.

Our goal has never been to have the biggest network – it’s to build one that’s genuinely useful. Whether that means making a timely introduction, sharing an opportunity, or passing along something we’ve learned, we hope every interaction creates value. From our corner of San Francisco, we love sharing what’s taking shape across the U&I ecosystem: what’s working, what’s not, & what’s coming next. You will find deeper dives in our LinkedIn newsletter & future posts here on Substack. Let’s dive in on observations.

60% Use, 20% Trust: The AI Coding Gap We Should Talk About

The past 48 months have proven that “AI (can) write the next line (of code).”

The focus now is on orchestration: you delegate whole units of work: issues, tests, migrations, refactors, and the agent executes while you direct.

What’s interesting, per Anthropic’s 2026 Agentic Coding Trends Report, developers now use AI for roughly 60% of their work, yet they report being able to fully delegate only 0–20% of tasks. Constant use, limited trust (😲). Three key takeaways for developers:

1. Constant use, guarded trust. The 60/0-20 split states the obvious. AI is in most of the work and owns almost none of it outright. The teams winning aren’t the ones delegating the most, they’re the ones who’ve figured out which 20% is safe to hand off, and built the muscle to tell the difference.

2. Agents run long now. The capability unlock this year isn’t speed, it’s stamina. Sessions now stretch from minutes to hours, the report cites a single 7-hour run that moved a 12.5-million-line codebase. The bottleneck stopped being “can it write code” and became “can it stay coherent over a long task.” Mostly, it can. We’re hearing from our operators that this is exactly where a lot of the innovation is happening right now: building the guardrails to trust an agent running while you’re asleep/multi-tasking. It’s showing up in the startups too: a new wave of platforms now pitch always-on agents built around persistent memory, permission control, and audit trails, the infrastructure you need to trust an agent working while you sleep. The real risk with overnight runs was never the agent stopping, it’s the agent failing without you noticing. That’s why reliability and self-correction have become the features people are willing to pay for.

3. Security-first is the adult in the room. We are learning in real time, the same agentic systems driving the productivity gains are amplifying the risk. The winning pattern is bounded autonomy: clear limits, mandatory human escalation on high-stakes calls, audit trails, approval gates before anything touches production. And underneath: messy repos make messy agents. Engineering hygiene is a competitive advantage.

Identity is the new perimeter

An autonomous agent isn’t just software anymore, it’s a privileged actor with credentials, and enterprises are realizing they have no idea how many of them are running. A recent industry survey found 68% of organizations can’t reliably tell AI agent activity apart from human activity. Another report cited 78% of organizations don’t have formal policies for creating or removing AI identities at all.

Machine identities already outnumber human ones in most enterprises, 25x to 50x by some counts. Every new agent adds another set of API keys and access tokens that can be stolen, over-permissioned, or simply forgotten when the developer who created it moves on. The credentials keep working. Nobody owns them. This is the next wave of security startups racing to fill.

And the emerging consensus is that you can’t just retrofit old tooling: agent identities are dynamic, ephemeral, and autonomous. They delegate and act across systems in ways static service accounts never did, so the governance layer has to be purpose-built. The teams treating each agent as a first-class identity with an owner, a defined purpose, and a scoped, revocable set of permissions are the ones who’ll be able to let agents run unattended without lying awake about it.

💚 Welcome U&I Ventures-Backed CEOs

• Shahar Bahat, CEO, Co-founder, Stealth

• Ilan Kadar, CEO, Co-Founder, Stealth

• Kumesh Aroomoogan, CEO, ZeroDrift

• Etay Bogner, CEO, Stealth

• Tommy Mordo, CEO, Stealth

  

👋 Welcome New U&I Ventures Network Operators

We’re excited to welcome some of our newest members:

• Scott M. Morgan, Data & Analytics Manager, LinkedIn

• Jason Elrod, CISO, MultiCare Health System

• Steve Begalman, CISO, fmr Boyd Gaming

• Fahad Rizqi, President, Fiddler AI

• Val Dobrushkin, Partner; Director of GRC, AVA Compliance Solutions, Tricentis

• Ash Hunt, VP of Strategy, Cyera

• Gene Golovinsky, VP Product Security and AI, ServiceNow

• Nicole Grinstead, CISO, Roblox

• Jason Cowlishaw, VP Information Security & CISO, Veritone

• Joakim Tauren, CISO, Visma

• Jadee Hanson, CISO and CIO, fmr Vanta

• Henry Levin, Head of Security & Compliance and IT, Aisera

• Travis Farral, VP & CISO, Archaea Energy

• Ricky Waldron, Sr. Director, Security Assurance, Navan

• Joanna Chen, CISO, Dashlane

• Lior Barash, CISO, Cognyte

We’re excited to have you in the community!

🚀 New Roles & Moves

A few updates across the network:

• Friedrich Wetschnig → CISO, Albertsons

• Ankur Chakraborty → Deputy CISO, F5

• Manju Mode → CISO, U.S. Department of the Treasury

• Brian Waeltz → Deputy CISO, Westfield Insurance

• Aman Thind → Coming soon!

Open Roles

• CISO — Life sciences company in the Bay Area

• CISO — Global financial company in NY

If you’d like to discuss career opportunities, please reach out to KimC@uandi.vc.

📅 Upcoming Events & Black Hat Corner

Black Hat | August 3–7 | Las Vegas, Recommended Events (Invite-Only). If you’re interested in joining us and you are an active operator, email Joaquin@uandi.vc.

• U&I CISO Summit | Monday, August 3 | 10:00am - Noon

• Helicopters & Supercars | Monday, August 3 | 4:00-8:00pm

• Private Professional Headshots | August 4–6

• Dinner at Delilah | Tuesday, August 4 | 6:00pm

• Dinner at STRIPSTEAK | Tuesday, August 4 | 9:00pm

• Dim Sum at Mott 32 | Wednesday, August 5 | 1:30pm

• Topgolf Happy Hour | Wednesday, August 5 | 6:30-8:30pm

• Dinner at Barry’s Downtown Prime w/TPG + U&I | Wednesday, August 5 | 6:00-9:00pm

U&I Trust Summit | September 30–October 2 | Guerneville, CA

• The U&I Trust Summit will have 100 CISOs, CIOs, founders, investors, and enterprise technology leaders for two and a half days of candid conversations about AI, security, leadership, and trust. We’re excited to welcome Jason Clinton, Deputy CISO at Anthropic, who will lead a conversation on The Future of Leadership in an AI-Shaped World. Only a few spots remain open. If you’re interested in joining us and you are an active operator, email kimc@uandi.vc.

Thank you for being part of the U&I community. We feel incredibly fortunate to learn from so many thoughtful founders, operators, and investors, and we’re excited to continue sharing those conversations in U&I Connect.

See you at Black Hat!

Warmly,

Kim Moore & Kim Cooper

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

I’ve hired people throughout my career. I’ve also helped dozens of companies hire great talent.

The people who made the biggest impact weren’t always the ones with the most impressive resumes. They did not fit a mold.

Hire for grit & brutal talent before pedigree.

Two of the best hires I’ve ever made weren’t Ivy League MBAs. One of them didn’t even graduate from college. Gasp!

What they did have was grit & the skills required to get the job done.

They showed up early. They stayed late. They figured things out without being asked. They treated every challenge like it was theirs to solve.

A resume tells me where you’ve been.

Grit tells me where you’re capable of going. Want to know how to dig deep and understand if someone has grit? Ask them this one interview question:

Tell me about a time in your life when things felt really difficult. How did you get through it?

The answer tells me far more than where someone went to school or the logos on their LinkedIn profile. I’m listening for resilience, resourcefulness, and a willingness to keep going when no one else is watching. Those will be your best builders.

Especially in the first few years of building a startup, you will value hustle over pedigree every time.

Hire for the right motivation.

One of my favorite interview questions is simple:

“Why do you want this opportunity?”

I’m not looking for someone to tell me they want a paycheck.

I want to hear that they want to learn. That they’re hungry for responsibility. That they’re excited to build something that doesn’t exist yet.

Money matters, yes, we all work to support ourselves and our families.

But when things inevitably get hard (and they will), purpose lasts much longer than compensation.

Your first hires aren’t employees, they’re founding team members.

Early-stage startups are messy.

You’ll pivot. You’ll change priorities. You’ll make mistakes. Some months you’ll feel like you’re on top of the world, and others you’ll wonder if you’re going to make payroll. Every dollar matters while you’re searching for product-market fit. That’s why I look for people who see themselves as builders, not employees.

People who are willing to roll up their sleeves because they believe in the mission, not because it’s written in their job description. Choose carefully.

Build a mosaic of talent.

One mistake I see founders make is hiring people who look, think, and work exactly like they do. I think that’s the opposite of what you want. Hire people who are exceptional where you’re not.

If you’re technical, hire someone who naturally understands customers.

If you’re great at vision, hire someone obsessed with execution.

If you’re a relationship builder, hire someone who loves systems and process.

The goal isn’t to clone yourself.

It’s to build a mosaic of people whose strengths make the company stronger than any one individual could.

Don’t hire culture fits. Hire culture adds.

You know what is out? The phrase “culture fit.” Too often it becomes an excuse to hire people who make us comfortable.

Longer term, as you scale, you will want someone who can expand your team’s thinking.

Someone who brings a different background, perspective, or skill set that makes the entire team better.

That’s how great cultures are built. Intentionally evolve with every hire.

The people you choose in those first few years will shape your company long after the first version of your product is gone.

Stanford psychologist Dr. Carol Dweck coined the term to describe people who believe their abilities can be developed through effort, learning, and persistence. Those are the people I want building alongside me. I can teach skills. I can’t teach curiosity. The best hires I’ve made weren’t the ones who knew all the answers, they were the ones who couldn’t wait to learn.

Hire people who believe in building something bigger than themselves.

Questions for our readers: What qualities have made your best early hires unforgettable?

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

They’re parents.

I don’t think that’s a coincidence, and I don’t think it’s about the kids. I think it’s about what raising them does to you. Parenting is a forcing function (Amazon knows this well).

Most of us improve when we’re forced to. Left alone, we optimize for comfort. Parenting removes the option to defer.

A two-year-old does not care that you had a hard board meeting. A teenager will clock the gap between what you say and what you do faster than any investor in a diligence call. There’s no “I’ll get to it.” The job is constant, and it’s needy.

That pressure makes people better. Sharper about priorities, calmer under high load, and more honest about what is a high priority.

A few specific things show up over and over in the parents I most respect:

1. Ruthless prioritization. When the window between bedtime and your own exhaustion is the only block you get, you stop viewing everything as urgent. You learn to kill the meeting that doesn’t need to exist. You ship the thing that matters and let the rest go. The best founders we have backed have this. So do the best parents.

2. Patience. Raising a human teaches you that the timeline is not yours to control, and that pushing harder often makes things worse. You learn to hold a long arc, to plant something and wait for it without abandoning it. That’s the exact temperament that survives a company-building cycle.

3. Emotional steadiness. You cannot lead a team well while running hot, and you cannot parent well that way either. The people who’ve spent years de-escalating a meltdown while staying warm tend to bring that same regulated presence into a crisis at work. It is true leadership. My better half is very good at this. If he is reading this, thank you. :-)

Fun fact is that this shows up in the brain. Studies on new fathers found that becoming a dad is associated with measurable changes in the brain networks tied to empathy, emotional processing, and emotion regulation. There’s even evidence that the testosterone drop that comes with fatherhood may help augment empathy. The researchers’ framing: they treat the empathy and mentalizing that parenting demands not as an innate gift, but as a skill! One that can be trained and strengthened with practice. Which is exactly how I’d describe what I watch good operators do every day: read the room, intuit what someone needs before they say it, stay regulated when the stakes are high. Parenting is like going to the gym for leadership.

I remember having my first son, and I didn’t want the world to find out because I feared it would make me sound less committed to my work. In my experience, it is the opposite, and I’m grateful for the extra “job” I have that does not have a start or end time. This weekend was Father’s Day, so let me be direct about the dads.

I’ve watched fathers in our network do the unglamorous version of this well: the ones who leave the offsite dinner early without apology because they made a promise at home. The ones who model that you can be ambitious and present at the same time.

On February 28, 2026, we learned that the United States and Israel launched a major joint military campaign against Iran. That very same day, we had just concluded a CISO event in Chicago and had a founder in town from Israel. He texted me “I need to urgently go home to be with my daughters and family”. There were no direct flights or clear paths to get home. He took a few connections to a boat to get home. Do you think it is a coincidence that this father CEO is also the most responsive founder in my inbox or WhatsApp? Nope.

This example proves parents can and should bring their whole self to work. The cultures I most want to back are the ones where that’s normal, not heroic. Okay, this example is quite heroic, but you get the point.

None of this means you have to be a parent to be excellent. I’ve worked with extraordinary people who chose differently, or for whom that path didn’t open, and they built these same qualities through other crucibles: illness, caretaking, a hard early life, a relentless craft.

Parenting isn’t the only forcing function. It’s just a particularly reliable one, and one I happen to be surrounded by. The deeper point isn’t “hire parents.” It’s that the qualities that make someone great at building things are often forged somewhere other than the building. The forge is what keeps showing up in the people I admire most.

I grew up without a dad. So when I watch the fathers in our network show up: early mornings, hard tradeoffs, present… I don’t take it for granted. I see exactly what it gives a kid, because I felt the shape of its absence. And now I get to watch my kids see it in their father.

To everyone doing this work: it’s making you better, and it’s making the rest of us better by example. Happy belated Father’s Day.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

“Legacy SIEM* was never designed for AI.” -Databricks CEO Ali Ghodsi’s comments following the company’s announcement yesterday of its intent to acquire Panther.

The news took me back to 2018, when I first met Jack Naglieri shortly after he left Airbnb. Jack was beginning to build what would become Panther, and Innovation Endeavors led the Seed round.

My first leap into venture was at Dror Berman and Eric Schmidt’s Innovation Endeavors. Even when I moved on to Glynn Capital, the firm has played a huge part of my career, and I still have a long-standing relationship with the team. When they backed Panther at Seed and introduced me to Jack, helping and leaning in came instinctively.

What stood out wasn’t just the market opportunity. It was Jack’s conviction that security infrastructure needed to be rebuilt for the cloud era.

The dominant SIEM architectures were designed for a different generation of infrastructure. Cloud-native companies were generating exponentially more data, moving faster, and operating in fundamentally different ways than the enterprises those systems were originally built for.

Jack wasn’t trying to improve the existing model. He was trying to re-architect it.

The First Customer

One of the things I’ve learned in venture is that every iconic company has a period where almost nobody believes. The company has to earn every inch of momentum.

For Panther, I had the opportunity to help land one of their earliest customers.

At the time, it felt like a simple introduction. Looking back, it was one of those moments that remind me why relationships matter so much in company building.

Early customers do more than generate revenue. They create credibility. They validate a vision. They give founders proof that the future they’re describing might actually exist.

Stepping on the Gas

As Panther continued to grow, I stayed close to the company and the team.

After I left Glynn Capital and started U&I Ventures, I devoted hours every week and we grew our team to help Panther accelerate growth alongside the leadership team. In fact, the inspiration for buying our first office next to The Moscone Center and building out a “Supper Club” was in large part because of the demand Panther was having with our dinner series, and we were outgrowing renting dinner venues in the city.

The mission was to help the market understand why the SIEM itself needed to be rethought. We were teaching the market a new way to think and our network was pointing to the signal over and over.

Why This Acquisition Matters

This week is Databricks Data + AI Summit in San Francisco, and I heard Ali Ghodsi repeat three themes throughout nearly every major announcement:

Open source. Open integration. Lower costs. Those principles were clearly evident in the Panther acquisition. Security is increasingly becoming a data problem.

And the platforms sitting closest to enterprise data have a unique advantage in solving it. The collapse of traditional software categories as data platforms expand into security, governance, applications, and AI. Infrastructure becomes data. Data becomes security. Security becomes applications. Applications become agents. The boundaries are disappearing. Panther saw that future early and stayed ahead of rapid AI infrastructure needs.

Before the M&A headline, I will reflect on the countless conversations helping explain why the world needed, and still needs, a different approach to SIEM.

This is what makes my heart sing. Not just investing in companies. Helping them build momentum.

Congratulations to Jack and the entire Panther team. It’s been incredible to watch the journey from the earliest days to this moment.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

*For educational purposes for company founders and executives. This is not investment advice or an offer to invest. Refer to Disclaimers.

*SIEM: Security Information and Event Management

Disclosure: The views expressed in this article are my own and are provided solely for educational and informational purposes. Nothing contained herein constitutes investment, legal, tax, or financial advice, nor should it be construed as an offer to sell or a solicitation of an offer to buy any security, fund interest, or investment product. References to U&I Ventures, operators, founders, companies, markets, or investment themes are provided solely to facilitate discussion and should not be relied upon when making investment decisions.

Tomorrow (June 16th) at 10:30am PST, I’ll be co-leading a roundtable that sits at the heart of why I started U&I Ventures.

Over the last decade, I’ve spent my career at the intersection of founders and enterprise technology leaders. From my time at Asana to Innovation Endeavors, Glynn Capital, and now U&I Ventures, I’ve had a front-row seat to how innovation is actually adopted inside large organizations.

And I’ve come to believe something that isn’t discussed nearly enough:

Operators are one of the most underutilized assets in venture capital.

For years, venture capital has largely been built around founders and investors. Operators were viewed as customers, references, or perhaps advisors. Rarely were they viewed as core participants in the innovation ecosystem.

I think that’s changing.

Operators sit closest to reality

1. Founders have a vision.

2. Investors have a thesis.

3. Operators have reality.

They’re evaluating products every day. They’re running vendor bake-offs. They’re deciding whether to buy or build. They’re managing budgets, security risks, engineering velocity, and organizational change.

Particularly in cybersecurity, CISOs have an extraordinary vantage point. They often see technology shifts before the broader market recognizes them. They know which categories are gaining traction, which products are creating real value, and which trends are mostly noise.

When you spend enough time listening to operators, patterns begin to emerge.

That’s one of the reasons we built U&I Ventures around a community of CIOs, CTOs, CISOs, engineering leaders, and technical operators. They help us understand where markets are going, validate customer pain points, and ultimately help founders build better companies.

How we build early conviction

People often ask how you develop conviction when there is very little data.

The answer is simple.

At Seed, we invest in people first and markets second.

Before I look at metrics, I look at founders.

• Can I trust them?

• Can they navigate uncertainty?

• Do they have grit?

• Are they obsessed with the problem?

• Can they attract talent?

• Can they learn quickly?

• Do they move quickly?

One of the smallest signals I pay attention to is responsiveness. It sounds trivial, but how founders manage communication often tells you a lot about their decision-making process, prioritization skills, and operating cadence.

A founder doesn’t need to have all the answers.

But they do need to show up.

The second thing we look for is whether the problem is real. This is where our operator community becomes incredibly valuable. When dozens of CISOs, CTOs, or engineering leaders independently describe the same challenge, that’s a strong signal that a market exists.

Then there is founder-market fit.

Why is this team uniquely positioned to win?

The best founders don’t just understand the problem.

They’ve lived it.

At the earliest stages, conviction comes from pattern recognition, customer insight, and people, not spreadsheets.

AI infrastructure is bigger than applications

One topic I’ll spend time discussing tomorrow is AI and cybersecurity. The biggest misconception I see today is that AI is primarily an application story.

I don’t believe it is.

Every major technology shift creates entirely new infrastructure layers.

• Cloud created cloud infrastructure.

• Mobile created mobile infrastructure.

• AI is doing the same thing.

We’re moving from software that people use to software that increasingly acts on behalf of people. That shift creates entirely new requirements around governance, security, reliability, observability, and control.

New categories are emerging around:

• Agent reliability

• Model governance

• AI security

• Observability

• Evaluation systems

• Developer workflows

• Autonomous engineering platforms

Many of the largest companies created over the next decade may not be the applications everyone is talking about today.

They’ll be the foundational infrastructure companies that make enterprise AI adoption possible.

Why we built U&I Ventures

When we started U&I Ventures, I wasn’t trying to build another venture fund.

“Talent is universal. Opportunity is not.” - Leila Janah

Over the last decade, I’ve become increasingly convinced that one of the greatest untapped opportunities in venture capital is sitting inside enterprise organizations today: operators.

Throughout my career, I watched founders struggle to gain access to enterprise decision makers. At the same time, I watched operators who wanted to participate more actively in innovation but weren’t sure how to get involved.

The answer seemed obvious: connect founders and operators. The hard part was spending the last decade earning the trust required to make those connections meaningful.

Today, founders within our ecosystem gain access to operators who can really add value. The kind of value we all care about and why we are in this business.

We’ve seen introductions turn into pilot programs, meaningful revenue, executive hires, strategic partnerships, and future investors.

For operators, the benefits work both ways.

They gain exposure to emerging technologies before the broader market, opportunities to advise founders, support innovation, and help shape the future of their industries.

The goal has always been simple:

Create win-win-win outcomes where founders win, operators win, and investors win.

Democratizing VC access

One of our core beliefs is that some of the best investors of the next decade will come directly from leaders in operating roles.

Historically, access to venture capital was concentrated among a relatively small group of people and heavily influenced by who you knew.

Today, operators have more opportunities than ever to participate as advisors, angel investors, limited partners, venture partners, and ecosystem builders.

And they bring something incredibly valuable to the table:

First-hand knowledge of how technology is actually purchased, implemented, secured, and scaled.

That perspective matters.

If you’re an operator reading this, here’s my advice:

Start before you think you’re ready.

Most operators underestimate how valuable their experience actually is. You do not need to quit your job and become an investor. In fact, I encourage you to keep your day job.

Your value comes from the seat you’re currently sitting in. The closer you are to real-world problems, the more valuable your perspective becomes.

Start small. Meet founders. Join advisory boards. Become a design partner. Write a small angel check. Share thoughtful product feedback. Help people.

Innovation happens through participation.

The operators who build relationships with founders today will become the advisors, investors, and ecosystem leaders shaping the next generation of technology tomorrow. And perhaps most importantly:

Follow through.

Some of the best opportunities in my life have come from simply showing up, responding quickly, helping people, and being part of a community.

Serendipity is impossible to model.

Many of the opportunities that change your life arrive unexpectedly.

But they rarely arrive if you aren’t in the room. The real work happens behind closed doors.

Keep a low ego.

Be generous with your time.

Do what you say you’re going to do.

And remember that some of your greatest opportunities will come not because you planned for them, but because you showed up when others didn’t.

I hope you’ll join us for the conversation. Kindly email Joaquin@uandi.vc for a calendar invite.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

Important Disclaimer: This article is intended solely for informational and educational purposes. It does not constitute an offer to sell, a solicitation of an offer to buy, or a recommendation regarding any security, investment vehicle, or investment strategy. Any such offer may be made only pursuant to definitive offering documents and only in jurisdictions where permitted by law. Any references to U&I Ventures, current or prospective investment activities, companies, founders, operators, markets, sectors, or investment themes are illustrative in nature and should not be relied upon when making any investment decision. Certain statements contained herein may constitute forward-looking statements that involve risks, uncertainties, assumptions, and other factors that may cause actual results to differ materially from those expressed or implied. Past performance is not indicative of future results. There can be no assurance that any investment strategy will be successful or that any future investment will achieve results comparable to those discussed. Any views expressed are current as of the date of publication and are subject to change without notice. This publication is not intended as marketing material for any private investment fund. U&I Ventures does not accept capital through this publication and is not soliciting investors through this communication.

Models don’t get fined. Agents don’t get audited. The humans deploying them do and right now, most of them are flying blind when it comes to compliance.

Here’s the market reality: regulated industries: financial services, healthcare, any enterprise operating under SOC 2, HIPAA, or GDPR have always had a compliance problem. AI made it urgent. The latest regulations increasingly treat AI-generated communications like employee communications. That means every chatbot response, every AI-drafted email, every agent-generated output now carries the same liability as a human hitting send.

What we found is that the incumbent tools aren’t built for this moment. Most compliance software today works after the fact: review archived messages and let compliance teams review violations retroactively.

In a world where AI can generate thousands of communications in an hour, you need to catch compliance issues before it costs you.

ZeroDrift was built to do this, and today they’ve announcing their $10M seed round. We’re proud to be investors alongside a16z Speedrun, Reign Ventures, and Pitchdrive.

ZeroDrift sits between your AI model and your end user, catching compliance exposure before it ever lands. SOC 2, GDPR, industry-specific frameworks: the system deterministically flags violations and rewrites compliant responses in real time.

It’s not a wrapper. The architecture is roughly 70% deterministic rules and 30% LLM overlay, deterministic for speed and precision, LLM for context and rewrites. Lower latency than a conventional model call.

The CEO, Kumesh Aroomoogan, put it plainly: “We’re able to identify, deterministically, what are all the regulated areas, what’s the violation that’s being broken, and then we have LLMs that can do the rewrites.”

The obvious entry point is consumer-facing AI chatbots, where a rogue response can mean regulatory action, liability, or headlines. But Kumesh sees the larger opportunity in fully automated AI pipelines, machine-to-machine outputs that no human ever reviews. That market barely exists today. It will grow as AI proliferates. We believe it will be enormous.

We’ve been watching the agentic AI stack come together in real time as AI governance has become a board-level concern. The infrastructure to address it is being built right now.

Full TechCrunch article here: https://techcrunch.com/2026/06/02/zerodrift-raises-10-million-to-protect-ai-models-from-themselves/

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

One of the most valuable things about working closely with operators in U&I Ventures is the perspective we gain from people with boots on the ground, seeing how technology is being adopted, deployed, and reinvented in real time.

We wanted to share our learnings beyond what we posted on Linkedin today.

The bottleneck isn’t (just) model capability

A few key learnings below that go beyond U.S. data center energy demand (projecting to nearly double in 2.5 years), straining local land, power grids, and water supplies as AI buildouts accelerate.

→ Governance, data quality, auditability, and operational complexity are slowing enterprise AI adoption far more than model performance.

→ Data remains the single biggest unlock & the single biggest risk for any organization deploying AI at scale.

→ Security has shifted from cost center to business enabler, tied directly to customer trust, revenue, and enterprise readiness.

→ Agentic systems will live or die on governance, deterministic policy layers, human-in-the-loop workflows, and operational controls.

The net net: the biggest opportunities in AI likely sit in the infrastructure layer - orchestration, compliance, reliability, observability, and the enterprise control planes that make AI usable in production.

“The Great Slowing”

One operator coined: the great slowing.

The idea is that as enterprises bolt on guardrails, adjudication layers, and governance controls, latency and operational friction increase before the technology matures. The cost of safety, paid up front.

It’s a useful frame. The winners in enterprise AI won’t be the teams with the flashiest demos. They’ll be the ones who can operate inside complex, regulated, real-world environments and ship anyway.

On models: depth beats breadth

A spirited debate on frontier labs vs. industry-specific models. The room landed firmly on domain-specific depth.

→ Current corporate AI implementations were described (generously) as “milquetoast.” Nothing truly transformational yet.

→ The smart money is moving toward AI services companies, not new model companies. Think AI law firms, not legal-specific foundation models. Cheaper to stand up a services business than a data center.

Build vs. buy: a market in three parts

→ Large enterprise: buy for scale, build on top.

→ Mid-market: build with small engineering teams, CAPEX-sensitive.

→ SMB: forced to buy. No internal talent to build.

The cautionary tale heard repeatedly: internal AI projects have a six-month half-life. Several leaders described $5–10M write-offs on builds that aged out before they shipped. Buy options are immature today, but the build penalty is real.

Security is finally getting funded because AI made risk legible to the board.

→ Password management elimination is gaining real momentum vs. traditional approaches.

→ Network-based policy enforcement is having a moment.

→ The AI mandate is unlocking budget for security tools that couldn’t get approved 18 months ago.

The companies we’re most excited about right now are the ones being built for this exact moment: the slow part, the messy part, the part where AI has to actually work inside a large enterprise.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Yale professor Laurie Santos launched “Psychology and the Good Life” in 2018, the most popular course in Yale’s history. I read her work. Her thesis was simple and devastating.

Our brains are wired to chase the wrong things. More money. More status. More outcomes. And when we get them, the satisfaction we hope to expect never arrives. The brain moves the goalpost. Always.

That hit differently when I found myself working inside tech and venture capital, an industry almost entirely organized around moving goalposts.

I took early bets on myself and worked for less cash in exchange for as much equity as possible. I wanted more money. I actually needed more money to survive. This was not new for me, however, and I had nothing to lose because I didn’t have anything to lose. I did want those outcomes the research talks about, though.

I worked long hours, taught myself new systems (e.g., I took night classes at code academies in San Francisco, I learned to program and design, I read books on how VC works and how entrepreneurs, LPs, and investors make money). I also have an incredibly long list of people to thank who believed in me. They know who they are, and they are also very humble, and don’t need their name tagged.

Fast forward nearly 15 years in, married for a decade, plus two beautiful kids… and I did start to see the fruits of my bets and the cash started to come in.

I got a phone call this Friday from a VC telling me he conducted a survey and sent it out to all of his founders, and asked one question: “Who is the most helpful VC that is not a lead on your cap table?”… He told me, “Kim, your name came in as #1”. My cup is full. Goalpost is moving. Side note: There will be an entire post on why making other people happy makes me happy. It 100% stems from how I was raised.

When I decided to build U&I Ventures (mind you, with my own cash, post-taxes in the earliest days), I made an unusual bet. On people.

First and foremost, the people hired to build our firm. And the 1,800 CTOs, CIOs, and CISOs in our network that Kim Cooper (our Founding Operating Partner) and I have known our entire careers, spanning from our days at Stanford, Harvard, Google, Asana, Innovation Endeavors, and Glynn Capital. These people are operators who actively work on the hardest problems inside global 2,000 enterprises. They know what “good” actually looks like from the inside. They don’t need a fancy pitch deck to smell a real solution from a dressed-up one. And guess what? Most of them have never been included on the fund side to have a real seat at the table. I am talking about real relationships and opportunity, not just a phone call for completing due diligence.

Santos talked about how meaning and social connection are among the few things that genuinely move the needle on human satisfaction, not as an afterthought, but as the actual mechanism. The brain responds to real relationships differently than it responds to transactions.

We built around that and leaned in. Every event we host, every founder we introduce, every CXO meal around a table. It’s not pipeline generation dressed up as community. It’s the actual work and the trust we have built. Generating cash is table stakes in this business. The fulfillment I get for out-hustling and winning even in the most competitive situations is not cash. The relationships are the big returns.

Here’s what I’ve found: when you surround a category-defining founder with 30 people who’ve lived the problem they’re solving, something different happens. The feedback is real. The conviction deepens or breaks. And when a company like Pluto, Fig, or Plurai walks into a room of buyers who immediately understand what they’ve built, that’s not a meeting, that’s a verdict.

Santos also made the point that impact and engagement create more lasting satisfaction than passive accumulation. You have to be in it. Proximate to the work. Actually present to the value you’re creating, not just tracking it on a spreadsheet.

That’s what venture capital looked like before it became an asset class obsessed with its own metrics.

We’re trying to remember what it looked like before.

The 1,800 people in this network didn’t join because of our fund size or our logo. They joined because the conversations were worth having. Because their time was respected. Because we built something that feels and I don’t use this word lightly, meaningful.

Santos was right. The goalpost moves. So we stopped chasing it.

We built the field instead.

Connectors, MCP servers, agentic workflows, it’s new ground to cover, and there hasn’t been a clean way to map it.

We wanted to share something useful that just landed in the community: ClaudeSec - a free knowledge hub focused entirely on the security side of the Claude ecosystem. (Disclosure: it’s built by Pluto Security, our first portfolio company at U&I Ventures.)

What’s inside:

→ A searchable index of current Claude connectors in one place

→ Risk classifications and suggested guidelines for the higher-risk ones

→ Updates from Anthropic as the ecosystem evolves

→ Research write-ups on emerging threat models

It’s the kind of resource we wished existed six months ago, and it’s the kind of work we think the broader security community can benefit from, regardless of which AI tools your organization is leaning into.

More on why we backed Pluto

Our thesis: The explosion of business-built AI applications (Lovable, Bolt, Cursor, v0, Claude, and everything coming next…) has created an unavoidable new security surface that incumbents aren’t structurally positioned to cover.

AI builder platforms themselves are incentivized to optimize for speed and creativity, not to be neutral systems of record across competing tools. AppSec, CNAPP, and SASE vendors approach the problem from source code, infrastructure, or the network, but AI-built artifacts sit between those layers.

Pluto is building the neutral control plane that sits above and across all of it.

The founders, Shahar, Tal, and Gil bring a rare mix of product intuition, deep security pedigree (Microsoft, Palo Alto Networks, 8200, Nvidia), and the kind of category-creating instinct that’s required to define a net-new market.

By the time we ran our diligence with 65+ security practitioners, the conviction across the room was clear: this problem is real, growing, and largely unaddressed. ClaudeSec is one expression of that thesis in action.

If you’re a CISO, security engineer, or anyone thinking about how to deploy Claude responsibly inside your org, take a look: claudesec.pluto.security

And if you find it useful (or have ideas for what’s missing), we’d love to hear it to be helpful to others. The more security leaders contribute to resources like this, the better the whole ecosystem gets.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

This is Part II from yesterday. As a recap, we stated that the enterprise AI stack has been changing for the last 36 months, and incumbents are being replaced. The new architecture isn’t settled yet, and that’s exactly where the opportunity lives. We’re still early. The full displacement will take at least 5–10 years. Meeting new founders on our side has been happening at warp speed. Founders need answers within hours after being introduced.

There is no shortage of capital flocking to what we call the type of founders we meet with as “money magnets”. Great founders don’t chase capital; they attract it.

CIOs, CTOs, & CISOs are pressure-testing these founders. Enterprise operators are asking the same uncomfortable questions behind closed doors - do we buy or build? Here’s what our pipeline is revealing.

Enterprise software is being rebuilt around AI

One of the most interesting patterns in the pipeline has been targeting enterprise operators: people who have spent careers inside the major CRMs, ERPs, and service management platforms, who are now building the next generation of internal tooling.

The problem they’re solving is one every large organization knows intimately: tribal knowledge locked in spreadsheets, Slack threads, and undocumented workflows.

The vision is an AI-native layer that lets operators and developers build and deploy internal applications in days instead of quarters.

The incumbent platforms were not built for a world where AI can understand business logic and generate working applications from plain language. The companies building the interface layer between human intent and enterprise systems (and capturing the institutional knowledge that lives inside those systems) will be very difficult to dislodge once embedded.

AI development infrastructure is massive.

The other non-security thread running through the pipeline: the tooling layer for teams building AI products. Prompt management, evaluation frameworks, LLM orchestration, monitoring, observability. A year ago these were things engineering teams cobbled together internally. Today, they’re a real category with real enterprise customers paying real money.

What’s notable is who the buyers are. It’s not just AI-native startups. It’s large global enterprises with cross-functional teams building AI features for their end users, who need the same rigor around AI development. Version control for prompts. Testing for model behavior. Monitoring for drift and degradation in production. These are software engineering problems, and need software engineering solutions.

Companies that figure out the full stack will look like the operating system for enterprise AI.

Observability is the unlock

Observability is the foundational layer beneath everything. You can’t enforce compliance on communications you can’t see. You can’t detect anomalous data movement without a granular record of what normal looks like. You can’t govern AI agents without logging every action they take. You can’t improve an LLM-powered product without measuring what it’s actually doing in production.

The companies working on security-first and AI-grade observability are not telling a flashy autonomous agent story. But they’re building the substrate that makes every other tool smarter over time. The moat is data, and the data compounds with every customer and every event logged.

The companies that will matter in five years are the ones solving for a world where AI is generating, communicating, and acting at speeds humans can’t supervise.

That bar is harder to clear than it sounds. And more companies are clearing it than expected.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

The enterprise AI stack has been changing for the last 36 months, and incumbents are being replaced. The new architecture isn’t settled yet, and that’s exactly where the opportunity lives. We’re still early. The full displacement will take at least 5–10 years. Meeting new founders on our side has been happening at warp speed. Founders need answers within hours after being introduced.

There is no shortage of capital flocking to what we call the type of founders we meet with as “money magnets”. Great founders don’t chase capital; they attract it.

CIOs, CTOs, & CISOs are pressure-testing these founders. Enterprise operators are asking the same uncomfortable questions behind closed doors - do we buy or build? Here’s what our pipeline is revealing.

The “after the fact” era in security is ending.

For the last decade, almost every security category operated the same way: something bad happened, and then a tool flagged it. Archive, monitor, review, remediate. That’s how compliance works. That’s how most of DLP works. That’s how most of the SOC works.

That model is breaking down and the most compelling founders showing up right now are all making the same architectural bet in response: intervene at the moment of action, not after the fact.

The shift is showing up across communication security, data movement governance, and compliance tooling. The thesis is consistent across categories: the window between incident and detection is too long, the cost of retroactive review is too high, and the volume of AI-generated activity has made human-speed monitoring structurally obsolete. The companies getting serious traction are the ones that enforce at the point of execution, before a message is sent, before data moves to an unauthorized destination, before an agent action completes outside policy. Not a dashboard to review next week. A firewall at the moment it matters.

The SOC is being rebuilt from scratch & agentic delivery is here.

The staffing-to-workload gap in security operations isn’t closing. It’s widening. The industry has produced two responses, neither of which fully works. Traditional SaaS gives teams a better interface but still requires humans to act on every output. Horizontal agent platforms are validating enterprise appetite for agentic delivery at scale, but generic agents struggle with the specificity of security workflows, the toolchains, threat environments, and escalation conventions that CISOs have spent years building.

What’s emerging in the pipeline is a more targeted thesis: purpose-built security agents that don’t just surface work, but complete it. Alert triage that runs overnight. Compliance questionnaires that fill themselves. Vulnerability remediation that closes the ticket without a human in the loop. The business model is shifting too: from software licenses to outcome delivery, closer to managed detection and response than traditional SaaS. Businesses are moving toward outcome models to eliminate waste.

The primary difference between outcome delivery (often called Outcome-as-a-Service or OaaS) and SaaS is what you pay for: SaaS provides the tools for you to do the work, while outcome delivery provides the end result itself.

AI model security and LLM integrity have gone from research topics to new categories.

A year ago, “securing AI” meant adding guardrails to a chatbot. What’s showing up in the pipeline now is a much more serious version of that problem and a much more serious set of founders working on it.

Prompt injection, adversarial inputs, model weight integrity, hallucination under adversarial conditions- these are moving from academic papers into production security requirements. Enterprises deploying AI at scale are discovering that the threat model for an LLM is fundamentally different from the threat model for traditional software. The attackers have figured this out faster than the defenders.

Multiple companies in the pipeline are working at this layer - not on the application wrapper, but on the model itself. The moat here is deep technical credibility.

---

Agent identity is a huge governance gap.

For companies adopting agents, machine identities typically outnumber human identities in enterprise environments. Every agent has permissions, makes decisions, and takes actions on behalf of the business. Almost none of the existing identity infrastructure was built to govern that.

This theme shows up across the pipeline in several forms: companies building non-human identity (NHI) as a standalone category, companies governing which tools agents can call and logging every action for compliance, and companies building runtime enforcement layers that catch unauthorized agent actions before they complete. The common thread is the same: the governance layer for AI agents is being created right now.

This is just part one of what we are seeing. We will share part two tomorrow.

---

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

Follow us on LinkedIn

Here’s an uncomfortable question anyone using models should be asking:

“What assumptions about my system being stable are no longer true—and where am I blind to that?”

Because this isn’t really about a model upgrade. It’s about the fact that your system is now dependent on a component that can change its behavior in ways that are:

• non-obvious

• non-deterministic

• and not fully inspectable

Which means a lot of what feels “stable” in your stack is actually borrowed stability from the model.

And when the model shifts, that stability can disappear without anything explicitly failing. So the deeper version of the question is:

Where am I relying on consistency that I’m not actually controlling?

That’s the part most teams don’t map and it’s exactly where things break quietly.

If you’re running AI in production, the important question isn’t “is it better?” It’s “what changed under the hood and where will that surface?”

Anthropic didn’t just tune their most recent model. They changed multiple layers at once: tokenizer, reasoning controls, API behavior, and output structure. That combination matters.

These aren’t cosmetic tweaks. They alter how the model:

• interprets inputs

• allocates reasoning effort

• structures outputs

• interfaces with downstream systems

The tokenizer change, in particular. Tokenization defines how the model “sees” text.

You won’t necessarily see obvious failures. Instead, you’ll see drift:

• the same prompt produces a meaningfully different answer

• structured outputs no longer match assumptions

• tool calls are logically correct but structurally off

• reasoning depth varies unless tightly controlled

Nothing breaks outright. But the system is no longer behaving the same way.

That’s the risk with upgrades like this. Benchmarks go up. But production systems don’t fail on averages, they fail on edge cases, distribution shifts, and small inconsistencies that compound across steps.

If you’re upgrading, treat it like a migration:

• re-run evals on real production data (not just curated tests)

• look for what breaks, not just what improves

• validate structured outputs and tool use end-to-end

• actively probe edge cases

For companies like Plurai that sit in the critical path before deployment, model changes like this are exactly where their value shows up and why we backed them at U&I Ventures.

When a model fundamentally changes how it tokenizes, reasons, and structures outputs, you’re no longer validating performance, you’re validating behavior under a new system.

That’s a different job.

Most teams still think of evaluation as “does this model perform better on my benchmarks?” But what actually breaks in production isn’t top-line performance. It’s everything around it:

• assumptions baked into prompts

• fragile parsing logic

• tool call schemas

• multi-step workflows that depend on consistency

This is where Plurai becomes essential.

Because what needs to be tested isn’t just accuracy, it’s stability across real-world conditions:

• Does the model behave consistently across similar inputs?

• Do outputs still conform to the expected structure?

• Do edge cases degrade gracefully or cascade into failures?

• Do small deviations compound across chained steps?

A model like Opus 4.7 introduces behavioral variance, even when it’s “better” overall. And that variance is exactly what breaks production systems quietly.

Plurai is helping surface that hidden drift before it hits users.

If you’re relying on AI in production, you’re not just managing model quality, you’re managing system reliability.

And every model upgrade is a potential source of regression, even when benchmarks say otherwise.

Simulation, evaluation and protection isn’t a one-time step before deployment.
It’s continuous validation against a moving target.

And companies that treat it that way will ship faster and break less.

As a reminder for our readers, U&I Ventures backs next-gen founders shaping the future of intelligent systems. We are focused on Seed stage 🌱 & deliver value creation magic 🪄 (IYKYK).

We look for exceptional founders building enduring AI-native software infrastructure companies at the intersection of engineering, IT, and security to solve massive business problems.

If this is you, get in touch (deals@uandi.vc)

P.S. We will be in NY hosting AI leaders for dinner on May 4th with Ilan and Elad, Co-Founders of Plurai along with another stealth team we backed. Let us know if you’d like to join us!

Welcome to U&I Connect!

This is our first of many posts where we will share learnings from U&I Ventures on:

• Emerging technology trends, insights, and analysis within software infrastructure

• Career moves & open roles

• Events

You’re receiving this because we believe our updates align with your role in our community. Unsubscribe anytime.

Unsubscribe

Let’s Get Into It

Thanks for spending time with us at RSA, around our table at 500 Bryant, & virtually. These conversations shape how we think.

From our corner of San Francisco, we love sharing what’s taking shape across the U&I ecosystem: what’s working, what’s not, & what’s coming next.

More to come & deeper dives in our LinkedIn newsletter.

What’s 🥵 For Developers and Builders

Opus 4.7 dropped this morning. And just a few days ago, leaked screenshots suggest they’re coming for Lovable, Replit, Bolt, Figma, Wix next. We broke it all down - the growth curve, the model landscape, the vibe coding disruption, and what IGV being down 22% YTD actually means for enterprise software. Read more here.

Is AI Eating IT & Security?

Coming out of RSA 2026, one conversation kept surfacing across our CISO community: Is AI fundamentally dismantling — or transforming — IT and security?

We hosted a fireside chat with Amy Farrow and Alex Stamos to unpack this topic with over 200 CXOs. Read our full write-up here written by our advisor, Stephanie Losee, Director and Executive Editor at Salesforce.

5 RSA Takeaways

1. The “Bug Apocalypse” Is Already Underway

2. Every Attacker Is Moving Up a League

3. Does This Plateau?

4. Security Teams Are Becoming Builders

5. Operational IT Is Being Absorbed

What Operators Thought About U&I Ventures at RSA 2026

“This event brought so much positive energy — it’s hard to explain. It may have been my favorite part of RSA.”— CTO

“Really enjoyed the event — great to see so many familiar faces. Alex’s comments have stayed with me and sparked some interesting thinking around prioritization.” — Director of Cyber Security

“A fabulous gathering — I really appreciated the chance to connect with other leaders facing similar challenges and decisions.”— CISO

Here’s What CISOs Think Right Now

AI adoption is fragmented

• Some teams operating freely, others tightly locked down

• Claude / Claude Code emerging as enterprise default (controls + governance)

Agentic AI introduces new risk

• Limited visibility and monitoring

• Easier for threat actors to deploy autonomous agents

Regional divergence (Europe)

• Smaller companies blocking AI

• Larger enterprises moving aggressively

Compliance & Risk Signals

• Cyber insurance under pressure (payouts > premiums → shift toward self-insurance)

• AI compliance still nascent (ISO 42001 not yet demanded)

• Security questionnaires remain broken (low signal, high volume)

• Auditors increasingly using AI to probe deeper

• SOC 2 incentives misaligned (“clean” reports, weaker rigor)

• Regulation creating unintended behavior (e.g., Cyber Resilience Act workarounds)

• Exposure windows collapsing (90 days → 1–2 days)

💬 Operator Ask / Question from the Network

One of our operators shared:

"How are you reducing defender workload with AI automation in highly regulated environments? We have 100+ security tools burning 40% of our budget, but banking regulations make AI adoption complex and identity management is becoming our biggest bottleneck for any agent deployment."

If you’re seeing strong solutions in this space, please reach out to KimC@uandi.vc.

💚 Welcome U&I Ventures-Backed Founders

• Shahar Bahat, CEO, Co-founder, Stealth

• Tal Ofer Regev, CPO, Co-founder, Stealth

• Gil Maman, CTO, Co-Founder, Stealth

• Ilan Kadar, CEO, Co-Founder, Stealth

• Elad Levi, CTO, Co-Founder, Stealth

👋 Welcome New U&I Ventures Network Operators

• John Barrow, CISO/Advisor, JB Poindexter & Co./LaunchPoint Collective

• Christopher Smedberg, Director of Cybersecurity, Advance

• Or Cohen, VP/ Technical Product Engineering, Palo Alto Networks

• Alex Green, CISO, Delta Dental Plans Association

• Sandipan Ghosh, Sector Lead-Firmwide Innovation, Morgan Stanley

• Brian Waeltz, CISO, Cardinal Health (former)

• Bradley Schaufenbuel, VP/CISO, Paychex, Inc.

• Brandon Sterne, CISO, Basis Theory

• David Sledge, CISO/Advisor, Secure Seed Capital/Launchpoint Collective

• Corey Kaemming, CISO, Valvoline Inc.

• Kelly Haydu, CISO/CIO, CarGurus (former)

• Ingmar Krusch, SVP Engineering/CTPO/CIO, HelloFresh

• Mike Geehan, Head of Security/Compliance/IT, Cockroach Labs

• Joyce Chen, Founder & CEO, Chen & Foundry

• Ben Rothke, Sr. Information Security Manager, Experian

• Rohan Singla, CISO/CIO, ChargePoint

• Quincey Collins, CSO/Advisor, Sheppard Mullin Richter & Hampton LLP

• Bill Hayward, Sr. Director/IT & Security, Crusoe

• Cora Han, Chief Health Data Officer, University of California Health

• Renee Delphin-Rodriguez, Chief Legal Officer & General Counsel, SCAN

• Colin Blackman, Director of Engineering - Security Monitoring Services, Dell Technologies

• Craig Schwartz, General Counsel, Head of InfoSec, Nominal

• Sahil Bhanushali, Head of Technology Risk Management and Assurance, Lucid Motors

• Daniel Bowden, Global Business CISO, Marsh

• Scott Morgan, Data & Analytics Manager – Head of AI and Data Strategy, LinkedIn

We’re excited to have you in the community.

🚀 New Roles & Moves

A few updates across the network:

• Amy Farrow → CIO, Celigo

• Chetna Mahajan → CIO, Public Company (TBA)

• Ingmar Krusch → SVP Engineering (Infra, Data, Security, IT, Agentic Eng), HelloFresh

• Julie Irish → CIO, Alteryx

Open Roles

• Head of Security at pre-IPO legal software company in San Francisco

• CISO at pre-IPO software company in San Francisco

• CISO at Public Company in the Retail/Food & Bev space HQ in Boston

• CIO at AI search engine company in San Francisco

If you’d like to discuss career opportunities, please reach out to KimC@uandi.vc.

📚 Good Reads From the Security Community

• [un]prompted conference (pre-RSA) — exceptional content, now fully available + queryable via NotebookLM

• Greptalks.ai — AI-curated security conference insights by Caleb Sima
  → ~500 talks across major conferences
  → Dual perspectives: deep technical + business lens

📅 Upcoming Events

Google Next Engineering & Security Leaders Brunch April 23 | Las Vegas

NYC ML/AI Executive Leaders Dinner May 4 | New York

We’ll continue sharing what we’re seeing across the network & would love to hear what’s top of mind for you.

Warmly,

Kim Moore & Kim Cooper