contosec
contosec / Articles

AI Is Not Failing. We Are Still at the Beginning.

Why the skepticism about AI is understandable, and why I think it is aimed at the wrong time horizon.

The views and opinions expressed here are my own and do not represent Microsoft.

It is Sunday afternoon. I am in a Starbucks in Philadelphia. I drove my son down from home in Connecticut this morning for a meeting with the United Nations Youth Delegate Programme (and yes, I am a very proud dad, what?). It is a long drive, but worth it, and now I have four hours to fill. I have been working, stopping every once in a while to play some chess. At some point I read Satya Nadella's latest Scratchpad post, and it pulled me straight back to a conversation I had at a party the night before. Calling it a night is generous, the party topped out in the evening, which I am told is what coming of age looks like. That is what made me decide to spend part of this time writing.

It was one of those conversations about AI. A friend of mine is sharp, uses the tools, and is skeptical. His argument kept landing on the same point: it makes things up, it misses things, and he does not see the value. I made several arguments back. This article is an attempt to write them down more clearly.

AI was not the only thing in the air that evening. There is a lot of hype to go around right now, and the group kept circling back to the SpaceX IPO this week. I kept hearing people who clearly did not understand how any of this works say they were taking out loans to buy the stock, and that always sets something off in me. There is a pattern in history: when retail investors start borrowing money to chase a hot asset, it is usually a reliable signal that the moment has passed for the people who understand it. I am a Boglehead by conviction, index funds, long time horizon, boring on purpose, and that has taught me to stay unimpressed by the noise at peaks. I do pick a stock now and then, for the fun of it, and I have lost maybe 1 time out of 3, because I never quite know when to get out. If you are borrowing money to buy a single stock you cannot explain, you are not investing. You are making a bet, and Vegas has better lighting. Anyway, I am wandering off, and that is a conversation for another day.

The pattern underneath it, though, is the same one that shows up with technology. People either dismiss it completely because the early version does not work perfectly, or they overcorrect and treat every new product launch like a once-in-a-generation event. The more useful posture, in investing and in technology, is to understand where you are in the cycle and think clearly about what that implies.

Why the Skepticism Is Understandable and Also Misplaced

Every major platform shift in the last fifty years followed the same curve. The personal computer did not transform businesses the day it launched. It took almost a decade for the software layer to mature enough that a typical office worker could justify the cost. The internet started as email and text, e-commerce was slow and unreliable, and the full transformation of commerce, media, and work took another fifteen years to materialize in ways that became embedded in how companies operate. Smartphones took years of hardware iteration, app ecosystem development, and network maturation before mobile became central to how organizations actually work. Cloud computing is perhaps the most instructive example because it is the most recent: early adoption was confined to startups, enterprise migration was slow and cautious, and some companies are still mid-migration today.

We are less than four years into generative AI as a mainstream technology. By the standards of every previous platform shift, we are at the very beginning of the curve.

My friend's frustration is legitimate if you benchmark AI against what it will eventually be. It is less reasonable if you benchmark it against where every comparable technology was at the same point in its development. No one dismissed the internet in 1995 because you could not yet stream video. The infrastructure and the applications built on top of it took time to compound into what the internet became.

What Is Already Remarkable

For the first time in history, a machine can hold a sophisticated technical conversation with a person. It can reason across domains, synthesize large volumes of information, write working code, and produce outputs that are useful across a wide range of tasks. Last week I watched Boris Cherny, the engineer who created Claude Code, say in a Bloomberg interview that AI now writes around 80% of the production code on his team at Anthropic. That is mind blowing to me. This would have seemed not just difficult but categorically impossible twenty years ago. No roadmap existed for getting here.

When I stop and actually think about what this means, it is disorienting, in the best way. We built a machine. Then we made that machine reason. Then we taught it to communicate with us, and now we are on a path toward something that may eventually be smarter than any individual human. And all of this runs, at its foundation, on microscopic transistors, electrons moving through silicon at scales that are hard to visualize. The physics of it, that those tiny movements of charge translate into something that can write a poem or explain a protein structure or debug a legal argument, is one of those things that stops me when I let myself think about it seriously. I do not know what it says about what we are or where we are going. For me personally, this is at least comparable to sending humans to the moon. Maybe above it. The moon required tremendous engineering. This required building something that thinks.

The current limitations, making things up, struggling with edge cases, inconsistency across complex multi-step reasoning, are real. They are also engineering problems of the kind that historically get solved as the systems scale and the methods mature. The trajectory from where this started to where it is today is steep enough that ruling out continued progress is a hard position to defend.

Three Frames for Thinking About Value

When my friend said he does not see the value, I asked where he was looking. His experiments had mostly been standalone chat interfaces, tasks that were more novelty than workflow. So here is how I broke it down.

Personal productivity. This one is working now. Summarizing meeting recordings, drafting emails, building a first version of a presentation from notes, these are tasks where AI compresses time in a way that is not theoretical. The output needs human review and correction, but the draft happens in seconds instead of thirty minutes. For anyone managing a dense workload, that is a real gain.

Process and workflow redesign. This is harder and more valuable. The idea is not to drop a chatbot into an existing process. The idea is to look at your organization's actual workflows, find where human time goes into high-volume, lower-judgment tasks, and redesign those workflows with AI in the loop from the start. Routing decisions, classification, summarization, extraction from large document volumes, pattern matching across datasets: these are the places where the redesign pays off. Most organizations have not done this work yet, which is one reason the aggregate productivity numbers from AI adoption have been slower to show up than the individual-level results. The platform has to be embedded in workflows before it shows up in output.

The other half of that work is making the output trustworthy. A language model is probabilistic by nature, and you cannot hand a probabilistic answer to a process that needs the same result every time. So the real engineering is wrapping the model in deterministic structure: constrained inputs and outputs, validation steps, checkpoints where a wrong answer gets caught before it moves downstream. The companies getting value are the ones turning a tool that is right most of the time into a system they can actually rely on.

At the party, another friend in the group was explaining what Spotify has been doing with AI-generated music. I did not make the connection in the moment, but sitting here this afternoon I think it is actually a good illustration of this second point. Spotify has been quietly restructuring its catalog to surface more AI-generated tracks. The reason has nothing to do with quality. When a human artist's song streams, Spotify pays a royalty. When an AI-generated track streams, the royalty dynamics are different and the margins improve. So the company is rethinking its recommendation algorithms, its playlist curation, and its promotional surfaces to place AI-generated content where it captures listening time. This is not Spotify automating its customer support or replacing engineers. This is Spotify looking at one of its core cost structures and asking what AI changes about the economics. That is the exercise: not "how do we use AI as a tool" but "which of our processes or business model assumptions look different now that this exists."

Competitive differentiation. The third area goes further. The organizations that will pull ahead are not the ones doing existing things faster. They are the ones asking which products become possible that were not before, which research directions become worth pursuing because the search space is no longer prohibitively large, which new things can be created or discovered that would have required a decade of work under the old approach. This level of engagement requires a different mindset than "let us try the chatbot."

A Concrete Example From My Own Field

I have spent a significant part of my career working in and around M&A transactions in cybersecurity, and I want to use that experience to make the second and third areas more concrete.

When a company opens the due diligence period in an acquisition, cybersecurity is one of the most time-consuming workstreams. The reason is straightforward: before a buyer can sign off on the deal at the agreed price, they need to understand what they are actually acquiring. That means building an asset inventory from scratch for an organization you have limited access to, mapping the attack surface, identifying vulnerabilities, assessing the maturity of identity and access controls, and producing a risk register that can inform the negotiation. The findings do feed into deal terms, including remediation escrow arrangements where a portion of the purchase price is held back against security gaps found. But the bigger cost is often what comes after close.

Once the deal closes, the real integration work begins, and this is where the budget can become very large very fast. If it is a merger, you need to consolidate two identity environments, two Active Directory forests, two sets of access policies, two joiner-mover-leaver processes, two privileged access models. If it is a divestiture, you need to separate them cleanly so the carved-out entity can operate independently. The mechanism that governs this period is the Transition Services Agreement, or TSA. The seller keeps providing IT services, including identity infrastructure, email, and system access, to the divested entity for a defined period, typically anywhere from six months to two years, while the buyer builds out its own environment. The TSA has a cost, and exiting it has a larger cost. Getting off a TSA in identity terms means migrating users, rebuilding trust relationships, decommissioning federated infrastructure, and standing up a new identity stack from scratch. Organizations hire large consulting teams to do this work, and these projects run for months and cost millions. That TSA exit budget is a real and substantial line item in every significant transaction, and it is largely driven by how well the due diligence phase understood the environment to begin with.

Now think about what changes when you redesign this process with AI. The due diligence workstream that today requires weeks of manual analysis, access requests, interviews, and consultant time can be approached differently. AI can ingest Active Directory exports, cloud configuration data, vulnerability scan outputs, and network diagrams and surface an initial asset inventory and risk picture in a fraction of the time. The analysis that used to mean a team of people working through data sequentially can happen in parallel, with broader coverage and less human triage under time pressure. A better-understood environment going into close means a more accurate integration plan. A more accurate integration plan means a shorter TSA, because you are not discovering the complexity of the identity environment six months after signing. And a shorter TSA means lower costs on both sides of the deal. The seller wants off the hook for providing services. The buyer wants independence. Both benefit when the due diligence phase produces a clear enough picture that the TSA can be scoped tightly and exited on time.

I use M&A because it is an area I know well and the workflows are complex enough to make the example concrete. The same logic applies across industries. Healthcare has compliance and records workflows. Legal has document review. Financial services has risk and audit processes. Every industry has workstreams that are expensive, time-consuming, and built around human analysis of large volumes of structured and unstructured data. M&A cybersecurity is just my version of the example.

Where I Think This Is Going

My friend and I have talked separately, on other occasions, about where I think things are going. Here is that part.

The abstraction layers we use to interact with computers today may not survive this transition. We think of email as a given. We think of word processors, presentation tools, spreadsheet applications, all the interfaces we have built up over decades, as permanent features of how work gets done. I am no longer sure they are permanent.

If AI becomes a capable enough interface between humans and computation, the specific applications may stop mattering. Instead of opening an email client to write a message, you describe what you want to communicate and an agent composes it, sends it, and manages the thread. Instead of opening a document editor, you describe what you need to produce and the agent produces it, formatted, drafted, with the references pulled in. The interface is the conversation with the AI, and the agents handle the execution in whatever tools are needed behind the scenes.

This has significant implications for the software industry. A large portion of the cost in software development and product design today goes into the interface layer: the UI, the user experience design, the front-end engineering. If the interface becomes the AI and the agent, that cost structure changes. The value shifts from designing how humans interact with software to defining what agents are authorized to do and how the outputs are validated. That is a very different design problem, and it is one the software industry has not fully absorbed yet.

That Scratchpad post I mentioned at the start is what tied this together for me. Nadella's point is that the companies that will retain control in this environment are not the ones that pick the best AI model or buy the best AI product. They are the ones that encode their institutional knowledge and domain expertise into systems they own and develop.

The reason that distinction matters is straightforward. If your competitive advantage comes from using an AI product that anyone can purchase, you do not have a competitive advantage. Your competitors buy the same product. Everyone gets the same productivity gain. The playing field shifts but stays level. What is harder to replicate is what you build on top of your own knowledge using AI as the tool. The research team that uses AI to generate and validate hypotheses faster than any competitor in their space, the engineering firm that trains models on decades of proprietary process data to find efficiencies no external product would know to look for, the materials science group that combines domain expertise with AI to explore compound structures and discover a battery chemistry that is cheaper to produce and lasts longer, that is where the durable advantage lives. It is not in consuming AI. It is in using AI to do something with your knowledge that you could not do before.

What I Took Away From the Afternoon

Four hours in a Starbucks on a Sunday is not something that happens very often. No schedule, no one needing anything, just a few quiet hours while I wait for my son. Hours like this are easy to waste and hard to come by in a normal week.

What I kept coming back to is that the skepticism my friend expressed is a reasonable response to a technology that is not yet reliable enough for every use case. It is also, I think, a response to looking at the wrong time horizon. The value of the internet in 1995 was not visible if you measured it by whether the websites were good. The value was in the infrastructure being built and in the fact that the direction of travel was clear.

The direction of travel here is clear. The machines are getting better, the ecosystems around them are maturing, and the people who understand the terrain early are accumulating an advantage in how to use these tools that a late adopter will have to work to close. You do not need to be an evangelist to take that seriously. You just need to look at the historical pattern and ask whether this time is fundamentally different.