deepaklypse

19.9% vs 4.1%: AI's Login Risk Sits With Deployment Vendors, Not Model Makers The headline numbers describe an AI supplier base that struggles with basic security hygiene: patching known flaws, locking down email domains against impersonation, and keeping employee logins out of criminal marketplaces. Nearly one in ten companies assessed (9.8%) ran software with a flaw on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, meaning attackers have already used that flaw in real attacks. The more useful finding for enterprise buyers is where the exposure concentrates. Credential leakage is highest among the vendors that implement and operate AI for customers, the category that typically receives access to cloud accounts, development environments and production data, and lowest among the model developers that dominate public attention. That shifts the practical question for security teams from which model to trust to which integrator holds the keys. All findings are externally observed signals rather than confirmed breaches, and Black Kite says so explicitly. The data is best read as a map of where to look, not a tally of compromised companies. What they're not saying: • Sample construction: Black Kite has not explained how the 18,160 companies were identified as AI companies, how the six categories were assigned, or what time window the scans cover. • Credential validity: Black Kite has not said what share of infostealer-exposed credentials were still active, or whether any were confirmed to grant access to customer environments. • Index methodology: Black Kite has not published, in its announcement, how the Ransomware Susceptibility Index is calibrated or why 0.4 marks critical risk, nor the false-positive rate of its vulnerability detection. What the headline skips — and who benefits from that 👇

Japan's $63M AI-Era Cyber Plan Makes Breach First Response a Public Service Japan’s emergency package turns national cyber defense from guidance into standing operational capacity: named teams, a deadline, a budget line and a legal authority to act against attacker infrastructure. The stated goal is for Japan to reach one of the world’s highest levels of cybersecurity, built on public-private information sharing, fast assistance to victims and recovery from damage. The most consequential change for businesses is the cyber rescue team. Initial incident response, the first triage and containment after a breach, has typically been something a company arranges itself through its own staff, a security vendor or an insurer’s panel. A government-organized team drawing on public and private experts makes part of that first response a public service. For data center, cloud and managed-service operators, whose customers are often the first to call when something goes wrong, that changes who else is in the room during an incident. The scale invites scrutiny. Ten billion yen funds several teams across multiple agencies for an entire economy, which points to a program weighted toward people and coordination rather than a broad subsidy for corporate security spending. The Prime Minister’s call for companies to step up their own preparedness reinforces that reading. What they're not saying: • Allocation: The government has not said how the 10 billion yen is divided among the top gun team, the rescue team, the hardening team, active cyber defense and information sharing, or whether funding will recur beyond this emergency package. • Staffing and timelines: Only the METI team carries a deadline (end of November). Start dates, team sizes and recruitment plans for the rescue and hardening teams have not been disclosed. • Eligibility and terms: The government has not specified which companies qualify for rescue-team help, whether it is free, how it interacts with insurers and private responders, and what information companies must share in return. The quiet part of this story 👇

Arm Tops 50% of Hyperscaler Servers, Yet 8% Royalty Growth Shows AI CPU Money Lags The headline numbers tell a clear story about where Arm’s growth is coming from. Data center royalties doubled. Licensing, the upfront fees chip designers pay to use Arm’s technology, grew 50%. According to Arm’s shareholder letter, Google Axion, AWS Graviton, Microsoft Cobalt and NVIDIA’s Arm-based platforms have pushed Arm’s share of top-hyperscaler servers past half. That share stood at 15% in 2024. Read together, the figures also expose a lag. Total royalty revenue, the per-chip fees that make up most of Arm’s long-term economics, grew only 8%. A tripling of server share has not yet produced anything like a proportional rise in royalty dollars. Arm itself frames licensing growth as a leading indicator, and says it expects royalties to accelerate once the new designs reach production. That gap matters to anyone pricing compute, planning capacity, or valuing the companies that supply data center processors. Server market share and server revenue capture are different things, and Arm’s own figures show the difference. What they're not saying: • Data center royalty dollars: Arm has said data center royalties doubled but has not disclosed their dollar value or their share of the $670 million royalty total. Without that figure, the real size of the data center business can only be inferred. • How server share is measured: Arm has not specified whether the 15%, 50%-plus and 60%-plus figures count units, sockets, cores or new deployments, or exactly which operators count as the top hyperscalers. • Royalty economics per server chip: Arm has not said what royalty rate applies to hyperscaler-designed server processors, or how its newer compute subsystems change that rate. This is the key variable for whether royalty growth catches up with share. The quiet part of this story 👇

WhiteFiber's $60M AI Site Buy Prices Power at $1M a Megawatt Before Signed Tenants WhiteFiber has bought the right to build roughly 60 megawatts of AI data center capacity in North Carolina, with a path toward about 200 megawatts over seven years. The $60 million price, paid in cash, works out to about $1 million per megawatt of the minimum initial power supply and roughly $303,000 per megawatt if the full 198 megawatts is eventually confirmed. The purchase came before any definitive customer contracts for the new sites. WhiteFiber holds non-binding letters of intent, some from investment-grade counterparties, and says construction spending will follow signed agreements and financing. That structure fixes the cost of the site now while keeping the much larger build-out cost contingent. The same announcement disclosed that switchgear commissioning issues interrupted service and billing at NC-1, the company’s operating North Carolina campus, and that financing for that deployment has not closed. NC-1 is the closest available guide to how NC-2 and NC-3 may unfold. What they're not saying: • Retrofit cost and IT yield: WhiteFiber has not disclosed the expected capital cost to convert NC-2 and NC-3, or how many IT megawatts it expects from the 60 MW gross minimum. Without those figures, the all-in cost per usable megawatt cannot be calculated. • Utility confirmation: The company has not named the utility, described the confirmation process referenced in the Purchase Agreement, or given a timeline for confirming either the initial 60 MW or the additional 69 MW per property. • Customers and financing: WhiteFiber has not identified the prospective customers, the capacity covered by the letters of intent, or proposed terms. It has also not said how NC-2 and NC-3 construction would be financed, or disclosed the size, lender or terms of the pending NC-1 facility. What the headline skips — and who benefits from that 👇

Record $533M Bookings Make Land the Next Gate for Equinix's AI-Era India Growth Equinix, the largest global operator of colocation data centers (buildings where many companies rent secure, powered space for their servers and connect to each other), is looking for land in India. On its own, a land search is an intention rather than a commitment. Read next to the company’s latest results, it is a signal about where Equinix’s growth is constrained. Equinix’s third-quarter release describes “robust demand and strengthening pricing,” record bookings, a fourth straight quarter of double-digit growth in monthly recurring revenue, and a third consecutive raise to full-year guidance. Its stated response is supply-side: accelerating capacity delivery and planning $5 billion to $6 billion in 2026 capital expenditures. That matters for India because new colocation capacity cannot be booked until it exists, and it cannot exist until a suitable site is secured. When a company with this demand profile says it is hunting for land, the pace of its expansion in that market is set by site acquisition and development, not by the willingness of customers to sign. What they're not saying: • Scale and location: Equinix has not said how many sites it seeks in India, which cities it is targeting, or how much capacity those sites would hold. • Timeline and capital: The company has not disclosed when it expects to close land purchases or open facilities, or how much of its $5 billion to $6 billion 2026 capital plan, if any, is allocated to India. • Structure, power and customers: Equinix has not said whether Indian builds would be wholly owned or placed in an xScale-style joint venture, how it will secure grid power and permits, or whether any customers have pre-committed to the new capacity. The part that didn't make the press release 👇

At 79.5 Cents, CoreWeave's Bonds Price Texas Data Center Politics Into AI Debt A governor’s race moved the bond market of an AI infrastructure company. CoreWeave’s 2031 unsecured notes fell to 79.5 cents on the dollar. Unsecured notes are debt not backed by specific assets. Its 2030 and 2032 bonds now yield more than 15%. For the people who build AI capacity, that bond price matters more than the 7.2% share-price drop. Neoclouds such as CoreWeave fund graphics processors and data center space largely with borrowed money. Where their existing bonds trade sets the benchmark for what their next round of borrowing will cost. Texas was already restricting the sector before the vote. Gov. Greg Abbott froze every data center-related permit in September, pending a review of the current waitlist. The election mainly changes who will decide how long that pause lasts and on what terms. Hinojosa campaigned for a pause until state lawmakers set safeguards, and has called for an immediate moratorium. Republicans still control the Texas Legislature, which limits how far she can change state policy. The concern reaches beyond Texas. Governors-elect Amy Acton in Ohio and Keisha Lance Bottoms in Georgia also advocated slowing data center construction during their campaigns, and Democrats won majorities in both chambers of Congress. Investors had feared that a lopsided Democratic result could tighten curbs on data centers. The bond move shows that fear being priced into the cost of capital for AI buildout. What they're not saying: • The result raises several material questions for the companies whose securities moved. • CoreWeave’s Texas footprint: How much of its contracted and planned capacity is in Texas? How much of that is already energized, and how much depends on data center-related permits frozen since September? How would delivery schedules change if the freeze is extended? • CoreWeave’s financing plan: How much of its planned expansion depends on raising new unsecured debt at current yields above 15%? Does the company expect to change the pace or structure of its borrowing, and what near-term maturities or covenants could be affected by higher rates? What the headline skips — and who benefits from that 👇

93 Defective Transformers Turned an AI Data Center's Backup Power Into a TCEQ Case The Denton case is not about the computing equipment or the grid connection. It is about the electrical gear in between. Transformers step high-voltage utility power down to levels a data center can use. When 93 of them at the Denton site needed defect repairs, the facility ran on eight emergency generators for a stretch spanning April to June. TCEQ now alleges that the operation produced excessive emissions, among other violations. This matters beyond one site because backup generators are a standard part of every large data center’s design. Air authorizations for emergency engines generally assume short, infrequent use during genuine outages. Running them for weeks to cover an equipment problem tests that assumption. It also exposes an operator to environmental enforcement over what began as a supply-chain defect. The case also lands three months after Core Scientific publicly backed Texas Governor Greg Abbott’s push for transparency and accountability in data center development. In that August 10 statement, the company said it welcomed the state’s audit process. How it resolves the Denton enforcement will be a practical test of that stance. What they're not saying: • Emissions and run time: Core Scientific has not disclosed how many hours the eight generators ran, their combined capacity, their fuel type or which pollutants exceeded limits. • Root cause and remediation: The company has not named the transformer manufacturer or described the defect. It has also not said whether all 93 units have been repaired or replaced, and whether generators are still being used outside emergencies. • Financial and customer exposure: Neither Core Scientific nor CoreWeave has said publicly whether the transformer problem affected delivered capacity or customer commitments. Core Scientific has not said whether it will contest the enforcement or what penalty it anticipates. The part that didn't make the press release 👇

NANO's Six-Month IMPSA Study Shows KRONOS's AI-Era Path Runs Through Its Pressure Vessel NANO Nuclear Energy is bringing a certified nuclear fabricator into the KRONOS MMR design process before the design is frozen. Over six months, IMPSA will independently check KRONOS components against Section III of the ASME Boiler and Pressure Vessel Code, the American Society of Mechanical Engineers’ rulebook for nuclear-grade hardware. The aim is to surface fabrication, inspection, access and supply-chain problems while they are still cheap to fix. The move matters because a microreactor delivers no power, to a data center or anyone else, until its heaviest code-regulated parts can actually be built and inspected. The reactor pressure vessel, the steel container that holds the core under pressure, is the primary focus of this agreement. It is also the kind of component few manufacturers worldwide are certified to make. The deal is a structured starting point, not a supply contract. It establishes a named, certified engineering partner for the pressure vessel. It does not commit either company to production, volumes or a delivery date. What they're not saying: • Retainer and budget: NANO Nuclear Energy has not disclosed the retainer’s value or the projected cost of any follow-on engineering or fabrication. • Production timeline: Neither company has given a date for definitive fabrication agreements, first component delivery or first power from a KRONOS unit. • Fabrication location: The companies have not said whether future components would be made in Argentina, in the United States through IMPSA’s subsidiary, or elsewhere, or how cross-border regulatory and export requirements would be handled. The quiet part of this story 👇

Broadcom's $43B Backstop Turns an AI Rack Deal Into a Credit Bet on Its Customer The mechanics matter more than the headline figure. In its 8-K, Broadcom describes a structure in which outside financiers fund AI racks (complete server cabinets packed with accelerator chips, networking and power gear) and lease them to a Broadcom customer. Broadcom then stands behind the value of that hardware. If the customer defaults and the racks are sold, Broadcom owes the difference between 72.5% of the outstanding lease balance and whatever the racks fetch. That turns a hardware relationship into a contingent credit exposure of up to roughly $43 billion. Broadcom calls the exposure low-probability, citing the customer’s expected profitability and the lasting value of the equipment. Both of those depend on things outside Broadcom’s control. The arrangement shows how AI compute is being financed at this scale: the chip designer’s balance sheet is being used to make lenders comfortable with a customer that leases rather than buys. What they're not saying: • Who the customer is. Broadcom’s 8-K does not name the customer, and Broadcom has not publicly confirmed whether the backstop relates to the $63 billion Anthropic financing reported by the Journal. • Who the financial partners are, and on what terms. Broadcom has not disclosed the lenders, the size of the portion they took on, the lease durations, interest rates, or how the $43 billion maximum relates to total lease obligations. • Deployment scope and timeline. Broadcom and its customer have not disclosed how many racks are involved, the delivery schedule, the compute or power capacity they represent, or where they will be deployed. The part that didn't make the press release 👇

Sabey's Generator Test: Renewable Diesel's 40–86% Carbon Cut Rides on Feedstock Backup generators are a small but stubborn part of a data center’s carbon footprint. They run rarely, but because the operator owns them and burns fuel on site, their emissions count as Scope 1, the category a company cannot address simply by buying renewable electricity. Sabey’s Austin pilot targets that line item with a fuel swap rather than an equipment swap. The practical appeal is that renewable diesel is a drop-in fuel: the same generators, tanks and maintenance routines stay in place, so there is no stranded hardware and no redesign of a facility’s resilience plan. The harder question is what the swap actually achieves. By the Argonne figures Sabey itself cites, the climate benefit roughly doubles depending on whether the fuel is made from waste fats or from crops. That makes Sabey’s commitment to track feedstock the most consequential detail in the announcement. A drop-in fuel moves the decarbonization problem out of the engine room and into the fuel supply chain, and the pilot’s value to the wider industry will depend on how rigorously that supply chain is verified and reported. What they're not saying: • Scale: Sabey has not said how many generators at SDC Austin are running on HVO, their combined capacity, or what share of the campus’s backup fleet they represent. • Feedstock and verification: Sabey has not disclosed the feedstock mix of its current HVO supply, who supplies it, or what certification or third-party verification it will use to track origin, which determines whether the benefit lands nearer 40% or 86%. • Success criteria and timeline: Sabey has not said how long the pilot will run, what performance or reliability thresholds would trigger expansion, which sites would be next, or whether results will be published. The questions this raises, and who isn't answering them 👇