Blog https://bonsaytech.com ru Thu, 29 Oct 2026 22:32:54 +0300 Your People Already Use AI. Your Company Doesn’t. https://bonsaytech.com/tpost/your-people-already-use-ai https://bonsaytech.com/tpost/your-people-already-use-ai?amp=true Tue, 13 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation Personal AI use is widespread; company-level AI is not. What Accenture, Microsoft and the LexisNexis AI in IP report show about turning individual prompts into processes a company owns.

Your People Already Use AI. Your Company Doesn’t.

Your People Already Use AI. Your Company Doesn’t.
Key takeaways
  • Nearly three-quarters of knowledge workers already use AI, often with tools their employer has not sanctioned (Accenture × Wharton, 2026).
  • Personal productivity gains can move the bottleneck rather than remove it — Deutsche Telekom saw invention disclosures more than double while assessment capacity stayed flat.
  • thyssenkrupp's IP team turns repeated prompts into written, tested and shared methods before automating them.
  • The model is rented and replaceable; the method around it is the asset a company can own.
Two statements are often treated as the same thing: "our people use AI" and "our company uses AI". The 2026 research suggests they describe very different situations — and that the gap between them is where most of the value is lost.

Individual adoption is already high

Accenture and Wharton report that nearly three-quarters of knowledge workers already use AI at work, frequently through personal or unsanctioned tools. Microsoft's AI Diffusion report for the first quarter of 2026 measures AI use across working-age populations: 31.3% in the United States, 31.1% in Germany and 26.5% in Vietnam, among others.
The differences between countries are modest. The difference between individuals and organisations is large. A salesperson who drafts proposals with AI in twenty minutes, a support lead with a private prompt for common tickets, an analyst who cleans a weekly report with a chatbot — each has redesigned a small process. None of it belongs to the company, and all of it leaves when that person does.

When people move faster than the process

The AI in IP report published by LexisNexis in September 2026 contains a clear example. At Deutsche Telekom, inventors began using AI tools to write invention disclosures on their own initiative; guidelines followed later. In the first half of 2026, disclosures more than doubled compared with a year earlier and became more detailed and better structured.
The report also notes the consequence: the productivity gains of inventors did not reduce the assessment workload at the same rate. The team that evaluates, prioritises and files each idea received twice the input with the same capacity. The bottleneck moved one step down the line.
This is a common pattern. Personal AI speeds up one role; if the surrounding process stays the same, the next role absorbs the extra volume.

From a chat to a company method

The same report describes how thyssenkrupp's IP team approaches the problem. It starts from the work rather than from tool features: which tasks take the most hours, where AI can sensibly help, and how difficult the change would be. A task then moves through five stages:
  1. Explore — employees experiment freely, within clear rules for confidential data.
  2. Structure — a repeated prompt becomes a written method with context, steps and expected output.
  3. Test — the method is checked against known good examples.
  4. Standardise — it is shared with the team instead of remaining in one person's chat history.
  5. Automate — only when volume and stability justify it does software run the method through an API.
One observation from the chapter summarises the logic: the model often does not learn from the organisation's experience — the surrounding method does. Models are rented and interchangeable; documented, tested methods are an asset the organisation keeps.

Light rules, real usefulness

thyssenkrupp did not begin with an extensive AI policy. It started with two principles: people may experiment, and professional responsibility does not change. Adoption followed usefulness rather than usage targets — people used what saved them time, and the organisation captured what worked.

Questions worth asking

  • Who are the heaviest AI users in each team, and which tasks do they use it for every week?
  • What would leave with them if they left tomorrow?
  • Which of those tasks feeds another team? Speeding it up may create a queue downstream.
  • Who is responsible for turning a good prompt into a documented process? If nobody is, that is the organisational gap.
  • Which methods are tested against known good outputs before being shared?
Individual AI use is a habit. AI embedded in a documented, tested process is an asset — and the second depends on someone deliberately building the method around the model.

Sources

  • Accenture and Wharton, The Age of Co-Intelligence, 2026.
  • Microsoft AI Economy Institute, Global AI Diffusion: Q1 2026 Trends and Insights, May 2026.
  • LexisNexis, AI in IP, September 2026 (chapters by Deutsche Telekom and thyssenkrupp).
  • Andres Gavriljuk, The AI Transformation (2026).
]]> 95% Have an AI Strategy. 8% Can Show the Money. https://bonsaytech.com/tpost/ai-pilots-proof-of-concept-trap https://bonsaytech.com/tpost/ai-pilots-proof-of-concept-trap?amp=true Wed, 07 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation Why most AI pilots never reach production, what the 2026 surveys from KPMG, Deloitte, BCG and PwC actually measured, and the five checks that separate a demo from a running system.

95% Have an AI Strategy. 8% Can Show the Money.

95% Have an AI Strategy. 8% Can Show the Money.
Key takeaways
  • KPMG's Q1 2026 Global AI Pulse: 95% of organisations have an AI strategy, only 8% report established ROI.
  • Deloitte (3,235 leaders): only 25% have moved 40% or more of their AI experiments into production.
  • The causes are rarely the model: unrealistic pilot data, unchanged processes, unclear agent permissions and no owner for the build.
  • Companies that scale AI tend to automate one well-defined process end to end before moving to the next.
Almost every company now has an AI strategy. Very few can show what it earns. Four large surveys published in 2026 describe the same gap from different angles — and they point to causes that have little to do with which model a company picked.

The gap in numbers

KPMG surveyed 2,110 executives in 20 countries for its Global AI Pulse in the first quarter of 2026. Two results sit side by side: 95% of organisations have an AI strategy, and only 8% report established return on investment. Planned AI spending over the next twelve months averaged $186 million per organisation.
Deloitte's State of AI in the Enterprise 2026, based on 3,235 director- to C-level respondents in 24 countries, shows the same pattern from the inside. Worker access to sanctioned AI tools grew by half in one year — from under 40% to around 60% of employees. Yet only 25% of organisations have moved 40% or more of their AI experiments into production. Deloitte calls this the proof-of-concept trap.
The CEO view is similar. In PwC's 2026 Global CEO Survey, as cited by Allianz Global Investors, only 12% of chief executives reported that AI had both reduced costs and increased revenue.

Why pilots stall between the demo and production

The surveys and the case material around them point to five recurring causes.

The pilot data is not the production data

Pilots usually run on a clean export: a curated sample, a tidy spreadsheet. Production runs on several systems that disagree with each other, documents with inconsistent names and an ERP that has accumulated a decade of exceptions. Deloitte notes that use cases estimated at three months can stretch to eighteen once integration complexity appears.

The process around the model does not change

McKinsey Quarterly makes the point with predictive maintenance: a model can predict a failure days in advance, but if maintenance still follows a calendar schedule, nothing happens. The model works; the workflow around it does not move, so the value is zero.

Nobody decided what the agent may do

In the KPMG survey, data privacy and cybersecurity are the top concerns of executives, each named by 42%. When an agent can send client emails, issue invoices or change records without approval, legal and security teams stop the project at the first incident — usually with good reason. Agents that reach production have explicit permissions and a human approval step for anything irreversible.

Strategy has an owner; the build does not

BCG's AI Radar 2026 found that 72% of CEOs now consider themselves the main decision-maker on AI. But only about 15% of companies — BCG's "trailblazers" — redesign processes around AI, putting around 60% of their AI budget into agents. The rest mostly buy licences and launch further pilots.

Pilot fatigue

Without a roadmap for scaling, each successful pilot is followed by another pilot rather than a production rollout. A healthcare AI leader quoted by Deloitte calls the result "pilot fatigue": many experiments, a tired team and no measurable value.

A ladder rather than a leap

It helps to see business AI as a ladder:
  1. Copilots — drafting, summarising and searching. Useful for individuals, rarely visible in the P&L.
  2. Rule-based automation — reliable for simple, stable inputs; brittle when inputs change.
  3. A controlled agent on one process — it pursues a defined goal through the company's real systems via APIs, logs every action and asks a person before anything risky. This is usually where measurable value starts.
  4. Several coordinated agents across functions, with guardrails built into core systems.
Organisations rarely jump to the fourth step. They reach it one process at a time. BCG describes a real estate investment group where agents in the investor onboarding pipeline shortened the commitment cycle by roughly a third — one pipeline, measured before and after.

Five checks before funding another pilot

  • One defined process. Not "implement AI", but a sequence with clear inputs and outputs.
  • A known baseline. Hours and cost per month for the manual version, measured before the pilot.
  • Access to live systems. The pilot should run against the real CRM or ERP, not a CSV export.
  • Human approval for risky steps. Payments, refunds and client communication need a person in the loop.
  • A path to production within weeks. A plan with six to twelve months in a sandbox is a predictor of pilot fatigue.
A pilot that fails three of these checks is unlikely to be rescued by a better model. The failures happen in data, process and ownership — which is why they can be fixed.

Sources

]]> 12 Minutes vs. 7 Days: The New Math of Patching https://bonsaytech.com/tpost/12-minutes-vs-7-days-patching https://bonsaytech.com/tpost/12-minutes-vs-7-days-patching?amp=true Tue, 20 Oct 2026 10:00:00 +0300 Gleb Zamyslovsky Security & legacy What the State of AI Report 2026 shows about AI-assisted exploits, why legacy systems are hit hardest, what changes under Poland's amended KSC and the EU Cyber Resilience Act, and a 90-day plan to shorten patch time.

12 Minutes vs. 7 Days: The New Math of Patching

12 Minutes vs. 7 Days: The New Math of Patching
Key takeaways
  • In a test reported by the State of AI Report 2026, a frontier model built a working exploit for a known Firefox bug in 12 minutes; Windows Autopatch needs about 7 days to reach 90% of a fleet.
  • High- and critical-severity disclosures from 21 major vendors in H1 2026 exceeded their total for all of 2025.
  • Agents produced a functional patch for 65.9% of 920 historical vulnerabilities, but fixed the intended bug in only 22.2%.
  • Poland's amended KSC requires an ISMS and S46 connection by 3 April 2027; the EU CRA's 24-hour early-warning duty applies since 11 September 2026.
Two numbers from this year's State of AI Report frame the problem. In a reported test, a frontier AI model needed 12 minutes to build the first working exploit for a known Firefox bug — and produced working proofs of concept for 14 of 18 known bugs. Microsoft's Windows Autopatch, by comparison, needs about 7 days to reach 90% of a device fleet.
The distance between those two numbers is where patching risk now sits.

What changed in 2026

The patch queue grew

High- and critical-severity vulnerability disclosures from 21 major vendors in the first half of 2026 exceeded their total for the whole of 2025; critical disclosures rose almost fourfold in six months. The report is careful to note that CVE counts do not reveal who found a bug, so the share attributable to AI is unknown. The queue is longer either way.

Bug-finding scaled

Anthropic reports more than 33,000 high- or critical-severity findings across its partners and open-source scanning. These are findings, not published CVEs, but many will become patches that organisations have to apply.

Real intrusions used ordinary weaknesses

The report describes an operator who used more than 1,000 prompts to an AI coding tool to exfiltrate 150 GB from ten Mexican government bodies, and a security firm's agent that reached the database of a consultancy's internal AI platform in two hours by chaining 22 unauthenticated endpoints and a SQL injection. Neither relied on exotic zero-days. Unprotected endpoints, weak credentials and known holes were found faster.

Why legacy systems are hit hardest

An N-day is a vulnerability that is already public and already has a fix. For years, defenders relied on the time it took attackers to turn a published patch into a working exploit — often weeks. That buffer has largely disappeared.
A typical ten-year-old business system makes patching slow for structural reasons:
  • the framework is end-of-life, so no official patch exists;
  • nobody is certain which libraries and versions are inside;
  • there are no automated tests, so every update is risky and gets postponed.
In such a system, patching takes months while exploitation can take minutes.

AI does not simply patch it for you

The same report evaluated agents on 920 historical vulnerabilities in 139 real C and C++ projects. Working from source code alone, agents produced a functional patch 65.9% of the time — but only 22.2% of patches fixed the specific historical bug they targeted. Others fixed a different valid issue or merely stopped the crash.
A patch that compiles is not necessarily a patch that fixes. Engineers who understand the system still need to review it.

The regulatory clock in Poland and the EU

Under Poland's amended National Cybersecurity System Act (KSC), covered entities must operate an information security management system and be connected to the S46 system by 3 April 2027. Under the EU Cyber Resilience Act, manufacturers have had to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability since 11 September 2026.
If a working exploit can exist minutes after a patch is published, a quarterly patch cycle is an accepted risk rather than a policy.

A 90-day plan to shorten patch time

  1. Know what runs. Keep an inventory of systems, frameworks, versions and end-of-life dates; for software you ship, maintain a software bill of materials (SBOM).
  2. Prioritise by exposure, not only by score. Internet-facing and known-exploited vulnerabilities first. A medium-severity bug on a public login page outranks a critical one on an isolated test machine.
  3. Make patching routine. Automated tests, a CI pipeline and staged rollouts turn a quarterly event into a weekly task.
  4. Isolate what cannot be patched. Segment the network, place a web application firewall in front of the system and set a replacement date.
  5. Track one metric monthly: time from patch release to patch in production.
Attackers became faster in 2026, but most of the weaknesses they used were old ones. Old weaknesses can be closed — the constraint is how quickly an organisation can ship a change safely.

Sources

  • Air Street Capital, State of AI Report 2026, slides 207–211.
  • Rödl & Partner and McCann FitzGerald, summaries of the amended KSC and the EU Cyber Resilience Act timelines.
  • European Commission, Cyber Resilience Act — official overview and application dates.
]]> Agents Are Scaling Faster Than the Guardrails: Deloitte’s State of AI in the Enterprise 2026 https://bonsaytech.com/tpost/agents-scaling-faster-than-guardrails https://bonsaytech.com/tpost/agents-scaling-faster-than-guardrails?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation Deloitte surveyed 3,235 business and IT leaders in 24 countries. Three in four plan to deploy agentic AI within two years; one in five has mature governance for it. What the survey says about agents, sovereignty and the redesign of work.

Agents Are Scaling Faster Than the Guardrails: Deloitte’s State of AI in the Enterprise 2026

Agents Are Scaling Faster Than the Guardrails: Deloitte’s State of AI in the Enterprise 2026
Key takeaways
  • 74% of companies plan to deploy agentic AI within two years, but only 21% report a mature governance model for autonomous agents.
  • 77% factor an AI solution's country of origin into vendor selection; 83% call data residency and in-region compute at least moderately important.
  • Only 20% already grow revenue through AI, while 74% expect to; for now, efficiency gains come first.
  • 84% have not redesigned jobs around AI; 53% have considered pod-based team structures, but only 16% have moved to them substantially.
Deloitte's annual State of AI in the Enterprise report is based on a survey of 3,235 director- to C-level respondents across six industries and 24 countries, conducted in August and September 2025 and published in January 2026. Its subtitle — the untapped edge — reflects the main finding: AI is spreading quickly inside companies, but most of its value is still ahead of them.

From pilots to scale — slowly

Worker access to sanctioned AI tools grew by about 50% in one year, from under 40% to around 60% of employees. Among workers who have access, fewer than 60% use it daily, a share that has barely changed.
Only 25% of organisations have moved 40% or more of their AI experiments into production, although 54% expect to reach that level within three to six months. Deloitte calls the gap the proof-of-concept trap: pilots run with small teams, clean data and isolated environments, while production requires integration, security reviews, compliance checks, monitoring and maintenance. Use cases planned for three months can stretch to eighteen once those requirements appear.

Productivity now, revenue later

25% of leaders say AI is already transforming their company, up from 12% a year earlier. 84% are increasing AI investment. But the benefits are concentrated in efficiency:
  • 66% report improved efficiency and productivity today.
  • Only 20% report revenue growth from AI today, while 74% hope to achieve it.
Organisations divide roughly into thirds: 34% are starting to transform products, processes or business models with AI; 30% are redesigning key processes while keeping the business model; 37% use AI at a surface level with little change to existing processes.

Agents are coming before governance

The headline for engineering and risk leaders: 74% of companies plan to deploy agentic AI within two years, but only 21% report having a mature governance model for autonomous agents.
That gap matters because agents act rather than suggest. An agent that can send messages, change records or trigger payments needs defined permissions, logging, escalation rules and a person accountable for its behaviour. Without these, the first visible error tends to halt the whole programme.

Where AI is built now matters

Deloitte treats sovereign AI as a boardroom issue:
  • 83% say data residency and in-country or in-region compute are at least moderately important to strategic planning; 43% call them very or extremely important.
  • 66% are at least moderately concerned about reliance on foreign-owned AI technology and infrastructure.
  • 77% factor an AI solution's country of origin into vendor selection, and 58% build their AI stacks primarily with local vendors.
For companies operating across the EU, the UK, the Middle East and Asia-Pacific, this means architectures that can run models in specific regions — or self-hosted — and vendors who can document where data goes.

Work redesign lags

Expectations of automation are high: 36% of companies expect at least 10% of jobs to be fully automated within a year, and 82% within three years. Yet 84% have not redesigned jobs around AI capabilities. Leaders name insufficient worker skills as the biggest barrier to integration, but fewer than half are making significant changes to their talent strategy; most focus on general AI training.
Team structures are starting to move. As fewer roles require supervising large teams, 53% of companies have considered pod-based or non-hierarchical models — but only 16% have adopted them to a great extent.

Physical AI is already in operations

58% of companies already use physical AI — robotics, autonomous vehicles, drones — to some extent, and adoption is projected to reach 80% within two years, with Asia-Pacific markets leading.

Preparedness

42% believe their strategy is highly prepared for AI, and 30% say the same of risk and governance — both up from last year. Confidence in technical infrastructure, data management and talent fell slightly, which suggests that the operational work is harder than the strategic work.

What follows for 2027–2028

The survey describes a sequence many organisations are now in. Access and pilots are mostly solved. The next constraints are integration with real systems, governance for agents that act, regional requirements for data and models, and teams organised around outcomes rather than tasks. Each of these is primarily an engineering and operating-model problem rather than a model-selection problem.

Sources

]]> AI Adoption by Country in 2026: The UAE at 70%, the US at 21st https://bonsaytech.com/tpost/ai-adoption-by-country-2026 https://bonsaytech.com/tpost/ai-adoption-by-country-2026?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation Microsoft's Global AI Diffusion data for Q1 2026 ranks economies by the share of working-age people using generative AI. Where adoption is highest, where it is growing fastest — and what the coding data says about how software is now built.

AI Adoption by Country in 2026: The UAE at 70%, the US at 21st

AI Adoption by Country in 2026: The UAE at 70%, the US at 21st
Key takeaways
  • 17.8% of the world's working-age population used generative AI in Q1 2026; 26 economies are above 30%.
  • The UAE leads at 70.1%, followed by Singapore (63.4%); the UK is 8th (42.2%), Australia 11th (39.5%), Israel 13th (38.1%) and the US 21st (31.3%).
  • Twelve of the fifteen fastest-growing economies are in Asia, led by South Korea (+43%), Thailand and Japan; Vietnam grew about 25% to 26.5%.
  • Git pushes rose 78% year on year to 380 million in Q1 2026, and merged pull requests linked to AI coding agents grew more than 28-fold since June 2025.
Microsoft's AI Economy Institute publishes a quarterly measure of AI diffusion: the share of people aged 15 to 64 who used a generative AI product during the period, derived from aggregated, anonymised telemetry and adjusted for device market share, internet access and population. The Q1 2026 edition, published in May, shows adoption still rising — and spreading unevenly.

The global picture

AI use rose from 16.3% to 17.8% of the world's working-age population in a single quarter. Intensity is rising among leaders: 26 economies now exceed 30%.
The divide between richer and poorer economies is widening. In the Global North, usage reached 27.5% (up 2.8 points); in the Global South, 15.4% (up 1.3 points). Access to electricity, internet connectivity and digital skills explain most of the difference.

The leaderboard

Rank Economy Q1 2026
1 United Arab Emirates 70.1%
2 Singapore 63.4%
3 Norway 48.6%
4 Ireland 48.4%
5 France 47.8%
6 Spain 44.2%
7 New Zealand 43.0%
8 United Kingdom 42.2%
9 Netherlands 42.1%
10 Qatar 41.8%
11 Australia 39.5%
13 Israel 38.1%
21 United States 31.3%
23 Germany 31.1%
24 Poland 31.0%
The United States moved up only from 24th to 21st. Several smaller, highly connected economies — the Gulf states, Singapore, the Nordics, Ireland — continue to lead.

A growth wave in Asia

Twelve of the fifteen fastest-growing economies since June 2025 are in Asia, each with at least 25% more AI users than a year earlier. South Korea grew 43%, Thailand 36% and Japan 34%; Mongolia, Laos and Turkey all grew more than 30%. Vietnam, Kazakhstan, Uzbekistan and Cambodia are also in the group — Vietnam rose about 25%, to 26.5% of its working-age population.
Microsoft attributes much of this to better performance in local languages. On multilingual benchmarks, the gap between English and other languages has narrowed sharply; Japanese accuracy on a standard knowledge benchmark rose from about 50% to around 80% between model generations, and a recent model scored higher in Japanese than in English on a harder version of the test. Japan moved from 56th to 48th place in the ranking.

How software is now built

The report's most striking data concerns code. Git pushes — the moment developers publish code changes — reached 380 million in Q1 2026, up 78% from 213 million a year earlier. New repositories rose 45% to 21.3 million. In Japan, code uploads grew 129%.
Merged pull requests associated with AI coding agents have grown more than 28-fold since June 2025. Microsoft links the step change to coding models and tools released in late 2025 and early 2026, and to the shift of tools like GitHub Copilot from code suggestions to agents that complete tasks and open pull requests.
The labour-market data, so far, does not show the feared collapse. US software developer employment reached about 2.2 million in 2025, a record and 8.5% higher than a year earlier, and was about 4% higher again in March 2026. The report's explanation: cheaper software production can increase demand for software, if that demand is elastic — while cautioning that it is too early to judge the long-term effect.

Reading the data

A few points help interpret the rankings:
  • Usage is not deployment. The metric counts people who used a generative AI product, not organisations that changed processes. Surveys such as Stanford's AI Index find agent deployment in business functions still in single digits.
  • Language matters. Improvements in non-English performance translate quickly into adoption, which is why several Asian economies are accelerating now.
  • Talent markets follow adoption. Economies where AI use is high and rising — including the UAE, Singapore, the UK, Australia, Israel and Vietnam — are also where demand for engineers who can build and run AI systems grows fastest.

Sources

]]> AI for Cyber Defence in 2026: What 77% Adoption Actually Looks Like https://bonsaytech.com/tpost/ai-for-cyber-defence-2026 https://bonsaytech.com/tpost/ai-for-cyber-defence-2026?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski Security & legacy The World Economic Forum and KPMG reviewed real deployments of AI in security operations. Where AI already delivers, where it does not yet, and how organisations decide how much autonomy to give a security agent.

AI for Cyber Defence in 2026: What 77% Adoption Actually Looks Like

AI for Cyber Defence in 2026: What 77% Adoption Actually Looks Like
Key takeaways
  • 77% of organisations report using AI in cybersecurity, but adoption tracks company size and resources (WEF Global Cybersecurity Outlook 2026).
  • Organisations using AI extensively in security shortened breach times by about 80 days and cut average breach cost by $1.9 million.
  • The clearest gains are in threat intelligence, vulnerability detection and phishing defence; AI in recovery is still mostly conceptual.
  • WEF frames agent autonomy in four levels — assist, recommend, execute with override, execute independently — chosen by the risk and reversibility of each action.
Attackers now use AI for reconnaissance, malware and exploit generation, and the result is speed: work that took weeks can be done in minutes. In May 2026 the World Economic Forum and KPMG published Empowering Defenders: AI for Cybersecurity, a white paper built on case studies from partner organisations and workshops with 105 representatives of 84 organisations across 15 industries. It is one of the more concrete descriptions of what defensive AI does in practice.

Adoption is broad but uneven

According to the WEF Global Cybersecurity Outlook 2026, 94% of respondents see AI as the most significant driver of change in cybersecurity, and 77% of organisations report using AI in their security work. Adoption is closely tied to size: large companies with mature data and budgets lead, while smaller organisations, governments and NGOs lag because of cost, skills and data maturity.
The most common uses are phishing detection (52% of organisations), intrusion and anomaly detection (46%) and user-behaviour analytics (40%).

The measurable effects

The paper cites several outcomes that explain the momentum:
  • 88% of security teams report time savings and more room for proactive work.
  • Organisations that use AI extensively in security shortened breach times by roughly 80 days and reduced average breach costs by $1.9 million.
  • 76% of security professionals reported exhaustion in 2025; 53% of teams reported underfunding and 55% understaffing — the structural gap AI is expected to help close.

What the case studies show

The paper maps its cases to the six functions of the NIST Cybersecurity Framework 2.0 — govern, identify, protect, detect, respond and recover. A few examples illustrate the range:
  • Security design reviews. A storage company replaced manual threat modelling with three cooperating agents — one reviewing designs, one checking whether findings were actually fixed in code, one assembling release certification with a full audit trail — reporting three times the coverage and half the review time.
  • External attack surface. A professional services firm scanned more than 100,000 internet-facing sites with an agent that crawls each site, checks configuration and probes for injection flaws. Analysis time per site fell from about 15 minutes to under one; manual effort dropped by 93%.
  • Threat intelligence. A security vendor turned an investigation process that took roughly three weeks of manual work into about an hour of agent-assisted work with consistent, evidence-backed output.
  • Secure code. Google describes agents that search for unknown vulnerabilities and generate patches; every generated patch is reviewed by human researchers before it is submitted, and more than 100 critical issues have been fixed this way.
The concentration of cases in identify and detect is telling. AI is already strong at finding and correlating signals. Its role in recover — rebuilding systems after an incident — remains largely conceptual.

Four questions before deploying AI in security

The paper structures adoption as four steps, each with a question for executives:
  1. Align. Does the use case support a business priority such as resilience, compliance or cost? Sometimes standard automation is the cheaper, lower-risk answer.
  2. Ready. Are workflows documented and repeatable, is the security data complete and well structured, and can identity and access management handle machine and agent identities?
  3. Validate. Is there a pilot with success criteria, fall-back plans and a clear go/no-go decision?
  4. Scale and sustain. Is there an owner, monitoring for model drift and a way to retire what stops working?
For smaller companies the advice is pragmatic: focus on one or two use cases tied to the most critical risks, use AI already built into existing tools, and scale only what shows measurable benefit.

How much autonomy to give a security agent

The most useful part of the paper for engineering leaders is a four-level model of autonomy:
Level What the AI does Example
Assist Processes and organises data; people decide Summarising alerts
Recommend Proposes an action; a person approves Flags a malicious file, waits for "quarantine"
Execute, overridable Acts on reversible decisions; people monitor Blocks a suspicious IP; an admin can undo
Execute, independent Acts without real-time human involvement Coordinates DDoS mitigation under a supervisor agent
The deciding factors are risk and reversibility. High autonomy suits low-risk, reversible actions; irreversible, high-stakes actions keep a person in the loop even at the cost of speed.

The risks that come with agents

The paper is explicit that agentic AI expands the attack surface. Agents can be hijacked, can behave unexpectedly because of hallucinations or manipulated inputs, and can be deployed without approval or clear accountability. It also warns against over-reliance: heavy dependence on automation erodes the hands-on expertise needed when the automation fails. The recommendation is to simulate AI failures and keep security operations functional during an AI outage.
The workforce question follows. 54% of organisations name a shortage of skilled people as the main barrier to adopting AI in security, and the profile in demand is shifting from single-tool specialists to engineers who can work across tools and explain AI output to decision-makers.

What this means for 2027–2028

Gartner, quoted in the paper, expects 15% of day-to-day work decisions to be made autonomously by AI agents by 2028, and 88% of enterprises are already investing in agents. For security teams, the practical path is the one the case studies follow: start where AI is strongest — detection, triage, intelligence and code review — keep people accountable for irreversible actions, and measure the result in hours and incidents rather than in the number of tools deployed.

Sources

]]> AI Funding in Q1 2026: $226 Billion, and 94% of It in Mega-Rounds https://bonsaytech.com/tpost/ai-funding-q1-2026-mega-rounds https://bonsaytech.com/tpost/ai-funding-q1-2026-mega-rounds?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation One quarter of private AI funding matched all of 2025. CB Insights data shows where the money went, how concentrated it became, which AI markets are hiring fastest — and what the numbers mean for founders raising outside the frontier labs.

AI Funding in Q1 2026: $226 Billion, and 94% of It in Mega-Rounds

AI Funding in Q1 2026: $226 Billion, and 94% of It in Mega-Rounds
Key takeaways
  • Global private AI funding reached $226.2 billion in Q1 2026 — more than the $217.4 billion raised in all of 2025 (CB Insights).
  • Mega-rounds of $100 million or more took 94% of the money; the median deal was $4.9 million.
  • 77% of AI equity deals went to companies with fewer than 50 employees.
  • Fastest headcount growth: AI companions (+69%), defence AI copilots (+64%), multi-agent orchestration (+54%) and coding agents (+41%).
CB Insights' State of AI report for the first quarter of 2026 contains a number that sounds like a typo: global private AI funding of $226.2 billion in three months — more than the $217.4 billion raised across the whole of 2025, and up 216% on the previous quarter. Behind the headline, the data describes two very different markets.

A handful of rounds, most of the money

Mega-rounds — single rounds of $100 million or more — accounted for 94% of Q1 funding, compared with 40–81% in the quarters of 2022–2025. The largest rounds went to frontier model developers and their infrastructure: a $122 billion corporate minority round for OpenAI, $30 billion for Anthropic, $16 billion for Waymo and $7.5 billion for xAI.
The rest of the market looks very different. The median AI deal in Q1 was $4.9 million, against an average of $159.9 million. Deal count, at 1,965, was broadly in line with previous quarters. In other words, the record total reflects concentration at the very top rather than a general rise in the size of typical rounds.

Where the money went geographically

Region Q1 2026 funding Deals
United States $206.0B 980
Europe $10.5B 440
Asia $8.0B 438
Canada $1.1B 43
Israel $1.0B 33
Oceania $0.5B 23
The US share of funding is extreme because of the frontier rounds; its share of deals — about half — is closer to recent years. Europe's $10.5 billion was its strongest quarter in the period CB Insights tracks, led by NScale ($1.6 billion), NEURA Robotics and Wayve (about $1.2 billion each). Oceania's largest round was Advanced Navigation's $110 million Series C.

Small teams, large valuations

Most AI funding goes to very small companies: 77% of equity deals in Q1 went to companies with fewer than 50 employees, and 70% of AI M&A exits in 2026 so far involved companies of that size. CB Insights also lists record valuations per employee — several new labs and robotics start-ups were valued at more than $200 million per employee at their latest round.
For founders this cuts both ways. Investors are comfortable funding small, senior teams; they also expect those teams to produce output usually associated with much larger organisations.

Which AI markets are hiring

CB Insights tracks year-on-year headcount growth by market. The fastest-growing in Q1 2026:
  1. AI companions — 69.2%
  2. Defence and national-security AI copilots — 64.1%
  3. Voice AI development platforms — 61.8%
  4. Machine-learning training data curation — 59.6%
  5. Multimodal AI developers — 57.7%
  6. AI agent browser infrastructure — 55.6%
  7. Multi-agent systems and orchestration — 54.4%
  8. Small language model tools — 44.6%
  9. AI video localisation and dubbing — 44.1%
  10. Coding AI agents and copilots — 40.7%
Several of these — agent infrastructure, orchestration, coding agents — compete for the same scarce profiles: senior engineers who combine distributed systems, data engineering and production machine learning.

Physical AI and M&A

Physical AI — humanoid and industrial robots, drones, autonomous mobility — led all sectors by share of deals at 11%. Industrial humanoid developers closed 17 deals and surveillance and reconnaissance drone makers 14.
AI M&A reached 266 deals in the quarter, down 9% from Q4 2025 but up 90% year on year, after three record quarters. Large technology companies acquired AI start-ups after an average of 4.5 years, compared with 7.6 years across all AI M&A — they are buying capabilities earlier.

What the numbers mean outside the frontier

  • Headline totals say little about typical rounds. With 94% of capital in mega-rounds, the relevant benchmark for most start-ups is the $4.9 million median.
  • Capital efficiency is the expectation. Small teams raising large rounds set a reference point: investors look at output per engineer.
  • Talent competition concentrates in a few profiles. Agent infrastructure, orchestration and applied ML are growing headcount fastest, which raises the cost and time of hiring those engineers everywhere.
  • Europe and Israel remain early-stage heavy. Around three-quarters of deals in both regions are early-stage, which makes the path to later rounds — and the team needed to reach them — the critical planning question.

Sources

  • CB Insights, State of AI Q1’26 — investment, headcount, exit and geographic trends (equity deals only).
]]> AI-Generated Code and Security: What the 2025–2026 Data Shows https://bonsaytech.com/tpost/ai-generated-code-security https://bonsaytech.com/tpost/ai-generated-code-security?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski Security & legacy AI assistants now write a large share of new code. Studies from Veracode, Stack Overflow, Microsoft and the State of AI Report show what that means for security, review capacity and the teams that maintain the result.

AI-Generated Code and Security: What the 2025–2026 Data Shows

AI-Generated Code and Security: What the 2025–2026 Data Shows
Key takeaways
  • Veracode tested more than 100 models on 80 coding tasks: AI-generated code contained an OWASP Top 10 flaw in about 45% of cases, and larger models did not do significantly better.
  • 84% of developers use or plan to use AI tools, yet 46% actively distrust their accuracy (Stack Overflow 2025).
  • Git pushes grew 78% year on year in Q1 2026 (Microsoft) — review capacity did not grow at the same rate.
  • The practical answer is not less AI but more verification: secret scanning, dependency checks, authorisation tests and human review of the paths that handle money and data.
Writing code has become cheap. Microsoft's Global AI Diffusion report for the first quarter of 2026 notes that git pushes — the moment developers publish code changes — rose 78% year on year, driven by tools such as Claude Code, OpenAI Codex and GitHub Copilot. The question for engineering leaders is no longer whether AI writes code in their organisation, but who checks it.

How often AI-generated code is insecure

In July 2025 Veracode published its GenAI Code Security Report, testing more than 100 large language models on 80 curated coding tasks. The central findings:
  • In about 45% of cases the generated code introduced a vulnerability from the OWASP Top 10.
  • When a secure and an insecure implementation were both possible, models chose the insecure one roughly 45% of the time.
  • Results varied by language: Java failed most often (above 70%), while Python, C# and JavaScript ranged from 38% to 45%.
  • Defences against cross-site scripting and log injection failed in 86% and 88% of relevant cases.
  • Larger, newer models did not perform significantly better on security than smaller ones — Veracode reads this as a systemic issue rather than a scaling problem.
The pattern matches what code reviewers describe: AI output usually works for the happy path and is less reliable about the defensive details that are invisible in a demo.

Developers use it — and doubt it

The Stack Overflow Developer Survey 2025, with about 49,000 respondents, shows the tension inside teams. 84% of developers use or plan to use AI tools, up from 76% a year earlier. At the same time, 46% actively distrust the accuracy of AI output, compared with 33% who trust it; only about 3% trust it highly. The most common frustration, named by roughly two-thirds of respondents, is output that is almost right, but not quite.
Experienced developers are the most cautious group. That is consistent with where errors hide: in authorisation, edge cases and error handling — the parts that require knowing how a system is used.

Faster attackers, same old weaknesses

The State of AI Report 2026 adds the attacker's side. In one reported test, a frontier model built a working exploit for a known browser bug in 12 minutes. Documented intrusions in 2026 relied mostly on unprotected endpoints, weak credentials and injection flaws — the same categories that appear most often in AI-generated code. Faster exploitation combined with more code that has not been reviewed widens the window of exposure.

Where AI-built code usually fails

Reviews of products built largely with AI assistants or app builders tend to find the same groups of issues:
  • Secrets in the repository — API keys and database URLs committed in code or history.
  • Authorisation gaps — endpoints or tables that any logged-in user, or anyone, can read or change; disabled row-level security is a frequent example.
  • Untested money paths — sign-up, payments and data exports without automated tests.
  • Dependencies nobody chose — packages added by an assistant, outdated or with known CVEs, and no update routine.
  • Architecture without boundaries — business logic, data access and presentation mixed together, little error handling and no logging.
  • No owner — code that nobody on the team fully understands, which makes every later change risky.

Verification has to scale with generation

Large technology companies are applying AI to the review side as well. In the World Economic Forum's 2026 white paper on AI for cybersecurity, Google describes agents that search for unknown vulnerabilities and propose patches — with every patch reviewed by human researchers before submission. The principle generalises: AI can widen review coverage, but accountability for what ships stays with people.
For most teams, the practical controls are well known and inexpensive:
  1. Secret scanning on every commit and across the existing history.
  2. Dependency and licence checks in CI, with an owner for updates.
  3. Authorisation tests for every endpoint and data table that holds customer data.
  4. Automated tests on the paths that make money — sign-up, checkout, billing, exports.
  5. Human review of security-sensitive changes, regardless of who or what wrote them.
  6. Prompt-injection and data-leak checks for any feature that passes user input to a model.

What this means for 2027

Code volume will keep growing faster than the number of experienced reviewers. Organisations that treat AI as a way to generate more code without changing how code is verified will accumulate risk quietly — until a customer security questionnaire, an investor's technical due diligence or an incident makes it visible. Those that invest in verification will capture the speed without inheriting the debt.

Sources

]]> Hiring in 2026: 70 Days to Fill a Role, 11.6% Never Filled https://bonsaytech.com/tpost/hiring-engineers-2026-time-to-hire https://bonsaytech.com/tpost/hiring-engineers-2026-time-to-hire?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski Teams & hiring McKinsey's HR Monitor 2026 and Mercer's Global Talent Trends 2026 describe an employer-driven labour market where specialist technology roles still go unfilled. What the data says about speed, pay, retention and AI in recruiting.

Hiring in 2026: 70 Days to Fill a Role, 11.6% Never Filled

Hiring in 2026: 70 Days to Fill a Role, 11.6% Never Filled
Key takeaways
  • Median time to hire across ten countries is 70 days (mean over 90); top-quartile organisations hire in 49 days (McKinsey HR Monitor 2026).
  • 11.6% of vacancies go unfilled — 13.3% in technology, media and telecom and 13.7% in electronics.
  • Pay is the top reason to change jobs (47%); job security jumped to third place (36%).
  • 54% of executives name talent scarcity as the top force shaping their people plans, and employee thriving fell from 66% in 2024 to 44% in 2026 (Mercer).
Labour markets in Europe and the US have steadied, and employers hold more negotiating power than two years ago. Yet two large studies published in 2026 show that specialist technology roles remain hard to fill — and that speed has become the deciding factor in who gets the best candidates.
McKinsey's HR Monitor 2026 surveyed about 1,300 HR professionals and 5,500 employees in January 2026 across Belgium, France, Germany, Italy, the Netherlands, Poland, Spain and the UK, with comparison data from the US and China. Mercer's Global Talent Trends 2026 draws on roughly 12,000 executives, HR leaders, investors and employees.

Vacancies that stay open

HR professionals report being unable to fill 11.6% of vacancies, up slightly from 11% in 2025. The gap is widest in electronics (13.7%) and in technology, media and telecommunications (13.3%), reflecting continued scarcity of specialised digital and engineering skills.
Applications per posting vary widely with local unemployment — from about 165 per role in Spain to ten in the Netherlands, against a 30-application average. For specialist roles, volume rarely solves the problem: many applicants, few who fit.

Speed decides

The median time to hire, from approval of a position to an accepted offer, is 70 days; the mean is more than 90. Top-quartile organisations complete the same process in 49 days. McKinsey finds that organisations with longer hiring cycles report lower offer acceptance, as strong candidates run several processes in parallel and accept the first good offer.
Outcomes improved modestly. Offer acceptance rose to 59% (from 56%), and the hiring success rate — acceptances net of probation-period terminations — rose to 50% (from 46%). Country differences are large: France leads with 71% acceptance and 64% hiring success; Poland is lowest with 46% and 37%.
About a third of positions are filled internally. Of the two-thirds filled externally, 43 percentage points come from companies' own recruiting and 23 from external providers such as headhunters, agencies and staffing firms.

What moves people

Pay and benefits are the top driver of job changes, named by 47% of employees. Work–life balance and flexibility remain in the top five everywhere. The notable shift is job security, which rose to third place (36%) after being the least important driver in 2025 — a sign of a more risk-aware workforce. The importance of training and development as an attraction factor fell by 12 percentage points.
Voluntary attrition is down two points year on year. Employees stay mainly for compensation (52%), work–life balance (46%) and job security (45%).

Under the surface: strain

Mercer's data adds a warning. Employee thriving — people who report flourishing at work — fell from 66% in 2024 to 44% in 2026. 35% of employees would consider leaving if they felt disadvantaged by unequal access to AI tools or training.
Executives see the same constraint from the other side:
  • 54% name talent scarcity as the top macro force influencing their people plans.
  • 59% of HR leaders say attracting people with vital digital skills is the biggest workforce challenge of 2026.
  • 98% plan organisational design changes in the next two years, and 99% expect AI to lead to at least some headcount reduction.
  • 63% of executives see redesigning work around AI as the people initiative with the highest return — but only 32% believe their workforce can combine human and machine capabilities well.

Planning horizons are short

Only 11% of organisations practise strategic workforce planning — forecasting needs three or more years ahead; nearly two-thirds plan no more than twelve months out. McKinsey Global Institute estimates that up to 30% of current work hours in Europe and the US could be automated by 2030, while more than 70% of today's skills remain relevant. Short horizons make it hard to prepare for that kind of shift.

AI in recruiting — and its rules

McKinsey estimates that core recruiting steps such as screening, assessment and interview support have automation potential of at least 60%. In the EU, however, AI systems used in recruitment and personnel decisions are classified as high-risk under the AI Act, with requirements for risk management, documentation, transparency and meaningful human oversight, on top of GDPR. The report recommends human-in-the-loop design, bias testing and strong data governance.

What this means for engineering teams in 2027

  • Time is the main cost. A 70-day median for a general role is a lower bound for senior engineers in scarce stacks; each month of vacancy delays the roadmap.
  • Offers compete on pay and stability, not on training programmes.
  • Retention depends on fairness and workload, including fair access to AI tools.
  • Planning beyond twelve months is rare — which is exactly when capability gaps become visible.

Sources

]]> More Code, Fewer Juniors: The Software Engineering Labour Market in 2026 https://bonsaytech.com/tpost/more-code-fewer-juniors-engineering-labour-market https://bonsaytech.com/tpost/more-code-fewer-juniors-engineering-labour-market?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski Teams & hiring AI coding tools pushed code output up sharply. Developer employment overall reached a record — while hiring of the youngest developers fell. What Microsoft, Stanford, McKinsey, Deloitte and Mercer data says about engineering teams in 2027–2028.

More Code, Fewer Juniors: The Software Engineering Labour Market in 2026

More Code, Fewer Juniors: The Software Engineering Labour Market in 2026
Key takeaways
  • US software developer employment reached a record of about 2.2 million in 2025, up 8.5% (Microsoft), and was 4% higher again in March 2026.
  • Employment of US developers aged 22–25 fell nearly 20% from 2024, while older cohorts kept growing (Stanford AI Index 2026).
  • Measured productivity gains from AI are 14–26% in software development and customer support; agent deployment remains in single digits across most business functions.
  • Senior engineers who can specify, review and own AI-assisted work are becoming the constraint — and the pipeline that produces them is narrowing.
Two findings published in 2026 appear to contradict each other. Microsoft reports that software developer employment in the United States reached a record high. Stanford reports that employment of the youngest developers dropped sharply. Both are true — and together they describe how engineering teams are changing.

More code than ever

Microsoft's Global AI Diffusion report for the first quarter of 2026 notes that git pushes — published code changes — rose 78% year on year, as coding assistants and agents became mainstream. Its labour-market data runs against the popular expectation of mass replacement: total US software developer employment reached about 2.2 million in 2025, up 8.5% and a record for the profession, and March 2026 was about 4% above March 2025.
Microsoft's explanation is economic. When developer productivity rises, software becomes cheaper to build; if demand for software is elastic, organisations build more of it, in more parts of the economy. The report is careful to say it is too early to know the long-term effect.

Fewer entry-level developers

The Stanford AI Index 2026 looks at the same market by age. US developers aged 22 to 25 saw employment fall nearly 20% from 2024, while headcount for older developers continued to grow. The index also notes that measured productivity gains from AI — 14% to 26% — are clearest in exactly the fields where entry-level employment is starting to decline: customer support and software development.
Deloitte's State of AI in the Enterprise 2026 describes the same mechanism from the employer side. Leaders interviewed for the study said that entry-level work — data entry, reconciliation, first-line support — is being prioritised for automation, and expressed concern that these roles are the starting point of longer careers.

Capabilities rose; deployment did not keep pace

On SWE-bench Verified, a benchmark of real software engineering tasks, AI performance rose from 60% to close to the human baseline within a single year, according to Stanford. AI agents jumped from about 12% to roughly 66% task success on OSWorld, a test of real computer tasks — but still fail about one attempt in three on structured benchmarks. And agent deployment remains in single digits across nearly all business functions.
In practice, this means AI writes a growing share of the code, while people remain responsible for deciding what to build, reviewing what was generated, integrating it with existing systems and owning the result in production.

What employers say they need

Survey data on skills points the same way:
  • In McKinsey's HR Monitor 2026 (1,300 HR professionals, 5,500 employees, ten countries), software development and other narrow technical-execution skills declined in HR's ranking of future skills, while problem-solving, creativity, data and AI, and the ability to reason rose. Digital literacy jumped from 20th to 6th place.
  • McKinsey Global Institute estimates that up to 30% of current work hours in Europe and the US could be automated by 2030 at a moderate adoption pace, while more than 70% of today's skills remain relevant.
  • In Mercer's Global Talent Trends 2026, 54% of executives name talent scarcity as the top force shaping their people plans, and 59% of HR leaders say attracting people with vital digital skills is their biggest workforce challenge.
  • Deloitte found that 53% of companies have considered pod-based or flatter team structures, but only 16% have moved to them substantially.

The senior constraint

Put together, the data suggests a shift in where the bottleneck sits. Generating code is no longer scarce. Engineers who can turn a vague requirement into a precise specification, recognise when generated code is wrong, design systems that stay maintainable and take responsibility for production are scarce — and senior developers are the cohort still growing.
The narrowing entry-level pipeline makes this a medium-term problem. Senior engineers in 2030 are today's juniors and mid-level developers. Fewer entry-level roles in 2025–2026 means fewer experienced engineers available at the end of the decade, unless organisations deliberately keep training paths open.

Questions for engineering leaders

  • Where does review capacity come from as code volume grows — and is it measured?
  • Which tasks are delegated to AI, and which still require a person who knows the system?
  • How do junior engineers learn if the tasks they used to learn on are automated?
  • Is the team structured around outcomes — small pods with a senior lead — or around headcount?
  • What is the plan for senior capacity in 2028, given today's hiring patterns?

Sources

]]> Stanford AI Index 2026: The Numbers That Matter for Product and Engineering Leaders https://bonsaytech.com/tpost/stanford-ai-index-2026-key-numbers https://bonsaytech.com/tpost/stanford-ai-index-2026-key-numbers?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation The ninth AI Index runs to more than 400 pages. Here are the findings most relevant to founders, CTOs and investors — capability, adoption, investment, risk and the labour market — with the context each number needs.

Stanford AI Index 2026: The Numbers That Matter for Product and Engineering Leaders

Stanford AI Index 2026: The Numbers That Matter for Product and Engineering Leaders
Key takeaways
  • Organisational AI adoption reached 88%; generative AI hit about 53% population adoption within three years — faster than the PC or the internet.
  • AI agents rose from 12% to about 66% task success on OSWorld, yet still fail roughly one task in three; deployment in business functions remains in single digits.
  • US private AI investment reached $285.9 billion in 2025, and 1,953 AI companies received new funding in the US alone.
  • Documented AI incidents rose to 362 from 233, while responsible-AI reporting stays patchy.
Stanford's AI Index Report 2026, published in April by the Institute for Human-Centered AI, is the most widely cited independent dataset on artificial intelligence. Its co-chairs summarise the year in one line: a field that is scaling faster than the systems around it can adapt. Below are the findings with the most direct consequences for companies that build software.

Capability: still accelerating, still jagged

  • Industry produced more than 90% of notable frontier models in 2025. Several now meet or exceed human baselines on PhD-level science questions, multimodal reasoning and competition mathematics.
  • On SWE-bench Verified, a benchmark of real software engineering tasks, performance went from 60% to close to the human baseline in a single year.
  • AI agents improved from 12% to roughly 66% task success on OSWorld, which measures real computer tasks across operating systems — but still fail about one attempt in three.
  • The frontier remains uneven: a model that earned a gold medal at the International Mathematical Olympiad sits next to a top model that reads an analogue clock correctly only about half the time. Robots succeed in only 12% of household tasks.
The practical reading: capability on well-specified tasks is high and rising, but reliability on open-ended, multi-step work is not yet at a level where unsupervised automation is safe.

Models are converging

Leading models are now hard to tell apart, and open-weight models are more competitive than ever. The performance gap between the best US and Chinese models has effectively closed — as of March 2026 the top model led by just 2.7%. At the same time, benchmarks are saturating, frontier labs disclose less, and independent testing does not always confirm developer claims.
For product teams this lowers the value of betting on a single provider and raises the value of evaluation: test models on your own tasks and keep the integration replaceable.

Adoption is fast and broad

  • Organisational adoption reached 88%.
  • Generative AI reached about 53% population adoption within three years, faster than the personal computer or the internet. Adoption correlates with income but has outliers: Singapore at 61% and the United Arab Emirates at 54%, while the US ranks 24th at 28.3%.
  • The estimated annual value of generative AI tools to US consumers reached $172 billion by early 2026.
Yet adoption is not the same as deployment. The report notes that AI agent deployment remains in single digits across nearly all business functions.

Investment concentrates in the US

US private AI investment reached $285.9 billion in 2025, more than 23 times China's $12.4 billion (the report cautions that Chinese state guidance funds are not fully captured). The US also led in new company formation, with 1,953 newly funded AI companies — more than ten times the next country. However, the number of AI researchers and developers moving to the US has fallen 89% since 2017, including an 80% drop in the last year.

Productivity and work

Studies collected in the report show productivity gains of 14% to 26% in customer support and software development, with weaker or even negative effects in tasks requiring more judgement. In software development, where gains are clearest, US developers aged 22 to 25 saw employment fall nearly 20% from 2024, while employment of older developers continued to grow.

Risk is rising faster than reporting

Documented AI incidents rose to 362, up from 233 in 2024. Almost all frontier developers report capability benchmarks, but reporting on responsible-AI benchmarks remains inconsistent. Research cited in the report also finds trade-offs: improving one responsible-AI dimension, such as safety, can reduce another, such as accuracy.
Public opinion is split. 73% of AI experts expect AI to have a positive effect on how people do their jobs, compared with 23% of the public. Globally, the EU is trusted more than the US or China to regulate AI effectively.

Infrastructure and environment

The US hosts 5,427 data centres, more than ten times any other country, and nearly every leading AI chip is fabricated by a single company, TSMC. AI data centre power capacity reached 29.6 GW — comparable to New York State at peak demand.

What to take from it

For companies building with AI in 2027, the index supports a few working assumptions:
  1. Model choice matters less than evaluation and integration. Leading models are close; measuring them on your own tasks is what differentiates.
  2. Agents need supervision. A one-in-three failure rate on structured tasks means human approval for consequential actions is still a design requirement.
  3. Adoption is not value. High usage coexists with single-digit deployment in business functions; the gap is engineering and process work.
  4. Incidents and regulation will grow together. Logging, access control and documentation are cheaper to build in than to retrofit.

Sources

  • Stanford Institute for Human-Centered AI, AI Index Report 2026, April 2026 — top takeaways and chapters on technical performance, economy and responsible AI.
]]> AI in Europe 2026: Record Funding, a Scale-Up Gap and a Sovereignty Question https://bonsaytech.com/tpost/state-of-ai-in-europe-2026 https://bonsaytech.com/tpost/state-of-ai-in-europe-2026?amp=true Thu, 22 Oct 2026 10:00:00 +0300 Arseni Mazolevski AI & automation European AI start-ups raised a record $21.8 billion in 2025. Dealroom and Prosus show where Europe leads — adoption, applied AI, frontier talent — and where it falls behind: growth capital, models and compute.

AI in Europe 2026: Record Funding, a Scale-Up Gap and a Sovereignty Question

AI in Europe 2026: Record Funding, a Scale-Up Gap and a Sovereignty Question
Key takeaways
  • European AI VC funding reached a record $21.8 billion in 2025, up 58%; AI is now more than 30% of all European VC.
  • Europe has about as many AI start-ups as the US but captured only 11% of global AI VC since 2023, against 77% for the US.
  • The gap is at scale: late-stage AI funding was $12 billion in Europe versus $141 billion in the US in 2025, and over half of late-stage capital is foreign.
  • Over 75% of European AI funding targets vertical applications — health, energy, fintech, security and defence, legal.
The State of AI in Europe: The Invisible Giant report by Dealroom and Prosus (March 2026) describes a continent that builds AI companies at the same rate as the United States but rarely scales them at home. For founders, CTOs and investors working in or with Europe, its data explains both the opportunity and the constraints.

Funding at a record — and still small at scale

European AI venture funding reached an all-time high of $21.8 billion in 2025, up 58% from 2024 and nearly ten times the 2016 level. AI now accounts for more than 30% of all European VC funding, double its share three years earlier. Large seed rounds are also at a record, most of them in AI.
The gap appears as companies grow. Europe has a comparable number of AI start-ups to the US but captured only 11% of global AI VC since 2023, against 77% for the US. Early-stage funding is roughly on par; at breakout stage Europe invests about three times less, and at late stage the difference widens to roughly $12 billion versus $141 billion in 2025.
More than half of the late-stage capital going into European AI companies comes from abroad, predominantly from US investors, who also lead most European AI rounds above $100 million. The report's summary is blunt: Europe grows the companies; others own them at scale.

Adoption: Europe uses AI more than anyone

On usage, Europe leads. AI adoption in most European countries exceeds US levels, and Europe records about twice the LLM usage of the US. The dominant models, however, are built in the US and China — so European usage largely enriches foreign ecosystems.
Microsoft's AI Diffusion data for Q1 2026 points the same way: Norway, Ireland, France, Spain, the UK and the Netherlands all rank in the global top ten by share of the working-age population using AI.

Talent: on par at the frontier, in the wrong jobs

Europe has frontier AI talent comparable to the US, but its distribution differs:
  • 53% of European AI talent works in traditional-economy roles, against 40% in the US.
  • Only 33% works in digital-native technology companies, against 46% in the US.
  • Around half of US AI talent is imported, much of it from Europe — though the report sees early signs of that flow reversing.
  • Europe accounts for just 3% of new global AI patents, compared with 70% for the US and 14% for China.
The talent exists; fewer of those people work in companies built to scale AI products.

Where Europe competes

More than 75% of European AI funding targets vertical, specialist applications — health, energy, fintech, security and defence, and legal. Defence, security and resilience is the fastest-growing AI segment, with $8.7 billion invested in 2025, up 55% year on year. Europe also holds a strong position in robotics, AI-enabled manufacturing and autonomous systems, while trailing in foundation models and AI chips.
London remains the largest hub, with about 1,700 VC-backed AI start-ups worth a combined $125 billion and $7.1 billion raised in 2025. Munich and Zurich lead in deep tech and research; Paris is rising, particularly in model development.

The sovereignty question

Sovereignty runs through the report: models, compute and late-stage capital are concentrated outside Europe. Deloitte's State of AI in the Enterprise 2026 shows that buyers feel it too — 77% of companies now consider an AI solution's country of origin when choosing vendors, and 83% call data residency and in-region compute at least moderately important.
For companies selling AI products into Europe, that translates into concrete requirements: the ability to run models in the EU or on customers' own infrastructure, clear data-processing agreements, and documentation of where data flows.

The proposed fixes

Dealroom and Prosus argue that Europe's problem is capital and friction rather than innovation or talent. Their proposals include opening European pension funds — which hold around €13 trillion — to venture and growth capital (a 3% allocation would release about €100 billion), extending the planned EU-wide company framework to cover cross-border financing and employment, simplifying the regulatory stack, and backing European open-source models and vertical applications.

What it means for 2027–2028

  • European AI companies will stay lean for longer before reaching growth capital, which puts a premium on senior, efficient engineering teams.
  • Vertical AI is where Europe has an edge — and where domain knowledge and regulation (health, finance, defence) matter as much as models.
  • Sovereignty is becoming a buying criterion, not just a policy theme; architecture choices need to reflect it.

Sources

]]>