Vijay Balasubramaniyan

Vanta/Drata for MAPD? As I spend a lot of time with Drata for our SOC2 compliance at falcon health, I see a clear parallel between: A) General privacy/security frameworks for enterprises, and B) Risk adjustment, data reporting/submission, and payment compliance for Medicare Advantage plans There are hundreds of things to track for SOC2 compliance - various checks and balances - but you also need processes and mechanisms to monitor changing environments: network traffic, compute usage, new users, cyber threats. The platform organizes hundreds of data streams, automatically checks for errors or risks, and provides alerts to users. So imagine this for Medicare Advantage: Utilization trends, HPMS memos, changing CMS regulations and policies, risk score compliance, and all downstream vendors and their data. What if we had a platform that organizes these data streams, analyzes them, and provides appropriate action plans? The features would mirror what we see in modern compliance platforms - but tailored for MAPD operations. Multi-program compliance across MA, Part D, and Star Ratings. Automated regulatory tracking instead of evidence collection. CMS experts instead of security experts. Provider/vendor management instead of vendor security questionnaires. Compliance protocols instead of security policies. Continuous CMS compliance monitoring instead of 24/7 security monitoring. Same proven framework, different regulatory universe. Do we have such a platform in the MAPD space? --- The image is adopted from the Drata site! Changed the features to meet the MAPD compliance

13

6 Comments

Key takeaways: - The core shift is economic, not hype. LLMs turn “AI” into a recurring operating cost, so pilots quickly become capacity planning, governance, and ownership. - Power and timelines show up because production inference needs sustained compute capacity. When usage increases across the org, you run into procurement, security review, integration work, and infrastructure readiness challenges. - The winners are not the teams with the flashiest demos. The winners are the teams that convert compute into measurable outcomes inside a workflow with traceability and controls. - In 2026, “AI strategy” that is not tied to a specific workflow, KPI, and operating model is mostly theater. If you are building the application layer on top of the datacenter buildout, execution systems, workflow automation, data-layer tooling, compliance automation, I want to see what you are shipping. Founder intro: www.axion.ventures

6

Many companies cut the first security check long before they build the first security strategy, and the gap isn’t cheap. Our new Holtium insight shows how to spot that lag early and quantifies what it costs. Worth a 3-minute read if you’re on a growth path. 👇

17

Open software on proprietary hardware is not sovereignty. Real control means three things:  ✓ You know what you’re running  ✓ You can change it  ✓ You can exit On initial provisioning, some major server vendors permanently bind CPUs to vendor‑controlled firmware signing keys, eliminating modification and exit by design. You don’t see it. You can’t reverse it. ➡️ You get a hidden lock‑in Result: → The CPU only boots vendor‑signed firmware → You can’t repurpose or resell it → You can’t switch vendors Your hardware works, but it’s locked forever. —---- Why your CFO will care? A $50K server usually recovers 20-30% value after 5 years. Fused CPUs have no secondary market. Across a 200‑server fleet, that’s $2–3M in lost capital you never planned for. This isn’t a security issue. It's a balance-sheet issue that hits every refresh cycle. —---- The Real Risk: When Updates Stop! This happened. After Spectre and Meltdown, vendors refused to patch CPUs just 3–5 years old. Now imagine this today: • A CPU zero-day is actively exploited • Your vendor has the patch • Sanctions or export rules block distribution • Your CPU is vendor-locked → You cannot patch it. → You cannot switch vendors. → You just wait → exposed. The visibility gap: There’s no clear disclosure. No standard audit. Most enterprises don’t even know which CPUs are fused, until it’s too late. —---- The Alternative: What We Build Infrastructure controlled by you. Not locked at first boot. That means:  • You have access to the firmware keys  • You patch on your timeline  • Geopolitical restrictions don't paralyze you • Your hardware keeps real market value —---- For regulated, sovereign, or geopolitically exposed organizations, CPU lock‑in isn’t a technical detail. It’s an architectural and financial risk. The servers you deploy today will either retain value and independence in five years, or become stranded assets. That decision lives at the CPU architecture level. If your infrastructure must survive zero-days, sanctions, and vendor exits, you need a different CPU architecture. Let's talk about building it. #VendorLockIn #OpenHardware #DigitalSovereignty 

18

8 Comments

Where is the post-training infra market still “unsolved”? The best pockets are areas where the stack is still missing a reliable primitive. Here are 4 areas where it might work: 1. Outcome-based evaluation (beyond LLM-as-judge) Enterprises care about “did the agent complete the workflow correctly?” as opposed to “did it look fluent?”. But the big challenge is instrumenting ground truth from business systems (CRM, ticketing, payments) and then turning it into automated evals. Startups that own this interface can become system-of-record for AI quality. 2. Continuous learning for agents (safe retraining loops) A lot of teams want self-improving agents, but they don’t trust the loop. The winning wedge is: gated data collection + audit trails + rollbacks + sandboxed deployments. This could be the next evolution after basic orchestration. 3. Governance + compliance automation as product There are rules in place to push companies to document risk controls, testing, and monitoring. The infra opportunity is software that continuously produces compliance evidence (test coverage, incident trails, red-team results) as a byproduct of normal operation. 4. Data flywheels for post-training (high-quality feedback at scale) Post-training quality is gated by data. Partnerships like Anthropic’s use of Surge AI’s RLHF platform illustrate the demand for scalable human feedback + QC systems. Startups that productize “feedback ops” (tools, QC, workforce routing, privacy) can be critical picks-and-shovels.

5

1 Comment

The asymmetry between product innovation and security protection has never been greater.......... and it will get worse before it gets better. However, I am short term pessimistic, long term optimistic. Asymmetry is where outsize returns and opportunities exist. It's a great time to build a security startup.

2

👀 Goats. Agentic AI. Monster trucks. A $1.7B funding wave. RSA Conference 2025 had it all — and then some. But buried in the buzzwords and booth stunts were real signals for founders building in cybersecurity. We wrote up what we saw, what we’re tracking, and what actually matters as you navigate an innovation-hungry market. From securing AI systems to the rise of identity posture and autonomous SOC — this had signal hidden in the noise. If you're a startup CEO, security exec, investor, or just trying to cut through it all, this one’s for you. 👇 Read the full breakdown: https://lnkd.in/eyXG22Vc #RSAC2025 #cybersecurity #startups

70

18 Comments