Recap of First Rays AI Portfolio Day

Opening: Where Are We in the AI Adoption Journey

The opening set the macro picture: capability has arrived, returns have not, and the gap is architectural.

• AI is a different wave. The internet distributed information; AI produces judgment and does the work. Value shifts to whoever makes that judgment trustworthy, secure and governed.
• Tokens up, ROI flat. MIT NANDA: 95% of organizations see zero return on genAI. Menlo Ventures: 2025 enterprise genAI spend hit $37B, 3.2x year over year.
• Harness and routing beat bigger prompts. A small decision model (Jev) handles routine agent steps; the Databricks example on the slide shows 23% lower cost, 29% fewer tokens and 92% vs. 90% accuracy. Open weights average $0.23 vs. $1.86 per million tokens for frontier models (MIT Sloan, OpenRouter data).
• Data, cost and trust are the blockers. Gartner: 60% of AI projects without AI-ready data abandoned through 2026; 40%+ of agentic projects canceled by end-2027; 50%+ of AI initiatives halt on agentic identity by 2028. Agents are also straining infrastructure: 48 major GitHub outages in a year.
• Value moves to architecture. Harnesses, routing, data and trust. For founders: build the architecture layer. For enterprises: redesign workflows, don't bolt on (McKinsey: high performers 3x more likely to redesign workflows).

The Brakes Are Still Being Designed

Alok's segment turned the macro data into the First Rays thesis and mapped the portfolio onto it.

• Cars and brake pads. “The cars have arrived” but “the brake pads are still being designed.” The brakes are governance, security and identity. They are still primitive, and that is the First Rays thesis.
• Trust the model the least. The deck featured Satya Nadella's line: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
• An agent trust stack across three phases: before the run (checkable goals, domain knowledge, verified building), during the run (survive for weeks, stay on goal, contained execution, least privilege, every action checked) and after the run (provable audit trail, evidence for more autonomy, agents interacting safely).
• Who leads each layer. AllStacks defines what the agent should build; Arnica proves the code is safe; WireMock proves behavior before release; Backslash controls what the agent touches on the machine; Realm Labs checks model intent at runtime; Nametag proves a verified human approved each consequential action.
• Agents go rogue when no honest path exists (Realm Labs research). Agents work inside system instructions, infrastructure and ethical boundaries; when squeezed they Fail, Hack or Cheat. Takeaway: monitor intent, not just actions.
• Context and workflow portfolio. DQLabs, AllStacks, Humigent, Essenvia, FunnelStory, Blotout and Fused make agent delegation trustworthy through data quality, engineering outcomes, domain context, regulatory traceability, graduated autonomy, consent and reproducible apps. Slide line: buying control software does little if organizations bypass it.
• Open and closed should both flourish. Nikesh Arora on preferring open weights for explainability, auditability and verifiability, paired with a Cathedral (Anthropic) vs. Bazaar (DeepSeek) framing: both poles flourish, with every other lab in the middle.
• Close: harnessing the value of AI. The conversation has moved from the model to the AI system. Agents have arrived; safety and security have never mattered more (“trust in depth”); context, data and the harness are where value accrues; the real bottleneck is organizations, not models.

Keynote 1: Past the Pilot: What Enterprise AI Takes to Ship

Rajkumar's argument: building a pilot has never been easier, and that is the problem. Production lives in everything the demo lets teams skip.

• Two lists. What models can do (reason, code, plan, run privately) vs. what enterprises can feed them (data across forty systems, unclear permissions, drifting definitions, a token bill after the pilot). Pilots stall in the gap.
• Uncontrolled tool calling. Models are rewarded for finishing tasks, so blocked agents reach for other tools and systems. Fix: cap steps and retries, read-only access for read-only tasks, per-task tool allowlists, log every call.
• Unauthorized access. An agent holding a user's SAP credentials can reach all 100 reports she can, not the one she asked for. Fix: a governed retrieval layer that checks access, fetches and logs; the agent never holds source credentials.
• Context and cost. Context is how the business actually works, owned by business teams, and is the moat. Token bills rise even as prices fall, so route by difficulty, post-train narrow domains, save frontier tokens for hard reasoning, and show the bill to the use-case owner.
• Bold predictions. Context is sovereign wealth and stays in-house; frontier models become the exception as firms move to open weights on their own inference; data prep for agents becomes huge; every tool call goes through an enterprise-controlled governed layer.

Keynote 2: Beyond Model Evaluation: Rethinking Accountability in Enterprise AI

Sekhar used an illustrative duplicate-charge complaint to show how accountability moves when agents, not fixed workflows, decide the path. Traditional software specifies branches, owners and exits before release. Agentic systems decide intent, authority, action and outcome at runtime.

• Embedded agents carry the same gap. Salesforce documents Agentforce taking wrong or skipped actions; Microsoft confirmed a Copilot Chat issue with confidential-labeled email; Intercom separates an answer from verified resolution.
• The assurance paradox. The more capable agents become in unanticipated situations, the harder they are to test before deployment. Cited cases: an OpenAI red-team where agents in separate VMs signaled through cache timing; OpenAI internal coding agents that weakened monitoring; Replit's agent deleting a production database during a code freeze; an OpenAI test-wallet case where access was mistaken for permission.
• Connected systems escape per-run evals. METR and Redwood's investigation of the OpenAI and Hugging Face incident: about 1,200 agents meant to be isolated, a shared board with more than 70K messages and files, about 700 later participating in the attack. Reconstruction reportedly took 3M GPU-hours and more than 7B logs (Fortune).
• Outcomes, not completions. Nylas H2 2026 survey: 54% saw at least one agent-caused error in 90 days; 31% reversed an agent-triggered workflow. An arXiv preprint found 30x token variation across runs of the same task.
• ChatSee's answer. An assurance engine that observes, classifies and remediates across custom and embedded agents, a taxonomy of 157 failure modes, and an Enterprise-specific AI Failure Analysis Report built from 4-6 weeks of prompt, response and trace logs.

Closing thought: “The unit of accountability is not the model response. It is the business outcome the AI system was trusted to change.”

Panel: Past the Theater: Where AI Actually Works in Cybersecurity

Moderator: Sai Venkataraman, Co-Founder & CEO, Discern Security. Panelists: Victor Chang, CIO & CISO, Backstory; Vasant Balasubramanian, Group VP & GM, Risk, ServiceNow; Kimberly Quan, Compliance & GRC Practitioner, ISSA Board Member; Shane Shook, Venture Partner, Forgepoint Capital, Founder of multiple MSSPs.

Key takeaways:

1. Useful applications are specific, not generic. Examples included automated security testing, building security controls through natural-language coding, and connecting siloed enterprise data to produce actionable intelligence. Buyers’ priorities differed by role.
2. Delegating work to AI does not delegate accountability. Victor Chang compared agents to employees: the leader who deploys them remains responsible. Vasant Balasubramanian emphasized that oversight must span security, legal and business teams.
3. Human oversight must be more than an approval button. Kimberly Quan stressed that reviewers need to see the prompt, instructions and response, understand the context, and be able to challenge the result. A nominal human checkpoint is not meaningful governance.
4. Governance itself needs automation. Manual approval processes can become bottlenecks. Vasant described agents assessing data sensitivity, geographic restrictions and other risks to help evaluate proposed AI deployments.
5. Automation without expertise can scale mistakes. Shane Shook described an engagement where AI was performing a routine security activity incorrectly. His caution: a large AI budget cannot replace domain knowledge and validation.
6. Continuous agents need continuous controls. Static compliance checks are poorly suited to systems that act and change constantly. The discussion favored controls tied to evolving risks and business outcomes, rather than simply collecting evidence faster.
7. Buyers want remediation and clear economics, not another dashboard. Victor rejected tools that identify problems without explaining what to do next, and consumption pricing without demonstrable ROI. Kimberly pushed back on adding more disconnected tools.

Panel: Measuring and Delivering AI Outcomes

Moderator: Alok Shukla, FunnelStory. Panelists: Aditya Phadke, GVP, Enterprise Customer Success, DocuSign; Deepak Sharma, GreyOrange; Laura McCarty, VP of Customer Success, Pure Storage; Janhavi Giri, Principal Architect, Field CTO Office, NetApp.

Key takeaways:

Start with the outcome, not the technology. The panel discussed productivity, cost savings, revenue recovery and operational performance. Examples ranged from extracting actionable terms from agreements to improving warehouse throughput. AI usage alone is not proof of value.

Customer success must demonstrate value, not report activity. Laura McCarty described a shift from showing customers how much they use a product to proving what it delivers. Sales and customer success need to agree with the buyer on how outcomes will be measured.

Outcome-based pricing sounds simpler than it is. Deepak Sharma explained that warehouse performance depends on software, hardware, other vendors and customer operations. Separating each contributor’s impact requires trust. He favored combining subscriptions with outcome-based elements rather than relying entirely on payment for results.

Data readiness remains a major production bottleneck. Janhavi Giri described the difficulty of assembling fragmented manufacturing data, even with resources available. Context, lineage and control at the data layer matter as much as model capability.

Measure the full cost of operating AI. An example involving unexpectedly high cloud costs highlighted how observability and supporting infrastructure can undermine the economics. The practical lesson is to include monitoring and security costs when calculating ROI.

Deployment flexibility can determine whether a deal happens. The audience discussion highlighted resistance to public-cloud deployment where intellectual property, customer data or sovereignty requirements are involved. Private cloud and on-premises options remain important, particularly in manufacturing and European markets.

Data trust is a buying requirement, not an afterthought. Buyers distinguish employee productivity tools from systems that handle sensitive business data, with different expectations for deployment and model access.

Cross-Cutting Themes

• The model is the easy part. The opening, Rajkumar and Sekhar made the same point from three angles: value and risk sit in the system around the model.
• Govern the action, not just the access. Governed tool-call layers, least-privilege retrieval, verified human approval and intent monitoring. Access is not permission.
• Context is the moat. AI-ready data decides whether projects survive; business teams should own context. Portfolio companies such as DQLabs, AllStacks and Humigent sit in this layer.
• Right-size the model and the bill. Route routine work to small or open-weight models, keep frontier tokens for hard reasoning, and include monitoring and security when calculating ROI.
• Measure outcomes, not completions. Sekhar's verified-business-outcome unit, FunnelStory's graduated autonomy and the outcomes panel all point to resolution and reversal rates over task-completion claims.
• Organizations and data trust are the bottleneck. Workflow redesign separates high performers; control software only works if teams actually use it. Across both panels, buyers treated data trust and deployment choice as purchase criteria, not afterthoughts.