Welcome to Issue 164 of The CTO Show Brief.

AI is no longer a software story. This week made clear that the next competitive layer is physical: energy grids, sovereign data centers, national models, and commoditized exploit kits. Capital is repricing accordingly, and the window for undisciplined growth bets is closing.

NVIDIA's CERAWeek partnership with NextEra, Constellation, and Vistra turns AI compute clusters into dispatchable grid infrastructure. The Vera Rubin DSX design lets these facilities absorb and release power in real time, bypassing the 200+ GW interconnection queue that now defines the real bottleneck in AI scaling. The constraint has shifted from chips to electrons. Whoever controls flexible compute-plus-power wins the infrastructure layer. In the GCC, this maps cleanly onto existing solar and nuclear buildout strategies.

Egypt launched Karnak (30-80B parameters) at the Ai Everything MEA summit, making it the most complete Arabic-first foundational model to date. The accompanying plan to produce 750,000 AI graduates annually frames human capital as compute. This is not an isolated event. Morocco, UAE, and Saudi Arabia each have sovereign model or infrastructure programs underway. The structural implication: regional startups that build on sovereign models gain local-context moats that global incumbents cannot easily replicate. The MEA AI market is projected at $46.71B in 2026 with a 35.5% CAGR in the GCC alone.

Model Context Protocol crossed 97 million installs in March. Every major frontier lab now ships MCP-compatible tooling. The release of MCP Security Standard v1.1 signals the protocol is hardening for enterprise production. What this displaces: the entire category of custom-connector startups. What it creates: demand for context engineering, MCP gateway security (zero-trust inspection of JSON-RPC calls between agent and tool), and agent-to-agent commerce infrastructure. Startups whose value proposition was integration are now undifferentiated. Startups managing what agents are allowed to do and see are in demand.

The Iran conflict has driven Brent crude to $112/barrel and introduced stagflation scenarios into investor models. U.S. venture funding is tracking toward $13B in March, a sharp drop from February's record ($140B+, led by OpenAI and Anthropic). European infrastructure funding hit a yearly high in the same period. Late-stage AI growth rounds are stalling. Seed and early-stage deals remain intact. Defense tech, energy independence, and supply chain plays are absorbing reallocated capital. For founders raising Series B or later, path-to-profitability has returned as the primary evaluation lens, not growth rate.

DarkSword, an iOS zero-click exploit kit targeting versions 18.4-18.7, was leaked on GitHub this week. The kit combines six vulnerabilities into a fileless attack that exfiltrates crypto wallets, iMessages, and health data in minutes, then self-wipes. The leak effectively democratizes nation-state-grade mobile attack capability. Traditional MDM tools have no visibility at this process level. The direct consequence: CISOs are compressing mobile EDR procurement cycles from months to weeks. With CISA operating at 40% staffing due to the DHS partial shutdown, U.S. critical infrastructure enters this period without adequate federal backstop. Known targets include Saudi Arabia and Turkey.

March 2026 is the first month of active EU AI Act enforcement for GPAI providers. Documentation packages are no longer optional. The FTC's updated AI disclosure standard introduces a proximity requirement for AI-generated content disclosures. Healthcare AI systems are now under Section 1557 non-discrimination scrutiny in the U.S. The regulatory environment has moved from guidance to litigation risk. The near-term beneficiaries are AI governance infrastructure companies: automated documentation, drift detection, bias auditing. The near-term risk: any enterprise AI deployment in healthcare, hiring, or credit that lacks a human-review trail.

 🎙️Episodes Recap:

#583 Continuous Compliance Is Coming: Richa Kaul on AI Agents, Data Risk, and the End of Manual GRC

In this episode, Mehmet sits down with Richa Kaul Founder and CEO of Complyance, to explore how AI is fundamentally reshaping governance, risk, and compliance (GRC). What was once seen as a cost center is now becoming a strategic asset. With the rise of AI agents, continuous compliance, and real-time risk visibility, enterprises are moving beyond manual checklists toward intelligent, automated systems. This conversation breaks down how AI is changing the way organizations think about data risk, why compliance is finally reaching the boardroom, and what the future of GRC looks like in an agent-driven world.

#584 AI-Powered Prospecting: Rylan Folts on Data, Wealth, and the End of Cold Outreach

In this episode of The CTO Show with Mehmet, Mehmet sits down with Rylan Folts , Co-Founder of WealthFeed, to explore how AI is reshaping prospecting in wealth management and beyond. The conversation goes beyond fintech. It dives into a deeper shift from relationship-driven growth to data-driven timing. Rylan shares how “money in motion” signals and life-event data are becoming the new foundation for customer acquisition, replacing traditional cold outreach and guesswork. They also unpack how AI is not replacing advisors, but amplifying them by removing operational friction and enabling highly personalized, multi-channel engagement at scale. This is a conversation about timing, trust, and how data is quietly becoming the most valuable layer in modern go-to-market strategies.

👉 Grab your copy here

Thanks for reading — and for being part of this growing, global-minded network.

— Mehmet