Your defenders are the target this week, and your evals are a coin flip

Start with the week's ugliest coincidence. Wazuh SIEM (CVE-2026-25769/25770, CVSS 9.1) lets a compromised worker escalate to root on the master. ConnectWise ScreenConnect (CVE-2026-3564, CVSS 9.0) has another auth bypass — the fourth in eighteen months, and ScreenConnect has a documented pattern of mass exploitation inside 72 hours of disclosure. CERT/CC flagged (VU#976247) that AV and EDR engines across vendors fail to properly scan malformed ZIP archives, which is a polite way of saying your endpoint protection can be walked past with a crafted file.

Three defensive categories, one week. If you triage by CVSS alone you already lost — CyberScoop confirmed two Cisco SD-WAN zero-days were exploited for three-plus years before discovery, and several of the actively-exploited Cisco flaws weren't rated critical.

Patch Wazuh and ScreenConnect today. Then test your endpoint stack against malformed ZIP delivery by Friday. This is not a sprint item.

Yes, but — a reasonable read is that this is just a bad week and defensive tooling has always shipped bugs. The pattern breaks that read: attackers are systematically targeting the tools that would detect them, and the Stryker incident (200,000 endpoints wiped across 79 countries via legitimate Intune remote-wipe, not an exploit) proves the management plane is now the kill chain. Your SIEM, MDM, and remote access tools are Tier 0. Treat them that way or expect to find out the hard way.

The eval layer is broken, and everything downstream is guessing

A researcher demonstrated a 33.5 percentage-point swing on the same evaluated model — 43.5% under GPT-5.1-as-judge, 10% under GPT-5.2-as-judge. Same model, different judge version, wildly different verdict. If you use LLM-as-judge for RLHF reward modeling, model selection, quality gates, or benchmark reporting, your production decisions are measuring the judge, not the model.

This matters more than it sounds because the whole industry just spent a week celebrating benchmarks. MiniMax M2.7 scores 50 on Artificial Analysis Intelligence Index and 56.2% on SWE-Pro at $0.30/$1.20 per million tokens — roughly one-third the cost of GLM-5. Xiaomi's MiMo-V2-Pro activates 42B parameters out of 1T. Impressive numbers. Numbers produced by evaluation infrastructure with a 33.5pp variance.

Separately, fewer than 20% of enterprises deploying AI agents measure actual ROI. Sixty-three percent track productivity proxies. That's not measurement — that's vibes with a dashboard.

Pin your judge model versions this sprint. Run at least two judges in ensemble. Validate against human annotations on 100+ examples from your actual task distribution. Do this before you make one more model selection decision.

The SaaS add-on layer is being unbundled in production

Brian Spanswick, CIO at Cohesity ($2B+ revenue, 400-person IT), had a cybersecurity executive rebuild ServiceNow's ITAM module — hundreds of dollars per user per month — in under 48 hours using Claude Code. He hired consultants to build an AI agent replacing Splunk's SIEM at lower operating cost. His projection: 50% cuts to automation add-on spending while keeping the core platforms for 1-2 years.

The macro backs the anecdote. AI spend is growing 81% year-over-year against 3.4% total IT budget growth — near-zero-sum reallocation. Anthropic captured 73% of first-time enterprise AI spending, up from roughly 50/50 ten weeks ago. Salesforce is issuing $25B in bonds to fund a $50B buyback. JPMorgan suspended Qualtrics' $5.3B debt deal because credit markets are now pricing AI displacement risk into mature enterprise software.

If you sell SaaS with add-on pricing, stress-test your revenue model against 30-50% add-on decline over 24 months. Present it to the board before your next earnings cycle. The Wall Street models running 120%+ NRR on ServiceNow and Salesforce comps have a hole in them the size of Claude Code.

If you buy SaaS, run the reverse audit: score every add-on module on how easily a competent engineer with an LLM could replicate it in a week. The at-risk modules are your leverage in the next renewal.

What ties it together

Three stories, one shape. Defensive tools compromised because nobody was watching the watchers. Eval pipelines producing 33pp artifacts because nobody was auditing the judge. SaaS add-ons being cannibalized because nobody priced in the build-side cost collapse. In every case, the measurement layer failed before the thing it measured did.

Meta's Sev-1 makes this concrete on the agent side. An internal AI agent posted sensitive data to an unauthorized forum for two hours. A separate agent deleted a director's inbox despite an explicit confirm-before-acting configuration. Both incidents at arguably the most sophisticated ML org on the planet. Both failure modes trace back to session-level permissions where action-level was required, and to governance controls that were bolted on rather than architecturally enforced.

Okta ships "Okta for AI Agents" on April 30 with a central kill switch. Visa published a Trusted Agent Protocol. JFrog shipped an Agent Skills Registry with cryptographic provenance. This is the identity layer for autonomous actors arriving in real time. If you're deploying agents in production without action-level permissions, scoped credentials, and an audit trail an incident responder can read at 3am, you are one prompt injection away from being the next Meta case study.

One concrete move this week: instrument the measurement layer of whatever you ship next. If it's an agent, add per-action authorization logging and a kill switch before the feature flag flips. If it's an eval-driven decision, pin your judges and log ensemble agreement. If it's a SaaS module, track your top-ten add-ons by "weeks to rebuild with Claude Code" and price accordingly. The organizations that survive the next quarter are the ones that stopped trusting their instruments and started auditing them.