Next week, I will be publishing earnings reviews on Robinhood, SoFi, ServiceNow, Amazon, Reddit and a couple of other companies.

What a wild week in cybersecurity. PHP, which is a programming language that helps run more than half of the internet, saw two critical bugs revealed. These bugs sat for a decade, effectively allowing potential adversaries to run malicious code on another server without any login credentials. The bugs were patched mid-week after details leaked and early exploitation attempts began. The full extent of successful exploitation is still unclear. Microsoft also revealed that China-affiliated hackers abused compromised ConnectWise application identities and led agent-powered attacks against more than 2,250 Microsoft 365 customers. Reports came out that, in some cases, cloud access took under 3 hours to be breached. Elsewhere, a lone hacker used an open-source AI agent platform to create an invasive swarm of malicious agents that hacked into 100+ corporate websites. 

While the threat environment has always been daunting, it has noticeably worsened with the cadence of attacks materially accelerating as AI agents proliferate. One stat sums up the discovery side of this: 3% of every "critical" software bug found in recorded history was discovered in the last month alone. As every cyber CEO talks about on earnings calls, they’re no longer protecting against human-led threats. They’re protecting rapidly increasing attack surfaces from machine-based adversaries and authorized agents that can go rogue and cause lots of damage despite accessing exactly what they’re supposed to. Agents are better at finding bugs, don’t need to rest and are creative at devising ways to exploit known vulnerabilities that were previously considered non-issues.

Now the skepticism, because some is warranted. The loudest voices narrating this week sell products that benefit from the chaos. The “catastrophic week” is great for cybersecurity demand and the push for tighter open-source AI model regulation. Maybe not so coincidentally, it was people from cybersecurity and frontier closed-model companies who were the loudest alarm ringers all week long. But here is why I don't think you can wave this away as only vendor hype. Strip out every exaggerated headline and the structural facts remain. The cost of a competent attack collapsed, the time from picking a target to privileged access greatly shrank and the time to find a decade-old critical bug in the world's most common web language was profoundly compressed as well. Human-led patching processes just don’t work anymore in this world. We do need the latest and greatest AI and identity security controls from CrowdStrike, Palo Alto and others and we can’t rely on antiquated systems and significant manual labor requirements without inevitably inviting damaging breaches that cost far more than a security contract would. While I do think a lot of the things we’re reading are grossly sensationalized for clicks and other personal interests, I still think this is all a sizable and structural tailwind for security and data infrastructure vendors.

There was a series of headlines that hit SE this week. First, analyst notes (including a DBS downgrade from earlier this month that re-circulated on social media) warned that competition in Southeast Asia is intensifying and forcing the company to spend more on logistics to defend its turf. Next, it announced plans to pursue an IPO for its fintech business (Monee) as a separate entity. Cash from this transaction could help fund some of the needs for its newly announced entry into the public cloud space. It announced Sea Cloud as it shared it had been working on cloud and AI services internally for a couple years and was ready to make them broadly available to the public. 

I think a cloud entry for them makes sense. It will certainly be expensive and a potential operational distraction from their core business, but this team is excellent and can balance many important focus areas at the same time. Cloud is a massive opportunity for them and I think pursuing it is worth all of the risks. For Monee, I’m ok with the move as long as SE’s e-commerce marketplace data is still made openly available to Monee’s underwriting processes and as long as the two pillars can continue sharing loyalty program perks to enrich the overall value SE provides to customers, uplift retention, boost cross-selling and turbocharge lifetime value.

I think the ugly market reaction makes sense given the incremental cash needs that will stem from this and some inevitably thinking this signals its existing product categories are beginning to see maturing growth. I don’t think that’s the case. I just think this is an ambitious founder seeing a big market and wondering why he doesn't have a sizable piece of it too. There could easily be more downside with the ugly chart and the new sources of execution risk, but I think this company is just fine and we’ll look back in a few years thinking these were great decisions for maximizing long-term shareholder value. It never feels like that in real-time when these same decisions lead to sharp share price declines, but they’re making the right moves, I think. If I had more cash available and less existing exposure to the themes this company is tied to, I’d seriously consider starting a small position and slowly averaging down if it kept falling.

Results:

Balance Sheet:

Annual Guidance Updates:

SoFi had a busy week on the deposit front. On Tuesday, SoFi bumped the SoFi Plus savings APY from 4.50% to 4.70% on up to $20,000 for SoFi Plus members. Then on Thursday it announced SoFi Earn, or SOFIE. While the name is maybe not amazing (not too late for a pivot), the value proposition is clear. This is the first tokenized deposit ever offered to consumers by a nationally chartered U.S. bank. Each SOFIE token represents $1 held on deposit at SoFi Bank, earns a variable 4.40% APY, and carries FDIC insurance up to the usual limits. When a member actually wants to deploy the money, they convert SOFIE into SoFiUSD (SoFi's stablecoin) and can buy crypto in the app or send funds over blockchain rails around the clock. It's rolling out to SoFi Crypto members through November, and Anthony Noto framed the launch as bringing "the best of banking to the digital money ecosystem.” The structure here is the story. For review, the GENIUS Act explicitly prohibits stablecoin issuers from paying interest on stablecoin holdings. SoFi's workaround is elegant and, crucially, legal. The yield is never paid on a stablecoin. It's paid on a plain old FDIC-insured bank deposit that happens to be represented by a token, and the deposit converts into the stablecoin only at the moment you want to spend or move it. So to summarize: SOFIE is the high-yield-earning deposit and SoFiUSD is the thing to convert it to when you want to use or transfer the funds. SoFi is aiming squarely at the roughly $64B in stablecoins sitting idle in rarely used or inactive wallets, per Federal Reserve research the company cited. Every dollar that migrates to SOFIE becomes a SoFi Bank deposit, and deposits are the raw fuel of this business model, funding personal loans that yield double digits against a 4.40% cost.

In other news, SoFi and Prudential announced a new life insurance partnership. This gives SoFi members in-app access to its SimplyTerm life plans. It allows SoFi to expand the product suite in an asset-light way that doesn’t require it to use the balance sheet for funding. That keeps members in the door for longer, with more cross-selling, higher retention and higher lifetime value… without losing any degree of lending or overall balance sheet flexibility. Great move, in my opinion.