China’s $10B Chip IPO Challenges the DRAM Oligopoly
CXMT IPO DRAM Story: $10 Billion Listing Takes Aim at the Oligopoly
ChangXin Memory Technologies (CXMT) just priced a ~$10 billion IPO on Shanghai’s STAR Board. It’s one of the largest public offerings in Chinese history. The listing takes direct aim at the Samsung/SK Hynix/Micron DRAM oligopoly, which has dominated global memory chips for years. This CXMT IPO DRAM story is quickly becoming one of the biggest semiconductor headlines of the year. Indeed, the size of the raise alone signals how much Beijing wants a domestic memory champion.
Half of CXMT’s offering is reserved for strategic and state-backed investors. For example, Alibaba, Nio, Transsion, and China’s National Social Security Fund all hold stakes. The listing could value CXMT near 2 trillion yuan. Additionally, it is expected to build momentum for other Chinese chip IPOs, including Yangtze Memory (YMTC) and Baidu’s Kunlunxin unit. However, some analysts warn the mega-listing echoes past Chinese market-top signals like PetroChina’s 2007 debut. Read the full CXMT IPO coverage at TechStrong Semi.
TSMC Posts Record Profit as AI Demand Surges
Meanwhile, TSMC posted a record second-quarter profit. Profit climbed more than 23% year-over-year on booming AI chip demand from Nvidia, Apple, and Broadcom. As a result, TSMC is doubling down on its Arizona investment, and advanced nodes now make up 77% of its wafer revenue.WP
AI Power Costs Spark a Grid Fight
On the energy side, the White House is expanding its AI Ratepayer Pledge. The voluntary framework brings utilities, data center developers, and state governors together to keep AI infrastructure costs off household electric bills. Futurum’s Dan O’Brien called the move “a positive.” On the other hand, colleague Mitch Ashley argued that a voluntary pledge “cannot govern” a fight already playing out at the municipal level. Read more at Techstrong.ai. That tension is already showing up in the numbers. For instance, PJM’s latest capacity auction added $6.3 billion in data-center-linked power costs, and it also missed its reliability target for a third straight year.
CMMC Phase II Suspended, Iran Exploits SS7 Flaws
On cybersecurity, the Department of War suspended CMMC Phase II requirements. The pause comes just four months before third-party audits were set to become mandatory. Officials cited high compliance costs for small defense contractors as the reason. Still, the underlying obligations, DFARS 252.204-7012 and NIST SP 800-171, remain fully in force. Details at Security Boulevard. Separately, new reporting from the Financial Times via TechCrunch revealed that Iran exploited decades-old SS7 telecom flaws and commercial ad-tech data. As a result, the tactic let Iran track US military personnel across the Middle East.
Watch Today’s Panel
Today’s Techstrong Gang panel includes Alan Shimel, Jon Swartz, Mike Vizard, Jiewen Wang, and Jack Gold. Together, they break it all down live. For more panel discussions, check out the Techstrong Gang video archive.
Transcript
Hey everyone, happy Thursday and welcome to the Techstrong gang. It's Thursday. I blink my eyes, it was Monday, but here we are at Thursday.
We're rounding out. We'll finish this up and tomorrow finishes the week. It's one into the next, into the next.
Before you know it, I'll be in Las Vegas at 115 degrees for Black Hat. But welcome to the gang today. Let me introduce you to our gang members.
We've got a great gang lined up for you. We've got our friend Jack Gold here, and Jack, good to see you. Thank you.
Good to be here. Thank you. We've got my friend, Wiky Wang, who I haven't had the pleasure of being on with in a long time, so it's good to see Wiky, and I hope it's good to see you, Wiky.
Yeah. That's good. And then joining Jack, Wiky, and I are our two stalwarts, the man in the West, the man in the East, Joen Swartz and Mike Vizard.
Gentlemen, welcome. So, you know something is afoot when DRAM is sexy. Right?
Good old DRAM that every time I went to buy DRAM, it got cheaper. That's always been my experience with DRAM. Well, the world supply of DRAM is pre-sold for the next two years or whatever they say, and it's having repercussions.
And Mike, the people in China are never one to miss an opportunity. Yeah. And they're jumping in on it.
But it's not just DRAM, it's the whole semi spaces- Yeah ... ablaze. It's a global issue.
But today, TMSC got everybody going because they posted a 72% increase in profits, and at the same time, they turned around and said they were going to invest $100 billion in Arizona. And then we have these folks in China talking about an IPO to build more memory for what ultimately will be an AI ecosystem, and that seems to be where most of the demand is coming from. And as I look at all this stuff, I'm going to go to Jack, but at what point does all this stuff actually come online, and how far down the road are we really looking?
Because I'm also a little bit dubious, to be honest, about what's being said about semiconductor plants in Arizona, because, well, they require water, and if you've been to Arizona, the one thing they argue about all the time is water. So what's real and what's not real here, Jack? Water?
No water in Arizona? Who ever heard of that? Look, it is a real problem, so let's segment this out.
There are a few things going on here. First of all, there's a real shortage of not just DRAM, but all RAM. Right?
All memory is in real short supply. And Alan, you're right, it's probably sold out for at least maybe two years, maybe longer. We don't really know.
In the past, memory has been really cyclical, so it'd be really gung ho, great sales for two, three years, and then there's a drought, and they can't sell anything for another two years. So, do you make $100 billion investments in new plants when you don't know two years out whether or not you're going to be able to sell that equipment? It takes three to four years to get a new semiconductor plant up and running, by the time you start it until the time it's actually producing at volume.
So there's a real issue there. That's number one. Number two is that why these guys are making so much money, the Microns of the world, the SK Hynixs of the world, and now the Chinese are trying to get into the act as well, of course, is that DRAM has shifted from what used to be relatively low cost, put it in your PC, put it in your phone, put it in your TV, you get $3, $5 a chip, to high bandwidth memory that's required for all these AI systems, and lots of it.
And the margins on those things are 80%, 90% in some cases, as opposed to 10% on DRAM for consumer devices. So all of these guys are shifting their production to this high margin, high cost, high bandwidth memory. Makes a whole lot of sense, right?
The third piece of this, and this gets into the Chinese piece, is that a lot of this new high bandwidth memory technology is not going to China. We're not shipping it there. If it's US-based companies, even the Korean-based companies are not allowed to ship it because it's leading edge.
" Memory is not easy to make, but it's certainly not as hard as making an NVIDIA GPU chip. Right? And so they've been making memory for quite a period of time, number one.
Number two is they're low-cost producers of everything. Let's face it. And so if you're trying to get in the consumer they're very attractive.
In fact, Apple is rumored to be talking to them to try and buy their memory. The question is, how good is it? Does it hold up as well as Samsung or SK Hynix or Micron?
We don't quite know that yet. That'll take some time to get to that answer. But there's every reason for them to get into the marketplace to do that.
And the final thing around TSMC investing $100 billion now in Arizona, two things going on there. Number one is they're trying to diversify the supply chain. It's not good to have everything in one location, for anyone, for any manufacturing facility.
So the more you can get in the US, the better, or in other parts of the world as well. Number two is it doesn't hurt you politically. Right?
Given the current administration and what they're looking at How they're promoting Intel and Apple partnerships because they're all going to be US-based, it all helps. And as aside from that, I'd also say that the problem, or the challenge, we shouldn't say problem, but the challenge that TSMC has is that building those chips in the US costs maybe 10 or 20% more than building them in Taiwan. And so what you're probably going to do is go after the really high-margin chips where you're not hurting, not the low-margin chips that you produce 3 billion of them a year.
And that plays right into the whole AI craze because that's really what NVIDIA chips at $30,000 or $40,000 a crack are much better than $3 chips that go into your TV. And so it's an interesting dynamic, but my bottom line to all of this is, don't hold your breath. If something happens over the next year or two to mess up this marketplace, these guys are going to be hurting because they're throwing a lot of money at this stuff.
And once you start building out, you can sort of stop, but you're still going to have a minimal investment that's going to be pretty high. So Mike, I got some thoughts on all of this as well. First, let me deal with the Chinese market and this IPO.
I think there's two things at play here. One is, as Jack pointed out, you have three makers of DRAM in the world in a sold-out market. Why shouldn't you have a fourth or even a fifth and a sixth, right?
And so that's smart business, that's good business, assuming that the quality is on par. But the real bigger issue here is this wasn't a listing necessarily on the US stock exchanges. This was a listing in China because it's part of China's AI strategy, right?
And we're partly to blame for it. When we don't give them access to GPUs or Western DRAM or Western technology, what do you expect them to do, roll over? No.
You are incenting them to develop their own market, to develop their own production capability, and which is exactly what they're doing. And so now we're seeing it with GPUs, we're seeing it with Huawei equipment, we're seeing it with the etching, right? That right now only, I forget the name of the company out of the Netherlands does.
ASML. ASML. ASML.
And now we're seeing it with DRAM. You are going to see an entire AI ecosystem independent of Western US, read US, influence develop, and then they will compete globally, not just in the Chinese domestic market, which is a big market to begin with, but they'll compete globally. I think you need that political lens when you look at this.
You need that political lens when you look at the TSMC, and Jack, I'm going to disagree with you. " TSMC is married to the government of Taiwan and their reason for being. They want to be that porcupine.
They want the Chinese to know, and the world to know, there's a kill switch. They get invited and they kill what we produce at TSMC, the whole world's going to suffer. You're not going to be able to switch it to Arizona.
So from a geopolitical point of view, they're going to placate our administration, which is easily placated. In this case, it's a $100 billion bribe to build a thing where they'll make their lower-end chips, where the margins aren't that high, so they could charge a little more, they could charge a little less. This is a company that just announced 72% growth- Yeah ...
in revenue and was already a mint, printing money. They don't care. Yeah.
100 billion's a lot to you and I, not to them. So I think that's the real political game here, right? Is TSMC has to make itself so valuable that the world will protect Taiwan.
Alan, I don't disagree with what you just said. The trouble with that approach is that I'm not convinced that if, God forbid, China tomorrow decides to take over Taiwan and TSMC, that our government would do anything about it. Look at what's happening with other commodities.
Look what's happening with rare earths. By the way, no one talks about rare earths. They already tried this once, right?
If China cut off rare earth metals to us, half of our consumer products would no longer function or- No, but in rare earths, we are. We're actively looking for alternative sources, both here in the US and Brazil and other places. Sure.
Africa. But again, that's a five-year effort, right? It's not something you turn on overnight.
No. It's going to take time. It's going to take time.
I guess my point was though, Alan, I'm not sure that we have the vision or will have the vision if China decides to take over Taiwan and TSMC to say, some of us will have the vision. " If you don't think Jensen has his number on speed dial- Eh, maybe ... and the rest of these billionaires- Maybe.
I think- By the way, there is one other point that you made earlier I want to amplify, and that is, if you don't give it to China, they build their own. They're already trying to rebuild, or they're trying to build ASML-like machines. Yeah.
And they're going to be half the price. Yeah. And they'll be able to make lots of them, which ASML can't do.
That is the end game right there. They're going to take the long view and they're going to do to chips what they did to automotive and EVs, right? They're going to run the same playbook.
Yeah. And while you may not see much of that technology here in the US, it'll be everywhere else around the world. They will take up most of the demand in the market and then slowly start to squeeze on price to the point where the US maker or the Taiwanese maker will not be able to compete.
" Fair point. Mm-hmm. I wrote this CXMT $10 billion IPO, and there are two takeaways, and I wondered, maybe I'll ask Jack about this.
So this is going to be maybe the second-largest Chinese IPO ever. In a sense, I interpret this kind of as a sovereign challenge to Samsung, SK Hynix, and Micron. But also, what to me was really interesting is this IPO signals this kind of transition in China's semiconductor strategy.
So we're moving from this heavy reliance where you're bankrolled by direct government subsidies to kind of utilizing public capital markets to fund this technology race. And the investors include Alibaba, NIO, and TransDigm. Is that kind of what you think is going on, Jack?
Well, so let's look at this. Number one is they're listing on the Shanghai exchange, not- Yeah ... not NASDAQ.
Starboard I-- Yeah. Right. Shanghai, right.
So it's basically Chinese money funding China or Chinese industry. Alibaba, Tencent, I mean, those guys are on the Shanghai as well. In fact, my understanding was that the Chinese government refused to let these guys list on NASDAQ because they didn't want them beholden to the American and other- Oh, this is strategic, right?
It's strategic- Yeah ... to China's AI efforts. Yeah.
So we have to be a little bit careful when you start talking about the Shanghai Stock Exchange. Is it really-- Yes, it's a stock exchange, but how much control does China really have over it? There's a lot of gotchas in there, I guess, is what I would say.
Yeah, that to me was like, that jumped out at me as the significance of that. Yeah. Or lack of.
Yeah. Yeah. Right.
Yeah. I mean, look at what SK Hynix just did, right? They listed on NASDAQ.
I don't remember the term, it's foreign-traded shares on the domestic market. But you go to NASDAQ, you can buy SK Hynix. It's a Korean company.
You can do the same with Samsung. You can't do that right now, at least, with CXMT. You've got to go to Shanghai, or someone has to go to Shanghai to buy their stock.
Right. So, I mean, it's an indication that China's getting serious about this market and the chip market in general, and they will catch up. If you deny them something, they will go build it.
There's an awful lot of smart people there. There's an awful lot of capital they can invest. And you can only hold them back for so long.
We'll have to see what happens. So what's the next logical outcome of this? And I think we're already seeing some of this, but eventually, will the US government say to everybody who uses chips from Taiwan or made in the US that they have to invest in the companies that make that to sustain that as well?
Because they're going to say, "We got to counter the investments that the Chinese companies are making in the core providers of memory and-" So what we're really discussing is a bipolar world, Mike. Right. Right?
Well, if you're in the Chinese camp, you buy from China, or if you're in the US camp, you buy from the US. Where does that leave Europe? Yeah.
Where does that leave the Middle East? Where does it leave Africa, South America, the rest of the world? Because I don't think those two camps, the Chinese and the American, are going to change much.
They're each going to try to hoard their own. So where does it leave Canada, Mexico, right? The US is not exactly out making friends these days.
It's also India. India is investing- India is huge ... a huge amount of money in that space.
Right. And that's- The Europeans- ... where the play is, right?
The rest of the world. Yeah. The Europeans are way behind on this stuff.
And primarily it's because they can't get together. The EU is trying to put together all these technology components- The sovereignty stuff. Yeah Yes.
And they're getting nowhere because Germany wants one thing, France wants something else. However it works and it's just, there's a lot of, if you look at kind of the underlying discussions in the technology space in Europe, they're all ticked off, I was going to use a stronger term, about why Europe isn't doing more to make this happen. But, I follow it.
There is stuff going on with European AI- They have a chip act ... sovereign AI, data sovereignty- Yeah ... cloud sovereignty, et cetera.
Sean? But, yeah. Yeah, I have a question here.
From my point of view is like, where the demand is, where the capacity expansion will be, and then the new technology and those entrepreneur or creators, they will find way to meet those demands. But what do you think, how long those demands will take, still exist? I feel like this is something very interesting because so far you can see all of those big heads, they try to have like a new innovation.
They try to get into the stock market, get more money to support the demand, right? They all try to expand, and you see the demand is so strong. Man.
Well, I would say we're still at the beginning. We're still at the beginning of this curve, not at the end. Right?
There's still this build-out that's going to go on for the next 10 years. " Yeah. You mean you don't want to pay more for AI than you pay for your workers?
Come on, Mike. Like, kind of what we did with cars and gasoline, huh? And remember the internet, Alan.
How many people invested gazillions of dollars in internet that went nowhere? Read my book coming out. Right?
Fiber prices fell by 90%. Anyway, guys, we've got to fall off of this subject, though, because we're almost 20 minutes in on it. We got to get onto our next one.
Mike, what do we got coming out of the White House? Now, all of a sudden, it's not build at all costs, drill, baby, drill on data centers? No, apparently, there's an issue around energy and what it's going to cost.
So I think they're saying keep building the data centers, but what they are saying to folks is that if you build a data center, you cannot use the electricity that is currently made available to consumers and other organizations. And so they're trying to create what feels like a separate grid system just for AI data centers. I think that's their end game.
3 billion in additional AI data center power costs that are not accounted for just yet. So there's still a lot of demand. And I'm going to throw something out here after I just look at John a little bit for more detail here.
But consider this, is it the data centers we need to throw off the current grid, or is it the people that are on the grid today and we need to kick them off onto maybe, I don't know, solar in your house so you can get out of the way of all these AI data centers? What do you think, John? I think we should adopt more solar and wind.
I know that would really warm the heart of Trump. This is like this AI ratepayer pledge, which we've heard about before. And I'm going to be really blunt, and I'm just going to throw it.
I actually look at this as this political midterm election play- Yes ... as a nod toward affordability. Right?
So Trump, he hates to use that word. He doesn't understand what it means, and he dismisses it. But I think it's a move to kind of placate the masses because we all know this AI boom is going to drive up electricity bills for Americans unless we do something radical.
So I think this is a self-protection move on his part because the Democrats, they are hitting so hard on data centers. This has become a key winning issue for them whenever I- Well- ... speak to Democratic strategists.
But I'm just going to explain just a little bit more about this, though. So the White House has this summit they're planning in a couple weeks, in the coming weeks if they ever do it, to bring together utility executives, independent data center developers, and state governors with this idea of this voluntary pledge, voluntary, to ensure that the expansion of AI infrastructure doesn't result in higher energy costs. Now, there was an earlier ratepayer protection pledge that was signed at the White House by Amazon, Google, Meta, Microsoft, OpenAI, Oracle, and xAI.
And under that agreement, the companies committed to financing the electricity infrastructure required for their projects rather than passing on the cost to consumers. So that's kind of where it's going. But again, I just think of this as cover your a*s type of move.
Yeah. So guys, in about, I don't know, two hours, I'm doing my Shimmy Says, and I'm going to be talking about data centers a lot. Data centers everywhere, right?
But let me bring some color to this. Down here in Florida, used to be a purple state. It's red, red, red.
It's another story. But Byron Donalds is the leading Republican candidate for governor because DeSantis is term limited out. And he is blanketing commercial waves with a message that says the following: He stands with President Trump to make sure that data centers will not affect the lives of Floridians.
We won't pay extra electricity for it, electric rates. We won't be affected by data centers. If it's not good for Florida, he won't allow it.
Standing with President Trump. Now, President Trump, last week or the week before, said data centers are liquid gold. Right?
He's still of that opinion. But it's not just the electricity that makes the data center. So there's a Times article out yesterday.
The biggest turnaround in public opinion in a year we've ever seen. A year ago, it was about 50/50 if people would want a data center near their house. Today, it's like 75% no.
Right. Because people are waking up to find construction going on. They're bypassing the regular zoning and housing and land use things because these guys are coming in with big money and buying it out.
And farmers and ranchers are waking up to smelling gas turbines because the energy thing is, don't worry, we're not using. That's what these companies are signing up for. We're not using the public grid.
We're going to build our own Private natural gas-fired generators and power plants for these behemoth data centers. Oh, and that exhaust pipe comes out by your house? I'm sorry.
Talk to your politician about that. Right? You got people waking up to gas-powered turbines outside making noise, and you want to know why people hate this?
Why people are so against it? There's another reason, though, Allen, and that's what I think a lot of people don't realize when we start talking about AI data centers. Other than the construction, so if construction takes 2,000, 3,000, 4,000 people, I get it.
A year, two years- There's no jobs ... there are no jobs. You're right.
Yeah. A typical data center employs about 50 people. Done.
Right. And it takes up, what, 10,000 acres? 20,000 acres?
Yeah. Some of these are 40,000. The one in Utah is 40,000 acres.
Yeah. Of what used to be productive land, which you can't farm on anymore. Or there are no trees left.
It dries up the water because you're changing the entire- No, but Jack, to be fair, a lot of these data centers are being built in flyover stand areas. Northeast Louisiana that used to be cotton was king, and now- Yeah ... they missed out on the John Deere factory, the Toyota factory, and this was their last best hope, and so they gave these people 80% tax deductions.
Outside of Memphis, Tennessee, towns where they got pictures of guys in horse and buggies, horse and carriages in the '60s bringing firewood when there was a big electrical plant right behind them, but that electric plant powered electricity back in Memphis, not out in Boomtown. Yeah, but Allen- And it's the same thing. It's the forgotten corners of the country- It's funny, man.
Yes ... where they're building this. You're right, but in the past when plants came into those areas, it was to create jobs.
So if I was- Yeah, no, they were factories. They were factories. Yeah.
If I was a citizen in that little town, there's benefit to me. These days- But now there's not ... there's no benefit.
Right. There's no give and take. There's no give and take.
Can I interject for a second? When we talked in the last segment about the long-term plans for China, I think about these as the short-term hustle or scam. Not a scam, but we create a couple thousand jobs to build this thing out, and then afterwards, oh, we're going to conveniently forget this.
As you guys said, there are no jobs. There are a handful of jobs. So this is like this short-term strike it while it's rich and then move on to the next project.
John, it's even worse than that because what will happen 10 years from now is you're going to find that probably 30%, 40%, 50% of these great big data centers that we built out will be vacant. Yeah. That's a good point.
Yes. That's a distinct possibility, but this is also playing out elsewhere, right? So the governor of New York put a moratorium- Yeah ...
on new data center projects, at least big ones, and that immediately got a response from Trump, so the two of them have been bickering ever since because Trump is saying that this is a wrong-headed approach. And despite whatever the guy running for office in Florida is saying, Trump is making it clear that more data centers, the better. Well, Trump- He said it before Joe ...
said it before. Yeah. It's kind of interesting what I can see here.
There are a lot of things currently people, one set of people try to support data center, but at the same time, the facility and supporting system actually is not there. Right? You can see for data center, we don't have enough electricity.
We don't have people around support, and people argue about whether we should have those in our neighbor. I'm just wondering how those combination work together to move things forward. I think the problem is solvable, but it requires a certain amount of political will and technical will and investment, and it's not going to be solved inside of a decade.
Right? You need to build an entire electric system for AI. One of the things, going back to the previous block, that China is doing, is they have a lot of access to energy that they're making available to AI companies and at a much lower cost than we do.
So- They're building out, by the way, Mike, just to interrupt, China is building out more electrical generation per year than we have in place. Mm-hmm. And not with coal fire plants necessarily.
They're using- Some coal. They're still doing coal ... but they're using a lot of solar.
They're playing with the- Nuclear ... thorium nuclear. Yeah.
Look, I'm not saying building out the data centers is the wrong thing. I'm saying we make it for a quick buck, and we're not- Yeah ... thinking perhaps longer term.
Long-term. Yeah. Of course, we're not.
So I actually think this summit is basically a, I don't know, brazen attempt to decouple global tech leadership from local economic backlash. And that's where I think people are standing up. They're saying- Yeah ...
"All the stuff that's going on at the national, this is my backyard. " But we have stood up, and we're not going to take it anymore. There you go.
Right. NIMBY issues really resonate with people, and- Yeah ... when you begin to get the cascading- No, it clearly does.
The Times article was crystal on it. As I said, 2:30 Eastern Time, I'll be live. I'm talking about this, and it's a long one.
It's about 20 minutes, maybe more. But it'll be 20 minutes. Another quick point that people don't talk enough about, noise pollution.
Yes. Yeah. You got 100 generators running in these data centers.
You're going to hear that for miles. And the gas turbines. Yeah.
Don't forget the gas turbines. Well, I'm sorry. Yeah.
The electric generators. The gas turbines, right. Yep.
They make a lot of noise. Yeah. Absolutely.
At the same time, I also see there are a lot of good companies. They try to solve those problem from smart way, right? Remember last time when we talk about the NVIDIA- New, what's that called?
The data center at your backyard. Mm-hmm. Yeah They try to- Yeah ...
solve this problem in different way. I think it's very innovative. I think Elon's just going to build them all on Mars.
We'll be all fine after that. You know what? All of this does play into his hands where it's okay if we pay a little extra dollars, put them in space.
Yeah, it doesn't work. China's building them under the ocean with wind farms on top. We did the math.
It doesn't work. You can't put them in space. No, I was being facetious.
But- Yeah ... where do you put them? Anyway, where do we go?
We got to go to our next segment here because we're over on time on this one as well. Mike, what do we got up next for the gang? Well, it was a little perplexing, let's just put it this way.
And I don't know if this is an ongoing conversation we need to have, but the Department of Defense, AKA Department of War, depending on what side of the aisle I guess you sit on, put out a statement saying that they were going to not enforce this next round of this security mandate that they had put in place because, well, the small businesses were complaining about the cost. Originally, it was a self-assessment test, and then the next phase of this thing is I have to actually pass a real test, and I think somebody was saying that the total of this test is like $64,000. At the same time, though, Iran has shown that they can exploit our telecom networks to get at our troops, and we're at war.
Let's be candid about this. And at the end of the day- I got the answer, Mike. Let's test them for testosterone.
Yeah, I heard that. I thought about that, too. " Yeah.
I think it's a very interesting topic. I wouldn't interpret this purse as a reduction of security standards. These security requirements still remain in place, right?
What's being reconsidered is how the certification process is rolled out. It makes sense from the operational perspective. If you try to scale in the third-party assessment around very big supplier ecosystem, it requires enough qualified assessors and an efficient certificate process.
The more interesting question now is how framework evolves over the coming months to improve the scalability while maintaining the confidence in the assessment process. That will have much bigger impact for the long-term compliance than the temporary purse itself. If you can remember last time when we talk about other executive order or something, you can see I feel like a government or regulated system try to encourage the innovation and try to support those small and medium size company, try to get into the system.
But at the same time, if you look at other perspective, like how things works, right? Even though we don't have this part, we still have the other compliance regulatory requirements there in place. How to regulate certain portion of the most important part from the security perspective, like federal, right?
Still in place if you try to get the federal contract. Part of that it will still doing some assessment, but just this specific one, they try to purse and try to see if there's any after effects evaluation or something else can regulate it. I think it's just- Yeah, but you know- ...
trying to do a simplification- Sorry ... to the process. Yeah.
This reminds me of a state or a county or a city putting building codes in place and then telling the construction companies that they can verify it on their own. Would you trust... And I'm not saying these are bad people.
I'm not saying they're doing it on purpose, but you can't put together an intensive security structure, just like you can't put together an intensive building code, and then expect people that are supposed to be compliant with it to do their own thing. Long-term, it doesn't. " You mean I can't grade my own homework?
Is that where you're going with that? Yeah. Pretty much.
Yeah. I think that's the reason the entire audit industry is there, right? " There are still some guardrail there, but from different angle.
You can't cross the line with the minimum requirements. But for this specific one, maybe we don't require in front of the- I guess- Yeah ... I wish they went the other way, and I wish they said, "We recognize that this is costly, and we're going to go invest in," I don't know, "AI to help reduce the cost of this thing.
" But I think that they went to their immediate knee-jerk, let's just get rid of the regulation versus let's figure out a way to make the regulation work. Doge. It's Doge for security.
That's a great comparison. Exactly. Slash burn and don't think- That's what they're doing ...
more than a millisecond Yeah. And so how is a larger enter- if the US government isn't willing to enforce some compliance standards on smaller businesses, will larger enterprises follow suit, or are we just going to be all kind of looking at each other for the next 10 years saying we should do something about cybersecurity, but not really? Look, over 50% of malware attacks happen against SMB, not against big enterprises, because big enterprises can defend themselves.
It's the little guys that can't. It's the 100-person company, or the 1,000-person company that generally doesn't have the ability to go out and do all this advanced cybersecurity protection stuff that the big guys can do. And if the government really wanted to get involved, they could do basically, I don't know, Medicaid for security, right?
We will help pay for you to go out and make sure you're secure. Guys, this is an old story. Exactly.
Yeah. Well, in the long term, that's going to be cheaper. So during the early 2000s through like 2010, one of the companies I co-founded, 60, 70% of our business was with the feds.
And I will tell you, this has always been the problem. If you want to meet the US Army's information assurance standards, or DISA, or DoD, SECDEF, or even in the civilian side of the house, you had to have your FIP certification. You had to go down to Fort-- Not Los Alamos.
Out at Tucson. Huachuca, and spend a couple of months there. You had to have a lab, independent lab verify you.
It's a big boys' game. That lab is in Sierra Vista, Arizona, just so you know. Okay.
Fort Huachuca. I spent a lot of time there. Months, and a lot of money.
65,000 is peanuts- Mm-hmm ... to what it costs to get into the fed game. Yeah.
And they do have programs, right? They have the hub zones, and the women-owned, and Native-owned, and all of these kind of things. But it's still an expensive proposition.
" Right. But with cybersecurity, every hole is a big hole. Right.
Think about this. " But if you have 10 company qualified for this contract, if one company said, "Okay, even though you don't require, but I still do it," is it a unique advantage there? No.
At the end of the day, the government looks at price, right? Mm-hmm. And one of the bigger problems that wasn't addressed by this, that didn't get noticed, is the number of attacks that start at small companies and then make their way up the food chain.
That's the issue, right? So now if I'm going after these small companies that are connected to these defense contractors and into the US government, isn't that the equivalent, therefore, of creating a soft underbelly that it seems like the bad guys already know about and now have AI tools to exploit? So I'm kind of scratching my head going, we know that the adversaries are going to be more skilled and have better tools, and yet we're relaxing our- And what percentage of total companies in the US are small business?
Probably at least 85%. 80. I would say at least 85, yeah.
In the US, yeah, it's very high. In other countries, it's even higher. It's probably 95.
Yeah. So yeah, it's a problem. It is.
Guys, we're about out of time. I got to wrap things up here on us. What a great Techstrong gang today.
How do I bring all three of these together? I don't know if you all saw the semifinal game this week between Argentina and England in the World Cup. England should be playing in the finals this week at MetLife in New York, right?
But they're not, because after taking the lead, instead of pressing their advantage, they fell into a defensive shell. They stopped attacking. They lost their edge.
They lost being aggressive. They lost doing what they needed to do to be the team they need to be. And the Argentinian team just kept pushing.
You knew it was a matter of time, and they won two to one. It reminds me a little bit of what we got here. Mm.
The US had a distinct home-field advantage. We had a head start. We controlled these markets.
But in shortsightedness, in playing defensively, in going into a shell, we're allowing new markets, new players to compete and develop, who will potentially eat our lunch. In taking shortcuts around cybersecurity, we're allowing adversaries to press an advantage. Yeah.
For the quick buck of building a data center, we're putting our people at risk and not taking their needs into consideration. All of this comes back and bites you in the butt, the same way it bit England, right? And so I think we need to think about that going forward.
Anyway, that's it for Techstrong gang today. As usual, you can watch us every Monday to Friday at noon here on Techstrong TV, Techstrong TV YouTube channel, Techstrong OTT channel, LinkedIn, any of our Techstrong sites, on demand on any of those sites, too, if you can't catch us live at noon. We'll be back tomorrow with our Friday weekend.
Mike's going to wrap that one up. I won't be on, unfortunately. But until then, Wiki, Jack, Mike, and John, thanks for joining us.
Thank you for joining us. Well, have a great day, everyone. Bye-bye.