Hardware, Networks effect, and Cryptography

Hello Cyber Builders 🖖

Some weeks ago, I published a map of six places where I believe durable cybersecurity companies can still be built. Every week, I see AI-assisted coding speed up software development. What used to take months and a team of five now takes one CTO and a weekend. Systems of Record have lost their value. Software companies’ valuations dropped to an average of 5x annual revenue.

Building a database with dashboards is now a weekend job. Most software ideas are no longer real businesses. If your only edge is ‘we use AI,’ you have a feature, not a moat. Being ‘sovereign‘ does not set you apart either. It probably means creating an identity and building trust with your customers, not product differentiation.

So for Cyber Builders, the big question remains: “What to build now in 2026?”

Today, I am diving into the first three topics I mentioned last time.

• Hardware and embodied products.

• Deep tech and cryptography.

• Network effects and practitioner communities.

I believe in human ingenuity and our drive to build new technologies. Electricity changed every industry in the 19th and 20th centuries. Computing and AI will do the same in the 21st. Let’s build the right things.

I recently read an article about hardware sensors and why they could be the next big thing in AI. It reminded me of my own hardware background and why, even in 2026, this space still matters.

Physical products occupy space. They get installed, certified, and integrated into real environments. Once a hardware security appliance is deployed in a data center or a secure enclave chip is embedded in an industrial controller, replacing it requires procurement approval, physical access, testing, and sometimes regulatory re-certification.

Hardware startups can be intimidating. I have met founders who are afraid of it and even reject “thinking about it”. Many VCs, caught up in the SaaS boom, saw hardware as old-school.

But if you look at it rationally, here is what it takes:

• Engineering means prototyping, picking components, laying out PCBs, handling heat, building enclosures, and testing for reliability. You need to understand the underlying physics and design a supply chain.

• Manufacturing does not mean building a factory or hiring a big team. Hardware OEMs can make your devices. Every city has hardware experts who can help. Arduino and Raspberry Pi communities are still going strong.

• Embedded software used to be hard. Booting a full operating system was a big challenge. Now, it is much easier than it was in the 1990s or 2000s.

• Still, software engineering for hardware involves considering the lifecycle, documentation, maintenance, releases, and support. You cannot just push a fix to AWS and expect everyone to get it. You have to plan, test, and support updates for years. This is one of the hardest parts, and founders need to learn it or hire someone who has done it before.

• Certification matters for hardware startups because it helps demonstrate that a product meets essential safety, quality, and regulatory requirements before it reaches customers. It can build trust with buyers, reduce barriers to market entry, and prevent costly delays caused by compliance issues later in the development process. For startups bringing physical products to market, certification is often a critical step in turning a promising prototype into a credible, commercially viable hardware solution.

Common Criteria (CC) certification is hard to achieve but can provide a competitive edge in some highly regulated markets. For example, Utimaco’s CryptoServer hardware achieved CC certification at EAL4+ under Protection Profile EN 419 221-5. Entrust’s nShield HSMs earned CC certification from Italy’s OCSI, qualifying them as Signature Creation Devices under European eIDAS regulation. These certifications took a large effort and a several hundreds thousand euros of budget.

Innovation can also be found in the hardware space, particularly in machine identity nowadays. A Hardware Unique Key (HUK) is a secret, device-specific cryptographic root key burned or generated inside a chip, forming the basis for security, key derivation, and device authentication. It is unique to each piece of hardware, inaccessible to software, and permanent for the life of the device.

PUFs, or Physically Unclonable Functions, are also worth looking at. They let you create a hardware-bound identity for each device. Provisioning has always been tough in security design. With PUFs, you use the randomness and uniqueness of each device—the way it was made, the small differences between them—as an unclonable function, like a serial number for each unit.

Remember, scaling hardware takes capital and a long-term view. It is not a quick three-year play. But hardware gives you real defensibility. Once your product is deployed, integrated, certified, and trusted, it is much harder to replace than software. The barriers are technical and operational: manufacturing, supply chains, distribution, compliance, customer integration, and field reliability all add to your moat.

This is especially true for security hardware. Trust is not built overnight, and customers are unlikely to replace critical infrastructure once it has proven reliable.

To read further, check out that super interesting article:

Let me start with a story about a very small number.

The PlayStation 3 used the ECDSA signature algorithm to protect its game authentication system. The implementation had a flaw: the random nonce k was not truly random—it was the same value across multiple signatures. From the outside, the cryptographic output looked correct. The signatures verified. The system appeared secure.

But from two signatures sharing the same k, you can mathematically derive the private key. An attacker who collected two PS3 signatures could extract Sony’s master signing key. The entire protection system collapsed from a single deterministic implementation error.

Nobody could tell from the outside. Until they could.

This is why cryptography has a moat that AI cannot reach. AI can generate cryptographic code; it can even generate formal verification of software (see Leanstral: Open-Source foundation for trustworthy vibe-coding). Still, designing trustworthy cryptographic systems is hard. Most will fail, and only a few will earn the trust of users and markets.

You might say crypto is in a down cycle. I know. Crypto has been tied to speculation, meme coins, and what Chris Dixon calls casino culture. It is also linked to crypto anarchy, using math and cryptography to avoid government oversight. Both are less popular now. Still, I believe cryptography can help build new solutions with strong privacy and user data ownership.

Here are some examples:

• Fully Homomorphic Encryption (FHE) enables computations on encrypted data without decryption, facilitating secure collaboration on sensitive datasets like cross-bank fraud detection, healthcare research, and intelligence sharing. Hardware advances are making FHE more commercially viable despite slow performance.

• Zero-Knowledge Proofs (ZK) allow organizations to prove the truth of a statement without revealing underlying data, such as identity or compliance information. zkVMs are simplifying cryptographic complexity, creating infrastructure akin to a “Stripe for ZK” that converts primitives into APIs and workflows.

• Confidential Computing involves hardware-isolated environments such as Intel’s, AMD’s, and ARM’s trusted execution environments. Remote attestation verifies workload integrity without trusting operators. Cloud providers offer these primitives, but enterprises need orchestration, policy, identity, and compliance tools to create an infrastructure moat through deep integration with enterprise trust systems.

• Proof of Humanhood turns identity into security infrastructure as AI-generated content becomes widespread. Traditional verification methods are becoming less effective. The opportunity is to develop a trust layer using cryptographic credentials, hardware signals, and biometrics to verify human origin.

I have already had several conversations about the cryptography space: it is very difficult to monetize. To some extent, cryptography is mathematics, and you don’t get rich with maths!

You need to identify use cases that were previously impossible but are now achievable through new crypto-based methods. Zero Knowledge is a prime example. Being able to provide proof without revealing the underlying data—whether for privacy or business reasons—is a powerful capability.

If you look back, you’ll see some examples. For example, VPNs were built using strong public-key cryptography schemes (ISAKMP/IKE and then IPSEC with symmetric crypto)… the tech value is the confidentiality and integrity of packets. But the true value lies in connecting two local networks or a fleet of laptops over public, insecure “Internet” networks. That’s a much more interesting use case!

Here is a paradox that should make every cybersecurity investor uneasy.

Security is one of the most community-driven industries in the world. Practitioners constantly share threat intelligence, detection rules, tooltips, and hard-won experience through informal channels. Conference hallways at GreyHack, CCC, or DEF CON are where the real knowledge transfers happen. Twitter or Discord has rich communities.

Still, there are no large companies exploiting a network effect in cybersecurity.

A network effect is an economic phenomenon where a product or service becomes more valuable as more people use it. When a network grows, each new user adds value to every existing member, creating a self-sustaining loop of growth and strong market dominance. Classic examples are social networks: unless you start following people and engaging with their content, they are useless. Who would like to be alone on Twitter or Substack?

Still, I think this is a moat that AI could not replicate on its own. Adoption is a long-term play; joining a network requires building human trust with its leaders.

That’s what makes network effects interesting right now: as AI floods the Internet with synthetic content, threat reports, and noise, the value of authentic, practitioner-verified networks is increasing — not decreasing. In a world where anyone can generate a convincing threat analysis in 30 seconds, the practitioner who has actually seen the attack, tested the detection, and published the finding under their real name becomes scarcer and more valuable.

Let’s take an example in the Threat Intelligence space. It shows why network effects in cybersecurity are real but fragile.

• Recorded Future built a data-centric network effect: more telemetry from customers improves its models, which should make alerts better for everyone. But even that kind of scale is not enough if the product becomes too dense or too expensive for most teams.

• Intel 471 takes the opposite approach. Its defensibility comes from human-curated intelligence, underground relationships, and analyst judgment. That is a different kind of network effect: not more data, but better access to people and communities that machines cannot easily replicate.

• The C2 ISAC is another signal. AT&T, Verizon, T-Mobile, Comcast, and Charter created a private intelligence-sharing group after the Salt Typhoon incident, bypassing the existing government-affiliated structure. The lesson is clear: security practitioners will share valuable intelligence only when the network feels trusted, private, and low-friction.

That is the opportunity. The winning threat intelligence network may not be another feed aggregator. It may be a trusted enclave where verified practitioners share intelligence, build reputation, and prove the value of their contributions through real-world outcomes.

AI will make software cheaper, faster, and easier to build. That does not mean durable companies disappear. It means founders need to look for moats in places AI cannot instantly replicate: atoms, trust, cryptographic assurance, and real practitioner networks.

Hardware is hard because the physical world is hard. Cryptography is hard because being almost right is not enough. Network effects are hard because trust cannot be generated by a model. That is exactly why these spaces are interesting.

I would love to hear your thoughts. Where do you see durable cybersecurity companies being built in 2026? Do you agree that hardware, cryptography, and practitioner networks are strong opportunities, or do you think I am missing something?

Reply in the comments. I read every one.

Next week, I’ll publish Part 2 and cover the remaining three areas from the original map.

Laurent 💚