Wade Sonenberg 🐬

Here's what nobody tells you about going from $0 to $4.3M ARR. It's not a growth curve. It's a series of plateaus interrupted by breakthroughs. Year 1: $0 to $400K ARR. Everything was exciting. The product barely worked. Customers were forgiving because we were new. Years 2–3: $400K to $1.2M ARR. First real sales motion. First real team hires. First real mistakes in both. Year 4: Got stuck at $1.2–1.6M ARR for almost 8 months. Couldn't figure out why. The answer was me. I was the bottleneck. Year 5: $1.6M to $2.6M ARR. Rebuilt the team. Rebuilt the product roadmap. Rebuilt my own operating approach. Then got stuck again at $2.4–2.6M ARR for another stretch. Every founder talks about the breakthroughs. Nobody talks about the stretches of months where nothing moves and you genuinely don't know if you're doing something wrong or if you just need to wait. Those periods almost broke me. What got me through was two things. First, concrete data — I stopped measuring by MRR and started measuring by leading indicators: activation rates, expansion revenue, net revenue retention. If those were moving, MRR would follow. Second, the knowledge that every founder I respected had gone through the same thing at the same stages and had survived it. Year 6: Broke through to $4.3M ARR. Still building. The plateaus don't mean you're failing. They mean you've exhausted what got you here and need to find what gets you there. That's not a crisis. That's the job.

I am a CISO at one of the six banks that got called to Treasury on Tuesday. I need to explain what happened in that room. Bessent and Powell don't convene emergency meetings. They just don't. Last time was SVB collapsing. So when the invite hit — "cybersecurity briefing, Treasury headquarters, Tuesday morning" — every one of us knew this wasn't a courtesy call. Jane Fraser was there. Brian Moynihan. Charlie Scharf. Ted Pick. David Solomon. Dimon got the invite but couldn't make it. They told us Anthropic built a model called Mythos that found thousands of zero-day vulnerabilities across every major operating system and every major browser. Some of these bugs are 27 years old. Sitting in production code since 1999. Nobody — not Google Project Zero, not the NSA, not a single human researcher — ever caught them. The room got very quiet when they explained the next part. This model doesn't just find vulnerabilities. It writes working exploits. Autonomously. No human in the loop. Their previous model had a near-0% success rate at autonomous exploit development. Mythos hit 72.4% on Firefox alone. One demo showed it chaining four separate vulnerabilities to escape both a browser sandbox AND an OS sandbox — weeks of work for an elite human team. Mythos did it overnight while the engineers slept. The Anthropic people kept using the word "emerged." These capabilities weren't trained. They emerged from general improvements in reasoning. That word is what made the room go cold. Because if it emerged in their model, it'll emerge in the next one. And the one after that. 99% of the vulnerabilities are still unpatched right now. Every major bank runs on the same compromised infrastructure. We just got told the exact shape of the holes and we can't fix them fast enough. Anthropic committed $100 million in compute credits and launched Project Glasswing — 40 organizations get limited access to use Mythos defensively. Amazon, Google, JPMorgan, Apple, Microsoft. But nobody in the press is connecting this part. Anthropic is valued at $380 billion. $30 billion revenue run rate — just surpassed OpenAI. Evaluating an IPO for October. And the model that terrified every bank CEO in America? They can't release it to paying customers. Their own researchers said it might be "many times larger and more expensive than Opus." Too expensive to commercialize at scale. The company preparing for the biggest AI IPO in history just told the U.S. government its flagship product is simultaneously too dangerous to sell and too expensive to run. That's a hell of a slide to put in front of underwriters. Meanwhile OpenAI is reportedly building something called "Spud" with similar capabilities. Every hospital system, every power grid, every bank in America is running software with decades of unfound vulnerabilities — and we're entering a world where any sufficiently advanced model finds them all at once. We left Treasury with one clear understanding: the window between when AI can find every vulnerability and when defenders can patch them is going to be the most dangerous period in the history of cybersecurity. Nobody in that room disagreed. What's your company doing about it? Genuinely — because most of us don't have an answer yet either. This is a fictional narrator. The numbers are real.