2026-09-15 00:00:19
OREM, Utah, Sept. 14, 2026-- SecurityMetrics has participated for the last eight years in PCI SSC’s GEAR (The Global Executive Assessor Roundtable) since its creation in July of 2018. As participants in GEAR, SecurityMetrics aims to improve the cybersecurity of businesses to help protect organizations and customers alike from cyber threats, and to help refine the PCI compliance process for its customers. SecurityMetrics will be attending the PCI SSC North America and Europe 2026 Community Meetings, and will be contributing to GEAR’s efforts again.
“It has been great to be members of GEAR over the years, because it strengthens our connection to the PCI Council and allows us to provide feedback to the council from the perspective of the QSA companies on the standards and programs that support them,” says Gary Glover, Vice President of Assessments. “It also allows QSA companies to interact during meetings and help shape the QSA community as a whole.”
“We are excited to be in GEAR and to share our future technologies that go beyond PCI compliance like our
Spectre AI solution ,” says CEO Brad Caldwell. “These advancements in the field make e-commerce safer for both consumers and merchants.”
Along with SecurityMetrics’ participation with GEAR at the PCI SSC North America Community Meeting, they will have a tech talk titled ‘6.4.3 and 11.6.1 Monitoring Lessons Learned,’ which will be held on Wednesday, Sept. 16, at 9:35 a.m. in the Ballroom Foyer. Attendees can stop by Booth #33 to learn about AI threat solutions through its
For help navigating PCI compliance, speak to one of our experts today:
SecurityMetrics secures peace of mind for organizations that handle sensitive data. From local shops to some of the world’s largest brands, SecurityMetrics helps businesses achieve data security with penetration testing, vulnerability scanning, gap analysis, security consulting, managed services and compliance mandates (PCI, CMMC, HIPAA, GDPR, HITRUST).
SecurityMetrics is a PCI certified Approved Scanning Vendor (ASV), Qualified Security Assessor (QSA), Certified Forensic Investigator (PFI), CMMC Certified Registered Provider Organization (RPO), and Managed Security provider with over 26 years of data security experience. They have tested over 100 million systems for data security and compliance. They are privately held and headquartered in Orem, Utah, where they maintain a Security Operations Center (SOC) and 24/7 multilingual technical support.
For press inquiries, email
Social (LinkedIn, X, FB, Instagram, YouTube): @SecurityMetrics
2026-09-14 23:41:42
AI reviewing AI? What could possibly go wrong?
Well, for starters, the biggest issue here is bias. If a model has written the code, it probably shouldn’t be the one doing the review. Then there’s the fact that these code reviews shouldn’t be fully outsourced to LLMs (even though they can assist you pretty well, I’ll give you that).
But what about AST analysis? Well, we now have tooling built specifically for these purposes and designed for the AI era.
Below, you’ll find 5 tools for reviewing AI-generated code. They are listed alphabetically, not best to worst (since what’s best for you really depends on your own stack, Git host, how much reviewer noise you’re willing to put up with... that sort of thing).
What if the problem isn’t that the code looks wrong, but that nobody checked whether it does what you’ve agreed to build? That’s the core idea behind Verify.
This tool does exactly what its name implies: it verifies whether the changes satisfy the original intent.
Here’s how it works:
So, it’s no longer about “Does the code look okay?” Now, it’s more like “Does this match our intent and expected behavior?”
Best for: Teams shipping a high volume of AI-generated code who need to prove correctness and maintain an audit trail.
CodeRabbit offers one of the best signal-to-noise ratios among AI code review products. It reads the diff, writes a plain-English walkthrough, draws sequence diagrams, flags bugs, security, and style problems, offers one-click fixes, and lets you chat with it directly in the PR.
This product bundles more than 40 linters and security scanners (including ESLint, Ruff, golangci-lint, TruffleHog, and Trivy) in sandboxes. As a result, there’s less need for a DIY setup.
Best for: Teams that want trustworthy, low-noise AI code review across mixed Git platforms.
Greptile creates an index of your repositories first and turns it into a semantic graph that captures:
This happens before the review. Greptile doesn’t read a diff in isolation, but with the whole-repo context.
It’s particularly useful for catching cross-file and cross-service bugs in large/legacy codebases, where problems introduced by changes aren’t always obvious.
Best for: Teams working on chunky or old systems.
Graphite works by breaking a large change into a chain of small, dependent PRs. Under the hood, its AI reviewer, Diamond, understands that PR #3 depends on PR #2, so it doesn’t throw false "this variable doesn’t exist" errors on a stack.
Such context is a big differentiator between a reviewer that's useful and one that just creates noise.
Best for: Fast-moving GitHub teams that already work with stacked pull requests
⚠️ Note: Cursor acquired Graphite in December 2025 (per Cursor's own announcement), and Diamond has since been folded into Graphite's "Graphite Agent" plans, so the “Diamond” name is increasingly becoming legacy branding.
Qodo (formerly CodiumAI) approaches code review from the testing side. Its PR reviewer, Qodo Merge, grew out of the open-source PR-Agent project, Qodo Cover generates tests, and Qodo Gen is in your editor.
Qodo connects review comments to test coverage and generates the missing tests. Its 2026 revision also runs reviews through several specialized agents, covering areas like bugs, security, quality, and coverage.
Best for: Teams whose review issues often come down to gaps in test coverage.
So, which one should you integrate in your pipelines?
|
Tool |
Category |
Platforms |
Best for |
|---|---|---|---|
|
Aviator Verify |
Intent verification |
GitHub; agents via MCP |
Proving a change matches approved intent; compliance evidence |
|
CodeRabbit |
Diff review |
GitHub, GitLab, Azure DevOps, Bitbucket |
Low-noise review across mixed Git hosts |
|
Greptile |
Whole-codebase review |
GitHub, GitLab |
Cross-file and cross-service bugs |
|
Graphite Diamond |
Stacked-PR review |
GitHub |
Teams living in stacked pull requests |
|
Qodo |
Test-aware review |
GitHub, GitLab, Bitbucket |
Review that closes test-coverage gaps |
Match the tool to your team’s biggest review pain points. Now, I know that flashy landing pages and great copywriting might be convincing, but your decision should ultimately come down to the features that matter to you the most.
Whatever you end up choosing, run the tool only as an advisory or required check. Let the AI handle the first pass, but keep a human responsible for deciding what gets merged and shipped.
No. They simply change what humans spend time on.
The tool takes over the repetitive first pass (style, obvious bugs, missing tests, mechanical checks), so you can focus on things that actually require human judgment: business context, product trade-offs, and whether the design fits.
Review reads the diff and infers intent from the code, then posts comments. Run it twice, and you can get different comments. Verification checks the implementation against acceptance criteria you approved beforehand and returns the same verdict and evidence on every run.
Be skeptical of any single number. Almost every "we rank first" figure comes from the vendor's own benchmark. Independent tests often disagree because they use different bug sets and methods.
In practice, accuracy depends on the tooling and underlying sets of analysis it performs. Tools that combine multiple analysis methods are usually more accurate and deterministic. Verify just happens to be one of them :)
2026-09-14 23:25:40
Nine days ago the president of Kyrgyzstan gave his central bank a deadline: build a working digital som platform and pilot it by 31 December 2026, test it with real users in 2027, then roll it out to the country in stages. Today the National Bank of the Kyrgyz Republic signed a Memorandum of Understanding (MoU) with CertiK, the largest security firm in Web3, to help it get there without the thing that has cost the crypto industry $3.35 billion in 2025 and another $1.32 billion in the first six months of this year. The digital som is already legal tender under a constitutional law signed in April 2025, which is further than 131 of the 134 countries studying a CBDC have got. What Bishkek does not yet have is the thing every central bank discovers it needs the moment a digital currency goes from slide deck to server: someone who has watched attackers take apart live blockchain systems for nine years and knows where they get in.
The memorandum sets up a framework for two kinds of work. The first is engineering, where CertiK will support the central bank on blockchain and digital asset security, security assessments, formal verification, cybersecurity and operational resilience, which in plain terms means reviewing the code and the systems the digital som will run on, proving mathematically that critical pieces behave the way they are supposed to and planning for what happens when something breaks at 3am.
The MoU extends to digital asset oversight and regulatory advisory support, covering anti-money-laundering and counter-terrorist-financing controls, custody, security standards and licensing requirements, alongside the possible deployment of CertiK's Supervision and Compliance products so the regulator can watch risk build up in real time rather than read about it afterwards. Training and knowledge transfer run through both halves. The central bank's board member Sanzhar Abdygaziev framed the document as a starting point for exchange rather than a finished contract, with particular value placed on blockchain security, cybersecurity, AML/CFT and the monitoring of digital asset transactions.
Central banks are good at many things. Running a distributed ledger that holds the national currency, where a stolen key means stolen money that cannot be clawed back, is not historically one of them. A CBDC forces a monetary authority to take on the operating risks of a crypto exchange with none of the crypto exchange's tolerance for failure. Kyrgyzstan's three-phase pilot plan, announced last October, starts by connecting commercial banks for interbank transfers, then plugs in the Central Treasury for government and social payments, then tests offline and low-connectivity transactions before any national launch.
Each phase widens the attack surface: more institutions holding keys, more integrations, more devices in the field. That is the moment to bring in a firm whose day job is finding the flaw before someone else does. The list of countries that got a CBDC to the public is short for a reason. The reason is rarely the economics.
The supervision half matters just as much. Kyrgyzstan is not only building a CBDC; it is building a regulated digital asset industry around it. Last October the country launched KGST, a stablecoin pegged one-to-one to the som on BNB Chain, with Changpeng Zhao advising the national crypto committee and a national digital asset reserve under discussion. The 5 September council meeting approved a single digital platform for licensing and supervising virtual asset firms, with pilot testing set for 1 January 2027. A regulator that suddenly has licensed exchanges, a stablecoin, a reserve and a CBDC to watch needs tooling that reads on-chain activity the way a bank supervisor reads a balance sheet. CertiK already sells that tooling; the MoU leaves the door open to deploying it.
A central bank is the hardest customer a security firm can win. The procurement rules are strict, the compliance bar is high, the operational requirements are unforgiving and a mistake ends up in a parliamentary hearing rather than a Discord channel. CertiK has spent nine years auditing protocols and exchanges; it reports more than $600 billion of digital assets protected across 150-plus countries and operates under SOC 2 Type II and ISO 27001 controls. What it has not had until now is a named, long-term engagement inside a monetary authority that is actively building a sovereign digital currency. That is the reference point every other regulated institution asks for. The firm has been working its way toward this for a while: it has provided technical advisory support to regulators in the United States and answered consultations from the Monetary Authority of Singapore. Bishkek is the first place where the relationship is formal, long-term and tied to a live currency programme, which is the template CertiK can now carry to the next central bank.
There is a second reason the engagement is worth more to CertiK than its fee. The firm's own data describes exactly the kind of threat a central bank should fear most. In 2023, private key compromises were 6.3 percent of incidents and nearly half the money lost, $881 million across 47 events. In the first half of 2026, wallet compromises were 33 incidents out of 344 and took $444.5 million, a third of everything lost, with the two largest events of the half, Kelp DAO and Drift, coming from infrastructure and operational failures rather than bugs in smart contracts.
Key and wallet compromises as a share of all incidents versus a share of all losses, 2023 and first half of 2026.
Kyrgyzstan is a country of about seven million people where remittances from citizens working abroad add up to roughly 30 percent of GDP. Cheaper, faster, traceable money movement is not an abstract policy goal there; it is household income. That is why the government has been willing to move in eighteen months through steps that take larger economies a decade.
Milestones on Kyrgyzstan's digital som programme, 2021 to 2027.
The central bank drafted a digital som concept in 2021, approved it in 2022, ran a regulatory impact analysis and took prototype proposals from twelve vendors in early 2024, published draft laws that August, won a constitutional amendment in April 2025 and laid out the three-phase pilot in October. Larger economies are still debating whether to build. The eurozone is moving toward an issuance decision, the United States has banned a Federal Reserve retail CBDC by law and the three retail CBDCs actually live, in the Bahamas, Jamaica and Nigeria, are all small economies that decided to go first. Kyrgyzstan wants to be the fourth. It also wants to be the first one that treated security as a design input rather than an afterthought.
Three things will show whether this memorandum turns into something more than a signing photo. The first is whether CertiK's name appears on the digital som platform's security assessment before the December pilot, which would mean the engineering half of the MoU went live inside the deadline. The second is whether the Supervision and Compliance tooling is switched on for the virtual asset licensing platform that begins pilot testing on 1 January 2027, which would mean the regulator is watching its licensed exchanges on-chain from day one. The third is who calls next. Every central bank in the research phase of that 134-country list is watching the small ones that go first. A security partnership structured around a live CBDC is the kind of thing that gets copied.
Kyrgyzstan has given itself fifteen weeks to put a digital form of its currency on a working platform. It has spent one of those weeks bringing in the firm that keeps score on how the rest of the industry gets robbed. If the pilot lands in December with an independent security assessment behind it, Bishkek will have done something no G20 central bank has managed: shipped a sovereign digital currency with the security work visible from the outside.
Don’t forget to like and share the story!
Vested Interest Disclosure: HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYOR.
2026-09-14 23:06:37
Two years ago, searching a large marketplace catalogue in anything other than English or Chinese was close to useless. Type a plain description of what you want in Hebrew, Arabic or Polish and you get a handful of results, most of them irrelevant. The catalogue has hundreds of millions of listings. The problem is not that they are missing — it is that the words a shopper uses and the words a seller writes in a listing title are different words, and the gap gets wider the further you move from English.
That is a translation problem in the loose sense and an LLM is obviously good at it. So I built a search engine that takes a plain-language query in any of twelve languages, converts it into the terms sellers actually list under, queries the marketplace API, and ranks what comes back by real rating and order volume rather than ad spend.
The language part worked roughly as expected. Everything around it did not. Here are the failures that taught me something.
The marketplace API takes a min_sale_price parameter. I had been passing it for months — a floor to strip out the two-dollar junk that pollutes every category.
Results kept coming back below the floor. I assumed the parameter was advisory, shrugged, and filtered client-side as a patch.
The parameter is in cents. Passing 15 had been asking for a minimum of fifteen cents. Every price filter in the system, on every surface, had been a no-op since the day it was written.
The lesson is not “read the docs.” I had read them. The lesson is that a filter that silently does nothing looks identical to a filter that is working on data that happens not to need it, and I had no test that would have told the difference. A parameter you cannot observe failing is a parameter you should assert on: pass an absurd floor, and assert the result set becomes empty. That test would have caught it in five minutes at any point in those months.
To narrow results, queries get routed to a category before hitting the API. I asked the model to pick the category ID.
It did. The IDs were plausible — right length, right numeric range, returned without hesitation. Some of them did not exist. Others existed and were the wrong department entirely.
This is the failure mode people mean when they say hallucination, but the specific danger here is different from a wrong sentence. A wrong sentence is visible. A wrong ID is not. The API accepted them, returned a perfectly well-formed result set from some other corner of the catalogue, and everything downstream looked healthy. No error, no empty result, no log line. Just quietly wrong results for a subset of queries.
The fix was boring: fetch the real category tree, and validate every ID the model produces against it before it is used. If the model’s pick is not in the tree, fall back to the keyword mapping.
The general rule I took away: never let a model’s output be used as an identifier without validating it against the authoritative list. Free text can be wrong and a human notices. An identifier can be wrong and nothing notices.
Queries can carry a sort intent — “cheap running shoes”, “popular kitchen gadgets”. The parser stripped those words out and turned them into a sort order.
It stripped them with a substring match.
So newborn baby clothes had the word “new” removed from inside “newborn” and searched for born baby clothes. cheaper earbuds searched for er earbuds. ratings monitor searched for s monitor.
This had been running for years. It never threw. It never logged. It just quietly returned bad results for an entire class of query — and “newborn” is not an exotic word in a catalogue full of baby products.
The fix is a whole-word boundary, with one wrinkle worth writing down: \b in JavaScript regex is defined on ASCII word characters and does not do what you expect against Hebrew or Arabic. I had to match on whitespace-or-string-edge instead:
const re = new RegExp("(^|\\s)" + escaped + "(?=\\s|$)", "i");
If your text processing has to work outside the Latin alphabet, audit every \b you have.
This is the one that changed how I prioritise.
I had assumed the thing to optimise was result quality. Better prompts, better ranking, better category routing. I spent months there.
Then I looked at where people actually left. The overwhelming majority of drop-off was not at checkout and not after a bad result — it was on the results page, before anything had rendered. Cold searches were taking six to eight seconds, because a cache miss means a live call to the marketplace API and that call is slow and outside my control. The people leaving had never seen the results at all, good or bad.
Caching every search for 24 hours took a warm query from around seven seconds to around 0.2. That single change did more for conversion than every ranking improvement I had shipped.
Related, and slightly embarrassing: a couple of category pages were paying for an LLM call before checking the cache. The cache was there. It worked. It was just sitting behind an expensive call that ran unconditionally. Moving the check in front of it took those pages from 2.4 seconds to 0.2.
If you put a model in a request path, draw the actual sequence of what happens on a cache hit. Not the intended sequence — the real one.
Photograph a product, get similar listings. It works, but not in the way people expect.
It reliably tells you the kind of thing you are looking at. It rarely finds the exact item. Photograph a specific gemstone ring and you get “women’s gemstone ring” and forty listings that are not that ring.
I treated this as a shortfall for a while and tried to close the gap. Then I noticed that the failure is more useful than the success would have been. On a marketplace, the same item is typically listed by dozens of sellers at very different prices. A user who wanted “that ring” is usually better served by forty near-identical alternatives, sorted by rating, than by one exact match at whatever price that particular seller chose.
Sometimes the honest thing is to describe what your feature does rather than keep pushing it toward what you assumed users wanted.
A pet category returned the query “cat toy” as a stream of cat-themed merchandise for humans: mugs with cats on them, cat-print socks, cat cushions. The retrieval was doing its job. The seller listings genuinely use those words.
There is no prompt that fixes this, because nothing is wrong upstream. The category simply contains a large volume of items that legitimately match the words and do not match the intent. It needs a domain-specific negative filter — and building one taught me its own lesson, because my first pass filtered out “plush”, “puzzle” and “simulation” as obvious human-merchandise words. Those are all real, common dog toy descriptors. I had to put them back.
Junk filters are domain knowledge, not string lists. Write them with someone who knows the domain, or measure them before shipping.
Most of what broke was not the model. The model did the linguistically hard part adequately from early on. What broke was everything at the boundary between the model and the rest of the system: unvalidated identifiers, a unit mismatch in an API parameter, an encoding assumption in a regex, and an ordering mistake that put an expensive call in front of a cache.
And the biggest single win was not intelligence at all. It was making the page appear before people gave up on it.
The engine is at onefindme.com if you want to try breaking it — it is free and there is no signup. I am still interested in queries it gets wrong, particularly in languages I do not read.
2026-09-14 22:58:11
Saudi Arabia awarded $196 billion of giga-project construction contracts in 2025, a fifth more than the year before, with another $431 billion of announced investment along the Red Sea coast still waiting to be tendered. Every one of those contracts turns into thousands of orders for cement, steel bars, gravel and tiles, most of them still priced the old way: a site manager calls four suppliers, collects four numbers over WhatsApp and picks one without ever knowing whether he overpaid.
BRKZ has been quietly collecting those numbers for four years. It has priced $1.37 billion of quote requests since 2022, sold $133 million of materials off the back of them and grew revenue four times over in 2024 then 2.5 times in 2025 while the sea routes feeding the Kingdom were being redrawn. Today it has $31 million more to spend: a $13 million Series B co-led by Aramco's Wa'ed Ventures and 500 Global, with BECO Capital and Anb Seed Fund participating, plus $18 million of growth debt that Stride Ventures has committed under the $30 million facility the two sides agreed last October. The round is still open, so expect more names on it before the year ends.
https://www.youtube.com/watch?v=Dm6cqKWH6pg&t=62s&embedable=true
Read the $31 million carefully and it splits into $13 million of equity, which buys investors a share of the company, plus $18 million of debt, which BRKZ has to pay back. Startups usually avoid debt because lenders want cash flow, not promises.
BRKZ wants it because of how its customers pay. A contractor buying rebar for a Diriyah site expects sixty or ninety days to settle the bill, while the factory that rolled the steel wants its money on delivery. Someone has to fund the gap in between.
BRKZ has decided that someone should be BRKZ. That turns a marketplace into a lender. Lenders need loan books, which is why Stride Ventures, a firm that has backed the same playbook in India, agreed to a $30 million line last October when the company had raised only $22.5 million of equity in its life. The road here has six stops: a $5.55 million seed from Better Tomorrow Ventures, an $8 million Series A1 in March 2024 that took the company out of stealth, an $8 million Series A2 with $1 million of Capifly debt in early 2025, the Stride facility, a strategic cheque from SIC, the investing arm of the Saudi Industrial Development Fund, in April 2026 and now the Series B. The disclosed tranches add up to $65.6 million; the undisclosed SIC amount takes the company past the $70 million it reports.
When BRKZ came out of stealth in March 2024, the app listed around 1,200 products from 350 suppliers and had handled a bit over $170 million of quote requests. Thirty months on, the supplier count is about 2,100, the catalogue has more than 13,000 product records and the quote volume has passed $1.37 billion, which works out to growth of six to eleven times depending on which number you pick.
The customer side is now more than 1,500 contracting companies and 150 factories. The factories are the clever part because a cement plant does not only sell through BRKZ, it also buys its raw inputs through BRKZ, so every factory that signs up adds supply for the contractors already on the app while adding demand for the raw-material suppliers upstream. That two-way loop is what SIC was paying for in April; its chief executive put the case plainly: the biggest problem for Saudi factories is finding buyers, not finding money. A platform with 1,500 contractors on it is a buyer-finding machine.
BRKZ grew revenue 4x in 2024, then 2.5x in 2025 and says 2026 is tracking toward 3x. Stack those multiples on top of each other and revenue in 2026 lands at thirty times what it was in 2023, for a business that ships physical goods on trucks. The 2025 figure is the one that tells you something, because 2025 was the year Gulf shipping, insurance and supplier lead times all got repriced by conflict in the region.
Indexed revenue built from company-disclosed year-on-year multiples, 2023 = 1. Sources: BRKZ company disclosures, October 2025 and September 2026.
When materials get scarce, contractors go back to whoever can actually deliver which is usually the old supplier relationship, the cousin with a truck. But here…..they did not. They ordered more through the app. That is the difference between a price-comparison website and a supply chain. It is hard to fake.
Since 2022 BRKZ has priced $1.37 billion of requests and sold $133 million of materials. So roughly a tenth of everything quoted on the platform turns into an order. On a phone-and-WhatsApp procurement desk that ratio is normal, because a contractor asks five suppliers to price the same steel and only one of them wins. The difference is that when the losing quotes happen on BRKZ, they do not vanish.
Cumulative request-for-quotation volume versus cumulative materials sold since inception, US$ millions. Source: BRKZ company disclosures, September 2026.
Each one is a timestamped record of what a particular product cost, from a particular supplier, delivered to a particular city, in a particular week. Four years of that adds up to about 38 million structured data points across 13,000-plus product records and 2,100-plus supplier profiles. No competitor can buy that dataset. No contractor has one. It is the raw material for the pricing model that this round is really funding. The job of that model is simple to state: shrink the gap between the $1.37 billion and the $133 million.
Strip the word AI out and describe the jobs. The pricing model has been trained on about 40,000 quote requests and, for each new order, predicts what BRKZ should pay the supplier, what it should charge the contractor and which suppliers should get the request. Between 84 and 89 percent of those predictions land within 5 percent of the price the deal actually closes at. A procurement officer who used to spend an afternoon on the phone now gets a number in seconds and decides whether to accept it. The second job belongs to Nusa, an agent that handles bulk cement.
A truck driver drops a load, photographs the paper delivery note, sends it on WhatsApp; Nusa reads the photo, finds the matching order, checks the tonnage and closes the delivery. About three-quarters of deliveries now clear this way without anyone at BRKZ touching them; the rest get flagged to a person. The third job is credit. When a contractor asks for ninety-day terms, a model scores the request against BRKZ's own history of who pays on time, then a human in finance signs off. In all three cases the machine handles volume and a person keeps the final decision, which is the version of AI that lenders and insurers are comfortable with.
Disclosed automation and accuracy rates across quotation, fulfilment and credit, with the underlying data asset. Source: BRKZ company disclosures, September 2026.
Ibrahim Manna, who founded BRKZ in 2022, is a three-time logistics founder and former Careem executive. The company is built the way a logistics person would build it: trucks, warehouses and supplier contracts first, clever software second. His account of the past year is that contractors and factories never stopped needing three things, materials they could rely on, prices they could trust and deliveries that showed up.
A disrupted region made those needs sharper rather than smaller. His account of the next phase is about sequencing. The first four years went into the supply network, the logistics and the data. Only now, with all of that in place, does it make sense to put a smarter layer on top. Only now can the company push beyond Saudi Arabia into the rest of the Gulf without the network snapping.
Wa'ed Ventures is Aramco's $500 million venture fund, holds more than 100 portfolio companies and exists to build Saudi businesses outside oil. It first invested at the Series A1 and is now co-leading, with chief executive Anas Alghatani framing the investment around procurement that is more efficient, connected and data-driven. 500 Global manages $2.1 billion and has backed more than 5,000 founders in 80-plus countries; it is a new lead here.
Managing partner Amjad Ahmad's reasoning is that building materials is one of the largest and least digitized categories in the Saudi economy, with BRKZ's growth through the disruption as proof the team can execute. BECO Capital of Dubai co-led the A1, came back for the A2 and is in for a third time. Anb Seed Fund puts a Saudi bank on the cap table; anb Capital chief executive Khalid S. Alghamdi points to the SAR 5 billion of processed quotes as the evidence of scale. Behind the equity sit two strategic players: Stride Ventures, whose $18 million turns a signed facility into money on the balance sheet, together with SIC, which is building an alternative-investment book of roughly $425 million this year and picked BRKZ as one of its direct industrial holdings.
Saudi Arabia is building more than any other country right now. The figures that matter for a materials seller are the ones describing what has not been built yet. Knight Frank counts $196 billion of giga-project contracts awarded in 2025 and expects the Kingdom's total construction output to reach $191 billion a year by 2029. On the Red Sea coast, 17 giga projects carry $431.3 billion of announced investment, of which $57 billion has been awarded, so 13 percent.
Announced giga-project investment versus construction contracts awarded, by region, US$ billions. Source: Knight Frank Saudi Arabia Giga Projects Report 2025 via Arab News and Zawya.
Around Riyadh, $237 billion has been announced and $44 billion awarded, so 19 percent, with Diriyah alone holding $45.6 billion in the pipeline. Knight Frank's earlier tally put the whole programme at more than SAR 1.25 trillion launched and not yet delivered. BRKZ already supplies contractors on The Red Sea Project, Diriyah, Qiddiya, ROSHN and King Salman Park, which puts it on both of the geographies where the unawarded money is largest. Vision 2030 fixes the deadlines, Expo 2030 and the 2034 World Cup fix the later ones and none of those dates move, which means the contract awards keep coming whether or not the region has a calm year.
Three places. First, the AI layer: more of the quote-price-deliver journey handled by models, so the platform can process far more orders without hiring in proportion. Second, going deeper into the chain in both directions, up into raw-materials sourcing and down into last-mile delivery, because that is where a physical-goods marketplace earns its margin and its reputation across 40-plus delivery cities.
Third, cross-border trading: direct supply corridors with China, India and other manufacturing hubs, including specialty and private-label products, so that a Saudi contractor's order does not depend on one route staying open. The embedded-financing product, funded by the Stride debt, runs underneath all three, because a contractor who gets ninety-day terms from BRKZ is a contractor who does not shop around. The company was picked for the Saudi Unicorns Program in 2025, has $12 million of the Stride facility still to draw, has a state industrial fund as a shareholder and has left the Series B open, which is a fairly clear signal about how it expects the next few months to go.
BRKZ spent its first four years doing the boring part: signing suppliers one at a time, building a truck network across dozens of cities and learning what a tonne of cement really costs in Jeddah on a given Tuesday. It did that in the one country on earth that is about to award more construction work than anywhere else. It kept growing through the year that was supposed to break supply chains in the region. The $31 million does not need to prove the model, because a thirtyfold revenue climb already did. It decides how much of the next trillion dollars of Saudi building gets priced by BRKZ's software instead of by four phone calls and a guess.
Don’t forget to like and share the story!
Vested Interest Disclosure: HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYOR.
2026-09-14 22:14:00
AI is getting cheaper at the same time that companies are spending more on it. That sounds contradictory, but it is one of the most important things happening in enterprise AI right now.
The price of processing a million tokens keeps falling, especially as open-weight models improve and compete aggressively on cost. At the same time, enterprises are moving from small pilots to always-on copilots, automated workflows and multi-step agents. Cheaper units make it easier to use more units.
For insurance and financial services, I think this changes the AI conversation in a useful way. The question is no longer which single model should win. The better question is which model should handle which kind of work, at what reliability level and under what governance rules.
I use tokenomics to describe the economics of AI at the unit level. Every prompt, retrieved document, tool response and generated answer consumes tokens. Once AI moves into production, those tokens stop being an abstract engineering metric and become a recurring operating cost.
Pricing is also becoming more complicated than a simple monthly subscription. Many enterprise deployments now combine usage-based pricing, committed capacity, caching discounts and different rates for input and output. A team can have a cheap model and still end up with an expensive system if prompts are bloated, agents loop unnecessarily or every task is routed to the most capable model by default.
That is why lower token prices do not remove the need for cost governance. They actually make governance more important because falling prices encourage more experimentation and more volume.
The most interesting part of the current market is that the pressure is not coming from one challenger. It is coming from an ecosystem of open-weight models that keeps improving. Families such as DeepSeek, Qwen, Kimi, GLM and MiniMax have made it harder to assume that the best enterprise option must always come from a closed frontier provider.
That pressure is visible in pricing. In May 2026, DeepSeek made a 75 percent reduction on its flagship V4-Pro pricing permanent [1]. The exact leaderboards will continue to move, but the broader direction is clear: strong models are becoming available at much lower unit costs than many teams were planning around a year ago.
For enterprises, this creates something closer to a portfolio market. Instead of asking one model to do everything, teams can route work based on task difficulty, latency needs, data sensitivity and the cost of being wrong.
This is where regulated industries need a different lens from consumer experimentation. Insurance and financial-services workflows often involve underwriting, claims, customer communications, compliance reviews and other decisions where a small quality gap can create a large downstream cost.
Reliability becomes especially important in agentic workflows. If a model succeeds 95 percent of the time at each step, a five-step workflow succeeds end to end only about 77 percent of the time. Each step may look strong in isolation, yet the combined workflow can still fail often enough to create rework, manual review and customer friction.
That is why I do not think the right strategy is to route everything to the cheapest model. A cheaper model may be perfect for summarization, classification, drafting or high-volume internal tasks. A higher-cost model may still be worth the premium when a workflow is complex, regulated or difficult to recover from when it fails.
The enterprise AI stack is starting to look less like a single vendor decision and more like a routing problem. The goal is to match model capability to business risk. I call this approach a risk-tiered model routing framework: work is classified by business risk first, and model choice follows from that classification rather than the other way around.
Routine work can often go to smaller or open-weight models. Medium-risk tasks can use stronger models with additional checks. High-impact decisions can be routed to the most reliable model available and paired with human review, deterministic rules or independent verification.
This is not only about saving money. Routing gives teams a way to make cost and reliability explicit. It forces product leaders to define which tasks actually require frontier-level capability instead of paying the reliability premium everywhere.
In my own work leading AI product strategy for large financial-services and insurance organizations, this kind of tiering plays out in practice. Routing high-volume, low-risk tasks such as document summarization, intake classification and internal drafting to smaller or open-weight models has meaningfully reduced inference cost without a measurable drop in output quality, while tasks tied to underwriting judgment, compliance communications or customer-facing decisions have continued to justify a reliability premium, paired with human review. The savings from the first category are what fund the ability to be conservative in the second.
Cost is only one reason open-weight models matter. They can also change how organizations think about continuity and control. A model that can be deployed in more than one environment gives a team options if a hosted service becomes unavailable, changes terms or becomes difficult to use in a particular jurisdiction.
That became more than a theoretical concern in 2026, when a U.S. export-control action temporarily suspended access to certain frontier AI models worldwide [2]. Whatever your view of those policies, the engineering lesson is straightforward: dependency on a single model endpoint is now a business-continuity question.
For regulated companies, model provenance belongs in the same conversation. Teams need to know where a model came from, what license applies, how it was trained or fine-tuned when that information is available, where inference runs and who is responsible for monitoring changes. Open does not automatically mean low risk, just as closed does not automatically mean safe.
Traditional cloud FinOps taught teams to track compute, storage and network consumption. AI needs a similar discipline, but token count alone is not enough.
I would track cost by use case, model, workflow and outcome. A workflow that costs twice as much but cuts manual review dramatically may be the better investment. Another workflow may look cheap per call but become expensive because it runs millions of times or repeatedly retries failed steps.
Teams should also watch prompt size, retrieved context, output length, cache hit rates and the number of model calls inside one user action. Those are the places where an apparently small design decision can quietly multiply production cost.
There is a larger paradox here. AI infrastructure spending continues to rise even while inference prices fall. That makes sense if cheaper AI unlocks more use cases, more users and more automation.
A team that once used AI for one chatbot may now use it for document processing, customer support, coding, research and agentic operations. The unit cost falls, but the number of units explodes. This is the same pattern we have seen with other computing technologies: efficiency often expands demand rather than shrinking it.
For executives, that means token price should not be confused with AI budget. Lower prices improve the economics of individual workloads, but portfolio growth can still push total spending higher.
If I were designing an AI platform for a regulated enterprise today, I would assume from day one that multiple models will be used. I would build routing, evaluation and cost attribution as platform capabilities rather than adding them after teams have already hardwired dozens of applications to one provider.
Using the same risk-tiered model routing framework, I would also define model tiers based on business impact. Low-risk tasks would optimize for cost and speed. Sensitive workflows would optimize for reliability, traceability and recoverability. Every tier would have clear evaluation thresholds and a fallback strategy.
Finally, I would treat the model portfolio like any other critical vendor portfolio. Cost matters, but so do concentration risk, portability, provenance and the ability to keep operating when conditions change.
The open-weight shift is making AI cheaper, but it is also making the decision space much bigger. Enterprises now have more models, more deployment options and more ways to trade cost against capability.
For insurance and financial services, the winning strategy will not be to chase the lowest token price. It will be to understand where cheap models are good enough, where a reliability premium is justified and how to move work between them without losing governance.
That is why I think tokenomics is moving beyond the infrastructure team. Once AI is embedded into core workflows, the economics of models become part of product strategy, risk management and business continuity. The token may be tiny, but the decisions around it are getting very large.
[1] Engadget, “DeepSeek permanently reduces the price of its flagship V4 model by 75 percent,” May 2026.
[2] Mayer Brown, “Commerce Department Extends Export Controls to Advanced AI Models; Authorizes Release to Specific Trusted Partners,” June 2026.
