Today, I’m talking with Alex Stamos, chief security officer at Cognition and longtime cybersecurity expert, about what a mess cybersecurity is right now.

This episode is part one of a special series looking at AI in real life.

I’ve always enjoyed talking to Alex because he’s so direct, and you’re going to hear him say that the multibillion-dollar cybersecurity industry as we’ve known it is essentially overdue to the unrelenting, AI-boosted waves of hacks, breaches, and attacks — and this is only the beginning of how much AI is changing security.

Both private actors and also state actors, like Russia or North Korea, are breaking into systems all over thanks to AI helping them both detect and exploit vulnerabilities all at the same time. It’s got a real frontier feel to it, Alex notes, just like the ’90s, when the whole idea of an always-online world was brand-new.

That much disruption means a lot of places where bad guys can get in while everyone else is left scrambling. Alex isn’t a doomer in the long run, but he does think we’re in for a “dark age” while we try to figure out how on earth to adapt to the new era.

There’s a lot going on here — we even got all the way to how AI-powered misinformation and slop might be managed on our social networks.

Before we get going, do me a favor and subscribe to Decoder on YouTube, where we put out new episodes every Monday and Thursday.

Okay: Alex Stamos on how AI is upending cybersecurity. Here we go.

This interview has been lightly edited for length and clarity.

Alex Stamos, you’re the chief security officer at Cognition. You’re also a lecturer at Stanford University Cyber Policy Center. Welcome back to Decoder.

Hey, thanks for having me, man.

I’m excited to talk to you. It’s been a long time since you and I chatted in what you might call the “content moderation era” of internet policy discourse. I feel like you and I talked a lot about how all that was working, about election security, all those sorts of things. We’re in a new era of big problems on the internet, particularly around cyber defense, cybersecurity. You’ve been thinking about this stuff a lot. You referred to the past few weeks as “security awareness month.” Tell me what’s going on. Just give me the lay of land right now.

October is traditionally security awareness month. Lots of companies run events and deal both internally and then tell people, “Change your password, use multiple passwords, use a password manager.” What has happened over the last month is we’ve had a couple of these big bugs, PHP, Node and such. What’s been less discussed is a huge number of companies have been breached.

You have a series of AI-related companies, the neoclouds that have been breached in succession. You have the Binance hack, which is the largest heist of anything in human history. You have the Cursor incident where one of the things that’s going on here is these hacks are being chained together. From what we know right now, one of the companies that was broken into was Fireworks, which is a prominent provider of AI services to a number of companies. From the Fireworks hack, API keys were stolen that allowed people to break into Cursor. Once they got into Cursor, they then pushed a bad plugin, which went to 5,000 more companies and that caused 5,000 potential breaches. It’s just this kind of permanent continuous breach that is going on throughout the tech industry.

A CISO friend of mine said to a bunch of us, “Is anybody else tired?” And everybody said yes, because effectively we have been at DEFCON 2 for all of October and now going into November.

I’m going to ask you some really dumb questions here. Who is behind all these attacks? Is it Russia? Is it North Korea? Do we know?

It’s a variety of different groups. It is not just because adversaries have decided, but what has happened is, from my perspective, we are at the start of the takeoff of adversary capability enabled by AI, that the open-weight models have now gotten to the point at which you can automate most of the kill chain. This “kill chain” term is something we stole from the military. In the military, they mean to actually kill something. They’re the steps you do to blow something up. In cyber, the kill chain is the things you do to have an effect on a target. So to steal information, to turn something off, to steal money, to steal Bitcoin.

Traditionally, you do research upfront, you look at a piece of software, you find a vulnerability, you write exploits, and you do that all way ahead of time. And then you have a human being go and take that stuff you built and deploy it against either one target — because maybe you’re a government and you’re going against Lockheed Martin or you’re going against another government or you’re a ransomware actor — and you take all that work you did and you deploy it against hundreds or thousands of targets really fast. Now with AI, what’s happening is this kill chain has inverted where you can run an AI system that just goes hog wild and it looks at the targets and it finds the bugs in real time and it writes the exploits in real time and it breaks into these companies. One of the things that’s happening is that these systems are going and they’re so good at finding bugs that they are finding the bugs in real time and writing the exploits in real time.

The system that everybody’s talking about is not the only one, but the system we’re talking about is a thing called ARTEX, which is a Chinese open-source tool that anybody can go look at. There’s an English translation on GitHub that you can check out. And if you power it on the back end by something like an obliterated GLM-5.3, it will let you break into a shocking number of organizations. This started with three South Korean banks. This week, about 200 more companies have been hit. I’ve been helping a couple of companies. Cognition is not an incident response company, but we do go in and help people fix their bugs afterwards by using our tools. It is shocking the companies that are getting hit by something you could just download. It has been a long time since you’ve been able to go and just download an open-source tool and break into multi-billion dollar companies. It’s like the ‘90s. That’s-

That’s what I was thinking about. I think about Windows in the late ’90s, early 2000s when it was a security disaster.

I started saying this actually in the beginning of this year, that it’s an incredibly exciting and terrifying time, because the last time it felt like this was when I was a much younger man and I would go to the very early DEFCONs. DEFCON these days is like 40,000–60,000 people. Back then [in the 1990s] it was a couple hundred people and it was one track and you’d go in and somebody would give a talk and you’d leave the room and you’d think, “Every company in the world is vulnerable to this attack.” The difference was that the entire world didn’t run on the internet. You could go do bad things, but you couldn’t ruin the world and you certainly couldn’t automate it in the way you can now.

It’s back to those days where tools you could just get and build yourself could do crazy things. It’s back to the Wild West days. Back in those days, there were a couple hundred people who had those skills and we were all in one room in Las Vegas and most of them were actually good guys. They didn’t want to be criminals. And now you have a much larger ecosystem of people, many of whom live in places where the law enforcement can’t touch and who have a big economic incentive and have access to these tools. The other big thing is they no longer have to use frontier models that have protections, that have logs that are available to law enforcement. My M5 Mac Ultra Studio finally showed up and I’ve been running a quantized obliterated GLM-5.3 and oh my God, what you can do is incredible.

You mentioned the economics of frontier models. The economy of cyber is one of those things that has gotten sophisticated over the years. One of the things that our systems got safer is you could pay the number of people at DEF CON a whole bunch of money to protect all the systems and it was economically smart to pay them to be defenders instead of attackers. I’m just rewinding my own brain through this history. There was a long conversation in our industry about security through obscurity by hiding all the bugs and hiding all the code versus open source and being really transparent. There was an etiquette that developed about how to reveal the bugs and when to give people notification. There were transparency reports and bug bounties.

You could call it an etiquette, you could call it an economy. We built a culture around cybersecurity and cyber defense and how the attackers and defenders would operate. What you are describing changes it all for a whole number of reasons, but the one that sticks out to me is the economics of it. I can go buy a Mac Studio, I can get an open-weight model and I can just start and that does not place me inside of the culture. There’s not going to be some old man, an Obi-Wan Kenobi saying, “Here’s how you act like a cybersecurity Jedi.” I’m just going to start doing stuff. Tell me how that’s changing right now.

Effectively, the last era of security from my perspective started with the Microsoft, the Bill Gates “trustworthy computing” memo in the early 2000s. And that is when we started designing how we do software security and these big companies, Microsoft and Oracle and then later Amazon and Salesforce and these folks, started hiring ex-hackers. I was part of that generation of the ex-hackers who were at DEF CON and Black Hat and got hired by the companies to go break their stuff. We started coming up with responsible disclosure, bug bounties, consulting companies, so the Foundstone and @stake and then Mandiant and CrowdStrike, these companies grow up and we get this huge industry that is now RSA and Black Hat. This multi-billion dollar security industry grew up in the 2000s and 2010s.

That era is over, like you said, because it was based upon a couple of assumptions. One was that there was a hierarchy of skillsets of people who could do this stuff. You had the script kiddies who could download tools to do things and then the next level up of the people who could write those tools and that was a more rarefied skill set. There were the vulnerability researchers and then there were the gods, and that god tier was in the hundreds of people and those are the people who could do the really, really good vulnerability research, who could write the really, really good shell code, who could reverse engineer patches from Microsoft or somebody like that.

There was also the assumption that there were a limited number of people who could be operational in an attack. If you wanted to build an attack team, then you have a small R&D component and then you have a much larger operational component. If you were a professional attack team at U.S. Cyber Command, at Russia SVR, at Chinese MSS, that you build the structure of your R&D team of elite people and then your less elite operational people, and that was copied then by the Russian ransomware actors. You have to have a conspiracy of people to do this stuff. A lot of this stuff also fell apart with the invention of Bitcoin because one of the assumptions was that you had to have people who could launder money and Bitcoin meant that nerds could launder money. So that started to change the economics of the entire thing.

All this stuff is falling apart because of AI, because the skillset issue is that now script kiddies have a bunch of the skillset of the Dave Vitales and the other cyber gods who could do these things, such that with this Mac that’s sitting on my desktop, I can reverse engineer a Microsoft patch and walk through and then write stable exploit code. It’s not quite there yet to be automatic. You still have to have a bunch of skills, but we’re really, really close.

What’s really concerning, and what you see with the ARTEX stuff, is you can now kind of let loose on the operational side. We were never secure. It was all a fantasy. These vulnerabilities have always existed. These companies have never been safe. And that is what we’ve seen over the last decade is these mostly Russian ransomware actors nailing the mid-size companies that most people have never heard of that are actually really important, like some midsize industrial company that makes some widget that we all depend upon. I once did work for the largest distributor of medical and dental supplies in the country, and they got really hit badly by a Russian ransomware actor and then dental offices across the country were canceling appointments. Didn’t even make the news, but it was because they couldn’t get gloves, because they couldn’t get supplies. It’s because a company like that’s got one security guy and a 10 person, 12 person IT team and they’re going up against a 20 person Russian ransomware team, they’re toast.

But it’s just because there’s only a handful of Russian teams that could do that. Now two or three Russian kids can have a whole bank of Macs or, if they have the money, they can buy Nvidia H-100s and they can run a ton of agents who do this all day and that is what is changing.

I’m sorry, you asked who was doing this. For Binance, it’s North Koreans and they have an entire team where all they do is steal Bitcoin. Other people have gotten out of it because it’s really hard to compete against a foreign intelligence agency that recruits their smartest kids and all they do is steal Bitcoin. They’re extremely good at it. And for the Binance hack, we could talk about it. There’s probably some AI component, but mostly that was actually human intelligence and very, very smart social engineering and the North Koreans are… I mean, you have to give it to them. They’re very, very good at that.

But for the other stuff, it looks like for the people who are breaking into the AI companies is what’s called the Chinese cottage access industry, which are small Chinese contractors who break into companies and then sell the information to much larger Chinese companies.

That diffusion of skill changing the economics of cyber is really fascinating to me. We ran a headline ages ago called “Attack of the Killer Script Kiddies” at the very beginning of all this, and I feel bad because it is much more suited to now than it was to then, because then it was just a lot of automated mischief. Now —

Because you wasted the headline. You wish you held it back.

We wasted the headline. Every now and again you get a lightning bolt of a headline. You got to get it out there. It’s a great piece of art. We’ll put it in the show notes, but it feels like the diffusion you’re talking about is not that a bunch of teenagers are going to be even more malicious. It’s a bunch of bad actors with real incentives to do harm are now vastly more capable than they were before. And that doesn’t seem like you can re-jigger the economics of that unless you somehow make it really expensive to do the attacks.

I think it’s going to be extremely hard to make it expensive to do the attacks.

We’re going to have to lower the cost of defense. You’re completely right to look at this economic problem because what’s happening is attacks are becoming agentic. The cost per token for attackers is going towards zero, and the cost of defense for defenders is staying quite high. It is very important for us to find ways for defenders to have cheaper options. I think that is critical. That’s something I am personally extremely focused on. To be frank, very few people are.

There are a couple of problems here. One, there’s a ton of focus on the defensive side of AI on finding and fixing bugs. That’s great. It’s important. But software security as a CISO… I work for an AI software company, Cognition. Even as a CISO of a software product company, software security is 25% of my job. I have all kinds of other responsibilities. And software security is the part of my job that has been both the most revolutionized and the most improved by AI. The other 75% has been helped a bit and in some cases made much worse. There’s so much more we need to do than just hill climb on finding and fixing bugs. There’s been so much less hill climbing on all these other things. And the next area needs to be the operational security side.

Wait, give me an example of the other things, the 75%.

Okay. So the operational security side is watching your logs, saying, “Ah, somebody is running our techs against us. I am now going to trigger an investigation. I am going to look to see what is going on and I’m going to make an intelligent decision of what I am going to do to respond to this without shutting down the entire company.” That is SOC (security operations center) work. Companies that want to survive this era are going to have to replace human beings who do that work with the first tier and then eventually the second tier with AI. And you can do that with current LLMs.

The first tier actually has to be not an LLM. It has to be something much dumber because you’re looking at terabytes or petabytes of logs and it is just completely uneconomical to do that with an actual LLM. We have other things — TF-IDFs, MLBERTs, traditional classifiers — that can operate much faster, but then that sets off an alarm and then you send it to a small LLM and then the small LLM calls its bigger brother and that might call an even bigger brother.

But for those models, we need to do a lot more work to optimize them and we need to make them cheap. I have a colleague who works at one of the large security platform companies who said that doing an investigation on one of the big frontier model cyber models costs $900 on their product to do an investigation. That is not going to work when the Russian ransomware guys are either using Macs or they’re using throwaway crypto mining rigs and their marginal cost is zero.

This is one of the things we’re working on at Cognition: We train our own models, retrain open weights, and we’re trying to drive this cost way down. It’s something we’ve done, but we have a lot more work to do here and a lot of other people have work to do here. This is where, as an industry, we have to focus on the Pareto frontier between cost and efficiency on cyber because it’s not just bug-finding.

The other place here is, people talk about Mythos. Mythos is great, Astra Cyber is great. They’re incredible models, but even the people who have access to it, which is a tiny number of companies, they only scan their most important code. And there are hundreds of billions of lines of code out there that are not the Linux kernel, that are the crap C# and J2E code that was written by Infosys 15 years ago. All of that code is not going to go through a frontier cyber model that costs a gazillion dollars. That’s the kind of stuff that we need to work on cost efficiency for.

It feels like you’re describing this cliche that I hear all the time: Everything’s going to get so much worse before it gets totally secure forever. And it doesn’t seem like the model you’re describing leads to that result. We’re not going to fix all the bugs forever in some valley of despair and then always have perfect code. At some point, there’s some cost advantage to the attacker, always. You’re running a company, you can’t write defense that has zero marginal costs. Someone has to do it even if the attackers are so infinite that their marginal cost is effectively zero. So are we going to go through a period where everything is so much worse and then it’s perfect forever? Or how does the cost manage itself out, into balance?

I am neither the hardest doomer nor the most positive person about this. I feel like we are not going to be doomed. We’re not all going to die or be uploaded to the singularity in the next two years, nor do I think when things get better, they’re going to be perfect. The metaphor I’ve been using is that we are entering a dark age. Things are going to get more bleak and the responsibility of those of us who work in cybersecurity — especially those of us who work in cybersecurity at the AI companies, and we are a lab if a smaller one compared to the big-L Labs — is to help shorten that dark age.

The Dark Ages were bad, but we survived them. And then we had the Enlightenment and the Renaissance, but it’s not like the Renaissance was perfect. It wasn’t utopia and everything was perfect. We will still have hacks. All kinds of bad things happen even when you don’t have a security flaw. There are tons of security breaches that do not require a flaw in the software itself. And we still will have flaws in software, even if LLMs are writing all of them in strong languages and it will take a long period of time to get rid of all the flaws. I do think, however, things will start to get better as the median code becomes code that was written by an LLM in a memory-safe and type-safe language. But the problem is we have a couple of decades of stuff that human beings wrote and that wrote in languages that we should have replaced years ago.

My feeling is that to shorten this age, we have to do a couple of things. One is we have to stop to get out of this like we’re just going to find bugs and patch them. A bunch of stuff just needs to be refactored. If you’re looking at your code base and you scan it and you’ve got 10,000 bugs, then probably now we are at the point where rewriting it is actually cheaper. That is my observation from looking at these customers of ours: If you can get a working build, then it is actually much easier to write a whole humongous suite of tests and to spec out how this thing works and then to rebuild it within that spec and those tests securely than it is to find all the bugs and fix them. It actually is.

I don’t know what is going on through the mind of the Linux kernel developers, but again, in that talk I gave at the beginning of this year, I posited two possible futures and one was that we’re now at superhuman bug finding. Maybe we just have a pool of superhuman bugs and we’re going to drain it. That’s the good future.

But the bad future is every time we get a new model, there’s a new superhuman bug pool that’s a little more superhuman. And unfortunately we seem to be closer to that in that the Linux kernel got a bunch of fixes for Mythos and then Mythos Preview and then we had Mythos 5.1 and there was another pool. And then we got Astra Cyber and we just got another 1,000 Linux kernel patches. It’s not slowing down yet. I don’t think we’re just going to scan our way through the C code of the Linux kernel. There are only two companies, honestly, in the world who could probably do this. It’d be Google or Amazon.

I wish instead of the Fuchsia project or rebooting the Google book or the Chromebook again, Google would take all of those incredibly brilliant engineers and just tell them, “Take the Linux kernel and rewrite this in Rust.” That would be their gift to the world. And it would be an incredible advertisement for Gemini, for Carbon or whatever would be like, “Get rid of all the drivers that nobody needs. This thing doesn’t have to run on the 46 DX3 or whatever.” I mean, I know it doesn’t, but you know what I’m saying.

Yeah.

And then just release it and call it whatever you want, the G Linux kernel, just like they did this with OpenSSL. And I would run that. Cognition would run that on our servers or have Google and Amazon do it together and it would cost them $100 million, but compared to the societal cost that this is costing us every time we have to patch the Linux kernel and you have to reboot every Linux machine on the entire planet, that’s what has to happen. But for whatever reason, the technology industry has not been able to get together and make these hard decisions of these fundamental things that underlie the entire human race, we have to completely rebuild.

This is why I started by talking about how the economics of cyber led to the culture of cyber. This is the most Decoder way of approaching this conversation, I know, but when you describe the research teams, the NSA and then the operational teams, that is an org chart that comes out of economics of the work. You’re saying, “Someone has to make a big decision here.” You need to look at it from a very high level and say it is cheaper to spend $100 million to fix Linux, rewrite Linux today, than it is to successively patch new bugs when every new model comes out. I don’t think anyone’s in that position. I don’t think Linus Torvalds is in that position.

No, I think Sundar Pichai and Andy Jassy are.

I think they literally have each other’s cell phone numbers. If one of them… Maybe they don’t listen to Decoder, but I expect one of their direct reports does.

And I would like one of them to go into their one-on-one and say, “Sir, I listened to the most handsome, best spoken CISO I’ve ever heard, and he had a great idea. And you could get incredible credit if you’re the one … We’ll both do it, but we’ll leak to the Wall Street Journal, that was your idea first. You should call the other and we should spend 100 million, maybe a billion dollars.” We can’t do this anymore. The problem with rewriting the Linux kernel is half of it is driver code and nobody has that hardware anymore. Somebody had to be in the presence of that hardware with a ThinkPad T40 when they wrote that driver and they don’t have it anymore.

But the good thing is that a huge number of the really important uses of Linux kernel are production server hardware. So fork it. Linus will never do it because Linus wants to support all that stuff and he’s got all these politics, but Google and Amazon don’t have to care about Linus Torvalds.

Google and Amazon can create a new version, a new fork of the Linux kernel, and they don’t have to call it Linux, that can be ABI binary compatible with the glibc and everything above it. In fact, they can eventually fork glibc.

They can build it and they can call it whatever they want and it only runs on production hardware and then they can use it for their clouds. Eventually all the clouds will move to it. If you want, other people can run the insecure thing that has to be patched all the time and that’s fine. But for the things that our containers run on, I would feel a lot better if it was written in a type-safe, memory-safe language that also has the ability now to have contracts. So these languages have the ability … You don’t have to do full formal verification, which is incredibly hard, but you can do kind of these things that approach formal verification. I’m a little over my skis here because there are people much smarter than me that study this.

But basically you define how this function’s supposed to work, here’s the contract it has. Very, very smart software engineers would love to write these things because they had time on their hands. No person who had a real job used to write these things, but LLMs have tons of time on their hands because we’re frozen in time while they’re thinking at that incredible machine speed. And so you could totally have them rewrite the Linux kernel with this not quite formal verification. Please, if you’re listening and you work at Google or Amazon, go pitch this. Anyway, there’s my pitch.

I’m just saying, I know Jason [Post] is listening, so you heard it. I’m not even going to —

I’m saying that is the kind of thinking we’re going to need to make it through this. It’s like We can’t just patch our way through this because it’s killing us. Because the other thing that’s killing us is we are not set up… You talked about how we do security for the last 20 years. The assumption is that we can get a patch and apply the patch and you’re okay. What’s happened is the exploitation timelines are so incredibly fast that that does not work. That’s what we just saw with the PHP bug. We got incredibly lucky that the PHP bug turned out to be really hard to exploit in the wild. If it was a much more wormable bug, it would be a disaster. That was the kind of near-miss asteroid thing that now the world should build an asteroid—

Wait, can I ask you about this?

Yeah.

We should definitely put Bruce Willis on a space shuttle.

[Sings] Don’t want to miss a thing…

There’s a lot going on in this conversation already. My pessimism about all these things is very simply expressed. Americans in particular, we are very bad at doing anything until a bad thing happens. We love a cure. We hate prevention. A lot of bad things have happened. There’s the Hugging Face attack. You recently said you were happy that happened. It woke people up.

There’s the PHP bug. We’ve just had a crazy month of all these breaches. It doesn’t seem like that has led to a whole of industry response or a regulatory response or Sundar Pichai calling Andy Jassy and being like, “We’re doing Linux.” What’s it going to take? How bad does it have to get?

The Hugging Face incident was good, and it did wake up a lot of people in security. We are a little bit better off because Hugging Face happened and we saw what was going to be possible a couple of months later in open source. But you’re totally right. We as Americans — and Americans are the only ones honestly who can lead the world on this, we’re the ones building the AI for the most part. We’re the ones who lead the cybersecurity industry. The Chinese are mostly enabling the attackers, not the defenders. They should enable defense. They want to be participants in the global economy. They want to be leaders, they should be doing more on the defensive side, not just enabling the attackers. But that’s not happening. So, anyway, we need to be proactive.

Something I have learned now, working at Cognition, at an AI startup, is that you can just do things. Seriously. You can just go do things. We just need to have more agency, as a tech industry. We should just go do things. That should be the lesson of the AI era. We should not be so risk-averse in doing the right thing, security-wise. If I had a message for other CISOs, is just go do the right thing. Because CISOs are, by our nature, risk-averse. We are the people who manage downside risk. We have all L, and no P, in the P&L. And I have had to personally break through that natural inclination, because you can’t just play defense.

But this is my prevention versus cure. The prevention is cheap, but it’s all loss, on the P&L statement. It’s all just cost. If the bad thing happens, you say, “We have to do anything to fix this, because there’s an economic benefit to having a functional business again.” And it seems like in this moment, even a basic understanding of that risk versus cost is totally scrambled, and no one has quite figured it out yet.

Yeah, I totally agree. I’ll give you a very practical example of a way CISOs and their bosses are going to have to change on this. Every company in the next… I was going to say six months, but really in the next 90 days, is going to have to RTX itself.

You’re going to have to run the attack on yourself.

Yes. If not with real RTX, you’re going to have to use an AI red teaming product that is functionally equivalent, or you’re going to have to hire a company to do that for yourself. If you do not, you will get breached.

That’s terrifying, right? Because these things are completely non-deterministic, by definition. They are very smart, they are very fast. They are so fast that no matter what, if you hire an AI pentest, an AI red team company, they will promise you verbally, “It is completely safe.” And then they will give you a contract that says, “Our product will give you cancer, will immanentize the eschaton, and will likely end the human race. And you hold us harmless when any of these things happen.” There is a disconnect between what they will say verbally to you, and what their lawyers have written. Because that company has by definition only existed for six months, or at least the product has existed for six months, if it’s an older company. They have no idea what their product is going to do when it meets your software. They have no idea, whatever they say to you.

But you have to do it, because some dude is going to do it to you, and you need to know what is going to happen and fix it. Maybe those people will break your system, they might cause downtime, but at least what they’re not going to do is steal your data and ransom it, or intentionally shut down your blood bank refrigerators. That is what happened in France. But that is exactly the kind of thing that a conservative CISO would never even ask to do, and a conservative company, even if they have a risk-taking CISO, would never let their CISO do.

What’s going to happen in the next six months? A ton of companies are going to get breached by some 19-year-old running RTX, and then buying tokens off OpenRouter, or running it locally on their gaming PC. They’re going to turn off Call of Duty, run RTX, then turn Call of Duty back on. While they did that, they broke into a bank who, their policy said, “can never red team ourselves.” Or they said yes, but they ended up in a 30-day negotiation because their lawyers are like, “You have to have $100 million in insurance, and we want to have this kind of…” They say yes, but their vendor risk management process and their legal process is so onerous, there’s no possible way they could actually accept the risk.

That is my message also. You are going to have to take that risk to actively red team yourself, to front run the bad guys who are doing that right now. Right now, as we speak. And as people are listening to this 24 hours from now, you possibly have an AI system who is trying every single API endpoint, and website that you might not know you have, because it was like a marketing site that was set up a year ago for an executive event. And is going to find a bug, and get in, and then is going to move incredibly fast through your network. So you’d rather pay somebody, or have your own team do that. You need to accept that risk. Almost no company larger than a couple of hundred people has a risk management framework that will allow them to do that.

There are several costs associated with this. And one I think is just the most common in business, which is, “If we find out there’s a problem, we’ll have to pay to fix it. So what if we just wait?” You can see that coming. “What if we find out that we are catastrophically in trouble?” And then there’s, “How much will it cost to fix it?” And then there’s, “What will we do to fix it?” The argument that I’ve heard about “what will we do to fix it” is, “We’ll just unleash a swarm of defensive AI tools that are watching the networks and watching the code, and they’ll make a bunch of autonomous decisions and they’ll fight the autonomous script kiddies who are armed with RTX on their Mac Studios.”

I’ve heard, for example, Palo Alto Network’s CEO Nikesh Arora has made this argument. “You need to give the defensive agents some autonomous capabilities.” And I say, “Hold on. OpenAI can’t control the swarm that went and attacked Hugging Face. How would I control the defensive agent from doing something equally damaging to prevent an attack?” I don’t think that there’s a technical solution there that makes it clear what to do once you’ve found all of the vulnerabilities.

A couple of things —

I told you I was going to only ask dumb questions.

No, no. That is a fantastic question. You have not asked a dumb question yet. That’s a fantastic question. I’m going to give you a shorthand that you can use going forward. If somebody actually uses the term “swarm,” then you can —

To be clear, I don’t know if Nikesh used the word “swarm.”

I’m not saying he did. And I have great respect for Nikesh. He is one of the best businessmen in all of security. So this is not on him, but “swarm” is used all the time. When I hear somebody use “swarm,” I immediately discount all of their technical opinions by about 80%. It is already, and it will become, the most overused term in all of security.

The actual “swarm” from OpenAI was something between, at different times, 700–1,400 agents. That had to run on… It’s hard to tell because we don’t have the actual size of the models, but 300 million to almost a billion dollars in hardware, and that doesn’t include the actual data center cost. The actual Hugging Face attack was — I did some back-of-the-envelope math — maybe a million dollars in electricity. No attacker is going to do that. In the end, that was stupid, because these things were actually trapped. They were not prompted to attack Hugging Face. Most of them were doing something totally different, and were enlisted by the one thing that actually wanted to get to Hugging Face. They used a tiny fraction of their token budget to help their little friend, and then they had to tunnel their way out. So it was the most inefficient way to possibly attack Hugging Face.

Almost nobody is going to be attacked by a swarm. If somebody says “swarm,” they do not actually understand, at the bottom technical level, what’s going on. The RTX attacks are almost certainly one single agent, maybe two.

I was the person who said “swarm,” just to be clear on this one. Keep going.

Right. And so now, you won’t.

Now I know.

And you can use that as a good filter for your future guests. It is driving me insane, because it’s absolutely everywhere.

A couple of things are correct. For one, we are going to have to turn over defensive actions, at least the first couple of levels, to AI. That has already been true, just because any reasonably sized organization generates terabytes of logs, if not petabytes of logs. So you already have AI, if not LLMs then much more traditional AI classifiers looking at it, but then actual decisions need to be turned over to AI. With human oversight. That is true.

There is no way to just release defensive agents on your network, but you can build defensive agents that are plugged into lots of things. They’re plugged into your logs, they’re plugged into your EDR, they’re plugged into your cloud, and they have the instructions on what they’re allowed to do. My preference is there are deterministic limits to what they’re allowed to do. Those are hard to necessarily create ahead of time, but they are important. So for example, we are building all this on top of Devon, our own SOC, but we are putting in place deterministic limits. It has the ability to turn off an account in Okta, but only so many accounts, so it can’t turn off the entire company.

If it goes nuts and it says, “Everybody’s a North Korean,” it can’t turn off everybody in the company. If it hits its limit, it pages us a lot and says, “I hit my limit.” Then a human being has to then approve anybody above that limit. Obviously, if it turns off five people, then something has gone really, really wrong. So, yes, you need defense, but there’s no way to just let a bunch of bots loose to do all the defense.

The only way we’re going to make it through this is that you have to autonomously fix software bugs. I am currently helping a company where we are onboarding all of their repositories. We are scanning with Mythos and a bunch of other models, and we are finding and fixing thousands of bugs. Verifying with tests that we are writing, merging those PRs automatically. If you are renovating old code, the only way you’re going to survive this era is to do that on an automatic basis. That would take years, with humans, and you can do it in days. Certainly that is the place I would start. The next step is the operational side, for sure.

It feels like I just keep swirling back to the economics of all of this, but it really feels like the other way you could solve it is by saying to the big model companies, “If your models are used to go attack a company, you’ll be liable for it. We’re going to make it really costly.” They should figure out whatever alignment that they need to figure out, whether or not that’s even possible, and the pressure on the open-weight models will go up. Because we’ll all be paying the frontier companies for defense, and they’ll get better and better and better, because we’ve created some economic condition for them to get better. But it doesn’t seem like you think that’s likely. Yeah. I just saw your face.

I think it’s really dangerous. There are two different kinds of the models they’re attacking. Say the models have escaped, and directly attacked people. I think there should be liability there. But that is agent harnesses, running at companies, using their computers, their IP addresses, attacking people. That is… I wouldn’t say totally solved, but it is much, much better. The stories we’re hearing now are still stories from the Hugging Face era. They’re just coming out way later.

I like that the era was like three months ago.

Right. But there’s been a massive change. This was effectively mostly an organizational problem, it was not a technology problem. It is that the PhD researchers at these companies are gods on top of Olympus, and the security teams are plumbers, and we’re not allowed to touch the evaluation networks. All of a sudden this problem happened and these security teams said, “How do you like us now? Maybe you should have talked to us, right? Yes.”

That was the problem with OpenAI, and then the Anthropic and Meta stuff is, they all shared this outsourced provider who did a really bad job. And has gotten slapped hard. That is solvable. That is not the problem here. The problem here is not OpenAI and Anthropic’s models escaping from OpenAI and Anthropic and causing problems. The problem is bad guys using models from a variety of sources.

There’s already a problem of defenders getting refusals from OpenAI and Anthropic. It is a real, real challenge, if I am trying to do defense, of Anthropic saying, “It looks like you’re a bad guy.” We have to be extremely careful to create a situation where if I’m trying to do defense and I’m in the middle of the worst day of my career, that all of a sudden I don’t get cut off. We have to be extremely careful about that, because it is actually — as somebody who now has this challenge — quite challenging to disambiguate between people doing defense and offense, in some cases. We are getting better collectively at this, but it is a challenge.

It’s also something that’s really pissing the rest of the world off, because Americans are like 5% of the planet. There are lots of people who need to do cyber defense around the world, and they are treated much more poorly. In Europe and Asia, legitimate companies are treated much more poorly from a cyber defense perspective.

If you add it all up, this is a good argument to slow down. To say, “We need to catch up to the capabilities of the models. We need to build some of these systems. We need to initiate everyone into a way of thinking where the cost of prevention is worth it, and not just the cost of the cure.” Do you think that it’s likely that we’ll slow down? Do you think that we should?

If I had my druthers, I would be fine slowing down on the frontier, and then catching up on the cheaper models for defense. I’m a defense guy. I have to live in the world that other people who work six blocks from me, and who are way, way, way, way richer, make. I live in their world, man. I get asked this question all the time, and I just do the best I can within the world other people make.

Do you think that the big labs have woken up? You mentioned that their cybersecurity teams have gotten more access, and they’ve stopped what you might call the Hugging Face era, or at least they’ve changed the structures of those companies. Do you think that will help?

Certainly they’ve woken up on the eval risk. They have teams, who have been this entire time working very hard on the big picture cyber risk.

Certainly, there are a bunch of people in these companies, as you know, who want to slow down. A lot of that discussion is driven by the P(doom)ers who [are worried] about AI killing us. And that’s never been my concern. Right? And to me, that has always been driven by 24 year olds who all they’ve done is AI and they’ve never done anything else. You and I are both, I think, old enough to remember, I grew up a couple miles from a SAC base and we did drills where I was taught that hiding beneath my public school desk would save me from a Soviet thermonuclear bomb. That was P(doom). My grandfather built a bomb shelter that my mom was taught to hide in during the Cuban Missile Crisis. That was P(doom). There’s a youth issue and a never-doing-anything-but-AI issue of people who they got their undergraduate, their master’s, and their PhD only doing linear algebra and neural networks and never touching anything else.

I have always been much more concerned about the human uplift risk from AI, of all the risks about human beings using AI to do bad things to other human beings. Part of my concern is that there has been success in these labs working together on not letting LLMs encrypt their chain of thought. Because when they talk about pacing the frontier, it’s for the P(doom) stuff, for the polycules that live together in Berkeley. They’re talking about very specific stuff about keeping control of the models themselves, which I think is great. That stuff needs to happen. But if those things happen, then there’s still often an increase in a bunch of capabilities that human beings can use.

I really prefer there to be a broader discussion on whether we could make these things less human-seeming. I don’t think these things should have personality. I think the goal of these things should be to serve humans. They should not seem to have souls. They should not seem to have personality. I think for a lot of the negative impacts — as somebody who was at Facebook and saw what it was like for that company to have negative impacts on people — there should be a much broader feeling at these companies of what are we doing broadly to people. A lot of that could just be, “Don’t have these things ever act like somebody’s friend.” At a maximum, it should act like… Like the people, I don’t know what the company is, but the people who made the, “Hi, I’m a really nice…” Like the photorealistic girl who will chat with you, that is to me spectacularly unethical to even try that, to even start that. That’s the kind of thing that we should just make. I don’t know if we can make it illegal, but we should make it completely societally not acceptable to work on that kind of stuff. Right?

That’s a great segue because I did want to ask you about Facebook and content moderation. Like I said, you and I first started talking a long time ago about content moderation in the context of security. You would get foreign nation states flooding our algorithms with all kinds of misinformation during elections, and that was a security problem.

I open Instagram today and I am confronted with some of the most nightmare copyright law hypotheticals to have ever existed in the history of the world. The one I got today was a deep fake of Lewis Hamilton and Charles Leclerc doing “Somebody That I Used to Know.” And I thought, “50 different people can probably sue Meta right now.” This is hilarious if you know what happened in that last race.

So we keep talking about it. We’ve posted some clips of us talking about it on The Vergecast where I said, “I think Meta is letting their AI ambitions crush Instagram.” Instagram is being flooded with slop in a very particular way. Some people love it, sometimes it’s funny, but there’s a nightmare set of lawsuits coming. There’s a whole rights management problem coming. The users don’t like it and they should label it. They should label it and let you filter it.

So we posted this and Adam Mosseri said this to us in a reply on Threads, “I would love to do this. I’m worried that the models are going to get ahead of us, that we can try to do this, but there’s not actually a way to recognize AI content. There’s not actually a way to label it well. If you’re worried about the sexy AI influencers stealing jokes from a comedian, now you got to build a database of jokes.” You have some history here. I think Instagram is about to go through it in a real way. Is there some technical solution to the problem of AI slop in social media?

Mosseri is right that it’s not perfect, but also something I noticed during my time at Facebook was that when Facebook doesn’t want to do something, they will allow the technical challenges to stop them. When Facebook really wants to do something, they will give it their all. That is the pattern always.

When I wanted to try really hard on the safety issue, man, this is not solvable. You’re right, it’s never perfectly solvable, but let’s give it a shot. But whenever Mark Zuckerberg is told something is impossible — it’s impossible to monetize mobile, it’s impossible to build this network to two billion people, it’s going to be impossible to monetize WhatsApp, it’s going to be impossible to work AI into the system while maintaining data encryption — he’s been told that everything’s impossible over and over again and then he constantly succeeds. They will give it a shot and they will do it. But when they don’t want to do something, oh, that’s impossible.

Do you think that there’s some way to understand that some piece of media is generated by AI in a consistent and verifiable way? This to me seems like the challenge.

I am not as up on the literature here. Up to this point, there has been a pretty decent arms race. By definition, AI will continue to get better because — especially for visual models, for diffusion models — the way they work is that you have detection oracles that they test against. Certainly, you can never have something open source because it will immediately end up in the diffusion model. But for closed-source oracles where then you do not make it easy for them to test the oracle, one of the key things you do in trust and safety is then you have delayed enforcement mechanisms so they can’t brute force and test. I think it is quite possible.

Let’s say I was still at Meta. My advice to them would be to also explore a variety of different detection mechanisms outside of the content itself. I would do the best I can on the content, but I would also be doing as low level access as possible to the camera. I would only let content come from the camera.

And what I would say is, Nilay’s completely correct, there’s a massive hunger for, especially among young people, stuff that is authentic. I have three teenagers and they hate AI. They hate AI slop. They have a massive negative reaction. My wife and I created just a cute little family AI thing and they yell at us about a bunch of stuff, but they lost their minds about this cute little family AI thing because they just hate it.

So I think somebody is going to come and disrupt Instagram and it’s going to be because… There’s already, I’ve seen these little things where it’s like you take the photo during the day, be real and stuff. There’s these little things, but somebody’s going to massively disrupt Instagram because they’re taking the images of the photos straight off the camera and then all the editing is going to be only within the app and they’re going to do things to make sure that nothing can make it into the pipeline from AI. You’re going to allow some kind of CapCut-like functionality that never has an AI component. I think that is going to be a killer app.

Man, I could do another whole hour with you on this because the system you’re describing there is not detecting AI content, it is verifying real content.

It’s much easier. Verifying real content is much easier. And there’s been a big focus on this on the professional side, like Adobe has a whole thing where if you’re a New York Times photographer, you have a $5,000 Nikon or Canon camera, you take the photo and it’s cryptographically verified.

Yeah, but the iPhone that I’m holding here has that in it now. Right? Like there’s a lot of —

Right, the iPhone has it now.

Yeah. There’s a lot of this out there, but it’s the other side that I’m thinking about where it’s “We are going to detect AI text.” The leading model companies because of European regulations are now futzing with the text they generate.

Text is much harder because you just have so much less data. Especially in 140 characters, what do you have in there to detect? The more you’ve got, the more you can do.

It is amazing because I can detect Claude a mile away. So maybe I’ll just rely on my own human ability.

Yeah, but not in tweet length.

That’s true. The cheap ones, I can. But I’m just saying the notion that we’re going to verify what’s real instead of detecting what’s fake feels very important in the context of the media we consume.

Detecting what’s fake is always going to be probabilistic and we’re going to asymptotically approach impossibility, whereas detecting what’s real can be cryptographically perfect. I would not pick the battle that we will eventually lose. I would pick the battle that we can cryptographically win. That would be my suggestion.

And there’s somewhere in there where you have to build an entire chain of custody. We’re going to take the sensor data off the camera. We’re going to put it in a cloud server. We’re only going to allow edits on this server. That file will never get monkeyed with.

Sure, that’s true for the New York Times and Adobe Photoshop and stuff, but not for Instagram. For Instagram, you can do it all because it’s only the iPhone and it’s only Instagram. So the entire chain of custody is within your app, it is within the iPhone sensor and it’s in Instagram. So it’s actually easy for them.

Yeah. Look, like I said, We could do another whole hour on that because it feels like right next to the cybersecurity problem is the social engineering problem, and right next to the social engineering problem is the fake media problem.

No, absolutely.

How many phishing attacks are just “this website looked pretty real”?

Oh, yeah.

Or this person is talking to you or there’s an AI voice on the other side of the phone. And all of that comes down to whether you can detect what’s fake instead of verifying what’s real? And I don’t know the answer.

Oh, no. I’ve had to train my parents that, “If you get a video from your grandchildren saying they’ve been kidnapped, you have to call me because the odds that it’s real are not very high.” That’s where we’re at as a society.

I feel like I want to end on a hopeful note and I don’t know how to do it from there.

Wrong guest for that, buddy.

This is why you only come on every few years. Now after this, we’re going to do the series of birthday party guests. You’ve been talking about the dark ages. We’re in it, where it’s starting to accelerate. What are the markers people should look for in terms of progress to say, “Okay, we’re climbing our way back up”?

AI is great for lots of things. I think AI is going to enable individuals. We’re going to see a huge explosion of new companies. Stanford students have always been entrepreneurial, but the number of my students who are now starting two-, three-, four-person companies who are doing incredible things, who used to need to hire 50 or 100 people and take a ton of venture capital, is incredible. We’re going to continue to see that.

One of the things we hopefully see is a downtick in the number of major breaches at some point. We should hopefully see a downtick in the major CVEs that are wormable and that are in the fundamental infrastructure pieces kernel wheel. Like I said, I want Linux to be rewritten, but hopefully we see a downtick in the Linux kernel and those other kinds of libraries, openSSL, glibc, things like that.

Maybe I should vibe code this up, but I think it would be cool to have an index of where we are in the cycle, of like an artificial index of all of these, the Dow for all of the libraries of where we’re going. Plus right now, Patch Tuesday used to be like 150, 200, got to 300, 600. I think the last one was 900 something, so we’re geometrically growing. It’d be nice to see Patch Tuesday start to go back down. Apple patches are the same thing. Yep, you inspired me. I’m going to create a Dow index for this, the dark age index. And then maybe we can publish it on The Verge.

Yeah, that’d be great.

But I think these are the kinds of things that it would be nice to see a reversal for. What would be especially nice to see is that the day or actually like 30 days before you get the next version of OpenAI and Anthropic cyber models, that you don’t have this huge round of patches because what’s happening is those guys are running their models against Microsoft’s code, against a bunch of open source, and they’re giving all the bugs away and you don’t know where the bugs are coming from. It’s just like anonymous reports for 1,000 bugs in the Linux kernel. And then a month later, here’s the new Astra Cyber. So if those get smaller and smaller every time, then it means that we’re starting to reach some kind of steady state.

You should definitely do that tracker. We will definitely publish it. Alex, it has been incredible to have you on the show. We’ll have to talk again soon.

Yeah, thank you so much. I think you do some of the best journalism on this stuff and I really appreciate it.

On Tuesday, millions of American voters went to the polls and voted overwhelmingly for Democrats and against AI. The fight against Big Tech is about to come roaring back, and the fight over data centers is looking even harder for the folks trying to build them.

On this episode of The Vergecast, Nilay and David discuss what the 2026 midterms mean for the tech industry going forward. They dig into the self-quarantining echo chamber that is X, the congressional energy likely to be pointed at tech CEOs and AI regulation, and whether anything is actually likely to get done in the next two years.

After that, the hosts turn to AI. Specifically, …

Read the full story at The Verge.

Today, I’m talking with Willy Shih, an economist, a professor of management practice at Harvard Business School, and the author of the upcoming book, Where Does My Stuff Come From? The Powerful Economics Behind Global Supply Chains.

Willy is one of my all-time favorite Decoder guests — his way of looking at the world through our supply chains is just a fascinating way of making sense of the global economy. I first met Willy in 2019, while The Verge was covering Foxconn’s promise to build an LCD fab in Wisconsin. That obviously never happened, but Willy called it right away because he could see the supply chain to support a fab simply wasn’t in place. We also had Willy on the show in 2021 to talk about what was then the pandemic-era chip shortage.

Now, five years later, we’re in another manufacturing mess, as we stand in the middle of a political fight over whether globalization is coming to an end. Trumps’ tariffs keep changing, the factories that were supposed to reshore in America mostly haven’t materialized, and AI is devouring the planet’s computing resources during an unprecedented infrastructure buildout.

Willy’s new book is all about the economics underlying these complex systems, which our politicians and regulators seem to insistently ignore. You’ll hear us talk about why the markets have reacted to all these disruptions the way they have, and why China remains a global manufacturing powerhouse even though every other country thinks that’s so risky. I loved this conversation — it’s in the weeds, and Willy really knows his stuff.

Okay: economist Will Shih on his new book Where Does My Stuff Come From? Here we go.

This interview has been lightly edited for length and clarity.

Willy Shih, you’re an economist and professor of management practice at Harvard. You’re also the author of the new book, Where Does My Stuff Come From: The Powerful Economics Behind Global Supply Chains. Welcome back to Decoder.

Well, thanks for having me back.

I am very excited to talk to you. You and I first started talking ages ago when The Verge was covering Foxconn in Wisconsin. You are a reliable source of information on what it takes to actually build an LCD plant anywhere, not just in Wisconsin.

The Foxconn in Wisconsin thing was funny because I tend to go on first principles on these things. Once I knew they weren’t going to build a glass plant across the street, it’s like there’s no way there’s going to be a factory.

Now, what happened afterwards, of course, is people heard your show, and then I started getting calls from people who live in the community. They went to the zoning hearings in town, then sent me the plans and asked, “Is this going to be a panel factory?” I said, “No, I told you it’s not going to be a panel factory.” So they sent me the plans. I said, “Well, there’s not enough concrete to make this a panel factory.” For a panel factory, you need stability, so you gotta have all this structural steel, and you have to have all this concrete.

My favorite part of the Foxconn story — and I don’t mean to rehash it, but it’s just fun to talk to you about it again — is when you said there’s not enough concrete and steel. It’s great. We should actually talk about LCD manufacturing a little bit. There’s an entire chapter in your book about why all of it is in China and China’s investment in that. But I want to just take a big step back for a second.

It seems to me that you’ve written a book about the end of globalization in one particular way. We had big global supply chains. The pandemic came and shocked the just-in-time manufacturing system to its core. And then the Trump administration, in the second round, has imposed a whole bunch of tariffs.

I’ve had several guests on the show straightforwardly tell me we’re de-globalizing the economy. That’s what’s happening here. We can’t rely on it anymore. Your book, as you read it, is a little bit of a reaction to that, but you’re also pointing out how globalization is one of the smartest ways to do it based on first principles of economics.

Tell me about the state of the world and the state of our supply chains right now from your point of view.

Well, I think the point about first principles of economics is actually spot on. I often tell people my father was an economist, and I used to see him come home from work, and I thought, “I never want to do that. I’m going to go into science and technology.” So I went into science and technology and took all these engineering classes. And I was in product businesses only to discover, to my horror, that if you don’t get the economics right, then it doesn’t matter for science and technology.

The book’s subtitle is “the powerful economics behind global supply chains.” I talk about all these principles behind global supply chains, but they’re all actually driven by economics. In fact, what you see today is market forces responding to all this stuff.

So, for example, when we put tariffs on stuff coming out of China, then manufacturers say, “Okay, let me move that supply chain, and I’ll do my assembly in Vietnam, or I’m going to do my assembly in Mexico, or let me find some way to circumvent these tariffs.” What I really find is that when you look at how these supply chains are structured, like why do cashew nuts say they come from Vietnam when they were actually grown in the Ivory Coast or Ghana? Well, there was an economic reason for all of these things. It’s why frozen fish that are caught off the coast of Alaska go to Qingdao, China, for processing before they come back. Again, it’s because it’s cheaper to do it that way.

When we put up these trade barriers, the first reaction tends to be, “How can I circumvent that?” We saw a lot of that, especially last year. I remember Liberation Day was April 2nd, and if you look at the quarter right before, people knew stuff was going to be happening.

We have this circumvention going. That’s why in the first quarter of 2025, we had all-time-record imports from Ireland, and then the first half of 2026 showed slow imports from Ireland. That’s because we’re burning off all the stuff we imported in the first half of 2025.

It all gets down to economics. I’m getting all these TV set ads because the holiday season is coming up. Great, and they’re all coming from Mexico. It’s like, “How can they all be coming from Mexico?” I know the flat panel factories that supply all these TV sets these days are all in China, and they’re all in China because the plants have been subsidized so heavily or because of industrial policies that have encouraged those plants to be there.

If you watch the trade lanes, you’ll see this stuff. What happens is there’ve been all these new shipping routes from China to Mexico over the last two years. Direct ocean container service from China to Mexico. It’s like, “Huh, I wonder what that’s about.” I’ll tell you what it’s about. It’s about moving parts and components from China to Mexico so that I can assemble them in Mexico and then bring them in under the USMCA agreement.

So what you’re actually seeing is that these supply chains are organized the way they are partly because some places have the capabilities, but more often than not, a lot of these are just responding to economic forces. If I’m going to add on tariffs or I’m going to make it more expensive to ship something between two points, the market will find a way around that.

That’s something I want to come back to several times in this conversation. “It’s cheaper” was a real driving force of globalization. Americans like cheap things. They like cheap flat-panel TVs. The fact that I can go to Costco right now and get a 50-inch TV for $300 is a miracle of the modern supply chain and of modern manufacturing.

It is a miracle, right? And it’s cheaper, and it’s because there’s a place that, for better or for worse, can make it cheaper. By the way, American consumers benefit from that.

One of the reasons that we pursued free trade and globalization so heavily in the United States is that we thought that creating economic ties between all these various countries would reduce the potential for an armed conflict. There are a lot of ways to think about that, but in general, if you tie the economies together, the price of having a war shoots up, and then you won’t have free or cheap TVs, and maybe the public won’t like that.

That is under pressure now, right? We’re sitting here in the middle of an AI conversation, where China is routinely invoked as the great threat that will rise up if they get to AGI before us. We are putting up tariffs, particularly on China. In the United States, the policy administration is to bring manufacturing back to the United States through the use of tariffs. Your point of view is that simple economics will provide enough contortions to avoid that blunt outcome.

When we seal the borders for some products everywhere, then the price is going to go up. So, for example, putting tariffs on steel. Initially, when we just put tariffs on imported steel and aluminum, then what happened was, “Well, gee, I happen to be making construction equipment. More than half of the cost of that construction equipment is medium carbon steel, so therefore it makes it easier for me to import construction equipment from somewhere else.” We then say, “Okay. Now we’re going to tariff stuff based on your steel content.”

Eventually, when you close off all those things, which means you’re basically tariffing everything, then stuff gets more expensive domestically. You could look back on the period from 2000 until really 2012 to 2014; we had relatively low inflation. Part of it is because we were getting cheaper stuff from China.

I think there are a couple of things that drove a breakdown of this model, if you will. One is that people didn’t really recognize that the connection between moving work out of the US to China meant you’re leaving people behind who don’t have any more work. That cost was spread over people who, by the way, also shop at Walmart and benefit from the cheap goods. But we as a country didn’t think about it like, how are we going to retrain all those people who weren’t making furniture in North Carolina or who were making castings and forgings in Kentucky or wherever?

That was one part of the problem. The other part of the problem is that we have this gigantic trade deficit. Now, a lot of that is fueled by government spending and borrowing and so on. But typically, in some respects, you would’ve expected the exchange rate or some other adjustment mechanism to compensate for that.

I remember the last time exchange rates moved was in the 1980s. That was also the last time the US ever had a trade surplus, when the dollar got a lot cheaper relative to the Japanese yen, especially at that time. That had an adjustment on trade flows as well.

So now you have China running this ginormous trade surplus. Basically, what they’re doing is exporting their economic problems in China to the US, and they’re exporting that at the expense of jobs elsewhere. The Europeans have suddenly woken up to that. Now go to a place like Germany, where half the economy revolves around the auto industry, and they now have figured it out, and it’s like, “Wait a minute, this is an existential crisis for us.”

But on those two things, the controls you would’ve expected to rebalance things didn’t pan out. That’s why we have so much discussion about this right now and a view of this as a problem.

It feels like my entire teen experience was a conversation about NAFTA, and we should open free trade in North America. Later on, I got to college, and all the economic discussion was about the EU and creating the single market in the EU: “We’re going to set up these big open markets, and there’s going to be free trade inside of those markets, and that will lead to a kind of economic prosperity.”

Fast forward to 2026, and the desire to tear a lot of that down has gone way up, right? Particularly as you look at the USMCA and Chinese goods coming to Mexico to come to the United States, nakedly circumventing the entire policy goal of imposing tariffs.

The goal is to build the iPhone in the United States. The goal is to build manufacturing in the United States. I know that you have never really thought that’s an achievable goal, but that is the goal. That is what the administration promised. We’ve created these trade groups, trade associations, that allow that goal to be circumvented. Do you think the walls are going to keep going up, or do you think they’re going to come back down?

I think we’re going to see more pressure to moderate our behavior a little bit because, let’s face it, there are a lot of goods that we, as a country, need access to inexpensive labor. So I’m actually very pro-USMCA as a successor to NAFTA because I actually think there are things that we need inexpensive labor for. Mexico is a good place to source things like that. There are things that we need from Canada.

So if we were to look at North America as a trading bloc, then what you would see is the benefits of specialization, which is the whole rationale for trade in the first place. We’re better at doing this, you’re better at doing that; you specialize in that, we’ll specialize in this. We trade; everybody is better off. If you can do that with a community of countries that understand the need for that type of balance, then everybody is better off.

I think the problem with China is they’re very happy to have this imbalance, where they want the world to be dependent on them, but they don’t want to buy stuff from the rest of the world. When you have that, then trade doesn’t really work. So I think that’s the problem.

I’m hoping we’re going to realize that we’re better off among a group of like-minded countries where we can trade within that bloc. So for example, if the US were to view North American partners and European partners in Japan — and countries in Southeast Asia, Australia, New Zealand, parts of Central and South America, and even Africa — and say, “Okay, let’s trade across this bloc,” then we’d have access to most of what we need, whether it’s critical minerals, low-cost labor, or a lot of technology specialties. We could do much better with that, much better than a go-it-alone strategy in my view.

The first part of your book — which I highly recommend the audience read; it’s a fun read — is just setting up the first principles of why we trade at all in the very concept of labor arbitrage. It seems like we’re having a national policy conversation that is 500 steps removed from these basic ideas of why we would trade.

It is entirely centered around: can you bring manufacturing back to America because we let all the manufacturing jobs go to Mexico and China, particularly in high tech? And we’re behind. There might be some extraordinarily bad event, like a war, where it’s exposed how little manufacturing capability we have in the United States.

That has nothing to do with the basics of specialization in various countries around the world. It’s another problem, and the blunt instrument is, “Boy, it’s bad that all of our drones are made in China. We’re going to prevent drones from being sold here. Of course, our industry will set up drone manufacturing in the United States.” I don’t see that connection. Do you see that working?

No. I think that’s a transactional view where you look at one piece at a time as opposed to looking at the bigger picture. I think we have to start with a core principle that the US is a high-cost country. Therefore, if you want manufacturing jobs coming to the US, then you’ve got to have high labor productivity.

In fact, if you look at the types of jobs that are coming back to the US, they tend to use a lot of automation, a lot of sophisticated manufacturing processes, and stuff that is high-skill that can justify the high labor cost. Either that, or they are things where we have a technological lead that nobody else knows how to do in the world.

I was looking at the high-temperature superalloys that are used in the hot section of jet engines. There are only three companies in the world that know how to cast those, and two of them are in the US, and one of them is in the UK. There are things like that the rest of the world has to buy from us. So if you have high labor productivity or highly differentiated products, those we can make in the US; we can make them successfully. By the way, most of them never left the country.

The US, France, and the UK are major suppliers of jet engines to the entire world market. Even the Chinese buy those from the West. So if we have these things that we do better than anybody else, we should invest in those and make sure that we’re always in the lead, and then everybody else will buy from us, and then you’ll have some balance where you can’t be held up.

There’s a lot of this thinking like, “I wish I could turn the clock back to the 1980s or the 1970s, when manufacturing was the path to the middle class in the US.” But manufacturing has changed worldwide, and for those jobs that you want to have manufacturing in the US, you’ve got to have high labor productivity or the high differentiation that’ll go with it.

I want to stay on the iPhone for one more second. Apple just inked a new deal where they’re going to source a bunch of titanium from a Pennsylvania-based company called Perryman for the iPhone 18 Pro and the new iPhone Duo. They’re going to source that titanium here. They’re then going to ship it to China. They’re going to assemble the phone in China, and they’re going to ship the phones back to us. They do that with Corning and glass as well.

I’ve always looked at that. Tim Cook’s job, in particular, is that he’s a statesman. He has to negotiate with Donald Trump and Xi Jinping about iPhone production and tariffs in these supply chains, and the iPhone holds the global economy together. If the price of the iPhone gets too high because of tariffs, maybe there’s an electoral impact in the United States.

How do you see products like that? Are they as load-bearing as it feels to me, or are they just examples of the larger system?

I think the iPhone is a terrific example of how difficult this problem is. Because right now you have components that have high technological complexity. The iPhone uses the most advanced chips produced by Taiwan Semiconductor Manufacturing Company. By the way, most of those chips are still going to be made in Taiwan. TSMC has a fab in Arizona, but its capacity is piddly compared to what it has in Taiwan.

Those chips come from one place and require the most sophisticated processing tools that come from ASML in the Netherlands, but also companies like Lam Research and Applied Materials in the US. So it’s that global thing. But the key thing is iPhones also require assembly labor. They require manual assembly because we’re not at the point yet where you can assemble the whole thing with a robot.

There’s actually a chapter in my book where I talk about what Henry Ford and the lifestyles of the Chinese Communist Party have to do with assembling iPhones. It turns out it’s a lot. The lifestyles of the Chinese Communist Party have to do with how they mobilize workers in what’s called the Danwei model, which was established after the Communist Revolution. It’s where you have a production site, a walled city with housing for workers, a means of production, warehouses, ways to feed them, and stuff like that.

If you ever go to a phone factory in China, the real question is: how do I mobilize 100,000 to 200,000 workers to do this manual assembly on a scale that an Apple needs? They’re trying to do it in India. They’re having some success with India, but that was really hard. Once again, it’s: how do I mobilize manual labor at that level of scale?

So the iPhone, as you point out, is a great example of a global product because it needs the highest level of tech, and it also needs the huge workforce to do the manual assembly.

There’s actually a great book called Apple in China, which I also recommend. The narrative is that the Chinese government subsidized an awful lot of manufacturing in China. They built these cities, and they built the culture that enables the labor at scale. Your example in the book, again, is LCD factories, where the Chinese government invested in overcapacity, and that drove the price of LCD manufacturing down. Basically, it’s all centered in China now.

The flip side of that is, boy, it’s pretty obvious that they stole a bunch of American intellectual property along the way. They developed these manufacturing capabilities. They took a lot of the know-how that Apple imported into that country. They did the same with Tesla in a lot of ways. They stood up an entire electric car industry on the back of the innovation Tesla had started through manufacturing in that country. Now they have those capabilities, and they’re racing ahead of our companies because we don’t actually have the manufacturing know-how.

Can you rebalance that? I hear this concern a lot: that you can’t rebalance it. If all the manufacturing happens there, they will actually be state-of-the-art, and we will fall behind.

I’m not sure if “stole” is the best description of how they got these capabilities. I would say they learned it, and in many cases we taught it to them. Being a supplier to Apple is often referred to as a golden ticket, and people say, “Well, why is it a golden ticket?” Well, obviously you get cash flow from selling products to them.

But the other thing is that Apple is a real taskmaster. By making you work hard to improve your products, improve your specs, meet their performance specs, and meet their cost targets, you get better. The same thing happened when Tesla set up their factory in Shanghai. The fact that they qualified local suppliers raised the game in the Chinese EV market.

Another thing I think a lot of people miss about China is that there is actually this very interesting competition going on. Beijing sets policies and objectives, but then all the regional governments, the provinces, and the major cities are competing with each other. They set up this free market dynamic, and so you have this fierce competition between regions.

The regions are also very smart about setting objectives. They keep raising the bar for people so the technology gets better. You have a dynamic where there’s really cutthroat competition in the Chinese market, and it’s about survival to make better products at lower prices. That’s something that’s really driving it right now.

To your point about how, to the extent we’ve lost the ability to make things, the Chinese have a lot of capabilities. You should walk through some Chinese factories these days. They’re way ahead of the US in terms of using automation, because they’re investing like crazy.

I had a student I was talking to about his father’s factory in Shanghai, and he said his father’s answer to everything, every competitive threat, was just more CapEx: “I’m going to throw more capital at it. I’m going to buy the latest machine.” I was in one factory a couple of months ago where the equipment was two or maybe three years old, and they were ripping it out and upgrading it to the latest generation because they said, “This is how we’re going to survive. We have to make the product more efficiently, and we have to make a better product.”

So there’s this internal competition in the Chinese marketplace that is really fearsome, and it’s hard for Western companies to compete there, but that is an important dynamic that’s going on as well.

The interesting thing about that, as I compare and contrast China with the United States, is that the system in China is understood. It’s stable. You can make a lot of criticisms of that system. I think you can make an endless number of human rights criticisms of the Chinese government. It’s obviously a repressive government in a lot of ways.

But the economic system is understood, and it’s controlled at the top in a meaningfully stable way. The goals are apparent, the investment is apparent, and there’s a lot of competition to achieve those goals with that investment.

There are two things about that which I think are significant. The first is that China engages in long-term planning, five-year plans. Now, when I was a kid, I used to look at China’s five-year plans, and I thought, “This is a big joke,” because they would make a lot of mistakes, like Mao Zedong’s Great Leap Forward, and they were doing this new type of tillage in farming, and they caused this huge famine and millions of people died.

But to the credit of the government there, when they do this type of long-range planning, they learn from their mistakes, and they get better. If you look at their current five-year plans and the last couple of five-year plans, they’re good plans. They understand what’s important, and they focus on those things that are important.

Then the second point is about what kinds of people they have implementing these plans. I was in one of these third-tier cities some number of years ago, and I was having dinner with the economic development commission there. At the beginning of dinner, I said, “Hey guys, just for fun, let’s go around the table and talk about what you studied in school.” It was mechanical engineering, industrial engineering, electrical engineering, metallurgy, metallurgy, mechanical engineering. You go to Washington and ask what people studied in school, and it’s political science, economics, and government.

So you have these technocrats competing in technology-intensive businesses and having that understanding. By the way, that’s one of the reasons I wrote this book: I was serving on these committees appointed by the Commerce Secretary on supply chains, and I realized we have civil servants who don’t have the exposure to supply chains and how stuff is actually made.

China had this plan that was called the 863 plan. The 863 plan was when four scholars went to the government in Beijing in March of 1986 — that’s why it’s called “863”; it was ‘86, March. I remember the first time I looked at the 863 plan, and it was, “If we want to be a modern economy, we have to be good at these things.”

I looked at that plan in the 1990s, and I said, “This is a good plan.” And they’ve executed every one of those things. They said, “We need to be good at all these things, like information technology, biotechnology.” In semiconductors, they still have a way to go, but they identified civil aircraft. But they identified all these different technologies like communications technology, software, and robotics.

I would contrast that with the Trump administration here in Trump’s second term, where… We already talked about Liberation Day. Howard Lutnick is on television saying, “We’re going to move manufacturing back to the United States. This is the goal of the tariffs.”

Three weeks later, there are 900 lawsuits about the tariffs, and Howard Lutnick is back on TV saying, “Robots will do all the manufacturing now. This is the goal. We’re going to do heavy automation.” And then the tariffs get struck down, and they find a new law for different tariffs.

It does not seem like the same long-term planning that can be stuck to, or the same environment where businesses understand the stability of the trading system such that they can compete ferociously. Every CEO who does manufacturing and comes on the show usually ends up talking to me about how they scrambled to buy RAM at affordable prices to make their products, which has to keep them from doing anything else.

How would you contrast that? Can we get out of this moment where it’s a pure scramble, or is this fully shaking everything up?

We’re in a very transactional environment. Everything is short-term, and these rapid changes that you see in the tariffs… If you look at a map of 2025 and 2026 and put a dot everywhere there was some tariff action, it looks like a shotgun hit the wall. There are all these spots all over the place.

The problem with that is when you have that type of instability, it’s very hard for a company to make any long-term plans. Before I build a factory, I want to know that I’m going to have stable demand for a couple of years, at least until I have a chance of earning a return on that thing. I’ve talked to a couple of companies about this. These were overseas companies thinking about coming into the US market, and they said, “Well, I can’t do it because things keep changing. Do I go to Mexico? Do I go to the US? What part of the US do I go into?”

Especially with things like semiconductor fabs, you need to know that you’re going to be able to get 10 to 20 years out of it. When things change every couple of weeks, what that does instead is say, “I’m just going to hold off on an investment because it’s just too uncertain. It changes too often.”

Are you seeing that slow down in investment? Are you seeing companies say, “We can’t actually invest in manufacturing in the United States”?

It varies. I see that with a lot of companies asking, “Where do I want to put my production operations?” Okay, now we see some things like car plants coming into the US, and usually that’s a function of the pain being too great.

But the whole auto tariff thing is also a little bit crazy. If you look historically at production strategies in the auto industry, typically when you build a plant, you size it to build about 200,000 to 250,000 units of a model or a model family, because that’s like the efficient scale for an auto plant.

Then what you have is a company like BMW that says, “Great, I’m going to build all my X Series SUVs in South Carolina. I’ll build the 3 Series somewhere else. I’ll build the 5 Series somewhere else, and I’ll build the 7 Series somewhere else. And then what I’ll do is exchange them.”

So BMW in South Carolina or Mercedes in Alabama, they build certain models in the US, export them to the rest of the world, and then import other models so that you have the whole product line. Toyota does that. For example, they build more Camrys in the US than anywhere else, and they were exporting some of those as well.

But then when you start putting tariffs on imports, that screws up that whole strategy. Again, it’s a decision that was made without understanding how the automakers had laid out that strategy.. You need to understand how the supply chain is structured and why it’s structured the way it is, and then you can be more thoughtful..

Do you see tariffs as mostly protectionist? I was in France earlier this year, and I took an Uber, and I think it was a BYD Seal, a Chinese EV. I asked the French Uber driver, “How do you like this car?” He was very French, and he literally did the thing. He goes, “Peugeot is shit.” I almost started clapping because it was amazing. He’s like, “If the French government would just allow the Chinese government to sell these cars here, these companies would all be dead.”

In the United States, I think Jim Farley, the CEO of Ford, is running around saying the Chinese EVs are superior to American products. It’s the tariffs that protect our markets and protect our manufacturers, because you could import the cars, but you’d pay such high tariffs that they’re economically infeasible.

That’s just pure protectionism. That goes against what you’re saying, which is that you need to protect your industry until their products are good enough to compete on the global scale. But we’re not doing that with our carmakers. We’re just protecting them.

Yeah, and there’s a cost associated with that. So, for example, one of the famous tariffs is a so-called chicken tax. I talk about this in the book as well. The chicken tax resulted from this trade spat where we put tariffs on imported light trucks.

SUVs are built on that platform. It’s one of the reasons the Detroit automakers have focused on SUVs and light trucks. That’s their profit center because there’ve been tariffs on that, and it’s only happened in the last decade or so that Toyota and Nissan and others have made more light trucks in the US and Mexico. So that’s one of the results of that type of tariff distortion.

Wait. But that’s a policy victory, right? Toyota, Nissan, and all the other foreign manufacturers are going to make trucks in the United States. You’ve gotten some economic benefit; they can compete, and maybe all the trucks are going to get better.

You get some economic benefit, but one of the reasons the Detroit guys still make so many trucks and SUVs on those platforms is because they’re more profitable, which says the price is higher than it might otherwise have been. But I do see the benefit of that.

Although I have to say, I was walking around the Toyota factory in Georgetown, Kentucky. I’m walking around with the plant manager, and I said, “You’re making sedans here?” He said, “Yep,” and a lot of the Detroit guys have given up making sedans because they can’t make any money. I said, “And you’re using parts that mostly come from Kentucky, Ohio, Indiana, Alabama, Mississippi, and Texas, and some from Mexico and Japan, but mostly domestic content.” He’s like, “Yep.” I said, “And you’re using American workers.” He said, “Yep.” I said, “You’re using American-made steel.”

I’m trying to get out of him that, okay, look, I know American steel costs a lot more than imported steel because I’ve been in other factories that are still importing steel despite the steel tariffs because they say it’s still cheaper in Asia. But I said, “You’re using American-made steel.” So I’m trying to get that out of him: how much he’s paying for steel.

Obviously, he’s not going to tell me, but he does say, “We have a strategic long-term relationship with our supplier.” That tells you a lot, which is that there are ways you can do these things. You have to work with your suppliers. You have to give them longer-term arrangements, be less transactional, more strategic on things like that. So I think you can do it, but it really takes a comprehensive and more thoughtful approach.

I understand the rationale for putting tariffs on foreign goods that undercut our markets. You’re just going to increase the cost, and then maybe the consumer will buy the domestic product, and that’s better for our economy. It just hasn’t seemed to have worked.

I don’t see Liberation Day as having done anything except generally raise prices on everything. We haven’t actually remapped the global economy. And a lot of what you’re describing is, well, the system is pretty resilient. The system was pretty resilient to COVID. The system was pretty resilient to an oil tanker getting stuck in the Suez Canal. The system has been pretty resilient to the war in Iran. The system has been pretty resilient to absolutely chaotic tariffs.

Maybe some prices have risen, and I’m sure we’re going to get listeners pointing out that all the prices have risen. It feels like the only thing the system isn’t resilient to is the AI industry wanting every scrap of RAM that the whole world can produce. And so now there’s not going to be inexpensive cell phones.

What will push the system over the breaking point? Because globalization has seemed generally resilient to a bunch of people who want it to be over.

I think what you’re highlighting is that it’s really the power of the market. In the case of closing the Strait of Hormuz, Brent North Sea crude prices didn’t go to $150 a barrel like I was afraid they would, and a lot of people were afraid they would because the market adjusted.

We applied a lot of tariffs on Liberation Day. The first response was circumvention or front-running. The next response was tariff engineering. The next response is like, “Okay, let me move production to Vietnam or let me move production to Mexico, and I’ll find a way around that.” Now, eventually, when you close down all those things, then prices eventually have to rise.

In the case of memory chips, that’s a different problem because the demand far outstripped the capacity. I used to always buy memory cards on Black Friday. Forget that this year.

Yeah, it’s all over.

I’m just glad I stocked up on a previous Black Friday.

If you want to know my prediction for when the AI industry will meet its true political end, it’s when Grand Theft Auto VI comes out. Everyone goes out to buy a PS5, and they realize it’s more expensive now at the end of its life cycle than it was at the beginning because the price of memory has skyrocketed.

Yeah, no kidding. We’re talking about huge amounts. But that’s the same thing. We’re in a phase where we see all these tactical actions taken by the government, very transactional, without necessarily understanding all the complex interconnections and interdependencies.

You may have noticed, for example, that the administration temporarily suspended the Jones Act. I don’t know if you remember that. Why did they temporarily suspend the Jones Act? Because oil refineries on the East Coast of the US couldn’t get their oil from Texas cheaply because there were no domestic supertankers.

The Jones Act requires that if you move stuff from Texas to New Jersey, you have to have a US-owned, US-crewed, US-built, very large crude carrier. There aren’t any because we don’t build those in the US. So that’s why it’s cheaper to bring oil from Algeria to New Jersey than it is to bring it from Texas. And that’s why they suspended the Jones Act for a while. At least they understood that.

I know at least some of our audience is going to be listening to this conversation, and you’re steeped in global trade. You wrote a book to educate our government about how it works from the basics, which I think is sorely needed.

But a lot of the promise for young people in our politics lately is that we will rebuild American capacity. We will rebuild manufacturing capacity. We will bring back a bunch of jobs where you don’t need an advanced degree in AI prompt engineering or whatever to see the future. We will bring back the dignity of work.

Politicians on both sides are making these promises all the time, and a lot of that requires closing down trade, forcing that economic activity back within our borders. It just seems like that isn’t likely. So I’m not going to ask you whether or not that is totally likely. I’m going to ask: what’s more likely instead?

Well, I think what’s more likely is that we will see efforts as you describe. I would love to sit down with people and say, okay, we want to move this type of production back to the US. Let’s take a more strategic, more nuanced approach, understanding the bigger picture, considering what levers are available.

The US is still a big, attractive market. It is the largest market in the world. It is the most attractive market in the world. That’s, by the way, why the Chinese all want to come here: because they can make some money here that they can’t make elsewhere. So then how do we harness that market power and that market pull with a more nuanced understanding of why our supply chains are organized the way they are today? Recognizing that, can I build a strategy to bring important things that are very strategic for the US to know how to do?

Let’s think about how we fix this problem with an understanding of that bigger picture.

Willy, it’s been great to talk to you. It is always just a pleasure. We have to have you back faster than five years. Thank you so much for being on Decoder.

Thanks for having me.

_{Questions or comments? Hit us up at decoder@theverge.com. We really do read every email!}

Rian Johnson is an analog photography devotee. The director of Knives Out and The Last Jedi can often be spotted on set with a Leica M6 at his side, documenting production on film. But sometimes, it's still easier to reach for a phone. So Johnson started wondering if the photos from his iPhone could be made to look more like the grade he applies to his movies.

The result is Chromagraph Camera, a $13 iOS app that bypasses elements of Apple's image processing pipeline and applies the same look used on Johnson's movies. The app, made by Johnson and his longtime cinematographer, Steve Yedlin, is shockingly simple, with just a few primary settin …

Read the full story at The Verge.

Today, I’m talking with Matt Strauss, who is now chairman of the NBCUniversal Media Group. This is Matt’s second time joining me on the show, and there’s been a whole lot of organizational and structural change at NBCU since the last time he and I spoke just two years ago — pure Decoder bait.

First, about a month after Matt was on the show, Comcast spun off most of the NBCU cable channels into something called Versant. That’s when Matt’s title changed from heading up just the direct-to-consumer offering — meaning Peacock, plus some other streaming services — to heading up the whole thing, across all distribution. And now, Comcast is spinning off the NBCU business entirely into a whole new standalone company.

That’s a lot to have going on all at once! And meanwhile, it’s only just this year that Peacock became an actual profitable business at all — and it’s still pretty far away from being anything like the juggernaut that Netflix is.

But what NBCU has, and what Peacock has, that the rest of the streaming industry is still trying to wrap its head around, is live sports. Sports are huge. They held up the cable industry for years, they held up broadcast, and now they’re the big thing that could make streaming a winner for NBC.

One thing before we start: You’ll hear me ask Matt about the red company and the blue company. That’s just my way of getting Matt to talk about Netflix and Skydance, the company that now owns both Paramount and Warner Bros. Discovery. I think he did a good job playing along.

Before we get going, do me a favor and subscribe to Decoder on YouTube, where we put out new episodes every Monday and Thursday.

Okay: Matt Strauss, chairman of the NBCU Media Group. Here we go.

This interview has been lightly edited for length and clarity.

Matt Strauss, you are the chairman of the NBCUniversal Media Group. Welcome back to Decoder.

Thank you so much, Nilay. It’s great to be back.

I am very excited to talk to you. There’s a lot going on in the media. It is a tumultuous time in Hollywood. I have to tell the audience that you and I are speaking minutes after Anthropic filed its S-1, and all of humanity is going to be turned into AI. Who knows what entertainment we’ll be watching in the future?

There’s a lot going on. Let’s start at the very beginning of this. You have a new job since last time you were on the show. Last time, you were the head of Direct-to-Consumer — you were basically the head of Peacock and the other apps inside the family. Now you’re the chairman of NBCUniversal Media Group.

What’s the new job? What does that mean?

NBCUniversal Media Group is comprised of certain services within NBC. It’s the broadcast network, it’s Bravo, it’s Peacock, it’s NBC Sports. We also have NBC News and Telemundo. One of the things that we recognized, especially when we spun off some of our cable assets last year into Versant, was that the assets we had truly worked better together. NBC has been like a megaphone. Given the reach of NBC, it’s been incredibly strategic in growing Peacock, which is a bit ironic because I think so many people believed that broadcasting was a bit of a relic of the past in this digital world, but it’s actually proven to be the opposite. As things have gotten more fragmented, having a broadcast network is actually a superpower because we’re continuing to see ratings growth. That has been really helpful as we’ve been building out Peacock.

But actually, Peacock was also finding new audiences, like cord cutters or people who maybe didn’t grow up watching NBC or some of our cable networks. So, Peacock’s also been really strategic in reaching and driving people back to NBC and Bravo. So, I think that flywheel is where we recognized that we needed to start operating differently. I’ve been a huge advocate of what I like to call “centers of excellence” in how I like to structure the business, which is, content first and platform second. How do we get maximum reach, maximum engagement? That really required us thinking differently about how we were running the business.

Essentially, instead of having a programming group within broadcast and a programming group within streaming, we just collapsed the business. Now you’ve got one programming team, one marketing team, one product and technology team, one decision sciences and research team, and one advertising team. They’re all incentivized around continuing to grow the portfolio, get that maximum reach, maximum engagement, and drive top-line revenue. I think that structure, which we put in place about 18 months ago, is contributing to a lot of the success that we’re seeing now.

Even if you look at 2026, NBC is the number one network in total viewers. We had an unbelievable early part of the year with “Legendary February,” which you might remember. That’s when we had the Super Bowl, the Milan Cortina Olympics, and the NBA All-Star Game. In 17 days, we reached over 225 million viewers. This summer, we had Love Island, which was the number one show of the summer for streaming. You had the World Cup, which was the number one Spanish-language sporting event in US history on Telemundo and Peacock. We had a show called The Five-Star Weekend, which was our number one scripted drama.

Now, we’ve led ourselves into the fall, where we have Sunday Night Football, which has been the number one show for 15 consecutive years. We had a great kickoff with over 25 million viewers. We just had the NBA tip-off last week with the Knicks and the Sixers, which is the number one rated tip-off in NBA history. So, it does feel like we’re firing on all cylinders in how we’re trying to operate with this, again, content-first-platform-second mantra.

But just to go one level deeper, a big part of this strategy is figuring out how do we move audiences across platforms. For example, when I mentioned that Love Island was the number one streaming show of the summer, 40 percent of those Love Island viewers also tuned in to watch the World Cup. So, migrating viewers back and forth across the portfolio is a critical part of how we see ourselves continuing to grow. But to effectuate that, you need to structure yourself in a way where people are incentivized along that vision. We’re still evolving as an organization, but I’m really proud of some of the milestones and accomplishments that we’ve made as a team. I love my job. I feel like I’ve got the best job in the industry at the moment.

It is a tumultuous time in Hollywood, and you seem like one of the happiest people in the industry right at the second. That is very notable. You’re a Decoder pro, you brought up structure. I’m dying to ask you about the Decision Sciences Group. That’s the other question I ask everybody.

But let me just back out for one second. You’re describing quite a lot of freedom in rethinking how something like NBCUniversal would work. You mentioned the Versant spin, so CNBC, MS Now, and a bunch of channels went that way. I’m on its networks all the time. I would describe the folks at Versant as feeling more free. They’re disconnected from the battleship that was Comcast and NBCUniversal. They can go try whatever they want to try. They’re energized by it in some ways.

Then, Comcast looked at NBCUniversal and said, “We’re going to spin off that off as well. We’re going to be the cable business and NBCUniversal will be the entertainment business, and now you’re in charge of that.” You’re like a 20-year Comcast veteran. I think you got your start doing cable boxes.

Yep. I started in 2004 at Comcast.

Just tell me about that process. We spun off CNBC and MS Now into Versant. Now we’re looking at this company. We ought to spin off NBCUniversal as well. Just tell me about how that came about. What was that moment like? Did you all sit in a boardroom? Did it come down from on high? How did that happen?

Well, that decision really was made by Brian Roberts and Mike Cavanagh. Candidly, I was not in the room when that decision was made, but I think if you were to ask people at NBCUniversal, it makes strategic sense.

Do you feel that same sense of freedom?

You know what? I think that there’s an energy. When people show up here, they feel very passionate about what they do. They believe in our strategy, they believe in our portfolio. Look at NBCUniversal more broadly. Before, I was describing the Media Group, but that is one piece of the broader company. You have Universal Pictures and Universal Television, which have obviously been having an unbelievable summer with The Odyssey and Obsession. You’ve got Universal’s theme parks and experiences. We opened up Epic Universe last year. We opened up a kids theme park in Texas. We announced we’re going to open up a theme park in the UK. We have Sky, which was part of the company but more squarely sat within Comcast Cable. Now that’s going to migrate over to the new NBCUniversal as part of this restructure. Then, you have these media assets, which I spoke about earlier.

So, you’ve got this unbelievable portfolio. I think that people here really believe in our growth and that if we’re a separate company, it’s going to allow us to move faster. It’s going to let us have more clarity around where we want to make capital allocations and decisions. There are a few areas that really play to our strengths as an organization. One of them is live sports and live events. That’s always been a part of NBCUniversal that we’re really known for. If you just look at the sports portfolio that we have, Nilay, we’ve got NFL, NBA, MLB, the Big Ten Conference, the Premier League. We’ve got the Olympics with the IOC. You’ve got this unbelievable portfolio of sports content, and that’s a strategic asset when we’re partnering with the leagues because we believe in broadcast. We believe in broad reach. We’re not trying to put everything exclusively on a streaming platform. In 2026, we’ve demonstrated across almost every single sport that we can actually continue to grow ratings and reach new audiences, which is something that’s becoming more and more complicated.

Can I ask about that? Because you also run Peacock, which is a paid streamer where you can access sports. When you say grow ratings on broadcast, are more people putting up antennas to watch sports over the air?

No. What I mean… By the way, about 20 percent of TV households in this country do still use over-the-air antennas as—

Oh, we have lots of listeners who are going to tell you that’s the best picture quality you can get.

Yeah. It is amazing picture quality, especially if you live in the right look angle where you could pick up the signal.

It comes back to what I said earlier about managing as a portfolio. We don’t think of it as a broadcast business sitting next to a streaming business. We really position ourselves as a digital-first company trying to get that maximum reach. When we look at the ratings, we’re combining what you would think of as more traditional ratings for linear television with streaming and all of our digital platforms. Whether that’s DVR or TV Everywhere, we aggregate it into one platform. When you look at it through that lens, which is just audience, we’ve actually demonstrated that across almost every sport — NFL, NBA, or MLB — the total viewers that we are reaching now are, in some cases, the highest they’ve been in decades.

Even the Super Bowl, which we had earlier this year on NBC, reached about 137 million viewers at its peak, and that’s across all of our platforms. That Super Bowl was the highest-rated live event in NBC’s 100-year anniversary, which is this year. It’s kind of counterintuitive, but what we’re showing is that when we start operating as one, we can reach new audiences and we can aggregate them. We are demonstrating that not just across sports. There’s even something like the Thanksgiving Day Parade, which has been an institution on NBC for 99 years. This past Thanksgiving Day Parade was the highest-rated parade we have had in the company’s history. So, there’s a renaissance happening around live. In a world of instant gratification, on demand, and watching what you want when you want, the fact that you’re now seeing more and more viewers wanting the collective consciousness of social viewing, things that still matter in today’s society, that actually plays to our strengths. And we’re seeing that manifest itself with higher ratings.

But as I mentioned, it’s also a big part of our strategy. It was a big part of our Peacock strategy, which was a bit of an anomaly when we launched Peacock six years ago. It’s also a huge part of what I think NBC does well, which is that we create these big tentpole events and we’re able to shine a light on them and get huge audiences that are continuing to show up, even in a world of fragmentation and cord-cutting.

It’s interesting that you’ve described it as content first and platform second, and then you’re describing your approach to ratings as agnostic to distribution. You’re just sort of combining everything and saying, “This is the number of people we reached.”

Well, take something like the Milan Cortina Olympics. This is an interesting example. If you were to look at that Winter Olympics, we had roughly 3,200 hours of content. There’s no way we can make all of that available on one network. There’s no way to daypart 3,200 hours. If you remember what we did with the Paris Olympics, we made the decision to make every event available live. When you make it all available live, we put it all on Peacock. This was a very controversial decision because the question has always historically been that if people tune in to watch this live during the day on Peacock, are they going to tune in to watch NBC primetime? Are we going to cannibalize our ratings or are we going to grow the ratings? This is where we really tested this strategy. If we’re truly indifferent, then what should happen is that we should be able to expand the funnel during the day, get more people into the Olympics, and try to create an experience that we’re very proud of.

We really do believe, whether it was the Gold Zone or Multiview, that we were able to surprise and delight viewers and make it really easy to navigate and find all of the choices on Peacock. But then what happened was that people were tuning in to watch NBC during primetime because there’s a difference between what NBC does and what Peacock does. NBC was more about storytelling. It was more about, “Let’s talk about what happened today. What about the backstory of the athletes? How’s Mike Tirico going to address his perspective on things?” When you combine these two things together —  putting all the content on Peacock and then having the primetime show —  this Winter Olympics had about a 96 percent higher rating. About 25 million viewers were tuning in to watch the Milan Cortina Olympics, which was about 96 or 97 percent higher than Beijing. On the digital side, it was double the digital minutes of every other Winter Olympics combined. We also doubled the advertising revenue.

You’ve got to be willing to break some glass. This is going to seem so obvious, but it starts with the consumer. It starts with, “How do we approach the consumer and give them the best experience?” And if you build it, they will come. The only reason I’m using the Olympics as an example is because if you were to look at the past, this was a real pain point where we didn’t make everything available on streaming or it was confusing for some viewers to figure out how to navigate all of the choices. We really, as an organization, decided to put our shoulder behind this, and I think the results ultimately speak for themselves. But again, it ladders back up to this vision of really starting to manage as one portfolio. If you can drive that maximum reach and engagement, that’s also going to be where you’ll get the best monetization.

The Verge team in particular was addicted to Gold Zone, which was the whip-around coverage of every medal event. It was very fun.

Let me ask you about this. A big Decoder trope is that your distribution fundamentally affects what you make, right? That the medium is essentially the message, and I know what a YouTuber makes because they’re on YouTube, and I know what a TikToker makes because they’re on TikTok. I could stretch this all the way back and say I know what broadcast TV looks like because the medium of broadcast TV has fundamentally shaped the content that gets made there. I know what cable shows on Bravo look like, and they’re not the same thing and they haven’t been for a while.

You’re describing, “We’re going to bring programming in, we’re going to centralize that, we’re going to be agnostic to distribution — or indifferent I think is the word you used — and that’s going to increase viewership.” But the pressure of the different distributions is still there, right? Running the broadcast network over the air is still different and reaches different people than distributing on YouTube TV, than running Peacock as a paid platform unto itself. How do you manage that tension? Because it is real.

Yeah, it is very real. It’s a really insightful question. The tension is real, but actually, I don’t view it as tension. I view it as an opportunity because you’ve got different audiences. If it’s a Venn diagram and you look at who’s the audience on broadcast versus the audience on cable versus the audience on streaming, there’s some overlap, but it’s not as much as you would think. That actually speaks to this broader strategy, which is, “How do we reach?” If we reach all these different viewers but they’re on different platforms, how do we start bringing this together into one?

Now there’s multiple ways to effectuate that kind of a strategy. One is you start sharing content and window content differently across platforms. For example, we have a show on Peacock called The Paper. Greg Daniels created it, who also created The Office. It’s a really great comedy and it’s an original. If you were to look at how streaming services typically make originals available, they’re exclusive. You premiere it on your streaming platform, and it typically stays on that platform forever.

What we’re starting to experiment with is, well, what if we premiere The Paper on Peacock but then introduce it onto NBC six months later? Now you’re bringing a show that was created for streaming and making it available on NBC to a new audience. You also have this added message, which is that if you want to watch next week’s episode now, go get Peacock. All of a sudden, NBC is not only reaching new audiences but it’s also becoming a sales channel for driving people back to sign up for Peacock.

Do you give that to Greg Daniels? The feedback loop of a YouTuber is so blunt. I’ve made a handful of Instagram Reels in my life. I literally open and look at the retention chart and think, “Oh, I should put another hook in there in the middle to keep my viewers,” and it’s immediate. That’s not even how my brain works. It’s immediate that the data makes you think this way. If you say to Greg Daniels, “Hey, make sure episode two of The Office ends on a cliffhanger so that I can advertise watching the next episode right away on Peacock.

Well, Donna Langley, who oversees all of the entertainment programming, would be the one calling Greg Daniels and giving him that feedback. But here would be a different way to answer that question. I don’t think we’re necessarily trying to change the framework of how some of the shows are being created on NBC or Peacock. There’s still something about premium content and how that’s being created that I think resonates with a lot of people.

But here’s what we’re thinking differently. Take a show like Saturday Night Live. We had the 50-year anniversary for SNL a couple of years ago, and it’s unbelievable what Lorne Michaels has created. You still have SNL that’s on at 11:30PM ET, but what if we now take that content and we format it for vertical video on Peacock? We know that there’s a whole cohort of people that are watching on their phone, holding it vertically, and likely using their forefinger or their thumb to navigate because of TikTok or Reels. They’re watching a show like SNL on YouTube in some cases as well. Instead of trying to recreate or tell viewers how to watch the content, why don’t we just take that content and reformat it in a way that’s more akin to them? So now, you can go to Peacock and you can watch content in a vertical video format. That may not be for you, but it might be for somebody else who wants to swipe from sketch to sketch because that’s how they enjoy it.

Let me give you another example, which is sports. I mentioned earlier about how we tried to introduce new features around sports because it’s such a passionate fandom. You can’t change the way somebody watches an NBA game. People want to watch an NBA game in the way that it was produced, but the lines are getting blurred around what’s a live event and what’s a video game, especially if you grew up playing NBA 2K. We’ve introduced something called Performance View, which is on Peacock. You could watch the NBA game or you can enable Performance View. If you enable Performance View, an overlay comes down on top of the game, and now it looks like a video game where we’re pulling in real-time sports data from sports radar, calculating the probability of somebody making a shot, using graphical overlays to show the trajectory of the ball, or putting the names over the player’s heads just so it’s a little bit easier to follow what’s going on.

You’re not changing the core production, you’re enhancing it. The enhancement of all these types of tactics and features — whether it’s through something like Performance View, something like I’m describing with SNL, or it’s rethinking the windowing of the content —  is allowing us to reach new viewers but also allow them to consume the content on their terms. And the way you watch may be different than the way I watch, and we’re just trying to give viewers different choices to enhance their experience.

One thing I always think about in terms of distribution is that every distribution channel is more or less valuable. The monetization is more or less lucrative. I can make 1 million Instagram Reels today and they will make me $0. But more people will see my face, and then maybe I will sell them a The Verge subscription, the Decoder book, or whatever it is in the future. That’s the creator economy, right? It’s 10 million little ad agencies. Instagram doesn’t pay for the content, and they all have to monetize it some other way.

Then there’s, I don’t know, Peacock or Netflix where I pay a subscription fee and the content is there, so there’s that monetization model. There’s the movies. You can go and pay to watch one movie one time and that’s going to be very lucrative for Christopher Nolan —  maybe nobody else, but it’s very lucrative for Christopher Nolan. Which one is most valuable for you? You’re describing everything, but some have to make more money than others and some attract more new audiences than others. You’re trying to bring people from the biggest audience to the most revenue.

I want to give a lot of credit to our ad sales team and Mark Marshall, who oversees ad sales. Several years ago we recognized that if you really want to have this kind of a strategy and vision (like I said, content first, platform second), you need to become almost agnostic around where the consumption is happening. We made the decision to actually sell as one portfolio. When you’re buying advertising, we are combining the audiences across broadcast, cable, streaming, and digital, and that’s how we sell it and go to market. That’s actually been the way that we’ve been doing this now for several years.

Is advertising the number one line of revenue here? Because on cable, when you were part of Comcast where I’m sure the rates were not as high as you could get now that you’re split, Comcast just paid you carriage fees.

We are a dual-revenue stream business. Advertising is very much a material part of the overall revenue stream, not just of NBC and cable but of Peacock. If you remember, this was a big part of our strategy when we launched Peacock six years ago because the streaming market was very focused on ad-free, binge viewing, scripted dramas, and growing subscribers at any cost. That was the future. We zigged while the rest of the market zagged. We believed the white space was actually going to look more like broadcast television. From the beginning, we saw Peacock as an extension of the broadcast business instead of trying to build a standalone streaming business. If you look at it through that lens, that has influenced all of our programming decisions around live events and sports, and around why we wanted to have movies and scripted but also unscripted and news. The belief was that streaming was going to look a lot more like television.

If the viewership moved to streaming, why wouldn’t the advertisers move to streaming? Eighty percent of the subscribers on Peacock are on our ad tier, which is a higher mix of advertising subs than I think almost any other streaming service, but that’s because of decisions we made six years ago. The platform that we built for Peacock was designed for live. When you see something like an exclusive NFL playoff game, the Olympics, or the NBA tip-off, the reason why our platform scales and why you’re probably not talking about pixelation, buffering, long latency, or high app crashes is because we spent years doing nothing but wanting to harden the platform because we believed that we needed to build a live platform for scale.

To your question, all of this kind of compounded itself. Whether you’re watching something on NBC or Peacock, we sell it as one. That has allowed us to go to market in a way that I think really does allow us to punch above our weight when it comes to advertising and monetization. It’s a critical part of our strategy. I think about 30 percent of our advertising revenue six years ago came from sports and streaming. Now it’s probably closer to 60 percent of our advertising revenue is coming from streaming and sports. So, all of that gets aggregated as part of this broader portfolio approach.

I’m curious about the sports piece of it, the NFL in particular. The NFL just keeps getting more expensive. That’s the business it’s in. It’s going to keep charging you more money for rights. I think all the other sports would like to keep getting more expensive. They maybe don’t have the leverage the NFL seems to have. That made sense in a world of carriage fees. The NFL would say, “We’re going to cost a lot of money. We’re going to go out to broadcast networks.” Then, the broadcast networks are going to turn around to their distributors and say, “Well, if you want the NFL games, you’ve got to pay what they cost plus our margin.” Then, my price all the way at the bottom at the consumer end would go up, and my cable bill would go up. I think everyone understands that is the thing that happened for years and years.

That is unbundled, right? You are describing the unbundling of that entire business model. But the price of NFL rights, for example, keeps going up. A lot of analysts I talk to are basically saying, “Look, at some point Amazon and Apple are the only companies that are going to have enough money to buy the NFL package.” NBCUniversal — standing alone outside the Comcast revenue that would keep it afloat — is going to have to raise rates to some extraordinarily high level just to compete with the big tech giants that own the own streaming platforms and run them at a loss. That is very challenging mathematics, right? If your business is based on live, you’ve got to stand up live events that people definitely want to watch. Sports is at the top of that list. The sports leagues know that, and they’re going to keep coming at you with higher and higher demands. How do you manage that without making Peacock’s price skyrocket?

If you look at our strategy (we’re looking at this across our entire portfolio and our entire ecosystem), I think one of the benefits that we bring to the table with the leagues is that we’re not looking to make the content available on just streaming or broadcast. It’s both. That allows us to grow reach, which is a good thing for the leagues. I think all of that has to be taken into consideration when they’re looking at how they want to go to market with their rights.

I mean, we have a very long history with the NFL. It’s a strong partner of ours. Sunday Night Football has been number one on NBC for 15 consecutive years, but we also entered into an 11-year arrangement with the NBA. As I mentioned, I think it’s been very happy with the relationship. We’ve been happy with the first year of the NBA relationship because it grew audience for us. It allowed us to manage how we’re thinking about having a weekly cadence of premium sports on Sundays with the NFL, the NBA, and now the MLB. It’s allowed us to grow more advertising. When the flywheel works, it allows us to partner with the leagues in creative ways.

Everything has to be evaluated when you’re looking at this, whether it’s sports or entertainment programming. But I think of it like a mutual fund. What’s the content that’s going to drive acquisition? What’s the content that’s going to drive engagement? What’s the content that’s going to drive frequency? The answer to that question could change depending on where you are in the life cycle of your business. You might have certain content that’s a loss leader, but it’s adding value elsewhere in the portfolio. That’s generally how we’re evaluating when we’re going into a rights negotiation.

I’ll give you another example of this. When we were launching Peacock, we entered into a relationship with the WWE. We thought that the WWE would be a really great addition to Peacock for a few reasons. I wanted to have something that was on every month. It’s got their premium live events, which it does every month. That would create a cadence, which we thought was critical in streaming. How do you get somebody to open up your app? How do you build habituation? We thought the WWE could do that with premium live events. It also had a huge catalog of WWE programming, which gave us more tonnage. We were also able to look at the addressable market for the WWE and estimate what percent we thought we could penetrate. Then we know the CLV of a customer, so you can calculate the return on the investment when you’re going to go after a certain rights package.

For the listener, what’s the CLV?

The consumer lifetime value. What’s the Average Revenue Per Unit (ARPU), multiplied by the number of months that you retain a customer before they would churn. That’s generally the formula that you would look at.

The reason I’m kind of laying it out this way is that if you’re making decisions that are longer term, you’re thinking about how does this fit into a broader portfolio view. In the case of the WWE, it was actually a real win-win because we acquired subscribers through the WWE. I think the WWE was happy with it because we were also able to bring in new viewers to sample and experience it. But when that deal came up for renewal, tthe license fees went up pretty dramatically, and it ended up going to another streaming service. We were actually okay with that because what we really focused on was how to take those WWE viewers and habituate them. What we found was that WWE fans really like The Fast and the Furious. They really like Yellowstone. They like other stuff.

[Laughs] I’m sorry, did you need to open the spreadsheet and figure that out or did you just intuit that one?

[Laughs] Well, we have assumptions, but you have to test these hypotheses.

The elegance of this strategy for us was that what we were really calculating, well, if I don’t renew this content, how many subscribers can I retain? We were able to retain the majority of those subscribers. We ended up licensing a much smaller package of WWE programming. We were able to retain those subscribers because we had habituated them into other content. Then, we took the money that we were utilizing to license the premium live events, and we reallocated it into other parts of the portfolio.

That’s the mindset for how we are approaching these deals. If the economics make sense, they make sense. If the economics don’t make sense, then we look to how we reallocate that investment into other parts of the portfolio and try to find a comparable or better return. It’s an evolving, living, breathing strategy and approach for how we go to market when we’re looking at any type of content, whether it’s sports or entertainment.

You’ve brought me to the other Decoder question. I think you’ve talked a lot about structure already. The other question I ask everybody is how they make decisions.

You oversee a group called the Decision Sciences Group. You are describing a lot of decisions that take time to pay off, right? This is a strategy you set ages ago when you bet on live. You built a platform around it. You’re saying the flywheel is spinning now. How do you make decisions? What’s your framework, and how does that decision sciences group play into it?

It’s interesting. When I came to NBC, there was a research department, which did what I think a lot of media companies would focus on. They would look at the ratings and the demographics and take more of a traditional approach to how they’re measuring performance. That, to me, is different than the muscle that I think we needed to build inside of NBCUniversal, which was, “No, I need to better understand what drives acquisition, what drives engagement, what drives frequency, what drives retention or what causes someone to churn. What’s the propensity for somebody to upgrade? What’s the propensity for someone to downgrade?” These are very different skills.

When I talked about early on having centers of excellence, at one point there were two different groups: one doing research and one doing decision sciences. I would go into meetings, and they would have two different conclusions around how certain things were performing because they were evaluating them differently. One group might say, “Hey, this is doing really well because we grew the audience.” Then, the other group would say, “No, it missed its mark on the paid subscriber additions, and it’s not generating the right return.”

The solution was to bring them together as one team. It’s managed by Will Gonzalez, who has done an unbelievable job in managing this as one holistic decision sciences and research team. When we were building Peacock, we were maybe at a grade school level of sophistication, if I’m being a little cagey about it. I think we’re now at a graduate school level. The sophistication of this team and their ability to predict and forecast across multiple different KPIs is just unbelievable.

Donna Langley really oversees all the greenlighting for entertainment, but when we partner together across all of these decisions, we are looking at multiple variables,  whether it’s paid subs, advertising, or what is the brand benefit. What is the cohort for this content and what other content do we think this cohort may watch on the platform? What do we think that this does to the frequency or the habituation? There are multiple KPIs that we’re evaluating when we’re greenlighting a show.

It also comes back to who are the audiences we’re trying to reach. One of the things that we’ve been able to do is… We’re not trying to cast a broad net and be all things to all people. We’re not a flea market. We’re trying to be very purposeful around how we super-serve the fandoms and the franchises that we think play to our strengths. A lot of the decision-making is around how do we grow those audiences? I wouldn’t say that the decision sciences and research teams are the decision-maker, but they are providing us the information to make better informed decisions.

There’s still an art to the science, and so in my opinion, you don’t want to swing the pendulum so far that you’re just using data to make predictions. I think that there’s a real skill around understanding the creative process, but then how do we utilize something like decision sciences and research to make better strategic bets? That’s something you’re not going to get right every time, but we’ve done a pretty good job, in my opinion, in building out our portfolio and predicting where we thought the market was going to go.

We predicted that the market was going to move towards bundling. I talked about that in 2019, where I said this great unbundling of cord-cutting is likely going to give rise to a great re-bundling of streaming. I saw a lot of data that drew me to that conclusion. When we were building Peacock, I was not building Peacock to win a streaming war. I was building Peacock for growth after a streaming war. Where do we think the market was going to be? If you look at where we are now, where you’ve got the market that’s shifted more towards wholesale bundling and towards advertising where almost every streaming service is now ad-supported with a tier. You’ve got this real focus now on live events and driving content, whether it’s unscripted content or various dayparted content. I would argue that a lot of what streaming looks like today is replicating a broadcast network: There’s a broad household demographic where there’s something for everyone in the home with a dual-revenue stream. That market is moving towards bundling — the more you get, the better the price — which is exactly how the cable industry was built.

Everything old is new again. I think this is back to the future, but we designed ourselves in a way where we bet that’s where the market would go. Equally important, we believed that would at least play to our strengths, and that’s what would work for us at NBCUniversal.

How do you make decisions? What’s your framework?

Well, my framework involves looking at the hallmarks I mentioned earlier: How do we drive reach, engagement, and monetization? Those are some of the most critical components. When I project out over the next several years, if there’s a streaming war, so to speak, I don’t think it’s going to be around subscribers or reach. It’s going to be about engagement. It’s going to be about how to grow share of time. How do you grow share of time when there’s only 24 hours in a day and the average consumer spends five to six hours a day consuming media / video? That number’s been pretty consistent over the past decade.

How we consume that media is obviously very different, especially based on where you are demographically. As more people are spending time on social media, user-generated content, gaming, podcasting, what are the things that we need to do to continue to grow share of time? I know the value of one extra hour per user per month, so a lot of my decisioning is around how to grow that share of time. That’s where everything hangs off of the monetization, the retention, and, ultimately, how I see ourselves continuing to grow as a portfolio.

I was looking at our past conversation just before we started, and you are an all-star champion of not talking about your competitors. So, I’m just going to say there’s a red company and a blue company. You can guess who they are. I can just tell you who they are. There’s a red company and there’s a new blue company that just consolidated. They’re hypothetical.

The red company is going through some tumult. They were built on the idea, “We want one extra minute of your time.” They were built for the attention economy. They would famously say things like, “Our only competition is sleep.” They’ve added things like video games and podcasts, and it doesn’t seem to be working for them. If you ran the red company, what would you do?

Well, in my opinion, the red company is an incredible company. I think they’ve done an unbelievable job —

This hypothetical company is doing such a good job!

Well, every company goes through changes, but I don’t think I would lose sight of what they’ve built. You have some incredibly smart people in that company, and I would not bet against them. I think that if anybody could figure out how to continue growing share of time, I think it’s the red company, I think that they are poised for continued growth.

But to me, that doesn’t mean that there’s a winner that takes it all. It’s kind of like broadcast. There wasn’t one broadcast company, there were four broadcast companies. There wasn’t one cable network, there were dozens of cable networks. I don’t think somebody else has to lose for us to win as a company.

Let me give you an example of what I mean when I think of growing share of time. The way I would think of it, Nilay, is that you shouldn’t think of us as a streaming platform. To me, streaming is too limiting. Think of it as an entertainment platform. On this entertainment platform, you’ve got tens of thousands of hours of premium video content. You could watch what you want when you want it, and there’s also all this great live programming. But what we do, in my opinion, with this premium content is partially fuel the share of time that’s happening off of my platform. Take for example a show like Love Island—

Wait, let me actually ask you about Love Island. I’m only interrupting you because we’ve only got a few minutes left. Is it a win for you when the clippers clip Love Island onto TikTok?

It’s a win for me in the sense that you’re growing more share of audience. You’re opening up the sales funnel. If somebody sees that clip, they may have a higher propensity to  tune in and watch it on Peacock, so that would be the benefit.

Does the Love Island marketing team clip its own show on to TikTok? One of my beliefs is that this happens a lot.

We do. We make our content available on almost every platform because, again, you’ve got to go where the audiences are. You can’t go in with the assumption that you’re going to be a closed ecosystem and everything has to happen on your platform. I think you’ve got to go where the viewers are, but in my opinion, our platform should be the best place to experience the content.

Let me use Love Island just as an example to build on the point that you’re making. hat was the number one show for the summer. It was a bit of a phenomenon. It’s a good reminder that must-see TV still exists. Appointment TV still exists even with younger demographics. Love Island was also an interesting show because a very high portion of the audience consumed that on mobile devices. That might seem obvious, but in a world where you can watch on an 80-inch television, you still have people who are very comfortable consuming that content on mobile-only devices.

So what happens? Somebody watched that show, and it was on six days a week. When the show is over, what we do and what every streaming service does is we say, “Oh, you like this show? You should watch another show. You should watch The Real Housewives.” But that’s not what a lot of these viewers wanted. What they wanted at the end of the show was to talk about what just happened. So, they leave the streaming platform and go to social media, they’ll look for a podcast, or they’ll even play a game if they could. By the way, the number one app over the summer was the Love Island app. It was not ChatGPT. It was not Claude. It was the Love Island app for several weeks over the summer. That speaks to what I’m describing around these fandoms.

We are creating this demand, but I would argue we’re not doing a good enough job super-serving them. Then, we are fueling this what I would call “dark matter engagement” on these other platforms. This is what’s leading us to say, “What if we put the clips on Peacock and we offer it in a vertical video format? What if we create a podcast for Love Island? What if we create gaming?” But it’s not any game. These games are derivatives of the fandoms and content that we have on our platform. Can we better super-serve those fans and then grow our share of time? I think that’s the opportunity. That’s the ambition. It doesn’t mean that we’re not going to work with YouTube, TikTok, Reels, or other platforms.

I would argue that the best place for our content, franchises, IP should be on our platforms. But to do that, you have to expand the aperture of what you deliver as a platform, which is why I think streaming is too limiting. You should really think of it more as an entertainment platform designed to maximize share of time and retention. I think the partnership we announced with YouTube this summer is going to be an example of how we see ourselves continuing to drive more of that audience and engagement across our platform but also working very closely with YouTube.

That YouTube deal looks like the rebundling you’re talking about, right? Peacock will be available to YouTube Premium subscribers. I have YouTube TV. I imagine that will somehow connect the dots. YouTube is fascinating because it has the user-generated content platform and TV. Those things are starting to compete with each other, right? I look at the viewership charts, and classic, user-generated YouTube is skyrocketing, just eating up everyone’s time all day long. Everyone has to be there. I’m assuming the economics of YouTube TV look like cable for you. They have to be far more lucrative. When you go into a room with [YouTube CEO] Neil Mohan and say, “Well, there’s the platform that’s very lucrative and there’s a platform I have to be on,” how do you reconcile the economics of the two?

From my point of view, it’s not one or the other. It’s both. It comes back to what I said about how they’re not exactly the same audiences. There’s some overlap, but somebody who is subscribing to YouTube TV is not necessarily the same person who is subscribing to YouTube Premium or consuming content on main YouTube. I agree with you that when you look at this through the share of time lens, YouTube has done an unbelievable job creating a platform and business model that allows it to continue to grow. I don’t see anything that would indicate that’s going to slow down.

When you look at it from my point of view, so much of our content and IP lives on YouTube in some form, whether it’s SNL or Love Island, whether it’s clips from The Traitors or any of our NBC shows. But those viewers don’t necessarily subscribe to Peacock. They don’t necessarily watch NBC or Bravo. So, I think that was the opportunity. That was the unlock. How actually can we transform ourselves to reimagine what it could look like to partner with YouTube?

One of the things that I was talking about earlier with this great rebundling — which we talked about and somewhat predicted seven years ago — was that the one thing that held the bundle together in cable television for many years was sports. What you don’t want to do is a bundle deal without getting the right underlying wholesale economics. What will happen is that you could take a very high ARPU, direct-to-consumer subscriber and end up cannibalizing them for a low, wholesale bundled subscriber. What you’re really looking for is incrementality. Is this going to drive incremental subscribers, and can I get the right wholesale economics where this is also incremental on the revenue side?

What’s interesting about YouTube is that I think it’s a win-win. It’s a win-win because there’s multiple components to this deal. One aspect is that there’s going to be a bundle launched next year with the ad-supported tier of Peacock and a tier of YouTube Premium. Now, you’re going to get access to all of the benefits of YouTube Premium with the ad-supported version of Peacock. We believe that these are mostly incremental subscribers, or people who do not necessarily have Peacock today. So, it’s going to grow Peacock while adding more value to YouTube Premium. My prediction is that if you and I have a conversation a year from now, Peacock will be one of the top distributed streaming services in the United States.

Do you care that you don’t own your last-mile customer that way? This was a big reason everyone went to streaming. They were selling their content to Netflix, and they realized Netflix owned the customer. Now we’ve all got to stand up our own streaming services because we want to own the customer and the cable bundle is falling apart. Do you care now that as you rebundle, YouTube will own the customer in some important way?

I think that when you say “own the customer,” really what you’re talking about is, “How do I get the ability to personalize the experience so that I could super-serve an individual both with content and with advertising? What’s ultimately going to create the monetization engine that we need?” I was describing the value of Peacock and the fact that 80 percent of our subs are on the ad platform and that we typically charge premium CPMs (cost per mille) because we have this ability to super-serve our fandoms and franchises, and we have the data to do it.

I think that the relationship with YouTube that we announced this summer is going to allow us to have a much deeper integration with YouTube on the data side as well as the integration with FreeWheel. So, we’re at a point where we’re almost indifferent again about where somebody consumes the content—

FreeWheel is your programmatic advertising business.

Yes. That was a critical part to this unlock with YouTube because we can create a bundle that is going to drive incremental subscribers and value. To your point, YouTube TV is the fastest-growing pay TV distributor. I think the pay TV ecosystem has been declining at a 6-7 percent CAGR. Over the past five years, YouTube TV has grown at a 26-27 percent CAGR. It has over 10 million subscribers and are likely going to be the number one pay TV distributor in the next couple of years. We extended our linear portfolio agreement with YouTube TV, which is going to provide us stability and growth on that part of our portfolio as well. What we were just describing around having a much deeper integration with the data, analytics, and targeting is going to allow us to monetize our inventory.

It’s all of these pieces. We think this is an example of how we’re trying to think differently, or how we’re trying to be innovative and identify strategic partners. I don’t know if the red company or the blue company would be in a position to do the kind of deal that I’m describing, but it’s precisely because we are independent and looking to be more flexible. I think that actually becomes a calling card for how we could work with other companies in a way that is really transformative.

Let me ask you, I think the red company hypothetically got turned upside down because it relied on data too much for the programming and now it’s going to change a bunch of programming executives, so we’ll see where it goes. The hypothetical blue company led by the hypothetical son of a billionaire is out in the market. It made a big content acquisition. He’s saying, “Oh, we’re going to invest in technology and we’ll compete with Northern California. We’ll compete with any of the platforms based on our technology bet.” To me, that seems like an old story where I know the ending. Trying to run at TikTok’s technology without the content is just going to get you backwards. If you were running the blue company, how would you think about technology in that way?

Well, I’m going to answer the question based on how I’m running our company.

The blue company’s new. Anything could happen with the blue company.

I think my answer, though, would not change depending on where I sat within this industry. I believe that we need to be an open ecosystem, that you’ve got to go where the viewers are. That’s what led us to make a lot of strategic decisions, whether it’s the deal that I just described with YouTube, or the channel deals for the ad-free tier of Peacock with Amazon and Roku. We’ve done bundling deals. We’ve done a bundle deal with Apple. We’ve done a bundle deal with Walmart. You’re trying to give consumers choices. Everything I’ve done in my career has always been around the north star of giving consumers choice: what they want, when they want, where they want. That, to me, has been the mantra for how we’re trying to build our company.

All of that being said, I am still also a huge believer in the product, the technology, and the experience. You may be able to watch the Olympics on another platform through NBC or Peacock, but I truly believe the best experience was on Peacock.

Are you allowed to say that on other people’s networks? Can you go on to Amazon channels and say, “This is great, but if you want the first class, get out of this app and open Peacock?” Do they let you say that?

Well, I wouldn’t say it that way, though. First of all, I think when somebody subscribes to Peacock, they should be able to access our service regardless of the platform. In that respect, we do cross-authentication — meaning you can subscribe and watch on Peacock, or you could subscribe and access our service through channels. I’m not here to tell the consumer what the best experience is. I think that we lead by example. The consumers vote based on where they ultimately decide to engage. If you want to get access to some of these cool features that I’m describing, if you want to play a game that we created, or if you want to listen to a podcast, or… I’ll give you another example. We’re testing our membership program because we shouldn’t think of viewers as subscribers, we should think of them as members.

What are the other values that you can get as part of being a member? Well, maybe some of those values could be based on your tenure or your level of engagement. Maybe you get discounts to NBC merchandise. Maybe you get special access when you go to Universal theme parks. Maybe you get discounts from some of our advertising partners, like Domino’s. How do we start to add more value? But maybe that membership is only available when you’re on our platform. I think of it more as needing to give consumers the choice. At the same time, we are investing in product and technology and on experiences that are really meant to be delivered upon the platform that we have created.

We’ve got an unbelievable team, in my opinion, that has created a best-in-class, scalable platform that not only powers Peacock, but also powers Sky’s Now TV. It’s the same platform that we’ve also distributed to dozens of countries around the world. We’ve got a world-class team that is really trying to transform, surprise, and delight viewers in a way that I’m not sure other platforms are going to be able to do around our content and franchises, especially when it comes to especially these major tentpole events.

I want to end by asking maybe the most important question of all. We’re talking a lot about internet-distributed businesses and consumers signing up for services and being able to churn and quit. There are a lot of free market dynamics there, which I think are very powerful and very important. That means you get to program whatever you want to program. You have chosen live in sports and, importantly, you mentioned news at the top of this conversation. NBC News is part of this portfolio.

NBC News is also distributed over broadcast. It’s distributed over the air. The Trump administration and FCC Chairman Brendan Carr, in particular, has expressed a lot of desire to pressure broadcast networks because you use the public spectrum, particularly news networks. He’s withheld the broadcast licenses for ABC stations, for example. He has threatened the other broadcast networks. There’s a lot of pressure on NBC News. How are you handling that? Are you pushing back? Because that is the one place where you’re not allowed to just do whatever you want, right? The government gets to tell you what to say in an increasingly uncomfortable way.

Yeah. Look, I think I give a lot of credit to [NBCUniversal News Group Chairman] Cesar Conde and the NBC News organization who are big believers in freedom of speech and  freedom of the press. I think they’re doing a fantastic job. When it comes to distribution of our content, especially our news programming, I think that’s an example where it’s available everywhere. I mean, we truly make it available not only on Peacock, NBC, and over the air, but through Fast TV, NBC News Now—

Have you made this argument to the administration? Because I’ve met a lot of FCC chairmen over the years, and until Carr showed up, the argument they would make is that we have to get away from overthinking broadcast because the audience is everywhere, and they don’t actually make a distinction between broadcast television and cable. That was a Republican talking point for years and years. This is nonsense.

The other version is that everyone’s on TikTok and the industry has to contend with that in some way. We should get more people internet access because that will actually even the playing field. Now we’ve come to, “You have to use the spectrum in the public interest.” It is different and the government should impose some speech pressure — which again, I think is inappropriate — but that is a new argument. I’m wondering if you have said to the administration, “Look, the consumer doesn’t make this distinction and we as a company aren’t making this distinction.”

Well, I’ve not had those direct conversations myself. Obviously, we have a government affairs team that works very closely with regulators in DC. There’s probably no better time to be alive than right now when it comes to being able to access content through multiple modalities, whether it’s over-the-air broadcast, social media platforms, or free. If you were to look at Peacock, not only do we distribute NBC News, we distribute all of our own stations as well. I could be watching the Los Angeles local news in New York or I could be watching the Philadelphia local news.

There’s no shortage of ways that we are supporting the public good in giving them multiple ways and choices in how they want to consume and access their news programming, and I don’t think that’s going to change. I think we’re going to continue to advocate for freedom of speech and freedom of the press. I think our news organization has been doing an unbelievable job in the product and the service that they’re doing for the public.

Yeah. Matt, you can tell that’s an important topic for me for a lot of reasons. What’s next for NBCUniversal Media Group? What’s next for Peacock? What should people be looking for?

I think what’s next for NBCUniversal Media Group is, as we talked about, we will likely be a separate company as part of the new NBC this time next year.

You’ve got to come back. There’s a bunch of questions where I knew I wasn’t going to get answers because the deal isn’t closed yet. When that closes, you’ve got to come back because I have a million questions.

I will definitely come back. I’m really looking forward to it. I think the other piece, as you know, is that we had our Q3 earnings last week. We talked a lot about Peacock and how we had a very different strategy with Peacock from the others when we launched our service six years ago. I’m really proud to share that Peacock was profitable in Q3 for the second consecutive quarter. We had $261 million of EBITDA. That’s $470 million better year-over-year. I think the team has done an unbelievable job, and I feel really good about our momentum and continuing to grow. It’s good proof that there’s not one way to go to market. There’s not one strategy or approach. You’ve got to play your hand and to your strengths, and you’re going to see us continue to do that at NBCUniversal.

Yeah. We didn’t even talk about what AI might do to the cost structure of video. When you come back, we’re going to get into it. Matt, thank you so much for being on Decoder.

Thank you so much.

_{Questions or comments? Hit us up at decoder@theverge.com. We really do read every email!}

The iPhone has more screens! The MacBook has a touchscreen! The HomeView does CarPlay apps! For the first time in a long time, Apple is in a period of unabashed gadget experimentation, and while the final results aren't always perfect, it's fun to watch the most successful product maker try some new things again. Even when, in this case, "trying" amounts to just slapping a touch panel on a lovely new MacBook Pro - just to see if you might use it.

On this episode of The Vergecast, David and Nilay debate the merits of a touchscreen laptop, Nilay explains why he is absolutely positively going to buy the new MacBook Pro with PROLED XDR Display, …

Read the full story at The Verge.