Software development just went through the fastest transformation we've seen in our careers, and it happened in about 24 months. Silicon Valley poured roughly $500 billion into training models on the best practices developers had been documenting online for two decades, teaching software how to write code correctly the way the old Stack Overflow forums once did. The result: tools like Cursor and Codex that write genuinely good code, fast. Vibe coding isn't a trend anymore. It's table stakes, the new baseline every team works from, whether that's a Silicon Valley startup or an enterprise in Houston that's never had access to SV's full-stack developers.
But shipping good code is only the first two steps of a five-step cycle: design, build, test, deploy, operate. The half-trillion dollars in foundational investment has concentrated almost entirely on design and build. Everything to the right of that line - testing, documentation, compliance, deployment, operations - is where the real implementation work lives, and it's where Mercury Fund has always played.
Here's why the line matters: LLMs can't reliably check their own work. We've all watched a model confidently give a wrong answer, get corrected, and immediately admit its mistake. That's fine in a chat window. It's disqualifying in a compliance environment. SOC 2, ISO, PCI, every major industrial sector has a compliance regime, and every one of them requires an independent third party to verify the work. It's a structural requirement that holds regardless of how good the model gets. If there's an industry big enough to have a trade association, it's big enough to have its own licensing and compliance regime, and none of that changes just because the code got written faster.
We're seeing the same pattern across the dev stack. Dreambase, one of our newer investments in this category, sits on top of Supabase, the fastest-growing Postgres platform in the world and the database of choice for nearly every new AI-native startup. Your data is only as good as how you interpret it, and Dreambase is the insights layer that makes Supabase's data actually useful, from acquisition all the way through product engagement. And on security, we backed Blumira, seeded by the co-founder of Duo, the company that took multiactor authentication mainstream and sold to Cisco for a few billion dollars. Using those lessons, that team is building the AI-native security operations center, where agents do the triage, investigation, and response work analysts used to do by hand, so a lean team, or an MSP, can cover what used to take a room full of people.
The thread connecting all of it: every layer of the stack gets rebuilt for a world where the primary consumer of software isn't a person at a keyboard, it's an agent. The incumbents in infrastructure, testing, and operations are all exposed. That's our opportunity, and our opening.
