Inside the Dark Web, AI and Cybersecurity with Christopher Ahlberg CEO of Recorded Future
Summary
Mastercard’s $2.65 billion acquisition gives Recorded Future a long-term home and a route to combine threat intelligence with financial intelligence. Christopher Ahlberg calls the product a “Bloomberg for intelligence”: it turns the internet into an intelligence sensor, organizes hostile activity, and produces geopolitical, cyber, and warfighter insights. Recorded Future continues operating standalone.
Cybercrime has become a specialized supply chain with unusually attractive economics. People obtain and sell access, ransomware developers franchise their software, operators execute attacks, and specialists move Bitcoin through money mules; Ahlberg describes an 80/20 revenue split and “one of the best business models ever operated on planet Earth.” Twenty- to 25-year-old forums remain active, but much of the market has moved to Telegram.
Recorded Future’s AI stack progressed from hand-coded rules to multilingual extraction and automated intelligence production. Its original entity and event extractors were stacks of if-then statements; one model now spans roughly 15–30 languages and transfers learning across languages. LLMs can also produce recurring analysis—such as second-order implications from Somalia, written in Arabic and delivered every week at 8 a.m.—that Ahlberg says would have seemed impossible three to five years ago.
Ukraine turned Recorded Future’s deployment into a defensive data flywheel. Deploying the system there exposed the company to modern malware and other threats, which could then feed protection for customers elsewhere, creating what Ahlberg cautiously likens to a “virtual Iron Dome.” The company supports national capabilities in 47 countries but screens every customer and excludes governments and companies it considers unacceptable.
AI is expanding the reach and potential speed of cyber offense, while human-only defense will not suffice. Better phishing already works across languages; Ahlberg expects software that autonomously traverses compromised networks, forcing defenders to deploy automated countermeasures. Rob Joyce’s rule—“you have to know your network better than the bad guy coming at you”—becomes harder when an AI-assisted crawler can outsmart veteran IT staff.
The second-time-founder lesson was to pair a broad technical insight with ruthless market focus. Ahlberg admits Recorded Future began as “a big-ass hammer,” not a customer pain point; it initially pursued intelligence and quantitative-trading signals until a Series C investor told the company to kill the latter. Focusing on a larger cybersecurity market let it ride a wave where “you can make a lot of mistakes,” contrasting with Spotfire’s narrower pharmaceutical niche and $195 million exit.
Ahlberg expects the internet to move from reflecting society to actively defining it, raising the stakes for platforms, democracy, and warfare. He remains an optimist—democracy is “the best of the worst,” and education may blunt primitive manipulation—but does not claim defenders will win. If perhaps 75% of future information is machine-generated, merely labeling synthetic content will be insufficient; armed drones could also make a designated 10-by-10k-kilometer area lethal to anything moving inside it.
Deep dive
Not yet available upstream; scheduled sync will retry.