Daily AI brief · May 17, 2026
Anthropic Closes $30B Round, AI Cyber Arms Race Heats Up
Anthropic seals a $900B valuation raise, OpenAI rolls out a vetted cyber-defense model, Colorado's AI law gets rewritten before it lands, and Microsoft's May Purview drop gives M365 admins real data-governance teeth.
1. Anthropic Closes $30B at $900B Valuation — and May IPO Before Year-End *(Financial Times / Bloomberg)*
Anthropic has agreed to the terms of a $30 billion fundraising round valuing the company at $900 billion, led by Dragoneer, Greenoaks, Sequoia Capital, and Altimeter Capital.
The deal puts Anthropic past OpenAI's most recent $852B valuation.
A large portion of Anthropic's revenue growth has been driven by its AI coding tools, including Claude Code.
What it means for SMBs / MSPs: At this scale, Claude is infrastructure — not an experiment. If your clients are still evaluating whether to commit to the Anthropic ecosystem, the capital, compute deals, and revenue trajectory ($44B+ annualized) mean the platform isn't going anywhere. Factor it into your long-term stack recommendations.
2. OpenAI Launches GPT-5.5-Cyber for Vetted Defenders *(OpenAI / Axios)*
OpenAI is rolling out GPT-5.5-Cyber in limited preview for verified cybersecurity professionals through its Trusted Access for Cyber program, designed to give verified defenders broader access to GPT-5.5's cybersecurity capabilities for defensive tasks.
The model is specifically designed to help defenders write proofs of concept for bugs they find, or run simulations to test their organization's security posture.
Individual members accessing the most capable tier will be required to enable Advanced Account Security beginning June 1, 2026.
What it means for SMBs / MSPs: MSPs doing vulnerability triage, patch validation, or authorized pen-testing for clients should apply for Trusted Access for Cyber now — the June 1 MFA deadline is real and access isn't automatic.
3. Microsoft May Roadmap Drop: Purview Gets Serious, SharePoint Gets Smarter *(Level Up M365)*
May brings one of the most security-heavy roadmap drops of the year, with Microsoft Purview delivering major advances across DSPM, Insider Risk, DLP, and Data Security Investigations.
A new DSPM experience delivers unified AI observability and posture reporting with Security Copilot agents, including third-party signals from BigID, Cyera, OneTrust, and Varonis.
On the productivity side,
AI in SharePoint can now generate code to translate intent into reliable workflows, and automated document generation from SharePoint forms via new Power Automate actions is now available.
What it means for SMBs / MSPs: The Purview DSPM upgrade is the strongest reason yet to revisit your clients' M365 data governance posture — especially if they've been deferring DLP conversations. The AI observability layer makes it much easier to show clients what Copilot is actually doing with their data.
4. Colorado AI Act Gets Gutted — Enforcement Postponed Past 2026 *(StackCyber / Aguardic)*
Both chambers of the Colorado legislature passed a replacement bill (SB 189) on May 7–9, 2026, and it is now headed to Governor Polis for signature. The replacement law is a major scaling-back — it drops the original law's risk management programs, annual impact assessments, and extensive algorithmic discrimination duties in favor of a narrower notice-and-transparency framework.
You don't need to prepare for the June 30, 2026 original law deadline, but you do need to track whether SB 189 is signed and monitor the attorney general's rulemaking timeline.
What it means for SMBs / MSPs: If you've been quoting Colorado AI Act compliance work to clients, update your pitch — the heavy-lift risk management requirements are gone for now. But the notice-and-transparency obligations survive, and the AG rulemaking clock will restart. Don't drop the thread; adjust the scope.
5. G7 / CISA Release AI Supply Chain (SBOM) Guidance *(Infosecurity Magazine)*
The paper *Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements*, published May 12 by the G7 Cybersecurity Working Group, builds on its June 2025 shared vision and defines seven clusters of elements producers and users of AI systems should document.
The document notes that an SBOM for AI by itself is not sufficient — it must be connected to vulnerability scanning tools, security advisories, and adaptive tooling mechanisms to provide real supply chain protection.
What it means for SMBs / MSPs: This is early-stage guidance, not a mandate — but regulated clients (defense, healthcare, finance) will start asking about it. Get familiar with the seven clusters now so you're not learning it for the first time in a client conversation.
Microsoft Copilot Authoritative Sites (M365 Roadmap — Rolling Out Now)
Admins can now designate trusted sites whose content is prioritized in Copilot Chat and Search.
This is a simple admin-level control that dramatically improves Copilot answer quality by steering it toward your clients' own vetted content — instead of surfacing random SharePoint noise.
- Who it's for: MSP technicians managing M365 tenants, or internal IT champions on Business Premium / E3/E5
- How long a first test takes: 30–45 minutes to identify 3–5 authoritative internal SharePoint sites and configure them in the admin center
- First step: Open the Microsoft 365 admin center → Search "Authoritative Sites" in the Copilot settings panel → Add your highest-quality internal knowledge base or policy site. Verify the change by prompting Copilot Chat with a question that should pull from that source.
Before you turn on Copilot, ask your IT provider to show you what it would be able to access. In regulated offices the biggest worry about Copilot is what it does with your data. Purview's new AI observability layer shows what Copilot is accessing. If you're a law firm, accounting practice or healthcare-adjacent office with an unused Copilot license, start there.
*For MSPs:* Walking a regulated client through a Purview DSPM view of Copilot's data access is the clearest answer to the data objection.
Don't pitch Colorado AI Act compliance engagements based on the original SB 24-205 scope.
Colorado's landmark AI antidiscrimination law is being replaced before it ever takes effect — the original law is effectively dead.
Clients who were budgeting for risk management programs, annual impact assessments, and bias audit documentation under the old law can stand down from that specific scope. Quoting that work now will damage your credibility when the client's own counsel tells them enforcement is frozen indefinitely.
AI cybersecurity capability is becoming a tiered, access-controlled product — and that model is spreading.
OpenAI and Anthropic are now running parallel "verified defender" programs (Trusted Access for Cyber and Project Glasswing) that gate their most capable models behind identity verification and organizational attestation.
A cyber-capable model is easier to justify internally when access can be limited to vetted users, logged to named defensive work, and tied to stronger authentication controls — buyers are weighing different theories of controlled deployment alongside benchmark results.
If cyber-offensive skill is emerging as a byproduct of more general improvements in long-horizon autonomy, reasoning, and coding, we should expect further increases in cyber capability from models in the near future, potentially in quick succession.
The signal here isn't just about cybersecurity tools. It's the beginning of a broader pattern: frontier AI capability being rationed by trust tier, not just price tier. MSPs who build verified-defender credentials now — and who can help clients establish the governance controls required for higher-tier access — will have a differentiated service offering that's hard to replicate fast.