The room hasn't moved yet

Last night I went to a regional tech meetup. Twenty-five, maybe thirty people. Executives down to help desk techs, and everything in between. Sharp people, talking shop the way IT people do. I spent the evening working the room with one question: how are you using AI?

Most of them are using it. Some aren't at all. An IT manager in a regulated industry told me his org is just now evaluating one of the frontier AI vendors for internal use. In July of 2026. Not rolling it out. Evaluating.

But here's the part that stuck with me on the drive home. Of everyone I talked to, not one person was running an agent harness. Not one had given an AI any kind of persistent memory or a way to search their own knowledge. Nobody had AI doing work while they did something else. The most advanced usage in the room was a person typing into a chat box, reading the answer, and typing again.

These are not laggards. These are the people whose literal job is technology. And it's not just my local scene: McKinsey's latest State of AI survey found that while 88% of organizations now use AI somewhere, no more than 10% are scaling AI agents in any single business function. The gap between how the room works and how I work every day is wide enough that when I described my setup to a few of them, I got the kind of reaction you'd expect from showing someone fire.

That gap is what this issue is about. Because if the professionals in the room haven't moved yet, neither have your competitors. The window is open. Here's the problem, how to spot it in your own thinking, and what to do about it.

The problem

The room had settled on a mental model, and I think it's the wrong one.

The overarching sense I got was that AI is a neat tool. Another technology wave to be absorbed, the way we absorbed the internet, then virtualization, then containers. You wait for the dust to settle, you evaluate vendors, you deploy the winner, and life goes on with better tooling. Every person in that room has run that playbook successfully at least twice in their career. It's a reasonable model. It's also, I'm convinced, wrong.

Those earlier waves changed how the work got done. This one changes who does the work. Virtualization didn't rack the servers for you. Containers didn't write the deployment scripts and then monitor them overnight. An agent does the work: it reads, writes, checks its output, follows up, and runs while you're doing something else. Filing that under "new tool to evaluate" is how you end up treating a workforce change like a software purchase.

Then came the moment that crystallized the whole evening. I was talking with someone whose job is helping local businesses succeed, and the theme from those businesses was consistent: they're stuck trying to navigate the security concerns around AI. Data exposure, vendor trust, compliance. Legitimate concerns, all of them.

But here's what I've come to believe: paralysis by analysis is now a bigger risk than the risks being analyzed. I'm not dismissing the concerns. McKinsey's 2026 AI Trust survey found that nearly two-thirds of organizations cite security and risk concerns as their top barrier to scaling agentic AI, ahead of regulation and ahead of technical limits. So if security worry is what's stalling you, you're in the majority. That's exactly the problem. The stall IS the crowd. Security is important. It is equally important to crystallize your strategy and get moving. A security review with no end date isn't diligence. It's a decision to stand still, dressed up as prudence. And standing still is the worst thing you can do right now, because the technology compounds for the people using it. Every month you spend evaluating, the operators who moved are a month better at this. The gap isn't static. It's growing.

The honest good news: nothing I do requires secret knowledge. The tools are public. The techniques are documented. The people in that room could close the gap in a quarter if they started. So could you. That's exactly why the window matters, and why it won't stay open.

And if you run a small business, the numbers say the window is even wider for you. The Census Bureau's Business Trends and Outlook Survey puts overall AI use at 17-20% of U.S. businesses as of May 2026, with firms under 20 employees flat over the last six months while bigger firms pulled away. Meanwhile Goldman Sachs surveyed over 1,200 small business owners this spring: 76% report using AI and 93% of those say it's had a positive impact, but only 14% have it embedded in core operations. Read those two together and you get the real picture. The businesses that try it like it. Almost nobody has gone deep. Deep is where the compounding is.

How to identify it

The gap is easy to see in a room full of other people. It's harder to see in the mirror. Some tells, from the meetup and from my own past behavior:

• AI is a place you visit, not a coworker. If your entire usage is typing into a chat window and reading the answer, you're using maybe a tenth of what's available. The shift that matters is from "I ask, it answers" to "I delegate, it works."
• Your AI has amnesia. Every conversation starts from zero. It doesn't know your business, your customers, your history, or what you decided last week. If you're re-explaining context every session, you haven't given it a memory, and memory is where the compounding lives.
• You're evaluating on a timeline you'd never accept for deploying. That IT manager's org has been "evaluating" longer than it would take to run a scoped pilot. You'd have company: McKinsey found nearly two-thirds of organizations haven't begun scaling AI beyond pilots and experiments. If your evaluation has outlived the thing it's evaluating (models are replaced every few months), the evaluation is the delay.
• Your security review has no decision date. Real reviews end in a yes, a no, or a scoped "yes for this data, no for that." If yours just continues, it's not a review. It's a parking lot.
• You're waiting to see who wins. There is no dust that settles here. The vendors will leapfrog each other for years. Waiting for a permanent winner means waiting permanently.

If two or more of those landed, you're in the room. Most of the room is in the room. That's the point, and it's fixable.

How to fix it

Pick a vendor. Pick a tool. Pick a use case. Get moving. That's the whole prescription. Here's the expanded version.

1. Pick a vendor and stop optimizing the pick. Claude, ChatGPT, Gemini. At the frontier they are all good enough to start, and switching later is cheap because your prompts, workflows, and lessons travel with you. The choice you make this week is not a marriage. Treat it like picking which gym to join: the one you'll actually use beats the theoretically optimal one.

2. Pick one use case with real stakes and low blast radius. Not a toy demo. Something that costs you real hours every week but won't take the business down if the first attempt is clumsy. Drafting quotes. Summarizing meeting notes into action items. First-pass responses to routine customer email. The test: if it works, you feel it in your week. If it fails, you shrug and revert.

3. Timebox the security review and give it a decision date. Two weeks is plenty for a scoped pilot. Write down what data the AI will and won't touch. Start with data you'd be comfortable emailing to an outside contractor, because that's roughly what a vendor API is. The review ends with a written yes/no/not-this-data. Then you move. Concerns are valid. Deadlines make them useful.

4. Ship the pilot, then upgrade the relationship. Once the chat-window version of your use case works, take the next step the meetup room hadn't taken: give the AI standing context. That can start embarrassingly simple, a running document about your business that you paste in, or a folder of notes it can search. The goal is that it stops meeting you for the first time every morning. That's the step where "neat tool" starts becoming "coworker," and it's the step almost nobody in that room had taken.

5. Put a recurring hour on your calendar. The operators pulling ahead aren't smarter. They're in reps. One hour a week where you try to hand the AI something new from your plate. Some weeks it fails. The reps compound anyway.

Do this today, not someday

The 30-minute version:

• (5 min) Write down the three most repetitive hours in your week. Pick the one with the lowest stakes.
• (10 min) Do that task with an AI right now, badly. The point is contact, not perfection.
• (10 min) Write your two-sentence data rule: what the AI may see, what it may not. Put a decision date on anything you're unsure about.
• (5 min) Put the weekly hour on your calendar. Name it something you won't delete.

The people in that room are good at their jobs. In three years, the ones who started this quarter and the ones who kept evaluating will not be having the same career. Same goes for businesses. The pack hasn't moved. Move.

What's keeping you standing still: security, time, or not knowing where to start? Hit reply and tell me. I read every one.

— Justin