Two new insights, two synthesis patterns updated, one new operator. One meta-theme ran through both: surface-level matching fails where depth is needed. Shreyas Doshi names it for strategy. Anthropic names it for security.
Theme 1, Customer evidence before the first framework
Shreyas Doshi's May 16 essay compresses a widespread consulting failure into seven words: "The truth is one level down. Always." The failure is reaching for a framework before gathering specific customer evidence. A team can run a positioning offsite, debate platform vs. point solution, build a 2x2, and walk out with nothing falsifiable about an actual customer's frustration. The debate felt rigorous. It required no evidence.
Doshi's gate is simple: three specific customers with specific frustrations, one falsifiable differentiation bet, one piece of evidence. Not a framework summary. Not a category description. Three stories. The intake forces the specificity that framework debates make optional. Three customer stories beat every strategic framework because the truth is always one level down adds this to Diagnose before executing, refuse the playbook ask, where it joins Push past expert opinion until you reach the actual law of physics or contract and Refuse the playbook ask, run DATE: Diagnose, Analyze, Take a different path, Experiment as another named form of the same discipline: refuse the playbook until you've earned the evidence.
"Do you actually know what your customers need, can you conceive real differentiation in the face of stiff competition, and can you build that?"
- Shreyas Doshi, Three customer stories beat every strategic framework because the truth is always one level down. Customer specificity is the intake gate before any framework work begins.
Theme 2, Data flow tracing over pattern matching
Anthropic's Claude Security entered public beta in May 2026, powered by Opus 4.7. The differentiator is not model size. It's the scanning method. Pattern-matching scanners check for known vulnerability shapes: SQLi, XSS, hardcoded secrets. Business logic flaws have no known shape. They emerge from how data moves through specific system paths. A scanner that traces data flows follows the path a real attacker would follow, surfacing errors that are specific to that codebase and have no entry in any rulebook.
Anthropic reports hundreds of organizations used Claude Security to fix production vulnerabilities that existing tools had missed for years. The principle mirrors what Doshi names in strategy: going one level deeper than the surface match. Security scanning via data flow tracing finds business logic flaws that pattern-matching tools miss for years extends Verification, not execution, is the irreplaceable human job with a specific instance where AI surfaces findings and humans approve fixes before anything ships.
- Anthropic, Security scanning via data flow tracing finds business logic flaws that pattern-matching tools miss for years. Scanning by tracing data flows catches business logic flaws that pattern-matching tools miss for years.