AI, Cloud, and Biotech Are Now Defense Infrastructure. Here's What That Means for Your Strategy

If your firm touches AI, cloud, biotech, advanced materials, or logistics, you are in the defense stack. The only question is whether you know it.

For most of the postwar era, dual-use was a narrow classification that applied to a specific set of technologies: certain chemicals, certain materials, certain encryption standards, certain categories of machinery. The list was maintained by specialized compliance teams, and most firms never touched it.

That list has expanded dramatically, and the expansion is accelerating. Frontier AI models are dual-use. Large-scale cloud compute is dual-use. Synthetic biology platforms are dual-use. Advanced materials for batteries and magnets are dual-use. Logistics networks that can move cargo at scale under contested conditions are dual-use. Satellite imagery, geospatial analytics, and even certain categories of consumer data are being pulled into the classification. The line between commercial and defense infrastructure is no longer a line. It is a gradient, and most firms are closer to the defense end than they realize.

This is not a temporary condition. It is a structural change in how governments think about national capacity. And it means that firms that built themselves as purely commercial enterprises now have to make a strategic decision they did not anticipate having to make.

Lean in, firewall, or exit

There are three coherent responses to finding oneself in the dual-use zone. Each is legitimate. None of them is the default of doing nothing.

The first is to lean in. Accept that the firm's core capability is strategically relevant, build the internal infrastructure to operate under export controls and security clearances, and pursue government customers as a deliberate line of business. This is the path taken by a small number of AI labs, cloud providers, and defense-adjacent hardware firms. It is lucrative and it is durable, but it requires a rebuild of the firm's compliance, hiring, and partnership functions that most commercial companies are not structured to execute.

The second is to firewall. Continue to serve commercial customers, but deliberately architect the firm so that the dual-use exposure is isolated, controllable, and does not contaminate the rest of the business. This requires real discipline. It means saying no to some customers, some partnerships, and some product features that would otherwise be attractive. It is the hardest path to execute because it asks the firm to constrain itself voluntarily, in the absence of an immediate regulatory reason to do so.

The third is to exit. Divest the dual-use exposure, refocus the firm on parts of the value chain that are clearly commercial, and accept the valuation consequences. This is rarely the first choice, but it is sometimes the right one, particularly for firms whose leadership and ownership structure cannot credibly operate under the scrutiny that comes with the first two paths.

The error is not in choosing any of these. The error is in failing to choose, and allowing the firm to drift into a posture that satisfies none of them.

Why this is a dC/dt question

The reason this matters now is that the rate at which categories are being reclassified as dual-use is accelerating. A firm can be purely commercial in one quarter and implicitly strategic in the next, based on an export control update, a partner jurisdiction's new rule, or a single large government contract that brings with it a set of obligations the firm was not built to carry.

The firms that navigate this well are the ones that are having the conversation. They know which of their capabilities are likely to be reclassified, they have made a provisional choice about how they would respond, and they have a small number of people inside the firm whose job it is to monitor the boundary and update the choice. The firms that navigate this badly are the ones that will discover their status through a letter from a regulator, a question from a journalist, or a major customer abruptly walking away.

The conversation is straightforward. It is necessary. And in a world where the boundary of the defense stack is moving faster than most firms can perceive, having had it once is the difference between a strategic choice and a reactive one.

Which category is your firm in, and who inside the firm is responsible for the answer?