BPC Thought Piece

Your CIO or head of risk just called to tell you that the software category is at major risk of disruption from all things AI. What is the best framework to have in place to understand what exposure you might have in your portfolio?

In June of 2025, we published a deck on the vulnerability of the enterprise software ecosystem to an emerging category of native AI and AI enabled competitors (we are happy to send this along). It’s critical to understand that AI isn’t going to destroy the software ecosystem, but it will redistribute the economics. While this topic is again in the spotlight, it isn’t new, and in fact we have been through at least 4 of these transitions in software over the past 35 years… mainframe to client server (mid 90s), migration to internet based software (early 2000s), mobile apps (2005), and migration to cloud based apps (2010s). The reality is that in software, product lifecycles are generally 10-20 years. If you consider the software leaders at the end of each decade since 1990, there is tremendous change over the following 10 years and we will see this exact same phenomenon with AI.

AI is not an extinction event for existing software. Demand for intelligent workflows, process automation, and data infrastructure will continue to increase. But AI is reshaping where economic power resides within the software stack. Some layers that have not evolved and serve simply as a store of information will see an erosion of their economics. Others - particularly those that control the who, what, when and how (the workflow ownership) will capture a disproportionate share of the upside. Think of these as “orchestration tools” - this will be the next generation of software leaders.

The ecosystem survives… the economics migrate.

That said, here is our guidance as to how to evaluate your exposure:

1. Get fluent in the orchestration layer and control plane displacement: Understand whether your software investments a) operate at the level where decisions are made, b) trigger, manage and orchestrate workflows, c) set priorities and d) tell other enterprise systems what to do next. The risk for many software companies is that they may cease to be the layer that decides what happens, when and how. An example: Today, most CRM platforms are information repositories for customer information and dialogue. The control plane will move to an orchestration layer where AI and software agents will decide who to contact, when and through what channel. The AI will decide what to offer and on what terms. It will manage all workflows and trigger the complete customer buying experience. This is precisely what happened to Siebel (repository for customer data) when it gave way to Salesforce (workflow for managing customer engagement). ServiceNow’s success at the expense of BMC, and the hyperscalers success against VMware are also good examples of control plane shifts. Evaluate the breadth of functions, integrations, users and workflows the software enables. The broader and more integrated, the more it could serve as a control point for agents.

2. Is the architecture AI-ready or technically constrained? The Achilles heel of so many software companies is going to be antiquated architectures that make the adoption of AI difficult. Monolithic architectures, complex data models, stored procedures and lack of real-time access all serve as critical barriers to an AI agenda. Conversely, modular architecture with an API-first approach and real-time data access allows a company to embrace the AI opportunity. You need to ask - can the product expose safe, permissioned “actions” (“APIs”) with clear authorization boundaries while offering traceability (log, audit, and replay of agent actions) for compliance and auditability? Can it provide real-time data and eventing to support agent workflows that require fresh state?

3. Get the metrics that likely matter: a) number of users of product, frequency of use, b) essence of value proposition (is there demonstrable ROI?), c) percentage of R&D budget allocated to the AI agenda, d) quantification of tech debt (supporting multiple platforms, legacy code bases, weak dev ops processes), e) connectivity to other enterprise systems, f) financial leverage - high debt balances means capital goes to servicing the balance sheet instead of driving the AI agenda. As new AI and agentic systems are built, new metrics like “autonomous resolution rate”, i.e. number of tasks completed without human intervention, demonstrate the true ROI of the platform.

4. Look to leading indicators, not lagging ones: Look at turnover in the engineering organization and the salesforce - are people leaving for competing AI companies? Are the cadences of the new business pipeline changing (sales cycles getting longer)? Either might suggest competitors are gaining mindshare. Get an analysis of customer service tickets - significant bug fixes, performance issues and customer requests for new features and functionalities are all good indications of vulnerability. Are customers pushing back on price increases or other renewal terms including duration of contracts? Is there a change in competitive losses, and if so to whom? We consider changes in gross retention to be lagging indicator - by the time it shows up there it may be too late.

5. What percent of your capital is in “category creating” companies vs. companies that are defending a set of features? AI compresses feature differentiation. Exposure to companies that create new capabilities, drive automation, replace business processes and reduce friction through machine learning and AI offer compelling value propositions that enterprises embrace. Software companies that are “greenfield” in nature are much less vulnerable to AI disruption.

6. Is the software’s stickiness driven by real value - or just friction? AI agents can disintermediate products whose moat is steep learning curves or complex UIs by abstracting the UX and operating via APIs. AI also lowers technical switching costs: modern models are strong at mapping messy legacy schemas and writing migration code, making “rip and replace” less risky than before. Evaluate defensibility based on structural moats - mission criticality, proprietary data gravity, deep integrations with other enterprise systems and regulatory or compliance constraints that general purpose AI can’t easily replicate or bypass.

7. Rapid consolidations and roll-ups are likely more vulnerable: Companies that are the result of numerous acquisitions with significant debt balances often result in large numbers of products and multiple code bases to support. It also creates more complex and costly customer success efforts. Supporting multiple platforms with competing priorities will distract from the AI-first agenda. High quality VC firms will continue to aggressively fund start-ups that seek to disrupt these large, legacy incumbent providers that will be slow to innovate.

8. Evaluate your software portfolio against the cost of workflow failure: AI models are inherently probabilistic (prone to hallucinations), while legacy software is deterministic (100% precise). In low-stakes workflows (e.g. drafting, front-end of the hiring process, marketing copy, generic ticket routing, top-of-funnel sales), the ROI of AI-driven labor savings vastly outweighs the minor cost of occasional area errors, making these areas highly vulnerable to rapid disruption. Conversely, in mission critical processes (e.g., payroll, tax, clinical compliance, reconciling core ledgers), enterprises have zero tolerance for false positives. Software governing these deterministic domains are less prone to disruption in the short to medium term; buyers will always prioritize guaranteed accuracy and auditability over the theoretical ROI of an autonomous AI agent.

9. Cyber/information security, trust and governance are good places to have capital against: There is little doubt that the proliferation of AI is going to lead to an increased number and level of sophistication of cyber-attacks, deep-fakes and new types of users (autonomous agents) to compromise. Emerging AI capabilities greatly empower bad actors. Expect enterprise investment in next-generation cyber, identity and AI governance tools to increase over time.

10. Deep vertical market, regulatory, and compliance related companies should perform better through the front end of the AI wave: Domain-specific companies bring deep expertise in areas that are difficult for general purpose models to replicate. In addition, zero risk of failure mindsets in enterprise customers creates a more formidable short-term moat and provides an opportunity for existing vendors to build out meaningful AI capabilities.

The AI technology transformation is going to re-allocate value in a significant way. Companies that have the right leadership, technological foundations and needed capital can continue to be successful. Companies that choose not to defend their existing platform and instead focus on controlling the decision layer will be well positioned to prosper in the AI world.

We hope this serves as a helpful piece to understand what incumbent software providers need to be doing to ensure their future success. We look forward to hearing your thoughts.