听Barry S. Honig听
History teaches us that technological innovation frequently comes from small companies. Of course, once their products gain widespread market adoption, small companies subsequently grow to be larger companies, and even sometimes become a 鈥渦nicorn.鈥� A unicorn is a company with a market valuation of one billion dollars or more. But with the advent of AI development tools like Anthropic鈥檚 Claude Code and OpenAI鈥檚 Codex, many savvy technology investors are recognizing that the next unicorn company could not only mean a company with a greater than one billion dollar market valuation, but also could redefine it to mean a company that only has one-employee.听
These savvy investors correctly believe that powerful AI-based development, marketing, and sales tools can empower an individual to create, market, and sell a product that could become popular enough to command a one-billion-dollar valuation. Even if the prospect of a one-person unicorn company seems like a bit of a reach, it is almost certain that a unicorn company with fewer than ten employees will emerge soon. Consider the fact that Facebook, now Meta, purchased Instagram for approximately one billion dollars in 2012, when Instagram had only 13 employees. This was years before the modern AI coding and marketing tools available today existed.听
To be clear, there are risks associated with doing business with startups. However, if medium and large businesses restrict themselves from doing business with innovative startups, they risk missing out on important technological advances and losing their competitive advantage. This is why it is important for medium and large businesses to know how to assess and manage the risk of doing business with a small innovative software vendor.听
Let鈥檚 now consider some of the key risk factors that should be evaluated before engaging with a small, AI-first software vendor.
Financial Stability
One of the primary concerns for any medium or large company is that the startup it is working with could lose its funding and go out of business. When I worked at Morgan Stanley in the financial services industry more than thirty years ago, we faced this exact problem. We wanted to work with smaller companies because we knew they often had the latest and greatest technology, which could give us a competitive edge. At the same time, we had to protect the firm from becoming dependent on a vendor鈥檚 technology, only to have that vendor go out of business.听
We addressed this risk by requiring that the smaller company place its code base in escrow, subject to specific terms that would release the code to us if certain events occurred, such as the company filing for bankruptcy or defaulting on a loan.听
Today, companies should consider going beyond traditional source-code escrow. They should also consider securing access to the AI development environment used to build the software, such as Claude Code, along with the relevant instructions, prompts, chat history, technical documentation, and Q/A tests used to develop and validate the product. The specific materials and access rights would need to be clearly defined in the escrow agreement.听
In the age of AI, in one sense, larger companies can have greater confidence in their ability to continue using AI-generated, or 鈥渧ibe-coded,鈥� software because tools like Claude can help their own technical teams or third-party consultants maintain, troubleshoot, and enhance the product, even if the original vendor is no longer in business. The key is to ensure that the purchaser has the legal rights, technical access, and documentation necessary to do so and to continue to effectively use the software.听
Quality Assurance Testing (Q/A)
It is essential for a software purchaser to understand the type of Q/A performed on a vendor鈥檚 product so that it can be confident the software will perform as advertised in a live production environment.听
Here again, LLMs are incredibly useful and powerful tools that software vendors should be using. Claude Code and Codex offer extensive automated testing capabilities. They can generate tests for newly developed code, execute those tests, identify bugs, and help correct problems through iterative testing and refinement.听
These tools also enable Q/A engineers to use AI to develop additional tests that address edge cases that the original development process might not have considered. The important point is that the vendor should be able to demonstrate a disciplined testing process, including automated testing, independent review where appropriate, and testing under realistic production conditions. AI can significantly accelerate software development and testing, but the purchaser still needs evidence that the finished product is reliable.听
Customer Support
With the advent of chatbots and human-like avatars that can communicate with customers and answer questions in a natural manner, it is now possible for a small company to provide a substantial level of customer support with only a few people.听
Clearly, for mission-critical applications, a medium or large purchaser will also want to ensure that responsive human support is available when needed. The purchaser should听understand the vendor鈥檚 support arrangements, including response times, escalation procedures, and the availability of qualified personnel to address problems that AI-powered support tools cannot resolve.听
Ability to Quickly Respond to Bug Reports and Customer Requests for New Features
To properly assess whether a vendor can address this risk, the purchasing company should interview the vendor鈥檚 engineers and product managers or, at a minimum, review their resumes to verify that they have substantial experience developing the type of system being offered.听
This verification is particularly important in the age of AI. Although AI coding agents can generate large amounts of code quickly, the quality of the final product still depends heavily on the people directing the development process. The purchaser should have confidence that the senior product managers designing the system and the senior engineers orchestrating the various AI coding agents have the experience and technical judgment necessary to build, maintain, and enhance a fit-for-purpose product.听
Ultimately, the question is not simply how many engineers the vendor employs, but whether the people leading the development process have the expertise to use AI effectively and deliver a product that meets the purchaser鈥檚 requirements. A small team of experienced professionals using AI effectively may be able to respond to customer needs much faster than a substantially larger traditional development team.听
Customer References
It is, of course, essential to check a vendor鈥檚 customer references to understand the experiences of its existing customers. Purchasers should ask about the product鈥檚 reliability, the vendor鈥檚 responsiveness, the quality of customer support, and the vendor鈥檚 ability to deliver on its commitments.听
In cases where your company might be the first or second customer to use the product, there may be an opportunity to negotiate favorable commercial terms in exchange for being an early adopter. Depending on the circumstances, this could include a discounted price, additional support commitments, or even an equity stake in the vendor.听
We pursued these types of opportunities at Morgan Stanley, and they frequently paid significant dividends. Not only did we gain access to new technology, but we also had the opportunity to participate in promising investment opportunities at an early stage. For companies willing to take a calculated risk, working with an emerging software vendor can provide both a competitive advantage and an attractive economic opportunity.听
Cybersecurity
Given the cybersecurity threats facing businesses today, it is essential for a software purchaser to verify that its vendor takes cybersecurity seriously. This includes understanding the vendor鈥檚 security development practices and determining whether it听uses AI tools to scan its code base for vulnerabilities, identify potential weaknesses, and test the security of the finished product.听
Vendors should also consider using AI-powered tools, including emerging autonomous security-testing systems, to attempt to identify and exploit vulnerabilities in their own software before malicious actors do. The goal is to use AI not only to develop software faster, but also to make that software more secure.听
Remember, AI tools can be used either to attack systems maliciously or to conduct authorized penetration testing. Security teams have used a variety of approaches to simulate attacks and defend against them for many years. One commonly used concept is red-team and blue-team testing. The red team simulates attacks to identify vulnerabilities, while the blue team focuses on defending the system, detecting threats, and correcting weaknesses.
Today, AI agents can play a significant role in both activities. For example, one AI model, like Claude, could be tasked with identifying vulnerabilities in an application, while another, such as Codex or Kimi, could independently analyze the findings, simulate potential attacks in an authorized test environment, or help develop and validate fixes. By using multiple AI models, a company may be able to identify weaknesses that a single model might miss.听
The purchaser should, of course, verify that the vendor鈥檚 security testing is comprehensive and that identified vulnerabilities are addressed. AI-powered security tools are valuable, but they should complement, rather than replace, sound security architecture, access controls, human oversight, and independent security assessments where appropriate.听
Conclusion听
If these steps are followed, medium and large companies can work more confidently with small, innovative, AI-first software providers while managing the risks associated with doing so. The objective should not be to avoid small vendors simply because they have limited staff or financial resources. Rather, it should be to understand the risks, put appropriate safeguards in place, and take advantage of the tremendous innovations that these companies can offer.听
In the age of AI, the size of a software company is becoming a less reliable indicator of its ability to develop and deliver powerful technology. Companies that recognize this shift and learn how to evaluate and manage the associated risks will be better positioned to benefit from the next generation of technological innovation. Companies that are afraid to and restrict themselves from doing business with such software vendors, do so at the risk of sacrificing their own competitive advantage.听