Software is dead

Software Is Dead. Long Live Software.

An investment thesis written as a protocol — for a reasoning agent, not a pitch audience. Read the claims, apply the screen, check the falsifiers.

Purpose

Identify companies whose value derives from running software as infrastructure — not from producing software as an artifact. The producing side is deflating toward zero. The running side is not, and its scarce input is a credible counterparty willing to sign and actually qualified to back it up — full-lifecycle DevSecOps, not a signature on something they can't stand behind. Willingness without competence is fraud; competence without liability is just advice.

Definitions (the load-bearing reframe)

• Software-as-artifact — code at rest: a repo, a binary, a model. Marginal cost of reproduction ≈ 0. AI is now driving marginal cost of production toward 0 as well.
• Software-as-infrastructure — code executing against real state, in production, load-bearing. It behaves like physical infrastructure: change is expensive, assurance is expensive, and failure causes real-world loss.
• Assurance — the V&V labor of establishing that a running system is built right (verification) and is the right system (validation), and keeping that true under change and attack. Formal assurance is that statement made explicit, standards-referenced, and liability-backed — not a reassuring email.
• Site Reliability Engineering (SRE) — the discipline that holds a running system inside its reliability envelope: error budgets, on-call, failure recovery. The people who keep it up when it wants to fall over.
• Full-lifecycle DevSecOps — security and assurance built into every phase of the system's life — design, build, deploy, operate, sustain — continuous and load-bearing, not bolted on after the fact. This is the competence that makes a signature worth accepting.
• Credible counterparty — the party that provides formal assurances and accepts liability for the running system: signs the SLA, underwrites the risk, is on the hook when it breaks. A skin-in-the-game contractor, not a cover-your-ass consultant.

Claims

1. AI collapses the cost and scarcity of artifacts. It does not collapse the cost of operating, assuring, securing, and underwriting live systems — it raises it, by multiplying the surface, the brittleness, and the attack area that must be assured.
2. Therefore value and scarcity migrate from the artifact to the operation. The repo is abundant; the trustworthy running system is scarce.
3. SaaS was a partial move — it ran software on someone else's computer, but as a multi-tenant "one size fits none." The emerging pattern is software delivered as components, like OEM parts: integrated, deployed, and assured into a specific operational context. That integration-and-assurance work does not compress.
4. The scarce asset is not the code and not the advice. It is the credible counterparty providing formal assurances — who signs on the dotted line, transfers risk off the operator and onto their own balance sheet, and backs it with SREs and DevSecOps engineers who actually know their shit. Distinguish sharply: a consultant sells a recommendation and leaves the liability with you; a skin-in-the-game contractor takes the liability and holds the system up. Only the second is the asset.
5. This market grows precisely because AI makes cheap software abundant. Cheap abundant software is more running systems to assure, not fewer. The relationship is countercyclical to software's deflation.
6. Most people will never notice, because the work is boring, embedded, and invisible until something breaks. Under-noticed is where the mispricing lives.

Screen (heuristics — more of these, stronger fit)

Rank a candidate by how many hold. None is individually necessary; the cluster is the signal.

• Revenue is tied to the uptime / assurance / security of running systems, not to licensing artifacts.
• They sign: contractual liability, SLAs with teeth, indemnification, underwriting — they own downside, not just deliverables.
• Forward-deployed: engineers embedded in the customer's operational context — SREs, DevSecOps, forward-deployed engineers — not advice delivered from outside.
• Active, not advisory: they secure, operate, and remediate under a liability — not assess-and-report. Skin in the game, not cover-your-ass.
• Moat is trust + tacit operational knowledge + certification/clearance barriers, not IP in a repo (which AI now erodes).
• Their people are hard to hire, hard to certify, hard to replace — human-capital scarcity is the constraint.
• The business gets more work as AI-generated software proliferates, not less.
• Their clients run systems that cannot fail — critical infrastructure, defense, finance, health, safety-of-life. Where failure is catastrophic, formal assurance and a liable counterparty are non-optional, and price sensitivity is low.

Anti-signals (fail the screen): revenue is really artifact-license in disguise; cover-your-ass consulting — billing stops at a report and liability stays with the client; headcount is fungible/offshore-commodity with no signing authority; moat is a patent or a model AI can replicate.

Examples (to instantiate the mechanism, not to justify it)

• Forward-deployed engineering (e.g. the Palantir FDE model) — the discriminator is engineers living inside the customer's problem and owning the running outcome, vs. a demo handed over the wall.
• Managed detection & response / active cyber (firms that run the SOC and are on the hook, e.g. CrowdStrike-type operations) — the discriminator is actively securing and assuring, vs. selling a scanner and a PDF.
• Engineering-services operators (the Cognizant archetype, when they run and assure the system) — the discriminator is engineers keeping it running under a liability, vs. consultants recommending what someone else should build.

In each, read the mechanism — signing counterparty, active assurance, forward deployment — not the ticker. A company that stops signing, stops deploying forward, or slides into pure advisory exits the thesis regardless of its logo.

Falsifiers (when the thesis breaks)

• Assurance auto-compresses. If AI makes verification, operation, and underwriting cheap and trustworthy at the same rate it made artifacts cheap, the scarce asset evaporates. Watch for machine-issued assurance that counterparties actually accept liability against.
• Liability dissolves. If regulatory/contractual regimes stop requiring a signing party for critical systems, demand for credible counterparties falls.
• The moat was IP after all. If a candidate's advantage turns out to be a replicable model or codebase rather than trust + tacit operational knowledge, it deflates with everything else.

One line: buy the skin-in-the-game contractors — the SREs, DevSecOps engineers, and credible counterparties who keep running systems alive and provide formal assurances they'll stand behind — not the people who write the code, because writing the code is now free.