After AI, There Is No Cheap Software
26th October 2026 — I tweeted recently that given the widespread hacking incidents reported through Black October, the era of good enough software is over. It is now the era of enterprise software valuable enough to justify the effort of keeping it secure and running in the face of AI-empowered attackers.
On the night of 11 October, the freezers in hundreds of French supermarkets turned into ovens. The manager of an Intermarché supermarket near Dijon got a call at about four in the morning, drove in and opened his freezers. “There was no more cold,” he told NPR, “just hot air coming out.” Someone had got into the controllers that run the refrigeration and kept the defrost cycle running for hours.
Nobody needed AI for this one. The controllers sat on the open internet. Many were old models that their maker, Danfoss, had stopped supporting in 2016 and 2021, so there was no patch to apply. For years they were safe only because no attacker had bothered with them.
The supermarkets’ fridge controllers were a facilities purchase, and most enterprises still run their software the same way - as a cost centre with its own department, bought as cheaply as they can get away with. Software bought that way was always full of holes. Finding and closing them is the cleanup bill, and nobody paid it, because nobody was looking.
Now somebody is.
A CIO who doesn’t pay the cleanup bill will pay for the breach instead. The French supermarkets are paying both, for the food they lost that night and for new controllers in hundreds of stores. Intermarché has already warned that its insurance may not cover the loss.
I thought AI would make software cheaper. It has made software cheaper to write, and I assumed the cost of owning it would fall too. In practice, AI is orders of magnitude better at finding the holes in software than at building software without them, so the cost of owning software is going up. And it goes up most for whoever built or bought it cheapest. That’s most of what enterprises run, and it ran the fridges in France.
In theory, any software a business bought always had to be worth what it cost. Now it has to deliver, and deliver the way consumer software is judged, in short cycles, with continuous impact that is objectively demonstrable. Mere claims of utility don’t cut it any more, because every system a business runs is somewhere an attacker can get in, and that liability is now expensive in a way it never was before.
After AI, there is no cheap software, there is only valuable software.
Enterprise Software Operates on Sales-Market Fit
Enterprise software has historically run on sales-market fit, not product-market fit. Product-market fit isn’t just about engagement, it’s about value, and enterprise software is not held to the same standards as consumer apps, where one mistake and the customer churns. B2B vendors only ever paid lip service to adoption, because once the contract was signed, whether anyone used the software was somebody else’s problem. A lot of what enterprises bought ended up as shelfware, renewed every year and barely used.
Even where the core system is SAP or Oracle, most of what an enterprise runs is the software around it. There’s a vendor portal from 2014, the code three different contractors wrote to connect the systems to each other, a tool some business unit built for itself, and the controllers that facilities bought for the buildings. That’s where the cheap software is, and most of it was signed for by people who never used it.
Cheap software was never good software. Built or bought, most of it was written by good-enough developers at the going rate for good-enough work, which in outsourced services is roughly $30 an hour. Code written that way has more defects and is harder to change. And what was the alternative, anyway?
Most Software Was Safe Because Nobody Was Looking
Enterprises did pay to find out whether their software could be broken. They hired a chief information security officer, usually reporting to the CIO, and once a year or so brought in a pen test. A few outside experts spent a few weeks trying to break into whichever systems the enterprise had put in scope. Security leaders at large US companies told one survey they test on average just 32 percent of what an attacker could reach.
That was enough. Breaking into software took weeks of expert work, and the few who could pay for those weeks, mostly intelligence agencies and hostile states, spent them on targets worth the trouble. Jason Lemkin, who founded the SaaS conference SaaStr, quoted his former CTO on 23 October: “The only reason we haven’t been hacked is no one cares about us.” “True for so long,” Lemkin added.
If even a software company’s CTO believed that, the CIO of a retailer or a bank certainly did. The pen test only had to show that the important systems held, and the CIO decided which systems those were and accepted the risk on everything else. For twenty years, almost nothing came of that decision, until last week, when America’s biggest banks found AI agents inside their customers’ accounts.
A Working Exploit Now Costs Twenty Dollars
Lemkin’s post had a third line: “No longer true for … anyone.” A day earlier, a programmer who posts on X as Dabs had said why.
The machine is an AI model running in a loop. It guesses at a hole, writes code to get in through it, tries the code, checks for itself whether the code got in, and starts again if it fails.
That code is called an exploit, and a working one now costs about twenty dollars. In September Anthropic reported that GLM-5.3, a Chinese open model anyone can download, built a working exploit for known flaws in Chrome in eight hours, with twenty minutes of help from a person, for $20.40. The security firm GreyNoise saw hundreds of AI agents break into 395 organisations through their print servers. At one high school, the attacker went from getting in to controlling the whole network in seven minutes. At those prices, attackers no longer need to choose their targets.
In October, researchers using AI turned up holes that had sat unnoticed for years. eMudhra, an Indian company that issues the certificates browsers use to trust websites, says a flaw in its keys “went undetected for about 18 months, through two independent audit cycles.” The researcher who found it did so “reportedly with the help of AI-assisted tooling”. One of those keys, The Hindu reported, was just the number 4.
Researchers at the security firm Wiz used AI to turn old flaws in PHP into working attacks, and named them PHP2Shell. PHP is the programming language behind, in CNBC’s words, “just under 70% of all websites with known server-side programming languages”, WordPress and Wikipedia among them. A team at the security firm Tolmo built a working exploit in less than a day, a job that Tolmo’s Matt Suiche said would once have taken “multiple weeks”.
A yearly pen test checks the systems in scope for a few weeks, while an attacker’s loop can search everything an enterprise has on the internet, all year. That includes software the CIO never sees, like the fridge controllers facilities bought. A system doesn’t even need to be on the internet, as long as a vendor has a login to it. Attackers who broke into ConnectWise, an IT-management company, stole the logins it holds to its customers’ systems and then used AI agents to sign in to around 2,250 organisations, at almost 3,000 attempts a minute.
Nobody gets a warning first, either. Mandiant, the security firm Google owns, estimates that attackers now exploit a hole, on average, about seven days before a patch for it exists. When PHP2Shell went public, the security firm Artemis saw an attacker using a copy of the first published exploit within 30 minutes.
Cheaply Built Software Has the Most Holes to Close
Everyone agrees that defending against all this is going to cost a lot. Aaron Levie, who runs the cloud-storage company Box, wrote on 23 October that “years and years of legacy enterprise infrastructure will need to be upgraded”. What he doesn’t say is why the AI that finds the holes can’t bring that cost down, or what decided how big it is for any one enterprise.
An exploit either works or it doesn’t, which is why a machine can search for holes by the thousand. Closing a hole often means changing how the system is built, and no machine can check a design the way it checks an exploit. There’s no test that tells you whether the part of a program that shows data is kept apart from the part that stores it. So closing holes still needs people. Gergely Orosz, who writes The Pragmatic Engineer newsletter, thinks that’s where most of the money will go.
Greg Brockman, OpenAI’s president, says the company “took 25% of our production engineers and said, ‘Sorry, all your projects are on hold. You are now defending.’” The models were there “to find all the holes”, and the engineers were there for what he called “up-leveling our security architecture”. A tool can apply a patch that exists, but it can’t redesign a system whose hole is in its architecture. For the French fridge controllers, there was no patch at all.
The size of the bill for any one enterprise was decided by how well its software was built. Security is a requirement no user ever sees, so it was the first thing a cheap build left out. Wiz traced the PHP2Shell flaws to “key architecture decisions, some made over a decade ago”. Even PHP, which has a foundation behind it, had been working on the problem behind one of those flaws since 2024. Most of the cheap software an enterprise runs has nobody maintaining it at all.
An attacker needs only one hole. The defender has to close all of them, and only the defender pays to fix. Maintenance was a bill an enterprise could pay at its own pace, a little every year. The cleanup bill can also be paid one system at a time, but only until someone finds a hole in a system you haven’t got to yet. From then on, you’re paying for the breach.
Validating Software Will Cost More Than Writing It, and Will Be Worth It
By NIST’s estimate, finding and fixing the defects users run into already cost enterprises about 80 percent of what writing the code did. That’s before the liability when something goes wrong. Two of the French supermarkets lost €270,000 between them in one night. About 700 were hit, and the BBC reckons the total could run into the millions. Japan’s GMO Internet rented out Windows desktops in the cloud that traders ran their trading software on. Its CEO admits his security people had found problems with the service before hackers broke in. The hackers placed trades from customers’ accounts at more than 70 brokers, then demanded $50 million. GMO is covering the losses, and its shares fell almost 16 percent in a day, wiping out about $400 million. Badly built software can now take down the business that runs it.
Finding any one hole gets cheaper with every model. But every change anyone makes to the code now has to be checked for holes before it goes live. Every time a better model comes out, everything already running has to be checked again. OpenAI says it spent “hundreds of billions of tokens” attacking its own systems to find the holes first. As Brockman put it, “there will be a new model, there will be a new round.”
Anthropic said in May that security “used to be limited by how quickly we could find new vulnerabilities. Now it’s limited by how quickly we can verify, disclose, and patch” them. In six months of scanning widely used open-source software, its models turned up more than 29,000 possible holes, outside firms had worked through about 6,000 of them, and only 516 had been fixed. A parody account that writes as an enterprise IT manager summed up the PHP2Shell patch in a thread 58,000 people liked: “The emergency patch took four hours. Finding out what PHP actually runs took eleven.” The hardest part is finding people who can fix architecture.
The other way to pay is the breach, which IBM puts at a global average of $4.99 million. America’s SEC now wants listed companies to disclose a material breach within four business days. A breach doesn’t close the holes, so the enterprise still pays for the cleanup afterwards.
Help after a breach is also getting harder to buy. The Wall Street Journal reports that demand for emergency cyber response hit an all-time high through Black October. Sophos’s incident-response team handled seven major incidents in seven days, a workload that normally takes three months, and MoxFive says a newly breached company may wait up to five days for help.
Nobody has published how much validating software costs compared with writing it, and I’m not going to make up a multiple. An enterprise that built or bought its software on a shoestring now faces a cleanup bill far bigger than anything it planned for. The real number for any one enterprise comes from going through what it runs, one system at a time, and that is the CIO’s job from Monday morning.
Cheap Software Comes After the Cleanup
Most enterprises treated software as a cost centre, and that is why the cleanup bill is so big. A cost centre is judged on what it spends this year, so every system went to the cheapest bidder who could make it work. The security writer Bruce Schneier calls this “the problem of it being cheaper to be vulnerable than to be secure.” AI has turned that around: being vulnerable is now the expensive option, and a cost-centre budget never planned for it.
So software can’t be judged on what it costs any more, only on what it delivers. A consumer app is judged by the dopamine that keeps people opening it, and enterprise software by the budgets, KPIs and the promotions of the people who sign for it. In When the Models Get Better, Your TAM Should Go Up I said those consumer dynamics were already entering the enterprise. Now enterprises have no choice, because every system they run costs money to defend.
The obvious objection is that AI is making software so cheap to write that the cost will fall whatever it takes to defend it. When something gets dramatically cheaper to produce you get vastly more of it. But every new system is one more thing to defend. Schneier’s long-term bet is that AI will help defenders more than attackers, but in the short term, he says, “attackers benefit more because existing legacy code is vulnerable.” The short term lasts for as long as cheaply built software is still running.
Software gets cheap again only after two things happen in parallel. What an enterprise already runs has to be rebuilt or retired, and new software has to be built by people who can make it cheap to validate. Doing only one of them doesn’t bring the cost down, because new systems built cheaply have the same holes, and building new systems well does nothing for the old ones.
If I were the CIO, this is what I’d do on Monday.
- Retire the shelfware first. Nobody uses it, and it still has to be defended.
- Ask every vendor how they check their software for holes, and price the answer into the renewal, because the holes in bought software are on the CIO’s bill too.
- Go through what the enterprise runs, including what facilities bought, one system at a time. Work out what checking each one would cost, and decide whether to rebuild it, retire it or defend it. Retiring a system is the cheapest way there is to stop paying for its holes.
- Stop paying $30 an hour for good-enough work, whoever it comes from. I’ve argued why before, and the cleanup bill is one more reason.
Once the cleanup is done and the people building software can make it cheap to validate, software will get cheap again. Until then, there is no cheap software, there is only valuable software.
This essay is also on X. Join the discussion →.