The discount and the bill

There is a number making the rounds these days, in analysts’ presentations and in fund notes, and it is rather striking when brought down to the scale of a single day. The five largest U.S. technology groups have announced, for 2026, infrastructure investments of between six hundred sixty and six hundred ninety billion dollars, against roughly three hundred eighty the year before. Divided by the days of the year, that comes to just under two billion dollars a day: data centers, accelerators, energy contracts, land. No industry, in peacetime, has ever spent at this pace to build a productive capacity whose end customer it does not yet know with any precision.

Italy, in its own small way, is following the same curve. The Artificial Intelligence Observatory of the Politecnico di Milano measured, for 2025, an artificial intelligence market of one billion eight hundred million euros, up fifty percent on the year before; Anitec-Assinform, with a narrower perimeter, arrives at one billion three hundred eighty million, up forty-seven point six percent. The two figures do not match, and it is worth saying so at once, because the associations count different things; but they describe the same slope. Seventy-one percent of large companies have launched at least one project, and eighty-four percent have bought licenses for at least one generative tool. Among small companies, however, experimentation drops to seven percent.

The thesis of this piece is that the software market today finds itself between two risks, symmetrical and equally concrete. The first is the risk of those who stay as they are: the traditional software house, with overhead and pricing models designed for an era in which writing code was the expensive part, an era that no longer protects it. The second is the risk of those who believe they have found the shortcut: assisted do-it-yourself, vibe coding, which moves the cost from the estimate to the maintenance and hides it until it becomes an emergency. Neither of the two is the answer. The answer is a new structure, a light one, but with the skills inside it that both models are losing: design, analysis, implementation, security, privacy.

A return that this time has to be proven

The difference from earlier waves of technology investment lies not in the figure but in the patience. The cloud, ten years ago, was adopted for years on the strength of promises of flexibility that were hard to quantify. Artificial intelligence, by contrast, arrives at a moment when boards of directors have learned their lesson and ask for a measurable return within the fiscal year: productivity per employee, lower operating costs, cycle times. The same Politecnico Observatory reports that fifty-eight percent of companies with a project under way see a significant impact on their business model; which means, read the other way around, that four in ten do not see one yet.

This demand for a quick return is the key to understanding everything that follows. Where the benefit has to materialize in a hurry, the strongest temptation is not to invest more: it is to pay less. And the market, obligingly, has set about offering ways to pay less. The first risk arises from those who can no longer get themselves paid; the second from those who believe they need not pay at all.

The first risk: the model that is aging

For thirty years a software house sold, at bottom, one thing only: the ability to turn a slow, manual process into a fast, automatic one. It was a competitive advantage because it was scarce. It took analysts, developers, months of work; those who had them sold at a high price, those who did not, bought.

Artificial intelligence makes exactly that ability abundant. Automating is no longer a differentiator; it is the minimum condition for staying at the table. A consequence follows that many players find hard to accept: value shifts from doing to deciding what to do, from the function to the meaning the function produces for whoever uses it. Software that offers nothing but basic automation is drained of perceived value with a speed that did not exist before, because the customer knows, or believes he knows, that he could get it elsewhere at a fraction of the price.

The risks for those who stand still are at least four, and they add up. The first is the erosion of pricing power: the ability to defend a subscription fee wears away when the customer perceives an alternative at almost no cost, and the financial markets, which usually arrive late but arrive in force, priced this in at the beginning of this year. Between February and March 2026 the listed software sector lost, according to the reconstructions of Forbes and of several research firms, more than a trillion dollars in market capitalization; the sector index fell by about a fifth, and Salesforce stock, to name just one, by more than a quarter. The market has christened the phenomenon the SaaSpocalypse, and the underlying logic is brutal: if one agent does the work of five people, the company buys one license instead of five. The second risk is the lowering of barriers to entry: a new competitor gets to a presentable product in weeks, and the customer himself can try to build the software on his own. The third is the obsolescence of the technical base: the accelerators on which this infrastructure runs have replacement cycles of a few years, the architectures that rest on them age along with them, and those who do not upgrade lose competitiveness while those who do upgrade bear a recurring cost that the old price lists did not provide for. The fourth, the most insidious, is shadow AI: the customer’s employees using artificial intelligence tools outside any company rule, and in doing so hollowing out the official software from within, carrying processes and data to places where no one governs them.

An organization with headcount sized for writing code, fees that are hard to defend, and release cycles designed for technologies that lasted ten years does not withstand this pressure for long. That is not a moral judgment; it is arithmetic.

The second risk: the vibe coding discount

The term was coined by Andrej Karpathy, formerly director of artificial intelligence at Tesla and one of the founders of OpenAI, in a post dated February 2, 2025: you describe out loud what you want, you accept the code the model proposes without reading it, you correct by trial and error until it seems to work. Karpathy presented it as an amusement for weekend prototypes. Within a year it had become a budget line.

The reason lies entirely in the demand for a quick return described above. Vibe coding offers a cost reduction that is not real but perceived, and the difference between the two adjectives is the whole question. Perceived, because what one sees is the cost of producing the first version, which really does collapse: an internal management system, a customer portal, an integration between two systems, everything seems to cost a fraction of what it used to. Not real, because the cost of software has never been the cost of writing it. It is the cost of keeping it standing for the years in which the company works on top of it, of changing it when the regulations change, of defending it when someone attacks it, of understanding it when the person who made it is no longer around.

On each of these items the available data are less reassuring than the initial discount would suggest. Veracode, which has been testing the security of code for twenty years, published in March 2026 the update to its study of generated code: across more than one hundred fifty models and eighty programming tasks, in forty-five percent of cases the model introduces a known vulnerability. The figure is identical to that of two years earlier. Two years of models presented as revolutionary have moved the security rate from about fifty-five percent to about fifty-five percent. METR, an independent lab, measured in 2025 that experienced developers, working on code they knew, took nineteen percent longer with artificial intelligence tools, while remaining convinced they were going faster.

Bear in mind that those numbers concern professionals who read the code. Vibe coding, by definition, is practiced by those who do not read it, or would not know how to. This is the point that makes the risk greatest precisely for those who adopt it inside a company in the belief that they are saving money: an unstable product, because no one knows its structure; an attack surface that no one has inspected; a maintenance cost that explodes at the first serious change, because every intervention requires reconstructing an understanding that never existed; and, beneath all this, a lack of experience and of professionalism that the model does not make up for, because the model answers the question it is asked, and those without the craft do not know which question to ask. The same development work, handed at a later stage to someone who knows how to do it, often costs more than if it had been done well from the start, because the redoing comes on top of the undoing.

There is, moreover, an item that never appears in do-it-yourself estimates, and that is data protection. Those who build by trial and error do not design where personal data are stored, which data pass through the model, on what legal basis, for how long. IBM, in its 2025 annual report on the cost of data breaches, found that sixty-three percent of organizations have no artificial intelligence governance policy whatsoever, and that a high level of shadow AI adds on average six hundred seventy thousand dollars to the cost of a breach. Homemade vibe coding is, in this respect, the same shadow AI that weakens the traditional software houses, with the addition of an artifact that remains, that processes data, and that someone will have to answer to a supervisory authority for having designed without knowing it.

A note of caution

It would be wrong to conclude from this that traditional software is doomed, or that artificial intelligence in development is a mistake. Neither is true.

On the first point, the established vendors of management, accounting, and customer relationship systems retain advantages that no model replicates on its own: regulatory compliance built up over years of updates, proven reliability, a far-reaching distribution network, trust in the brand. The risk of replacement is concrete for simple tasks and overestimated for mission-critical systems, and the more sober analyses of the stock market decline say so clearly: the survivors are those who make complex processes work and demonstrate a return far greater than their fee. The moat, as the analysts call it, has not disappeared; it has moved higher up, to where security, compliance, and accountability reside.

On the second point, those who maintain that assisted code generation is an irreversible advance are right. Veracode’s data measure raw code, before any review; in the hands of someone who can read what the model produces, the same technology shortens timelines and raises quality. The problem is not the tool; it is the illusion that the tool replaces the craft instead of multiplying it. The thesis of this piece is not that we should go back: it is that the discount is visible at once and the bill arrives later, and that the two must be set down on the same sheet of paper before signing.

What changes, then

If the diagnosis is correct, the two risks have the same root and the same cure. The traditional software house is at risk because its structure is too heavy for the value the market grants it; assisted do-it-yourself is at risk because its structure is too light for the responsibilities it takes on. In between there is not a compromise but a different form: a structure that is modern in its costs and its timelines, that uses models as building material, but that keeps intact the skills the market is taking for granted at the very moment it is losing them.

There are five of them, and they should be named one by one because it is on each of them that do-it-yourself fails. Design, meaning deciding what to build and what not to, before writing a single line. Analysis, meaning understanding the customer’s process better than the customer understands it, which is the part no model does on its own because no model knows which question to ask. Implementation, meaning building in such a way that the system withstands the first serious change and the hundredth. Security, meaning reading and verifying what is generated, given that almost half of that code arrives with a known flaw. And privacy, meaning designing from day one where the data live, who touches them and why, instead of finding out at the first request from an authority.

It is on this form that AYXZA is being built. It does not have the costs of the old model because it does not have its structure; it does not have the risks of vibe coding because it does not share its premise, namely that software is finished when it seems to work. It is likely that in the coming years the distinction between those who build and those who assemble will become the most important dividing line in the industry, far more than the one between large and small. The companies that buy software will do so, more and more, on the basis of a single question: who answers when it breaks. The discount, by then, will already have been spent.

https://www.ayxza.com/