A recent discussion among a group of CTOs turned to AI and whether the SaaSpocalypse is real: the idea that companies will stop buying software because their own AI-accelerated engineers can now build whatever they need. The CTO of a large financial services company summed up where he stands:
"We have a large engineering org, and with AI making everyone so much more efficient, I'm honestly looking for more that they can do. So yeah, we're assessing our entire SaaS portfolio and plan to replace many of them with tools customized to our needs. But there are still a few things that I want to outsource, and risk is top of that list."
He runs more engineers than most benefits companies will ever hire, AI is making every one of them faster, and his response is to insource an entire SaaS portfolio. If anyone can afford to own everything, it's him. And risk still tops his outsource list.
Every tech leader is running that same build-vs-buy math right now, and build is winning a lot more than it used to. But as I wrote in a prior post, build is still only half the story: the build cost collapsed, but the ownership cost didn't move. When you're dealing with sensitive data, risk is the heaviest piece of that ownership cost, and it stays the same size no matter how fast you build. If anything, AI has increased risk for many companies as more powerful models identify new exploits daily.
There are still a few things that I want to outsource, and risk is top of that list.
Situation Normal, All Fed Up
One day at a prior company, our alerts started going off like crazy. The latest eligibility file from a client was about to terminate most of that employer's population because existing employees weren't on the file. We stopped the load and dug into the data and found that an eligibility file from a different employer had ended up in this employer's load folder.
The load process added new employees first, so by the time the mass terminations tripped the alarms, tens of thousands of "new employees" from the wrong company were already in the database. The stop "worked as designed," but the damage was already done.
We carefully removed the pile of records that didn't belong to that employer. Then came the harder part: finding the employees who had genuinely changed jobs and did work for this employer, but whose records now carried the other employer's old data. And finally, the excruciating part: we notified both employers of what was technically a PII breach, even though we caught the cross-pollination and cleaned it up before anyone saw it.
When you own the pipeline, you own the blast radius.
Every safeguard did its job that day. The alarms fired, the load stopped, the data was clean again in hours. But it was still a breach, with notification letters going to two clients (and their lawyers). When you own the pipeline, you own the blast radius.
And that pipeline came from a team whose entire job was moving benefits data, with validation thresholds, load-order rules, and alarms tuned by people who had watched files go wrong for years. A pipeline you assemble in a few AI-generated hours has whatever checks someone remembered to ask for. Would yours have stopped that file before the terminations ran? Would it have even been noticed before your clients started calling?
Shift the risk, lift the worry
So put risk at the top of your own outsource list and watch what comes off your plate.
Start with the raw files. When feeds flow to the Data Nexus instead of your servers, original files full of PHI stop landing on your infrastructure. A whole class of exposure, including a medium-risk attack vector, moves off your systems. A wrong file can't land in your load folder when you don't have one.
Your claims exposure shrinks too. Full PHI stays on our infrastructure, and you pull only de-identified data into the downstream systems that never needed identity in the first place. Your analytics stack doesn't need to be a radioactive PHI stockpile.
The Data Nexus also minimizes data exposure by design: it only sends an employee's eligibility to a downstream partner after they enroll the employee. That's HIPAA minimum necessary running as pipeline behavior, with the policy language to match.
Put risk at the top of your own outsource list and watch what comes off your plate.
SOC 2 Type 2 comes included. Buying your own first one runs $30-50K+ and takes three to six months, much of it your senior engineers' time. Ours is done, we renew it every year, and BAA coverage and audit trails come along with it.
If a breach ever happens on our systems, the liability and the work to fix it stay with us as the data processor. Notifying your clients is your job, but now you have an experienced partner to help (or blame, if that helps, too!). In practice you'll still pull some PII into your own systems to serve employees. But that footprint is small, you choose every field in it, and you control its blast radius.
My CTO friend is already making two calls: one to his engineering team and one to the SaaS vendors he's replacing. But when it comes to sensitive data, he's making another call: "Here, you take this."
Sometimes the best risk strategy is to give it to the experts.
