Embedded Files
March 17, 2026
The prior post introduced the phrase “Festine Lente”, or “make haste slowly” in the context of making intentional engineering compromises and business tradeoffs. This feels the opposite of how many view software business in terms of “move fast and break things.”
Artificial intelligence is pitched as the answer.
It may be a "deus ex machina" moment. A trite plot device is reused and supposed to resolve an otherwise difficult situation, if only we temporarily suspend disbelief. As in literature, resorting to some almost magical answer reflects a lack of creativity and tenacity in its overly simplistic proponents.
Placing faith in AI does not absolve secure supply chains of issues. AI may be part of an intentional and careful approach, but the answer is mundane and boils down to the notion of due diligence.
Recklessly unquestioning faith can't be the answer to a complex problem.
Awareness
Awareness
My past co-worker Allan Friedman recently noted, “You can’t defend what you don’t know about.” This was in response to discussions on the need to scour software systems for and remediate the presence of Anthropic tooling following that company being labeled a supply chain risk.
This is an interesting case, as a previous post here noted that an upstream open source provider or a commercial vendor might revoke your access to software upon which you depend. The situation with the US Pentagon declaration shows a downstream consumer of your product can wield similar power over your business by declaring that a particular component must not be in anything they consume.
If you don’t have the basic situational awareness that would be demonstrated by a comprehensive software bill of materials (SBOM), your business will struggle to efficiently resolve such a demand.
Wisdom
Wisdom
If awareness is a present-moment perception of something, knowledge then is the accumulation of such points of awareness toward broader understanding. As understanding grows towards actionability, wisdom represents the application of knowledge.
As Allan rightly points out, the importance of navigating that potential ordeal of search and remediation is currently lost in the public discourse behind superficial questions of “is Anthropic bad”. Substitute any vendor or component for “Anthropic” and substitute any objective or subjective assessment criteria for “good/bad” and we have the generalized business challenge: Comprehensive control of the software supply chain in the face of even arbitrary decisions and constraints.
But how? Could AI give a path to both rapid development and comprehensive knowledge of the software internals?
It really is a simple problem statement though:
You can’t maintain systems you don’t understand.
Worse, for the simple capitalist, is that understanding is a continually recurring expense. If you’re not putting enough of your ARR toward covering that debt long term, you’re asking for surprises disrupting your business down the line.
Artifice
Artifice
Even worse is the current trend of divesting in understanding. The hope is that robots will be able to do the work to synthesize understanding on demand and do it almost for free very soon now.
But hope is not engineering. And hope is not wisdom.
The robots are both amazing and amazingly limited. And they are quite expensive when your business must carry their full cost without the extensive subsidies from venture capitalists and stock and bond markets which are present today. The model capabilities may improve quickly. Prices are less likely to.
Ceding the development and maintenance of complex systems to the machines doesn’t meaningfully change the problem. Unless the machines are very, very good, then external understanding will still be needed. Unless the machines are very, very inexpensive, then the machines will still represent a notable and recurring expense.
The combination of all of this means costly business disruptions are quite predictable going forward in the abstract even if on the surface each might feel surprising and different. Root cause will repeatedly be willfully insufficient engineering understanding of the systems on which the business depends.
Insurers, regulators, and consumers will also react to these disruptions predictably.
Need advice on navigating AI in your software supply chain? Reach out to start a conversation on how intentional engineering sustains business value.
Page updated
Report abuse