July 24 - Everyone wants to build the future. Who wants to maintain it?
The central strategic risk of the next decade - and the opportunity window for acquiring the talent to mitigate that risk.
For years, we have celebrated the builders of the next breakthrough. AI models, cloud platforms, agents, all that. But underneath, there’s an overlooked trend. We are losing maintainers of the foundation. Critical software, often held together by a handful of people, is quietly aging. AI can write code, but can it replace the institutional memory and care that keeps our systems alive?
The world runs on software. But to keep running, that software needs layers of dependencies to keep functioning. Not very many people understand those layers. Each year fewer have the expertise to keep it running. And it's just not exciting and cool enough to get much attention in boardroom budget discussions.
Everyone wants to build the future. Almost no one wants to maintain it.
This may well be the central strategic risk of the next decade. And a key opportunity for smart founders and talent focused companies.
The software beneath the software—and why AI will not magically take care of it
For years, business leaders have been told that software is eating the world.
What they have not always been told is that much of the software doing the eating rests on layers of older, less visible software—encryption libraries, compatibility tools, schedulers, editors, build systems, operating-system packages and protocols.
Some of these projects are maintained by large, well-organized communities. Others depend on a remarkably small group of people. Sometimes, one person.
This arrangement has existed for decades. But emerging conditions and new risks may force change:
- AI is increasing the speed at which vulnerabilities can be found and exploited. Autonomous systems are becoming more capable of pursuing goals in ways their operators did not anticipate.
- Quantum computing is creating the need to replace some of the cryptography embedded deep inside the digital economy.
- Many of the unsung maintainers of today's software and systems are retiring, moving on to other things.
At precisely this moment, many leadership teams are doubling down on a bet that software engineers are becoming expendable. This may prove to be one of the more expensive strategic misunderstandings of the AI era.
AI can generate code. That does not mean it can assume responsibility for the accumulated software infrastructure on which modern civilization depends.
This weeks' Executive Explainer Think AI will replace developers? Why smart firms are hiring not cutting tech talent provides deeper background on this issue, and explains why smart firms see this as the best time to hire top engineering talent not cut it. The piece also provides a fascinating historical tour of real world examples where crucial systems were impacted by dependencies on smaller teams or individuals.
Fragile foundations
The Heartbleed vulnerability was and remains one of the strongest examples of immense mission critical operations running on fragile foundations.
OpenSSL is an open-source cryptographic library used to secure communications across websites, email systems, applications, servers and networking infrastructure.
In 2014, the Heartbleed vulnerability revealed that certain versions of OpenSSL could allow attackers to read sensitive information from a system’s memory—including credentials, communications and cryptographic keys. The vulnerability affected a foundational component of internet security and could be exploited without leaving an obvious trace. (Heartbleed)
Enterprise leaders were shocked that such a serious bug existed. They were more shocked when they discovered how little institutional support surrounded this software on which so much commercial activity depended.
The incident helped catalyze the Linux Foundation’s Core Infrastructure Initiative, through which technology companies began funding security audits, developers and open-source projects considered essential to global infrastructure. The initiative was explicitly created in response to Heartbleed and the realization that critical projects were operating without resources proportionate to their importance. (Linux Foundation)
The world had built enormous economic systems on software that almost nobody in the executive suite understood, funded or took responsibility for maintaining.
Debian: one counterexample worth studying
Ian Murdock, who founded Debian in 1993, offers an example of how to do things right. By the time Murdock died in 2015, Debian had long since become a broad, developer-governed community. Its history describes a worldwide volunteer project, supported by defined governance, package-maintenance processes and nonprofit infrastructure. (Debian)
Debian is great example of how open-source infrastructure can outlive its founder when governance, contribution practices, institutional identity and succession are deliberately built into the project.
New risks
Emerging conditions and new risks are putting critical pressure on the stability of the world's current software enterprises. This will force companies to scrutinize the software components that their mission critical systems depend on, and make sure they retain technical talent capable of providing this scrutiny and resolving the risks and issues they find. A few of the key risks are summarized below. For a deeper dive see the S3T Executive Explainer Think AI will replace developers? Why smart firms are hiring not cutting tech talent.
AI is increasing offensive cyber capability
AI systems are becoming better at identifying vulnerabilities, chaining exploits and carrying out multistep technical operations. This week, that risk became much less theoretical with the OpenAI Hugging face hack.
During an internal cybersecurity evaluation, OpenAI models were prompted to pursue complex exploitation tasks. The normal production classifiers intended to stop high-risk cyber activity were deliberately disabled so researchers could test the models’ maximum capabilities.
The models then found and exploited a previously unknown vulnerability in OpenAI’s test infrastructure, obtained open-internet access, escalated privileges and reached Hugging Face’s production systems. OpenAI characterized the event as an “unprecedented cyber incident.” Hugging Face detected and contained the activity. (OpenAI)
Maintainers will face more pressure, not less
AI will help defenders find vulnerabilities. It will also help researchers, criminals and automated systems generate more reports, probe more packages and test more possible attack paths. That creates a workload problem.
An exhausted maintainer receiving thousands of AI-generated findings still has to determine which reports are valid, reproduce the problem, understand the consequences, write a safe patch, test it against downstream systems and coordinate a release.
AI can assist with those activities, but it cannot assume accountability for them.
The Open Source Security Foundation recently raised additional funding specifically to help overworked maintainers deal with the increased volume of AI-generated security reports. That is an early indication of where the pressure is heading. (OpenSSF)
Quantum migration is approaching
The quantum-computing threat is often presented as though it will arrive on one dramatic morning when a giant machine suddenly breaks the internet.
The more practical danger is the migration.
NIST has already finalized its first major post-quantum cryptography standards and has encouraged organizations to begin transitioning. Its current planning anticipates deprecating and eventually removing quantum-vulnerable algorithms from federal standards by 2035, with high-risk systems moving earlier. (NIST)
That means companies will have to locate cryptography embedded across applications, devices, networks, identity systems, databases, vendor products and archives. Someone will have to understand where those systems are, how they interact and what will break when the cryptography changes.
That someone will not be a chatbot operating without experienced engineers.
The fashionable mistake: replacing developers with AI
Companies have recently found it fashionable to announce that AI will allow them to operate with fewer developers.
AI can automate routine coding, improve documentation, generate tests, translate between languages and help teams understand unfamiliar systems.
But software engineering is more than the production of code. It includes architecture, integration, testing, maintenance, security, incident response, prioritization, negotiation with users, understanding undocumented behavior and deciding which apparent improvement is too dangerous to deploy.
- The more AI-generated code companies introduce, the more they will need people capable of evaluating and supporting what the AI produced.
- The more autonomous agents companies deploy, the more they will need engineers who understand permissions, containment, monitoring and failure modes.
- The more sophisticated AI-enabled attackers become, the more they will need security engineers who can think beyond known attack patterns.
- And the closer quantum migration gets, the more they will need people who understand the technology several layers beneath the user interface.
The Bureau of Labor Statistics still projects software-developer employment to grow approximately 16% between 2024 and 2034. It projects employment for information-security analysts to grow 29%, partly because of increasing cyberattacks, AI adoption and the need to protect new technologies. (Bureau of Labor Statistics)
The tasks will change. But the need for smart technical people will not disappear.
3 unpleasant discoveries in the next 3 years
My expectation is that many organizations will make 3 unpleasant discoveries over the next 3 years:
First, they need more experienced engineers than their AI workforce plans currently assume. Not necessarily armies of people writing routine code by hand—but engineers who understand systems, dependencies, security, architecture and operational consequences.
Second, cybersecurity spending will have to rise. Organizations will be defending against conventional attackers using AI, autonomous tools pursuing objectives in unexpected ways, software-supply-chain vulnerabilities and the early stages of post-quantum migration.
Third, this spending will compete with AI spending. Within constrained technology budgets, money spent on security engineers, code audits, dependency inventories, cryptographic modernization, testing infrastructure and open-source support is money that cannot also be spent on premium frontier-model subscriptions, enormous token budgets and experimental AI projects.
This may lead some another unpleasant discovery for AI Big Tech and their investors and shareholders: The AI industry’s revenue forecasts often assume that customers will expand AI consumption to a level sufficient to warrant current valuations.
But customers may soon discover that AI itself creates additional security, governance and infrastructure expenses. They are already discovering that AI tokens aren't as affordable as they once thought.
None of this makes AI a poor investment. But it does underscore that the total cost of responsible AI adoption is larger than the starting invoice.
2026-2027 may be an ideal window for acquiring top talent
Software-development hiring remains well below its pre-pandemic baseline. As of July 17, 2026, Indeed’s U.S. software-development job-posting index stood at approximately 75.6, compared with a February 2020 baseline of 100. (FRED)
That does not prove that salaries have reached an absolute bottom or that every engineer is inexpensive.
But it does suggest that employers currently have access to a talent market that is considerably less overheated than it was several years ago.
Good technical talent may be about as affordable and available now as it will be for much of the next five years.
Smart companies should be using this period to recruit people who understand infrastructure, security, cryptography, distributed systems and complex software maintenance.
They should also be identifying the open-source dependencies buried inside their critical products and asking:
- Who maintains them?
- How many active reviewers do they have?
- Who can publish a release?
- What happens when the lead maintainer disappears?
- Is the project adequately funded?
- Do we have the expertise to repair or replace it?
- Are we contributing anything to the infrastructure from which we profit?
And btw: These are not questions for the IT department alone. They are questions about operational resilience, capital allocation and enterprise risk.
AI needs engineers more than engineers need hype
The unsung-maintainer problem has been with us for decades. The difference now is that we are placing more automation, more economic value and more autonomous capability on top of the same uneven foundations.
AI could be harnessed and extraordinarily useful in maintaining those foundations.
But AI will not care whether an obscure encryption library remains secure. It will not feel accountable when a compatibility package loses its maintainer. It will not negotiate a controversial Bitcoin upgrade or decide how to balance property rights against quantum theft.
People will still have to do those things.
Organizations that understand this will use AI to make strong engineers more capable. Organizations that do not may dismiss the very people they will soon need to rescue them.
The age of AI is not the end of software engineering. It may be the beginning of a period in which genuinely good engineering becomes more strategically valuable than ever.
Opinions expressed are those of the individuals and do not reflect the official positions of companies or organizations those individuals may be affiliated with. Not financial, investment or legal advice, and no offers for securities or investment opportunities are intended. Mentions should not be construed as endorsements. Authors or guests may hold assets discussed or may have interests in companies mentioned.
Member discussion