How software acquirers assess AI disruption risk in a target

What counts as AI disruption risk in a software target?#

AI disruption risk in a software target is the chance that models, agents or an AI-native competitor take over the work customers pay the product to do, or shrink the number of seats they pay for. The substitute may not be another vertical product at all: it can be a general assistant that drafts the same document, or an agent that works across several systems at once.

The useful question for an acquirer is narrower than whether the target uses AI. It is which part of the customer's job the product owns, and whether that part survives when drafting, searching and summarizing become cheap. A product can ship impressive AI features and still sit in the most exposed layer of the workflow.

Risk also differs inside one product. A field service platform's dispatch board and payment flow may be durable while its report builder is exposed, so the rubric scores the modules that carry revenue, not the logo.

The five-factor scoring rubric#

The five-factor rubric rates a target on system-of-record depth, regulatory complexity, seat exposure, workflow ownership and proprietary operating records. Rate each factor low, medium or high risk and attach one sentence of evidence, so the score can be debated on facts rather than instinct.

Buy-and-hold acquirers usually weight system-of-record depth and workflow ownership most heavily, because those two decide whether customers can leave at all. Seat exposure matters most where revenue is priced per user.

Why system-of-record depth carries the most weight#

System-of-record depth carries the most weight because AI tends to attack the layer above the record, not the record itself. An agent can draft a change order, triage a claim or summarize an inspection, but it still needs a trusted place to write the approved result, attach the signature and keep the audit trail.

A common mistake is to read heavy daily usage as record ownership. A reporting tool can be open on every screen all day and still be optional if the data lives in the customer's ERP. Two tests help: which system would the customer restore first after an outage, and which system would an auditor or regulator ask to see.

How to test seat exposure in the revenue base#

Seat exposure is tested by mapping each paid seat to the task its user performs. Pull seat counts by role from the billing system, not from the CIM, and sort roles into those whose work is mainly drafting, data entry, triage or lookup, and those who approve, dispatch, inspect or sign.

If most revenue comes from per-seat pricing on the first group, the target faces seat compression at renewal or a forced repricing. A pricing move to locations, assets or transactions that is already under way, with renewal evidence, is a real mitigant.

• 1Seat counts by role and customer segment, exported from billing.
• 2Net seat change at each renewal over recent cycles.
• 3Revenue split between per-seat and per-location, per-asset or per-transaction pricing.
• 4Any AI add-on already priced, and how customers responded to it.
• 5Contract terms that let customers reduce seats mid-term.

Proprietary operating records: moat and option#

Proprietary operating records lower disruption risk when the product holds linked history a new entrant could not reconstruct, such as years of inspection results tied to equipment, failures and repairs. That history lets the target build features grounded in how its customers actually work, which a general assistant cannot copy.

The same records can matter outside the product. TechCrunch reported in September 2025 that AI labs are demanding more reinforcement-learning environments, simulated workspaces where agents train on multistep tasks, and real workflow histories can help developers design and evaluate that kind of work. That gives well-documented records a possible second use, subject to rights, but it should not be counted as revenue in the investment case.

Score this factor favorably only when rights are documented. Most records in a vertical product are governed by customer agreements, so read the aggregated-data and usage-data clauses, the privacy policy and any data processing agreements before treating customer records as an asset.

Illustrative: two targets, one rubric#

Illustrative: a fictional software holding group is weighing two targets. The first runs dispatch, impound inventory, release paperwork and payments for towing operators, with more than a decade of linked call, vehicle and release records. The second is a proposal-writing tool for engineering firms that pulls past project descriptions from shared drives and drafts qualification packages, priced per user.

The towing product scores low risk on record depth, regulation and workflow ownership, and medium on seats because dispatchers are licensed per user. The proposal tool scores high on seats and workflow, since one person drafts alone, and high on records because the content stays in the customer's drives. The group proceeds with the towing product, adds a diligence workstream on customer data terms, and passes on the proposal tool at the asking price.

Putting the score in the investment memo#

The disruption score belongs in the investment memo as its own page beside retention, pricing and leverage, not as a footnote in the technology section. Bain's 2026 midyear private equity report calls AI one of the industry's most important value-creation levers and says inaction has become a strategic choice, so the memo should state both the score and what the post-close plan does about each high rating.

Keep the evidence file with the score. When an AI-native competitor starts winning deals or a pricing migration lands, the portfolio team can rescore one factor and show exactly what changed.

How SourceX looks at the records factor#

SourceX does not score acquisitions or advise on price; it helps owners of operating records understand whether specific record families can be licensed to AI developers. The SourceX Enterprise Data Value Framework, a SourceX methodology rather than an industry standard, rates records on uniqueness, domain expertise, human-generated signal, scale, recency, data cleanliness, rights and AI utility, with reproducibility reducing value, which maps closely onto the records factor.

When a portfolio company chooses to proceed, the SourceX five-step transaction runs Supply, Rights, Preparation, Approval and Delivery for that company alone. Nothing is shared during the initial assessment, and the supplier approves every step.