Should a company build its AI systems or buy them?
Goal Boss answers that one workflow at a time. Some work is best done by a product the company buys. Some needs a system built on the company's own data. A good share of it needs a product with a built layer on top.
The assessment report recommends one of the three for each opportunity it names, and Goal Boss delivers whichever one the company chooses.
Three possible answers
What the report recommends for each opportunity
- Buy a product, and Goal Boss integrates it
- Goal Boss builds the system
- Buy the standard part, and Goal Boss builds the rest
How the choice gets made
When a product already does the job
Buy
A workflow that looks the same at every company in an industry usually has a product built for it, and the vendor has already paid for the security work and the regulatory upkeep. The company buys it. Goal Boss configures it to how the experts work, connects it to the company's data, and gets it into daily use.
When no product fits
Build
Some work is specific to how one company's senior people get results, and that work is often the reason its clients stay. Either no product covers it, or the product would force the company to change the process that sets it apart. Will Pemble builds that system on the company's own data, from how its experts do the work.
When a product covers part of the work
Both
A product often handles the standard part of a workflow and stops short of what this company does differently. The company buys the product, and Goal Boss builds the layer that sits on top of it, so the experts work in one place.
The route Goal Boss advises against
Having the company's own staff build it
A system the business depends on every day needs an engineer who has run production systems, a security review, and one person accountable when it breaks. Few companies of 100 to 2,000 people have that person with time to spare. Goal Boss builds the system itself and trains the managers to run it.
What the research says
AI has made custom software cheaper and faster to build, and companies have started building what they used to buy. Code written by AI still needs a security review, and internal builds reach daily use about half as often as builds done with a partner.
32%
of respondents to McKinsey's 2026 global survey say their organization decided against buying at least one software product or feature because it could build the same thing in-house with agentic coding tools. The survey drew 1,719 responses from 97 countries.
McKinsey, The state of AI in 2026, August 25, 202654%
of SaaS licenses are in use at the average organization. Zylo puts the cost of the unused 46% at $19.8 million a year.
Zylo, 2026 SaaS Management Index45%
of the time, generative AI models chose the insecure way to write code when a secure way was available. Veracode tested more than 100 models on 80 coding tasks.
Veracode, 2025 GenAI Code Security Report, July 30, 2025In MIT NANDA's 2025 sample, customized tools built with an outside partner reached deployment about 67% of the time, compared with about 33% for tools built internally.
The report drew on 52 interviews and 153 survey responses, and its authors describe the figures as directionally accurate. It shows a correlation and does not prove that the partner caused the result.
MIT NANDA, The GenAI Divide: State of AI in Business 2025, July 2025The result depends on adoption either way
A bought product and a built system fail the same way. The software works, nobody redesigns the job around it, and usage stays flat.
Every sprint therefore runs the same four steps whichever route it takes. Goal Boss measures a baseline in week one, puts the system in place, gets managers using it before their teams, and reports the result against the baseline in week thirteen.
On both routes Goal Boss works to SOC 2 standards and penetration-tests what it builds and connects before it goes live. Goal Boss does not perform SOC 2 audits, which stay with the company's auditor.
A sample report that buys and builds
The sample assessment report covers an insurance claims administrator. It names five opportunities for improvement and recommends buying two, building two, and auditing one before any money is spent on it. The 90-day plan takes two of the five: a record review product that the company buys and Goal Boss configures, and a system for drafting large-loss reports that Goal Boss builds.
Questions about building and buying
- Is it faster to buy than to build?
- Not by much anymore. In the sample 90-day plan, configuring the bought product takes weeks 3 to 7 and building the second system takes weeks 7 to 11.
- Can one sprint include a product and a build?
- Yes. A sprint takes one or two of the five opportunities in the assessment report, and they can be one of each.
- How is security handled?
- Goal Boss builds to SOC 2 standards and runs its own penetration tests before a system goes live. It does not perform SOC 2 audits, which stay with the company's auditor.
- Who owns a system Goal Boss builds?
- The company owns every system Goal Boss builds for it.
- Who maintains it after the sprint?
- The company chooses. It can take a maintenance contract with Goal Boss, use another vendor that Goal Boss recommends, or have its own team maintain the system, in which case Goal Boss trains that team on it.
- What if the company only wants the recommendation?
- The assessment report stands on its own. It names five opportunities for improvement, recommends buying or building each one, and belongs to the company whether or not Goal Boss does any of the work.
Start with the assessment
One week on site produces the five opportunities and a recommendation to buy or build each one.
