Two Stories That Cost Real Money
I watched a software consultant cost me a store and a customer on ShopSnap. The consultant was charming. The customer was convinced. The decision was Shopify. The reason was not technical, not commercial, not strategic. The reason was that the consultant only knew Shopify and did not bother to look at ShopSnap at all. They sold what they could ship. The customer paid for a gap in the consultant’s resume, not a gap in their business.
A few months later I watched another consulting firm insist that an enterprise system had to be built on Next.js instead of .NET 10. They were polished. They were confident. They had developers on tap. They also had no real answer for the things .NET 10 does better than Next.js for an enterprise workload: strong typing across the entire stack, mature dependency injection, first-class identity and authorization, native background services and gRPC, decades of compliance patterns baked into the runtime, and a deployment story that runs the same code from container-native cloud down to an on-prem, AD-joined Windows server in a regulated data center. None of that came up. What came up was their bench.
These are not edge cases. They are the consulting model working exactly as designed. The dirty truth nobody puts in the SOW is this: a consultant’s technical recommendation is almost never about the best fit for your business. It is about the best fit for theirs.
Consultants Are Not Fiduciaries
In law and finance there is a concept that protects clients from this kind of self-dealing: fiduciary duty. A fiduciary is legally required to act in your interest, not theirs. A lawyer in a regulated jurisdiction, a registered investment advisor, a board member of a corporation — they all carry it. Break the duty and there are real consequences.
Software consultants do not have one. There is no licensing body, no oath, no enforceable rulebook, no professional code that says they must recommend the technology that is actually best for you. The only thing constraining them is contract law, marketing, and the hope of repeat business. That is a very loose leash, and the entire industry has organized itself around it.
Even in industries where fiduciary obligations exist, the consulting model strains them. Investment consulting firms that started as performance reporters in the 1970s and 1980s drifted into recommending products that, conveniently, only they could implement. The pattern is universal: once a firm sells advice and execution, the advice will eventually be shaped by the execution. The recommendation that wins is the one that funds the next invoice.
In software the conflict is not even subtle. A consultancy with a 40-person Next.js practice will recommend Next.js. A shop with a stable of Shopify-certified developers will recommend Shopify. A boutique that does nothing but Salesforce implementations will hear your problem and, miraculously, conclude that the solution is Salesforce. Tell them you are evaluating a different platform and watch the body language change. They are not lying. They are doing exactly what their business model rewards them for doing.
The Hertz Lesson: $32 Million for a Website That Never Shipped
If you want a case study in what happens when a customer trusts the sales pitch and stops asking questions, read the Hertz v. Accenture complaint. Hertz hired Accenture in 2016 to design, build, test, and deploy a new website and mobile apps. The go-live date was December 2017. It slipped to January 2018. It slipped again to April 2018. It missed that too. By May 2018, Hertz terminated the engagement, having paid Accenture more than $32 million for software that, per the lawsuit, was never delivered as a functional website or mobile app.
The complaint is brutal reading. Accenture allegedly failed to follow Java standards. They wrote code so brand-specific that it could not be reused for Hertz’s Dollar and Thrifty brands, despite contractual extensibility requirements. They ignored a responsive-design specification and then demanded hundreds of thousands of dollars in additional fees to deliver the medium-sized layout the contract already required. Code quality was poor enough to constitute a security risk. And after blowing the deadline by five months, Accenture asked for another $10 million on top of the $32 million already paid to finish the project.
Hertz’s mistake was not unique. They were so impressed by the sales presentation that they let Accenture function as the product owner as well as the implementer. Once that happened, every architectural decision, every scope clarification, and every quality gate sat on the same side of the table. The customer had no internal advocate. The consultant scored their own homework, and they kept giving themselves A’s while the building burned.
The number that should haunt every executive signing an SOW is not $32 million. It is $0 — the value of the deliverable Hertz actually received.
A Pattern, Not a Bug
It is tempting to file Hertz under “bad luck” or “wrong vendor.” It is more accurate to file it under “standard outcome of an industry without fiduciary duty.” The receipts go back decades and across sectors.
McKinsey paid roughly $600 million in 2021 to settle investigations into its role advising Purdue Pharma on how to “turbocharge” OxyContin sales while simultaneously advising the FDA, which regulated those same opioid manufacturers. In 2024 the firm reached a separate $650 million deferred prosecution agreement with the U.S. Department of Justice over the same opioid work. McKinsey also advised U.S. Immigration and Customs Enforcement on detention budget cuts (suggesting savings on food and medical care for detainees) while running 64 federal contracts and, in the same year, 137 projects in Saudi Arabia. Swissair famously hired McKinsey for a growth strategy and was steered into a stake-buying spree across regional carriers that helped drive the airline to bankruptcy.
Boston Consulting Group has been criticized for working multiple clients in the same industry and tilting recommendations between them. PwC blew up its own reputation in Australia over tax-advice leaks. KPMG was caught in the Gupta state-capture scandal in South Africa. The names rotate. The structural problem does not. Whenever a firm makes more money by selling you a particular answer, the question quietly bends to fit that answer.
The recommendation that wins is the one that funds the next invoice.
The Vendor Who Wears a Consultant Costume
There is a more polished version of the same conflict, and it is everywhere in B2B software. Vendors increasingly offer “stack audits” or “architecture reviews” as front-door services. They show up neutral, take a careful inventory of what you run, and produce a slick PDF. Then — surprise — the optimal stack happens to include their product, their partner’s product, and a multi-year implementation services contract with them at the helm.
Salesforce, Marketo, and similar platforms run partner ecosystems in which integrators earn commissions, tier status, and co-marketing dollars for steering customers onto specific products. None of this is illegal. Most of it is not even hidden. But it shapes every recommendation. If your consultant’s firm hits a Platinum tier by booking $2 million of platform licenses for you this year, you should assume that tier influenced their slides before they ever walked into your conference room.
The cure is not paranoia. The cure is to ask the question out loud: “What commissions, rebates, partner-tier benefits, referral fees, or co-marketing arrangements does your firm receive from any vendor you are recommending here?” If the answer takes more than ten seconds, the answer is yes.
Enter Vibe Coding: The Margin Your Consultant Is Not Telling You About
Everything I have written so far has been true for thirty years. What changed in the last twenty-four months is the size of the margin a consulting firm can quietly pocket between what they bill you and what their developers actually produce. The lever is AI-assisted development, and at its worst it goes by the name Andrej Karpathy coined in February 2025: vibe coding.
Vibe coding is the practice of describing what you want to an AI agent in plain English and accepting whatever it ships back, with little or no human review of the resulting code. As a prototyping tool in a developer’s own sandbox it is wonderful. As the production pipeline for an enterprise system you are paying senior consulting rates for, it is a slow-motion disaster.
And it is happening to you whether you know it or not. Consultancies have every incentive to lean on AI generation as hard as possible: it lets a junior bill at a senior rate, it lets one developer cover three projects, and it widens the gap between contract value and labor cost into something that looks more like a software-product margin than a services margin. The customer rarely sees the difference — until production.
The 45% Number You Need to Memorize
In 2025, Veracode published its GenAI Code Security Report, the most comprehensive study of its kind to date. The researchers tested more than 100 large language models across 80 carefully designed real-world coding tasks. They were not looking for whether the AI could produce code that compiled. They were looking for whether the code it produced was safe to deploy.
The headline number: 45% of AI-generated code samples failed security tests and introduced vulnerabilities from the OWASP Top 10 — the canonical list of the most dangerous web application security risks. Cross-site scripting was particularly brutal, with only 12 to 13 percent of generated code coming out safe. SQL injection, command injection, broken authentication, broken access control — the classics — showed up at industrial scale.
Java was the worst, with a 72% security failure rate. Python, C#, and JavaScript were better but still alarming. And the update Veracode released in October 2025 contained the finding nobody in the industry wants to talk about: the newer, larger frontier models from Anthropic, Google, OpenAI, xAI, and Qwen, released between July and October 2025, showed no meaningful security improvement. Some regressed. The pass rates for Claude Sonnet 4.5 and Claude Opus 4.1 actually dropped versus their predecessors. You do not get out of this problem by waiting for a better model.
This is not the only data point. Checkmarx independently reported up to 70% insecure code from AI assistants. New York University and the BaxBench benchmark found 40 to 62 percent of AI-generated code contained security flaws. The numbers cluster around “roughly half.” Roughly half of the code your charming consultant is shipping you, if they are relying on AI without rigorous review, has a security flaw waiting to be exploited.
The Receipts: Real Breaches in Real Vibe-Coded Apps
If statistics feel abstract, the case studies do not. In July 2025 Wiz researchers found an authentication bypass on Base44, a popular vibe-coding platform owned by Wix. The flaw required only basic API knowledge to exploit. It granted unauthenticated access to any private application on the platform — which, by the time of disclosure, was hosting internal chatbots, knowledge bases, HR systems, and applications handling personally identifiable information for enterprise customers. The fix took 24 hours. The exposure window was much longer.
CVE-2025-54135, nicknamed CurXecute, allowed attackers to make the popular AI coding tool Cursor execute arbitrary commands on a developer’s machine. CVE-2025-54136, nicknamed MCPoison, lets an attacker poison the Model Context Protocol server configuration of an AI coding agent to establish persistent code execution that survives IDE restarts. CVE-2025-59944 was a case-sensitivity bypass in Cursor that, combined with MCPoison, allowed attackers to defeat file-write protections entirely. These are not abstract academic findings. They are CVEs with patches and exploits.
Escape.tech ran a large-scale scan of 5,600 publicly deployed vibe-coded applications across Lovable, Bolt.new, and Base44. They found 2,000 highly critical vulnerabilities, 400 exposed secrets including API keys and access tokens, and 175 instances of leaked PII — medical records, payment data, the works. A December 2025 study by Tenzai tested five major AI coding agents on the same task: build a URL preview feature. Every single one of them — five out of five — silently introduced a server-side request forgery vulnerability. One hundred percent. The same flaw class that lets an attacker pivot from a customer-facing web form into your cloud metadata service and walk out with credentials.
And then there is slopsquatting, the supply-chain attack that exists because AI hallucinations about package names turn out to be deterministic and reproducible. Attackers scan AI output for invented package names, register those names on npm and PyPI, and wait for the next victim to copy-paste an install command. Socket.dev found more than 205,000 unique hallucinated package names across 576,000 code samples. The malicious huggingface-cli package alone was downloaded more than 30,000 times before anyone noticed.
This is the production environment your consultant’s slide deck does not contain a single slide about.
Why Charm Is Their Most Reliable Weapon
A consulting firm’s top-of-funnel job is not engineering. It is persuasion. The people who walk into your boardroom are selected for the same skills that make a great trial lawyer or a great political operative: composure under pressure, the ability to read a room, the ability to take a hostile question and turn it into a moment of warmth. The senior partner who closed your deal probably has not written production code in fifteen years. The team that will actually staff your project is two or three rungs down the seniority ladder, and you will not meet them until the contract is signed.
Browser London, analyzing the Hertz case, identified the most important single failure mode: the customer was so impressed by the pitch that they handed product ownership over to the consultancy. Once that happens, you have outsourced not just the work but the judgment about whether the work is correct. The fox is not just guarding the henhouse — the fox is also the chicken inspector, the lock manufacturer, and the auditor of last resort.
The defense is unglamorous and a little uncomfortable. You have to do the homework yourself, or pay someone whose only job is to do it on your behalf and who has no skin in the implementation contract. That is the closest thing to a fiduciary you can buy in this industry.
The Customer’s Defense: Doing the Research They Will Not
You do not need to become a software architect to avoid being fleeced. You need to do three things consultants count on most customers not doing: research, structured comparison, and direct questioning.
Research: spend a weekend reading. For any technical recommendation you are about to accept, identify at least two credible alternatives that the consulting firm did not propose. If they pitched Next.js for an enterprise system, force yourself to read about .NET 10, Java with Spring Boot, and Django. If they pitched Shopify, look at WooCommerce, BigCommerce, Magento, and yes, smaller specialized platforms like ShopSnap. Not to become an expert, but to learn the questions. If the consultancy cannot articulate, in plain English, the specific reasons their recommendation beats the alternatives for your specific workload, then they are not recommending. They are selling.
Structured comparison: insist that every shortlisted vendor structure their proposal the same way. Same scope categories. Same effort breakdown. Same assumptions section. Same risk register. When proposals do not line up apples-to-apples, the gaps between them are where the surprise invoices live. A consultancy that resists structured comparison is telling you something important about how they intend to price the back half of the engagement.
Direct questioning: ask uncomfortable questions in writing, and demand written answers. “Who specifically will be on this project? Full names, seniority levels, location. Will the people in this pitch meeting be doing the work?” “What percentage of the code on this engagement will be generated by AI assistants, and what is your review and SAST process before any of it merges to main?” “What commissions, partner-tier benefits, or referral arrangements do you have with any vendor or platform you are recommending?” “Will you give me three references whose projects went over budget, and tell me why?” The last one is the most revealing. Anyone can produce three happy clients. The story they tell about a hard one tells you who they really are.
A Practical Checklist Before You Sign
• Demand a written statement that the consultancy is not a fiduciary for you, alongside a written statement of which technologies, vendors, and platforms generate commissions, rebates, or partner-tier benefits for their firm. The honest ones will sign it. The dishonest ones will get vague.
• Require the proposal to include at least two named alternative architectures considered and the specific, measurable reasons each was rejected. “The team is more familiar with X” is not a reason. It is a confession.
• Get the actual team in writing. Names, titles, locations, hours per week committed. Tie a portion of payment to retention of those named individuals through the milestone they were committed to.
• Demand an AI usage policy in the SOW. What tools are allowed, what percentage of code may be AI-generated, what human review is required, what static analysis (SAST), software composition analysis (SCA), and dynamic analysis (DAST) gates must pass before code merges. If they refuse to put this in writing, walk.
• Insist on owning the code, the cloud accounts, the repositories, the CI/CD pipelines, and the credentials from day one. Not at handover. Day one. You cannot audit what you do not control.
• Hire a second pair of eyes whose only role is to review the consultant’s work and who is paid by the hour, not by the project. Pay them 5 to 10 percent of the consulting contract value. Best money you will ever spend on a software project. They are the closest thing to a fiduciary you will be able to retain.
• Build the contract around delivered functionality with acceptance criteria, not hours billed. Time-and-materials is a slot machine; fixed-fee with clear acceptance is a calculator.
• Reserve the right to do source-code security review at any time during the engagement, with no advance notice beyond what is reasonable for compliance access. Reputable shops welcome it.
• Require all third-party dependencies to be vetted against known-malicious package lists (slopsquatting is real and growing) and pinned by hash, not by version range.
• If you are in a regulated industry — finance, healthcare, defense, gaming, anything touching PII — require an explicit written threat model and a written architecture decision record (ADR) for every major technology choice. “Because we like it” is not an ADR.
The Bottom Line
Consultants are not your friends. They are not your fiduciaries. They are not your employees. They are vendors. Charming, polished, articulate vendors who will sell you the technology they know rather than the technology you need, and who are increasingly tempted to deliver that technology by way of AI tools that, according to the largest study ever done on the subject, ship critical security vulnerabilities about half the time.
None of this means you cannot work with consultants. You absolutely can, and for many projects you should. But you have to walk into the room knowing what game is actually being played. The game is not “how do we make your business succeed.” The game is “how do we book this contract, staff it from our bench, and ship something that gets us paid before you notice what we cut.” In the age of AI, the cutting is easier and the gap between bill rate and actual labor is wider than it has ever been. The downside, when it shows up, is also bigger than it has ever been: data breaches, compliance fines, regulatory action, and the kind of public failure that the Hertz lawsuit immortalized.
Do the research. Ask the questions. Get the answers in writing. Hire an independent reviewer. Read the alternatives the consultancy did not propose. And if the senior partner across the table from you is more polished than substantive, more confident than specific, more focused on relationship than on requirements — you are not looking at your future technology partner. You are looking at the next case study on someone else’s Substack.
Be the customer who is harder to fool. The consultancies that survive contact with you will be the ones worth hiring.
— Gal Ratner
Chief Architect, Prana Entertainment | Founder/CTO, Inverted Software & WhiteStar Labs