Companies usually treat software vendors like any other supplier. They invest in a platform, sign a contract, and move on.
It’s supposed to make things easier, right?
But then the software spreads and starts running finance, managing customers, storing data, and stitching together the systems that keep the company operating.
Eventually someone asks an uncomfortable question.
If the company needed to replace that platform tomorrow, could it?
“The typical answer is no, so are you really a customer, or are you a hostage?” asks Raju Vegesna.
Vegesna, chief evangelist at Zoho and a speaker at the upcoming CIO Association of Canada Peer Forum in Vancouver April 15-16, has spent more than two decades working in enterprise software. He says most organizations don’t notice the change until they stop and think about how dependent they’ve already become on those systems.
By that point, the systems running the company may no longer be fully theirs.
The rise of digital dependence
Think about how most companies build their technology stack.
A sales team adopts a CRM because they need a better way to track customers. Finance installs an accounting platform to manage billing and reporting. Marketing brings in analytics tools to understand campaigns and customer behaviour. None of those decisions feel especially risky on their own.
Over time, though, those risks start to add up.
Data moves between systems because workflow depends on those integrations, and suddenly entire departments organize their daily work around a handful of platforms that don’t talk to each other.
Those stacks are often way bigger than leaders realize. The average enterprise now manages about 305 SaaS applications, according to Zylo’s 2026 SaaS Management Index.
Those connections eventually become part of how the company runs. Replacing a system means untangling the knots the business tied into its own workflows.
The financial implications are also becoming harder to predict. The Zylo report found that expense-based SaaS purchasing grew 267% year over year, driven largely by AI features and usage-based pricing.
Vegesna says the dependence often develops gradually, through decisions that seem routine at the time.
“They are trapped into multi-year contracts,” he says. “They are so deep into it [and the] technology is so entrenched that they don’t realize how much of a hostage they have become.”
When the software has become part of the organization’s infrastructure, walking away is no longer a simple decision. At that point the relationship can start to look less like a vendor contract and more like the early stages of Stockholm Syndrome.
For years, that dependence showed up mostly in cost, complexity, and long contracts. But there’s a new dimension to the problem.
When organizations feed internal data into AI systems, they can also be contributing the knowledge that then trains those systems.
If your company’s data helps build the intelligence behind a platform, who owns the value created from it?
AI raises the stakes
Vegesna has seen the answer to that question show up in how companies experiment with AI.
In one case, a leadership team basically told him, “AI is moving too fast, and I want to be part of it,” Vegesna recalls. The company pushed large volumes of customer and operational data into a public cloud platform so it could start using AI tools.
The move helped them get up to speed with the technology, but what the company didn’t fully consider was where the knowledge created from that data might end up.
“Without realizing, they gave up all their IP, their intellectual property, which is their customer data,” says Vegesna.
Information that once sat inside the company’s systems was now being processed by systems outside themselves.
Another company Vegesna spoke with took a different approach.
A pharmaceutical firm working in drug discovery wanted to experiment with AI, but was cautious about where its research data went.
Instead of handing that information to external platforms, the company used open source models and trained them using its own internal datasets.
“Now it’s their own model with their own data that is very specific,” says Vegesna.
The contrast comes down to where the intelligence built from company data ends up.
In one case, it begins shaping models outside the organization. In the other, it remains tied to the company’s own systems and research.
Customer records, operational patterns, and research data often contain years of hard-earned knowledge within a company. Once that information feeds AI systems, it starts shaping models that can influence entire industries.
Digital sovereignty becomes a leadership question
For decades, digital transformation focused on converting physical things into digital form. Books became ebooks, impossible-to-refold paper maps became navigation apps, and payments went digital.
Vegesna says the technology industry is now entering a new phase of digitization as AI starts to digitize intelligence itself.
These systems learn from the data companies produce every day through customers, operations, and internal decisions.
Who ends up controlling the intelligence created from that data?
Many organizations haven’t confronted the question yet, says Vegesna, and describes the issue as a form of digital sovereignty.
The concept is often discussed in the context of governments, but Vegesna says it’s becoming just as relevant inside companies.
As organizations rely more heavily on external platforms to process data and run AI tools, they may also be giving up control over the systems analyzing that data.
Vegesna compares the dynamic to supply chains.
The COVID-19 pandemic exposed how dependent many companies were on global manufacturing and logistics networks they didn’t control. Businesses that once assumed those systems were stable suddenly learned the supply chain had a landlord.
Enterprise software, cloud infrastructure, and AI platforms now form a kind of digital supply chain that processes company data and runs the systems businesses depend on.
That kind of dependence is also drawing attention from cybersecurity experts.
In a recent interview with Digital Journal about emerging cyber risks, AttackIQ field CISO Pete Luban noted that attackers are now targeting the providers and software integrations that connect entire ecosystems.
“Why break into 1,000 companies when you can hit one trusted provider and reach them all,” he said.
The same structure that lets software ecosystems scale also concentrates risk in a small number of platforms.
Inside companies, those environments often evolve in ways that mirror the organization itself.
“In other words, technology takes the shape of the organization,” says Vegesna.
Departments adopt their own tools and connect them until those platforms become part of how the company runs. Before long, the software starts to look a lot like the people running it.
“Culture is the real operating system,” says Vegesna.
The way teams share information and work together often determines whether technology becomes a coordinated system or a patchwork of disconnected tools.
As AI spreads through enterprise systems, those choices also influence where the knowledge generated by that work ends up.
Modern companies will continue to run on cloud platforms and software ecosystems. Few companies can realistically build every system themselves, and Vegesna isn’t suggesting they should.
What he encourages leaders to understand is who ultimately controls the systems and data their businesses depend on.
Vegesna says the same sovereignty question is beginning to surface beyond individual companies.
“Canada produces a lot of energy that is a key ingredient for AI right now,” he says. “But Canada is not productizing it.”
The pattern shows up across industries. Countries and companies often supply the raw inputs while someone else builds the product that rakes in more value.
“Do you want to be an ingredient, or do you want to be a product?” he asks.
The same question can apply inside companies as well.
A platform can look like a normal vendor contract on paper. Everything keeps running, so no one stops to question who really controls the system.
But if the company discovers it can’t realistically replace the platform that runs its operations, the relationship might not be what it thought.
The organization may still call itself a customer, but from the vendor’s perspective, it might look a little different.
Something closer to a hostage.
Final shots
- Enterprise software has become infrastructure inside companies. When a platform becomes impossible to replace, the balance of power between customer and vendor changes.
- Company data now feeds the models that power many AI systems. Where that data flows determines who benefits from the intelligence built on top of it.
- Digital sovereignty is no longer just a policy debate for governments. It’s becoming an operational question for CIOs deciding which systems their organizations really control.
Digital Journal is the national media partner for the CIO Association of Canada.
