Two-thirds of small firms using AI now build their own tools, Pax8 finds

Pax8’s survey of 1,150 respondents found that small and mid-sized businesses have shifted from buying AI tools to building their own, with most surveyed in every market doing so without a formal, documented review. The finding points to potential governance and oversight risks, but the excerpt provides no market reaction or further survey details.

Analysis

The investable signal is not “SMBs are adopting AI”; it is a potential shift in who captures the spend and who bears the risk. DIY tools can displace some narrow SaaS workflows, but production use creates demand for identity controls, data-loss prevention, monitoring, and integration. That favors managed service providers and security vendors if they can package governance affordably; it may also raise support costs for providers whose customers deploy unapproved tools. Cloud and model usage could grow, but the survey does not establish paid usage, durable workloads, or net-new spend.

Treat the finding as an early risk indicator, not evidence of earnings impact. Pax8’s channel position gives it useful SMB access, but its commercial interest in selling software through IT providers warrants skepticism about how “building” and “formal review” were defined. No incident data, spending figures, or company-level exposure are provided.

Over the next 1–3 months, look for corroboration in security-vendor commentary, MSP bookings, and reported AI-related cloud consumption. Over 6–18 months, the key question is whether DIY systems remain prototypes or become business-critical applications that require paid governance and support. The thesis weakens if adoption does not translate into security budgets or if SMBs standardize on bundled controls from existing platforms. No immediate directional trade is justified by this survey alone.

Key Decisions for Investors

• No trade on the survey alone. Treat it as a watch item for managed service providers and cybersecurity vendors, not a forecast of near-term revenue.
• Monitor earnings commentary and channel checks over the next 1–3 months for SMB security spending, AI-related cloud consumption, and MSP demand for governance services. Seek evidence of paid deployments rather than reported experimentation.
• If corroborated by rising security bookings or AI-governance attach rates, consider a relative-value position favoring security and managed-service exposure over undifferentiated SMB application software; size only after verifying which vendors have material SMB exposure.
• Falsifiers: no measurable change in security budgets or cloud usage, continued reliance on free or bundled tools, or evidence that DIY projects are largely abandoned before production.