The mechanism is simple and unsentimental. Carriers bled through the ransomware years, repriced, and began demanding controls as a condition of coverage: multifactor authentication everywhere, tested backups, endpoint detection, privileged-access management, incident response plans with names attached. Companies that once treated such lists as consultant theater implemented them in a quarter, because renewal depended on it.

Markets doing what mandates could not

The result is a de facto national security standard, arrived at without legislation. The questionnaire is the regulation; the premium is the penalty; the audit is the market conduct exam. Mid-sized companies, historically the least defended tier, have improved fastest, precisely because they can least afford to self-insure.

Second-order effects are appearing. Security vendors now market to underwriting requirements rather than fear. Boards receive coverage terms as a legible proxy for cyber posture, a number where there used to be adjectives. And carriers, sitting on claims data no one else has, increasingly know which controls actually reduce loss, knowledge that flows back into requirements with each renewal cycle.

The arrangement has limits, since insurers optimize for insurable loss rather than national resilience. But as an engine for raising the corporate floor, the invoice has outperformed the sermon, and it is not close.

Underwriters have started asking about authentication specifically, which has done more to accelerate passkey adoption inside large organisations than any internal security argument.

Cranberry Journal has also reported on the API Economy Enters Its Utility Phase, Repairable Tech Goes Mainstream, and Profitable and Disaster Costs Are Rewriting the Deal Between States and Washington.

That property is what made the category enormous, and it is what produced the situation most large companies are now working through: portfolios of hundreds of applications, assembled by people acting sensibly in isolation, that nobody ever evaluated as a whole.

The audit nobody wanted to run

The first discovery in any consolidation exercise is that the inventory is wrong. Companies routinely find substantially more active subscriptions than their systems record, because the purchases that bypassed procurement also bypassed the asset register. Duplicate categories are the norm: several project trackers, multiple video tools, overlapping analytics.

The waste is real but smaller than the headline numbers suggest, and honest programs say so. Unused licenses and abandoned tools are the easy recovery, and they are largely one-time. The durable savings come from consolidating overlapping categories onto single vendors with negotiated enterprise agreements, which is slower, requires migrating people off tools they like, and generates the political friction that made departmental purchasing attractive in the first place.

Integration cost is the part that surprises finance. Each additional tool in a portfolio carries an obligation beyond its subscription: an identity integration, a data flow, a security review, an offboarding checklist. Those costs live in engineering and IT budgets rather than the software line, which is why a portfolio can look affordable in one spreadsheet while consuming disproportionate staff time in another. The same API infrastructure that made tools easy to connect also made the connections easy to accumulate without counting.

Security has been the effective forcing function. A sprawling portfolio is a sprawling attack surface, and every application holding company data is a vendor whose own security posture becomes the company's problem. Cyber insurance questionnaires now ask for application inventories, and being unable to produce one is itself an underwriting signal.

What is genuinely different this cycle is who is running the effort. Software consolidation used to be an IT initiative that departments resisted successfully. It is now typically owned by procurement or finance, with an explicit savings target, and it is being pursued alongside the same scrutiny being applied to cloud spending. Both are symptoms of one shift: technology costs that grew during a period when nobody had to justify them are being examined by people whose job is justification.

Identity is where the sprawl bites hardest, since every application is another integration to secure and another place a credential lives, which is part of why passkey rollouts move slowly in portfolios nobody has inventoried.

The overcorrection is predictable and already visible in places. Reimposing full procurement review on every software purchase reintroduces the exact delay that departmental buying routed around, and the teams affected will route around it again. The organizations getting this right are setting a threshold, below which purchasing stays fast and above which review is real, and accepting that some duplication is the price of a company that can adopt a tool in a week.

It is also being adopted more slowly than almost anyone involved expected, and the reasons are worth understanding, because they are not technical.

Recovery is the hard problem

A passkey binds authentication to a device and a biometric or PIN. That eliminates the entire category of attacks built on knowing a secret, which is most of them: phishing, credential stuffing, reuse across breached sites. Security teams like it for exactly this reason, and cyber insurers have started asking about it in underwriting, which tends to accelerate adoption faster than any internal argument.

The problem is what happens when the device is gone. A password can be reset by someone who can prove they are the account holder, through a process every organization already operates. A passkey has to be re-enrolled, and the re-enrollment path becomes the weakest link in the entire scheme, because an attacker who can convince support to enroll a new device has defeated the cryptography without touching it.

Organizations that took this seriously built genuine recovery infrastructure: multiple registered devices, verified backup channels, and support procedures with real identity proofing. That is expensive and slow. Organizations that did not have quietly recreated the phishable secret they were trying to eliminate, one help desk call at a time.

The second obstacle is enrollment friction at a moment when nobody wants friction. Adding a passkey requires an interaction during a session the user came to do something else, and every prompt inserted into that session costs conversion. This is the same tension visible in invisible checkout design, where the commercial pressure runs consistently toward removing steps rather than adding them. Product teams measured on completion rates and security teams measured on credential compromise are optimizing different numbers, and the product teams usually own the flow.

Enterprise deployment has its own version. Passkeys assume a device with a secure element and a user with authority over it. Shared workstations, contractor laptops, kiosks and the long tail of manufacturing and healthcare environments do not fit that assumption cleanly, and the fallback for those cases is where the passwords keep living.

There is a procurement dimension that rarely appears in the security discussion. Passkey support has become a checklist item in enterprise software evaluations, which means vendors add it to close deals rather than because customers deploy it, and a surprising share of the support that exists in the market is unused. That is the same gap between purchased and adopted capability visible across sprawling software portfolios.

The realistic forecast is not elimination but stratification. High-value consumer accounts and employee access at security-conscious organizations move first and largely have. The long middle, small business software, legacy internal tools, anything with a login form written a decade ago, will keep a password field for years, because the cost of changing it exceeds the cost of the risk as currently priced. The thing that would change that arithmetic is insurers pricing the risk differently, which is already how a surprising amount of corporate security policy gets set.

The forcing function is demographic. The engineers who built and tended these systems are retiring faster than replacements can be trained, and institutions are discovering that the risk they deferred was never really technical. It was biographical.

Why now, after all the failed nows

Previous modernization waves foundered on the big-bang rewrite, multi-year projects that attempted to replace everything and frequently replaced nothing. The current wave is different in method: strangle rather than replace, wrapping old cores in modern interfaces and migrating one function at a time, with the legacy system retired piece by piece rather than in a single act of institutional courage.

New tooling has shifted the economics as well, with automated code analysis capable of mapping decades of undocumented logic, and translation systems producing credible first drafts of modernized code that humans then verify. What was a decade-long archaeology project is compressing into something a CFO can approve.

The spending is enormous and largely invisible, since no customer sees a core migration that succeeds. But the institutions moving now are buying the one asset the deferral years consumed: the ability to change anything at all, later, when it matters.

That shift follows earlier coverage of Cyber Insurers Have Become the De Facto Regulators of Corporate Security, AI Agents Take Over the Back Office, Quietly and Small Models, Big Deployments.

The direction is still mostly one way. What has changed is that the exceptions have become numerous enough, and expensive enough, to have a name and a budget attached.

The workloads that stopped being variable

The economic case for public cloud was never that it was cheap. It was that it converted capital expenditure into operating expenditure and let capacity track demand, which is enormously valuable when demand is unknown. A company that cannot predict whether it needs ten servers or a thousand should absolutely rent.

The trouble is that workloads age. A service that was unpredictable during its growth phase becomes, five years later, a steady thing with a known baseline running twenty-four hours a day. At that point the company is paying an elasticity premium on capacity it uses continuously.

Finance departments arrived at this before engineering did, which is why the conversation has the tone it does. The trigger is usually a cloud bill crossing a threshold where it becomes a board-visible number, followed by an analysis showing that a meaningful share of it funds steady-state compute and storage that has not varied materially in years.

Data gravity has sharpened the calculus. Egress pricing means that the cost of moving data out of a provider scales with the amount of it, and companies that accumulated years of it discover the exit is priced accordingly. That has produced a rational but uncomfortable conclusion in some organizations: the time to reconsider architecture is early, while the data is small enough that the decision is still reversible.

The AI infrastructure buildout has cut both ways. Training remains firmly rented, because almost nobody's demand for it is steady. Inference is a different profile entirely, and as it moves into production at constant volume it starts to resemble exactly the kind of predictable workload that repatriation targets. Several organizations running smaller models at high throughput have found the on-premises comparison unexpectedly favorable.

What almost nobody is doing is leaving. The pattern is hybrid by default: burst capacity, global distribution and managed services stay rented, while the steady base moves to owned or colocated hardware. That is a more complex operating model than either pure position, and it requires exactly the infrastructure engineering talent that a decade of cloud adoption trained companies out of maintaining.

Regulated industries have been quietly ahead of this. Data residency and audit requirements pushed banks, insurers and health systems toward hybrid architectures years before cost made the question fashionable, and those organisations retained the operational skills that everyone else is now trying to rehire.

Which is the real constraint, and it is the same one that makes legacy rewrites so difficult. The financial case for repatriation is often clear. The staffing case frequently is not, and a company that cannot hire people who know how to run hardware will keep renting it regardless of what the spreadsheet says.

Earlier Cranberry Journal coverage examined the maturing of the layer beneath this in The API Economy Enters Its Utility Phase.

The consolidation is now well advanced. Categories that supported eight funded competitors support two or three. The survivors have raised prices toward sustainability, purchased their weaker rivals for the customer contracts, and settled into the growth rates of the thing they actually are: infrastructure.

What the utility phase looks like

Buyers feel the shift as a change in posture. Procurement teams that once picked APIs like apps now negotiate them like power contracts, with uptime terms, exit clauses and second-source strategies, having learned from a few well-publicized deprecations that a dependency is a liability with good documentation.

The maturation is healthy even where it stings. Stable, boring, profitable infrastructure providers invest in reliability rather than land grabs, and the developers building on them can plan in years rather than funding cycles. The modernization of legacy systems depends on exactly this stability, since nobody wraps a fifty-year-old core in a vendor that might not see thirty.

What ends is the romance, and the venture math that required every plumbing company to become an empire. What remains is the actual achievement, easy to forget because it worked: assembling a functioning company from rented parts in a weekend, a capability now as unremarkable as electricity, which is the highest compliment infrastructure can earn.

That shift follows earlier coverage of the Rural Broadband Buildout Reaches the Hard Part.

Modular laptops with user-replaceable everything have moved from crowdfunded curiosity to credible category. Major manufacturers now publish repair manuals, sell parts directly and advertise battery replaceability, claims that would have been unthinkable in the glued-shut era. Repair scores appear on retail listings in a growing number of jurisdictions, and products with good scores are converting better.

The economics behind the conversion

Three forces aligned. Legislation forced parts and documentation into the open, removing the manufacturer's ability to monopolize repair. Secondary markets matured, making resale value visible at purchase time, and repairable devices hold value dramatically better. And device lifecycles stretched as performance gains flattened, so a machine worth keeping five years became worth fixing in year three.

Manufacturers discovered the model works for them too. Parts, service plans and certified refurbishment are recurring revenue with margins that rival accessories, and a customer who repairs stays in the ecosystem rather than shopping the replacement cycle.

The losers are business models built on planned succession rather than planned durability. The winners include an unexpected constituency: corporate IT departments, which buy in fleets, measure total cost of ownership and have concluded that the repairable machine is simply cheaper. When procurement and idealism agree, the argument is over.

The same repositioning has carried the secondhand market upmarket, where buying used signals discernment rather than constraint and increasingly is not cheaper.

Cranberry Journal has also reported on the API Economy Enters Its Utility Phase, Cyber Insurers Have Become the De Facto Regulators of Corporate Security and the Checkout Is Disappearing, and Retailers Are Ambivalent.

The growth has moved elsewhere. The telehealth companies expanding this year are narrow by design, built around a single condition, a defined protocol and a relationship measured in months rather than minutes: hormone optimization, weight management, dermatology, behavioral health, men's and women's health clinics that combine diagnostics, prescriptions and recurring clinical check-ins.

Why narrow works

The economics differ fundamentally from the visit-based model. A general telehealth platform sells appointments and competes on convenience. A condition-specific clinic sells outcomes over time and earns recurring revenue that looks more like a subscription business than a medical practice.

The clinical logic follows the same shape. Chronic and lifestyle conditions are managed, not cured, and management is mostly communication: lab review, dosage adjustment, adherence support. Those are tasks video and messaging handle well, arguably better than episodic in-person visits ever did.

The regulatory watch

The model's growth has drawn scrutiny proportional to its marketing. State boards continue to tighten rules around asynchronous prescribing, and operators that invested early in genuine clinical infrastructure, licensed providers, real lab relationships, conservative protocols, are increasingly separating from those that treated medicine as a checkout flow.

The second act of telehealth, in other words, looks less like an app and more like a clinic that happens to have no waiting room.

That shift follows earlier coverage of Repairable Tech Goes Mainstream, and Profitable.

The villain is now simply leaving the stage. Between stored credentials, one-tap wallets, pay-by-bank rails and, at the frontier, AI agents that complete purchases on a customer's behalf, the deliberate act of checking out is dissolving into the background of commerce.

The merchant's dilemma

Retailers, who spent years demanding exactly this, are discovering the trade. The checkout was friction, but it was also the merchant's final owned moment: the upsell, the loyalty enrollment, the email capture. As payment moves into wallets and agents, that moment increasingly belongs to the platform holding the credential.

The concern sharpens with agent-driven purchasing. When software shops on a customer's instructions, the storefront itself may never be seen. Merchants describe preparing for a world where their true customer interface is structured product data, machine-readable pricing, availability and terms, rather than a designed page.

Who holds the credential wins

The strategic contest underneath is old and familiar: whoever holds the payment credential holds the relationship. Banks, wallet platforms and now AI assistants are competing to be the default, and merchants are being reminded, not for the first time, that convenience for the customer usually means consolidation above the merchant.

The checkout is dying. The fight over what replaces it has barely begun.

The credit decision embedded in that frictionlessness is now getting its own scrutiny, as installment lending at the checkout becomes visible to the credit bureaus for the first time.

Earlier Cranberry Journal coverage examined Retailers Are Selling Belonging, Not Goods, the API Economy Enters Its Utility Phase and Cyber Insurers Have Become the De Facto Regulators of Corporate Security.