There is an AI bubble.
You’re just looking at the wrong layer.

The dot-com crash did not destroy the internet. It destroyed companies that mistook access to the internet for a sustainable competitive advantage. The infrastructure layer survived and compounded. The application layer collapsed. Cisco, Microsoft, and Google won. Pets.com did not. The technology was real. The moats were not.

AI is tracking the same curve. Thousands of SaaS companies have built businesses on a polished interface over an API they do not own, serving use cases that any moderately resourced in-house team can now replicate. When that layer commoditizes, and it is already happening, the companies left standing will be those that used technology to amplify something real. In physical security, that distinction has never been more important.

At their peak in 2021, SaaS companies traded at 20 to 40 times ARR. That multiple is already compressing for AI feature-layer companies, repricing toward 2 to 5 times as the market recalibrates what the software is actually worth without the infrastructure beneath it. The dot-com application layer collapsed over 80% from peak to trough. The current compression will not be identical. But the direction is the same.

We started building security operations before guard management software was a real category. Coverage decisions were made on legal pads. Patrol routes lived in someone’s head. Accountability meant a phone call at 3am, not a dashboard notification. Over twenty years, we watched the software promises arrive, each one claiming to solve what the last one couldn’t. Most of them were right about the problem. Almost none of them were built for the operator running the shift.

We are not engineers. We are operators. When we finally built what we needed ourselves, in nine days, using AI tools available to anyone with a subscription. The point was not that we are clever. The point is that if we could do it, anyone can. A regional operator with fifty officers and a laptop can now build the guard management platform that took a venture-backed software company three years and eight million dollars to ship. That changes everything about where the value sits in this industry.

The software was not the hard part. It never was. Knowing exactly what to build. That was the hard part. And that cannot be replicated with a subscription. I believe that distinction is what separates the companies that will compound through this transition from the ones that won’t.

Two waves. Same playbook.

When Netscape went public in August 1995 at a $2.9 billion valuation on its first day, having never turned a profit, it inaugurated a decade-defining misunderstanding. Investors, operators, and analysts conflated the significance of the underlying technology with the durability of the companies built on top of it.

The infrastructure layer was vindicated. Cisco’s routers carried the traffic. Microsoft and Oracle owned the enterprise substrate. Google, arriving late, became the defining company of the era. The application layer was largely wiped out. Pets.com, Webvan, eToys: rational ideas, built on a fundamentally flawed assumption that novelty of delivery mechanism sustains a moat indefinitely.

The mechanics of multiple inflation

Public SaaS multiples peaked at 20 to 40x ARR in 2021. The AI premium reinflated those multiples for AI-native companies through 2023 and 2024. Every enterprise buyer was allocating budget to AI initiatives regardless of demonstrated ROI. That dynamic is already reversing. The signal is quiet. But it is there.

The real beneficiaries
of the AI wave.

Nvidia’s appreciation from 2022 to 2025 is not coincidence. Microsoft’s position, with deep investment in OpenAI and AI embedded across its entire enterprise stack, reflects exactly the lesson the dot-com era taught. These companies do not need the AI application layer to survive. The AI application layer needs them. That asymmetry defines who holds pricing power over the long run.

In physical security, infrastructure does not mean chips or cloud. It means operational infrastructure: people, processes, and response systems built over decades. The same principle applies. The same winners emerge.

Categories most exposed to displacement

What survives the compression, in physical security

The companies that hold their valuations have built genuine switching costs through deep workflow integration, proprietary data, or network effects that make replacement operationally painful regardless of the underlying technology.

Companies like Trackforce already see this coming. They have built what is widely regarded as the best guard management and tour reporting software in the market, used by hundreds of thousands of officers across North America for scheduling, tour verification, incident reporting, and compliance documentation. And they understand better than anyone that the threat is not a better competitor. It is a regional operator with a few hundred officers and an Anthropic subscription who builds a comparable tool themselves in a week, at a fraction of the cost in licensing, answering to no roadmap but their own.

The question was never whether their software is good. The question is whether the software alone is the business. They know the answer is no. Which is exactly why they are positioned to excel through it.

Look at what has happened to CRM and workforce management valuations. As software categories commoditize, the multiples compress. The product becomes self-evident. And when the product becomes self-evident, the relationship becomes the differentiator. Serving approximately 75% of the North American guarding industry, Trackforce doesn’t face commoditization as an existential threat. They face it as a forcing function. The advantage isn’t standing still. It’s having the position to move from.

The software will evolve. The relationships will not have to.

Immix is a parallel case. Most enterprise monitoring centers run on Immix as their integration backbone, aggregating video feeds, sensors, access control events, and alarm signals from dozens of disparate systems into a single operational view. It is the platform that makes a monitoring center function as a single coherent operation rather than a collection of disconnected tools. Replacing Immix does not mean switching an application. It means re-engineering the operational nervous system of the entire organization. That kind of depth is not a product feature. It is infrastructure. And infrastructure survives.

Technology is a tool.
Not the outcome.

Between 2019 and 2025, dozens of security-focused SaaS platforms emerged promising AI-powered analytics, automated incident reporting, and predictive patrol routing. Many raised significant venture capital at multiples that assume they solved the sector’s operational problem. They did not. They solved the interface problem. The operational problem remains, because it was never primarily a technology problem.

Twenty years before
the first algorithm.

We built the infrastructure before we built a single line of code. The first officers we put in the field were managed with spreadsheets and cell phones. Patrol accountability was a signature on a paper log. Incident documentation was a phone call followed by an email. It was slow, imperfect, and entirely dependent on the quality of the person holding the phone.

That is exactly the point.

What those years produced was not inefficiency to be fixed by software. They produced an understanding of what physical security actually requires: what breaks down under pressure, where the accountability gaps live, which problems are human problems and which are coordination problems. You cannot learn that from a product demo. You learn it by being the team that gets the call at 2am when something goes wrong, and by being the team responsible for making sure it does not happen again.

Twenty years of that is the foundation. The software that sits on top of it today, the proprietary platforms, the patrol systems, the coordination tools we built ourselves, those are the dividend. Not the investment.

This is what the model looks like in practice. Guarding, patrol, and technology combined around the actual risk profile of the client. Not a product, not a platform, but a methodology. The most efficient physical security outcome scientifically possible. We didn’t arrive at that through analysis. We arrived at it through twenty years of getting it wrong, then less wrong, then right.

Over the last twenty years, NJB became a security technology company. The hard part was the infrastructure. The easy part, it turned out, was the software. Our clients don’t pay for the platform. They pay for the outcome. That distinction is the whole argument of this paper.

The scale of that infrastructure is worth stating plainly. Approximately 10,000 officers in the field. Tens of millions of protected locations across the United States. More than two decades of national coverage built before a single platform entered the picture.

The bubble will clarify,
not destroy.

Technology bubbles do not destroy the technologies that cause them. The internet survived the dot-com collapse. The companies that failed were not casualties of a flawed technology. They were casualties of a flawed theory about where sustainable competitive advantage resides when a technology becomes broadly accessible.

Artificial intelligence will follow the same arc. The models will improve. The API access will become cheaper. The barrier to building functional AI-powered applications will continue to fall. The companies that built their businesses on the assumption that access to AI was itself the moat will discover that it is not.

The counterargument is that the models will eventually become good enough to replace human judgment entirely. Maybe. But not yet. Not in an industry where the outcome is someone’s safety, where a wrong call at 2am is not a bad user experience but a failure with real consequences. The gap between AI that can process information and humans who can bear responsibility is not a technical problem. It is a human one. I don’t know when that gap closes. I know it has not closed yet.

The companies that win are those that used the technology to get better at something real, something that requires judgment, relationships, and accountability that no model can replicate yet. In physical security, that means showing up when it matters, being accountable when it goes wrong, and building the trust that allows a client to sleep at night. The platforms came later. The trust came first.