Building your own software used to be about capability. Now it's about risk.