The Harper Bet

A master services agreement gets read closely once, during negotiation, clause by clause. Then it is signed and filed, and the attention that produced it moves to the next thing. Every word stays binding. Almost none of it is looked at again.

That is not negligence. When Ponemon surveyed 554 IT and security professionals running vendor risk programs at healthcare organizations in 2019, the average organization reported 1,320 vendors under contract and 27% said they assessed all of them even once a year. One agreement can hold several hundred separate promises: coverage to maintain, notification windows to hit, subcontractors to disclose, records to retain, screenings to run on a schedule. The teams falling short are outnumbered, not careless.

Five years on, in fieldwork at the end of 2024, 69 health systems and payers rated their own supply chain risk coverage at an average of 52%, the weakest category in the NIST framework against 73% for everything else. Two studies measuring different things, so not a trend line. Nothing in either one looks like a solved problem.

That is today, in one industry, at today's volumes. The reason we started Harper is what happens to that arithmetic next.

The bet

The cost of building things is collapsing, and what that really changes is the cost of being wrong. Ambitious projects are ambitious because most of them fail. When a failed attempt costs a small team a few months instead of a large one several years, you can afford to be wrong more often, and the bar for what is worth trying drops with it. Ideas that could not justify the payroll last year are worth an attempt this year. That change is most visible in software, and we expect it to arrive in hardware, biotech, energy and manufacturing behind it.

What we think follows is a period of rapid advancement across most of the economy, with one important difference from the last industrial expansion.

That one was slowed by physical constraints: capital, factories, materials, distribution. Those are the constraints falling now, and our argument is that what replaces them as the binding limit is paperwork. Every new product entering a regulated market has to prove it is allowed to operate. Every enterprise adopting that product has to prove its vendor is behaving. Both of those are document problems, and both scale with the number of relationships rather than with the value of the work.

So the bet is that compliance is a tax on ambition, and that it is about to become the last real bottleneck on how quickly good products reach the markets that need them.

We are building ahead of that curve, on both sides of it. Enterprises need to consume vendors safely at a pace they have never had to before. Vendors need to grow fast without a compliance function they cannot yet afford. Today those two needs are in tension, and the tension is resolved the same way every time: the enterprise buys from whoever is big enough to answer the questionnaire, and the better product does not get adopted.

Compliance work is about to get much harder

The usual story about AI and compliance is that the software does the work and the headcount goes down. We think that is close to backwards, and the reason is that both sides of every vendor relationship are about to be handed a problem they are not built for.

Enterprises get volume. If more things get built and more of them are worth buying, the number of vendors an enterprise has to diligence, onboard and then keep watching goes up sharply. Adoption cycles compress at the same time, because a buyer who takes a year and a half to onboard a vendor loses to one who takes weeks. Nobody currently running a vendor program is equipped for several times the relationships at a fraction of the timeline, and no realistic amount of hiring closes that gap.

Vendors get regulation. Regulated markets respond to rapid change by writing more rules, and each regime arrives as obligations somebody has to read, interpret and discharge. A company that has never needed a compliance function suddenly needs to answer for one, usually while it is still small. That side is no better equipped than the buyer, and it has less budget to be equipped with.

A vendor program covering 1,320 relationships today is not going to be covering fewer. The job does not shrink. It gets much harder, and it gets harder faster than headcount can follow.

That is what we are fighting to improve. Not the existence of compliance officers and analysts, whose judgment is the part of this that cannot be automated and should not be. The volume. The reading, the chasing, the checking, the remembering. If that work stays manual, the wave breaks over the people currently holding it.

Why nobody built this layer

It required reading, at a volume that only makes sense if reading is close to free.

An enterprise already owns most of the adjacent pieces. The CLM - Icertis, Gatekeeper, Ironclad - holds the executed file and does that job well. The GRC platform tracks the framework. Between them sits work that neither one does: turning a hundred pages of prose into a few hundred discrete commitments, each with an owner, a trigger and a clock, then keeping every one of them true for years. Priced at a person reading a document, that work costs more than the risk it prevents, so it gets deferred to audit prep, where a fraction of it happens under pressure.

That constraint held for as long as reading was expensive. It is not expensive anymore.

The framework was the wrong document

A decade of compliance software went into the framework. SOC 2, HITRUST, ISO, HIPAA control mappings: standards written by someone else, general by design, converging on a common control set a little more each year. That was the right problem to solve first because it was the tractable one. Evidence collection is mostly plumbing into cloud and HR systems, and one control answers for every customer at once.

A certification is a proxy, though. When a vendor hands over a report, the buyer learns the vendor met a general standard. It learns nothing about the agreement between the two of them: the limits that were negotiated, the windows that were agreed to, the flow-downs that were promised. A report is evidence about a general standard, not about your agreement. It does not tell you whether the notification window you negotiated was hit, whether the service credit you were owed was paid, or whether the indemnity you bargained for is intact. Those live in the contract.

Compliance drift

Compliance drift is the distance between what an organization signed and what is happening under it. It opens at signature and widens every quarter, because the promise is fixed while everything it depends on moves. Vendors get acquired. Subprocessors change. A policy that satisfied a clause gets rewritten by someone who never read the clause.

Attention decays alongside it, and that is the part organizations underestimate. At signature, the people involved know the terms, why each limit was set, and what to watch for. A year later, that agreement is one of several hundred, the reasoning behind a specific clause has thinned, and the attention that would have caught a lapsed certificate has reallocated to whatever is newer or louder. A quiet contract is neither. Nothing gets forgotten deliberately. The context around it erodes, and the obligations carry on regardless.

Drift surfaces late and adversarially: in an audit, a breach, a renewal fight, or diligence on the company itself. You learn its size from someone with an interest in it being large.

What the manual version costs

The healthcare numbers are the ones somebody has tried to measure. That same 2019 study put third-party risk management for the industry at $23.7 billion a year, built from 60,480 hours annually across 6,210 hospitals at $63 an hour fully loaded. Dividing that back out gives roughly $3.8 million each, which is how the sponsor's press release reported it rather than something the survey measured. It is the only industry-wide estimate we have found, so treat it as an order of magnitude. The composition is the part that matters and it comes straight from the derivation: almost none of it is software. It is people, reading documents, on salary.

In that survey, 56% had suffered a breach introduced by a third-party vendor within two years. The budget exists and the loss happens. What is missing is anything that reads the agreement the loss violates.

What changes when reading gets cheap

The unit of compliance stops being the document and becomes the obligation. A contract is prose; you can store it and search it and little else. An obligation has a party, a trigger, evidence that would satisfy it, and a date. Expressed that way it can be worked rather than filed.

Verification stops being periodic. Annual assessment exists because assessment is expensive, not because risk arrives on an annual schedule. As the cost of checking falls, checking becomes continuous, and an organization moves from preparing an answer once a year to holding a live one.

And the cost curve inverts. The same obligation appears across dozens of agreements in slightly different words. Store it once, canonically, reference it everywhere it appears, and the hundredth contract costs less to process than the first. Compliance labor has never worked that way, and it is what makes the rest of this possible.

Ten years out

The tax is regressive. The cost of proving you are allowed to operate is close to fixed, so it falls hardest on the smallest party, and it decides which products reach a market through conversations that never happen.

We would like that constraint gone. Not the obligations, which exist for good reasons and usually trace back to somebody getting hurt, but the overhead of proving they are met.

If an enterprise can verify a small vendor as cheaply as a large one, it can choose the best product rather than the safest-looking one. If it knows its exposure the day it changes, oversight starts to look like operations instead of an annual scramble. And if the cost of entry drops, more people build ambitious things, and the organizations that need those things can adopt them without taking on risk they cannot see.

We start in healthcare, where the scrutiny is sharpest and the obligations are densest, and where responsibility genuinely does not transfer with the work: a plan that delegates keeps ultimate responsibility for it under 42 CFR 422.504(i)(1), and a covered entity can be liable for a business associate acting as its agent under 45 CFR 160.402(c). The same engine reads a contract in any regulated market.

That is the bet. Ten years out, we want a compliance officer to answer "are we covered?" the way a CFO answers "what is our cash position?" - immediately, from a system, with the receipts underneath.