Your sales demo is now your competitor’s spec

What changed is the cost curve

The tool behind much of the noise is REA (Reverse Engineer Anything), an open-source MCP server on GitHub under an MIT licence. It connects coding agents such as Claude Code and Codex to the standard disassemblers, Ghidra, IDA and Hopper. It also analyses Android APKs, .NET assemblies, Electron and JavaScript apps, websites and captured network traffic. On 12 October it had 98,200 stars and 21,800 forks.

Free disassemblers have existed since the NSA released Ghidra in 2019. What has changed is the human effort the work takes. Zoeller documented one case in September: a local open-weight model on a single workstation reverse engineered a 1989 strategy game and rebuilt it for the browser in about a week, with under four hours of his attention. He estimates a current frontier model does it in hours.

A job that once needed a rare specialist for months can now be specified in a paragraph and left to run. That is the cost of understanding software. The cost of replacing it in production, with tested rules, migrated data and regulatory sign-off, has fallen far less. Most product leads in insurance were protected by the first cost.

The law never protected what your software does

EU law separates code from behaviour, and always has. The Software Directive (2009/24/EC) protects the expression of a program. Article 1(2) states that the ideas and principles behind it, including its interfaces, are not protected. In SAS Institute v World Programming (C-406/10, 2012), the Court of Justice held that a program's functionality, programming language and data file formats fall outside copyright. World Programming had rebuilt the behaviour of SAS's software purely by observing and testing it, and the Court found nothing unlawful in that.

The Directive gives licensees more. Article 5(3) lets anyone entitled to use a program observe, study and test it while running it, to work out the ideas behind it. Article 6 permits decompilation only where it is indispensable for interoperability with an independently created program. In Top System (C-13/20, 2021) the Court added decompilation by a lawful acquirer to correct errors. Article 8 makes contract terms that override Articles 5(2), 5(3) or 6 null and void. Separately, the Trade Secrets Directive (2016/943) treats reverse engineering of a product made available to the public as a lawful way to acquire a secret, unless the acquirer is bound by a valid duty not to.

Plenty remains unlawful. Copyright covers the code and any program substantially similar in its expression. Decompiling a competitor's product to copy a feature, rather than to connect to it, falls outside both exceptions and infringes. Confidentiality obligations, the database right, patents and the ban on circumventing technical protection all still apply. What was never prohibited is rebuilding behaviour from observation and testing, which is exactly what World Programming did. That route was lawful and expensive. A 2017 academic paper on reform of the Directive made the point directly: conventional reverse engineering was tolerated because its cost and time protected the rightsholder.

AI is removing that cost. The statute books are unchanged.

Insurance is not games

A game ships the whole product to the player. Most insurance software keeps its value on the server: the rating engine, the fraud models, the claims rules and the data behind them. Nobody can decompile a binary they never receive.

That narrows the exposure without removing it. The table shows what an outsider can actually get hold of.

The commercial model moves first

When features are cheap to understand, a feature lead buys less time, and the carrier's own team becomes a credible alternative to every vendor. What still separates vendors is measured performance: reliability at scale, integration depth and results a carrier can verify. The sales motion changes before the product does.

1. The demo becomes the specification. A sales demo, a trial login or a recorded walkthrough now documents a workflow well enough for a competitor, or the carrier's own engineering team, to rebuild it from observation. Rebuilding from what was shown and tested is lawful. Run demos on the assumption that they will be studied: show outcomes and the data behind them, and keep configuration depth for contracted customers.
2. The RFP gains a new bidder: the carrier's own team. Feature-comparison RFPs rarely separated vendors. Most bidders already answered yes, configurable or roadmap, and the award turned on references, delivery track record and risk. What changes is the alternative. When the carrier's engineers can work out a workflow from demos and documentation, building it in-house becomes a credible option, and every bid is measured against that rebuild as well as against other vendors. That bidder is credible for workflow and interface layers. It is far less credible for a policy administration system or a core: Bessemer's Caty Rea told a McKinsey panel this month that these are still very hard to build this way, because evaluation and audit are the hard part. It is also mostly a large-carrier bidder. Most mid-sized carriers will keep buying. The vendors that win will move the evaluation to measured results, such as a proof of value on the carrier's own data against metrics agreed in advance.
3. Price anchors to the cost of rebuilding. Once the rebuild is a credible option, it sets a price. A procurement team that can estimate what that rebuild costs in engineering weeks and tokens will use that figure as the ceiling in negotiation, whatever value the product delivers.
4. Every renewal becomes a re-sale. Renewal conversations used to start from the cost of leaving. As that cost falls, they start from what the product delivered last year, argued on results.

These are decisions about how the company sells, prices and renews. They land on the CRO and the board well before they reach the CTO.

Where it lands first

1. Claims capture becomes the soft target. Self-service claims depend on photos and video taken in the policyholder's app. Fraudsters already bypass live capture by feeding pre-recorded or edited media into the capture SDK through a hijacked camera input. Decompiling that SDK shows exactly where to inject. Verisk's 2026 fraud study found that 57% of US consumers already use AI editing tools, 99% of insurers have seen manipulated claim documentation, and only 43% feel confident they can catch it. Any integrity check that runs on the device should now be treated as advisory.
2. Feature leads shrink. A public app reveals as much as a demo. Differentiation that lives in the interface now has a shorter shelf life than a typical carrier procurement cycle. Decompiling your app to copy it is unlawful, but it is hard to detect and harder to prove.
3. Legacy lock-in weakens, including yours. The largest switching cost in insurance has been that nobody fully knows what the old system does. Finding out is getting cheap. Thoughtworks reports a proof of concept on a 40-year-old, four-million-line COBOL and assembler life administration system: 160,000 lines reverse engineered into functional specifications in four weeks instead of eight, at 80% comprehension accuracy, with Claude Code generating the replacement services. The numbers are modest. The direction is clear. It feeds demand for modern cores now, and it lowers the cost of leaving them later.
4. Exit becomes a statutory right with a falling price. The EU Data Act's switching rules have applied to cloud and SaaS providers since 12 September 2025. From 12 January 2027, providers may no longer charge for the switching process itself. DORA already requires insurers to hold exit strategies for ICT services that support critical or important functions. Those plans were hard to execute. Cheap reverse engineering of configuration, rules and integrations makes them executable.

A US governing-law clause will not fix this

Many US InsurTechs entering Europe license their software under US law and put client-specific terms under local law. The logic is understandable. US courts have enforced contractual bans on reverse engineering: in Bowers v Baystate (2003), the Federal Circuit held that a licence prohibiting it was not pre-empted by copyright law. In the US, the contract can do work that EU law will not let it do.

It helps less than founders expect.

1. Copyright is territorial. Whether decompiling in Utrecht or Munich infringes is decided by the law of the country where protection is claimed, and Rome II (Article 8) does not let the parties choose otherwise.
2. The clause binds only the customer. A competitor studying your public app, or a fraudster studying your SDK, never signed your licence.
3. Mandatory EU rules apply regardless. The Data Act and DORA's contract requirements reach any provider serving EU insurers. If your EU subsidiary signs and the rest of the deal sits in the EU, Rome I (Article 3(4)) keeps mandatory EU law in force whatever law you choose.

The US-law licence still secures ownership of improvements and supports trade-secret claims against the customer, where EU law does let a contract restrict reverse engineering. It should not appear in the investment case as a defence against copying.

What to build instead

1. Move every decision off the device. Treat client apps and SDKs as public documents. Fraud checks, eligibility rules and pricing logic belong on the server. Capture integrity needs server-side proof: device attestation, media signed at the point of capture, and provenance checks before a claim enters straight-through processing. For claims capture vendors, this is also the sales argument for 2027.
2. Turn data into a performance gap, and secure the right to use it. Claims data is not a moat by itself. It becomes one when the contract lets you use it across customers, that right survives termination, GDPR allows it, and it produces a gap that widens with volume, such as fraud hit rates that improve with every carrier added. The part worth most is the trail of handler corrections and the reasons behind them. Carriers are now being told to keep it: McKinsey's QuantumBlack team advises enterprises to hold decision history and similar context in-house, and to renegotiate vendor contracts to protect it. A vendor acting as GDPR processor generally cannot reuse client data for its own purposes, so the role you contract under matters. These terms sit in the client agreement and data processing terms, under local law, and deserve the negotiating effort currently spent on IP warranties.
3. Price on outcomes the buyer cannot rebuild. If a carrier can rebuild your workflow at token cost, it will anchor your price to that cost. Outcome pricing holds only where the result depends on something the carrier lacks, such as cross-carrier data or a model with a measured track record.
4. Make the insurer's compliance cheap. Under DORA the insurer stays fully responsible for its outsourced ICT and keeps its own register of information. Only providers designated critical face direct oversight. A vendor that arrives with complete DORA contract terms, audit access, incident reporting and AI Act documentation lowers the carrier's cost of using it. That wins procurements. It is not a moat, because another qualified provider can offer the same.
5. Model renewals on delivered value. High gross retention in insurance software has long reflected switching cost as much as satisfaction. With the Data Act and AI-assisted migration both lowering that cost, plan retention on what the product delivers each quarter. For boards and investors this is a question of revenue quality: how much of today's retention and pricing power comes from customer value, and how much from the cost of replacing the software? Only the first part survives a falling replacement cost, and diligence should test which one the numbers reflect.

The takeaway

The law protecting insurance software has not changed. It protected code, and it still does. Everything else was protected by the cost of working it out, and that cost is falling fast.

Three things follow. Anything shipped to a device is public and should be designed that way. A carrier's exit from your platform is getting cheaper by law and by technology at the same time. And the vendors still holding customers after 12 January 2027 will be the ones whose results a carrier cannot reproduce with its own data and a token budget.