The main risk is not whether the product works; it is whether a tiny vendor can turn a real but externally timed pipeline into booked revenue, collections, and repeatable support-heavy economics before concentration, working-capital swings, or
dilution interrupt the compounding. The moat rests on trusted workflow embedding, so any security, reliability, or evidence-integrity failure would be especially damaging.