The vibe-coding era did not change what startups need to keep in-house. It changed what is left after AI absorbs the commodity work.
That list is shorter than most founders expect. It is also much more expensive to get wrong.
Imagine you're a founder at $30K MRR with a Lovable MVP, a few paying customers, and a seed round close enough to plan against. You hire 4 generalist engineers, keep an offshore agency on standby, pay for 3 SaaS subscriptions that all promise velocity, and somehow you are still slower than the solo founder using Cursor with taste and discipline.
The problem is not outsourcing. The problem is that you outsourced moat work and kept the chores.
The moat test starts with one question
Before you hire, outsource, or give a task to AI, ask one question: does this work encode the judgment that makes your company different?
If the answer is yes, keep ownership close. If the answer is no, your default should be a vendor, an agency sprint, or AI under review.
We use a simple quadrant with founders:
| Work type | What it means | Default decision |
|---|---|---|
| Moat + recurring | Unique product judgment you will repeat 100+ times | In-house, senior |
| Moat + one-time | Important strategic work needed once or twice | In-house owner, outsourced execution |
| Commodity + recurring | Standard plumbing you need forever | Vendor or AI |
| Commodity + one-time | Clear chore with a defined finish line | Agency or contractor |
This is the real build vs buy decision for seed-stage teams. Not "can we build it?" but "should this live in our learning loop?"
What should never leave the learning loop?
Keep product judgment in-house. The founder who prompted the first version is still the person who understands why customers buy, why they churn, and which ugly workflow is actually valuable.
Keep eval design in-house if your product depends on LLMs, retrieval, classification, or agents. An eval set is not a QA spreadsheet; it is your product opinion written as tests. If your assistant routes customer requests, the difference between "good enough" and "wrong in a way that breaks trust" belongs to you.
Keep architecture decisions in-house, even when someone else writes the code. The decision to migrate off Supabase, split a service, add a queue, move to native iOS, or introduce pgvector changes your future cost curve. You can hire a senior team for the sprint, but someone on your side has to own the trade-off.
Keep distribution and customer-success voice in-house through the first 10-50 customers. You can outsource ad production, content drafts, and CRM cleanup. You cannot outsource the question of which customer matters, what promise resonates, and which complaint is actually a product requirement.
Keep security posture in-house. A vendor can run infrastructure, a consultant can run SOC 2 prep, and a pen tester can find issues. Your team owns what data is stored, who can read it, what gets logged, and how auth maps to real customer risk.
What should you outsource immediately?
Outsource DevOps unless infrastructure is the product. A US senior DevOps hire is usually a $150K+ base-salary decision, and materially more once benefits, recruiting, equity, and tooling are included. A managed DevOps retainer for an early team often lands around $5K-$15K/month, which is easier to justify before your system has real operational depth. Below 10 engineers, you usually need managed Postgres, CI/CD, monitoring, backups, and sane alerts, not a custom platform team.
Outsource design system implementation, but keep taste in-house. A small startup brand and design-system sprint can cost $25K-$50K; a fuller product design system can run higher. Hiring one senior designer for 4 months at roughly $14K-$15K/month in base salary already puts you near $60K before benefits, recruiting time, and the risk of making the wrong early hire.
Outsource compliance prep when it is a checklist, not the core product. A narrow first SOC 2 push can land around $25K-$60K all-in for a small SaaS team; Type 2, larger scope, and remediation can push it much higher. The posture stays yours; the evidence collection and policy paperwork do not need to become a full-time hire.
Outsource migrations, security audits, performance work, and mobile builds when the scope is clear. A small cloud migration can be a 4- to 8-week engagement; audits, React Native builds, and performance work need their own scope. The principle is the same: clear inputs, clear output, and a senior owner on your side.
This is where engineering partners should earn their keep. Grovs processes 10M+ events daily, and Semaphr protects 10M+ installs across 500+ dev teams; that class of infrastructure work needs senior ownership, clear constraints, and production scars. It does not need you to hire every specialist permanently on day one.
What should AI take over?
AI should take the bottom layer of commodity work, not the judgment layer. Give it scaffolding, test fixtures, API stubs, migration drafts, documentation, simple refactors, glue code, and first-pass PR review.
Do not give it architecture by accident. AI works best when a senior person has already decided the module boundary, data model, file structure, failure mode, and acceptance criteria.
Let AI draft a Supabase migration, but require a senior engineer to review rollback, data integrity, and access policies. That is the line a founder needs: the model can produce the first pass; your team owns the decision that protects customer data.
The useful test is not whether a tool can generate code. The useful test is whether your evals can tell you when that code is wrong.
This matters most in AI products. On the AI Communication Platform, the hard product line is not "can a model translate voice?" It is whether the system can keep real-time voice translation under <500ms latency, route failures safely, and behave correctly across web, desktop, iOS, Android, Slack, and Teams.
AI can write a lot of the implementation. Your team still owns the standard.
How should the team change by stage?
Treat the stage ladder as an operating heuristic, not a law. At 0-10 customers, do not hire a team because the MVP feels messy. The founder should own product, customer success, and direction; AI should handle boilerplate; outside help should stay limited to brand, legal, and occasional technical review.
At $0-$30K MRR, your first real hire should be a senior full-stack engineer who can say no. The second hire is often a designer-engineer hybrid or product-minded engineer, not a dedicated PM. Outsource the design system, basic compliance prep, and one-off infrastructure work.
At $30K-$200K MRR, add depth where the product is proving demand. That might mean a backend engineer for data and reliability, an eval-focused engineer for LLM workflows, or a customer-success owner who can turn repeated issues into product decisions. Keep using agencies for migrations, audits, mobile builds, and performance sprints.
At 10+ people, start pulling specialty work inside when the trigger is real. Security becomes full-time when sensitive data, enterprise questionnaires, audit pressure, or repeated access-control work starts consuming founder and engineering attention. Forward-deployed engineering can also become a moat in B2B, where engineers who sit close to customers turn messy enterprise workflows into product.
The objections are usually about control
"My data is sensitive, so I cannot outsource DevOps." You are mixing up work with control. Your team owns RLS, IAM, schema, key rotation, audit logs, and retention rules; a vendor can still run the boxes.
"Agencies do not care about my product." Correct, if you outsource product judgment. Wrong, if you outsource a defined sprint with inputs, outputs, and a senior owner on your side.
"AI cannot be trusted with my code." It should not be trusted alone. It should be boxed in by architecture, tests, review, and evals, then used hard where the work is repetitive.
"I will just hire 5 juniors and give them AI tools." That is usually the most expensive version of slow. In our production work, 2 senior builders plus AI beat 5 unsupported juniors on almost every production problem that matters.
The failure mode is outsourcing the wrong layer
The wrong layer is the one where learning compounds. Product judgment, eval design, architecture, distribution, customer voice, and data posture get sharper every week you keep them close.
Everything else should fight for its place in-house. If it is standard, time-boxed, measurable, or below the architecture line, it probably belongs with AI, a vendor, or a senior outside team.
That is the practical version of staying small without staying fragile. Keep your moat. Outsource the commodity. Let AI eat the chores only after you know how to judge the output.
At appssemble, we use this test before we touch a rebuild, an AI workflow, or a mobile sprint.
If you want a second set of eyes on your hiring plan, book a call and we'll map what to hire, outsource, and automate before you spend the budget.