Short answer: For most refinery owners and industrial contractors, buying or partnering is the safer starting point for software and AI agents, and building makes sense in specific cases. Build when you have engineering capacity, a narrow use case tied to your own systems, and a plan to support it for years. Otherwise, decide by asking who owns five things: process knowledge, ongoing support, security, governance, and proof of results.
Someone on your team has probably built a working demo in a weekend. A spreadsheet became an app. A model read a document and answered a question. It looked good in a meeting.
So the question is fair: why not build the rest ourselves?
Sometimes you should. This guide is for deciding honestly, whether you operate a plant or you are a contractor working inside one. It applies to custom software, integrations, and AI agents, also called digital workers: AI that performs a defined job, such as supporting a JSA, reconciling contractor hours, or following up on missing paperwork.
What does the research say about building versus buying?
MIT's NANDA initiative reported that AI tools bought from specialized vendors or built with partners reached deployment about 67% of the time, while internal builds succeeded about a third as often. The study looked at generative AI broadly, not industrial work specifically, and critics argue its headline numbers oversimplify. Treat it as a signal, not a verdict.
The lesson applies to software too: the demo is rarely the hard part. Support, security, and proof usually are.
Should you build, buy, or do both?
| Option | Works best when | Watch for |
|---|---|---|
| Buy off the shelf | The need is common across industries | Fit to your jobs, sites, and rules |
| Build custom | The work is unique to your operation | Year two support and ownership |
| Partner on a build | You need your process encoded fast | Clear ownership and exit terms |
| Mix | Common parts are bought, unique parts built | Integration between the pieces |
What are the five questions to answer first?
1. Does your team know the work well enough to encode it?
Software and AI agents both have to understand what a job, a site, and a job type mean. Maintenance, emergency work, turnarounds, and capital projects follow different rules. Someone has to define those rules and keep them current. If that knowledge lives in a few experienced heads, building means pulling them off the work they do best.
2. Who owns it in year two?
Most internal builds start with enthusiasm and one capable person. Ask what happens when that person changes roles, when a model or a connected system changes, or when a site needs a new job type. A tool without an owner becomes shelfware.
3. What security questions apply to software and AI agents?
Whoever builds it has to decide what data it can see, how personal information is detected and handled, and how long recordings, photos, transcripts, and records are kept. For AI, add whether your data is used to train models. Incident evidence raises its own retention questions. These are decisions, not features, and your legal and IT teams will want them in writing before any pilot.
4. Who is responsible for governance?
This is usually the first question IT asks. Does the software or agent act under its own identity or a user's credentials? What can it read, and what can it change? Can you trace every action to a rule or a person?
OWASP, a nonprofit security standards group, lists agent goal hijack, where poisoned emails or documents redirect an AI agent, as the top risk for agentic applications. A system that can change records needs limits on what it can change and a record of what it did.
Human oversight belongs in the design. Routine, rules based steps can run on their own. Judgment steps should surface a finding, a recommendation, or a confidence level to the right person. In industrial work, that is a feature, not a limitation.
5. How fast can you show a measured result?
Pick one problem, record a baseline, and set a short window. Idle days, admin hours, hazards identified, or time to payment are all measurable. If a build cannot show movement on one of them quickly, it will compete with every other priority for budget.
What should owner operators and contractors consider?
Your hardest questions are integration and approval. Systems like ERP matter, and your IT and security teams will want answers on data, identity, and audit before a pilot begins. Ask every builder or vendor for those answers early.
Another constraint is usually time. For example, admin work such as aligning hours to work orders and chasing staffing details, task IDs, badge IDs, and expired documents uses the same hours your supervisors need in the field. Judge any option by how quickly it takes that work off your people, and by whether it fits how your customers already require you to work.
Where does Valorian fit?
Valorian builds custom software and digital workers for refinery and industrial contractor work, and our team has worked inside these facilities. We start by learning your work, your pain points, and your workflows. We do not hand you a one size fits all tool.
Some of what we do is live. Some is in pilot. If you ask which is which, we will tell you plainly. Valorian runs a SOC 2 Type II program, and we are glad to walk through our approach to security and governance.
If you are weighing a build, tell us what you are dealing with. We will tell you honestly whether it makes sense to buy, build, or do some of each.
Tell us what you're dealing with.Security and governance
Digital workers