Much of the clear low-hanging fruit are in automating or aggregating fragmented data in tech-neglected industries, and that often involves handling PII or payments data - which quickly exposes you to GDPR and equivalents in every country, for which there isn’t a obvious path to compliance (especially when considering that web tech trends go the opposite direction, like the trend toward edge computing = how do you satisfy data residency requirements? It gets complex fast).