A MicroConf keynote that lists ten ways AI attacks a SaaS business, crosses off the old moats, and names the eight defenses that still hold.
Posted
1 weeks ago
Duration
Format
Talking Head
educational
Views
231.1K
3.7K likes
57 · 43
Big Idea
The argument in one line.
When code approaches free, a SaaS company is only defensible through things a competitor cannot clone: trust, data gravity, permission to act, earned accuracy, approvals, network coordination, learning loops, and operational burden.
Who This Is For
Read if. Skip if.
READ IF YOU ARE…
You run a bootstrapped or small SaaS and want a structured way to judge how exposed it is to AI clones, open source, and platform features.
You are thinking about selling a SaaS in the next few years and want to know what makes buyers still pay strong multiples.
You are choosing what to build next and want to pick a product shape that survives vibe-coded competition.
You sell per-seat software to teams whose headcount AI could shrink, such as support desks, receptionists, or call centers.
SKIP IF…
You want tactics for growth or acquisition; this talk is about defense, not offense.
You are not building or investing in software products.
You want deep frameworks for scoring each moat; the evaluation questions are introduced only briefly at the end.
TL;DR
The full version, fast.
AI will not send all SaaS to zero, but the speaker estimates 10 to 20 percent of SaaS companies will decline or die. Ten attacks drive this: six on the supply side (customers vibe coding the three features they use, competitors hitting parity, open source getting deployable, platforms shipping your feature, agencies selling custom builds at SaaS prices, and models absorbing your product) and four on the demand side (customers going out of business, seats disappearing, workflows becoming irrelevant, and humans no longer using the software). Most classic moats like features, clever code, UX familiarity, and integrations are gone. Eight still work, and the move is to find which ones you have and deliberately grow into more.
Free for members
Chat with this breakdown — free.
Sign in and you get 23 free chat messages on us — ask for the hook, quote a framework, find the exact transcript moment, generate a markdown action plan. Bring your own key when you want unlimited.
Co-written with an M&A advisor after a month of digesting 89 analyst papers; the goal is a middle path between 'SaaS is dead' and 'nothing changed'. Four acts laid out.
02:26 – 08:15
03 · Supply shock: six attacks
Customers build it, competitors reach parity, open source gets deployable, the platform ships your feature, agencies sell custom builds at SaaS prices, and the model absorbs your product.
08:15 – 12:27
04 · Demand shock: four attacks
Customers go out of business, seats disappear, the workflow you manage stops mattering, and humans stop being the ones using the software.
12:27 – 15:42
05 · The classic moats AI killed
Nine reasons customers used to stay, and why only brand, coordination, and system of record survive.
15:42 – 19:00
06 · Why moats matter now: M&A and public markets
Private equity is unsure who will exist in three to five years; HubSpot fell 21 percent on strong earnings while Atlassian rose 35 percent.
19:00 – 21:30
07 · Moat 1: Buyers know and trust you
Brand, knowing how buyers buy, partners who recommend you, and internal champions. QuickBooks and Shopify as examples.
21:30 – 23:27
08 · Moat 2: You're a system of record
Daily operations, approvals, rules, and integrations live in your software. Jira and Gym Desk as examples.
23:27 – 25:25
09 · Moat 3: You're allowed to act
Tools that move money or step into a flow beat tools that only recommend. Stripe Connect, Reimbi, and Churnkey.
25:25 – 26:43
10 · Moat 4: They don't check your work
Years of being right earn output nobody double-checks. Gusto and Avalara.
26:43 – 29:55
11 · Moat 5: Someone official already said yes
Licenses, certifications, and accreditations held by the vendor. Vanta, an ABA training company, and SMS carrier registration.
29:55 – 31:25
12 · Moat 6: Everyone's already in it
Network coordination means switching requires everyone to move at once. Slack and Commit Swimming.
31:25 – 34:02
13 · Moat 7: Every customer makes you smarter
The outcome loop and its three gates. Stripe Radar, Ramp, Churnkey, and Mailchimp's Omnivore.
34:02 – 36:05
14 · Moat 8: It's hard to keep running
Operational burden as defense. ScrapingBee, Cloudflare, and email deliverability at Drip.
36:05 – 38:57
15 · Which moats are possible for you
Eight self-audit questions and a map from current product shape to the moat it could grow into.
38:57 – 39:50
16 · Field guide and event outro
Pitch for the free moats field guide and upcoming MicroConf events.
Atomic Insights
Lines worth screenshotting.
Customers no longer need to clone your 50 features, only the three they actually use.
There are at least 46 AI note takers, and most have near feature parity with each other.
Being ahead on features still buys you time, just far less than it used to.
A plausible estimate is that 10 to 20 percent of SaaS companies will decline or go to zero because of AI, not all of them.
Your UI is effectively a spec that a platform partner can hand to an AI and ship for free to customers it already owns.
Agencies can now sell fully custom software at $299 to $999 a month, competing directly with one-size-fits-all SaaS at $99.
If AI wipes out your customers' industry, as with translation agencies, usage can soar while their ability to pay you collapses.
Support teams shrinking from eight human agents to one or two supervisors is why seat-priced help desks are moving to outcome pricing.
Seat software for receptionists or call centers that does not add an autonomous agent will be undercut by a $300 to $500 agent bundle.
Of nine classic SaaS moats, only brand, coordination between people, and being the system of record survive AI.
An API is now just the spec you hand to a coding agent, so integrations no longer protect you.
HubSpot beat earnings and dropped 21 percent while Atlassian rose 35 percent, because buyers now price moats against AI.
QuickBooks survives as bad software because accountants recommend it, and a better product does not get you into that conversation.
A tool that recommends a payment is a report; a tool that moves the money has a moat.
Nobody checks what Gusto files with the IRS, and that earned trust is what stops a vibe-coded clone from winning.
A competitor can clone your code in a weekend, but regulatory approvals and board accreditations take months.
A learning loop only counts if every customer improves it for all others, customers cannot export what you learned, and it keeps learning.
The infrastructure you resent maintaining, like scraping proxies or spam fighting, can be your strongest moat.
Takeaway
Defend with what AI can't clone
WHAT TO LEARN
As code approaches free, durability comes from trust, data gravity, permission, approvals, networks, learning loops, and operational burden, so audit which you hold and build toward the rest.
02Why this talk exists
AI is a real but partial threat: expect roughly 10 to 20 percent of SaaS to decline or die, not the whole category.
Treat this as a two-sided risk audit, since some threats come from more competitors and others from fewer paying customers.
03Supply shock: six attacks
A customer only has to rebuild the handful of features they use, so product complexity is no longer a defense.
Platforms you integrate with can now ship your feature quickly to customers they already own, using your UI as the spec.
04Demand shock: four attacks
Check whether AI threatens your customers' own business, because collapsing customer revenue becomes churn you cannot win back.
If your price is per seat for roles AI can automate, add an agent or move to outcome pricing before someone bundles one.
05The classic moats AI killed
Features, clever code, UX familiarity, and integrations no longer hold customers once AI can rebuild them and extract data.
Brand, coordination between people, and being the system of record are the classic moats that still survive.
06Why moats matter now: M&A and public markets
Acquirers now price your odds of existing in three to five years, so moats affect valuation even if you never sell.
Public markets already reward moats: a strong HubSpot quarter fell 21 percent while Atlassian rose 35 percent.
07Moat 1: Buyers know and trust you
Trust compounds through ecosystems: when partners build careers recommending you, a better clone cannot even get into the conversation.
Ask who has built their business or career around recommending you, and invest in growing that group.
08Moat 2: You're a system of record
Owning daily operations, approvals, and wired-in systems creates gravity that an afternoon of data export cannot undo.
Test your record-keeping moat by asking what customers cannot export, what breaks downstream, and what they must rebuild.
09Moat 3: You're allowed to act
Software that moves money or steps into a live flow is stickier than software that only recommends an action.
If you build a reporting tool, look for the step where it could take the action itself.
10Moat 4: They don't check your work
Being right for years earns output nobody double-checks, which no newly vibe-coded competitor can claim.
Calculation tools should aim to become the number customers remit without recalculating it.
11Moat 5: Someone official already said yes
Approvals held by you as the vendor, not by your customers, take months to earn while code takes a weekend.
Compliance-heavy areas like SOC 2, accredited courses, and SMS carrier registration slow every new entrant.
12Moat 6: Everyone's already in it
The more people who must coordinate a switch at once, the deeper the moat, as with whole teams or leagues.
Single-seat tools can grow this moat by becoming the place a group coordinates.
13Moat 7: Every customer makes you smarter
A data moat only counts if each customer improves results for all others, the learning stays private, and it keeps improving.
Correction-driven loops like fraud detection or transaction categorization become worth far more pooled than any single customer could build.
14Moat 8: It's hard to keep running
Infrastructure that is easy to build but painful to keep running, like scraping proxies or spam fighting, deters both clones and DIY.
The operational chores you resent maintaining may be the strongest moat you have, so do not rush to eliminate them.
15Which moats are possible for you
Score your product honestly against eight questions, one per moat, and treat each as a scale from zero to 100.
Pick the next moat that matches your product shape, such as point solution to system of record or data collector to learning loop.
Glossary
Terms worth knowing.
SaaSpocalypse
Social media shorthand for the claim that AI coding tools will make most subscription software worthless because anyone can build their own version.
Moat
A durable advantage that makes it hard for competitors to take a company's customers, even when they offer a similar or better product.
Vibe coding
Building software by describing what you want to an AI coding assistant and accepting its output, often by people who are not professional programmers.
Feature parity
The point where a competing product offers essentially the same features as yours, so features stop being a reason to choose you.
System of record
The software that holds the authoritative data for a business process, such as balances, approvals, and statuses, which other tools read from or write to.
Supply shock
A sudden increase in the number of competing products in a category, which pushes prices down and commoditizes them.
Demand shock
A sudden drop in the number of customers able or willing to buy, for example because their own industry is disrupted.
Learning loop
A cycle where a product observes situations, actions, results, and corrections across many customers and uses them to improve its predictions for everyone.
Outcome-based pricing
Charging per resolved result, such as a closed support ticket, rather than per user seat.
SOC 2
A security and data-handling audit standard that many business buyers require from software vendors before signing a contract.
Multiple
The number a buyer multiplies a company's revenue or profit by to set its purchase price; higher multiples mean higher valuations.
See every word as it's spoken — crank it to 2× and still catch all of it. The same dual-channel trick behind Amazon's Kindle + Audible.
17px
analogystory
How the f*** do you survive, if you're a SaaS company, how do you survive in this age of AI? AI is more of a problem probably for every SaaS founder in this room than you think. You know, I could start one today and probably have pretty close feature parity in a few months.
They don't need your 50 features. They only need the three that they use. If you don't agentify your software, build some type of agent on top of it, I think you're going to zero in the next couple of years because someone's going to come along and they're going to, QuickBooks is terrible software.
I hate using it, but I don't care because my accountant uses it and he likes it. You're probably lucky, probably doing pretty well if you have one or two of these. I am going to try to scare you a little bit with this talk.
This is the, I think I have 91 slides, 92 slides. It is by far the densest talk I've ever given. This one has a lot of gravity to it.
You'll notice it's also the, I think the only talk I've ever written, co -written with someone. So it says by Rob Walling and Anner Volset, because Anner Volset spent about a month wrestling with 89 different papers written by... Think tanks, private equity groups, Gartner, mashing them with Claude, a chat GPT going back and forth trying to figure out how the f*** do you survive if you're a SaaS company, how do you survive in this age of AI?
Because what SaaSpocalypse tells us, tells us on social media, is all SaaS is going to zero. So we can say, well, that's not true. It's just not true.
It's objectively not true. But is it going to go back to normal? Are we okay?
Should we ignore it? That's not true either. So there's something in the middle, and that's what we're trying to find with this.
So where we're going today, normally I have three acts, but today I have four. I want to try to get you a little scared. AI is more of a problem probably for every SaaS founder in this room than you think.
I don't want to scare you too much, but just enough to pay attention. I'm going to talk about classic SaaS moats, what I mentioned in SaaS Playbook, if you've read that. I have a few moats and how some of those are dying or have died.
Then talk about what we think are the moats that still work. I have like three or four slides that really could be a whole four -hour workshop on how do you evaluate your SaaS company? What questions do you ask?
I tack it on at the end because it's important, but can't possibly cover that in a 45 -minute talk. So this is a sentiment that we're hearing on the internet. MicroConf, tiny seed.
I'm a founder, SaaS founder. AI is amazing. I'm shipping so much faster.
And obviously, my customers are, hairstylists or lawn care specialists, they're never going to vibe code my product. Okay?
So that is an attack. That's one attack that AI can make against you, is someone, your customer specifically vibe codes your product. So I'm going to now show you 10 attacks, nine additional ones, several of which you probably haven't thought of.
They're grouped into two buckets, the supply side and the demand side. Okay? So basic economics.
If we have a widget, and suddenly the supply of widgets goes way up, the price of widgets go down, they get commoditized, you lose as a company. You lose as a founder, right? Well, SaaS can be the same thing.
Imagine you have a single SaaS application that does scheduling links, and suddenly there are 99 others. There's a huge supply. It becomes very messy.
So when the supply gets shocked, that's a problem. On the other side, demand is, well, these are my customers, right? People buying.
Well, what if I have a million potential customers in the US and their businesses, and let's say 90 % of them go out of business tomorrow? Suddenly, my demand plummets. This is bad.
Both of these are bad. So I'm going to cover 10 across supply and demand. I'm going to break them into those buckets.
The supply shock has six different vectors that AI can come after you with. The thing to remember is... AI, everyone gets AI, not just you and not just your customers.
Everyone gets AI. So the first attack is the one we all think about. Your customer builds it, right?
Some people say, my app's pretty complicated. It has 50 different features. You're going to get the slides at the end, by the way.
But 50 different features, they're never going to vibe code it. One thing to think about is they don't need your 50 features. They only need the three that they use, all right?
Second attack is competitors reaching parity very quickly. This slide shows eight of the 46 different AI note takers that I could find on the internet. And it's, what is it?
Otter, Fireflies, Crisp, Fathom, TLDV, Read AI, Circleback, Granola. And I wanted to show them in this order because, you know, you think about your otter in 2016 and you're like, oh, I got this all to myself. This is amazing.
And now we have granola and everyone in between who almost, they almost all have feature parity. They're kind of the same product. And I know that would piss off the founders if they were here, but you don't, I could start one today and probably have pretty close feature parity in a few months.
That's a great for an upstart. And it's really bad for your supply. It's a supply shock that everyone can get to feature parity with most apps these days.
Features used to buy you a lot of time. They buy you a lot less time. So, attack number one was customers.
Attack number two, competitors. Attack number three is open source. I have already seen this.
There are more open source projects. There are more open source projects working, moving faster than they used to because, if I'm coding, everybody gets AI. They're moving faster, and non -technical buyers who used to stay away from open source, They can deploy it because they talk to cloud or cloud code, and they can run open source.
None of these causes saspocalypse. Ten of them together makes a difference. My estimate, and this is just me doing this for 20 years and taking a guess, said this multiple times, I think somewhere saspocalypse says everything's going to zero and everyone's plateauing.
That's not happening. That's not true. I think somewhere between 10 % and 20 % of all SaaS companies in the world are either going to decline or go to zero.
That's a lot. It's a lot, and it's not. I mean, does that include little indie hacker projects?
Probably. That's still a lot, right? 10%, 20 %?
That gives you an idea. Tack number four is a platform, like a system of record that you're tied into, ships your feature for free because they can build it in a week, a month. They can build it a lot faster.
They already have the customers. You've basically given them a spec through your UI. They could feasibly, if you're an add -on to something, they could go out.
I'm imagining if you're, well, anything that ties into a CRM. Isn't Salesforce and HubSpot and Close and any other CRMs just going to start building all the ancillary things because they're just easier to build now? So your platform.
This is like an integration partner that's going to come for you, I think. Track number five, we're seeing this. Custom software at SaaS prices, approximately.
If you're an agency, you used to charge 30 grand, 50 grand for a build because it took three months. Now you can vibe code it. You can code it with AI assistance in a third, fourth, fifth of the time.
And you always want to, agencies want recurring revenue. If I'm charging $99 a month for mine, my one size fits all, agency charges, whether it's $299, $499, $999, whatever it is, completely custom, made for you, supported for you. This model is becoming a thing.
In fact, if I were in my early 20s, I would think about something like this. This is a really interesting business model. It's still an attack on SaaS.
And the sixth supply side is if the model absorbs your product. This may or may not happen, but you... Remember when we used to pay apps to generate ad copy and headlines and images and all that stuff?
Those apps went away, and there's a bunch of examples of others that have as well. All right, so that's the supply. Demand shock, there are four of these.
The demand shock I find, and when Anders started bringing these to me, I was like, oh, I hadn't thought of that. I hadn't thought of that. And most SaaS founders, the founders that I've talked to as I've been writing this talk are like, I didn't even think about that.
What if your customers just go out of business? 50%, 90%, whatever the number is, huge swaths that AI wipes them out. So imagine that your SaaS serves translation agencies or transcription agencies that used to have a human sitting there listening to something.
The number of words translated and transcribed since AI have gone through the roof. right? There's a lot more volume of this happening.
The revenue of these agencies is effectively going to zero because we are basically using AI. Now, one can argue there's going to stay some boutique agencies if you're doing medical transcription, I'm sure, or translation. You know, there's certain areas where this is critical.
But this ecosystem is going to take a big hit. I mean, I say 10 to 20 percent of SaaS is going to experience a problem. 80 percent, 90 percent of these agencies are are going to zero.
There's big disruptions in copywriting as well. There's a lot of things. So while the activity grows, your customer's ability to pay you plummets.
If your customers start going out of business, there's no recovery from that, right? In terms of that's just involuntary churn. Tack number eight, are your seats going away?
This one we've heard. Remember when Saspocalypse came up and they're like, seats are going away because agents are going to do everything. Yes and no.
In some businesses, seats are going to have a problem because if you are Zendesk and you are customer service or customer support software, I think when Derek and I left Drip, we had six or eight customer support and we had six customer success. Now, so that was about 12 people. Customer success these days still can't, is not agentic yet.
Customer support is 80, 90 % automated in a lot of things. So suddenly you have... go from eight agents to maybe one or two that is supervising a bunch of, yes, eight human agents down to one or two AI agents, and they're just supervising them, right?
So you have massive contraction of seats.
And you'll see Zendesk and Help Scout and these folks moving towards outcome -based. There's a bunch of things they're doing with pricing to try to get around this. It's still a big shock.
Attack number nine of 10. Does the thing you manage still matter? Are people using it at all?
Or does it just go away because of AI, whether it's agents? Imagine that you were software to manage take -home coding tests. We don't do those anymore, right?
The whole category of software, managing take -home code, because if you give someone a take -home coding test, what do they do? Well, they're going to use AI for it, but you want them to use AI. How much did they do versus how much did the AI do?
So Derek and I were just talking, you're mentioned like six times in my talk, I guess. You and I were just talking on the podcast a couple of weeks ago, talking about hiring. And it's like, well, we do pair programming now.
That's what I would do, right? You're not going to, I'm not going to take home a coding test. So some people in this room impacted by it, others not, it's still an attack.
The 10th and final one is, it's related to seats, but it's different. Imagine if you were software for receptionists, or almost like call centers, where they are going to be replaced by AI agents. So you have a bunch of seats, there's a bunch of humans, and you have software you're selling for $50 a month.
If you don't agentify your software, build some type of agent on top of it, I think you're going to zero in the next couple of years because someone's going to come along and they're going to say, yeah, you want that software plus like a fully autonomous, let's say 90 % accurate agent for $300, $500 a month when you're paying 50 bucks a month, but you can let the receptionist go or the call center people.
They're going to pay the three to 500 bucks or whatever that is. So is the human even using your software anymore? related to seats, but it's different.
So that's the part that gets you scared, to make you think, you know, I need to pay attention, because even if your business is doing okay today, and you're bootstrapping, and you just want to run it forever, some of this stuff's coming for you now, and some of it's coming for us over the next few years. All right, so we're going to talk about some, I'm going to zip through this part.
This is like classic moats that I've thought about, that we've talked about in SaaS traditionally, why customers used to stick around. I came up with nine reasons. I saw this slide this morning and I realized, yeah, there's probably eight, but whatever, it doesn't really matter.
So it used to be, I have unique features, they're not going to leave because they need these features. I have a real strong brand they're going to stick with me for or continue to buy from me for. I have these owned traffic channels.
I have SEO that I've been doing for years. Clever code, complex algorithms, five years of honing, refining, working around buggy APIs, whatever else. The team is familiar with my UX.
They don't want to retrain people, so they're not going to switch. I have 30 integrations. Man, those are complex to build, aren't they?
High switching costs. It's hard to get my data out. It can't really export, and then configuring in the new workflow thing on the other place is a pain in the butt.
If multiple people are in my app coordinating, similar to retraining, it's like everyone has to move at once, and we cut over on this day. And then I'm a system of record where all this data comes in, and it's complicated to move, right? These are nine reasons I came up with.
There are probably more. And we're just going to check a few of these off, shall we? So what does AI do?
AI makes building features, doesn't bring it to zero. I don't want to act through this talk like suddenly I can build a years worth of software in a week. That's not true.
But it dramatically reduces the moat or the barrier to just rolling out new features that competitors have. Feature parity, I think products are going to all kind of converge because whoever's really good at product and UX, people are just going to wind up copying them with AI. Own traffic channels.
This one I'm 50 -50 on. Yeah, if you have really good SEO, it's fine. Is AI making marketing?
And just like it's making, kind of starting to trivialize code, is it starting to make marketing really muddy? It is. Clever code.
I think we can just admit that someone can probably, now that AI is solving 100 math proofs, anyone hear about this? There's like 100 math proofs that haven't been... solved ever in human history, and they're saying inside it was Anthropic or Gemini or somebody.
They just solved 100 of them. And Einar and I were talking, and I was like, well, glad I'm not getting my PhD in math. It's like, what do you do anymore, right?
AI's doing it. UX familiarity, yes, if it's still humans. If things go agentic, your UX doesn't matter at all.
Integrations, isn't the API really just the spec to hand to? to my uh my bot now to code the thing oh no i'm getting depressed all right and high switching costs used to be a thing they still are a little bit but man have you have you seen someone point an ai at an app and say pull out all my data even when there's no export yeah it really can and does happen so um of these nine i think three are still like system of record is a real thing you're gonna see it in this list here coordination between people is a thing and a brand plus some stuff is the thing so We have these three.
I'm going to add five more. And we're going to dig into those now. This is the meaty, meaty part of the talk.
So for each of these... Hey, real quick. If you're getting value out of this talk, you should subscribe to the MicroConf YouTube channel.
We're posting all the talks from MicroConf Europe. So even if you couldn't make it to Iceland, you can still get a lot of the learnings from the event. We also have a back catalog of some amazing talks from our previous events.
All right, let's dive back in. I'm going to... I'm going to say what the mode is.
I'm going to give at least two examples for each one. And that's probably the important part of the talk. I tried to give a big name example we all know and tried to do a smaller, like, microconf tiny seed company just because I don't want to just give, hey, you should be Slack, Facebook, and Google.
Like, this is not helpful, right? So I tried to do a big one, a small one, and then there's a question at the end to help you almost evaluate your own... product in the context of this.
Something I didn't say at the beginning is that the M &A market, one of the reasons ANR, so ANR came at this problem from private equity and the M &A market, because a big part of what makes the whole SaaS ecosystem work and so valuable is that private equity, which does 70 % of the acquisitions of our types of SaaS companies, they have been paying incredible multiples.
for the past six, eight years, maybe a little longer. And they follow public markets. So as HubSpot or Atlassian move, so does private equity, and these multiples change.
Even if you never plan to sell, this ecosystem works because a lot of money has been flowing into it. If you don't have any of these moats, what Einar has been seeing at Discretion Capital, right? He runs a sell -side M &A advisory for two to $20 million SaaS companies.
What they've seen is that private equity and strategic buyers as well are really scared, not about the present, but they don't know if you're going to be around in a year, three, five years. So he came at it as, what can you have in your business that gives them confidence that you're going to be around in three to five years, such that they will pay our old multiples that we've talked about all this time.
I come at it from more of the founder side. He comes at it from kind of the finance, private equity side. And that's why these modes are important.
Even if you never plan to sell, even if you're bootstrapped, these are defenses against AI. And the other interesting thing, I had a couple slides I pulled out, and it's about Atlassian and HubSpot within a day of each other in August. This is about five weeks ago.
They reported their earnings. And HubSpot beat earnings. beat almost every expectation, did a billion -dollar stock buyback, and their stock dropped 21%.
And Atlassian had similar results, but their MCP server had doubled in use. It had a bunch of AI was making it better. They went up 35%.
It was a huge swing. Imagine tens of billions of dollars moving around. And when we look at it, it's like, well, Atlassian and Jira specifically has several of these moats.
And HubSpot's inbound marketing engine is probably going to, I wouldn't say wiped out, is massively negatively impacted by AI. So we're already seeing it in public markets. We're seeing it in private equity and acquisition markets.
And obviously, we are seeing or going to see it in the bootstrapper markets as well. Let's dive into the moats. The first one is that buyers know and trust you.
I've tried to summarize each of these with this phrasing, but then there's bullets. It's like, well, what does that mean, right? It's a strong brand.
And also, you know your buyers and you know how they buy. You have partners, potentially, that have built their businesses around recommending you. And you have a champion inside a company that will fight for you.
So the true, like, strongest form of this moat is when a competitor who came in with better software, who can vibe code it, still has to build all of this, all right? A lot of these moats, actually all of them, they're not on or off.
It's not a bit. Maybe it's a zero to 10, right? A zero to 100.
And you could say, well, Salesforce or Shopify are at 90 out of this, you know? And you can say, well, maybe I'm at 10 now. How do I get to 20 or 30?
Examples of this. Strong brand, you know the buyers, partners recommend you. QuickBooks is a perfect example of this.
Huge ecosystem. We could replicate QuickBooks tomorrow, and we would be fighting against the accountants. QuickBooks is terrible software.
I hate using it, but I don't care because my accountant uses it, and he likes it, and a better product doesn't get you in this conversation. I mean, Xero's doing okay, but what is Xero? 10, 12 years into this?
Shopify is another example. Their partner network is extensive. There's a bajillion agencies, I think literally thousands of agencies that implement Shopify stores.
So yeah, hey, there it is on the slide. It must be true. So when a merchant, if you go to, a merchant goes to hire an agency and says, what cart should I use?
Well, they're like, well, obviously we're going to do Shopify, right? The platform's already decided.
The moat, two questions. I'm sorry, the moat, two examples. And now we have the question, which is.
Who's built their business or their career around recommending or defending you? That's one way to evaluate this. Vote number two.
You are a system of record. What does that mean? It's a source of truth within a business for data.
This is where daily operations are built around you. It means people are logging in every day to do stuff. You might be the operating system of that business.
That if you go down, the business is like, shit, out of luck. They can barely do stuff. There are systems of record that aren't just the operating system.
If they have a source of data that can't be easily exported and that everyone's working in all the time. But I think the biggest mode here is daily operations are built around you. You have balances, you have approvals, you have statuses, you have all types of stuff, workflows, living.
Rules and rules are configured and a lot of other systems are wired in. Either reading from it. to act or pumping data in to you and that data doesn't come out jira is a good example of this right we think of it as just an issue tracker but there is so much i mean devs and managers and product people you have multiple teams in jira and you could export your tickets in an afternoon But migrating all the history, the audit trail, the integrations, and getting all those teams to move to a different system would be very, very painful.
So the fact that it is a system of record just has gravity, it has weight, and it keeps you there. Gym Desk is a tiny seed company. He had an amazing, amazing life -changing exit.
And it's basically, imagine your gym, martial arts store, dojo, yoga studio, your entire business runs on him. And it started as, I don't even remember, it was like, a part of the gym and then suddenly he's like integrating with hardware so people can use like a fob to get in the door and every aspect of the gym is just invoicing and billing and just kept spreading and so now if you're a gym you get gym desk done no one very few are going to switch off this for any type of ai so the question is if your customer wants to leave what can't they export what breaks downstream and what would what would they have to rebuild Mot number three, this is where it starts to get esoteric, where Einar showed me these and I was like, what do these mean?
And I had to spend hours thinking through. You're allowed to act. What does that mean?
So if you're a tool that recommends that a clerk makes a payment, you're one type of tool, versus a tool that can make the payment, that can actually move money. So do you give them a spreadsheet with a list of PayPal emails? and dollars, okay, so you're like a report, you're an analysis, you're a reporting tool, or do you actually move the money?
If you can move the money, then you act. Examples of this, Stripe Connect. No one's switching off Stripe Connect.
Doesn't just recommend a payment, it actually moves money.
Tiny C Company, re -emby. It reimburses, if I wanted to pull a job candidate in, fly them out, and they have expenses, meals, hotel, other stuff. I don't want to sign up as a vendor in my system.
I want to pay them via Venmo, PayPal, Cash App. re -envy does the whole thing soup to nuts. The fact that re -envy can act means that it has a pretty nice moat here.
You don't have to be Stripe to have the authority to pay.
And I threw a third one in here, churn key. Which is, if you're a SaaS company, you can put churn key in, and they have offers when people go to churn. And they help, they offer discounts, and they offer all kinds of different variations to try to reduce your churn.
And there's a lot of tools that will tell you who's about to churn, but churn key is literally allowed to get in the cancellation flow and make an offer. They're allowed to act. They're allowed to step in front of your customers, and you don't even check on them.
Question here is can you act, can your software act or can it only advise? Are you a reporting tool or something that actually does something?
Moat number four is that, this is another one, when he said it, I was like, what are you talking about? They don't check your work.
The best example of this is Gusto. I've used Gusto for 10 years at least. No, no, since 2013 probably, 13 years.
And I've never once. checked their work. I could go to jail for IRS something or other if Gusto decided to fuck me because I have never once looked at anything but the W -2 they issued to me.
You just don't. And we can say, well, it's complicated. Like, why don't I?
Well, I don't know. I don't understand it. Great.
So am I going to switch when someone AI vibe codes a Gusto competitor? I'm not because these guys got it dialed. Another example, this is Avalara, also a tax.
This is sales tax, though. Once again, we don't check the number. This was when I had, I struggled to find like a small, like a tiny seed microconf example of this.
So I have two big ones. And it's not just, hey, we're trustworthy. They've earned this permission, right?
They've been right for years and years and years. So if you were to, like I said, vibe code Gusto or Avalara, switching is not likely.
All right. We're in the homestretch here. The fifth one, oh yeah, this is the one we added the other day because it had gotten lumped in.
Man, you do this long enough and they start lumping in. At one point we had 10 and then realized, yeah, you can imagine this, how this goes trying to build something like this from nothing. So this one is that someone official already said yes.
And what I mean by that is, this is where their regulations, licenses, accreditations, certifications, right? Anything where there's a third party board or body. that is monitoring these things, and that you, as the vendor, have to qualify, get certified, et cetera, et cetera.
Just because your customer, I guess I have a bullet here, but just because your customers do it, yeah, yeah. Serving regulated customers isn't the same as holding an approval yourself, and because the competitor can clone your code. Again, every one of these is like, all right, if cloning the code, let's just assume it gets faster and faster, easier and easier, and it goes to zero, much like hard drive space did.
Internet speeds, bandwidth, all that, right? It just approached zero. It didn't get to zero, but it approached zero.
Let's assume, for the sake of argument, code approaches zero. What else are these modes doing for us? And this is where you have to get...
This can be the ISO 27001. It can be... I want to say GDPR.
That's not what I mean. A SOC 2 is what I'm thinking of. And these are just little speed bumps in the road.
But it can also be things like, well, I'll get to it in a second, I guess HIPAA is another one. So compliance is so brutal that Vant is literally a billion -dollar company, and they just spring up over the past. I mean, they haven't been around for more than five or six years.
Because these things are tough, and they take a while, they're expensive. An example of a tiny seed company that works with this, and if you were to try to vibe code this exact same thing, it would be very hard. Because no one in here knows what ABA is, except for the founder.
I forget what it is. But it's like a... element of psychology, and it's related to that.
But they have courses that count towards credentials. And if you try to vibe code this, you have to get board approval. And are any of us going to go through that?
No. So she has a moat around her business. Another example of this is one that I just thought of in the last couple days.
Sending text in the U .S. is shockingly difficult, and the laws are way worse than email. We thought we had it bad with Drip.
When I deal with the text, the SMS companies in TinySeed, I'm like, good Lord, I would never start a business in that. Well, that's a moat right there, right? So you have to, there's carrier registration, there's consent laws, there's all types of ways.
It is very cumbersome. The software for this is not that hard to code, but dealing with texting is not fun. So that is a bit, you know, is it 100 % no one's ever going to do it?
No, but it is going to be a barrier. The question here is what approval, complexity, what legal stuff do you know, have you navigated, that a competitor would have to earn? Number six is that everyone's already in the software.
This is the idea of network effect. Who has to move if they leave your software? Is it one person?
Well, they can switch in an afternoon, right? You have a whole team? All right, everyone agrees, we move next week.
It's a whole community or a whole company all at once. It's painful. So the more folks that are in there coordinating, the bigger the moat.
Obviously, prototypical example of this is Slack. Some of us love it. Some of us hate it.
We all try to move off of it. No one does. There's competitors to Slack.
We can't name them because Slack is the king. But you don't have to be Slack. Commit Swimming is a tiny seed company.
Swim team management built for coaches. But what they do is, and a lot of the swim, there's adult swim teams, but imagine there's a bunch of kids swim teams and they get all the parents signed up for it and it's notifications, right? Here's the meet, here's the location, we're all doing this pizza party, blah, blah, blah.
Every family's all signed up. These are all non -technical folks generally. So switching doesn't just mean to move the software.
It's like everybody has to move all at once and the whole league has to agree. Like it's a pain in the ass. So the question here, this one's very interesting and obviously hard to achieve.
Would a competitor have to move everyone at once is the question. Number seven of eight. Every customer that you have makes your software smarter.
You're going to hear me talk and use the phrase learning loop. Einar's going to be talking about learning loops in a couple hours. Example of this is Stripe Radar.
which identifies fraud. And every merchant that Stripe has sees fraud patterns, and that feeds up into a Borg -like mind that protects all the other merchants. So if you were to try to go start your own Stripe radar with just your data, it's worth way, way, way, way, way less than Stripe radar.
And their system gets smarter. No single merchant could ever build it, right? And if you leave it, you lose it.
The diagram here is a situation comes up. human or software takes an action, you see what the result is, and then you correct and make it better. If you have a lot of data, it doesn't matter.
You have to be able to use that data to predict across all your customers, because that then becomes the moat, because switching means you lose it. Another example of this is RAMP, which is bookkeeping, and every correction that one of their customers makes. to a Verizon line item.
Oh, I'm going to do that as a cell phone, whatever. Well, everybody else gets that too, right? That's a trivial example, but you get the idea.
And then churn key, again, every cancellation in theory should make their engine better. I don't actually, I didn't have a chance to contact the churn key guys. I don't know if they're actually doing that, if they're doing a feedback loop, but you can bet that I'll be contacting them after this talk and say, build that in because you should have this mode.
So this one only counts if you have Clear three gates. Number one, every customer makes it better for every other.
Can't just be siloed that this customer makes it better for themselves because then they can go build it or a competitor can build it. Number two, customers can take their data but not what you learn from it. Yeah, they can export it, but they don't know what you learn.
And the last one is you have to keep learning, right? Because if it's stagnant and you don't get better over time, then it doesn't matter. They can just leave.
Another example I thought about this is MailChimp. MailChimp's the only ESP that ever made freemium work because the biggest thing in email is spam, and they built an engine called Omnivore that figured out how to detect spam at a machine learning level. This was in 09, like way before any of this AI came out.
They're another good example. So your question is, does what happens to one customer make your product smarter for the rest? And the last one...
that I added just a couple days ago based on this Peter Levels tweet. It's hard to keep running. So Peter Levels tweets, I've tried for weeks now.
He's Peter Levels, indie hacker, half a million followers on Twitter. He's just vibe coding everything. I mean, even like $20, $30 stuff, he wants to like vibe code and host it himself because that's what Peter does.
So he's at the extreme end of that. He's trying to vibe code everything. So he tried to do scraping bee.
which is a, it's a proxy, it's a time to see company proxy service that helps you not get blocked as you try to scrape things, right? Because everybody blocks your IPs. Tried to code it, tried to code it.
Finally, he's like, fuck it. I'm just going to pay him 99 bucks a month. So if you look at his list of, he said, these are the only things I'm paying for now.
It's Cloudflare, like raw server, bare metal server boxes and VPS and blah, blah, blah, and Scraping Bee. And it's like, well, what a trip. These massive companies are scraping me.
Well, why is that? Well, it's because... Web scraping isn't that hard to build, but to keep it working and not get blocked is a pain in the ass.
It's a bunch of DevOps. It's servers. It's cycling IPs.
It's a huge headache to run. It's a burden. Scraping big guys sold.
They had a great exit, eight -figure cash exit they've been public about. But they didn't want to run it anymore. It was such a pain in the ass, but that was their moat.
Cloudflare, same exact thing, right? Are you going to vibe code to Cloudflare? If someone else vibe codes Cloudflare, am I going to switch?
No. It's a crazy moat. It's just hard to run.
Drip. God rest our souls, Derek Reimer, that we survived this. Drip was, anyone can send an email.
And this is why when I see people, I've seen someone like Vibe Code, kind of an ESP, right? And say, just plug in your Amazon SES and you can send your own email. And yep, Benedict, you as well.
We just kind of chortled because it's like, no, no, you don't understand. We had multiple full -time people. All they did was try to fight spam.
You hook it into your SES account. Like, it's a problem, right? So these are moats.
The question here is, is it hard to build or is it hard to keep running? Because that thing that you hate and resent can actually be a moat. These are the eight.
And now I'm going to wrap up with just a couple slides. These are more of a thought experiment that we're, I mean, we're going to be fleshing this next part out into hours and hours of stuff. So it's going to be quick.
But I want to answer the question quickly, like which of these are possible for you? And there's eight questions. Each one corresponds to a moat.
There's probably two, three, four questions we could ask for each of these, right? So it's like, who has built, you've heard some of these, who's built their career or business around recommending you? Do you hold the definitive view of the work, right?
Are you a record of the work? Are you a system of record? Are you just a view of it?
Do you take action or do you just recommend it? Do customers trust your output enough that they don't check you? What approval, this is the regulation one, right?
What approvals, regulations do you hold that a newcomer has to wait for? Who has to agree to replace you? Does one customer's experience make it better for everyone?
And what do you maintain that you resent maintaining? That's my favorite. And I think this is the last slide.
It is, these are just examples that I was like, for each of the moats, how would I go from where I am today to try to have that moat? So if I was, and these are in the same order as well. So it's like if I had a vertical tool, I want to build an ecosystem.
I want the vendor, I want to become the one that the industry recommends, right? If I'm a point solution, can I become a system of record?
If I'm a reporting tool that gives reports, can I figure out how to act and actually move the money or actually put the churn thing, not just recommend it? If I have something that calculates something, how do I get to be the output that nobody double -checks? If I'm in a regulated industry, how do I become an approved or the approved provider?
Don't we see Anthropic and all the AI providers trying to basically regulate their industry so that they pull the ladder up behind them? If I'm a single -seat tool, can I build that network of facts that everyone's coordinating? If I collect data, can I build a learning loop?
And if I have infrastructure that I babysit and I despise and hate, will that be a burden that no one else will carry? So, in conclusion, try to figure out which ones are yours or which ones you can move into. Maybe you have one of these today.
You're probably lucky. You're probably doing pretty well if you have one or two of these, I think. So if you figure out which ones are yours or you move towards them, you're worth more.
Business is more defensible. And as I said, this talk was about moats, about defense. And we're going to hear from Einar in a couple hours about how to go on offense.
So that's it for me for today. We have time for questions.
Thanks for watching. There was a lot in that talk, so we turned it into a free field guide. The 10 attacks, the eight moats, and a scorecard you can fill out for your own business.
Head to microconf .com slash moats, and we'll send you the guide. You'll also get the recording of the Q &A from after the talk. We're not posting that one on YouTube, so this is the only place to get it.
And if you want to be in the room next time, in 2027, MicroConf is headed to Austin, Texas in April, and Dubrovnik, Croatia in October. Watching these talks on YouTube is great, but the real magic happens... person you're in a room with about 250 founders who get exactly what you're building and some of the best conversations happen in the hallway between the talks the last seven maybe eight microcomps has sold out so grab your tickets now at microconf .com slash events if you want to go these events will sell out and i hope to see you there and if you already have your ticket or you're just ready for another great talk check out this one right here i'll see you over there
The Hook
The bait, then the rug-pull.
The talk opens with a cold-open montage of its scariest lines, then promises a middle path between the doom of SaaSpocalypse and pretending nothing has changed. Ninety-plus slides later, the reader has a list of ten attacks and eight moats to hold their own product against.
Frameworks
Named ideas worth stealing.
03:23list
The 10 AI attacks on SaaS
Supply 1: Your customer builds it
Supply 2: A competitor reaches parity
Supply 3: Open source gets good enough
Supply 4: The platform ships your feature for free
Supply 5: Custom software at SaaS prices
Supply 6: The model absorbs your product
Demand 7: Your customer stops existing
Demand 8: Your seats go away
Demand 9: The step you manage stops mattering
Demand 10: A human is no longer the one using your software
Threats grouped by economics: supply shocks flood your category with alternatives, demand shocks shrink the pool of customers who can pay.
Steal fora risk audit of any software product or a pre-sale diligence checklist
12:52list
Nine reasons customers stayed
Unique features (dead)
A strong brand (survives)
Owned traffic channels (weakened)
Clever code (dead)
UX familiarity (dead if agentic)
Integrations (dead)
High switching costs (weakened)
Coordination between people (survives)
The system of record (survives)
The classic SaaS retention reasons, with AI crossing most of them off.
Steal forexplaining why feature-led positioning no longer works
36:05list
The eight moats that still work
Buyers know and trust you
You're a system of record
You're allowed to act
They don't check your work
Someone official already said yes
Everyone's already in it
Every customer makes you smarter
It's hard to keep running
Defenses that do not depend on code being hard to write; each is a scale, not a switch.
Steal forpositioning a product against vibe-coded competitors
32:08model
The outcome loop
Situation
Action
Result
Correction
A learning loop that compounds across customers; it only counts if it clears three gates: shared improvement, non-exportable learning, and continuous learning.
Steal fordesigning data features that create real switching costs
37:11list
How to get there from here
Vertical tool to the vendor the industry recommends
Point solution to system of record
Reporting tool to permission to act
Calculator to the output nobody double-checks
Regulated industry to an approved provider
Single-seat tool to a network everyone coordinates in
Data collector to a learning loop
Infrastructure you babysit to a burden no one else will carry
A migration path from each common product shape to the moat it can most naturally grow into.
Steal forproduct roadmap planning
CTA Breakdown
How they asked for the click.
VERBAL ASK
38:57link
“Head to microconf.com slash moats, and we'll send you the guide.”
Post-talk voiceover offers a free field guide with the 10 attacks, 8 moats, and a scorecard, plus the unreleased Q&A recording as an exclusive, then pitches MicroConf events. A mid-talk subscribe plug runs around 16 minutes in.
Add Modern Creator as a preferred source and Google shows you more of our breakdowns in Search, Top Stories, and AI Overviews. It only changes what you see, and you can undo it in your Google settings anytime.
Add to Preferred SourcesOpens your Google source preferences with us pre-loaded. Tick the box and you're done.
A founder who scaled one SaaS to 100,000 signups in 100 days lays out the four-step filter he'd use to start over with none of his reputation behind him.
A three-hour-forty webinar where Russell Brunson and Todd Dickerson build working SaaS apps live from one-sentence prompts, then wrap the demo in an offer for the software that turns your frameworks into your own product.
An 11-minute insider breakdown of the AI second brain project that reveals how companies are already copying employee knowledge — and how to get to the other side of it.
00:30
01:19
02:06
02:50
03:17
04:14
05:23
05:43
06:13
06:43
07:13
07:50
08:10
08:48
09:38
10:12
10:44
11:12
11:32
12:24
12:43
13:11
13:41
14:11
14:41
15:51
15:58
16:40
17:10
18:06
18:40
19:07
20:09
20:39
21:07
21:39
22:42
23:16
23:26
24:38
25:23
26:08
26:43
27:01
28:15
28:37
29:07
29:44
29:52
31:07
31:22
32:36
33:06
33:36
34:03
34:55
35:25
36:22
37:05
37:35
38:35
38:51
09:26
46:17
3:43:22
11:03
Video of the Day1:34:06
30:46