Posted on by Gérard

The most durable thing in your software isn’t in the code.

AI can clone a SaaS product in a week and walk an agent straight through a shallow integration. What survives are three things that compound into one another, plus the human judgment beneath them that no competitor can replicate.

A trader at Jefferies, not an engineer, named the “SaaSpocalypse” panic, which tells you what kind of event this is. Software shed close to $2 trillion from its October peak on the theory that anything can now be cloned in a week. The theory is right about features and wrong about moats. The error is picturing a moat as a wall, one thing you build once and stand behind. The durable defense is a loop, and underneath it sits the part no competitor can vibe-code, because it was never in the code: judgment.

When the app you’ve hand-crafted with care is getting lost in the tsunami of new AI-generated iOS or Android apps, you get a sense that the barrier has changed. When the people repricing an industry sit on a trading desk rather than build the products, you are watching a sentiment event as much as a competitive one, and the two are not the same size. The panic says SaaS is being replaced. The shift says something narrower: the feature set, the part that was easy to defend, stopped being where the defense lives.

Concede the scary part, because it is true. A competent team with modern tooling and enough tokens can clone a single-workflow product in days, where it once took a year and six figures. And it gets worse than cloning: AI agents now walk through shallow integrations, reading across systems and eroding the switching costs on which two decades of SaaS strategy were built. The great wall you thought you had is being climbed from both sides.

The wall is the wrong picture

A wall is static, and anything static can be measured, matched, and scaled. The panic feels total because everyone is inspecting walls: this many features, that certification, this integration count. Every one of them looks vulnerable because the cloning cost of any fixed structure is approaching zero.

The companies that are not panicking have something that does not sit still: three advantages that feed each other, so using the product makes it harder to leave, which makes the next customer easier to win, which deepens the advantage again. Not a wall. A loop. It compounds while you sleep, and a competitor cannot copy a single turn of it because the value was never in a single leg. It was in the turning. Three legs, in the order the loop runs.

Workflow, where the work happens. Your product is under the most active attack, and the current debate has converged on one worth stealing: the system of record versus bolt-on distinction. A bolt-on sits beside the workflow and offers convenience, which is exactly what an agent routes around or what a weekend-vibe-coded clone matches. A system of record sits inside the workflow as the place where the work happens, the thing other tools and people organize around. You do not vibe-code your way out of the products your whole operation runs on, any more than serious workloads casually migrate off SAP, Teamcenter, or Salesforce. The test is brutal: if your product vanished overnight, would the customer’s work stop, or would they mildly miss it? Stop means you are in the workflow. Miss means you are beside it, and most products that are believed to be essential are merely present.

Trust: how you win the position and keep it. Being woven into the workflow raises the stakes, and nobody puts a prototype at the center of their operation. This is where your end-to-end Go-To-Market motion shines and makes the difference. The deeper you sit, the more the customer needs to trust what they cannot easily remove. Trust is permission to be relied on when something breaks: a SOC 2 report, a name procurement recognizes, a phone number that reaches a human accountable for the outcome. A risk committee does not approve the best demo; it approves the vendor it believes will still be answering when the workflow fails at the worst moment. That belief takes years to build and one incident to lose. This is also where partnerships fit. A reseller logo on a slide defends nothing. What a good partner gives you is borrowed trust: a business already trusts its value-added reseller and buys through it, so a go-to-market motion that rides that relationship borrows the trust the customer already extends to someone else. Partnerships are not a separate leg. They are how trust reaches a customer you have not yet reached.

Data, what the running work leaves behind. “Data is the moat” is the most recycled line in the genre, and it is half-wrong, which is what makes the other half easy to miss. a16z and others have spent years puncturing it: raw data is weak, the value of each incremental row declines, and a pile you bought or scraped offers little defense. The critique is correct, and it killed the lazy version of the claim. What it does not touch is the version that matters now. As models commoditize and intelligence becomes a utility, the scarce input swings back to the data the model never saw, and the data that matters is not bought; it is earned, accumulated only because you are the trusted system of record where the work runs, every exception and edge case deposited by use. This is where your operations layer shines. That is the turn the cliché misses: data you can buy is worth what anyone will pay for it, and data the work deposits is the one input a clone cannot start with. It begins this leg at zero and stays there until it has run real customers through real work for real years.

The delay is the moat

Now watch the whole thing turn. Workflow integration earns the right to be trusted. Trust wins and protects the integration. The integrated, trusted product emits proprietary data as the work runs; the data makes it better at the job, which deepens the integration further. No leg is the moat. The moat is the three compounding into one another, which is why a competitor who clones any single leg still loses: match what you do, certify what you are, even buy a data set, and you still do not have the loop, because the loop is made of time.

That is what the wall metaphor hides. The legs are connected by a delay. Trust accrues over years of not breaking; proprietary data over years of real usage. A competitor can ship feature parity on a Tuesday and still face a multi-year wait to spin up the same loop, and enterprise buying enforces every month of it: mid-market sales cycles run around 84 days and have lengthened, not shortened; contracts average about two years; 74% of buyers now weigh switching costs before signing, up from under half in 2018. A better product does not collapse that timeline. It waits in the same line while your loop turns a few more times. The delay is not friction in the moat. The delay is the moat.

The honest leak

A loop this tidy should make a careful reader suspicious, so here is where it leaks. Cursor, the AI coding tool, went from zero to $2 billion in annual revenue by February 2026, the fastest any business-software company has reached that mark, and it did it on word of mouth, with no marketing spend. That is the product spinning up its own loop without the trust apparatus the argument leans on, because when the buyer is a single developer who can adopt without a committee, product quality builds its own distribution, and the trust leg matters less. That edge is already eroding: with Google Antigravity, Claude Code, and OpenAI Codex attacking the workflow leg head-on, trust and data are becoming the differentiators even here.

So the loop is strongest where the buyer is an organization, with procurement, security review, integration debt, and a board asking who is accountable, and weakest where the buyer is one person clicking install. Knowing which you are is the difference between reading this as a warning and reading it as reassurance, and most companies flatter themselves on that question. (Watch, too, the newest leg some argue is forming: when value comes from many humans and agents collaborating in one system, the collaboration layer throws off network effects of its own. If it holds, it joins the loop rather than replacing it.)

The thing the loop is made of

One question is still open, and it is the one that matters most. Who decides which workflow is worth becoming the system of record for? Which incidents warrant over-investing to ensure the trust holds? Which data is worth capturing? None of those is a feature. Each is a judgment, and judgment is the one input in this picture that AI amplifies instead of replaces.

That is the foundation on which the whole loop stands. The reflexive read of AI is that it automates judgment out of the work; the truer read is that it extends judgment’s reach. A person with good judgment, well-instrumented with AI, can now apply it across a surface that used to need a team of a dozen. Execution was the scarce resource, and AI just made it abundant and cheap. Judgment about what to execute is scarce now, and AI turns it into leverage. Point AI at the abundant input, and you get a faster way to do the wrong things. Point it at the scarce one, and you get reach.

This is the final reason a vibe-coded competitor can copy your interface and still lose. It can replicate what your product does. It cannot replicate the accumulated judgment of a team that chose this workflow, earned that trust, captured the right data, watched it break, and learned what good looks like in a domain, because that judgment is not in the code. It is in the people, and in the loop they built. The companies that come through the AI transition stronger will not be the ones that automated judgment out of the loop. They will be the ones who put their best judgment where the loop turns.

What to audit before the next board meeting

The SaaSpocalypse is aimed at the wrong target. It attacks features and shallow integrations, which were never the durable moat, while the real defense was never a wall to inspect at all. It is a loop, and the question is not how high your wall is but whether your loop is turning.

So map yours. Where is your product the system of record the work runs through, and where is it a bolt-on the customer would merely miss? Is your trust earned and certified, or a slide hoping not to be tested? Where do you ride a partner’s trust? Is the relationship real, or just a logo? Is your data earned by usage, or bought and decaying? Then check the arrows between them, because a leg that does not feed the next is not part of a loop; it is a wall with extra steps. And underneath all of it: where is human judgment load-bearing, and are you investing in the people who carry it or quietly automating them away?

Then find the one place you still rely on a single static advantage a funded competitor could match in a quarter. Name it out loud. That is the part of your moat that was never a moat, because it never moved.

Images source: ChatGPT Images / Claude Opus / Gérard Métrailler

Originally published at orion.beehiiv.com.

Sources

Leave a Reply

Your email address will not be published. Required fields are marked *