The Only SaaS Moats Left in 2026
Rob Walling's MicroConf Europe talk argues that AI isn't ending SaaS, but it is quietly dismantling most of the moats founders relied on. He lays out ten ways AI can attack a SaaS business — six supply-side (customers, competitors, open source, platforms, agencies, the models themselves) and four demand-side (customers going out of business, seat contraction, the managed workflow disappearing, humans being replaced by agents) — and estimates 10–20% of SaaS companies will decline or go to zero. He then names eight moats he thinks still hold, each with a big-name and a small bootstrapped example, plus the question you should ask to test whether you have it.
- Walling's estimate, co-developed with his M&A-side co-author who runs a sell-side advisory for $2–20M SaaS companies, is that 10–20% of all SaaS businesses will decline or go to zero — not the total 'SaaS-pocalypse' of social media, but far from business as usual.
- The supply-side attacks are: customers vibe-coding the three features they actually use, competitors hitting feature parity fast (he counted 46 AI note-takers), AI-accelerated open source that non-technical buyers can now deploy, platforms shipping your feature because your UI was the spec, agencies selling custom builds at near-SaaS prices with recurring revenue, and foundation models absorbing thin wrapper products.
- The demand-side attacks are less obvious: your customers' own industries being wiped out (translation and transcription agencies), seat counts collapsing as support goes 80–90% automated, the thing you manage ceasing to exist (take-home coding test software), and humans using your software being replaced outright by agents.
- Of nine classic moats, he says AI has eroded six — features, clever code, integrations, UX familiarity, owned traffic/SEO, and even high switching costs, since AI can extract data from apps with no export.
- The eight moats he believes still work: buyers know and trust you (QuickBooks, Shopify), you're a system of record (Jira, Gymdesk), you're allowed to act rather than advise (Stripe Connect, Reimbi, Churnkey), customers don't check your work (Gusto, Avalara), someone official already approved you (SOC 2, HIPAA, board-accredited courses, SMS carrier registration), everyone is already in the software (Slack, Commit Swimming), every customer makes the product smarter (Stripe Radar, Ramp, Mailchimp's Omnivore), and it's simply hard to keep running (ScrapingBee, Cloudflare, Drip's spam fighting).
- The learning-loop moat only counts if three gates are met: one customer's data improves the product for everyone, customers can export their data but not what you learned from it, and the system keeps improving.
- These moats matter even for founders who never plan to sell, because private equity does roughly 70% of acquisitions in this market and buyers are now discounting companies they can't see surviving three to five years.
- His favorite diagnostic question: 'What do you maintain that you resent maintaining?' — the operational burden you hate is often the thing a competitor won't replicate.
The sharpest version of the demand-side threat: a competitor doesn't beat you on features, it removes the human who was using your software at all.
Imagine if you were software for receptionists... if you don't agentify your software, build some type of agent on top of it, I think you're going to zero in the next couple years. Cuz someone's going to come along and they're going to say, 'Yeah, you want that software plus a fully autonomous, let's say 90% accurate agent for $300, $500 a month when you're paying 50 bucks a month, but you can let the receptionist go?'
A concrete market signal that public investors are already pricing in which companies have AI-proof moats and which don't.
HubSpot beat earnings, beat almost every expectation, did a billion-dollar stock buyback, and their stock dropped 21%, and Atlassian had similar results, but their MCP server had like doubled in use... they went up 35%.
They don't need your 50 features, they only need the three that they use.
QuickBooks is terrible software, I hate using it, but I don't care because my accountant uses it and he likes it. And a better product doesn't get you in this conversation.
Is it hard to build or is it hard to keep running? Cuz that thing that you hate and resent can actually be a moat.