Episode 855 | The Eight SaaS Moats that Still Work in the Age of AI

Rob Walling: You’re listening to Startups for the Rest of Us. I’m Rob Walling. In this episode, I welcome Einar Vollset back on the show, and we record what I think might be the most important episode of the year, maybe of the past couple years. You’ll notice that the runtime on this episode is longer than usual because I just let it go. I let it take the time that it needed to take. This episode is a collaboration between Einar and me, where we talk through the eight SaaS moats that we believe still work in the age of AI. As you’ll hear once I bring Einar on the show, we are taking this very seriously and really trying to think about it from all the angles, and trying to take in outside information from folks other than just the X/Twitter bootstrapper ecosystem. And as investors in hundreds of B2B SaaS companies, we have a vested interest in figuring out what will make SaaS companies defensible as AI gets better and better and takes over more and more of the software ecosystem.

This episode is not an outline we put together in 30 minutes of brainstorming. Einar literally spent weeks of research doing a lit review and putting thoughts together. He ran it by our internal team, then ran it by me, and he and I went back and forth and collaborated on it to create not only the moats, but also these vectors of attack that we see AI having on SaaS companies, most of which you haven’t thought of, but that we are seeing and are aware of. We also came up with examples for a lot of these, because that’s really the hard part. It’s not just having a concept out on its own in an academic way, but having real life examples, maybe of big companies like Stripe, or small companies that you’ve seen on the show like SignWell or Gymdesk, that fit into the buckets of the moats that we discuss.

This episode is a combination of two MicroConf talks that Einar and I gave just a couple weeks ago in Iceland. And this episode is so dense, in a good way. It’s action packed and information filled, so we have brought the slides from our talks, and producer Ron is going to put together a detailed summary of what we talk through in this episode. You can get access to that plus the Q&A that happened in Iceland, which we’re going to cut from the YouTube version. There was, gosh, what, 20-something minutes of live Q&A after the talks. If you go to microconf.com/moats and enter your email, that’s microconf.com/moats, you’re going to get a ton of stuff: video of the live Q&A, the slides from our talks, and a pretty detailed summary of this podcast episode.

I know I mentioned at the top of this episode that it might be the most important episode of this year or the past couple years, and I think that could be true. I think that is likely true, actually, in the way that it can help you as a SaaS founder think about how to shore up your business, not only to stay in business, not only to keep growing, but to have a great exit valuation if and when you decide to sell. We thought about taking all this information and keeping it for TinySeed companies, putting it behind a paywall or however else we could try to guard it, but realized that it will actually do so much more good if we distribute it in this way for free to the community. So I hope that you listen to this episode, gosh, maybe more than once, and try to internalize the ideas that we’re presenting here.

And with that, let’s dive into our conversation. Einar Vollset, welcome back to the show.

Einar Vollset: Thanks for having me.

Rob Walling: We are having maybe the most serious conversation on this show of the past year or two. There are a lot of episodes where we show up and answer a few listener questions, but just so folks are prepared, it’s obviously going to be a longer episode. It’s really our take on the state of SaaS in the age of AI.

Einar Vollset: Correct.

Rob Walling: And this has come about for a number of reasons. One is, as folks know, you run Discretion Capital, which is a sell side M&A advisory for SaaS companies between $2 and $20 million. So you have a pretty unique viewpoint into the SaaS M&A market. You and I run TinySeed, 217 investments, and we are seeing things on the ground. Some are good signs and some are not good signs.

Einar Vollset: That is accurate, yes.

Rob Walling: And we’re trying to distill that into something actionable. Now, today’s episode is a version of us talking through the MicroConf talks we did in Iceland a couple weeks ago. I did a 45-minute talk, you did a 15 or 20 minute talk. It all could have been the same continuous talk. It’s all about this: if you’re running a SaaS company today, how can you potentially survive AI? What are some moats that are still available? We’re definitely going to talk through the threats. We’re going to kick off with “AI is more of a problem than you think,” because I think most founders, especially in our space, the MicroConf and TinySeed space, are underestimating the threat that AI is to their business or will be over the next couple years.

Einar Vollset: Yeah. I think it’s a very common thing with a lot of technical founders, and we back mostly technical founders, right? There’s always some technology. It’s like, oh, mobile’s here, or something’s here or whatever. And for the longest time, taking the stoic view like, “Yeah, yeah, but I’ll just keep doing what I’ve always done,” that was the right approach. Now I’m not convinced at this point.

Rob Walling: Yeah. The SaaSpocalypse happened in February, and we’re recording this in October. The SaaSpocalypse was the public markets dropping because there was a lack of confidence in public cloud companies, SaaS companies, and that rippled through the M&A markets. But what’s interesting is it’s not like we’ve seen our portfolio en masse plateau or go down. That’s not happening. And so that’s where there are conflicting signals and it’s cloudy.

Einar Vollset: I would agree with that.

Rob Walling: We have actually spent the past several months thinking about this topic. We have this massive portfolio of SaaS companies, tens of millions in ARR across our portfolio. How do we advise them? That’s a big part of it, as well as advising someone who is going to sell to private equity or a strategic. That’s what we’re trying to do. So as you’re listening to this, realize the dog we have in the race is that this is advice we’re going to give to companies that we are either selling or that we’re invested in. Do you want to talk a little bit about your process for this? Because you and I talked about whether there are moats that still exist, whether there are some things founders can do. And I came up with several moats and you looked at them and you’re like, “None of those are moats in the age of AI, bro.”

And I was like… So you went off and did some craziness with Claude arguing with ChatGPT for weeks.

Einar Vollset: So there’s a couple of different things here. From my perspective, I was interested in how the buy side thinks about this. What are the thought leaders saying among the people that buy these kinds of businesses? There was a bunch of commentary coming out of places like Gartner and Morgan Stanley and all this stuff. So I spent a bunch of time thinking about how they think about it and what they think is still durable. There was a lot of opinion writing, and it’s interesting because it sort of bifurcated into pre and post February, pre and post SaaSpocalypse. The underlying sentiment up until February was very much like, vertical SaaS, vertical AI, whatever you want to call it, AI is basically a tailwind. It’s going to be a great year. SaaS is the same, nothing’s changed.

It’s maybe even just a tailwind and then you’re done. Then after that, and really the actual triggers for the SaaSpocalypse in the public markets were these releases from Anthropic on the capabilities, where people all of a sudden were like, oh, this isn’t just a chatbot. It can actually do things. And so what I ended up doing, basically, was a literature review of how the buy side was thinking about it. There was mostly writing on the investor side. There was some on the founder-facing side, but most of it was on the investor side. So I was synthesizing that and trying to map out all these various moats. Part of the reason I ended up going to the investor side is because my sense is that, up until this year, most founders hadn’t really thought about moats. Not really.

They were probably relying on them, and they definitely were relying on one. One of the moats, and we’ll talk about it, that’s no longer a moat is just, “I wrote a bunch of code, it took me a while, and it’s difficult to write code and it takes a while.” There’s a surprising number of founders that just relied on that, not knowing that that’s really the only moat they had. So it was really mapping out the various reasons people stay. Why do people keep paying for software? And then mapping that onto the new reality that exists with AI, and seeing which of these are still actual moats versus draining or eroding moats, or however you think about it.

Rob Walling: I saw someone, a bootstrapper or an indie hacker on X/Twitter, in a conversation where I brought up that I was going to talk about moats in Iceland, and he said, “Why are we talking about moats? Those are VC things. We can succeed without moats,” right? And it’s like, yeah, maybe a year or two ago that was feasible. You find a niche, you thread a needle, you get some SEO, you get whatever, and you can grow a business. AI is coming for a lot more than people realize. And I do think it’s helpful, even if you’re a bootstrapper, to think about moats. You’re seeing indie hackers and small bootstrappers’ businesses go to zero all over the place on Twitter because of the models themselves. People think AI is one or two threats.

“AI is one or two threats to my business. One is that my customers are going to vibe code my app. The other one is that the model is going to get so good it can do it.” We have eight more, 10 total. And this was the shocking part. When you brought the AI vectors of attack to me, I think there were maybe six or seven, and I hadn’t thought of half of them. That was a big shock. So with that said, we’re going to talk about those vectors of attack right now. Then we’ll talk about moats and our best assessment of the moats that still work. Are we 100% accurate on all of this? I don’t think so. But are we relatively close? Are we directionally correct? I do think so. And I haven’t seen anyone else talking about these in this capacity.

And so this is something that, as a bootstrapper, I would be thinking about. I guess we’ll say this a lot. I’d be thinking about how I can implement one or more of these moats, because even if AI hasn’t had a big impact on you yet, I do think it’s coming.

Einar Vollset: I think that’s really one of the big unknowns. It’s undoubtedly true that a lot of these things are coming. The question is how quickly does it spread through the economy and into your niche? That, I think, will depend on what your customers are like and all that stuff.

Rob Walling: Yeah. And I’ve been saying I think between 10 and 20% of all SaaS companies are either going to zero or basically plateauing and declining. That includes big companies and small companies. And again, we’re already seeing it with very small ones. You have a tiny little utility online that converts a file from this to that? That’s done. You had a little thing that transcribes, or I don’t know, podcast show notes, for example, that used to be an app. I mean, it’s still an app, but it’s easy enough to implement. My prediction, my Babe Ruth calling his shot, is that Squarespace, unless they do something, they’re not going to go to zero tomorrow, but they’re going to plateau. I’m moving all my sites off there onto static sites, and I think a lot of other people are. There are now services for that. I interviewed Nathan from BlinkPages [VERIFY: “BlinkPages” – unsure of spelling], a TinySeed company, and he’s starting up a whole service to do that.

Einar Vollset: Yeah, there’s no doubt about that. I think fundamentally a lot of these things are changing, and how these companies react is going to have a huge impact. It’s almost like it’s the first time in at least 10 or 15 years that leadership really matters in companies large and small. For the longest time, once you got to a certain size and you had a SaaS and you had this retention, you couldn’t really screw it up all that badly. Now you can. You really can, and people will for sure.

Rob Walling: And unless a company like Squarespace comes up with a whole new AI-first approach that supports static sites, I don’t see how they make it long term. If they do that, they’ll survive. So let’s dive into this. We see it in TinySeed companies and MicroConf companies saying, “AI is amazing. I’m shipping three, four, five times faster, and my customer base isn’t technical, so they are not going to vibe code my product.” Then there are folks saying, “Well, the models will never do what I do because I’m so niche.” And this was thinking I had even three or four months ago, right before we started talking about this. So those are two attacks. There are 10. We’re going to break them up into supply side attacks and demand side attacks. What we mean by that is, if you look at Economics 101, if you manufacture widgets or you manufacture a SaaS app, and the supply of widgets in the overall market shoots through the roof, or the supply of competitive alternatives to your SaaS app shoots through the roof, you have a problem because you’re commoditized. Your pricing goes down. Your ability to charge goes down.

Similarly, on the demand side, if demand goes to zero or gets cut in half, that’s a big shock. So that’s what we’re going to walk through. We have six supply shocks. The first one is the vibe coding argument: your customer builds it. Keep in mind, people say, “My software is super complicated. It took us 10 years to build.” There are two things to this. Number one, it won’t take anyone else 10 years to build it. And usually, if you have a hundred features that you’ve built and they only use five, they only need to vibe code five features and they’re set. Attack number two is that a competitor reaches parity, because all your competitors get AI. This is the thing that I’m seeing. I had a slide in my MicroConf talk with eight different AI note takers, including Granola and Otter and six others.

Einar Vollset: Fathom.

Rob Walling: Fathom, yep. They’re all kind of the same now because you just get feature parity really quickly. I believe Otter launched in 2016 and Granola launched in 2024, eight years apart, and they’re kind of the same product because AI just gets you there. So even if you have a lot of the old moat of “Hey, we have a bunch of code,” it isn’t a moat.

Einar Vollset: Yeah. And even integrations used to be a big deal. If it’s a well documented API you’re integrating with, it’s like, what is it, a day, two days? There’s that. And there used to be this stratification. There was the cheap SMB option that just kind of did things and competed on price, but didn’t have all the complexity. Then once you, as a client or a customer, got large enough, you would graduate into the larger mid-size solutions and then maybe enterprise. The challenge now, if you’re the mid-size option, is that your lower cost upstart competitors potentially all of a sudden have every feature that you have. And so there’s really no reason for clients to switch as they grow.

Rob Walling: Yeah, it’s crazy. And for those listening, there’s a lot of information in today’s episode, so I’m going to have producer Ron put together a PDF summary of all of it, and that will be at microconf.com/moats. This is hundreds of hours of research, and frankly, you and I could probably talk about this for six or eight hours, which we will with TinySeed companies. This is the basis. This is like a 101 version of what we’re going to dive into with our own investments. So attack number three on the supply side is that open source gets good enough. We’re seeing more projects launch, and we’re seeing them move faster. Usually, if you’re a buyer, open source is free like a puppy, to use that expression. Well, now non-technical buyers can deploy open source. It’s not that much effort. Is any one of these things going to wipe out all SaaS?

No, but each of them is another few percentage points, right? That’s what we’re getting at here. Attack number four is that a platform you’re integrated with ships your feature or feature set for free, because they already have the customers and they move five times faster than they used to. They were never going to build your little niche thing until they decide, “Oh look, here’s a spec for how to build it. The spec is your app. Now I’m going to crawl through it. I’m going to screenshot it.”

Einar Vollset: There was a big public market fallout with something related to this, pretty much. I think it was ServiceNow or one of the big field service engines. All of a sudden, overnight, they decided they were no longer accepting integrations with one of their long-term partners, which was a lead management tool. My read of that is ServiceNow was like, “No, fuck that. We want to own that part too.”

Rob Walling: “We’re just going to build it.” That’s going to happen faster and faster.

Einar Vollset: Yeah.

Rob Walling: Attack number five is interesting. It’s custom software at SaaS-ish prices. So you have a generic SaaS that charges 99 bucks a month. Agencies also get AI. We’ve seen this firsthand with what used to be $30,000 to $50,000 agency projects. They’re just like, “Look, we’ll build it for a couple grand up front, it’s completely custom to you, and we’ll charge you 500 a month, a thousand a month, and we’ll maintain it on that monthly basis.” That’s actually a great business. If I was getting started…

Einar Vollset: Yeah. Go after one. Why not? Think about it, particularly on the mid-size, enterprise-y side of things. Maybe you’re a business paying 50 grand a year for this software, and here comes someone who says, “For 25K a year, you’ll get something super custom with an SLA, and I’ll monitor it and integrate it and do everything you need.”

Rob Walling: Yep. The moat of SaaS being complicated to build and host and maintain is not going away, but it is being dramatically impacted, right? Exactly. So attack number six is that the model itself, the LLMs, the foundational models, basically absorb your product. They turn you into an obsolete wrapper. It’s not going to happen to everyone, but we’ve seen it already.

Einar Vollset: It happens to some. I mean, Christ, do you remember we had some early investments in TinySeed where someone really smart had fine-tuned their own model and it was perfect for this. It was state of the art. And then I think ChatGPT released a new version, and it was like, oh, out of the box, zero shot, it does a better job. It’s like, well, then you’re screwed.

Rob Walling: Yeah. We’ve seen a handful of companies within our portfolio experience this. So now let’s look at the demand side. There were a couple on the supply side that were surprising to me, but the demand side was the one I hadn’t thought of. There are four here. Attack number seven is: will your customer still exist at all? Let’s say there’s an agency out there that used to translate or transcribe text and audio. Since AI came out, the number of words translated and transcribed in this world has, what, 10X’d, 50X’d, whatever. I transcribe everything now because we can and it’s really good. The agency revenue for those businesses is effectively going to zero. If it’s not going to zero, it’s going to a tenth of what it used to be, because everybody knows we can just use AI to do it.

So the activity itself, the volume of transcription and translation, has gone up. But if you were building software for translation agencies or transcription agencies, you’re done. There’s no market there anymore.

Einar Vollset: Yeah. This sort of reminds me of my favorite conspiracy theory, that dentistry is basically just a fraud. They fixed it in the 1970s and then decided, “You know what? We can’t make all these dentists unemployed, so we’re not going to distribute the solution.” It’s a similar thing. If you fixed dentistry, if you gave people a pill or a shot when they were born and all of a sudden they had perfect breath and no cavities, and you were selling to dentists, then that’s a bad industry to be in. A slightly less tinfoil hat example is that AI receptionists are now good enough most of the time, to the point where I actually wish my airline would offer me two options: one, call into the usual regular call center, and two, here’s a phone line to the AI voice agent that picks up instantly.

So that’s an example too, right? If you had the world’s best SaaS selling to call centers for human receptionists to click around on, that’s a tricky business to be in at that point, because you’re just going to get replaced. The people clicking on your buttons aren’t there anymore. They’re not getting paid to do that.

Rob Walling: Yep. That leads us into the next attack. There are two that are very similar, but this one is: are your seats going away? Zendesk is a great example of this. If you’re charging per seat for customer support software, your customers used to have six, 10, 15 customer support reps, and now AI is handling a big chunk of that. It’s not handling 100% of it, but is it handling 80 or 90%? So now you need, what, two or three reps that are just monitoring the agents? If you charge per seat, you don’t go to zero, but you lose 70 or 80% of your revenue, right?

Einar Vollset: HubSpot has other problems too, but HubSpot’s a similar thing. It used to be per seat for human writers to write things and SEO optimize and all this stuff. Now it’s AI slop. You just generate it. You don’t need as many writers. So if you’re counting writers and you don’t need as many writers, or you’re counting receptionists or customer support agents and you don’t need as many, that’s a contraction, even if the underlying industry is doing well.

Rob Walling: And then the ninth one is what you already referenced, which is if you cater to receptionists and they truly just go away and it’s all agentic, which there’s a really good chance happens with phone receptionists specifically. There’s a pivot here. That’s an attack, and you’re going to go to zero, but the way around it, of course, is to build the agent yourself and start selling that, right?

Einar Vollset: On the offensive side, for sure.

Rob Walling: Yeah. You’re selling $50 a month per seat software for receptionists right now? Do you charge 500 a month or a thousand a month and, frankly, build a full-on AI agent and just go all in on that? We’ll talk about that a little later. The 10th attack is: does the step you manage, or the artifact that you create, still matter?

Einar Vollset: Yeah. The interesting thing here is, once you start to think about it, there are a lot of things that only exist in this world because that’s how humans coordinate work. If AI is going to eat part or all of that process, you don’t need those artifacts anymore. So if your software is managing those artifacts, then…

Rob Walling: Yeah. The example in my talk was take-home coding tests for developers. That’s just not going to be a thing moving forward, because everyone can use AI to do it. You’re not going to be able to tell. There’s pair programming, and there are other ways to do this, but if you had a business built on that, it’s time to pivot. So I want to talk about old moats very briefly. I want to spend less time on them than I did in the talk, because we’ve already started touching on them, right? As builders and makers, we think of things like a unique feature set, clever complex code, years of coding, and even integrations, as you already mentioned. High switching costs, for some, I think are going to go down. I don’t know if you’ve used Manus, but I’ve had Manus click through some stuff, and it is bananas what it can figure out. It just figures it out.

Einar Vollset: Yeah. Browser use. I don’t think the average person realizes what an AI can do with a computer. They will soon, but they don’t at the moment.

Rob Walling: Right. And even UX familiarity has been a moat, like, “Oh, your whole team of non-technical folks in the office knows how to use this construction management software. You don’t want to retrain 50 people.” And it’s like, yeah, maybe. But what if agents start doing a good chunk of that work? What if they start doing 40 or 50% of it? Suddenly you don’t need to retrain anyone. The agent will just figure it out. So again, this is where people who say SaaSpocalypse are like, “Oh, 100%. Everything’s going to shit and everything’s going to zero.” And it’s like, no, no, no. But I’m also not going to be Pollyanna and say, “Oh, my customers won’t vibe code my app, so nothing’s going to happen.” Neither of those is true. So let’s talk about the eight moats that we hypothesize still work. As I said, you did this big lit review for weeks.

Dude, you had a snorkel on. I would talk to you and you’d be like, “I’m so knee deep in this shit, I don’t even know.” You were talking to me like I was Claude. You were like, “Dude, my friend Claude told me.” And I’m like, “Einar, he’s not a real person. You’ve got to get out of the building. You’ve got to go touch some grass, bro.”

Einar Vollset: Go fishing.

Rob Walling: Yeah, go fishing. You were deep in it, and you came up with a list of, I think it was six moats. Then as I started digging in, I came up with four or five more, and some of those weren’t moats, but we wound up with this list of eight, and I think it’s pretty close to reality. I knew we were on track when you and I kept coming up with other ideas, like, “Ooh, what about if you have software plus hardware? We missed a moat. There’s going to be nine.” And then we came back the next day and we’re like, “Aha, it fits into this category.” That’s when you know a taxonomy is starting to hold up, when it stops changing so often. So let’s dive into the first one. This is where buyers know and trust you.

All right? So it’s not just having a strong brand. It’s that you know the buyer and you know how they buy. There’s potentially a partner ecosystem where people have built their businesses around recommending you, and hopefully there’s a champion inside your account who is fighting for you, such that a competitor with better software still has to build all of that from scratch. And I want to point out that these are all on a spectrum. I don’t think this is a binary one or zero. I just listed four things, right? The brand, knowing the buyer, partners that recommend you, and a champion. If you have all four of those things, amazing. If you have three, you’re lower on the spectrum of the moat. If we were to score it from one to 10 or one to a hundred, you can imagine that being there.

Einar Vollset: Yeah. I agree with this for sure. The example I think you used in the talk was QuickBooks, which I hate with the passion of a thousand suns, but still, this is what all the accountants use, and that’s what they recommend. So it’s not easy to replace them for that reason. You could vibe code a QuickBooks alternative. I don’t think that’s super hard to do, but can I distribute it?

Rob Walling: Right. My accountant has used it for years, and he would recommend it if I wanted to look at the books. I don’t want to, right? The other example I used was Shopify. They have an amazing partner network, right? Thousands of agencies. If you go to hire an e-com agency to build your cart, the odds are good they’re using Shopify. We have a question at the end of each of these moats. It’s a thought experiment to see if you can fit into this moat or implement it, or where you stand with it. For this one: who has built their business or their career around recommending you or your product? Give that some thought. The second moat is that you’re a system of record. I’ve been using this term for years because it’s a popular one in private equity circles. I’ve always thought of it as being like the operating system for a business, the underlying OS the whole business runs on.

So daily operations are built around you. Approvals, statuses, balances, everything lives in your software. There are rules configured in it, and other systems are wired into you. They integrate with you to either pump data in so you can act, or pump data out so they can act.

Einar Vollset: Yeah. Another way to think about it is, is there some canonical state that’s recorded just in your system? It’s not elsewhere. It’s not a copy of something that’s elsewhere. It’s the decisions we made, the definitive record. The example we use here is Gymdesk, which is a TinySeed company. Who’s running the class on Tuesday at 6:00 AM is recorded there and nowhere else. That’s the canonical state. Who has paid for their membership this month? Who has access to the key fob? That sort of thing. It’s a system of record, and that remains one of the strongest things, because that’s where the canonical state is stored.

Rob Walling: It’s very hard to leave that. The switching costs are still enormous. It’s not just pointing Manus at it, exporting the data, and moving somewhere. It’s everything. What can’t you export? What breaks downstream in all the integrations you have? What do you have to retrain your humans to use? What do they have to rebuild?

Einar Vollset: You’ve got to reprogram the key fob. You’ve got to ask people to add their credit card again. Are you going to do that? No, you’re not going to do it.

Rob Walling: Number three, and actually the next two, when you first said them, I was like, “I’ve never thought of these at all.” So these were a surprise. Number three is that you’re allowed to act. I had to really think this through. A tool that recommends a payment, like, “Hey, here’s a CSV, you should go make $20 payments to all these affiliates,” is one thing. But then there’s a tool that is authorized to just make the payment, to actually move the money. Stripe Connect is an example of this. It moves money around, and it’s very hard to leave. ReMB [VERIFY: “ReMB” – unsure of spelling] is a TinySeed company that sends reimbursements to job candidates. You fly them into your office to do a job interview, you don’t want to set them up as a vendor, so you input their Venmo, PayPal, or Cash App, and it just sends the money.

It actually moves the money. This was not something I would have thought of as a moat before you brought it up.

Einar Vollset: Yeah. It’s just one of those things. Can your software do something in the world, or is it just an advisor? If it’s just an advisor and the human still has to do something, that’s much easier to replace, because then it’s like, “Oh, I still have to look at it and review it.” But if it’s actually wired in and does the thing, it’s part of the plumbing, kind of.

Rob Walling: Yeah. People don’t want to pull it out because it’s autonomous, in essence. Fourth moat, again another one that I hadn’t thought of, is that they don’t check your work.

Einar Vollset: Which sort of relates to the prior one, for sure. But it’s this notion that you’re allowed to act, you do something, and the people who pay for it trust you enough that they don’t check it. And I think the classic example here is HR software. I use Gusto for some things, and they file documents that I could apparently go to prison for with various state agencies that say, “This is your workers’ comp, this is your taxes, and that.” And they send money around. Do I go in every month, every two weeks, to make sure that the quarterly tax payment they’re doing to the state of California and the state of whomever else is right? No, I’m not. And that’s a big deal. I have bestowed upon you not only the right to act, but I trust you as the software not to screw this up, to the point where I don’t have to check it.

If I have to check it every time, then you’re easier to replace.

Rob Walling: Yeah. And so when you vibe code your Gusto replacement to save 49 bucks a month, or when an indie hacker vibe codes Gusto, are you going to switch? No.

Einar Vollset: Accounting software and tax software are similar too. It’s like, “Do I really want a vibe coded solution to save 50 bucks a month so that the IRS is going to come right up my ass? Do I really want that?” No, probably not.

Rob Walling: Number five is an interesting one. We have different wordings for these all over the place, but the one I have is “someone official already said yes.” This is around regulation, licenses, accreditations, and certifications, because a competitor can clone your code, but if they need to get approval from a board to do something, it can take months, if not longer. And I want to be clear here that serving regulated customers isn’t the same as you yourself needing to hold SOC 2, ISO 27001, or approval from an ABA or APA training board. What are your thoughts here?

Einar Vollset: I think again, this is a scale, right? There are some things that seem hard to get but aren’t all that hard to get, and then there are some things that are actually a pain in the ass to deal with. It runs the gamut. If you’re an organization that needs things to be HIPAA compliant because you’re dealing with personal health records or medical records, and you have software that handles that, and you know it’s HIPAA compliant and you’re not going to get into trouble, am I really going to vibe code a HIPAA compliant replacement? Is that what I’m going to do with my life? Probably not. The hurdle is higher. This is what I mean. There are no perfect moats. Eventually we’re all dust in the heat death of the universe, et cetera.

But fundamentally, this is one of those things where it’s like, I’m not just going to do it. “Yeah, Tom, down the hall, vibe coded a new version of our EHR, and he says we’re going to save 500 bucks a month.” Am I going to take that compliance risk? Probably not. And there’s a fair amount like that. One of the examples from the TinySeed portfolio is SignWell, which is a DocuSign competitor, an eSign competitor. And it’s like, okay, that seems easy. What is eSign? It’s just figuring out where to stick the signature in a PDF, end of story. No, that’s not the interesting part of that problem at all. You signed a contract, and now there’s a dispute on that contract. Is it valid? Are you going to vibe code an eSign solution so that your million dollar contract is in question because you vibe coded it?

No, you’re not going to do it.

Rob Walling: Yeah. Another example from TinySeed is Sidekick Learning [VERIFY: “Sidekick Learning” – unsure of spelling], which does ABA training. I believe that’s applied behavior analysis, so it’s affiliated with psychology and therapy. Their courses count toward a credential and CEUs and all that. I get that it’s niche, but nobody’s vibe coding a competitor to that.

Einar Vollset: Yeah, exactly. Is it super hard to have AI generate some training material? No. But do you really want to find out, and I don’t know if this is specifically the case, that the 200 nurses who used your software aren’t actually legally registered nurses anymore because you didn’t do exactly the right amount of compliant training or whatever? That’s just not something you want to deal with most of the time.

Rob Walling: Yeah. Moat number six, I call it “everyone’s already in it,” or “who has to move?” Really, it’s network effects. If you have software where one person needs to switch to a different app, they can switch in an afternoon. If you have to move a whole team, everyone has to agree and migrate together. But if it’s multiple teams, a whole company, or a whole community, it is a mess. And I know what example you’re going to bring up, so I’m going to pass it to you. Slack is a perfect example of this, right? None of us really like Slack that much. It’s getting kind of bloated, kind of a pain in the ass, kind of expensive, but we just keep coming back. What’s your other canonical example of this?

Einar Vollset: School apps, man. If you have kids anywhere in the Western world, you’ve been tortured with this every start of the school year. It’s like, “Hey, get on the parent view and see Tom’s grades and this.” And you’re like, “What the hell?” There’s four different logins. It’s like, “What is this complete dog?” And you have no choice, you have to do it. And you log in and you’re like, “Look, my kid could vibe code a better solution than this in a couple of days. Why is this all so bad?” And the answer is because the school doesn’t want to move a thousand students and 4,000 parents or however many. They just don’t want to do it. It’s install base. Moving software means telling an entire community, “Hey, you know all that stuff we told you about and you went through to sign up? Now you have to go sign up for this other thing and do this whole other thing again.” And that’s just not going to work.

So it almost doesn’t matter. The threshold for functionality is so low. It just has to be barely better than dog and it still gets paid.

Rob Walling: Yeah. And that’s what network effects get you. Moat number seven of eight is that every customer makes you smarter. Stripe Radar is an example, right? Every merchant on Stripe is protected by the fraud patterns seen at every other merchant. No single merchant could ever build Stripe Radar. There’s a ton of value in the collective, the community, and the data Stripe has that no one else has. So you can’t just come in and replicate this.

Einar Vollset: Yeah. This is related to some of the stuff we’ll talk about on the offensive side, like what the opportunities are here. But fundamentally, if you have software that learns from actual use by your customers and gets better in general, it’s similar-ish to a network effect. Some networks, like Twitter, are better the more people are on them. This is kind of the same. You have more customers, and because of that you’re learning more from your customers and your product improves, ideally automatically.

Rob Walling: And someone who just goes and codes this from scratch doesn’t get that. If you leave the product, you lose that value. You lose the learning. As I said at the beginning, these are defensive moats. These are how to defend, and at the end we’ll get to going on offense, which was your talk, in essence. To put a finer point on the learning loop aspect, I said it only counts if it clears three gates. Every customer makes it better for every other customer. Customers can take their data, but not what you learned from it. And your app keeps learning, because last month’s data isn’t sufficient. If it stagnates and you’re not constantly improving, it doesn’t matter.

Einar Vollset: So I disagree a little with this. It doesn’t necessarily have to translate across every single customer all the time. In the base case, if you’re a single person and over time it learns about your habits and gets better, that’s good for you. Even better is if it goes across a team or an organization. If a whole organization comes in, it becomes better, it fits that organization better. It learns inside the organization. It doesn’t have to transfer across organizations, but that’s the ideal. The ideal is more. Another thing here, and we’ll get into more detail on this on the offense side, is that it needs to be something that’s not easily stealable, exportable, learnable, or simulatable. You have to be observing things in the real world on a real world clock, as opposed to something where someone can just generate a crap ton of synthetic data and very quickly learn what they need to learn.

Rob Walling: All right. The eighth and final moat is that it’s hard to keep running. I was referencing a tweet from Pieter Levels where he’s basically like, “I’m vibe coding everything, all my apps. I’m not going to pay anybody else. I’m self-hosting everything.” Obviously he’s one extreme. Most of us aren’t going to do that, but it’s an example. He said the only things he’s paying for now are Cloudflare, some bare metal hosting somewhere, maybe VPSs, I don’t even know, and ScrapingBee. And it’s like, “Well, why ScrapingBee?” He said he’s repeatedly had AI try to build ScrapingBee, and it’s not the code. It’s all the proxies and the CAPTCHAs and all this other stuff. AI is just like, “We can’t build this for you.” So it’s that thing where web scraping isn’t hard to build, but keeping it working is brutal.

Einar Vollset: There’s a big, big difference between “I have a single page to scrape for my own purposes, I can hack that together, and lo and behold I’m able to get through,” and “I need to manage proxies over time, keep track of that, avoid the anti-scraping technology, and all this stuff.” Fundamentally, what’s going on here is there are certain things that just do not make sense for a single client to do themselves. The cost is such that you need to amortize it across a number of customers. And you’ll be familiar with this from your Drip days. Look at his face. Sending some goddamn email, getting it delivered, not caught in spam, not having really angry customers, and staying ahead of the folks who want to use your service for spam and all this.

That does not make sense for a single company. You have to be a pretty sizable company for it to make sense to say, “You know what? I’m going to hire 25 dudes and they’re going to look after my email infrastructure.” That’s a similar deal to ScrapingBee. And honestly, a lot of businesses are like this. It’s like, I figured out I’m world class at this. There’s just a minimum hurdle of complexity in running it, figuring it out, maintaining it, SLAs, whatever, and you just can’t compress it. That’s just the way it is.

Rob Walling: Yeah. And Cloudflare is another example of this. Is it hard to build and code, or is it hard to keep running? There’s a DevOps load. And the spam one you bring up, we had a full-time person plus, just doing that full-time.

Einar Vollset: Yeah. And it goes down, or you’re under a spam attack, or one of your spammers in Nigeria starts sending 10,000 emails out of the one good IP that your number one customer uses. You’ve got to wake some dude up at 2:00 AM. Look, do you want to do that, or do you want to pay $249 a month?

Rob Walling: That’s why this is a moat. So those are the eight, and I won’t recap them here because folks can go to microconf.com/moats and download a list of them. As we talked about, we’re going to create curriculum, a whole playbook for TinySeed companies around this, about how to evaluate themselves. Do they have any of these moats? Maybe scoring them, potentially. Which moats are you closest to? If you don’t have any, or if you have three and you want to get to four, how do you do that? So there’s a lot more to this conversation than just identifying them. But that was us going on defense, right? How do we not get sideswiped by AI? You’ve talked a lot about going on offense. Why don’t you take us from there?

Einar Vollset: So on the offense side, there are basically three moves in this world, I think. The obvious one is the one people are already doing, which is to keep improving the business. Use AI to build more software faster. It’s similar to what you’ve always done. Maybe you identify that you have a bunch of these moats, your business is in great shape, no problem, and it’s actually just an opportunity. You just go out and build more features, and AI gives you that capability. Great. To me, that’s almost table stakes on the offensive side, and I think everyone can do that. The second part is something we identified, which is the notion that people will have more agents.

There will be more agentic things happening, and agents are most likely going to be interacting with your software in some way, shape, or form. There are two stances you can take. One is to try to lock them out, which is sort of the Amazon approach, I guess. You saw that this week with the Facebook bot [VERIFY: name of Meta/Facebook shopping agent, transcribed as “the muse”], where you can’t order things from Amazon using it. That’s one approach. Another approach is to say, “Look, I want to make it super easy for the agents to come through,” and offer an MCP, and maybe gate it and get paid based on that. That can be a really good solution for a lot of things, because AI doesn’t always think it should build everything from scratch. The way I think about it is that AI makes a decision on complexity. It might decide, “You know what?

The best solution here is just to use this third party thing that’ll get us what we need. Let’s just do that.” I actually thought about this when we were in Iceland. It’s almost like there are two different kinds of SEO now. There’s the SEO to get human customers to use you, but there’s also SEO that targets agents, figuring out how to get the agent to pick your solution over all the other solutions, which might actually be a different question than SEO for humans. So if it’s clear to you that people are going to be using agents to do this, making that ideal, actually charging for it, and doing that agentic SEO or whatever you want to call it, is definitely a play. Those two things I think are semi-obvious.

I think most people have done it. Really, the main thing I think is you want to kind of become the worker. You need to start doing the work. If there was one thing I could do in terms of the portfolio or just the wider community, it’s sort of a kick up the ass in the sense that, look, an awful lot of B2B SaaS is this: I have some kind of a tool. I’m selling that to my customer, a business owner of some kind probably, and that business basically hires somebody or has an employee click on your tool in order to have some outcome happen. That’s a lot of SaaS. I’m here to tell you that if that’s the case, somebody is going to come along and they’re going to say, “Okay, you don’t have to click on this thing anymore.

We’re just going to sell you the outcome. We’re just going to give you the outcome that you actually want.” And my view here, effectively, is if you think that’s likely to happen, maybe not immediately, but in the next year or two, you should do that. You should be the one to do that. And the point I made in Iceland is, and I actually see this also if you just look at launches for Y Combinator, so many of them, 40 or 50% of those, are this. They’re basically agentic SaaS, I think it’s sometimes called. This notion that you sell the outcome. Don’t sell the tool, sell the outcome. But on the flip side, if you are a bootstrapper with existing customers, and you have industry know-how and connections and customers and all this stuff, it’s not obvious to me that you are in worse shape than a Silicon Valley startup with a $10 million OpenAI token budget or whatever. If you’re listening to this, most likely you have a SaaS in the industry and it’s already doing something.

You might be in a much better position, because the hard thing to get is trust from customers, and there’s a lot of noise around this stuff. If you come along as the trusted vendor who used to sell the tool and now you’re like, “Here’s the outcome, partially or fully,” and you can charge 10 times as much, that might be a much better solution. So for most people, I would say 80%, that is the play. That is your opportunity. I think there’s a lot of angst about SaaS at the moment. There’s almost this sense of, “Oh, Christ, here we go. Why couldn’t I have sold my SaaS five years ago?” And I’m like, yes, but also the opportunity here is larger than it’s ever been, because you have the ability to go up into the labor budgets much more aggressively than before, and labor budgets are much larger than software budgets.

If you look at the average business in this world, they spend a lot more money on salaries than they do on software. If you can access some of that, then you’re potentially in a great position. One of my favorite books is called 10x Is Easier Than 2x, and I think that’s the mindset to have on this. Yeah, you can build a little faster, so you can build some things and charge more for your software. That’s great, and I’m not saying you shouldn’t do that. But it’s always worth taking a step back and asking, “All right, I’m charging $75 a month. What do I have to do so that the same customer will give me $750 a month?” That’s the exercise. “What are they even using my tool for? What are the adjacent workflows for the person who clicks on this that I can go after and offer as a solution, so they don’t have to use as much labor to get the outcome they want?”

That is the opportunity. And I guess I’m a little surprised at the negativity about AI in some cases. I get it. There are certain ways in which we’re starting to hear people say, “Forget it. I vibe coded a solution,” or “I just use Claude for this.” But equally, I think there’s an opportunity here to 10X a lot of businesses that, prior to AI, may have really struggled to grow 2 or 3X in the same timeframe.

Rob Walling: So the opportunity there is to become the worker. And I can already imagine all the objections I would hear to this from bootstrappers and such. If I were a founder still, if I was, let’s say, running Drip, I’d be like, “God, that sounds like a lot of work. I’m already working full-time just trying to keep this business afloat. Now you’re telling me to spin up this whole thing with a worker that I then have to monitor, and that we know is not going to be 100%? AI is going to be 70 or 80%. So how do I put the safeguards in place? How do I sell that at 10X? Now I need a sales force where I was self-serve before?” I can come up with a litany of reasons not to do this, or at least objections.

But I think what you’re saying is, “Well, do you want to survive?”

Einar Vollset: That is it. I think that’s it. And one of the things it allows you to do is, if you’re going to do the worker stuff, then naturally you get this moat of the learning loop that we talked about. This notion that you are observing how things are going, based on the actions taken by your AI worker, and you’re able to improve over time. If I’m thinking about moats that are likely to stay ahead of the capability frontier forever, that is the one moat I think will just get stronger and stronger over time. This notion that your AI worker acts on the world. It does some things. It resolves a ticket, it gets a refund, it does whatever it does, and then it learns from that.

And because of that, it gets better, and that transfers across your customer base, so that you as a business are learning more and more and getting better and better at this thing. That is the only moat I can see that’s likely to stay ahead of the expanding capability frontier that the LLMs have. So yes, it’s a lot of work, but fundamentally I think your alternatives are good but not great. Some people think, “I’m just going to stick with this,” and they’re going to use what I call the old school learning moat. There was always a learning moat, and it’s this: you observe your customers or your prospects, you see what they need, they tell you what they want, and then you build that feature and ship it and see if they like it.

That’s the classical manual loop, as it were. But the problem with that is that the outcome is visual UX. It’s code that may take a very long time to get right in terms of designing and learning from your customer. But once it’s built, it’s five minutes of screenshots for Claude, and it just replicates everything and pushes it out there. Versus a learning loop, where it’s knowledge that exists within your organization that people don’t just take with them when they leave, and that you can’t just screenshot in order to copy. That is the one moat I’m pretty confident is going to stay ahead for the years to come. I think the most valuable businesses will be like that. They’ll be things that you have learned over time in the real world from actual customers, and then you add a more capable AI to that.

Yeah, everything gets even better, but it doesn’t negate the fact that you have learned all this stuff that an LLM just can’t learn very easily.

Rob Walling: Yeah. And I want to call out to folks listening that the first offensive move is to become the worker, agentic SaaS and related. But a second and different offensive move is to implement a learning loop like you’ve said, right? Not the old school learning loop, but where you actually have data and figure out how that data helps and predicts for all or most of your customers. That’s another thing that is of incredible value. It’s not just a moat. As you build it, it should draw in more customers and build momentum. The thing I struggle with, because I totally agree with you, is that I know if we had built that, if I was still running Drip and we built an amazing learning loop to keep spammers out and keep everything deliverable, there would be a bunch of schmoes who would come along and vibe code stuff and say, “But our deliverability is great.

It’s 99.9%.” And they’d just be lying. So building this is not enough. I think you have to build your brand around it for people to believe it. Just saying it on a marketing site, I don’t think that’s enough. And that sucks. It’s not fair. It’s not your fault, but it’s your responsibility to get this done. I wish it was easier. I wish you could just build a learning loop and say, “Look, our tech is the best, our learning is the best, our engine is the best,” and everyone would believe you. You know that people are going to argue over this and try to discredit you and say that they’re better and all that stuff. So just be prepared for that fight. It doesn’t mean it’s not worth it. Cool, man. So we covered a lot of ground today: the 10 vectors of attack, the supply and demand shocks, the eight moats we think will survive in the age of AI, as well as how to go on offense.

As a reminder, folks can go to microconf.com/moats to download a summary and potentially the slides, if producer Ron gives me the thumbs up to give away my own slides. You know what I love? I love going to MicroConfs, and people come up to me and say, “Hey Rob, where should we be, and at what time?” And I’m like, “You know what? I go wherever producer Sonia [VERIFY: “Sonia” – unsure of spelling] puts on my calendar. That’s where I’m showing up. So please don’t ask me about logistics, because I genuinely don’t know.” No idea. Sonia is my boss at the event. It’s similar with Ron. I’m always like, “So what are we giving away, Ron? Because I don’t actually know what the giveaway is.” So all that said, if folks want to keep up with you on the internet, you are posting daily about the San Francisco Giants, fishing, and sometimes even SaaS M&A and moats.

You are Einar Vollset, E-I-N-A-R V-O-L-L-S-E-T, on X/Twitter. And of course, discretioncapital.com. You run the sell side M&A advisory for SaaS companies doing between $2 and $20 million. Even if you’re doing seven figures and you’re a SaaS company thinking about selling in the next six, 12, or 18 months, Einar is thinking a lot about how to make SaaS valuable and how to keep it a desirable asset to acquire. We’re also thinking about it separately. I’m thinking a lot from the founder perspective and about operating businesses at TinySeed, and you are too, but you’re also thinking about it from the private equity side and how to market these companies to make sure they still get good multiples.

Einar Vollset: Yeah. I think it’s fundamentally changed. The positioning has fundamentally changed, in that being knowledgeable and really understanding how to position, basically how to argue, “Look, AI isn’t going to kill this business next year,” has become a fundamental part of sell side M&A work for sure.

Rob Walling: Right. It just didn’t exist two years ago. We were such young spring chickens. Why didn’t we… We should have just sold.

Einar Vollset: We thought COVID was bad. Here we are.

Rob Walling: My sweet, sweet summer child. Yeah, totally. This is the thing with you and me. It’s almost day to day, week to week. We’ll talk and be like, “How are you feeling today?” And it’s like, “Man, I think we’re good. I think things are going to be great. We have moats and we’re trying to educate.” And then the next week it’s like, “I don’t know. Maybe I’ll just go fishing for the rest of my life.”

Einar Vollset: I’ll become a fishing guide.

Rob Walling: Yeah. And what’s funny too is you can see how my thinking has evolved on this podcast. I recorded an episode two or three months ago about SaaS in the age of AI, I think that’s what it was called, and it’s still generally valid. I still think 10 to 20% of SaaS companies are going to be impacted. What I didn’t have was these moats at all. I had three or four vectors of attack, I think, and those were the ones I had come up with. Then with new information, we form new opinions, because we’re not politicians who get accused of flip-flopping when we actually change our opinions on things, right? So you’re watching it happen in real time. Einar, thanks again for joining me today.

Einar Vollset: Thanks for having me.

Rob Walling: Thanks again to Einar for joining me on this epic adventure through SaaS defensibility and offensibility, which isn’t a word, in the age of AI. Again, if you want to download all the goodies that come with this episode, head to microconf.com/moats. Thanks for listening this week and every week. This is Rob Walling signing off from episode 855.