Episode 855 | The Eight SaaS Moats that Still Work in the Age of AI

0:00Einar Vollset: You're listening to Startups for the Rest of Us. I'm Rob Walling. In this episode, I welcome Einar Vollset back on the show. We record what I think might be the most important episode of the year, maybe of the past couple years. You'll notice that the runtime on this episode is longer than usual because I just let it go. I let it take the time that it needed to take. This episode is a collaboration between Einar and I where we talk through the eight SaaS moats that we believe still work in the age of AI. As you'll hear once I bring Anar on the show, we are taking this very seriously and really trying to think about it from all the angles and trying to take in outside information from folks other than just the ex-Twitter bootstrapper ecosystem.

0:46Einar Vollset: And as investors in hundreds of B2B SaaS companies, we have a vested interest in figuring out what will make SaaS companies defensible as AI gets better and better and takes over more and more of the software ecosystem. This episode is not an outline we put together in 30 minutes of brainstorming. Aynar literally spent weeks of research doing lit review, putting thoughts together, has run it by our internal team, then ran it by me, and he and I went back and forth and collaborated on it to create not only the moats, but there's these vectors of attack that we see AI is having on SaaS companies, most of which you haven't thought of, but that we are seeing and are aware of, as well as thinking of examples of a lot of these, because that's the hard part really, is not just having a concept out on its own in an academic way, but having real life examples maybe of big companies like Stripe or of small companies that you've seen on the show, like SignWell or GymDesk that fit into these buckets of the moats that we discuss.

1:57Einar Vollset: This episode is a combination of two microconf talks that Anar and I gave just a couple weeks ago in Iceland. And this episode is so dense in a good way. It's action-packed and information-filled that we have brought the slides from our talks as well as producer Ron's going to put together a detailed summary of what we talked through in this episode and you can get access to that plus the Q &A that happened in Iceland that we're going to cut from the YouTube version of it. There was 20-something minutes of live Q &A after the talks. If you go to microconf.com slash motes and enter your email, that's microconf.com slash motes and you're going to get a ton of stuff.

2:41Einar Vollset: Again, video of the live Q &A. After this concept, you'll get the slides from our talks and a summary pretty detailed of this podcast episode. I know I mentioned at the top of this episode that it might be the most important episode of this year or of the past couple years, and I think that could be true. I think that is likely true, actually, in the way that it can help you as a SaaS founder think about how to shore up your business, not only to stay in business, not only to keep growing, but to have a great exit valuation if and when you decide to sell. And we thought about taking all this information and keeping it for tiny seed companies, putting it behind a paywall or however else we could try to guard it but realized that it will actually do so much more good if we are able to distribute it in this way for free to the community.

3:38Einar Vollset: So I hope that you listened to this episode gosh, maybe more than once, and try to internalize the ideas that we're presenting here. And with that, let's dive into our conversation.

3:57Einar Vollset: In our full set, welcome back to the show. Thanks for having me. We are having maybe the most serious conversation on this show of the past year or two. There's a lot of episodes, show up, answer a few listener questions, but just so folks are prepared, it's going to be obviously a longer episode, but it's really our take on the state of SaaS in the age of AI. And this has come about for a number of reasons. One is, as folks know, you run Discretion Capital, which is a sell-side M &A advisory for SaaS companies between$2 million and$20 million. and so you have a pretty unique viewpoint into the SaaS M &A market.

4:40Einar Vollset: You and I run TinySeed, 217 investments, and we are seeing things on the ground that some are good signs and some are not good signs.

4:51Rob Walling: That is accurate, yes.

4:52Einar Vollset: And we're trying to distill that into something actionable. Now, today's episode is a version of us talking through the microconf talks we did in Iceland a couple weeks ago. I did a 45-minute talk, you did a 15-20-minute talk. It all could have been the same continuous talk. It's all about, if you're running a SaaS company today, how can you potentially survive AI? What are some moats that are still available? We're definitely going to talk through the threats. We're going to kick off with, AI is more of a problem than you think. Because I think most founders, especially in our space, the microconf, tiny seed space, are underestimating the threat that AI is to their business or will be over the next couple years.

5:38Rob Walling: Yeah, I mean, I think like it's a very common thing with a lot of technical, particularly back mostly technical founders, right? And like, there's always some technology. It's like, oh, mobile's here or something's here or whatever. And like, for the longest time, like taking the stoic view, like, yeah, yeah, but I'll just keep doing what I'm always done. That was the right approach versus I'm not convinced at this point.

6:01Einar Vollset: Yeah, the SaaSpocalypse happened in February and we're recording this in October. And the SaaSpocalypse was the public markets dropping because there was a lack of confidence in public cloud companies, SaaS companies, and that rippled through the M &A markets. But what's interesting is we haven't really seen, it's not like we've seen our portfolio in mass plateau or go down. That's not happening. And so that's where there are conflicting signals. And this is, it's cloudy.

6:31Rob Walling: I would agree with that.

6:32Einar Vollset: We actually have spent the past several months thinking about this topic of like, we have this massive portfolio of SaaS companies, tens of millions in ARR across our portfolio. How do we advise them? And that's a big part, as well as, you know, when you're advising someone who is going to sell to private equity or a strategic, that's what we're trying to do. And so as you're listening to this, realize the dog in the race we have is this is advice that we're going to give to companies that we are either selling or that we are that we're invested in you want to talk a little bit about your process for this because you and i talked about are there moats that still exist are there some things you know they can do and i came up with several moats and you looked at them and you're like none of those are moats in the age of ai bro and i was like so so you went off and did some some craziness with claude arguing with chad gpt for weeks so there's a couple of different

7:24Rob Walling: things here one of the things is like from my perspective i was interested in like how does the buy side think about this like like what is the what are the thought leaders saying on the people that buy these kinds of businesses so there were a bunch of of commentary that was coming out of places like gartner and morgan stanley uh and all this stuff and so i spent a bunch of time thinking about how do they think about it what do they think is still durable and there was a lot of opinion writing and it's sort of like it's interesting because it's sort of bifurcated into pre and post you know february pre and post saspocalypse the underlying sentiment was very much up until february was very much like vertical sass vertical ai whatever you want to call it like ai is basically a tailwind like it's going to be a great year sass is the same nothing has changed it's maybe even just a tailwind and then you're done then after that like when and really like The actual triggers for the SaaSpocalypse in the public markets was these releases from Anthropic on the capabilities that they released, where people all of a sudden like, oh, this isn't just like a chatbot.

8:32Rob Walling: It can actually do things. And so what I ended up doing basically was sort of synthesizing, do sort of a literature review of like how the buy side was thinking about it. And there was mostly writing on that side, on the investor side. That's what, you know, there was there was some of it on the founder facing side, but most of it was on the investor side. So I was sort of synthesizing that and trying to get a sense for just map out all these various modes. And I think one of the things I realized, because I part of the reason I ended up going the investor side is because my sense is that most of the time founders up until this year hadn't really thought about modes.

9:07Rob Walling: Not really. Like, you know, they were probably relying on it. And, you know, they definitely were relying on it. And, you know, like one of the most, and we'll talk about it, that's no longer a moat. It's just like, I wrote a bunch of code. It took me a while. And they're like, you know, it's difficult to write code and it takes a while. There's a surprising number of founders that just relied on that, not knowing that that's really the only moat they had. And so really mapping out like, you know, what are the various different ways in which, why do people stay? Why do people keep paying for software?

9:37Rob Walling: And then mapping that onto the new reality that exists with AI. Which of these are still actual moats versus drying or eroding moats?

9:47Einar Vollset: I saw someone, it was a bootstrapper, an indie hacker on X, Twitter, saying, it was in a conversation I brought up that I was going to talk about moats in Iceland. And he said, why are we talking about moats? Those are VC things, we can succeed without moats. And it's like, yeah, maybe a year or two ago, maybe that was feasible. You find a niche, you thread a needle, you get some SEO, you get whatever and you can grow a business. AI is coming for a lot more than people realize. And I do think that it's helpful for even if you're a bootstrapper to think about moats. You're seeing indie hackers and small bootstrappers go to zero.

10:24Einar Vollset: Their businesses go to zero all over the place on Twitter because either the models themselves, people think there's like one or two threats. One or two threats to my business. One is that my customers are going to vibe code, my app. The other one is that the model is going to get so good it can do it. We have eight more. Ten of them. And this was the shocking part. I think when you brought the AI vectors of attack to me, maybe there were like six or seven or something. And I hadn't thought of half of them. And that was, I think, a big shock. So with that said, we're going to talk about those vectors of attack right now.

10:59Einar Vollset: Then we'll talk about moats and our best assessment of the moats that still work? Are we 100 % accurate on all of this? I don't think so. But are we relatively close? Are we directionally correct? I do think so. And I haven't seen anyone else talking about these in this capacity. And so this, I think, is something as a bootstrapper that I would be thinking about. I guess we'll say this a lot. I'd be thinking about how I can implement one or more of these moats because even if AI hasn't had a big impact on you yet, I do think it's coming.

11:31Rob Walling: I think that's really one of the big unknowns. I think it's undoubtedly true that a lot of these things is coming. The question is, how quickly does it spread through the economy and into your niche? That, I think, will depend on what your customers are like and all that stuff.

11:48Einar Vollset: Yeah, and I've been saying, I think between 10 % and 20 % of all SaaS companies are either going to zero or basically plateauing, declining. That includes big companies, small companies. Again, we're already seeing it with very small, you have a tiny little utility online that converts a file from this to that, like that's done. You had a little thing that transcribes or that, I don't know, podcast show notes, for example, used to be like an app. And I mean, it's still an app, but like it's easy enough to implement. But we're also seeing it like my prediction, my Babe Ruth calling his shot is that Squarespace, unless they do something, they're not going to go to zero tomorrow.

12:25but they're going to plateau.

12:28Einar Vollset: I'm moving all my sites off there onto static sites and I think a lot of other people are. There are now services. I interviewed Nathan from BlinkPages, a tiny seed company, and he's starting up a whole service to do that.

12:40Rob Walling: Yeah, there's no doubt about that. I think fundamentally a lot of these things are changing and I think how these companies react is going to have a huge impact. It's the first time in at least 10 or 15 years that leadership really matters in companies large and small. Because for the longest kind of time, once you get to a certain size and you had a SaaS and you had this retention and you had this, you couldn't really screw it up all that badly. Now you can't. You really can. And people will, for sure.

13:14Einar Vollset: And unless a company like Squarespace comes up with a whole new AI-first approach with static sites that it supports, if it does that, they'll survive. But if it doesn't, I just don't see how they do it long-term. So let's dive into this. We see it in tiny seed companies, micro-gum companies, saying AI is amazing, I'm shipping three, four, five times faster, and my customer base, they're not technical, so they are not going to VibeCode my product. Then there are folks saying, well, the models will never do what I do because I'm so niche. And this was a thinking I had even three, four months ago, right before we started talking about that.

13:50Einar Vollset: So those are two attacks. There are 10. We're going to break them up into supply-side attacks and demand-side. And what we mean by that is, if you look at Economics 101, if you manufacture widgets or you manufacture a SaaS app and the supply of widgets just in the overall market shoots through the roof or the supply of competitive alternatives to your SaaS app shoots through the roof, you have a problem because you're commoditized, your pricing goes down, just your ability to charge goes down. Similarly, on the demand side, if the demand goes to zero or gets cut in half, that's a big shock. So that's what we're going to walk through.

14:28Einar Vollset: We have six supply shocks. The first one is the vibe coding argument, is that your customer builds it. Keep in mind, people say, my software is super complicated, it took us 10 years to build. There's two things to this. Number one, it won't take anyone else 10 years to build it, usually. they also, if you have 100 features that you've built and they only use five, they only need to Vibecode five features and they're set. Attack number two is that a competitor, because all your competitors get AI, a competitor reaches parity, right? And this is the thing that I'm seeing, and I had a slide in my MicroConf talk where I had eight different AI note takers, including, I don't know, it was like Granola and Otter and six others.

15:13Einar Vollset: Fathom. They're all kind of the same now because you just get the feature parity real quick. And so Otter, I believe, launched in 2016 and Granola launched in 2024, eight years apart. And they're kind of the same product because AI just gets you there. So this is something that even if you have a lot of, you know, the old moat of, hey, we have a bunch of code, it isn't. Yeah.

15:40Rob Walling: And even integrations, you know, that used to be a big deal and all this stuff. Like if you said, well, documented API you're integrating with, it's like, well, I mean, what is it a day, two days? There's that. And it's also like different. There used to be, you know, this like stratification. It'd be like, oh, there was like the cheap SMB option that just kind of did things and competed on price, but didn't have all the complexity. And then once you, as a client or a customer, once you got large enough, you would graduate into the larger midsize solutions. and then maybe up in the enterprise.

16:11Rob Walling: The challenge now, if you're the mid-sized, then potentially your lower cost upstart type competitors all of a sudden have every feature that you have. And so there's really no reason to switch as clients grow.

16:25Einar Vollset: Yeah, it's crazy. And for those listening, there's a lot of information in today's episode. So I'm going to have producer Ron put together a PDF summary of this, of all the info. and that will be at microconf.com slash moats. This is hundreds of hours of research and frankly, you and I can probably talk about this for six or eight hours, which we will to tiny seed companies, right? This is the basis. This is like a one-on-one version of what we're going to dive into with our own investments. So tack number three on the supply side is that open source gets good enough. So we're seeing more projects launch.

16:58Einar Vollset: We're seeing them move faster. And usually if you're a buyer, you know, open source is free like a puppy for that expression. Well, now non-technical buyers can deploy open source. It's not that much effort. And are any one of these things going to wipe out all SaaS? No, but each of them is another few percentage points, right? That's what we're getting at here. Attack number four is a platform that you're integrated with ships your feature or feature set for free because they already have the customers and they move five times faster than they used to and they were never going to build your little niche thing until they decide, oh, look, here's a spec for how to build it.

17:38Einar Vollset: The spec is your app. I'm going to crawl through, I'm going to screenshot it, right?

17:41Rob Walling: There was a big public market fallout thing with something related to this pretty much. I think it was ServiceNow or one of the big field service engines. All of a sudden overnight decided no longer accepting integration with one of their long-term partners, which was a lead management tool. My read of that is ServiceNow is like, no, f*** that. We want to own that part too.

18:02Einar Vollset: We're just going to build it. that's going to be faster and faster. Attack number five is interesting. It's custom software at SaaS-ish prices. So you have a generic SaaS, charge$99 a month. Agencies also get AI. And so agencies, we've seen firsthand $30 ,000 to$50 ,000 agency projects. What used to be that, they're just like, look, we'll build it for a couple grand up front and it's completely custom to you and we'll charge you$500 a month,$1 ,000 a month. But it is custom to you and we'll maintain it on that monthly basis. that's actually a great business if i was getting started yeah go after once yeah why not think

18:38Rob Walling: about it right like you know particularly the mid-size enterprise side of things where maybe you're kicking out i don't know you're a business you're paying 50 grand a year for for this software and here comes someone along and says you know for 25k a year you'll get a super custom with an sla and i'll be i'll monitor it and integrate and do everything you need yep the moat of

19:01Einar Vollset: SaaS being complicated to build and host and maintain, it's not going away, but it is being dramatically impacted, right? So attack number six is that the model itself, like the LLMs, the foundational models, basically absorb your product. They kind of turn you into an obsolete wrapper. It's not going to happen to everyone, but we've seen it already.

19:22Rob Walling: It happens to some. I mean, Christ, do you remember we had some early investments in Tennessee where someone really smart had gone along and they fine-tuned their own model and it was like perfect for this. It was like state of the art. And then like, I think ChatGPT released a new version and it was like, oh, out of the box, zero shot. It does a better job. It's like, well, then you're screwed.

19:43Einar Vollset: Yeah, we've seen a handful of companies within our portfolio experience this. So now let's look at demand side. And these are the ones, there were a couple on the supply side that were surprising to me, but the demand side was the one that I hadn't thought of. So there's four here, right? So attack number seven is, will your customer still exist at all? and the idea of, let's say there's an agency out there that used to either translate words, text, audio, or they would transcribe words, text, audio. So since AI has come out, the number of words translated and transcribed in this world have, what do we, 10X, 50X, whatever.

20:16Einar Vollset: I transcribe everything now because we can, and it's really good. The agency revenue for those businesses is effectively going to zero. If it's not going to zero, it's going to a 10th of what it used to be because everybody knows we can just use AI to do it. So the activity itself, the volume of transcription and translation has gone up. But if your customers, if you were building software for translation agencies, transcription agencies, you're done. Like there's no market there anymore.

20:41Rob Walling: Yeah, I mean this sort of reminds me of my favorite conspiracy theory that dentistry is basically just a fraud. They fixed it in the 1970s and then they decided, you know what, we can't get all these dentists unemployed so we're not going to distribute the solution. But it's a similar thing. Like if you fixed dentistry, if you gave it to people like a pill or a shot when they're born, all of a sudden, like you had perfect breath and no cavities. Like if you're selling to dental dentists, then that's a bad that's a bad industry to be in. And it's sort of similar. Right. Like an example, you know, a slightly less tin pot example is like, OK, AI receptionists are not bad.

21:15Rob Walling: I know good enough most of the time to the point where I actually like I wish my airline would like offer me two options. One, call into the usual regular call center. And two, here's a phone line to the AI voice agent that picks up instantly. And so that's an example too, right? It's like, okay, if you had the world's best SaaS that was selling to call centers for human receptionists to click around on, okay, that's a tricky business to be in at that point because you're just going to get replaced. The people clicking on your buttons aren't there anymore. They're not getting paid to do that.

21:48Einar Vollset: Yep, and that leads us into the next attack, which is like, there's two that are very similar, but this one is, are your seats going away? Meaning, like Zendesk is a great example of this, right? If you're charging per seat for customer support software, you used to have six, 10, 15 customer support reps, and AI's handling a big chunk of that. Not handling 100 % of it, but are they handling 80%, 90 %? And so now you need, what, two reps, three reps that are just monitoring the agents? Like, if you charge per seat, you don't go to zero, but you lose 70, 80 % of your revenue, right?

22:20Rob Walling: This is also kind of the problem with like, and HubSpot has other problems too, but HubSpot's a similar thing, right? Like you used to be per seat for human writers to write things and SEO optimize and all this stuff. And now it's like, it just, no, like the thing is AI slop. You just generate that out. You don't need as many writers. So if you're counting writers and you don't need as many writers or you're counting receptionists, you don't need as many receptionists or customer support agents or whatever, that's a contraction, even if the underlying industry is doing well.

22:45Einar Vollset: And then the ninth one is what you already referenced, which is if you cater to receptionists and they truly just are going away, it's all agentic, which there's a chance that happens. A really good one. With phone receptionists specifically, I guess we'll talk about, because there's a pivot here. That's an attack, you're going to go to zero, but the way to get around this, of course, is to build the agent yourself and start selling that.

23:10Rob Walling: On the offensive side, for sure.

23:11Einar Vollset: Yeah, you're selling$50 a month per seat software for receptionists right now. Do you charge$500 a month or$1 ,000 a month, frankly? Build a full-on AI agent and just go all in on that. So we'll talk about that a little later. The 10th attack is, does the step you manage still matter? Or does the artifact that you create still matter?

23:32Rob Walling: Yeah, the interesting thing here is there's a lot of things, once you start to think about it, there's a lot of things that only exist in this world because that's how humans coordinate. work around something. If AI is going to eat part or all of that process, you don't need those artifacts anymore. So if your things are like managing those artifacts, then.

23:50Einar Vollset: Yeah. And the example in my talk was take home coding tests for developers. And it's like that just can't, that's just not going to be a thing moving forward, right? Because everyone can use AI to do it. You're not going to be able to tell. And so there's pair programming. I mean, there's other ways to do this, but if you had a business built on that, that's a time to pivot. So I want to talk about old motes very briefly, I want to spend less time than I did in the talk, because we've already started touching on it, right? As builders makers, we think things like a unique feature set, or clever complex code, years of coding, even integrations you already mentioned, high switching costs for some I think are going to go down.

24:29Einar Vollset: I don't know if you've used Manus, but I've had Manus click through some stuff and it is bananas what it can figure out. And it just figures it out.

24:37Rob Walling: Yeah, I mean, browser use, yeah. I don't think the average person doesn't realize what an AI can do with a computer. They will soon, but they don't at the moment.

24:49Einar Vollset: Right, and even UX familiarity has been a moat, right? Of like, oh, well, your whole team of non-technical folks in the office knows how to use this construction management software. You don't want to retrain 50 people. And it's like, yeah, maybe, but what if agents start doing a good chunk of that work? What if they start doing 40, 50 %? Suddenly you don't need to retrain an agent. It'll just figure it out, right? So again, none of these things are, this is where people who say saspocalypse are like, oh, 100%, everything's going to zero. It's like, no, no, no, no. But also I'm not going to Pollyanna and say, oh, my customers won't vibe code my app.

25:25Einar Vollset: So therefore nothing's going to happen. Neither of those is true. So let's talk about moats. the eight motes that we hypothesize still work. And as I said, you did this big lit review for weeks. Dude, I was like, you had like a snorkel on. I would talk to you and you're like, I'm so knee deep in this shit. I don't even know. You were talking to me like I was Claude. You're like, dude, my friend Claude told me. And I'm like, Anar, he's not a real person. You gotta get out of the building. You gotta go touch some grass, bro. You were deep in it. Yeah, go fishing. and came up with a list of, I think it was six moats.

26:02Einar Vollset: And then as I started digging in, I came up with like four or five more and then some of those weren't moats, but we wound up with this list of eight. And I think this is pretty close. I think it's close to reality. When I knew we were on track was when you and I then kept coming up with other ideas of like, ooh, what about if you have software plus hardware? And it's like, we missed a moat, there's going to be nine. And then we came back the next day and we're like, aha, fits into this category. That's when you know like a taxonomy is starting to hold up. when it stops changing so often. So let's dive into this first one.

26:32Einar Vollset: This is where buyers know and trust you, all right? So it's not just having a strong brand, but it's you know the buyer and you know how they buy. There's a partner, potentially partner ecosystem where they've built their businesses around recommending you. And hopefully there's a champion inside your account that is fighting for you. such that a competitor with better software still has to build all of it from scratch. And I want to point out that these are all on a spectrum. I don't think this is a binary one or zero. Like, I just listed four things, right? The brand, you know, the buyer, you have partners that recommend you, you have a champion.

27:14Einar Vollset: Like, if you have four of those things, amazing. If you have three, you're less on the spectrum of the moat, you know? And it's like this lower score. If we were to score it on one to 10 or one to 100, you can imagine that being there.

27:26Rob Walling: Yeah. No, I mean, I agree with this for sure. Like the example I think you used from the talk was QuickBooks, which is, I hate QuickBooks, but it's still like, look, this is like what everyone, all the accountants use and that's what they recommend. And so it's not easy to replace them for that reason. Like you could, you could vibe code a QuickBooks alternative. I don't, I don't think that's super hard to do, but I can distribute it. Right.

27:52Einar Vollset: I mean, accountants, my accountant has used it for years and, and he would recommend it if I wanted to look at the books. because I just don't want to, right? The other example I used was Shopify. They have an amazing partner network, right? Thousands of agencies that if you go to hire an e-com agency to build your cart, the odds are good they're using Shopify. And so we have a question at the end of each of these modes and it's a thought experiment to see if you can fit into this mode or implement it or where you stand with it. And it's like, who's built their business or their career around recommending you or your product, right?

28:25Einar Vollset: Give that some thought. The second moat is that you're a system of record. And you've been using this term for years because I think it's a popular one, right? In kind of in private equity circles. I've always thought of it as being like the operating system for a business. The underlying OS, the whole business runs on, right? So daily operations are built around you. Approvals, statuses, balances, everything lives in your software. There's rules configured in it and other systems are wired into you. They integrate with you to either pump data in so you can act or to pump data out so they can act.

29:00Rob Walling: Yeah, it's like another way to think about it is like, is there some canonical state that's just recorded just in your system? You know, it's not elsewhere. It's not a copy of something that's elsewhere. It's like, OK, the decisions we made or the definitive record of it. Like the example we use here is like Jimdesk, which is a tiny C company. And it's like, yeah, like who's running those classes like is like is on a Tuesday at 6 a.m. is recorded in the gym there and nowhere else. And that's like the canonical state. And like who has paid? Who has paid for membership this month? What is like who has access to the key fob?

29:34Rob Walling: That sort of thing. It's like, yeah, system of record. And yeah, that that is remains one of the strongest things. It's like that's where like the canonical state is stored.

29:44Einar Vollset: Very hard to try to leave that. The switching costs are still enormous. It's not just pointing mantis at it and exporting data and moving somewhere. It's everything. What can't you export? What breaks downstream all the integrations you have? What do you have to retrain your humans to use? What do they have to rebuild?

30:02Rob Walling: You've got to reprogram the key fob. You've got to ask people to add your credit card in again. Are you going to do that? No, you're not going to do it.

30:10Einar Vollset: Number three is that this was one when you first said it. The next two, actually, when you first said them, I'm like, I've never thought of these at all. So these were a surprise. But number three is you're allowed to act. And I had to really think this through. So a tool that recommends a payment, like, hey, here's a CSV, you should go make$20 payments to all these affiliates. That's one thing. But then there's a tool that is authorized to just make the payment, to actually move the money. Stripe Connect is an example of this. like it moves money around, very hard to leave. Reemby is a tiny seed company, right?

30:44Einar Vollset: That sends reimbursements to job candidates. Someone, you fly them into your office to do a job interview. You don't want to set them up as a vendor. So you input their Venmo PayPal cash app and it just sends the money. It actually moves the money. This was not something that I would have thought of as a moat before you brought it up.

31:01Rob Walling: Yeah, I mean, it's just one of those things like can your software do something or is it just an advisor? If it's just an advisor and the human still has to do something, that's much easier to replace, right? Because then it's like, oh, I still got to look at it and review. It's like, okay, but this actually is wired in. It does the thing. It's part of the plumbing, kind of.

31:20Einar Vollset: Yeah, people don't want to pull it out because it's autonomous in essence or it, yeah, it gets work done. Fourth mode, again, another one that I was like, I hadn't thought of this, is that they don't check your work.

31:32Rob Walling: Which sort of relates to the prior one, right? For sure. But it's this notion that like, You're allowed to act, you do something, and then like the people who pay it, they trust you enough, they don't check it. And I think like the classical example here is like, which like, you know, like HR software. I use Gusto for some things and they file documents that like I could apparently go to prison for, for Iran, for various state agencies that says this is your worker comps, this and taxes and that. and they send money around and like, do I go in every month, every bi-week and make sure that the quarterly tax repayment that they're doing to the state of California and the state of whomever else?

32:13Rob Walling: No, I'm not. And like, that's a big deal. Like, I have bestowed upon you not only the right to act, but I trust you as the software and not to screw this up. And to the point where I don't have to check it. If I have to check it every time, then you're easier to replace. Yeah.

32:27Einar Vollset: And so when you vibe code your Gusto replacement to save 49 bucks a month. Or when an indie hacker vibe codes Gusto, are you going to do it?

32:37Rob Walling: No. Or accounting software and tax software are sort of similar too. It's like, do I really want a vibe coded solution to save 50 bucks a month so that the IRS is going to come right up my ass? Do I really want that? No, probably not.

32:51Einar Vollset: Number five is an interesting one. I have it worded. I mean, we have different wordings for these all over the place. but the one that I have is someone official already said yes. And this is around regulation, licenses, accreditations, and certifications. Because a competitor can clone your code, but if they need to get approval from a board to do something, it can take months, if not longer. And I want to be clear here that serving regulated customers isn't the same as you yourself needing to hold SOC 2, ISO 27001, approval from the ABA training or the psychological, you know, the APA training board.

33:30Einar Vollset: What's your, what are your thoughts here?

33:32Rob Walling: I think, again, like this is a scale, right? There are some things that are hard, are like seem like hard to get, but aren't all that hard to get. And then there are some things that are actually, yeah, like this is a pain in the ass to deal with. And it's like, it runs the gamut, right? The fact is like, if you are an organization that needs some stuff to be HIPAA compliant because you're dealing with personal health records or medical health records, then, you know, like if you have some software that's dealing with that and you know that that's HIPAA compliant and like you're not going to get into trouble with the whatever, am I really going to vibe code like a HIPAA compliant replacement?

34:07Rob Walling: Like, is that what I'm going to do with my life? Like, I probably not. Like, the hurdle is higher. This is what I mean. Like, there are no perfect modes. Like, eventually, like, we're all dust in the universe and, you know, the heat death of the universe, et cetera. But fundamentally, like, this is one of those things that are like, yeah, I'm not just going to do it. Like, yeah, Tom, he vibe-coded a new version of our EHR, and he says, like, we're going to save$500 a month by doing this. Am I going to take that risk, that compliance risk? Probably not. And there's a fair amount like that. Actually, one of the examples is just from the TinySeed portfolio is like SignWell, which is like a DocuSign competitor, eSign competitor, right?

34:46Rob Walling: And it's like, okay, that seems easy. Like, what is eSign? Ah, it's just figuring out where to stick the signature in a PDF and a story. No, that's not an interesting part of that problem at all. It's like, okay, you signed a contract. Now there's a dispute on that contract. Okay, is it valid? Are you going to vibe code an e-sign solution so that your million dollar contract is in question because you vibe coded the e-sign solution? No, you're not going to do it.

35:13Einar Vollset: Yeah. Another example from Tiny Seed is Sidekick Learning, which is ABA training, which I believe is Applied Behavioral Analysis. so it's affiliated with psychology and therapy and stuff. And their courses count towards a credential and CEUs and all that. I get it, that's niche, but that would be, so nobody's vibe coding a competitor to that.

35:38Rob Walling: Yeah, exactly. And it's just like, look, is it super duper hard to have AI generate some training material? No. But do you really want to find out that you're, I don't know if this is specifically the case, like, oh, it turns out that the 200 nurses that use your software aren't actually, you know, legally registered nurses anymore because you didn't do the exactly of the right amount of, you know, compliant training or whatever. Like, that's just not something you want to deal with most of the time. Yeah. And mode number six is, I called this everyone's already in it,

36:12Einar Vollset: or who has to move. Really, it's network effect. It's like, let's say if you have software where one person needs to start using a different app, then they can switch in an afternoon. If you have to move a whole team, everyone has to agree, migrate together. But if it's like multiple teams, a whole company, or a whole community, and I know what example you're going to bring up, so I'm going to pass it to you. It is a mess. Slack is the perfect example of this, right? None of us really like Slack that much. It's getting kind of bloated, kind of pain in the ass, kind of expensive, but we just keep coming back.

36:44Einar Vollset: What's your other canonical example of this?

36:48Rob Walling: school apps man like if you have kids and anywhere in the western world you've been tortured with this like every start of the school year it's like hey get on the parents view and grade tom and this and it's like you're like what the hell like the there's like four different logins it's like what is this complete dog and you you have no doubt like you have to do it and i'm like and you log in you're like look my kid could like vibe code a better solution than this in a in a couple of days why is this all so bad and the answer is because the school doesn't want to move a thousand students and four thousand parents or whomever many they just don't want to do it it just it's install base it's like it's there it's like they're just not they're just like moving software means telling an entire community that hey you know all that stuff we told you about like we pain we went through to sign up.

37:42Rob Walling: Now you have to go sign up for this other thing and do this whole other thing again. And that's just not, that's just not going to work. You know, so it doesn't almost doesn't matter. Like it just, the threshold for functionality is so low. It just has to be barely better than dog and it still gets paid.

38:00Einar Vollset: Yeah. That's what network effects get you. Yeah. Moat number seven of eight is that every customer makes you smarter. So this is where Stripe Radar is an example, right? Every merchant on Stripe is protected by the fraud patterns seen at every other merchant. So no single merchant could ever build Stripe Radar. There's a ton of value in the collaborative, in the community, you know, and the data Stripe has, no one else has. So you can't just come in and replicate this.

38:32Rob Walling: Yeah. And like, you know, there's some of the stuff, this is sort of related to some of the stuff we'll talk about on the sort of offensive side, like what are the opportunities here? But fundamentally, like, yeah, there's there are certain things that like if you have software that learns from actual use of your customer and gets better.

38:47Einar Vollset: Yeah.

38:48Rob Walling: In general, like it's almost similar ish to a network effect. You know, like some some networks are like, like Twitter is better, however, more people are on it. And this is kind of the same. It's like you have more customers and because of that you're learning more from your customers and your product improves, ideally automatically.

39:04Einar Vollset: And someone who just goes and codes this from scratch doesn't get that. And if you leave your product, you lose that value, right? You lose the learning. And so, yeah, as I said at the beginning, these are defensive modes. These are how to defend. And at the end we'll get to going on offense, which was your talk in essence. I guess to put a finer point on the learning loop aspect of it, I had that it only counts if it clears three gates. Every customer makes it better for every other customer. Customers can take their data, but not what you learned from it. And you keep learning, your app keeps learning, because last month's data isn't sufficient.

39:42Einar Vollset: If it stagnates and you're not constantly improving, then it doesn't matter.

39:46Rob Walling: I sort of disagree a little with this. I think there are still, you know, it doesn't have to necessarily translate across every single customer all the time. Like it can be like, look, in the best case, like you can like just having if you are a single person that over time it learns about your habits, it's going to get better. Like that's good for you. Even better is if like it goes across a team or an organization. Like if a whole organization comes in, it becomes better. It fits that organization better. It learns inside the organization. It doesn't have to transfer across organizations. But that's the ideal.

40:16Rob Walling: The ideal is like more. And another thing here too, and like we'll get into more details on this on the offense. Like it needs to be something that's not easily stealable or like not easily exportable, easily learnable, easily like simulatable. Like it has to be things that are like you're observing things in the real world on like a real world clock as opposed to like something that you can just generate a crap ton of synthetic data. and then go out and just very quickly learn what you need to learn.

40:48Einar Vollset: All right, eighth final moat is, it's hard to keep running. And I was referencing that Peter Lovells had a tweet where he's basically like, I'm vibe coding everything, all my apps. I'm not going to pay anybody else, I'm self-hosting everything. And obviously he's one extreme, most of us aren't going to do that, but it's just an example. But he said the only thing he's paying for now are Cloudflare and some bare metal hosting somewhere, maybe it's VPSs, I don't even know, and Scraping B. And it's like, well, why Scraping B? And he said he's been repeatedly having AI try to build Scraping B. And it's like, well, it's not the code.

41:23Einar Vollset: It's all the proxies and the CAPTCHA and all this other stuff. And AI is just like, we can't build this for you. And so it's that thing of like web scraping isn't hard to build, but to keep that working, it's brutal.

41:36Rob Walling: There's a big, big difference between like I'm going to I have a single page to scrape for my own purposes and I can just hack that together and I'm just going to scrape it and lo and behold I'm able to get it through to like yeah I need to like over time manage proxies and keep track of that and like avoid the anti-scraping technology and like all this stuff and fundamentally what's going on here is like there are certain things that it just does not make sense for a single client to do themselves the cost of it is such that you need it amortizing across a number of customers and like you'll be familiar with this from your drip days it's like look sending some look at his face sending some goddamn email getting that delivered not caught in spam and like not having really angry customers like staying ahead of the and staying ahead of the folks that want to use your services for spam and like all this like that does not make sense for a single you know you have to be a pretty sizable company for it to make sense to have you know what i'm gonna hire 25 dudes and they're gonna be looking after my email infrastructure and and that that is a sort of similar deal to scraping b and and honestly a lot of businesses are like this it's like i figure out i'm world class at this the cost of doing it there's just a minimum hurdle of like complexity of running it figuring it out maintaining it slas whatever and you just can't compress it and that's just the

43:06Einar Vollset: way it is yeah and that cloud flare is another example of this it's is it is it hard to build this to code it or is it hard to like keep it running like is it there's a devops load there's a i mean the other spam one you bring up is just we had a full-time person plus just doing this full time.

43:22Rob Walling: Yeah, and someone has to like, it goes down, oh, you're like under spam attack, or like some of your spammers in Nigeria started sending like 10 ,000 emails out of your one good IP that your number one customer uses, you got to wake some dude up at 2am. And it's like, look, like, do you want to do that? Or you want to pay 249 a month?

43:40Einar Vollset: That's, that's why this is,

43:42Rob Walling: is a moat.

43:43Einar Vollset: So those are the eight. And I won't recap them here, because folks can go to microconf.com slash motes and download a list of them. But as we talked about, and there's, you know, we're going to create curriculum, like a whole playbook for tiny C companies around this about how to evaluate themselves, where are they, do they have any of these motes, maybe scoring potentially, and the idea of how, what motes are you closest to? If you don't have any, or if you have three and you want to get four, like how do you do that? So there's a lot more to this conversation than just this identifying of them.

44:18Einar Vollset: But that was us going on defense, right? How do we not get sideswiped by AI? You've talked a lot about going on offense. Why don't you take us from there?

44:30Rob Walling: So going on the offense side, basically there's sort of three moves, effectively, I think, in this world. And sort of the obvious one is the one that people are kind of already doing, which is like, keep improving the business. Use AI to make, you know, to go out and just build more software faster. It's sort of similar to like kind of what you've always done. It's like, OK, for me, like maybe you identify that you have a bunch of these modes. Actually, your business is in great shape. No problem. And actually, like, it's just an opportunity. And you just go out and like you just have to build more features.

45:05Rob Walling: And AI gives you that capability. And great. Right. So that to me is almost like, you know, table stakes as it relates to what you could do here on the offensive side. And I think everyone can do that. The second part is, you know, one of the one of the things we identified is this notion that people will have more agents. There'll be more agentic things happening. And so like agents are going to be interacting with your software, most likely in some way, shape or form. And there are kind of two stances to do here. One is to try to lock them out, which is sort of the Amazon approach, I guess. You saw that this week with the Muse, the Facebook bot, like you can't order things from Amazon using it.

45:43Rob Walling: That's one approach. Another approach is basically say, like, look, I want to make it super easy, you know, for the agents to come through and offer an MCP and maybe gate those people and like get paid based on that. And that can be a really good solution, actually, for a lot of things, because, you know, AI doesn't seem to always think it should build everything from scratch. The way that I think about this is like AI makes a decision on complexity. There's like it might decide, you know what, like the best solution here is just to use this third party thing that will just get us what we need.

46:16Rob Walling: Let's just do that. And actually, like I thought about this when we were in Iceland. It's like it's almost like there's two different kinds of SEO now. There's like the SEO to get your human customers to use you. but then there's also the SEO that's like targeting agents and figuring out like how do you get the agent to pick my solution over all the other solutions which might be actually be a different question than the SEO for humans and so if you have something here where it's like it's clear to you that people are going to be using agents to do that making that ideal and actually charging for it and like you know doing that agentic SEO or whatever you want to call it like that is definitely a play.

46:57Rob Walling: So those two things, I think, are sort of like semi-obvious. I think most people have done it. Really, the main thing, I think, is you want to kind of become the worker. Like, you need to start doing the work. If there was one thing I could do in terms of portfolio or just a wider community, it's sort of a kick up the ass in the sense that like, look, an awful lot of SaaS, B2B SaaS is I have a tool, some kind of a tool. I'm selling that to my customer, a business owner of some kind, probably. And that business, they basically hire somebody or they have an employee to click on that on your tool in order to have some outcome happen.

47:37Rob Walling: That's a lot of SaaS. And I'm here to tell you that like, if that's the case, somebody is going to come along and they're going to say, okay, you don't have to click on this thing anymore. just like we're just going to sell you the outcome like we're just going to give you the outcome that you actually want and my view here effectively is like if you think that's likely to happen maybe not immediately but like in the next year or two you should do that you should be the one to do that and the point i made in iceland is like it's not and like i actually see this also like if you just look at like launches for y combinator like so many of them like 40 50 of those are this they're basically agentic SaaS, I think it's sometimes called.

48:17Rob Walling: This notion that like, yeah, you sell the outcome. Like don't sell the tool, sell the outcome. But on the flip side, if you are a bootstrapper with existing customers and things like that, and you have industry know-how and connections and customers and all this stuff, it's not obvious to me that you are in a better shape being a Silicon Valley startup with a 10 million open AI token budget or whatever, versus if you're listening to this most likely you already are you have a sass in the industry and it's already doing something like you might be in a much better position because the hard stuff to get is like trust from the customers and like there's a lot of noise around this stuff if you come along as the trusted vendor who used to sell the tool and now you're like here's like partially or fully the outcome and you can charge 10 times that like that might be a much better solution so i think for most people 80 i would say that is the play that is your opportunity and i think like there's a lot of like angst about sass at the moment you know there's almost this sense that like oh like here we go you know it's like why couldn't i sell my sass like five years ago and you do whatever and i'm like yes but also like the opportunity here is much larger than it's ever been just because what you're doing is like much more aggressively than before you have an ability to go in up into the labor budgets and the labor budgets are much larger than the software budgets if you look at your average business in this world they spend a lot more money on salaries than they do on software and if you can access some of that then you you're potentially in a great position and one of my like favorite like books is called 10x is easier than 2x and i think that's the mindset to have on this it's like yeah like okay you can build a little faster so you can build some things you can charge some more for your software that's great and i'm not saying you shouldn't do that but it's always worth taking a step back and being like all right i'm charging 75 a month what do i have to do so that that same customer will give me 750 a month that as an exercise.

50:28Like thinking about like, okay, what are they even using my tool for?

50:33Rob Walling: Like what other things does this person that clicks on this? What other, like what are adjacent workflows that I can go after and just offer as a solution so that I don't have to use as much labor in order to get the outcome that they want? That is the opportunity. And I guess I'm a little surprised at the negativity in some cases about, you know, AI on this. And I'm like, yeah, I get it. Like it's, There are certain ways in which we're starting to hear people say, forget it, I vibe-coded a solution, or I just used Cloud for this. But equally, I think there's an opportunity here to 10x a lot of businesses that prior to AI may have really struggled to grow 2 or 3x in the same time frame.

51:11Einar Vollset: So the opportunity there is become the worker. And I can already imagine all the objections that I would hear from this, from bootstrappers and such. To me, if I were a founder still, if I was, let's say, running Drip, I'd be like, God, that sounds like a lot of work. I'm already working full time just trying to keep this business afloat. Now you're telling me to spin up this whole thing with a worker that I then have to monitor that we know is not going to be 100%. AI is going to be 70 % or 80%. So then how do I put the safeguards or whatever else in place and how I sell that at 10x and now I need a sales force where I was self-served before.

51:45Einar Vollset: I can come up with a litany of reasons to not do this or at least objections. But I think what you're saying is, well do you want do you want to survive right that is it i mean i think i think that's it

52:00Rob Walling: and and like one of the things that it allows you to do is that if you're going to do the worker the stuff then then kind of naturally this mode of like this sort of learning loop that we talked about this this like notion that you're observing how things are going and based on the actions that are happening and the actions that got taken by your AI worker thing, you're able to improve over time. That moat is always like, if I'm thinking about moats that I think are likely to keep forever like ahead of the capability, that is the one moat that I think over time will just get stronger and stronger.

52:39Rob Walling: This notion that like, it acts on the world, your AI worker does some things, It resolves a ticket, it gets a refund, it does whatever it does, and then it learns from that. And because of that, it gets better. And that then transfers across your customer base so that you as a business, you're learning more and more and more and getting better and better and better at this thing. That is like the only mode that I can see that's likely to stay ahead of sort of this expanding capability frontier that the LLMs have. So, yes, it's a lot of work, but fundamentally, I think like your alternatives are good, but not great.

53:20Rob Walling: Right. Like so like person who thinks I'm just going to stick with this and like I'm just going to like use what I call the old school learning mode, which was always like you always kind of there was always a learning mode. Right. And it's like it's this it's you observe your customers, you see what they need or your prospects or whatever. And then they tell you what they want and then you build that feature and then you ship it and then you see if they like it. And then like that sort of thing, the problem with that, and that's sort of the classical manual loop, as it were. But the problem with that is like the outcome there is visual UX, like it's code that is, you know, maybe take a very long time in order to get right in terms of designing and learning from your customer.

53:59Rob Walling: But once it's built, it's like five minutes of screenshots from Claude and it just replicates everything and it just pushes it out there versus like a learning group where like it's knowledge that exists now within your organization that people don't just take with them when they leave or you can't just screenshot in order to copy. That is the one loop that I'm the one moat that I'm pretty confident is going to stay ahead for the years to come. I think the most valuable businesses will be like that. There'll be things that you have learned over time in the real world from actual customers. You add a more capable AI to that or whatever, everything gets even better, but it doesn't negate the fact that you have learned all this stuff that an NLM just can't learn very easily.

54:46Einar Vollset: I want to call out to folks listening, the first offensive move is to become the worker, agentic SaaS and related but a second and different offensive move is to implement a learning loop like you've said right not the old school learning loop but the actual like you have data and figure out how that data helps and predicts for all or most of your customers that's another thing that is incredible it's not just a moat but as you have it it should draw in more customers and build momentum. The thing that I struggle with with it, because I totally agree with you, obviously, the thing I struggle with is I know that if, let's say we built that, again, if I was still running Drip and we built an amazing learning loop to keep spammers out and to keep everything deliverable, there would be a bunch of schmoes who would come along and vibe code stuff and say, but our deliverability is great, it's 99.9 % and they'd just be lying.

55:43Einar Vollset: And so building this is not enough. It's like you have to kind of build, I think, build your brand around that for people to believe it. Like just saying it on a marketing site, I don't think that's enough. And that sucks. That sucks. It's not fair. It's not your fault. It's your responsibility to get this done, right? It's that type of thing where I wish that it was easier. I wish you could just build a learning loop and be like, look, our tech is the best and everyone believes you, right? Or our learning is the best. Our engine is the best. you know that people are going to argue over this and try to discredit you and say that they're better and all that stuff.

56:16Einar Vollset: So just be prepared for that fight doesn't mean it's not worth it. Cool, man. So we covered a lot of ground today about the vectors of attack, the 10 vectors of attack, the supply and demand shock, eight moats that we think will survive in the age of AI as well as how to go on offense. As a reminder, you can go to microconf.com slash moats if they want to download a summary and potentially the slides if producer Ron gives me the thumbs up to give away my own slides. You know what I love? Dude, I love going to micro-confs and people come up to me and they're like, hey, Rob, so where should we be?

56:51Einar Vollset: At what time? And I'm like, you know what? I go where producer Sonia, whatever's on my calendar, is where I'm showing up. So please don't ask me information about logistics because I just genuinely don't know. And yeah, Sonia is my boss at the event. Similarly with Ron, I'm always like, so what are we giving away, Ron? because I don't actually know what the giveaway is. So all that said, if folks want to keep up with you on the internet, you are posting daily about the San Francisco Giants, fishing, and sometimes even SaaS M &A and moats. You are Ainar Volset, E-I-N-A-R-V-O-L-L-S-E-T, on X Twitter.

57:30Einar Vollset: And of course, discretioncapital.com. You run the sell-side M &A advisory for SaaS companies He's doing between$2 and$20 million. And obviously, even if you're doing seven figures and you're a SaaS company and you're thinking about selling here in the next, whatever, 6, 12, 18 months, A &R is thinking a lot about this stuff, about how to make SaaS valuable and how to make it still a desirable asset to acquire. We are also thinking separately. I'm thinking a lot from the founder perspective and operating businesses and TinySeed. You are too, but you're also then thinking about it from private equity and how to market these companies to make sure that you still get good multiples.

58:12Rob Walling: Yeah, I think it's fundamentally changed. The positioning has fundamentally changed in that being knowledgeable and really understanding how to position, basically how to argue that, look, AI isn't going to kill this business next year. That has become a fundamental part of sell-side M &A work, for sure.

58:30Einar Vollset: Right, it just didn't exist two years ago. We were such young spring chickens. Why didn't I, we should have just sold. We thought COVID was bad. Here we are. My sweet, sweet summer child. Yeah, totally. It's like, whoop. So we don't, I mean, this is the thing that like you and I, it's almost like day to day, week to week. We'll talk and be like, how are you feeling today? And it's like, man, I think, I think we're good. I think things are going to be great. Like we have moats and we're trying to educate. And then the next week it's like, I don't know. This is really, maybe I'll just go fishing for the rest of my life.

59:01Einar Vollset: You know?

59:02Rob Walling: I'll become a fishing guide.

59:03Einar Vollset: Yeah. And what's funny too is you can see how my thinking has evolved, certainly on this podcast. I recorded an episode two, three months ago about SaaS and the age of AI, I think was what it was called. And that's still generally valid. I still say I think 10 % to 20 % of SaaS companies are going to be impacted. What I didn't have was these moats at all. I had three or four vectors of attack, I think is what I listed. And those were the ones that I had come up with. And then with new information, we form new opinions, right? Because we're not politicians that are accused of flip-flopping when we actually change our opinions on things.

59:37Einar Vollset: You're watching it happen in real time. Aynar, thanks again for joining me today.

59:43Rob Walling: Thanks for having me.

59:44Einar Vollset: Thanks again to Aynar for joining me on this epic adventure through SaaS defensibility and offensibility, which isn't a word in the age of AI. Again, if you want to download all the goodies that come with this episode, microcomp.com slash motes. Thanks for listening this week and every week. This is Rob Walling signing off from episode 855.