The SaaS Moat: Who Survives the Software Reset

Software sentiment is the worst it's been in a generation. IGV, the broadest software ETF on the market, has shed 28% from its September 2025 highs, posting its worst month since 2008 while hemorrhaging nearly $4 billion in net outflows over the past year. Downgrades are piling up across the sector. And the narrative driving it all can be summarized in one sentence: AI is going to replace enterprise software.

The trigger was Anthropic's launch of Claude Cowork, a tool that doesn't just chat but executes. It navigates file systems, automates workflows, and performs tasks that used to require dedicated software subscriptions and the humans operating them. The market's reaction was swift and indiscriminate. Salesforce lost over 25% year to date. Intuit fell more than 34%. ServiceNow cratered from its highs, and even names with no direct exposure to the Anthropic announcement got dragged down. LegalZoom dropped 20% in a single session. Thomson Reuters fell 16%. The London Stock Exchange Group shed 13%.

It's a bloodbath. But it's also overblown.

The theory is not entirely wrong, which is the part that makes this interesting. The market is doing what markets do best: taking a real insight and stretching it to an absurd conclusion. AI will reshape software. It already is. But the idea that vibe coding and AI agents are about to render Salesforce, Microsoft, and ServiceNow obsolete is a fantasy.

What's actually happening is more subtle, more investable, and far more important to understand.

The Repricing
Here's the first thing to recognize: earnings aren't collapsing. This is not a fundamental breakdown. The companies at the center of this selloff continue to report solid revenue growth, strong margins, and healthy cash flows. What's happening is that the market is paying less for those earnings.

When a company trades at 30x forward earnings, the market is making a statement about the durability and growth of those earnings over the coming years. The higher the multiple, the more confidence investors have that revenue streams are predictable, defensible, and growing. Enterprise software has commanded premium multiples for years precisely because of this quality: sticky annual recurring revenue, high switching costs, and deep integration into corporate workflows made these companies look almost bond-like in their predictability.

AI just challenged that assumption. Not the earnings themselves, but the confidence that they'll keep compounding at the same rate, at the same margins, for the same duration. When that confidence wavers, multiples compress. And when multiples compress on companies that were priced for perfection, the price action looks catastrophic even if the underlying business is fine.

Adobe now trades at roughly 14x forward earnings, down from a five-year average near 30x. ServiceNow's forward PE has collapsed to about 25x from a five-year average near 67x. Atlassian dropped to 23x from an average above 100x. Microsoft, the most diversified software company on the planet, trades at roughly 24x forward earnings, its cheapest valuation in three years.

These are not numbers that reflect collapsing businesses. They reflect a market repricing the premium it's willing to pay for growth. And the catalyst for that repricing is a single question: if AI can do the work, how much is the software seat worth?

Seat Compression

This is the concept that spooked the market. "Seat compression" refers to the idea that AI agents can perform the work of multiple human users, meaning companies need fewer software licenses. If one manager using Claude Cowork can handle the output of five junior analysts, the demand for those five seats on Salesforce, ServiceNow, or whatever SaaS platform they were using theoretically drops by 80%.

The math is simple. The implications are enormous. And the market ran with it.

However; seat compression doesn't mean seat elimination. It means the premium these companies can charge per seat comes under pressure. There's a meaningful difference between "Salesforce loses all its customers" and "Salesforce can't justify charging as much over market rate for its product." The first is an existential crisis. The second is a margin headwind that gets priced into the multiple, which is exactly what we're seeing.

Consider how enterprise software actually works in practice. These platforms aren't standalone tools. They're deeply embedded into corporate infrastructure. Salesforce isn't just a CRM. It's the system of record for customer data, pipeline management, and forecasting across entire organizations. Ripping it out and replacing it with an AI agent isn't like switching from one streaming service to another. It requires migrating years of data, retraining teams, rebuilding workflows, and accepting the risk that something breaks in the transition. Companies don't do that lightly.

And here's the part nobody pushing the replacement narrative wants to acknowledge: if you build your own Salesforce, you also have to maintain your own Salesforce. You have to update it, monitor it, debug it when it breaks, secure it against intrusions, and scale it as your company grows. There's no customer support line. There's no team of a thousand engineers iterating on the codebase. It's just you and whatever Claude spits out at 2am when your API calls start failing. For a five-person startup, maybe that tradeoff makes sense. For an enterprise with hundreds of employees and millions in revenue flowing through the platform, the risk calculus looks very different.

Mastercard isn't going to let a data breach happen because someone vibe coded their back end.

So if the replacement thesis doesn't hold, where does the real threat come from? It comes from the gap between what AI can actually build and what the market thinks it can build.

The Vibe Coding Illusion
Let's address the elephant in the room: the claim that AI tools like Claude Code are going to let anyone build enterprise software from their laptop.

There's a kernel of truth here that's been inflated into a fantasy. We can illustrate the reality with a simple framework. Think of coding skill as a spectrum from 0 to 100. What tools like Claude Code have accomplished is genuinely remarkable: they've taken someone with zero coding experience and moved them to a 10 almost instantly. You can sit down, fire up a terminal, and build a simple localhost application in an afternoon with no prior knowledge. That's a real leap. We're speaking from direct experience here, having built full-scale operations using AI coding tools after knowing virtually nothing about software development beforehand.

But here's what nobody in the vibe coding hype cycle wants to talk about: the other 90% of that spectrum is still almost exactly as hard as it always was.

Going from 0 to 10 is easy now. Going from 10 to 25 requires understanding database structure, API security, deployment pipelines, and integration architecture. Going from 25 to 75 demands years of experience with scalable systems, load balancing, compliance, and enterprise-grade reliability. Going from 75 to 100, where you're building something that can actually compete with Salesforce or ServiceNow at scale, is a challenge that AI has barely touched.

There's a fundamental difference between writing a script that analyzes your Excel spreadsheet and building an enterprise application. The market is conflating the two, and it's a costly mistake.

The proof is already visible. Claude has roughly 30 million monthly active users. That's less than 10% of the U.S. population, and it represents the global user base, not just Americans. Out of those 30 million, how many are actually building anything who aren't already professional developers on existing teams? How many electricians are coming home after work and vibe coding enterprise applications? How many accountants? How many middle managers? The honest answer is vanishingly few.

The people pushing the replacement narrative are a deeply unrepresentative sample of the population. They're terminally online, tech-savvy individuals who live on the frontier of every new tool and trend. They sit at their desks and say "Claude Code, let's build something" the way most people say "let's order dinner." That's not normal behavior. It's extraordinary behavior from an extraordinary subset of the population, and extrapolating their experience onto the entire workforce is the same mistake the market made with every adoption curve that looked exponential in the first inning and then flattened.

Think of it like YouTube. When YouTube launched, it gave anyone the ability to become a movie star. Anyone could upload a video, build an audience, and monetize their content. The tools were there. The platform was free. And yet, two decades later, the overwhelming majority of people never uploaded a single video. The barrier wasn't access. It was effort, skill, and the simple fact that most people have neither the inclination nor the temperament to sit in front of a camera and build a media brand.

Vibe coding is the same. The tools exist. The capability is real. But the adoption curve will be far shallower than the hype suggests, because the bottleneck was never access to code. It was the willingness to build, maintain, and iterate on complex systems.

But if vibe coding isn't the threat the market fears, what is? The answer gets less attention, and it cuts in a direction that actually matters.

The Real Threat, and Why It Still Doesn't Kill Software
As vibe coding proliferates, the volume of software being produced will explode. But volume and quality are very different things. Most of what gets built will be, to put it bluntly, garbage. Open source Claude Code bots are already producing masses of low-quality code pushed to GitHub. Hastily built websites, poorly structured apps, and weekend projects with no commercial viability are flooding the ecosystem. The increase in output is real. The increase in economic value is questionable.

The market is pricing in a world where vibe coding produces competitive enterprise software at scale. What it's actually producing, in the vast majority of cases, is noise. Some of that noise will be disruptive. Some small percentage of vibe-coded projects will genuinely challenge incumbents in narrow verticals. But the bulk of it will have the shelf life of a TikTok trend: briefly impressive, quickly forgotten, and ultimately irrelevant to the companies that actually run corporate infrastructure.

The risk that is real, and worth acknowledging honestly, comes from professional developers who are already skilled and are now using AI tools to dramatically increase their output. A senior engineer who understands architecture, security, and scalability can use Claude Code to move ten times faster than before. That developer, working inside a company, absolutely could build an in-house alternative to something they're paying a SaaS provider for. That's the genuine threat to software premiums: not the plumber who comes home and vibe codes a Salesforce competitor, but the existing IT team that decides they can build it themselves and stop writing the check.

Even there, the economics are more nuanced than the narrative allows. Building the tool is one thing. Maintaining it is another. Running it at scale, patching security vulnerabilities, ensuring compliance, onboarding new employees onto a custom system with no documentation: these are ongoing costs that tend to creep up until the "savings" from ditching the SaaS subscription look a lot less compelling. Most companies that run the math end up staying with the vendor. It's the same reason most companies don't build their own payroll system even though they technically could.

So the threat is real but bounded. Software premiums compress. Moats narrow. But the companies don't disappear. Which raises the more important question: where in this selloff has the market made its biggest mistake?

The Moat Spectrum
Not all software companies face the same threat, and the market's indiscriminate selling has created a crucial mispricing. The vulnerability of any given software company depends on two factors: the depth of its integration into customer workflows and the sophistication of its user base. Both matter, and understanding them together creates a much clearer picture of who survives this repricing and who doesn't.

On the higher risk end sit companies whose value proposition is organizing or presenting information that AI can now access directly, or that serve a user base with relatively low technical barriers to switching. Legal research platforms, basic financial data aggregators, and simple workflow automation tools face genuine pressure. When an AI agent can pull case law, summarize filings, or reconcile spreadsheets faster and cheaper than the software designed for those tasks, the value proposition erodes quickly. This explains why LegalZoom, Thomson Reuters, and similar names got hit hardest.

Creative tools face a more nuanced risk. Take Adobe. The popular claim is that vibe coding threatens Adobe, but that misidentifies where the actual vulnerability lies. Nobody is going to vibe code Adobe Premiere. The technical depth of professional video editing, image manipulation, and design workflows creates a genuine moat around the professional tier of Adobe's suite. Adobe's real risk isn't in someone rebuilding their software. It's in AI-generated content: templates, stock imagery, design elements, and creative assets that reduce the volume of work flowing through their tools in the first place. That's a demand compression story, not a replacement story, and it requires a different analytical framework.

Figma is the perfect case study for how moats work based on user sophistication. When Figma launched, the consensus was that it would destroy Adobe in design. Instead, Figma got crushed. Why? Because the user base it targeted, casual and semi-professional designers, faces a low barrier to switching. These users don't have deep institutional lock-in. When a simpler, cheaper alternative like Canva comes along, they migrate without friction. The more technically demanding your product and the more sophisticated your user base, the stickier the relationship. Adobe's professional users need capabilities that no AI tool or simplified competitor can replicate. That's the moat, and it's built on the complexity of the use case, not the brand name on the login screen.

On the lower risk end, two categories stand out. First, infrastructure software: the platforms that sit underneath applications and manage the plumbing of enterprise IT. These are largely invisible to end users and provide the kind of deep, technical integration that AI agents can't easily replicate.

Second, and this is where the bull case gets genuinely compelling: cybersecurity.

This is the rare corner of software where AI disruption is a net positive for the incumbents. Think about what happens if the vibe coding narrative is even partially correct. If more people start building their own software solutions, every one of those applications becomes a new attack surface. Every hastily constructed database, every unprotected API endpoint, every app built by someone who doesn't know the first thing about security architecture becomes a target.

We've seen this firsthand. You can ask Claude if a piece of code is secure. It'll say yes. Then you go through six more prompts and discover a gap that was invisible on the surface. If Claude has blind spots in certain areas of security, and every AI model has blind spots, then every application built on that model shares the same vulnerability. It's a single point of failure at scale. One exploitable weakness in how an AI structures authentication, and millions of vibe-coded apps become simultaneously vulnerable.

Salesforce probably has a thousand people on its cybersecurity payroll, each earning a quarter million dollars a year, whose sole job is making sure the platform stays secure. That's not a cost that a vibe coder replicates. It's not even a cost that a skilled developer at a mid-sized company replicates. And as the surface area for attacks expands with every new AI-built application, the demand for enterprise-grade security solutions only grows.

Palo Alto Networks and CrowdStrike getting sold off alongside companies with genuinely vulnerable business models is one of the most obvious mispricings in this entire selloff. They should be beneficiaries of this trend, not casualties. The market will eventually sort the two groups. But right now, it's throwing the baby out with the bathwater, and that brings us to the biggest blind spot of all.

The CapEx Fortress
There's one more angle to the AI-kills-software narrative that deserves scrutiny, because it actually points in the opposite direction of the consensus fear. If AI truly becomes the dominant force in enterprise productivity, who can afford to compete?

Look at the CapEx numbers. Google is now borrowing money to fund its AI infrastructure spending. Meta, Microsoft, and Amazon are collectively committing hundreds of billions to data centers, compute, and model training. There are not many companies in the entire stock market that are worth $250 billion, let alone able to spend that much on a single line item.

If AI progress demands this kind of investment, the barrier to entry for building a competitive AI platform isn't shrinking. It's becoming insurmountable.

This creates a paradox that the market hasn't fully processed. The same AI that's supposedly destroying software moats is simultaneously building an impenetrable moat around the companies that control the AI infrastructure. Five years from now, the compute advantage these mega-cap companies have accumulated will be so vast that no new entrant can replicate it. The companies getting sold off today because "AI will disrupt them" are, in many cases, the same companies spending the most aggressively to own the AI layer. Microsoft isn't being disrupted by AI. It's the one doing the disrupting, while simultaneously embedding AI into every product it sells.

The idea that some vibe coder in a garage is going to out-compete a company spending $250 billion on AI infrastructure is not a serious thesis. It's a fantasy born from extrapolating the first 10% of the learning curve into the other 90%.

Our Outlook
The broader point is that the market is treating AI as a purely destructive force for software, when the reality is more like a restructuring. Yes, some premiums will compress. Yes, some smaller companies with shallow moats will face genuine existential pressure. But the idea that the entire enterprise software ecosystem is headed for extinction ignores several realities.

AI adoption creates new value even as it disrupts old models. A bootstrapped founder who used to need 20 developers can now build with three. That's a threat to the incumbent's premium, but it's also a value creator that generates entirely new businesses, new revenue streams, and new demand for the platforms those businesses run on. The net effect is not purely destructive. It's transformative, which means there are winners mixed in with the losers.

The gap between AI's potential and its current capability is far wider than the market is pricing. We have not reached AGI. AI cannot yet build, deploy, and maintain enterprise-scale software autonomously. The progress is real, but the extrapolation is running way ahead of reality. Fear of disruption is doing more damage to share prices than actual disruption is doing to revenues. That's the definition of an overreaction.

And the political environment provides a floor that few are discussing. This administration wants markets higher heading into midterms. If the software selloff bleeds into broader indices, there are policy levers available, from tariff moderation to regulatory relief, that could arrest the decline. We're not counting on political intervention, but we're noting that the asymmetry tilts toward stabilization rather than acceleration.

None of this means we should be blindly buying the dip. The multiple compression is real, the growth slowdown at many of these companies might come to fruition, and the increased competition from AI-augmented teams is real. What's not real is the idea that Salesforce, Microsoft, and ServiceNow are going the way of Blockbuster. These companies will adapt. Their multiples will settle at a new, lower equilibrium. And when the dust clears, the survivors will be operating with even wider competitive advantages than before, because the CapEx required to compete will have priced out everyone except the biggest players.