Innovation Unpacked: moats built on features or code are going away. Here’s what I think lasts.
Rob Walling just gave a talk called The Only SaaS Moats Left in 2026. He’s behind MicroConf and TinySeed, and he’s been in SaaS for about 20 years. He wrote the talk with Einar Vollset of Discretion Capital and gave it as a keynote at MicroConf Europe. It’s about 40 minutes, and it’s worth your time.
I build SaaS too. So I didn’t want to just react to his list. I wanted to test it. In this piece I go through his eight moats, say where I agree and where I don’t, and then run my own platform through a moat test. If a moat test can’t be tough on my own product, it isn’t worth much.
Here’s my take up front. Rob gets a lot right. Some of his moats are real. But moats built on features or code are going away, because AI makes copying cheap and fast. What lasts is owning the customer’s job better than anyone, plus a cost floor the old players can’t match.
What Rob actually said
The setup is simple. He lists ten ways AI and the market are attacking SaaS companies. Then he looks at nine classic moats and says only three survive. Then he adds five new ones. That gives him eight.
He also says moats aren’t on or off. He scores them on a dial from zero to ten, and says one or two strong ones is probably enough. I like that. Most moat talks act like you either have one or you don’t.
His big number is that 10 to 20 percent of SaaS companies will decline or go to zero. He calls it a guess himself, and I found no dataset behind it. I think the direction is right. But it’s a guess, so treat it like one.
One more thing to say plainly. Most of his small company examples are TinySeed portfolio companies: ScrapingBee, Gymdesk, a swim league app, Reimbi and Churnkey. Rob says on stage that they’re TinySeed companies. Einar’s firm also advised on the ScrapingBee sale. It doesn’t make his moats wrong. It means his examples come from companies he knows well. That’s also why they’re so detailed.
The ten attacks
Rob splits the attacks into two kinds. Six come from the supply side, meaning what competitors, platforms and tools can now do. Four come from the demand side, meaning what’s happening to your customers.
The supply side ones are familiar. The customer builds just the few parts they use. Competitors reach parity fast; he says he counted 46 AI note takers. Open source gets easy enough for people who don’t code. A bigger platform ships your feature for free. Agencies sell custom builds on SaaS terms. And the AI model itself swallows simple products.
He says customers only need about 3 of your 50 features. That’s his estimate, not usage data. But think about how a customer actually pays you. They pay for a few steps of their job, not your feature list. If you lay out the steps of the job, you’ll usually find most of your features sit outside the steps that matter. Those are the easiest to copy.
The demand side is where I paid the most attention. Customers go out of business. Seats disappear. Zendesk moved to outcome-based pricing for its AI agents in 2024 and expanded it in May 2026. When software does the work, you stop paying per person. The workflow stops mattering. People stop using the software at all.
Those last attacks are different. They don’t ask if a vendor can be copied. They ask if the customer’s job still exists, and who’s doing it. Hold on to that. It comes back later.
What the market did
Rob points to HubSpot. It beat its earnings estimates for the second quarter. The stock still fell 21 percent after hours on August 5 and closed down 19 percent the next day. CNBC called it HubSpot’s worst day on the market in a decade. That same week, Atlassian rose about 35 percent.
Rob’s reading is that Atlassian has moats and HubSpot doesn’t. That’s his view. To be fair, analysts also pointed to HubSpot’s slower customer adds and its guidance, and to short covering at Atlassian. So it’s one strong example, not proof. What I take from it is simpler. Investors are now asking the moat question out loud.
The old moats fade
Rob says only three of the nine classic moats survive. A lot of the old ones were about how hard it was to rebuild your product or move off it: your screens, your workflow, your data. Then he makes the point I think is the center of the whole talk. If agents do the work, nobody cares how nice your screens are. And if AI can pull the data out, the data isn’t a wall anymore.
That’s the part I agree with most. Moats built on features or code are going away. Not because the code is bad, but because copying it is cheap and fast now.
So what’s left? Two things, in my view. First, owning the customer’s job better than anyone. Not the feature. The job: the person doing it, the steps they go through, and where they get stuck. Second, a cost floor the old players can’t match. If you can get the job done for far less, and they can’t follow without breaking their own model, that lasts longer than any feature.
I’ll be honest about my bias. I build SaaS, and a lot of what I’ve built is features and code. So this cuts against me too.
Trust and records
Moat 1: buyers know and trust you. A better product doesn’t get you into the buying conversation. Brand does. Partners who recommend you do. His example is QuickBooks, and it’s the best line in the talk: he says he hates using it but doesn’t care, because his accountant uses it.
He’s right, and he undersold it. He says Xero has been at this for 10 or 12 years. Xero was founded in 2006, so it’s closer to 20. A good product has chased a trusted one for two decades and still trails.
My one add: a recommender moat is only as strong as the recommender’s own job. If AI shrinks what accountants do, that channel shrinks with it. So ask who recommends you, and whether their job is safe.
Moat 2: you’re the system of record. Your product holds the balances, approvals, roles and statuses, and it’s wired into other systems. His examples are Jira and Gymdesk.
I agree, but for a narrower reason. Rob already said AI can pull your data out. So the data isn’t the moat. What holds is the history, the audit trail, and all the steps downstream that break if a customer leaves. There’s a risk too. If agents become the users, the record might survive while the seats don’t. You could still be the system of record and get paid a lot less.
Moat 4: they don’t check your work. After years of being right, customers stop checking. His example is his own payroll company, Gusto. That’s a story, not data. But I think he’s right about why it holds. A rival can match your output fast. It can’t match ten years of being right fast.
In this group, I mostly agree. Trust holds. Records hold, for the history and the downstream steps. A track record holds. None of them are about features.
Act, approve, learn
Moat 3: you’re allowed to act. A tool that moves money, or steps in and does something, beats a tool that only makes a suggestion. This is my favorite of the eight. In my work I split tools into two kinds. A helper gives advice, and a person still does the step. A doer finishes the step. When people leave the loop, helpers lose first.
The risk is that general AI agents are getting the same permission. They can pay, book and click through websites. So the open question is whether you can act in a way a general agent isn’t trusted to.
Moat 5: someone official already said yes. Licenses, certifications and regulations, like SOC 2, HIPAA or carrier registration for text messages. His example is Vanta. But Vanta’s whole business is making compliance faster and easier. So the thing that protects you is also getting cheaper to get. Rob calls SOC 2 and ISO speed bumps himself. Some approvals stay a real wall. Many are getting faster.
Moat 6: everyone’s already in it. If a competitor would have to move a whole group at once, you’re safe. He calls Slack the king of team chat, and this is the one claim I think doesn’t hold. Microsoft Teams reported about 320 million monthly active users in 2023, and outside estimates put Slack far lower. Slack had the network. Teams had the bundle, and the bundle won on reach. That’s Rob’s own attack, a platform shipping your feature for free, beating Rob’s own moat.
The point under it is still real. In his swim league example, parents, coaches and the league all have to switch together. His test question is the right one: who has to agree before you can be replaced?
Moat 7: every customer makes you smarter. He sets three gates. Each customer makes the product better for the others. Customers can take their data but not what you learned. And you keep learning. His example is Stripe Radar, which Stripe says learns from data across millions of businesses.
I agree, with one condition. The second gate has to hold hard. The big AI models already know the public stuff. So your loop only counts when the outcome data is private to you. Did this payment turn out to be fraud? Did this email reach the inbox? Nobody else sees that.
Hard to keep running
Moat 8: your product is hard to keep running. Not hard to build. Hard to keep running, like scrapers or email delivery. His example is Pieter Levels and ScrapingBee. On September 4, Levels posted that he’d tried for weeks to build his own and would keep paying. On September 9, he posted that he’d built his own replacement, which he says works about 90 percent of the time and costs him almost nothing to run.
I’m not pointing this at Rob. He cited the post that was true when he cited it. The point is how fast this market moves. A moat that held on the 4th was gone by the 9th, for one determined customer.
I use a measure I call the Physics Gap. It’s today’s cost of getting a job done, divided by the lowest cost it could be. When that gap is big, someone closes it. For Levels, the gap was huge, so he closed it, and AI made it fast.
To be fair, Levels is an extreme builder, and Rob says so. Most customers won’t do this. And Levels didn’t make the hard part go away. The work of keeping it running moved to him. So hard to keep running is a moat, but a thin one. It holds while the gap stays small. Check it often, not once a year.
The test I think Rob skipped
Look at all eight together. Almost every moat is about defending the vendor: how hard you are to copy, and how hard you are to leave. Only a few of his attacks ask the bigger question. Does the customer’s job still exist, and who’s doing it? A moat around a job that’s going away doesn’t protect much.
So I’d test the job first. Start with the job performer. That’s the person, or now the agent, actually getting the job done. Not the buyer, and not the product. Then lay out the steps of the job. Then ask who does each step in three years.
Getting the job performer right sounds easy. It isn’t. Here’s an example from a client study. A survey was written to learn about moving power from the axle to the road, and it treated the car as the job performer. But a car can’t answer a survey. No single person could answer it either. It took several kinds of engineers.
That was my first clue something was off. The rule is simple. A survey has to be answerable by one person who does the job, or did it recently. If the job performer is wrong, everything built on it aims at the wrong target: the product, the features and the moat. You can have a strong moat around the wrong job.
So the job test has three parts. Who’s the job performer, and will they still be doing it? Are you a helper or the doer? And how big is the gap between what the job costs today and what it could cost?
Testing my own platform
My platform is Venture Proof Studio. Going by its own site, it builds and tests strategy with code, so every step can be checked before you commit. A strategy that misses its thresholds gets blocked before it’s funded. And you leave with a plan for what to test next, instead of a deck. Right now the only way in is through advisory work, by invitation.
Here’s how it does on the eight questions.
Who’s the job performer, and what’s the job? The person who has to decide whether a strategy is worth funding before they commit to it.
Will that job exist in three years? I think yes. AI makes strategies cheaper to write, so there will be more of them. Someone still has to decide which ones get money. That’s my view.
Helper or doer? Partly a doer. The platform blocks a strategy that misses its thresholds. But a person still makes the final call, and in advisory work I read the results with them. A doer at the gate and a helper at the decision.
What could someone rebuild with AI in a few days? The screens, the prompts and most of the features. If my moat were the interface, I’d fail my own test.
The Physics Gap. Writing a plan is cheap now. Finding out it’s wrong after it’s funded is the expensive part. I’m going after that gap by bringing the discovery forward, before the money’s spent. I can’t put a number on it here. It’s my bet.
What can’t a customer take with them? The method behind the platform comes from years of job-first and first-principles work. The code can be copied. Years of practice can’t be copied in a few days. That’s my view.
Who has to agree before you’re replaced? My bet is the course and the community around the method. If people learn and use the method together, replacing the tool means moving a group. That’s a bet, not something I can show yet.
Run it again every quarter.
There’s one more bet: a semantic graph that builds up from every analysis run, a map of what’s been learned across studies. My bet is that over time it makes each new study better. But access is advisory only right now, so it isn’t a working learning loop yet. It only becomes a moat if it passes Rob’s second gate.
So here’s my honest scorecard. Weak: the interface, the prompts and the features. What I think survives: the method, the graph if it works the way I bet, and the people around it. Two of those three are bets. I’ll keep testing them, and if they don’t hold, I’ll change course.
Where I land
Rob gets a lot right. Trust holds. Records hold for the history. A track record holds. Being allowed to act is strong. Learning from private outcomes is strong. Where I push back is on the Slack line, on how long hard to keep running lasts, and on skipping the job.
My take stays the same. Moats built on features or code are going away, because copying is cheap. What lasts is owning the customer’s job better than anyone, and a cost floor the old players can’t match. And check it often, because it can change in days.
If you’d like to run this on your own product, grab the free Moat Test checklist. It’s the eight questions, and the more detailed Moat Test playbook comes in the same download: free Moat Test checklist
If you’d like to work through this with other people, join the Innovation Unpacked Mastermind. And if you’d like help with your own product, book a call.
Sources
Rob Walling and Einar Vollset, “The Only SaaS Moats Left in 2026,” MicroConf Europe keynote by Rob Walling: YouTube
HubSpot after Q2 2026: Investing.com earnings call transcript and CNBC, Aug 7, 2026
Zendesk outcome-based pricing: Zendesk newsroom and Relate 2026
Xero founded 2006: Xero factsheet
Gymdesk growth investment, 2024: Five Elms
Teams users, 2023: No Jitter
Stripe Radar: Stripe
TinySeed and the ScrapingBee sale: TinySeed and Access Newswire
Venture Proof Studio: ventureproof.studio
Book an appointment: Click here
Email me: mike@pjtbd.com
Call me: +1 678-824-2789
Follow me on 𝕏: https://x.com/mikeboysen
Articles - jtbd.one - De-Risk Your Next Big Idea
Website - pjtbd.com
Slaying the Sacred Cows of Innovation
