Your Features Won't Save You: The Eight Moats That Still Work in the Age of AI by Rob Walling

AI won't kill all SaaS, but it's a bigger threat than most founders think. Rob estimates 10–20% of SaaS companies will decline or go to zero. Your features no longer protect you the way they used to. The businesses that last will be the ones with defenses that are hard to copy, even when code is nearly free to write.

How AI attacks SaaS

Rob outlines 10 threats in two buckets.

Supply side (more competition, lower prices):

• Customers build their own version. They don't need your 50 features, just the 3 they use.
• Competitors reach feature parity in months instead of years.
• Open source projects move faster, and non-technical buyers can now deploy them.
• The platforms you integrate with build your feature themselves.
• Agencies sell fully custom software at SaaS-like monthly prices.
• AI models absorb your product's core job outright.

Demand side (fewer or weaker customers):

• Your customers' industries get disrupted, and they go out of business.
• Seats shrink as AI agents replace human users.
• The work your software manages stops mattering.
• Humans stop using your software at all. If you don't add an agent layer, someone else will.

Which classic moats are fading

Unique features, clever code, UX familiarity, integrations and high switching costs are all weaker now. AI can copy features, write integrations from your API docs, and even pull data out of apps that have no export. Owned traffic channels like SEO are uncertain. What still holds up: being a system of record, having multiple people coordinating in your product, and brand.

The eight moats that still work

1. Buyers know and trust you. You have a strong brand, partners and champions who recommend you. Example: accountants keep QuickBooks entrenched no matter what competitors build.
2. You're the system of record. Daily operations, workflows and data run through you. Examples: Jira, GymDesk.
3. You're allowed to act. You do the thing, like moving money, instead of just recommending it. Examples: Stripe Connect, Reimbi, Churnkey.
4. Customers don't check your work. Your output is trusted after years of being right. Examples: Gusto, Avalara.
5. Someone official already said yes. You hold licenses, certifications or regulatory approvals that a newcomer would have to earn. Examples: SOC 2, HIPAA, board-approved credentialing, SMS compliance.
6. Everyone's already in the software. Switching means a whole team or community has to move at once. Examples: Slack, Commit Swimming.
7. Every customer makes the product better. You have a learning loop that improves results for everyone, and customers can't take it with them when they leave. Examples: Stripe Radar, Ramp, Mailchimp's spam detection.
8. It's hard to keep running. The ongoing operational burden is the moat. Examples: ScrapingBee, Cloudflare, email deliverability at Drip.

These aren't on/off switches. Think of each as a 0–100 scale you can work your way up.

Why this matters even if you never plan to sell

Private equity and strategic buyers now care less about how you're doing today and more about whether you'll still be around in 3–5 years. Public markets show the same thing. In earnings reported days apart, HubSpot beat expectations and dropped 21%, while Atlassian, whose moats are stronger, jumped 35%. Moats protect your valuation, and they also protect your business.

Questions to ask about your own business

• Who has built their career or business around recommending you?
• Are you the system of record, or just a view of the data?
• Do you take action, or only advise?
• Do customers trust your output enough not to check it?
• What approvals do you hold that a newcomer would have to wait for?
• Who would have to agree in order to replace you?
• Does one customer's experience make the product better for everyone?
• What do you maintain that you resent maintaining? (That might be your moat.)

Takeaway: If you already have one or two of these moats, you're in a strong spot. Figure out which ones you have, pick the next one to work toward, and your business becomes more defensible and more valuable.

Make sure to watch Part 2, How to Unfuck Your SaaS by Einar Vollset. Rob's talk is about defense. Einar's is about offense: once you know where you're exposed, how do you fight back?