The market is pricing in a simple narrative: AI can now code, so every SaaS company is toast. Since the start of 2026, SaaS have been crushed as investors rush for the exits.
But here's the thing. Not all software is equally vulnerable.
SaaS is getting crushed!
Some products are glorified CRUD apps that a junior dev could vibe code in a weekend with Cursor.
Others are deeply embedded systems of record, wired into enterprise data and workflows with switching costs that no AI tool is replacing anytime soon.
The market is painting the entire sector with the same brush. That's where opportunity lives.
The real question investors should be asking isn't "will AI disrupt software?" It's which software. What can vibe coding tools like Claude Code and Cursor actually replace today? What's still too complex, too entrenched, or too mission-critical to rip out?
I built a research dossier using Claude Code to systematically answer this.
The idea is this:
Map what no-code AI and vibe coding tools are genuinely good at replacing vs. where they fall short
Identify the lowest-hanging fruit... the software capabilities a firm could realistically internalize or spin up themselves
Triangulate switching costs, network effects, and system-of-record depth to determine which names have real moats
Layer on additional vectors: build cost vs. maintenance cost, per-seat pricing exposure (if agents let 1 person do the work of 5, seat counts compress), and whether incumbents can embed AI defensively to protect their position
The Prompt
We are running this research in Claude Code - this allows us to run parallel agents to scrub our research tasks.
Prompt:
You can find my system prompt for conducting this research report on p.214 of the below full output!
Claude Code spun up multiple sub-agents in parallel to produce a 220 page institutional-grade research report with three detailed appendices.
This is work that would take an equity research team weeks.
Here's what stood out.
The most important finding: the market is wrong about which names are vulnerable.
Our framework scored ~99 public cloud companies across 10 vulnerability dimensions. The result is a clear three-bucket bifurcation:
~25-30% of cloud market cap is structurally impaired (basic BI, contact center, simple PM, sales intelligence)
~40-45% is defensible or an outright AI beneficiary (cybersecurity, data infrastructure, vertical SaaS, ERP, identity)
~25-30% is contested and depends on execution (marketing tech, mid-market CRM, DevTools)
The top 5 most vulnerable names:
The top 5 most defensible:
The insight that surprised me most: "build vs. maintain" is the analytical key to the whole framework.
Everyone is focused on how cheap it is to build a v1 with Cursor or Claude Code. And they're right... build costs are down 80-90%.
But building v1 is only 10-15% of the total 5-year cost of owning software.
The other 85%? Bug fixes, security patching, compliance, on-call, infrastructure, feature iteration. AI has barely dented these costs. So when a company thinks "we'll just vibe code our own Asana," the v1 is free but the maintenance burden at $150-250K/year per engineer can quickly exceed the SaaS subscription it replaced.
This means internalization is only economically rational for simple, narrow-scope, non-critical applications. Complex systems of record? The build-vs-buy math still favors buying.
Per-seat pricing vulnerability is the most underpriced risk in cloud equities right now.
Our analysis identified $45-80B of annual SaaS revenue structurally at risk from seat compression alone.
The Klarna example is instructive: they eliminated 700 customer service agents with AI, which meant their SaaS vendor lost ~$500K in ARR from a customer that never churned. Revenue compression without churn. Traditional churn analysis is blind to this.
The framework also surfaced several compelling pairs trades for investors who want to be hedged:
Long CRWD / Short FIVN → opposite ends of the AI beneficiary/impaired spectrum
Long NOW / Short ASAN → enterprise system of record vs. commodity PM tool
Long VEEV / Short DOMO → regulatory lock-in vs. commoditized analytics
Long DDOG / Short PD → AI-expanding observability TAM vs. AI-automating incident management
Important caveats. This framework has real limitations. If AI capability plateaus, threatened names get more runway. Enterprise adoption could be slower than the Klarna case suggests... procurement inertia and risk aversion are real. And if incumbents like HubSpot or Monday.com execute their AI pivots well, they could retain more value than our scoring implies.
The catalysts to watch: NRR compression at exposed names on upcoming earnings calls, pricing model changes (per-seat → consumption), and CIO survey data on SaaS consolidation intent.
For each one of the names discussed, you can go much deeper too! But this is just my framework of thinking how SaaS shakes up with AI tools being introduced.
(P.S. - This post took a few hours to put together so I'd appreciate if you forward this email to your friends!)
Personal
I just hit 40,000 followers on !
For those wondering "who is Dave Wang" - I wrote about my story and a few fun facts about myself :)