41 | How Software Buyers Evaluate Defensibility in an AI World

Summary

---

The Path to Exit

Episode 41 | How Software Buyers Evaluate Defensibility in an AI World
Host: Mike Lyon (Vista Point Advisors)
Guest: Miles Lacy (Managing Director, Vista Point Advisors)
Date: June 30, 2026

---

Episode Overview

In this episode, host Mike Lyon and guest Miles Lacy delve into a crucial topic for software and AI founders: how modern software buyers and investors assess the defensibility of businesses in an era dominated by rapid AI advancements. The conversation focuses on how the position of a company within the "AI stack" greatly impacts its valuation and attractiveness for M&A (mergers and acquisitions), especially amidst uncertainties brought about by AI-native competitors and new technological shifts.

---

Key Discussion Points & Insights

1. Why Defensibility Matters More Than Ever (00:56–02:32)

• Backdrop: Recent AI developments (“SaaS apocalypse”) have introduced great uncertainty, making buyers prioritize risk management over growth potential.
• Investor Mindset: Shift from seeking high growth to scrutinizing what makes a software platform hard to replace (defensibility).
• Quote:

  "Investors are hyper focused on what makes existing software platforms defensible. They're asking themselves if...AI native upstarts or some of the large frontier models...could replace these solutions altogether."
  — Miles Lacy ([01:18])

2. System of Record vs. System of Action (02:32–03:32)

• Systems of record (SOR)—software that serves as the central source of truth for a business function—have always carried a valuation premium. Now, the distinction between being a SOR and a point solution is pivotal.

• Recent trend: Companies morphing from SOR to “system of action,” but typically SOR status comes first.

  “Before there was always a difference in valuation and interest level, but now it's starting to determine what deals can and can't get done.”
  — Mike Lyon ([02:32])

3. What is a System of Record? (03:32–05:06)

• Definition: The single, canonical source for a critical business function. Other systems depend on the information it houses.

• Examples:

  • Salesforce (customer/sales data),
  • Workday (HR),
  • QuickBooks/NetSuite (finance),
  • Vertical: EHR systems in healthcare (holds patient data, billing, compliance info).

• Defensibility factors: Heavily regulated industries and “human-in-the-loop” requirements increase defensibility.

  “Not only because it checks all those boxes...but really because from a product...it will never be disintermediated by AI native solutions because it just requires there being a human in the loop.”
  — Miles Lacy ([04:19])

  “If the software got turned off, what would a customer lose?...that would be catastrophic for a company.”
  — Mike Lyon ([05:06])

4. The Software Hierarchy: Most to Least Defensible (06:01–08:10)

• Most Defensible:

  • SORs with proprietary data, especially in regulated industries (e.g., EHR for healthcare).

• Mid-Tier:

  • Verticalized ERP-like platforms deeply tied into a workflow and integrating with SORs.

• Least Defensible:

  • Thin wrappers, BI dashboards, analytics point solutions, and horizontal tools (e.g., simple mail merges)—these face the highest risk from “frontier” AI models.

  “The key there is having it be verticalized...creates a bit of a moat or differentiation versus a larger horizontal player or one of the frontier [AI] models.”
  — Miles Lacy ([07:11])

5. Due Diligence: How Buyers Really Evaluate Positioning (08:10–10:45)

• Metrics:
  • Gross, logo, and net retention. High retention supports defensibility claims. The bar has risen; even retention in the mid-80s draws scrutiny.
• Key Questions Buyers Ask:
  • Could an AI-native startup realistically replicate your solution quickly (18–24 months)?
  • Who “wins the race” in five years—incumbent SaaS or new AI-native solutions?
  • Frequency and centrality of product use in customers’ workflows.
  • Has the product faced attempted cannibalization by general-purpose AI models?
• Quote:

  “You can claim to be a deeply entrenched system of record, but if you have gross revenue retention in the...high-70s or below, I think most buyers would be skeptical at that claim.”
  — Miles Lacy ([08:31])

6. Sellers’ vs. Buyers’ Perception of AI Risk (10:45–11:58)

• Disconnect:
  • Sellers often focus on current strength and no immediate AI impact; buyers are more concerned with long-term exposure and compounding risk.
• Buyers’ Perspective:
  • “Uncertainty multiplies over time.”
  • Strategic acquirers and PE firms evaluate risk across longer timeframes (3–15+ years).
• Quote:

  “Uncertainty multiplies and it's a big disconnect we're seeing right now because in general, most of the private software companies are doing pretty well.”
  — Mike Lyon ([10:45])

7. What If You’re Not a System of Record? (11:58–14:13)

• Reality:
  • Most companies aren’t SORs—focus should be on maximizing customer value and integrating AI to bolster utility.
• Tactics:
  • Leverage agentic AI to save customers time and increase efficiency.
  • Payments integration can drive stickiness, especially in SMB software.
  • Refactor existing SaaS products to make AI central to the value proposition; it's “table stakes” now.
• Quote:

  “It's not the case that if you've built a software business for the past 10 years that it cannot be AI native...AI has now become table stakes.”
  — Miles Lacy ([13:20])

8. Final Takeaways (14:13–14:53)

• Clear bifurcation in valuations based on where a business sits in the AI value stack.
• Founders with a credible, defensible position command premiums; those in gray areas face discounts—regardless of their current growth rates.
• Advice:
  • Assess and proactively strengthen your company’s defensive moats.
  • Seek expert guidance if unsure about your position—conversation early is key.

---

Notable Quotes and Memorable Moments

• Miles Lacy:

  “It will never be disintermediated by AI native solutions because it just requires there being a human in the loop.” ([04:19])

• Mike Lyon:

  “If the software got turned off, what would a customer lose?...that would be catastrophic for a company.” ([05:06])

• Miles Lacy:

  “So, focusing on how you can ultimately deliver that [value], especially with a lot of the new AI solutions that are coming out...that's where we're encouraging folks to spend a lot of their time.” ([12:36])

• Mike Lyon:

  “This bifurcation is real and we feel like it's widening. Founders who understand where they sit and can credibly demonstrate it are positioned to...capture a premium, while those who can't really at risk of...facing a discount almost regardless of growth rate.” ([14:13])

---

Timestamps for Key Segments

• 00:56–02:32: Why system of record status is now a make-or-break factor
• 03:32–05:06: Defining system of record with vertical examples
• 06:01–08:10: Hierarchy of software defensibility—from SORs to point solutions
• 08:10–10:45: What buyers look at in due diligence—metrics and strategic questions
• 10:45–11:58: The buyer/seller disconnect around AI impacts and risk timelines
• 11:58–14:13: Strategies for non-SOR SaaS founders to improve defensibility and stickiness

---

Conclusion

This episode provides a practical, field-level guide for software founders who want to understand how defensibility in an AI-driven world directly impacts valuation and M&A success. The core advice is clear: know where your product sits in the software stack, make AI central to your roadmap, and aim for the kinds of business functions that are hardest to replace or automate. Above all, be ready to demonstrate your defensibility in a market where buyers value it more than ever before.

---

Transcript

[Podcast Host]

Welcome to the Path to Exit, a podcast to help software and Internet founders understand the process to raise capital or sell their business.

[Mike Lyon]

Hello and welcome everyone. I'm Mike Lyon, Founder and Managing Director at VistaPoint Advisors and this is the Path to Exit. This show is dedicated to helping founders of software, AI and Internet businesses understand what it takes to raise capital or sell their business and how to do it well. My guest today is Miles Lacy, managing director of VistaPoint Advisors. A few episodes ago we covered the so called SaaS apocalypse and how AI is reshaping what makes a good software business. Today we're going deeper on where your software sits in the AI stack and why that position now drives valuation more than almost anything else. Please enjoy my discussion with Miles. Miles, welcome back to the podcast.

[Miles Lacy]

Thanks. Happy to be here.

[Mike Lyon]

We talked a few episodes ago about being a system of record. Why are buyers so fixated on this right now?

[Miles Lacy]

So if you cast your mind back to late January or early February, the SaaS apocalypse was precipitated really by the launch of Claude code agents. And at that point in time, buyers and largely the investment community, both in public and private equity found themselves frankly a really concerned, concerned for their existing portfolio and what this meant for the future of software development. That type of uncertainty and really any uncertainty in the market investors hate. And so they immediately went to a defensive posture, right? Looking at software through the lens of a defensive moat as opposed to one of growth and gaining market share. Now that's changed a little bit in recent months, but I think still writ large, investors are hyper focused on what makes existing software platforms defensible. They're asking themselves if it's in 18 months or maybe if it's at the end of their hold period in four to five years, will there be AI native upstarts or will some of the large frontier models frankly just replace these solutions altogether? And you're seeing that more so with point solutions and horizontal solutions, which we'll get into a little bit later. But it's really coming from a place of uncertainty concern from the investment community. And so they're hyper focused on understanding what is a system of recording. And that's largely been identified as probably the most defensible posture you can then build on top of for existing SaaS businesses.

[Mike Lyon]

And I think it's worth mentioning that this concept was always around. It just wasn't as front and center like investors were always thinking about businesses that were a system of record. Typically they had higher retention rates and they traded at higher multiples because of being a System of record as opposed to being a point solution. And now what we're seeing with newer businesses or businesses who are changing is they're morphing from system of record to system of action. But you kind of have to be the system of record to be the system of action. So I think this has always been there. But the investors and buyers frankly are starting to draw a line at that point between being a system of record and just being a point solution. There's a hard line there. Before there was always a difference in valuation and interest level, but now it's starting to determine what deals can and can't get done. So Miles, maybe talk a little bit more about what is a system of record and how are true system of records performing in a current deal process maybe versus something that looks a bit more like a point solution. Like how do those deal processes seem

[Miles Lacy]

different right now to think about it simply and then I'm happy to dive into some examples. But a true system of record is the single source of truth for a specific business function. It is almost this canonical record most of your other software pulls from or a lot of your business functions rely on. The obvious example is Salesforce for customer and sales data, Workday for HR and employee records, or a QuickBooks or NetSuite for financials. Those are some of the large horizontal examples. But within vertical software there's a ton of specific use cases. So a good example of a current client of ours, it is an EHR software business really focused on the medical space for a lot of in home care and patient care. So it houses all patient data, billing data, Medicaid reimbursement and it's a highly regulated environment. This is a business that's been around for over 10 years, but we're seeing substantial interest from investors. Not only because it checks all those boxes we talked about in the last episode from a KPI point of view and having great gross and logo retention, but really because from a product from the end market that it serves, it will never be disintermediated by AI native solutions because it just requires there being a human in the loop. And it's not something that any of these care providers would care to either try to vibe code themselves or even could replace with a frontier model like Claude or OpenAI.

[Mike Lyon]

Yeah, I think a really good definition and an example and one way to think about it is if the software got turned off, what would a customer lose? In the example Miles just described, that would be catastrophic for a company, right? If they turned that off, they couldn't bill, they couldn't get reimbursements. There's all kinds of regulatory stuff also. They don't really want to mess around with that. Right. It's so important they want something that they know that works. They're going to be less likely to turn on some AI upstart business versus there's some other types of things that would be used in that operation they would be willing to try. So I think that's a good way to look at it. What would a customer lose if they turn this software off? Or maybe more importantly, if it wasn't perfect. Right. If it was vibe coded and worked okay, but not great, be catastrophic for that business. As you think about different tiers of software providers, talk us through how you think about that and who's the most defensible and maybe who's the most exposed as we go down this kind of hierarchy of software businesses.

[Miles Lacy]

Yeah, so I think at the top you have systems of record with proprietary data and ideally those will also be in highly regulated industries, so ones where you need a human in the loop at some point and you cannot just rely on fully automated agentic solutions. And so to go back to a couple examples we referenced, if you want to have an AI SDR or BDR send emails on your behalf, it's relatively low risk. Right. From a compliance point of view. Now if you wanted to have AI treat patients in a medical environment, that's highly problematic. And so I think that kind of regulated layer only enhances the defensibility for anything that's already a system of record. So it's almost tier 1A and 1A be there. And then if you go a tier below and you look at the middle, there's this category of verticalized software that's more or less an ERP for a particular category. So think of like construction software, things that help you build clients, manage your projects, generate proposals. So something that has a really deep workflow element to it and is integrated into multiple other systems, like for instance, your systems of record like financials or QuickBooks. That's a really strong middle category. And the key there is having it be verticalized. So having specific enough nuances to the product that it creates a bit of a motor differentiation versus a either larger horizontal player in the software space or one of the frontier models which I think increasingly we're seeing creep into what is the lowest or sort of bottom tier, which is thin wrappers, BI dashboards, analytics point solutions, and particularly those things that serve more horizontal industries, like think of email automation Software or mail merge software. A lot of those things are starting to be replaced by the frontier models themselves. So I think those are pretty much the three tiers with a fair amount of nuance in between.

[Mike Lyon]

And anytime there's a big change in the market, there's this cat and mouse game, right, where the sellers are trying to look like the new thing that's valuable, right, because they want to get a high valuation and the buyers are trying to figure out what the business actually is. Maybe talk through a little bit. What are the kind of diligence buyers are doing to figure out where a software company really sits? What kind of questions are they asking? What are they looking at?

[Miles Lacy]

The first is just the numbers of it. All Right, so what are your gross logo and net retention metrics? You can claim to be a deeply entrenched system of record, but if you have gross revenue retention in the mid-70s or high-70s or below, I think most buyers would be skeptical at that claim.

[Mike Lyon]

Or even 80s these days, right? Like we were even seeing a lot of pushback on gross retentions in the mid-80s.

[Miles Lacy]

Yeah, absolutely. The bar has been lifted there. So I think that's the first hurdle you have to pass. And then the next question every buyer and investor is asking themselves is, okay, could an AI native startup replicate this solution in 1824 months? And some are even thinking about, okay, five years from now. If you were to start a race between an entrenched SaaS business or an incumbent SaaS business and an AI native startup, who would ultimately win in the next five years? And can we innovate quickly enough? So those are some of the questions. How often are customers engaging with your product? This is a bit of a double edged sword and the reason largely has to do with agentic solutions. And the way that folks are integrating a lot of agentic features into their existing products means you as the user can spend less time in the platform than you otherwise would pre AI. So there's a bit of nuance to that one. But broadly speaking, the frequency of which your customers are engaging with your product matters a lot. Is the solution at the center of a specific workflow or is it at the very edge or the final end result? So if you think about any given task, are you using this solution to get you 80% of the way there or is it only the final 20%? And how can you ultimately own more of that workflow over time? I think lastly, and this is pretty uncommon, but back in February and even March timeframe was a much bigger concern. But have Customers tried to replace your solution with a general purpose or frontier AI model and what would happen if they tried to do that? Once again, that's a concern that is always in the back of investors minds and I think will be continuing as we go forward, but certainly less so than I think people were fearing four or five months ago.

[Mike Lyon]

Absolutely. And one thing to keep in mind with this kind of diligence point is the sellers, the founders tend to think about what's going on right now with their business. So you might hear a lot of we're not seeing any impact from AI. Our revenue growth is still strong. That's true. But from a buyer's perspective, remember that uncertainty multiplies over time. So while a founder is thinking about what's going on now with his business or maybe the next year, if you're a strategic buyer, in theory, you own this thing forever. Right. Or certainly for a really long period of time. So they're thinking about how this plays out over the next 5, 10, 15 years. If you're a private equity firm who's going to do a recap and their hold time is three to five years, they're worried about what does this story look like three to five years from now when they're trying to sell the business. So this uncertainty multiplies and it's a big disconnect we're seeing right now because in general, most of the private software companies are doing pretty well. Well, they're not seeing big impacts, but it's this multiplication of the risk that is really getting in the way in terms of how buyers and sellers see valuations differently right now. So what if you're not a clear system of record? Are you just out of luck or what should you focus on if you don't fit neatly in that system of record or system of action category?

[Miles Lacy]

Yeah, I think. And this has been true for a long time. Right. So most businesses just won't be the system of record for their customers that is usually held by one to three or four different software products. That much hasn't changed in terms of the number of software vendors that are or are not a system of record. What you should ultimately focus on is where are you driving the most value for your customers and are you able to still deliver value, particularly by leveraging agentic AI? So anything you can do to reduce the hours spent on individual tasks for your customers is going to be hugely valuable, whether or not you are the system of record. And so focusing on how you can ultimately deliver that, especially with a lot of the new AI solutions that are coming out and that are easily integrated into existing software. That's where we're encouraging folks to spend a lot of their time. And then this is maybe a more nuanced case, although you see it quite a bit within the SMB category, which are payments integration. So are you able to integrate some type of payment processing or billing features and functionality into your product? Because that ultimately makes it very sticky as well, is when your customer relies on you for collecting revenue and just continuing to innovate. It's not the case that if you've built a software business for the past 10 years that it cannot be AI native. And I think one of the things that we're betting on here at VistaPoint is over the next 6, 12, 18 months seeing a lot of existing SaaS vendors refactor and reconfigure their product to have AI really be a centerpiece of it and more core to the solution that they're delivering. And so it's never too late. But certainly AI has now become table stakes. And so if you think about a competitor that's starting today, AI is going to be core to the platform and core to the product of what they do. To the point of if you were to disable AI solutions from that product, it would probably become useless. It's more about getting with the times than it is a extinction event like the term saaspocalypse obviously references. So there's plenty that you can do, but above all focus on how you can continue to drive value for your customers. And just think of AI as another tool in the toolkit.

[Mike Lyon]

Absolutely. Today on the show we talked about where different businesses sit in the AI value stack, why that position drives valuation and what founders can do to assess and kind of strengthen their position. This bifurcation is real and we feel like it's widening. Founders who understand where they sit and can credibly demonstrate it are positioned to kind of help capture a premium, while those who can't really at risk of kind of facing a discount almost regardless of growth rate. If you're not sure where your business lands, that's a good conversation to have early. Feel free to reach out to us via email. You can find all of our contact info on our team [e-mail] and we're happy to walk you through it at any time. Miles, thanks for joining us again.

[Miles Lacy]

Absolutely. Anytime.

[Podcast Host]

VistaPoint Advisors is a founder focused investment bank that advises software and Internet founders through M and A and capital raised transactions. We are a fully unconflicted investment bank who only works for founders on the sell side, so you know that we're always representing your best interest. Security is offered through VistaPoint Advisors member FINRA SIPC. This has been provided for informational purposes only. It is not intended to address all circumstances that might arise. Testimonials from past clients may not be representative of the experience of other clients, and there is no guarantee of future performance or success. Clients are not compensated for their comments. If you have any questions about the process of selling your business or raising capital, reach out to a member of our team or check out the four Founder Sections section of our site by visiting four Founders Guide.