Visualização de leitura

The triple squeeze: Why the SaaSpocalypse story you’re hearing is missing the most dangerous part

In early February 2026, nearly $285 billion in market value evaporated from software and related sectors in 48 hours. Atlassian dropped 36% for the month. The iShares Software ETF fell more than 30% from its September 2025 highs. Traders called it the “SaaSpocalypse.”

The popular narrative goes like this. AI coding tools have gotten so good that customers can build their own software, so why pay for a SaaS subscription when an engineer can vibe-code a replacement over a weekend?

That’s the least interesting version of what’s happening. The real story involves three forces converging on SaaS simultaneously, creating a structural trap that puts hundreds of thousands of white-collar jobs at risk. The force that will decide their fate isn’t AI. It’s a spreadsheet in a private equity office.

Force #1: AI isn’t replacing your product. It’s replacing the problem your product solves

Most enterprises won’t rebuild their tech stack with vibe coding, because that’s not how large organizations work. The bigger threat is that AI agents are making entire workflow categories obsolete. Take a SaaS ticketing product. The threat isn’t a competing ticketing system built in-house, it’s that customers are deploying AI agents to handle support directly, rethinking the pipeline from scratch. The old system isn’t replaced by a better one. It’s replaced by a fundamentally different approach to the job.

Satya Nadella telegraphed this on the BG2 podcast in December 2024, saying business applications would “probably collapse” in the agent era because they’re “CRUD databases with a bunch of business logic.” “All the logic will be in the AI tier.”

The data backs him up. Gartner forecasts worldwide AI spending will hit $2.5T in 2026, up 44% YoY, while overall IT budgets grew ~10%. That money is coming from other budgets. Average SaaS apps per company dropped 18% between 2022 and 2024 (BetterCloud). Among large enterprises, 82% are actively reducing vendor count (NPI Financial). Even companies not directly losing customers face fewer new purchases, slower expansions and harder renewals, because buyers are looking somewhere else.

Force #2: The $440 billion leverage trap

Between 2015 and 2025, private equity acquired more than 1,900 software companies in deals worth over $440 billion. The thesis was elegant. Sticky recurring revenue, high margins, predictable cash flows and high switching costs, all perfect for leveraged buyouts. It worked brilliantly for a decade. Then it stopped.

  • The setup (2020-2022). Public SaaS traded at a median 18x revenue in 2021 (Asana touched 89x). PE paid premium multiples with enormous debt. Anaplan went to Thoma Bravo for $10.4B. Coupa sold for $8B with $4.5-5B in leverage. Zendesk went private for $10.2B backed by ~$5B in private credit.
  • The collapse. By late 2025, the median public SaaS revenue multiple had fallen to 5.1x, over 70% below peak. Private software M&A multiples dropped below 3x in 2024.

Here’s the math. A PE firm buys a $100M-revenue SaaS company in 2021 at 8x ($800M), financing 40% with floating-rate debt, a $320M loan at SOFR plus 500 bps. The initial rate runs 5-6%. After Fed hikes, about 10%, or $32M annual interest. Then the multiple collapses. Even if revenue grows to $120M, at 2-3x the business is worth $240-360M. The loan is $320M. Equity sits somewhere between negative and barely positive.

This isn’t hypothetical. Wells Fargo now uses “keys handover” for cases where PE hands underwater portfolio companies to lenders. A record $25B of software leveraged loans trade below 80 cents on the dollar. Total tech distressed debt sits near $46.9B. Apollo cut its software exposure nearly in half during 2025.

When equity is underwater, PE has two choices. Walk away or shift into margin-maximization mode by cutting headcount, consolidating and extracting cash.

Force #3: AI is the cost-cutting weapon PE has been waiting for

Here’s the cruel irony. AI is killing revenue, the debt still needs servicing and AI is also the most powerful cost-cutting tool ever handed to a PE operating partner.

Most SaaS employees are white-collar knowledge workers, including engineers, PMs, marketers, CS, sales, support and analysts. Precisely where AI is making fastest inroads. Anthropic’s research found AI-exposed workers earn 47% more on average and are nearly 4x as likely to hold a graduate degree. Stanford Digital Economy Lab and Dallas Fed research shows employment among 22-25-year-olds in AI-exposed roles fell 13-16% between late 2022 and mid-2025, nearly 20% among young software developers.

Wall Street has picked its side. When Atlassian announced 1,600 layoffs (10% of workforce) to fund AI investment, the stock rose. When Block cut 4,000 jobs and Jack Dorsey said, “a significantly smaller team, using the tools we’re building, can do more and do it better,” the stock surged over 20%.

PE is moving too. Anthropic is reportedly in talks with Blackstone, Hellman & Friedman and Permira on a JV to embed Claude across portfolio companies. OpenAI is in parallel talks with Advent, Bain, Brookfield and TPG. Blackstone alone manages $1.3T+ across manufacturing, healthcare, real estate and financial services. Many licenses those companies cancel will belong to SaaS firms in other PE portfolios. As CNBC put it, “Private equity built the SaaS installed base. It may also be the one that rips it out.”

The loop closes. AI slows revenue, valuation collapses, debt becomes unsustainable and PE uses AI to cut headcount to service it. That’s the Triple Squeeze.

So, what can you actually do?

  • Assess exposure across three dimensions. First, your company. Is it PE-owned, and what vintage? Deals done at peak 2021-2022 valuations with heavy leverage are most precarious, and PitchBook or Crunchbase will tell you. Second, your role. Cost center or revenue engine? When growth stalls, PE defaults to margin maximization, and G&A, parts of marketing, internal tools and legacy product teams are vulnerable. Third, AI itself. How automatable is your day-to-day? If your core workflow is routing information, synthesizing documents or managing processes, the timeline is shorter than you think.
  • Supersize your T-shape. AI’s Achilles’ heel is scarce context. It doesn’t know your customers, your industry or why that one integration keeps breaking. Widen across adjacent roles while deepening your core with AI. Engineers can learn PM, UX and AI-assisted QA. Marketers can automate operational work with agents and build AI creative pipelines. Become an AI multiplier, someone who directs these tools with cross-functional judgment they can’t generate alone. If your employer isn’t giving you enough exposure, don’t wait. Vibe-code a side project. Pressure-test a financial model against your usual approach.
  • Build reputation while you still have a platform. Write publicly, contribute to communities, ship open source. Individual brand is a hedge against rising company-level risk, and far easier to build while employed than while competing with thousands of displaced workers.
  • If exposure is real, move early and deliberately. A wave of PE-backed SaaS layoffs would flood the market with experienced workers chasing a shrinking pool of roles. Those who fare best move while they can still be selective. But “move” doesn’t mean jumping to the first company with AI in its pitch deck. Apply the same structural thinking. Look for durable revenue, a real plan for AI-native competition, and profitability or a credible path.

The bottom line

The SaaSpocalypse narrative everyone’s debating, whether AI coding will kill SaaS, is a sideshow. The real story is financial, structural and already in motion.

Private equity spent a decade and $440 billion buying up software on a thesis that just broke. The debt doesn’t care about AI timelines or market sentiment. It comes due regardless. The only variable PE can control now is cost, and AI just made that variable dramatically easier to cut.

If you work in this industry, especially at a PE-backed company, it’s time for clear-eyed assessment of your exposure before the math makes the decision for you.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Why SaaS companies must become octopuses to survive AI

Sixty-six million years ago, an asteroid wiped out 75% of species on Earth. Octopuses survived, however, because of their ability to radically adapt their biology in hours, not eons. Today, SaaS companies face their own asteroid: AI. And the octopus points the way to survival.

We see the signs in the firms that are thriving today. When Upwork Senior Vice President Dave Bottoms rebuilt the company’s AI stack, he made a counterintuitive choice. Rather than optimizing for today’s best model, he architected for disposability.

“What we think is the best model today may not be the best model tomorrow,” Bottoms explains. His team built an “optionality layer” that lets them swap AI models like changing batteries.

As Bottoms recognized, AI is evolving faster than SaaS architectural cycles, and rigid AI implementations are becoming legacy systems the moment they ship.

Design for your customers’ jobs, not your technology

The fatal mistake many SaaS companies make with AI is starting with what the technology can do rather than what customers need it to do. Aarthi Ramamurthy, chief product officer at CommerceHub (now Rithum), begins differently. “I start with empathy,” she says. “I know what the retail ecosystem goes through and all the complexity in it.”

That empathy led CommerceHub to focus AI on a deceptively simple problem: supplier onboarding. When one company calls a sweater pink and another calls it fuchsia, manual matching creates friction.

But Ramamurthy’s team didn’t just throw AI at the problem. They mapped the specific “Jobs to Be Done”—such as getting suppliers connected faster with fewer errors—and then selected the right AI approach, starting with simple algorithmic matching before layering in machine learning for demand prediction.

Contrast this with an all-too-typical approach: We’ve got LLMs, let’s find somewhere to use them. Sushma Kittali-Weidner, former chief product officer at Rheaply, frequently sees this mistake. She explains: “People are looking for magic but not thinking enough about how AI can create efficiencies in existing processes.”

Enable octopus organizations

The most valuable thing SaaS companies can do with AI is enabled by the technology, but much bigger: Helping customers distribute intelligence and authority throughout their organizations. Allow them to be like the octopus, which has two-thirds of its neural tissue outside its central brain. Octopus organizations move faster and more responsively because decisions get made closer to the frontline.

SaaS company Movable Ink’s Da Vinci platform demonstrates this enablement. CEO Vivek Sharma built a system to mass-send hyper-tailored emails by combining vision models, generative AI, insight engines and prediction algorithms.

The platform pushes sophisticated personalization decisions to frontline marketers who previously needed executive approval for campaign variations. The system determines what stories are delivered to customers, which imagery and creative are used, and when, how often and where to deliver them.

This is authority devolution at scale. Each marketer becomes vastly more capable, teaming with AI to make thousands of micro-decisions that would have been impossible under traditional hierarchies. Movable Ink’s customers can now generate hundreds of thousands of email variations where they once created one.

Within one of the world’s largest commerce networks, CommerceHub’s 2.4 billion daily transactions create similar distributed intelligence, pushing supplier matching and inventory decisions to procurement teams. CommerceHub’s AI mines poorly structured data and surfaces patterns that enable frontline employees to act without escalation.

In short, winning SaaS products help customers become octopus organizations—distributed, adaptive and intelligent at every edge.

Break your own silos

The uncomfortable truth is that most SaaS companies can’t help customers become octopuses because they’re not octopuses themselves.

The octopus has a “neural necklace,” a ring of nerve bundles that connects all its arms, enabling instant information sharing among them without involving the central brain. But SaaS companies frequently have broken connections. Just look at customer success and product teams.

Customer success teams hear about where products fail, where workflows create friction and where latent needs go unmet. Product teams have usage telemetry and performance data. When this information flows freely between teams, you create extraordinary sensing capability. But typically, these teams have separate reporting lines. They exchange sanitized summaries while critical signals vanish.

CommerceHub’s Ramamurthy addressed this by starting AI deployment on internal insights dashboards before adding it to external features. This created shared understanding across functions. When customer success, product and engineering teams access the same AI-generated insights about customer behavior, they develop a common language and aligned priorities.

Build for continuous transformation

The octopus can reconfigure its RNA in hours, adjusting biological processes faster than evolution allows. This is how it’s survived for 300 million years without external defenses. SaaS companies need to adapt at a similar speed because AI capabilities shift weekly.

Kittali-Weidner experienced this. Her team at Rheaply was resource-constrained and couldn’t afford over-engineering, so they designed modular AI implementations that could evolve without massive refactoring. The research and prototyping process that once took weeks now happens in real-time co-creation sessions. That’s a true competitive advantage.

On-demand adaptation demands a new team composition. You need engineers who embrace disposable code, product managers who ship features knowing they’ll be replaced in months, and executives willing to deprecate yesterday’s breakthroughs for tomorrow’s improvements.

Design for the 80/20 rule

SaaS companies stumble by automating too little, leaving AI as a novelty or automating too much, triggering resistance. At Upwork, Bottoms has learned that “80% of the work can be automated, but the last 20% still requires human judgment.” Upwork’s AI, for example, generates job posts and proposals, but humans make the hiring decisions.

Similarly, Movable Ink succeeds by making AI suggestions initially optional and editable. Users see value while maintaining control. Only after establishing trust does the system shift toward AI-as-default.

Adapt for the future

The octopus teaches us that survival belongs to the adaptable.

Externally, your product must help customers become octopus organizations: Distributing intelligence, devolving authority and adapting rapidly. Internally, you must become an octopus yourself: Connecting information across silos, building for continuous transformation and balancing autonomy with coordination.

The AI asteroid is already here. Become an octopus and thrive.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

エージェンティックAIはエンタープライズソフトウェア市場をどう変えるか——6つの視点

MicrosoftのCEO Satya Nadella氏がエージェンティックAI時代に従来のビジネスアプリケーションは「崩壊する」と予測し、物議を醸した。2月初めにAnthropicが「Microsoft Copilot」に対抗する「Claude Cowark」をリリースしたところ、米国のソフトウェア株が大幅に下落した。SaaSの終焉は本当なのか、それとも過剰反応なのか。

1, 既存大手が当面は優位を維持する

業界見通し:既存の市場リーダーは当分の間、プラットフォームにエージェントを組み込むことでシェアを維持する可能性が高い。

Forresterのアナリスト Kate Leggett氏は次のように語る。「コアアプリケーションがすぐになくなることはない。ワークロードがAIエージェントに完全に移行するには、数十年かかる可能性がある」。業界コンサルタントのWilliam Flaiz氏も「CRMシステムを丸ごと入れ替えようという経営判断はまだ起きていない」と指摘する。CIOは既存への多額の投資を無駄にしたくないからこそ、今あるプラットフォームにエージェンティックAIを追加して価値を引き出そうとしている。

Technology Business Review(TBRI)のシニアアナリスト Alex Demeule氏も同様の意見だ。「大企業においては、エージェンティックシステムへの自律性の委譲リスクはまだ現実的ではない」と同氏、「株価が示す混乱の大きさとは裏腹に、既存の大手ベンダーは5〜10年のスパンで見ると、AIの時代への転換において有利なポジションにある」との見解を示した。

2, 価格モデルは根本から変わる

業界見通し:サブスクリプション型から消費量・成果ベースの価格モデルへの大きな転換が起きる。

Interarbor SolutionsのプリンシパルアナリストDana Gardner氏は、「中短期的な懸念は既存システムの入れ替えよりも、現在のベンダーの価格支配力の終焉だ」と言う。AIエージェントがビジネスアプリケーションの利用パターンを把握できるようになれば、CIOはその知見を活かしてより有利な契約条件を交渉できるようになる。

Bain & Coのレポートは「エージェントが人間のタスクを代替するなら、顧客はログイン数ではなく成果に対して支払うことを望む」と記す。IntercomやSalesforceなどはすでにこの方向に動いている。IDCの予測では2028年までに純粋なシート数ベースの価格設定は時代遅れになり、ソフトウェアベンダーの70%が消費量や成果を軸にした新しい価格モデルに移行するという。

3, ソフトウェアプラットフォームの融合と新たな競争

業界見通し:AIエージェントはデータの所在を選ばないため、CRMとERPなど従来のカテゴリーの境界が曖昧になる。

AIエージェントが効果を発揮するには、データがどこにあってもアクセスできる必要がある。SaaSベンダーはCRM、ERP、ITサービス管理などのカテゴリーの垣根を取り払う方向に動いている。Oracle、Microsoft、SAP、SalesforceはそれぞれAI統合プラットフォームの構築を進めており、ServiceNowはエージェンティックAIプラットフォームベンダーのMoveworksを買収し、CRM分野でSalesforceに挑んでいる。

4, 勝者と敗者——汎用ツールは苦戦、専門特化型は有利

業界見通し:汎用的なポイント製品は淘汰されやすく、深い業種特化型ツールは生き残りやすい。

Leggett氏はエンタープライズソフトウェア市場を3つに分類する。ワークフロー、スプレッドシート、軽量なプロジェクト管理ツールなどシンプルなポイント製品は「比較的早期に消えていく」という。差別化要素が少なく、複製しやすいからだ。一方、医療記録管理のEpicやCerner、製薬・ライフサイエンスのIQVIA、建設のProcoreなど深い業種特化型アプリは、専門知識と周辺システムとの統合によって守られている。大手CRMプレーヤーは自社データの囲い込み、業種別ナレッジ、パートナーネットワーク、規制対応の専門知識などで優位を持つ。

Demeule氏は「既存の大手ベンダーがここまで生き残ってきたのは、オンプレミスからクラウドへ、永続ライセンスからサブスクリプションへと、変曲点ごとにうまく転換できたからだ」と指摘する。

5, バイブコーディングが一部セグメントを揺るがす

業界見通し:バイブコーディングにより、エンドユーザーが独自のエージェントを構築できるようになり、SaaS市場の一部が揺らぐ。

バイブコーディング(自然言語のプロンプトをもとにAIエージェントがソフトウェアを書く手法)は、ローコード・ノーコードの動きをさらに一歩進める。従来のCRMやERPプラットフォームの枠の外で、エンドユーザーが生産性ツールを構築できるようになる。

Leggett氏はバイブコーディングを「本物の脅威」と見る。「煩雑で複雑すぎると感じているエンドユーザーが多い従来型エンタープライズソフトウェアを迂回して、生産性を高める可能性がある」。

ただし技術的に成熟していない組織には、ミッションクリティカルなワークフローに影響するエージェントを自力で構築・展開するスキルが不足していたり、リスクが高いと感じるかもしれない。

このようなことから、Demeule氏は「バイブコーディングで脅かされるのは単機能の小さなツールだ。顧客データベースやサプライチェーン全体を管理するような基幹システムは別の話だ」と言う。

6, エージェンティックなオーケストレーション層が生まれる

業界見通し:従来のSaaSアプリケーションは存続するが、エージェンティックなオーケストレーション層の裏側に隠れる形になる。

未来のユーザーインターフェースは従来のSaaSプラットフォームではなく、エージェンティックなものになる——アナリストたちはこの点で一致している。ただしCRMやERPがなくなるわけではなく、見えなくなるだけだ。

IDCのアナリストBo Lykkegaard氏は「SaaSモデルの弱点は複雑さだ。各SaaSアプリケーションは独自の学習曲線とUIを持ち、しばしば散発的かつ非効率に使われる。AIはこれに対する解決策を提供する。複数のダッシュボードを行き来する代わりに、システムをまたいでタスクをこなす会話型エージェントとやり取りできる。AIが新しいインターフェース層となり、複雑さを抽象化し、反復プロセスを自動化する」と言う。

Demeule氏は、効率性やコスト、エネルギー使用などを考慮しながら、LLM、SLM、RPAツールにタスクを割り振るオーケストレーションエージェントの登場を想定している。

今後数年間の焦点は、CIOがこの機能を既存のプロバイダーから調達するのか、OpenAI、Anthropic、Palantir、UiPathといった新興プレーヤーから調達するのか、という問いになりそうだ。

SaaS의 진화 방향 제시한 어도비… “핵심은 에이전트와 데이터”

AI 에이전트의 등장으로 소비자 참여 방식이 근본적으로 변화하면서, 서비스형 소프트웨어(SaaS) 기업들은 전략 재검토에 나서고 있다. 크리에이티브 플랫폼 기업 어도비는 이에 대응해 ‘고객 경험 오케스트레이션(CXO)’이라는 새로운 접근 방식으로 전환하고 있다.

어도비는 자체 컨퍼런스인 ‘어도비 서밋’에서 ‘어도비 CX 엔터프라이즈’ 제품군을 공개하며, 단순 소프트웨어가 아닌 에이전트 중심으로 정의되는 미래로의 전환을 선언했다. 이 과정에서 SaaS 기업은 축적된 도메인 전문성과 퍼스트 및 서드파티 데이터 자산을 기반으로 경쟁력을 확보할 수 있다는 점을 강조했다.

이 플랫폼은 맞춤형 및 즉시 활용 가능한 AI 에이전트, MCP(Model Context Protocol) 엔드포인트, 그리고 어도비의 오케스트레이션 엔진 기반 신규 인텔리전스 시스템을 통합한 것이 특징이다.

어도비의 부사장 선딥 파르사는 “SaaS는 지금 변화하고 있으며, 우리는 SaaS의 재구상과 재정의 과정에 참여하기 위해 아키텍처를 재설계하고 있다”고 밝혔다.

‘코치’의 지휘 아래 실행되는 에이전트

어도비 CX 엔터프라이즈는 ‘어도비 익스피리언스 플랫폼(AEP) 에이전트 오케스트레이터’를 기반으로 구축됐다. 이 기술은 AI 에이전트를 어도비 애플리케이션에 직접 통합한 것이 특징이다. 2025년 출시된 AEP는 현재 연간 1조 건 이상의 고객 경험을 처리하고 있다.

AEP는 여전히 CX 엔터프라이즈의 핵심 축으로 작동한다. 기업은 이를 통해 재사용 가능한 ‘에이전트 스킬’을 정의할 수 있으며, 특정 목적에 맞춘 맞춤형 에이전트도 구축할 수 있다. 또한 앤트로픽의 클로드, 오픈AI의 챗GPT, 구글의 제미나이, 마이크로소프트(MS)의 코파일럿, 엔비디아의 네모클로(NemoClaw) 등 다양한 AI 기술 스택과 연동이 가능하다. 개발자들은 모델 컨텍스트 프로토콜(MCP) 서버를 포함해 맞춤형 활용 사례 구축에 필요한 인프라도 활용할 수 있다.

어도비의 부사장 선딥 파르사는 “애플리케이션이 UI 레이어에 갇히지 않도록 하고, MCP 호출이나 A2A 계층을 통해 조합 가능한 서비스로 제공할 것”이라며 “고객은 기존 자산을 활용해 자신만의 프로세스를 구축하고, 자체 UI를 구현할 수 있다”고 설명했다.

파르사는 고객 선택권의 중요성도 강조했다. 현재 많은 기업이 자체 구축(build)과 외부 도입(buy) 사이에서 고민하고 있으며, 일부는 맞춤형 UI를 직접 개발하려는 반면 다른 기업은 이에 관심이 없다는 설명이다.

CX 엔터프라이즈를 활용하면 기업은 사전 정의된 에이전트 스킬을 기반으로 맞춤형 워크플로우를 구성할 수 있다. 또한 업무 최적화(작업 조율 및 자동화)나 브랜드 거버넌스(정책 준수, 권한 관리, 자산 권리 추적) 등 특정 기능에 특화된 에이전트도 바로 활용할 수 있다.

여기에 더해, 향후 몇 달 내 출시될 ‘어도비 CX 엔터프라이즈 코워커’는 설정된 목표를 기반으로 여러 에이전트를 조율하며 다단계 작업을 수행하는 역할을 맡는다.

예를 들어 마케팅팀이 다음 분기 구독률을 3% 높이는 목표를 설정하면, 코워커는 관련 고객군을 식별하고 성과 인사이트를 도출한 뒤 전략 수립, 이메일 문구 작성, 비주얼 자산 제작까지 지원한다. 이후 사람이 이를 승인하면 캠페인 실행과 성과 모니터링까지 이어진다.

파르사는 “기존 에이전트는 고객군을 생성한 뒤 ‘잠드는’ 방식이었다”며 “새로운 CX 엔터프라이즈 코워커는 항상 작동하는 상태로, 지속적인 메모리를 기반으로 수주에서 분기 단위까지 워크플로우를 운영할 수 있다”고 설명했다.

이어 “코워커는 미식축구 쿼터백처럼 현장에서 플레이를 지휘하는 역할을 하며, 마케터나 브랜드 담당자가 코치 역할을 맡는다”고 비유했다.

파르사는 “고객 경험 오케스트레이션이라는 방향성에 더욱 집중하고 있다”고 강조했다.

1대1 개인화로의 전환

어도비는 에이전트 기반 도구와 함께 두 가지 새로운 인텔리전스 시스템도 공개했다. ‘어도비 브랜드 인텔리전스’와 ‘어도비 인게이지먼트 인텔리전스’다.

브랜드 인텔리전스는 시각-언어 이해 능력을 갖춘 미세 조정 대형언어모델(LLM)을 기반으로 한다. 주석, 피드백 반복 과정, 폐기된 자산 등 정성적이고 미묘한 데이터를 학습해 브랜드 맥락을 이해하는 것이 특징이다.

어도비의 부사장 선딥 파르사는 “브랜드 인텔리전스는 단순 CSS 스타일 가이드를 정리한 ‘브랜드 키트’보다 훨씬 복잡한 문제를 다룬다”며 “데이터 상호작용 신호와 실제 기업 자산을 바탕으로 브랜드 감성을 이해하기 시작한다”고 설명했다.

어도비 인게이지먼트 인텔리전스는 타깃 고객에게 가장 적합한 제안이나 메시지, 다음 행동을 결정하는 데 도움을 준다. 클릭률이나 전환율이 아닌, 고객의 전체 생애주기 상호작용 데이터를 기반으로 한다는 점이 특징이다.

파르사는 “과거에는 ‘적을수록 좋다’는 접근이 통했지만, 이제는 ‘많을수록 좋다’는 환경으로 바뀌고 있다”며 “생성형 AI의 핵심 가치는 더 많은 콘텐츠를 경제적으로 생산할 수 있다는 데 있다”고 말했다. 이어 “단순히 양을 늘리는 것이 아니라, 1대1 개인화에 가까운 정밀 타깃 캠페인을 구현하는 것이 중요하다”고 덧붙였다.

초기 생산성 향상 효과도 크다는 평가다. 파르사는 “문제 해결과 초기 이상 탐지에 걸리는 시간이 기존 수일에서 수주 단위가 아닌, 몇 시간 수준으로 단축됐다”고 강조했다.

SaaS 기업의 데이터 경쟁력

에이전트 중심 환경에서 사용자 단위 과금 모델의 영향력이 약해지는 가운데, 어도비는 데이터 경쟁력을 핵심 차별화 요소로 내세우고 있다.

파르사는 “지난 수년간 2만 개 이상의 기업이 어도비 플랫폼 위에 시스템을 구축해왔다”며 “이를 통해 방대한 데이터와 도메인 전문성이 축적됐다”고 설명했다.

이어 “생성형 AI와 AI 에이전트는 전 세계 지식 체계를 이해하고 유용한 기능을 만드는 데 강점을 갖고 있다”면서도 “하지만 기업 내부 데이터는 폐쇄된 ‘월드 가든’ 구조에 있어 접근이 제한된다”고 지적했다.

또한 기업 환경은 매우 복잡하고, 여러 애플리케이션에 분산돼 있다는 점도 문제로 꼽았다. 파르사는 “업무 방식은 문서로 정리되기도 하지만, 일부는 조직 내부의 암묵지에 의존한다”며 “독립적으로 작동하는 AI 에이전트는 이런 맥락을 이해하지 못해 기업 환경에서 쉽게 한계에 부딪힌다”고 말했다.

이어 “어도비는 자사 애플리케이션 내부에 존재하는 기업 맥락을 AI 계층으로 연결하는 역할을 한다”며 “고객이 AI 플랫폼에서 이를 처음부터 다시 구축하는 것보다 훨씬 빠르게 구현할 수 있다”고 강조했다.

마지막으로 파르사는 “AI 시대에 고객 참여 방식이 급격히 변화하는 만큼, 어도비도 이에 맞춰 지속적으로 적응하고 있다”며 “무엇보다 중요한 것은 ‘개방성’”이라고 밝혔다.

그는 “기술 파트너 및 다른 SaaS 기업과 협력해 유연성을 유지하고, 고객이 있는 환경에 맞춰 서비스를 제공할 것”이라고 덧붙였다.
dl-ciokorea@foundryco.com

Adobe bets on agentic AI to rewrite SaaS for customer experience

Consumer engagement has been fundamentally changing with the advent of AI agents, forcing a rethink by software-as-a-service (SaaS) companies, and creativity platform provider Adobe is responding by shifting its approach to what it calls ‘Customer Experience Orchestration (CXO).’

Announced today at Adobe Summit, the new Adobe CX Enterprise suite is a pivot to a future defined by agents rather than by software alone, where SaaS companies claim an advantage based on their deep domain expertise and troves of first and third-party data.

The platform brings together customizable and out-of-the-box AI agents, Model Context Protocol (MCP) endpoints, and new intelligence systems built on Adobe’s orchestration engine.

“SaaS is changing, and we are re-architecting so that we can participate in the reimagination, the redefinition of SaaS,” said Adobe VP Sundeep Parsa.

[ More Adobe Summit 2026 coverage ]

Agents executing with guidance from a ‘coach’

Adobe CX Enterprise builds on the company’s Adobe Experience Platform (AEP) Agent Orchestrator, which brought AI agents directly into Adobe apps. Released in 2025, AEP now  powers more 1 trillion experiences annually, according to the company.

AEP remains the “anchor” for Adobe CX Enterprise, which now gives customers the ability to create agent skills (reusable instructions), as well as providing specialized and customizable agents. These can be incorporated into any AI tech stack, including Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini, Microsoft Copilot, Nvidia’s NemoClaw, and others. Developers also have access to Model Context Protocol (MCP) servers and other infrastructure required to build customized use cases.

“We’re going to make sure our applications are not trapped inside our UI layer, that they become composable services available through MCP tool calls or the A2A layer,” Parsa explained. “Customers can tap into what they have and bring that into their own unique processes, be their own UI.”

He emphasized the importance of customer choice. Many enterprises are still grappling with the ‘build or buy’ question; some will prefer to create their own bespoke user interface (UI) layer, while others will have no interest in doing so.

With CX Enterprise, enterprises can use pre-loaded agent skills to build custom workflows, or can launch agents pre-built for specific tasks like workflow optimization (coordinating tasks or automating handoffs) and brand governance (enforcing policies, managing permissions, tracking asset rights). And, a new Adobe CX Enterprise Coworker, to be available in the coming months, will act on specified goals and orchestrate other agents to perform multi-step actions.

For instance, if a marketing team is looking to increase loyalty subscriptions by 3% in the next quarter, the CX Enterprise Coworker will work with other agents to identify relevant audience segments, surface performance insights, create a plan, and develop email copy or visual assets, Parsa noted. Once all this is approved by a human, the Coworker will then help execute the campaign and monitor results.

Whereas previously agents would build an audience, then “go to sleep,” Adobe’s new CX Enterprise Coworker is “always on,” has persistent memory, and can run workflows across weeks, or even full financial quarters if required, Parsa explained. He likened the CX Enterprise Coworker to an American football quarterback, the player who directs the activities on the field, guided by a coach on the sidelines. Coworker’s coach is a marketer or a brand specialist.

“We’re doubling down on this framing of customer experience orchestration,” Parsa says.

Moving to one-on-one personalization

Along with these agentic tools, Adobe is introducing two new intelligence systems: Adobe Brand Intelligence and Adobe Engagement Intelligence.

Brand Intelligence is built on a fine-tuned large language model (LLM) with vision-language capabilities that learns from “qualitative and nuanced inputs” like annotations, feedback cycles, or rejected assets.

“Brand intelligence is going after a much harder problem than ‘a brand kit,’ which is a codification of a CSS style guide,” Parsa explained. The LLM can begin to understand brand sentiment, informed by “data engagement signals and the actual enterprise assets.”

Adobe Engagement Intelligence helps teams decide next best offers, messages, or other actions for targeted customers. This is based on their lifetime interactions, rather than click-throughs or conversions, according to Parsa.

Whereas previously, less was more, “in this world, more is better,” he said, pointing out that the promise of generative AI is producing more material economically. “It’s not creating more for more’s sake, it’s targeted campaigns that get you much closer to one-on-one personalization.”

Early production gains are “massive,” Parsa claimed. This is because troubleshooting and early detection of problems now takes “hours, not days and weeks.”

SaaS companies’ data advantage

Like many SaaS companies grappling with an agent-driven future where pay-per-seat models are becoming less relevant, Adobe is emphasizing its data advantage. Parsa pointed out that more than 20,000 enterprises have built on Adobe’s platform over the years, giving the company enormous amounts of data alongside domain expertise.

Generative AI and AI agents do a good job of understanding the “corpus of world knowledge” and building some “useful capabilities for all of us,” Parsa acknowledged. “But these technologies stop at the enterprise walls, because those are ‘walled gardens.’”

Further, enterprise context is very complicated and spread across numerous applications, he noted. “It’s codified in documents; in some cases just tribal knowledge informs how people function on a day to day basis.” AI agents working on their own (like OpenClaw or Claude Cowork) break in the enterprise because they are “brittle” and not grounded in enterprise data, he said.

“We are a proxy for all of the enterprise context that lives inside our applications,” said Parsa. “We’re going to bring that into the AI layer much faster than a customer restarting that whole process with an AI platform.”

Ultimately, he said, Adobe is “adapting and adjusting” to customer feedback and consumer interaction with brands, as well as with the internet itself, as customer engagement undergoes a dramatic shift in the era of AI. As this unfolds, Parsa emphasized the importance of “open, open, open.”

“We absolutely are going to work with tech partners, we’re going to work with other SaaS companies to make sure that we stay flexible and meet the customer where they are,” he said.

We Need a Shared Responsibility Model for AI

Over the past 6-8 months, researchers at my company discovered vulnerabilities across multiple AI tools that allowed external bad actors to steal data, exploit AI browsers, or poison the core memories of AI systems. As we responsibly disclosed these flaws, we found that AI vendors almost universally told us, “It’s not our problem.” In their..

The post We Need a Shared Responsibility Model for AI appeared first on Security Boulevard.

AI isn’t killing SaaS — it’s exposing which platforms matter

The emergence of powerful AI models has fueled a growing narrative that traditional software companies are on the verge of collapse in a disastrous  “SaaSpocalypse.” But treating all SaaS businesses as commoditized code bases ignores the reality that many platforms run the workflows, transactions and networks that entire industries depend on.

Investors should start evaluating application software companies through a different lens — or risk mispricing and walking away from some of the most durable assets in enterprise technology.

The conclusion that AI will broadly eliminate SaaS misunderstands how most application software actually works, particularly vertical software focused on specific industries and business models.

The value of many vertical platforms does not lie in the code itself, but in the operational systems they facilitate within the complex ecosystems of various industries. These workflows include payments flowing between suppliers and distributors, compliance processes embedded in regulated industries and logistics networks connecting millions of businesses in a marketplace.

These platforms often sit at the center of the day-to-day operations of entire companies, organizing the set of daily tasks for their employees and enabling management oversight over global footprints.

Part of the confusion within the market narrative about the destruction of software stems from timing. The technology industry is currently experiencing two overlapping shifts.

First, many industries are normalizing after stimulus-driven boom years, when software companies enjoyed extraordinary growth and traded at valuations that extrapolated COVID-era growth rates as if they would occur indefinitely. But as interest rates rose and enterprise technology budgets tightened, growth slowed and valuations compressed across the sector.

The second shift was separate and wrongly conflated with the valuation drop. The rapid emergence of generative AI tools that can accelerate software development and automate certain knowledge tasks led some investors to conclude AI’s emergence caused the SaaS growth slowdown.

The most vocal AGI maximalists indeed think that software will become infinitely replicable and each company will develop its own tools to utilize internally. But the fact that the biggest AI cheerleaders think it (or wish it) doesn’t make it so.

Many industries’ primary vertical software platforms do not simply provide standalone features. Instead, they act as the platforms that coordinate the activities of thousands of participants across a complex network, both external buyers and sellers and internal employees within organizations.

Put simply, vertical software platforms organize how businesses operate. Without them, entire essential industries like retail, supply chain and energy would devolve into chaos. The requirement of industry verticals to synchronize the actions of various constituents makes the AGI-eats-SaaS vision for the future — millions of unique, non-interoperable company-developed software platforms — hard to grasp.

The challenge of reliably integrating and synchronizing divergent software systems has been the core inhibitor to growing vertical software applications over the past 20 years. Lowering the cost of coding does not make this process any easier or replace existing providers.

While AI can produce working code for any type of software, it certainly will be challenged to replicate decades of proprietary real-world integration that vertical platforms have built.

That said, AI certainly represents a compelling opportunity to expand the value of existing vertical software applications. For example, when AI agents eventually begin transacting on behalf of businesses, they will still need to operate through an existing digital substrate—and in most industries, that substrate will be the vertical platform already in place.

Artificial intelligence will undoubtedly reshape parts of the software landscape. AI may weaken some traditional pricing models. Many SaaS companies historically priced their products based on the number of users or seats within a customer organization, and as automation reduces headcount, those seat-based models may come under pressure.

That doesn’t necessarily imply shrinking software revenue or margins. Particularly as AI gains autonomy, pricing structures will likely move toward usage, transactions or outcomes. Revenue models will be based on the value those systems deliver, as many already do.

Investors previously viewed software as a high-growth, high-multiple business model that could generate venture-style returns. But as the industry matures, the next phase will reward investors with a different mindset—one focused on operational improvement, disciplined capital allocation and long-term platform building.

Investors and companies experienced in consolidating fragmented industries should be well-positioned to pursue this kind of strategy. By integrating complementary software assets into broader vertical platforms, growing both scale and profits is possible.

That makes AI more of an enabling technology than an engine of disruption for the right kind of vertical SaaS platform. The opportunity for investors lies in recognizing the difference between fragile software tools and durable industry infrastructure.

Rather than signaling the end of the sector, the current moment may represent the beginning of a new phase in which disciplined companies and investors can acquire and consolidate durable SaaS businesses while the market is distracted by the idea of a SaaSpocalypse.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The real cost of manual access — and why CIOs are paying attention

In my nearly two decades as an identity practitioner — including leading identity programs at global financial institutions and serving as a CISO — I’ve seen a recurring pattern that quietly erodes enterprise velocity. I call it “Monday morning friction.”

The symptoms often look mundane, but they are systemically expensive:

  • The project stall: A cloud migration pauses while an engineer waits days for approval on a single resource.
  • The executive “dark” period: A newly hired leader spends their first week unable to access the very dashboards they were hired to oversee.
  • The security workaround: A developer uses a shared credential because the formal request process is too slow for the current sprint.

In large enterprises, these moments are often dismissed as routine IT friction. In practice, they are signals of manual access governance quietly slowing the pace of the business.

When I sat in the CISO chair, the pressure was binary: Keep the organization secure without becoming the “Office of No.” What has become increasingly clear in boardroom conversations is that manual access governance is no longer just a security concern. It has evolved into a persistent source of operational friction that slows the very transformation CIOs are tasked with accelerating.

The productivity tax of the “I don’t know” loop

The most significant hidden cost in governance isn’t software — it is lost time.

Research from Lakeside Software’s 2024 IT Leaders Report shows that employees lose nearly an hour each week to IT-related friction, with access delays and technical hurdles among the primary contributors. In a 10,000-employee enterprise, that translates into hundreds of thousands of productive hours annually spent waiting, escalating or troubleshooting.

This creates what I’ve seen repeatedly: The “copy-paste” model of onboarding. A new employee is told to replicate the access of someone else in a similar role. Over time, those inherited permissions accumulate. What begins as expedience becomes structural privilege creep.

The SaaS paradox: Modern tools, manual workflows

Most enterprises no longer rely on spreadsheets for governance. They use sophisticated identity governance and administration (IGA) platforms. Yet the presence of modern interfaces has not eliminated manual intervention.

Today’s “manual trap” is less visible. It’s the human-in-the-loop model that requires managers to interpret cryptic entitlements and click “approve” on decisions they may not fully understand.

Even in organizations with advanced identity tooling, automation frequently stops halfway. HR systems, identity directories, provisioning engines and application logs may each function well in isolation — but the human often becomes the integration layer between them. That integration work carries a cost. Every escalation pulls focus from higher-value work and pulls the CIO further away from digital acceleration goals.

Governance as a spend signal

Increasingly, CIOs are asking a broader question: Can identity governance help manage SaaS sprawl?

Identity data holds a powerful, underused signal. Authentication frequency and inactivity patterns reveal where access no longer aligns with usage. When viewed through an operational lens, identity governance becomes a shadow IT discovery tool.

For CIOs managing margin pressure and platform rationalization, this reframes identity from a cost center to a potential efficiency lever. If an identity platform can flag that a significant portion of a SaaS tier is unused because the governance signal shows zero logins in 90 days, it moves from a security checkbox to a procurement asset.

Approval fatigue and governance debt

Manual governance often creates the illusion of control. A manager clicking “approve” feels like oversight. In practice, high-volume approval queues create approval fatigue.

When access requests arrive described in dense shorthand — such as FIN-PRD-DB-USR-RW — most managers lack the time or context to dissect each entitlement. Over time, approvals become reflexive. This is where governance debt accumulates.

Like technical debt, governance debt is the byproduct of incremental shortcuts. The interest on that debt is paid not only in risk, but in downtime, rework and fragmented visibility.

The scaling problem: AI and machine identities

Manual governance models were designed for a workforce of humans. That denominator is changing. In cloud-forward environments, non-human identities — such as service accounts, bots and AI agents — already outnumber human users. These identities are created and modified at the speed of code.

A governance model that depends on manual review does not scale for AI. As CIOs invest in automated workflows and autonomous agents, identity governance increasingly needs to transition from a human-centric process to a higher-velocity automated control plane.

Identity as an operational control system

The friction surrounding access governance is often framed as a security trade-off: Safety versus speed. In practice, the issue is fragmentation.

When identity operates in isolation, organizations rely on people to bridge the gaps. Human coordination becomes the control plane. That is expensive, slow and prone to error.

Viewed through this lens, identity governance is an operational control system that influences onboarding speed, engineering throughput and workforce productivity. CIOs who recognize its role in shaping workflow velocity and cost transparency gain a competitive edge. Governance does not have to function as an emergency brake; it can become part of the engine.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

B2B Authentication Provider Comparison: Features, Pricing & SSO Support (2026)

This comprehensive guide compares the leading B2B authentication providers in 2026, including Auth0, Okta, SSOJet, MojoAuth, FusionAuth, and Keycloak.

The article explores enterprise SSO, SCIM provisioning, pricing models, developer experience, and authentication protocols such as SAML, OAuth, and OpenID Connect. It also includes feature comparisons, real-world SaaS use cases, pricing analysis, and future identity trends like passkeys and zero-trust security.

The post B2B Authentication Provider Comparison: Features, Pricing & SSO Support (2026) appeared first on Security Boulevard.

Vulnerability disclosure on SSL for SaaS v1 (Managed CNAME)

Earlier this year, a group of external researchers identified and reported a vulnerability in Cloudflare’s SSL for SaaS v1 (Managed CNAME) product offering through Cloudflare’s bug bounty program. We officially deprecated SSL for SaaS v1 in 2021; however, some customers received extensions for extenuating circumstances that prevented them from migrating to SSL for SaaS v2 (Cloudflare for SaaS). We have continually worked with the remaining customers to migrate them onto Cloudflare for SaaS over the past four years and have successfully migrated the vast majority of these customers. For most of our customers, there is no action required; for the very small number of SaaS v1 customers, we will be actively working to help migrate you to SSL for SaaS v2 (Cloudflare for SaaS).

Background on SSL for SaaS v1 at Cloudflare

Back in 2017, Cloudflare announced SSL for SaaS, a product that allows SaaS providers to extend the benefits of Cloudflare security and performance to their end customers. Using a “Managed CNAME” configuration, providers could bring their customer’s domain onto Cloudflare. In the first version of SSL for SaaS (v1), the traffic for Custom Hostnames is proxied to the origin based on the IP addresses assigned to the zone. In this Managed CNAME configuration, the end customers simply pointed their domains to the SaaS provider origin using a CNAME record. The customer’s origin would then be configured to accept traffic from these hostnames. 

What are the security concerns with v1 (Managed CNAME)?

While SSL for SaaS v1 enabled broad adoption of Cloudflare for end customer domains, its architecture introduced a subtle but important security risk – one that motivated us to build Cloudflare for SaaS. 

As adoption scaled, so did our understanding of the security and operational limitations of SSL for SaaS v1. The architecture depended on IP-based routing and didn’t verify domain ownership before proxying traffic. That meant that any custom hostname pointed to the correct IP could be served through Cloudflare — even if ownership hadn’t been proven. While this produced the desired functionality, this design introduced risks and created friction when customers needed to make changes without downtime. 

A malicious CF user aware of another customer's Managed CNAME (via social engineering or publicly available info), could abuse the way SSL for SaaS v1 handles host header redirects through DNS manipulation and Man-in-The-Middle attack because of the way Cloudflare serves the valid TLS certificate for the Managed CNAME.

For regular connections to Cloudflare, the certificate served by Cloudflare is determined by the SNI provided by the client in the TLS handshake, while the zone configuration applied to a request is determined based on the host-header of the HTTP request.

In contrast, SSL for SaaS v1/Managed CNAME setups work differently. The certificate served by Cloudflare is still based on the TLS SNI, but the zone configuration is determined solely based on the specific Cloudflare anycast IP address the client connected to.

For example, let’s assume that 192.0.2.1 is the anycast IP address assigned to a SaaS provider. All connections to this IP address will be routed to the SaaS provider's origin server, irrespective of the host-header in the HTTP request. This means that for the following request:

$ curl --connect-to ::192.0.2.1 https://www.cloudflare.com

The certificate served by Cloudflare will be valid for www.cloudflare.com, but the request will not be sent to the origin server of www.cloudflare.com. It will instead be sent to the origin server of the SaaS provider assigned to the 192.0.2.1 IP address.

While the likelihood of exploiting this vulnerability is low and requires multiple complex conditions to be met, the vulnerability can be paired with other issues and potentially exploit other Cloudflare customers if:

  1. The adversary is able to perform DNS poisoning on the target domain to change the IP address that the end-user connects to when visiting the target domain

  2. The adversary is able to place a malicious payload on the Managed CNAME customer’s website, or discovers an existing cross-site scripting vulnerability on the website

Mitigation: A Phased Transition

To address these challenges, we launched SSL for SaaS v2 (Cloudflare for SaaS) and deprecated SSL for SaaS v1 in 2021. Cloudflare for SaaS transitioned away from IP-based routing towards a verified custom hostname model. Now, custom hostnames must pass a hostname verification step alongside SSL certificate validation to proxy to the customer origin. This improves security by limiting origin access to authorized hostnames and reduces downtime through hostname pre-validation, which allows customers to verify ownership before traffic is proxied through Cloudflare.

When Cloudflare for SaaS became generally available, we began a careful and deliberate deprecation of the original architecture. Starting in March 2021, we notified all v1 users of the then upcoming sunset in favor of v2 in September 2021 with instructions to migrate. Although we officially deprecated Managed CNAME, some customers were granted exceptions and various zones remained on SSL for SaaS v1. Cloudflare was notified this year through our Bug Bounty program that an external researcher had identified the SSL for SaaS v1 vulnerabilities in the midst of our continued efforts to migrate all customers.

The majority of customers have successfully migrated to the modern v2 setup. For those few that require more time to migrate, we've implemented compensating controls to limit the potential scope and reach of this issue for the remaining v1 users. Specifically:

  • This feature is unavailable for new customer accounts, and new zones within existing customer accounts, to configure via the UI or API

  • Cloudflare actively maintains an allowlist of zones & customers that currently use the v1 service

We have also implemented WAF custom rules configurations for the remaining customers such that any requests targeting an unauthorized destination will be caught and blocked in their L7 firewall.

The architectural improvement of Cloudflare for SaaS not only closes the gap between certificate and routing validation but also ensures that only verified and authorized domains are routed to their respective origins—effectively eliminating this class of vulnerability.

Next steps

There is no action necessary for Cloudflare customers, with the exception of remaining SSL for SaaS v1 customers, with whom we are actively working to help migrate. While we move to the final phases of sunsetting v1, Cloudflare for SaaS is now the standard across our platform, and all current and future deployments will use this secure, validated model by default.

Conclusion

As always, thank you to the external researchers for responsibly disclosing this vulnerability. We encourage all of our Cloudflare community to submit any identified vulnerabilities to help us continually improve upon the security posture of our products and platform.

We also recognize that the trust you place in us is paramount to the success of your infrastructure on Cloudflare. We consider these vulnerabilities with the utmost concern and will continue to do everything in our power to mitigate impact. Although we are confident in our steps to mitigate impact, we recognize the concern that such incidents may induce. We deeply appreciate your continued trust in our platform and remain committed not only to prioritizing security in all we do, but also acting swiftly and transparently whenever an issue does arise.

❌