Yes, Many Software Leaders Have Moats. No, That’s Not Enough.

Do leaders in B2B software still have moats in the Age of AI?

Of course they do. You can see it plain as day in Gross Revenue Retention. The median GRR across B2B software is still around 90%. The best companies hold above 95%. When you have a $50k+ ACV, those numbers get even stickier. Longer sales cycles, deep implementations, dedicated support. Once a customer is in, they tend to stay in.

So yes, moats are real. High switching costs. Deep integrations. Workflow dependency. Data lock-in. All of it.

But here’s what founders get wrong when they celebrate high GRR: moats just keep your existing customers from leaving.

That’s it. That’s all they do.

And in 2026, that is not enough.

Everybody’s Talking About Who’s “Safe.” That’s the Wrong Question.

The last few weeks have been a frenzy of analysts trying to sort software companies into “safe from AI” and “not safe from AI” buckets.

Morningstar just reviewed 132 tech companies through an AI disruption framework and downgraded 40 of them.

Six former wide-moat companies got cut to narrow: Adobe, Salesforce, ServiceNow, Shopify, Descartes, and Manhattan Associates. Adobe’s fair value estimate dropped 32%. ServiceNow’s dropped 18%. Morningstar’s Eric Compton said they’re no longer confident software companies will earn excess returns over the next decade with near certainty. They downgraded their moat duration from 20 years to 10.

On the other side, they identified 27 companies whose moats they believe will hold up against AI. CrowdStrike and Cloudflare actually got upgraded because more AI in the world means more cybersecurity demand. Microsoft stayed wide-moat because of switching costs, network effects, and a diversified portfolio that benefits from AI (Azure, Copilot) even if some products (Office seats) face pressure.

Goldman Sachs jumped in with a similar framework, highlighting Snowflake, MongoDB, Shopify, and CrowdStrike as companies with “architectural moats that extend beyond the application layer.”

Their analyst argued that AI functions as an intelligent layer, not a foundational replacement, and that systems of record (SAP, Salesforce, Oracle, Workday) will remain strategic because they own the data AI needs to work.

Bain published a report showing that GRR is still holding at roughly 90% for most leaders. Customers aren’t leaving yet. But they’re not expanding either. Net revenue retention across public software has slid from ~116% at the peak to roughly 108%. And some vendors are already reporting slower seat count growth as companies get more efficient with AI tools.

HarbourVest called it the most profound valuation reset since the 2008 financial crisis and laid out the winners and losers: companies with strong data moats, operational criticality, and embedded fintech on one side. Horizontal CRM and project tools without industry context on the other.

All of this analysis is smart. All of it is well-researched. And all of it misses the real point.

“Safe from AI” Does Not Mean “Capturing AI Budget”

This is the distinction almost nobody is making clearly enough.

A company can be perfectly safe from AI disruption and still slowly die. Safety means your existing customers don’t leave. It means your GRR stays at 92%. It means nobody rips you out this year.

But safety doesn’t mean growth. And in 2026, the AI budget is the only budget that’s growing.

Gartner projects AI spending will approach $1.5 trillion in 2026. Software specifically is projected to grow 15.2% year-over-year. AI is capturing 30% of the total IT budget increase despite being a fraction of overall spend. Meanwhile, the rest of IT spending grows at a fraction of that rate.

So where do companies find budget for AI initiatives? They steal it from somewhere else. The question isn’t whether your company is safe from AI. The question is: are you the one stealing budget, or getting stolen from?

Look at the public market data. Private AI companies are trading at 61x ARR. Public B2B software companies are trading at 4x ARR. That’s not a valuation gap. That’s two completely different markets. The companies at 61x are the ones capturing AI budget and growing accordingly. The companies at 4x are the ones the market has decided are utilities.

Morningstar’s own data makes the case. They said AI products at incumbent software companies still account for only 1-5% of revenue or ARR. Retention rates haven’t changed, margins are still increasing, ARR is still growing. All the defensive metrics look fine. But AI revenue is barely a rounding error. The moat is holding. The castle is shrinking.

GRR Is Defense. Net New Customers Is Offense.

A 95% GRR means you lose 5% of your revenue base every year from existing customers. A 90% GRR means you lose 10%. Even the best companies are leaking. Moats slow the leak. They don’t fill the bucket.

GRR is holding up. Customers aren’t necessarily leaving established leaders for AI native start-ups. But that doesn’t mean they are committing more budget to them. Or that new customers will pick them for their AI Agents.

ServiceNow: 98% renewal rate, dead flat for 5+ consecutive quarters. Rock solid.CrowdStrike: 97% GRR, consistent every quarter even through the July 2024 outage (dipped less than half a point, bounced right back).Workday: >95% disclosed consistently, hit 97% in their most recent quarter (Q2 FY2026). Morningstar cited seven straight years above 95%.Datadog: “Mid to high 90s” every quarter, exact same language used by management in Q1 2025 through Q3 2025.Salesforce: ~8% attrition rate = ~92% GRR, consistent across every quarter. Their Q4 FY2026 earnings just confirmed the same 8%.HubSpot: “High 80s” customer dollar retention (their GRR proxy), ticked up slightly but essentially flat.

The metric that actually tells you whether a software company is winning or dying? Net new customer acquisition. Net new logos.

How many brand-new customers are signing up this quarter vs. last quarter vs. the year-ago quarter.

Median revenue growth for US public software companies has dropped from roughly 27% in 2021 to around 10% in 2025. When NRR was sitting above 115%, existing customers funded growth through expansion. At 108%, that engine barely covers churn. Growth has to come from somewhere else. It has to come from new customers.

And the new logos that used to flow in? Those prospects are now evaluating AI-native alternatives that didn’t exist 18 months ago. Top-quartile AI-native companies are achieving 360% new logo velocity year over year versus 71% for non-AI peers. AI-native companies are reaching $100M ARR in 1-2 years. The historical benchmark was 5+ years.

That’s not an incremental difference. That’s a different game with different rules.

The Seat Compression Math Is Real

The pundit consensus that certain companies are “safe” rests heavily on the idea that switching costs protect revenue. And they do, in the short term. But there’s a second-order effect nobody’s safe from: seat compression.

When one employee equipped with AI agents can accomplish the work of five traditional employees, the per-seat pricing model starts to collapse. Even if no customer churns, even if switching costs hold perfectly, revenue shrinks because the customer needs fewer seats.

The math: a 30% seat decline with a 10% price increase still nets out to -23% revenue. A 50% seat decline with a 15% price increase is -42.5%.

That shows up in NRR, not GRR. Your customers aren’t leaving. They’re just spending less. Your moat is intact. Your revenue is declining. Gartner reports that as of early 2026, 40% of enterprise software contracts now include outcome-based pricing elements. The transition away from per-seat is already underway.

What Actually Matters: 5 Things to Watch

1. Net new logo growth rate, quarter over quarter. Not revenue growth (which can be juiced by price increases on existing customers). New logos. New custome