SaaS isn't dead. Your ChatGPT subscription is SaaS.

Everyone says SaaS is dead

At the end of January, Anthropic released a set of add-ons for its AI agent, Claude Cowork, including one that could handle legal work. Within days, software stocks were tumbling and "SaaS is dead" was all over the news.

The thinking was simple enough. If an AI agent can do the work, why keep paying for the software the work used to happen in? And if you can build an app just by describing it, why rent one at all?

It's a fair question, and plenty of business owners are asking it. We build bespoke software for a living, so you might expect me to tell you to cancel the subscriptions and build your own. Most of the time, I'd tell you to keep them, and only build the part they can't do. And the best argument for that is probably open in one of your browser tabs right now.

Your ChatGPT subscription is SaaS

ChatGPT is a SaaS product. So are Claude and Gemini.

Think about how you use them. You pay a monthly fee, the software runs on someone else's servers, and it keeps improving without you ever installing an update. That's the textbook definition of software as a service. The tools that are supposed to be killing SaaS are SaaS.

They even sell to businesses the same way the old guard does. Claude's team plan, for example, is priced per person, per month, just like Salesforce. And people are signing up in huge numbers. OpenAI says ChatGPT alone has more than 50 million paying subscribers.

Who's actually making the money

Put the AI companies next to some of the biggest names in SaaS and you can see how quickly things have moved.

Last year it wasn't even close. Salesforce on its own brought in more than OpenAI and Anthropic put together. This year the AI companies have shot past it. Going by the figures they've shared with investors, both are now bringing in money faster than Salesforce is.

Those figures come with a health warning. They take a recent month or quarter and scale it up to a full year, and nobody has audited them. Google doesn't publish separate numbers for Gemini, which is why it isn't on the chart. But the direction is clear, and so is the business model: subscription software, running in the cloud. SaaS isn't shrinking. Some of its biggest players just have new names.

What you're really paying for

So if subscriptions aren't going anywhere, what are you actually paying for? Mostly, the people behind the software.

Software is never finished. Every app is built on layers of other technology, from the programming language to the database to the server it runs on, and all of those keep changing. When they change, the app has to change with them. A good SaaS company has whole teams doing that, fixing bugs and closing security holes, usually without you noticing. Salesforce spends billions a year developing its products, and your subscription buys you a small share of that effort.

A system someone builds for you is different. It stays exactly as it was on the day it was finished, unless somebody is paid to keep it up to date. Very often, nobody is.

PHP is a good example. It's the programming language behind most websites, including every WordPress site. Yet nearly half of the sites that use it are on versions that no longer get security fixes, some of them for years. Nobody decided that was a good idea. Someone built the site, it worked, and nobody was paid to look after it.

AI is finding the holes

For years, an out-of-date website was a risk most businesses could live with. AI is changing that.

In October, PHP released urgent fixes for two serious flaws, nicknamed PHP2Shell, that could let an attacker run code on a web server without even logging in. The researchers who found them had help from AI, and they say it made a long-standing weakness much easier to turn into a working attack. There's no ready-made update for older versions of PHP, and the US government's cyber security agency told anyone running them to take those systems offline.

If your software is looked after by a team whose job is patching, this is exactly what they're there for. If it's a site someone built for you years ago that nobody has touched since, that warning was meant for you.

It isn't a one-off, either. In April, Anthropic said one of its models had found thousands of serious security flaws, including some in every major operating system and web browser. It still only lets vetted security partners use that model without restrictions. Attackers are speeding up too. One security firm found that, between July and September, serious flaws were typically being exploited within days of going public.

So what really protects you is how fast someone patches. That's a big part of what you pay a SaaS company for.

You can build it yourself. Should you?

None of this means you shouldn't build your own software. AI has made building faster than ever, and we use it ourselves. But getting an app to work and making it safe are two different jobs.

When the security firm Veracode tested AI models on coding tasks, the code almost always ran, yet it failed security checks close to half the time. Moltbook, a social network for AI agents, shows what that can look like in practice. Its founder said he hadn't written a single line of code. Security researchers then found its database wide open, with over a million login keys exposed. It was fixed within hours, but only because outsiders spotted it first.

To be fair, rented software isn't automatically safe either. Last year, attackers got into a lot of companies' Salesforce accounts through a chatbot app those companies had plugged in. Salesforce itself wasn't the weak point, and that's the lesson: even rented software needs setting up properly, with someone keeping an eye on what's connected to it.

SaaS gets you most of the way

Here's my own take. SaaS is essential for running a business efficiently, but only up to a point. In my experience, a good SaaS product will handle around 70 to 80% of what a business needs. It's cheaper, quicker to get going and well looked after. Security fixes land for every customer at once, and regular updates keep it competitive.

The last 20 to 30% is where businesses differ: how you quote, how you schedule, the checks you run, the reports your clients expect. A SaaS product can only bend so far, because it's built to suit thousands of customers at once. That's where bespoke earns its place. A system built around how you actually operate can take you to 90% or more, and it can change as your business changes.

Which one is right comes down to how much of the work you want help with, and what closing that gap is worth. If the last 20% costs you hours every week or holds back growth, building for it can pay for itself. If it doesn't, a good SaaS product and a few workarounds will do the job.

Often the answer is both. Rent the core, and build the part that's yours on top of it, connected to the tools you already rent. Start by looking properly at how the business really runs before anything gets built. That's how we work at BespokeWorks: consulting first, then a build only where the case holds. And whoever builds it has to look after it the way a SaaS company would, with regular updates, monitoring and a named person responsible. If nobody's going to do that, don't build it.

Where SaaS goes from here

SaaS isn't dying, but it is changing, and the first thing to change will be how it's priced. If an AI agent does work that three people used to log in for, charging per login stops making sense. You can already see the shift. Fin, the customer service company formerly known as Intercom, charges for its AI agent by the outcome rather than by the seat, and Salesforce bought it in September.

The screen will matter less as well. More work will happen through AI agents instead of people clicking through menus. But those agents still need somewhere reliable to read from and write to: your customer records, your accounts, the rules on who can do what, and a history of what happened. That part of SaaS gets more valuable as AI takes on more of the work.

We'll also see a lot more custom software. AI makes small, tailored tools cheap to build, and most of them will plug into the systems you already rent. The ones that last will be the ones someone keeps looking after.

And security will move to the top of everyone's list. When AI can turn an old flaw into a working attack this quickly, how fast a provider fixes problems matters as much as what its software does. It's one of the reasons BespokeWorks is now certified to ISO/IEC 27001.

So, is SaaS dead?

No. What's in trouble is the lazy version of it: charging per head for screens nobody needs to look at. What's left is the reason people paid for SaaS in the first place. Someone else keeps your software running, up to date and safe, so you can get on with running your business.

So rent what gets you most of the way, and build the rest only where it's worth it. Either way, ask one question before you sign anything: who's on the hook when it breaks? If the answer is nobody, you've got a problem, whoever wrote the code.