Korva is a scroll of the internet’s best ideas.
SaaS companies are borrowing marketplace moats
The old moats
Two moats protected the old model. One was the system of record: data went in and did not come out, like Hotel California, so moving from one system to another was a huge lift. The other was the enterprise sales team, which had account control. Better adoption models make switching easier, though not easy.
Marketplace moats arrive
Shopify began by letting vendors do something easily. Now it works on the customer side too: a shopper who buys from one Shopify vendor gets an easy path to another, and Shopify can infer which vendors might interest them from past purchases. Salesforce took another route. It has the system of record and a lot of data, and it lets a whole ecosystem of other applications work on its platform, whether or not Salesforce competes with them. That ecosystem has reinforced its moat.
A marketplace billed like SaaS
HackerOne runs a bug bounty marketplace. Companies have software bugs and security holes they want to uncover, and white hat hackers want to be paid for finding them. HackerOne matches the two sides, yet it reaches the market the way a SaaS company does: it charges and bills like SaaS and moves money from its customers to the hackers.
Why is switching a system of record so hard?
Years of customer records, custom fields, reports, and connected tools are built around it. A move means mapping every field to the new system, retraining staff, and often running both systems side by side for a while. Any record lost or mangled in transit can affect sales, billing, or compliance. Large migrations are commonly planned in months rather than weeks.
How does an app ecosystem protect Salesforce?
Customers who install several third-party apps on a platform come to rely on how those apps share its data. Leaving the platform would mean replacing every one of them. Developers also invest in learning its tools, which gives them a reason to keep building there. Salesforce launched its AppExchange marketplace in 2005.
How do bug bounty programs work?
A company publishes rules that say which systems are in scope and what rewards apply to bugs of different severity. Outside researchers submit findings, the company verifies them, and valid ones get paid. Many programs include a safe harbor policy promising not to pursue researchers who follow the rules. Google launched its Vulnerability Reward Program in 2010.
More from Invest Like the Best with Patrick O'Shaughnessy
