Enterprises expected SaaS to simplify their IT infrastructure. In many ways, it did – but it also created an entirely new attack surface. Most departments now rely on a mix of sanctioned and unsanctioned SaaS applications – and even the sanctioned ones are often unmonitored for risk. This uncontrolled growth has evolved into a new form of Shadow IT: SaaS sprawl.

The rise of AI-powered SaaS tools has accelerated this trend even further. Users can now connect generative AI platforms to business applications like Google Drive, Slack, Microsoft OneDrive, CRM systems, and developer tools with just a few clicks – often without understanding the permissions being granted or the data being exposed.

While most organisations have adapted their identity and network controls for cloud usage, they are still unprepared for what has emerged behind the scenes: SaaS-to-SaaS integrations, AI-driven automations, OAuth permission chains, risky third-party plug-ins, and misconfigurations inside sanctioned apps.

The result is a scenario where security teams have minimal visibility and even less control.

Leading software development company Codehesion has identified a major industry shift where companies are moving from using off-the-shelf SaaS subscriptions, to building their own custom software.

“Businesses outgrow SaaS when software stops being a tool they use and becomes the engine their business runs on,” said Codehesion founder and CEO Hector Beyers.

“At that point, customer software isn’t a cost – it’s a competitive advantage. You’re building something your competitors can’t buy off the shelf.”

AI’s ability to accelerate delivery timelines has made the case for going custom even stronger.

“With the right partner, you get purpose-built technology at a speed that would have been unthinkable even a year ago,” said Beyers.

Flexera’s 2026 State of the Cloud Report marks a pivotal moment in cloud maturity. Now in its fifteenth year, the report shows cloud entering the value era—where organisations tie cloud decisions to measurable business outcomes, accelerate GenAI adoption and lean on centralised governance to manage rising complexity.

Those looking to get a handle on cloud spend and cloud governance must pay attention to these trends and to the goals that can help drive the most value possible, or risk getting left behind in reactive states.

For the better part of two decades, SaaS growth followed a familiar arc. In its early phase, convenience was the unlock. Moving from on-premise infrastructure to the cloud was transformative. Companies adopted SaaS because it was faster, cheaper, and easier to deploy.

Through the 2010s and early 2020s, growth was driven by features, better UX, deeper integrations, and the promise of all-in-one platforms. The winners built more, shipped faster, and consolidated workflows. But as we move deeper into 2026, a structural shift is underway.

AI has dramatically reduced the cost of building software. Production-grade code can be generated in minutes, dashboards can be replicated, workflows can be automated, and integrations can be accelerated with minimal engineering effort. Yet even as organisations accelerate AI adoption, governance maturity is lagging. Gartner research indicates that while most procurement leaders are deploying or planning generative AI initiatives, a significant majority acknowledge that their data is not AI-ready, limiting their ability to generate reliable, governance-ready insights.

The result is a widening gap between what companies can build and what enterprises are prepared to trust.

This is the point that marks the beginning of what we call the Post-Feature Era. In this era, functionality alone is not durable. Trust is. What cannot be replicated overnight are the invisible layers beneath the product: years of security maturity, governance discipline, operational resilience, and auditability. Enterprises are not buying code. They are buying assurance that the system will not expose them to regulatory, financial, or reputational risk.

Trust is moving beyond compliance because security and compliance are no longer back-office checklists addressed at the end of a sales cycle; they increasingly determine whether a company even enters the sales cycle. Recent industry research suggests that roughly 85 percent of enterprise buyers now require a SOC 2 or equivalent security attestation before signing contracts, and approximately 70 percent of deals are delayed or lost when vendors cannot provide it.

Governance is no longer a closing-stage discussion; it functions as a gating mechanism. Buyers are evaluating risk posture alongside product capability and expecting clarity on how data is handled, how systems are monitored, and how decisions, especially AI-driven ones, can be explained.

At the same time, compliance itself is changing. It once operated on a prepare, pass, reset cycle. That model is breaking down as SaaS companies now operate across geographies, serve regulated industries, and embed AI into core workflows, where scrutiny is not occasional but continuous.

This shift becomes even more significant as pricing models evolve, with AI reducing human dependency inside tools and value increasingly measured by outcomes rather than seats, including transactions completed, risks mitigated, and controls maintained. When revenue is tied to outcomes, customers must trust how those outcomes are measured and reported, which makes transparency foundational and embeds governance directly into execution.

Resilience is also being redefined. Modern SaaS companies operate within interconnected ecosystems of cloud providers, integrations, and third-party vendors. The expectation is moving from minimal downtime to demonstrable continuity. Enterprises want evidence that systems can withstand disruption and recover predictably.

All of this reflects a structural shift in how trust must be built and maintained. It cannot live in spreadsheets or be assembled reactively before audits. In a world where scrutiny is constant and expectations continue to rise, trust can no longer be treated as a point-in-time exercise. It must function as infrastructure: always on, continuously validated, continuously monitored, and embedded into the way products are built and delivered. This shift is precisely why trust will define the next decade of SaaS.

The next decade of SaaS will not be defined by who ships the most features. It will be defined by who can sustain credibility at scale. As software becomes easier to build, the bar for reliability and governance rises in parallel. In the Post-Feature Era, speed is baseline, and functionality is replicable. Trust is what compounds. It reduces friction in enterprise sales, enables expansion into regulated markets, and becomes increasingly difficult to displace.

Oracle executives have downplayed fears that AI will spell the death of software-as-a-service companies.

Oracle Chairman Larry Ellison said during the company’s earnings call on Tuesday that he believes the so-called SaaSpocalypse will be a problem for other companies, but not his.

“We have these coding tools now that allow us to build a comprehensive set of software, agent-based software, to implement to automate a complete ecosystem like healthcare or financial services,” Ellison said. “That’s what we’re doing at Oracle. That’s why we think we’re a disruptor. That’s why we think the SaaSpocalypse applies to others but not to us.”

Fears that AI will replace traditional software tools have been particularly high over the past month, after Anthropic released new agentic AI tools, triggering a sell-off in software stocks, including Salesforce and Asana.

Oracle CEO Mike Sicilia also said on the earnings call that he doesn’t agree with the idea of the SaaSpocalypse.

“I do think that AI tools and their coding capabilities would be a threat if we weren’t adopting them, but we are, and very rapidly,” he said. “We are building brand new SaaS products using AI and also embedding AI agents right into our existing applications suites.”

Sicilia added, “I’ve not yet met a customer who tells me they’re ready to give away their retail merchandising system, their core banking system, demand deposit account systems, electronic health record systems, and some cobbling together of niche AI features are going to replace all of that overnight. In fact, we hear quite the opposite from the customers.”

Oracle aren’t the only company trying to downplay the fears of AI companies like Anthropic and OpenAI becoming a threat to software giants.

Salesforce CEO Marc Benioff recently tried to reassure investors that the company’s focus on AI agents would insulate it from the software apocalypse. “If there is a ‘SaaSpocalypse’, it may be eaten by the ‘SaaS-quatch’ because there are a lot of companies using a lot of SaaS because it just got better with agents,” he said.

Workday CEO Aneel Bhusri also tried to allay fears during the company’s earnings call last week that HR and business software systems require complex security and regulatory needs, and boasted that AI companies such as Anthropic and OpenAI are running its software.

The SaaS industry has reached a turning point. After nearly two decades of relying on seat-based pricing, enterprises now expect pricing that reflects real value and real usage. Hybrid and consumption-based pricing models are becoming the new standard as AI-driven workloads reshape how software is used and consumed.

This shift accelerated in 2025 and 2026 for three key reasons: