From buying to building: how AI is changing SaaS (and what a Lovable project taught me)

Some time ago I worked with a technology consulting firm that had developed an interesting product: a service for creating AI agents, built entirely with Lovable, the vibe coding platform that lets you create complete applications by writing prompts in natural language. The product worked, the interface was convincing, and development time had been a fraction of the traditional one. Then came the security checks, and the product didn’t pass them.

That AI agents have become serious business, by the way, is something I have also verified as a consumer. My mobile operator recently called to offer me a switch to a virtual SIM: the very friendly young woman I was chatting with was an AI agent. I noticed. My mother, I don’t think she would have.

That experience made me touch, at the very same time, the promise and the limit of a transformation that is reshaping the entire software market. It’s worth telling the story in order, because it concerns anyone who buys, sells or uses business software.

The SaaSpocalypse: what happened to the market

For twenty years the model was one: you don’t buy software, you rent it. SaaS turned licenses into subscriptions, CDs into cloud, fixed costs into per-user fees. Then, in early 2026, something broke: a massive selloff wiped roughly one trillion dollars in market capitalization off software stocks, in what the markets dubbed the SaaSpocalypse. January 29 was the sector’s worst single day since the Covid crash, with Microsoft shedding 360 billion dollars in market cap in one day.

The trigger was the launch of increasingly capable agentic coding tools, and investors’ fear boils down to one question: if AI can build software, who will keep buying subscriptions? The answer, as we will see, is more nuanced than January’s panic. But the underlying point stands: for the first time since the shift to the cloud, the economics of software are genuinely in question.

From buying to building: the numbers behind the shift

The phenomenon has concrete foundations. According to Retool’s 2026 Build vs. Buy report, based on more than 800 builders, 35% of teams have already replaced the functionality of at least one SaaS tool with something built in-house, and 78% plan to build more of their own tools in 2026. The logic is simple: it becomes hard to justify thousands of euros in subscriptions for a generic tool when your team can get a tailor-made prototype built in a few days.

And we are not just talking about risk-tolerant startups. As early as March 2025, Y Combinator disclosed that about a quarter of its winter cohort had codebases that were 95% AI-generated, and Google reported that more than 25% of its new code was written by AI and then reviewed by engineers. Even the UK’s National Cyber Security Centre has acknowledged that the cost/effort curve for “bespoke enough” software is shifting, comparing the trajectory of vibe coding to cloud adoption twenty years ago.

The most interesting consequence for anyone dealing with procurement: the “how do I get my software” scale has grown longer. The options used to be two, buying licenses or renting SaaS. Now there is a third one: leasing a platform that lets you develop proprietary software, without going through a commercial CRM or ERP for every need.

Lovable and the vibe coding boom

The symbol of this third way is Lovable, the Swedish startup that became the fastest growth story in software history: 100 million dollars in annual recurring revenue within eight months of launch, 400 million crossed in February 2026 with just 146 employees, a valuation that jumped from 1.8 to 6.6 billion dollars in five months, and talks underway for a new round that would push it past 12 billion. More than 100,000 projects are created on the platform every day, users number around 8 million, and over half of the Fortune 500 use it in some form.

The term vibe coding, coined by Andrej Karpathy, actually covers a spectrum: at one end there are people who write prompts and accept the generated code almost without looking at it, at the other there are experienced developers who use AI to accelerate while keeping architectural control, reviews and tests. The distinction may sound academic, but that is exactly where the security game is played. I’ll get there shortly.

The pros: speed, cost, autonomy

The advantages are real and I have seen them up close. The first is speed: applications that would have taken a development team months are born in days, sometimes hours. The second is cost: for internal tools and prototypes, the vibe coding alternative costs a fraction of an enterprise subscription. The third is democratization: people with no technical background can turn an idea into a working application, and this shifts the power to create software from IT departments to the people who actually know the problem to be solved.

Then there is a subtler strategic advantage: independence from per-license pricing. When AI agents start doing the work of several people, paying for software by number of licenses becomes an economic contradiction, and building in-house removes the problem at the root.

The cons: my experience with security checks

And here I return to the story I opened with. The AI agent creation service built entirely with Lovable by the consulting firm I worked with functioned properly, but it didn’t pass some security checks. It wasn’t bad luck: it is the statistical norm of this approach when adequate technical oversight is missing.

How did it end? With the oldest remedy in the world: competence. A very talented Ukrainian developer then solved all the security issues, one by one. And it is no coincidence that he came from there: I recently wrote about why Eastern Europe is an unrivalled forge of tech talent. Vibe coding built the product in record time, but it took a flesh-and-blood engineer, with solid training, to make it truly secure. Keep that in mind for when we reach the conclusions.

The data on this front is striking. In 2025 a vulnerability catalogued as CVE-2025-48757 exposed the data of more than 170 applications built with Lovable: the cause was missing or misconfigured Row Level Security policies on the databases, which allowed anyone to read entire tables of user data, from payment records to API keys, without even logging in. Wiz research found that roughly one in five organizations building on vibe coding platforms inadvertently exposes itself to risk, with four recurring mistakes: client-side-only authentication, credentials hardcoded in the code, overly permissive data access policies, and internal applications published on the internet without protection. And the Escape research team, analyzing more than 5,600 publicly accessible vibe-coded applications, identified over 2,000 vulnerabilities, more than 400 exposed secrets and 175 cases of personal data in the clear, including medical records and IBANs.

The problem lies at the root, and it is worth understanding: AI models optimize for functional correctness. Does the code compile? Does the app do what it should? Great. Security lives in tension with that goal, because it adds complexity without changing the application’s visible behavior. The easiest path is to skip it, and the app works anyway. Until someone comes looking.

Then there is the maintenance issue, which the debate underestimates: as one industry veteran wrote, shipping the first version is maybe 2% of the work. An app built over a weekend is a long-term commitment disguised as a quick win: updates, dependencies, edge cases, evolving requirements. It is exactly why software vendors exist.

What to do about it, in practice

The lesson I have drawn, crossing my experience with the data, is that the right question has changed shape: from “can we build it?” (today the answer is almost always yes) to “can we build it, secure it, maintain it and evolve it responsibly over time?”.

A few practical criteria I feel comfortable suggesting:

For cheap, loosely integrated tools, under 50 euros a month, replacing them is rarely worth it: maintaining an internal solution costs more than the subscription. For deeply integrated systems, CRM and ERP first among them, replacement remains hard even when AI can replicate their functions: the value lies in the accumulated data, the integrations and the compliance, not in the screens. The ideal ground for vibe coding is in the middle: internal tools, dashboards, prototypes, specific automations, all the needs for which people used to buy a generic SaaS “because there was no alternative”.

On one condition, though: treat every line of AI-generated code as not final until it is verified. Security checks before release, data access policies set to deny by default, expert human review at least on the critical points, and regular scans after launch. Lovable itself introduced security scanners and enterprise certifications precisely because the market demanded them loudly, after the incidents.

The bottom line is that SaaS is not dying, but it is shrinking and specializing: the platforms that own data, integrations and compliance will stay, single-function tools that are easy to replicate are in danger, and in between a generation of tailor-made software is growing, built by the people who live the problem. The factor that decides whether this third way is an opportunity or a ticking time bomb is always the same, and it is not technological: it is the human judgment of whoever supervises. I wrote about it when discussing why AI is now calling for philosophers and humanists: tools multiply what we know how to do, including the mistakes we don’t know how to recognize.

SaaS, AI and Vibe coding