For the last 15 or 20 years, SaaS companies have spent a lot of time talking about differentiation. What is your unique value proposition? Who is your ideal customer? What can your product do that somebody else’s cannot? Those questions still matter, but increasingly, I think technology companies need to answer another one: what is your moat?
The language is changing because the market is changing. AI agents are beginning to reshape how people interact with software. Instead of learning every screen, menu and workflow inside an application, a user can increasingly ask an agent to help achieve an outcome. The agent then works across the underlying software to retrieve information or carry out the necessary steps.
That changes where value sits in a platform. If the interface becomes easier to replace or access through an agent, the front end alone becomes less defensible. The real moat moves deeper, into the data, relationships, business logic and governance that make the software useful in the first place.
For years, SaaS businesses have invested heavily in the user experience. That remains important, but I think we are moving towards a world where more interactions happen through an AI layer.
Consider a governance, risk and compliance (GRC) platform. Rather than opening a risk register, finding the relevant records, reviewing associated controls and building a report, a user might simply ask: “Show me the risks that have deteriorated this quarter, the controls associated with them and anything that needs executive attention.”
The agent becomes the interface, but it still needs somewhere to go for the answer. It needs trusted data and an understanding of the relationships between risks, controls, incidents, obligations and actions. It needs defined permissions, access to the appropriate systems and clear boundaries around what it can change. If it takes action, the organisation still needs evidence of what happened and who authorised it.
That is why I think the enterprise foundation becomes more important as the interface evolves. A simpler way to interact with software does not make the underlying complexity disappear. It makes the quality of that foundation more consequential.
Access to a large language model is unlikely to provide a lasting advantage on its own. Chatbots and tools for building agents are becoming more widely available, making it harder to differentiate simply by offering an AI capability.
The harder things to replicate sit underneath those capabilities: a sophisticated data model developed over years, relationships between information, complex workflows, business rules, integrations, security, audit history and industry knowledge embedded in how the platform operates. Together, these can form a much more durable source of value.
In GRC, the value of information is rarely contained in a single record. A risk matters because of the controls attached to it, the incidents that may indicate those controls are failing, the obligations behind them, the people accountable and the actions underway. Understanding how those relationships have changed over time adds another layer of context.
An AI agent can help analyse that information quickly, but first it needs information structured in a way it can reliably use. AI makes intelligence more accessible; the quality of the data and operating environment still determines what that intelligence can achieve.
Agentic AI also changes who, or what, needs access to enterprise software. Platforms increasingly need to support interactions from other AI systems alongside their human users. Model Context Protocol (MCP) is one mechanism for connecting AI systems with tools, data and capabilities.
For software companies, that raises a reasonable question: if another AI system becomes the interface, what happens to the customer experience and the value of the platform?
I think it brings the underlying value into sharper focus. A platform built primarily around presenting relatively simple information faces a different challenge from one containing deeply connected data, established workflows, enterprise integrations and governance capabilities. Making those capabilities available to agents can extend their usefulness, provided access and actions remain appropriately controlled.
The front door may change, but the capability behind it still matters. Opening a platform to AI creates value when it gives users another way to access something they already depend on and trust.
Through ReadiNow’s Executive Roundtable series, we have been bringing together senior risk, compliance and resilience leaders from major Australian organisations. Much of the discussion has focused on practical AI use cases, but another theme has repeatedly surfaced: AI becomes more useful when it can work with the organisation’s trusted data and established processes.
Participants have described experimenting with different models and tools while trying to understand how those capabilities connect with existing systems, policies and governance structures. One risk leader highlighted the challenge of simply keeping track of the AI platforms, engines and use cases being explored across the organisation.
A recurring discussion has been the difference between AI used separately from an enterprise process and AI operating within it. Copying information from a risk system into an external tool may produce a useful answer, but context, permissions and evidence do not necessarily travel with that information. The organisation then needs to manage how the answer is checked, used and recorded.
When an agent operates through the platform’s established controls, it can work with defined permissions, approved processes and connected data. Its actions can also form part of the same audit trail. For me, that is both a governance advantage and a practical technology advantage.
Our roundtable polling highlighted the breadth of the opportunity. When we asked where AI could make the biggest difference to GRC, three areas tied for the strongest response, each selected by around 29% of participants: keeping up with regulatory change, preparing reporting for executives and boards, and identifying patterns and emerging risks earlier. Another 14% selected risk and control assessments.
This was a small participant poll rather than a market-wide study, but the spread of responses was interesting. These use cases involve different tasks, from interpreting new information to communicating priorities and detecting patterns. Yet they depend on many of the same foundations: reliable data, relationships between records, appropriate access, defined processes and governed actions.
That is why I think the discussion about AI advantage needs to extend beyond the model itself. Models will improve and change, as will agents and interfaces. The organisational knowledge and operating environment they work with can provide value across those changes.
Today, a lot of enterprise AI activity still happens alongside established workflows. Someone takes information from one system, places it into an AI tool, asks a question and transfers the answer elsewhere. That can be useful, but it also creates additional hand-offs and a growing challenge around oversight.
The next stage is to make AI part of the workflow itself. A risk assessment could include an approved agent to support the assessment process. An incident workflow could use an agent to help classify and triage an issue. A regulatory change process could use AI to analyse a new obligation against existing controls and policies, with appropriate review.
The important point is that the agent has access to the relevant business context and operates within defined boundaries. The intelligence may come from different models over time, while the organisation’s data relationships, processes and knowledge remain available to support the work. That, to me, is a much stronger foundation for lasting value.
This thinking has shaped our approach to AI at ReadiNow. We see the long-term opportunity in enabling agents to work across the platform’s connected data, workflows and enterprise controls.
ReadiNow’s flexible data model, no-code configuration, security and integration capabilities provide the foundation. Agents can then work with the relationships already established between risks, controls, obligations, incidents, people and actions, within configured permissions and workflows, with human approval where required and evidence retained.
As more AI systems interact with enterprise platforms on behalf of users, I expect these foundations to become increasingly important. Technology companies will need to explain the trusted, useful capability their AI can access and why that capability is difficult to replicate.
For GRC leaders evaluating AI, I think that provides a useful question to ask: what does this AI understand about our business, and what controls govern its ability to act? The answer will tell you far more about its enterprise value than the quality of a demonstration alone.
These are the questions we continue to explore through the ReadiNow Executive Roundtable series. We bring together senior risk, compliance, governance and resilience leaders to share practical experiences, discuss where AI is creating value and examine the challenges of moving from experimentation into operational use.
The sessions are deliberately discussion-led, giving participants an opportunity to hear what peers are trying, what is working and which questions they are still working through.
If you would like to participate in an upcoming ReadiNow Executive Roundtable, register your expression of interest below.
Register your interest in a future Executive Roundtable