Most definitions of "software as a service" (SaaS) do not provide meaningful definitions for today’s business operators because they confuse recurring billing with the structure of an actual hosted service.
A business that charges a customer a recurring monthly fee is labelled a "software company" and considers its offering a hosted service, but ignores all the difficult mechanics involved in operating a multi-tenant hosted service, such as managing multiple instances of each application, managing the flow of new code to production, and ensuring compliance with all enterprise laws.
By breaking down these definitions to eliminate the category labels, we can see exactly what is a SaaS company, how true subscription SaaS platforms actually operate and grow, and where they are most at risk when mergers and acquisitions occur.
The Core Meaning of What Is a SaaS Company
The market generally has a misunderstanding of how to differentiate the pricing model of a SaaS company from the technical architecture of its products. Anyone can set up an access gate and charge a monthly fee for using a digital tool, but this would not be classified as a SaaS product.
A true SaaS provider is completely responsible for: the environment in which the code runs, the actual code, the security of the code, and how much downtime is incurred due to failure of the network.
Beyond the Basic Subscription Model
True SaaS companies will deliver the application 100% via the Internet (web), most commonly through a desktop browser or mobile device. A SaaS customer does not install any software on their device.
The SaaS vendor maintains responsibility for the application by managing all updates, maintenance, and hosting of all data. Customers pay for access to their applications, not for ownership of the code. Customers relinquish control of their local on-premises installations in exchange for the speed and simplicity of using a cloud-hosted application.
A customer loses all access to the application if a vendor loses their access to the cloud. The vendor must deliver exceptional uptime in order to meet their customers’ expectations. Ultimately, this creates a significant risk for all SaaS vendors, as the demand for continuous service is exchanged for the continued purchase of the service.
Multi-Tenant Architecture and Code Updates
Underneath all this, SaaS companies utilize multi-tenant hosted architecture. By creating a single instance of code that is used by multiple paying customers at once, the operation supports the fact that each customer keeps their data private and secure while using the same underlying application that is identical for the rest of the users.
Because the underlying infrastructure has been pooled together, these companies can create enormous economies of scale. When developers make an update to the software, the update is able to be immediately pushed to all of the companies that utilize the software.
The engineering operations of these companies have matured. Companies that develop this type of software do not release to their customers on an annual basis; the software is released on a weekly basis in scheduled release trains.
Developers will use feature flags to allow small groups of customers to test the new feature prior to rolling it out to everyone around the world. They also utilize the ability to automatically scale the servers up or down based on the elastic nature of the business's activity.
Financial Operations and Measuring Success
Fundamentals of financial operations for these types of businesses determine their success or failure. Without the ability to retain customers after growing, it is impossible for these companies to survive.
Therefore, both investors and the operational side of these companies evaluate the health of the company by measuring specific metrics related to the cost of acquiring a customer versus the total amount that customer will spend over time.
Unit Economics and Payback Periods
A healthy business will optimize unit economics as much as possible. The Customer Acquisition Cost (CAC) should be less than the Customer Lifetime Value (LTV) by a considerable margin.
The minimum standard for a company's LTV to CAC ratio is 3:1; any lower ratio indicates that the company is spending too much to acquire customers.
Payback periods indicate cash flow. This metric determines how many months of subscription income it takes for the company to recoup its total cost of acquiring the customer. For example, the payback period for a best-in-class micro-vertical application will be as short as 11 days, while for large enterprise applications, the payback is under 12 months.
Net Revenue Retention (NRR)
Net revenue retention (NRR) is what distinguishes the winners from the losers in today's marketplace. NRR measures how much revenue is being retained from existing customers after considering cancellations and upgrades.
Top-performing companies achieve NRRs between 110% and 120%. This means that even if these companies never sign any new customers again, they can still expect to see an increase in revenue of 10% to 20% in the next year. This happens as existing customers purchase additional seats or upgrade to higher tiers from their previously purchased software products.
If your business's monthly churn rate exceeds 5%, it is considered an emergency situation in the B2B sector.
Horizontal vs. Vertical: What Is a SaaS Company Strategy?
There are two different strategic paths to take: horizontal and vertical.
Horizontal software offers one business function across multiple industries (e.g., CRM or email marketing). This provides the opportunity for significant market share; however, competition is very high and pricing power is low.
Verticals are platforms that focus on the entire workflow of one specific industry. A restaurant management platform or construction project management tool would be examples of vertical solutions. Vertical tools experience rapid growth compared to horizontal products.
Currently, vertically focused solutions will command substantially higher valuation multiples than horizontally focused solutions. Highly targeted vertical solutions create high switching costs to keep customers from leaving.
Solo founders are developing highly targeted, AI-driven micro-vertical solutions. These types of solutions are inexpensive to develop, but they provide high value for specific niche markets, allowing for tremendous unit economics.
Enterprise Security and IT Audits
Selling to consumers is easy; however, selling to corporate IT organizations requires successfully passing through layers of security audits. Enterprise purchasers will not enter into any contractual agreement with you based solely on your marketing claims without strict and verifiable evidence of data security.
Compliance Reports and Audit Trails
Additionally, the procurement department requires the vendor's SOC 2 and ISO 27001 compliance reports to complete the hiring process. If a vendor does not possess these two forms of security compliance, the vendor will not get hired (or the transaction will fall through).
The SOC 2 Type II report and/or ISO 27001 certification are proof that the vendor has been following security standards for an extended period of time. Buyers do not want to simply hear about a system's security; they want to see an actual audit trail.
To meet the procurement department's requirements, a vendor must provide actual operational evidence, including:
Access logs that show who accessed internal servers and when, as well as any additional actions taken by an employee with that access.
A documented process for regularly rotating encryption keys used to encrypt databases.
SLAs that provide documentation of addressing critical vulnerabilities within 72 hours of detection.
Third-party test results for penetration testing that are conducted by a reputable independent organization.
Role-Based Access Control (RBAC) and Incident Response
Internal security operations must work perfectly. Vendors are expected to utilize RBAC for all internal security operations, except when there is a need to use additional users.
All employees must have access to only the exact system permissions they need for their specific responsibilities. Therefore, all employees must also utilize MFA for all access points to their internal and external systems.
When defining what is a SaaS company in terms of security obligations, if a data breach occurs, the vendor's incident response plan will determine whether or not the company's reputation will survive. For all incidents, the vendor will notify affected tenants and take immediate action to isolate the threat. On the other hand, vendors that do not notify affected tenants quickly lose their business presence and are subject to fines.
SaaS Case Studies and Company Examples
By examining actual SaaS companies, we can see how different approaches to their market strategies failed or succeeded due to market forces. The introduction of the new projects offers a unique look at the state of the industry and how trends are evolving.
1. Salesforce
The traditional IT model (horizontal), as represented by Salesforce and HubSpot, is defined by large enterprise-level system solutions. Salesforce is a classic example of this, having built a large CRM system serving multiple industries (retail, technology, finance, etc.) and generating over $7.2 billion in annual revenue.
As Salesforce grows, it will continue to acquire smaller tools and software companies, adding them to the Salesforce ecosystem and broadening its competitive advantage.
2. HubSpot
HubSpot is an example of how a more niche-focused company in the marketing technology space has grown into a global player. HubSpot initially focused on providing software solutions for small to medium-sized businesses with inbound marketing.
Since then, HubSpot has added a number of different solutions, and now serves over 290,000 customers, with a growth rate of 19% year-over-year.
3. Veeva Systems
The other end of the spectrum is represented by Veeva Systems and Procore Technologies. Veeva is an example of a vertical solution; it is an entirely cloud-based software company that builds solutions for the life sciences and pharmaceutical industries.
The life sciences and pharmaceutical industries have some of the most stringent regulatory requirements of any industry, and as such, Veeva has been able to carve out a sizeable portion of the market for itself. In recent valuations, Veeva has earned a 9.0x multiple.
4. Procore Technologies
Procore Technologies is a prime example of a vertical solution that has developed a comprehensive solution for the construction industry. General contractors and property developers have very specific processes and workflows with regard to bidding on jobs, managing projects, and ensuring job site safety.
Procore has been able to take this very specific process and digitize it, which makes it difficult for an organization to pull out of the Procore platform after it has already been implemented in all job sites.
5. Samsara Technologies
Samsara Technologies is another great example of a hardware-based SaaS solution in a rapidly evolving industry. Samsara is a leader in the connected operations space, with a phenomenal market multiple of 12.7x. Cloud dashboards are utilized to track fleet vehicles and heavy equipment.
6. Toast
Toast is restaurant software that combines hardware and software for restaurant operations.
Toast combines a point-of-sale (POS) system and a cloud-based payroll, inventory, and online ordering system for restaurants. By providing restaurants with a complete solution and embedding itself into their physical processes, Toast has achieved high retention rates.
7. Slack
The Slack story illustrates how product-led growth helped build Slack's user base from the bottom up. Instead of selling to executives, Slack chose to provide a free version of its product directly to end-users (employees). By doing this, Slack was able to create a user base from the ground up.
Once small teams started using Slack, the product became popular and spread throughout the organization. To continue using Slack after reaching the free tier, many organizations opted to sign up for the premium tier.
Although this bottom-up approach kept CAC low initially, Slack eventually needed to build out its enterprise sales team in order to obtain company-wide contracts and satisfy IT security requirements.
Conclusion: The Next Era for a SaaS Company
The era of growth at all costs is over. Companies that burn cash to acquire users with little or no value are being punished in today's market. To succeed today, companies must focus on profitability, capital efficiency, and customer retention.
Successful companies today do not rely on aggressive marketing tactics alone; they rely on well-maintained, reliable technical infrastructures, proving to enterprise customers that their solution is secure, and demonstrating value every month to avoid churn. Subscriptions are a billing vehicle only; the only way to maintain an edge is through execution.
Frequently Asked Questions About Business Operations
How does the micro-vertical model change the mathematical approach to the overall acquisition of customers?
The micro-vertical model closes in on a specific and narrow group of buyers. Therefore, through targeting and focusing your product on a painful pain point, the acquisition of customers typically can be achieved at a much lower advertising cost. Due to a unique selling proposition (USP), the number of conversions for each dollar spent on advertising is far greater. Then combining these low-acquisition costs with high-retention rates enables founders to pay back the cost of acquisition in days as opposed to months; therefore, they can rapidly scale without outside capital.
What does it mean when net revenue retention (NRR) falls below 100%?
When NRR falls below 100% that indicates that there are significant problems within the company, as this means that they are losing more revenue to existing customers who cancel and downgrade than they gain from upselling. This usually indicates core product failures, onboarding failures, and misalignment of your pricing model with the value provided to your end-users. This type of 'leakage' will eventually drain the entire business if not corrected.
At what point does product-led growth fail at meeting the demands of enterprise sales?
The point at which product-led growth fails to meet the demands of an enterprise sale is when the vendor attempts to secure a six-figure deal in the enterprise. The product-led growth path works for individual users wanting the self-service model; however, a chief information security officer (CISO) will not allow an unvetted tool that can remotely access corporate data to enter into its enterprise environment. At this point in time, vendors need to create a traditional sale motion that includes legal and compliance obligations, security questionnaires, and compliance certifications if they want to be successful in closing the deal.
How do compliance delays hinder early-stage market penetration?
Founders typically sell into the mid-market space before they receive their SOC 2 Type II report. This creates a bottleneck of sales, where they must essentially wait for the report before they can actually close any sales within the enterprise. Typically, it takes three to six months before a company can achieve its SOC 2 Type II and, therefore, if they delay their activities for compliance, they will burn through their funding while waiting for the audit's confirmation.
