So You Vibecoded Salesforce. Now What?

Curative, an Austin health insurer, cancelled a $600,000-a-year Salesforce contract after building a replacement internally in two months.¹ In Long Live Software (2 of 2), we made the claim that in regulated workflows, the audit trail is not a feature but the reason the software exists. Curative is a health insurer, so at first glance it looks like we over-imagined the regulatory moat. But a CRM holding member records still sits inside HIPAA, still has to produce a compliance-grade audit trail on demand, and still carries breach liability. None of those obligations went away with the seat license, and yet Curative is taking them on anyway.

AI-Native or AI-Naïve?

When we laid out the five moats, our working assumption was that regulated industries would be the last domain to fall. Compliance regimes, audit trails, and the cost of being wrong meant a health plan or a bank would keep buying the system of record long after a design agency had vibe-coded its way off Notion. We would have put a health insurer near the very bottom of the list of buyers willing to trade a vendor’s compliance posture for their own code. The fact that someone in that seat chose to build at all tells us something, regardless of whether it proves visionary or reckless.

Curative has also replaced provider credentialing with an agent that reads state medical-board sites and litigation databases, cutting turnaround to twelve hours at roughly twenty cents a file, and plans to cut 80% of its SaaS spend this year.² That is precisely the workflow depth we argued would protect incumbents: entity resolution, sharing rules, and a defensible audit layer in one of the most heavily regulated verticals. So, the question worth asking is whether regulation was just a proxy for build cost, and whether the cost has now dropped far enough that the constraint no longer binds.

The Path to AI-Native

In the quest to becoming AI-native, we are seeing two routes run in parallel. The first is migration from a legacy incumbent to an AI-native replacement and the second is the in-house build. Retool’s 2026 build-versus-buy survey of 817 practitioners found that 35% of teams have already replaced at least one SaaS tool with something they built, and 78% expect to build more internal software this year.³ Every category showed replacement pressure, with workflow automation and internal admin tools first, and CRM, BI, project management and customer support close behind. If AI lifts a twenty-person team to what used to take a hundred, the number of firms that can credibly build expands by an order of magnitude. But expanding who can build is not the same as expanding who should.

The incumbents have figured this out too, and rather than fight the model layer they have started renting it their perimeter. On August 26th, Salesforce and Anthropic announced Claudeforce, a plugin with thirty-seven prebuilt sales skills that lets a seller reason over live CRM data from inside Claude.⁴ Claude now runs inside the Salesforce trust boundary, so customers in regulated industries can deploy against their own data while the data and the AI workload stay inside a perimeter that has already been attested to. The pitch to a health insurer is no longer “do not build your own CRM.” It is “build what you like, on our perimeter, under our attestation, with our name on the paperwork.” The model layer that was supposed to disintermediate the system of record has instead been recruited to defend it. That is a stronger position than the disruption narrative gives incumbents credit for. It is also a quiet concession that the interface was never the product.

Building for 2035

In regulated industries, part of what a software buyer is paying for is someone else’s name on the attestation. An AI-native company still needs a ledger and an audit trail. When a probabilistic system adjudicates a claim or provisions an entitlement, the record of what was decided, by which agent, under which policy, at what time, becomes the entire basis of defensibility. What it does not need is the parts sold to humans: the UI, the workflow configuration, the training, or the seat.

We’ve seen enough headlines claiming a company has ripped out Salesforce for an internal build over the last nine months that another logo barely registers. What is new is the vertical. A health insurer, with state filing obligations and audit exposure, deciding it can own its own compliance surface is a different claim entirely. Most enterprise software pricing rests on an implicit claim that the vendor is absorbing risk the customer cannot absorb itself. If Curative gets through its first real audit with the internal stack intact, that argument gets a lot harder to make, and the moat narrows to the handful of workflows where an outside party must sign. If it does not, the interesting number will be what it costs to keep a vibe-coded claims engine compliant through its first regulatory exam.

We assumed the moats would erode from the outside in, and that vendors sitting in the regulated core had years to reprice, re-bundle, and move up the stack but that timeline may be a lot shorter than we expected. Either way, SaaS does not survive in its current form. What gets sold stops being the interface and becomes the evidence that the work happened under policy. And if regulation was only ever pricing the difficulty of building, the audit trail is still the reason the software exists, it just stops being a reason to buy.

Footnotes

1. Yahoo Finance, Curative CEO says company ditched a $600k-a-year Salesforce contract after vibecoding a CRM in 2 months, 2026 ↩

2. Finance BigGo, Fred Turner: Curative Cancels $600,000 Salesforce Contract, Says Agentic AI Can Cut Insurance Admin Costs by 96%, 2026 ↩

3. Retool, The 2026 Build vs. Buy Shift: How Vibe Coding and Shadow IT Have Reshaped Enterprise Software, 2026 ↩

4. Salesforce, Salesforce and Anthropic Announce Claudeforce: The #1 AI Meets the #1 AI CRM, 2026 ↩