What's Next for Software with Orlando Bravo

Summary

• Bravo’s core contrarian call: AI is run and managed by software, so the first group positioned to deliver the agentic enterprise is the domain incumbents who’ve been automating those workflows for 20-30 years — not just AI-natives. “It’s not either or. Both sides are going to be incredibly successful,” and this wave will be “many, many, many multiples bigger than the cloud wave and the SaaS wave.” Thoma Bravo has already bought ~30 AI-native companies as add-ons.
• His moat heresy, delivered categorically: “there really isn’t that much of a moat. There never was in software” — not data, not system-of-record status. The durable edge is leadership: domain founders with 20+ years who move fast and can’t be surprised by a startup because they’re talking to 10,000 customers. He thinks quality leadership “is being a bit undervalued” by markets.
• On AI disruption of the 77-company portfolio he is “extremely worried” — but retention rates are holding and so far they’re not seeing customer losses to an LLM. Agentic re-platforming is uneven: Proofpoint and Anaplan are there, Ping Identity and Coupa almost, “Dayforce is ripping” — while ROI of these agentic solutions “we don’t know yet cuz they haven’t been implemented and used.”
• The Medallia post-mortem (reports of creditors taking over, wiping out ~$5B of equity): a 2021 deal where they “paid too much cuz our growth didn’t materialize” — and the deeper error was replacing existing management and losing the innovative capability of a domain they didn’t really know. Would he keep existing leadership next time? “100%” — a direct break with PE’s change-agent orthodoxy.
• Software financing has repriced hard: on a live ~$3B refinancing, leverage capacity has dropped from 7–7.5x to ~5x, spreads are ~250bps wider with upfront fees, and unlevered credit yields ~10% vs. ~6% before. Portfolio implication: pay down debt now to be at a pretty low level ahead of the year-two/three refi wave. And the buy-side temptation is a trap: “this is exactly the wrong time to buy a mediocre software company at a bargain price” — great assets are cheap, but “nobody at these values is willing to really talk.”
• Exits stay challenging near-term — a “challenging year” after a record ~$15B flagship-fund distribution last year — though a couple of large companies are in late-stage discussions with financial-services firms and another with health or hardware firms. What reopens the window: agentic ROI showing up, incumbents (who deploy most agents today) printing 20% growth with steady margins and retention. On cyber, the next land-grab is agent identity — “how do you tell the identity of an agent? What data can it use?” — a field the identity companies “are going to own.”

Deep dive

1. AI is software — and the incumbents get first crack at the agentic enterprise

• Bravo’s level-set on the existential-risk narrative: “AI is run by software, AI is managed by software,” so the first group that can bring the agentic promise to corporations is the vertical software companies that have automated those domains for 20-30 years. Across Thoma Bravo’s 77 portfolio companies, agentic innovation velocity is “a rate that I’ve never seen before — it’s like a full-time job just to keep up.”
• The incumbent-vs-AI-native debate he refuses to pick a side on: “It’s not either or. Both sides are going to be incredibly successful.” They’ve bought ~30 AI-natives as add-ons and hope to buy them later as platforms. The wave will be “many, many, many multiples bigger than the cloud wave” — and in that wave Salesforce was created and Oracle did well.
• On LLMs and hyperscalers moving up the stack, his operating mentor’s line: “if you try to do it all, you’ll get to none.”

2. There never was a moat — leadership is the asset

• The 2000 origin story, as told: software buyouts were untouchable (“startups will put you out of business,” “Microsoft will consolidate you”), maintenance-revenue financing wasn’t available — Wells Fargo Foothill wouldn’t lend against maintenance revenue. Spending nights in companies’ paper renewal files, they found domain experts who had captured the entire knowledge of an industry — worth more than the customer base itself. Same playbook survived the AWS scare by buying the #1 player in each cyber domain.
• His categorical demolition of moat comfort-literature: data, system-of-record, determinism are “pieces of work almost trying to get software investors comfortable that they can sleep at night a little bit, but there really isn’t that much of a moat. There never was in software.” You survive by always shipping the best product at 5-to-1 ROI. What that implies: quality leadership “is being a bit undervalued.”
• Now AI lets these domain leaders go from automating 5-10% of a business or function to all of it — and companies run by founders or people who’ve done that for a long time “need less help from us.”

3. “Extremely worried” — and the Medallia confession

• Asked if all ~80 companies can pivot: “I’m extremely worried about it.” But the anxious watch — vertical teams hunting for customer losses to startups or LLMs — shows nothing yet: retention rates are holding. Platform progress varies: Proofpoint there, Ping Identity almost, Coupa almost, Anaplan there, “Dayforce is ripping.” Agentic ROI: “we don’t know yet… it’s very, very early, but we’re just going for it cuz that’s the future.”
• The Medallia autopsy, unusually candid: “It was a big mistake… we were moving really fast” in 2021; the sector’s domain depth was “questionable in hindsight,” and they underwrote growth that never came. The move to change leadership while pursuing the negative-10%-to-40% margin lift — “we really lost the innovative capability of that company.”
• The lesson, stated without hedge: keep existing leadership? “100%.” He disagrees with PE’s change-agent convention: “the reason they got to 2 billion in ARR is they did something right.” The alternative is grinding monthly 8-to-noon operating reviews — “much easier as an owner to say I’ll just put in my people. But then they don’t know the domain.”

4. Repriced credit, challenging exits, and the mediocre-bargain trap

• A partner’s line Bravo calls very powerful: “this is exactly the wrong time to buy a mediocre software company at a bargain price” — even if it yields 7-8% day one after cost cuts. Their filter — #1 domain asset, domain leadership, and visible platform-shift progress in the numbers — leaves offers out on great cheap assets, “but nobody at these values is willing to really talk. That’s the truth.”
• The credit repricing, with live numbers: on a ~$3B refinancing, leverage has fallen from 7–7.5x to about 5x, rates ~250bps wider plus fees, unlevered credit returns now ~10% vs. ~6% before — so portfolios must “pay a lot of debt down” ahead of the year-two/three refi wave. His dry aside on fickle capital: “People loved asset-light industries… what happened to that?”
• Exits: “just so difficult to see” — though two large companies are in late-stage talks with financial-services buyers and another with health or hardware firms. Last year’s record ~$15B flagship distribution “buys us a little bit of time.” What flips it: agentic ROI realized, incumbents printing 20% growth with steady margins and retention. “Today’s today. That could change in 6 months.”

5. Google’s stack, FDEs, and cyber’s new agent-identity land-grab

• The Google partnership logic: commitments to each hyperscaler run high single-digit billions, but Gemini/Vertex made Google “the only ones fully integrated in terms of a stack” — many portfolio companies build agents on Vertex, and the short-term prize is early model access, “especially our cybersecurity companies.”
• His deflating take on forward-deployed engineers: FDE resumes “are the same as a software developer… the community is the same.” Today’s talent scarcity is adoption lag, and “that scarcity won’t last” — retraining is fast and current bill rates “will change very, very quickly.”
• At almost $200B AUM with 200 people, this is “the first time in my career that I think we need more people” — but not for VC: “we tried it once… we’re just not good at that.” China: a separate tech stack, “not one of our big concerns.”
• On AI in cyber: combined, their cyber companies are “almost the size of Palo Alto, which is larger than CrowdStrike.” AI excels at killing vulnerabilities at write-time — which threatened Veracode-style scanners they once owned — but the entry vector stays human, and agent identity is a whole new field the identity companies “are going to own”: “How do you tell the identity of an agent? What data can it use? What data can it change?”