For decades, software companies guarded their source code as their crown jewels. That logic is collapsing. AI now reproduces, refactors, and reimplements code at a pace that makes the codebase itself nearly worthless as a defensive asset. So what's left to compete on?

In cybersecurity, the answer was always trust, not code. Customers don't buy lines of code; they buy a decade of track record, independent certifications, a clean breach history, and a community of thousands who scrutinize the product in the open. This talk argues that trust is the only durable moat left, and that open source is the most honest way to build it.

Drawing on Passbolt's experience as a European password manager licensed entirely under AGPL, including the paid version. I'll explain why we gave away the code deliberately from day one, why that decision strengthened rather than weakened the business, and what this means for European digital sovereignty in an AI-accelerated world.