Where the Moat Moves

In December 2024 Google added a feature called Deep Research to Gemini: an agent that plans a search, reads dozens of pages and writes a report. OpenAI launched a product with the same name in early February 2025. Two days later Hugging Face published an open-source version, built in a 24-hour sprint. Perplexity shipped its own the following week.

Four versions in about nine weeks. None of the followers needed the leader's code.

That race is a small preview of the question every software business now has to answer. If what you built can be rebuilt in weeks, what protects you?

My answer: defensibility is moving from what you built to what you can reach. Data you have the right to use. Customers who already trust you. Permission to work inside their systems. A place in the work they do every day. These share one property that cheap code doesn't touch: effort alone can't produce them, because they need time to pass or someone else to agree.

What code was doing in the moat

Warren Buffett made the metaphor popular. A great business is a castle that competitors keep attacking, so it needs a moat: something that stops rivals from taking the profits even when they can see exactly how you make them. He added a line that matters a lot right now: "A moat that must be continuously rebuilt will eventually be no moat at all."

The strategist Hamilton Helmer made the idea precise. Every lasting advantage pairs a benefit with a barrier, and benefits are common while barriers are rare. He found seven kinds of barrier: economies of scale, network effects, a business model the incumbent can't copy, switching costs, brand, a resource nobody else can get, and hard-won operating skill.

Good code isn't on the list. What kept software companies durable was mostly switching costs and network effects, which are made of customers' habits and participation, not code. Where the code itself did protect a company, it worked as an economy of scale. Building a serious business application was a large fixed cost, paid once and spread over every customer. The incumbent carried it easily. A challenger had to pay roughly the same amount before winning a single customer.

AI attacks exactly that number. When producing code gets cheaper, the fixed cost falls, and the barrier built on it falls with it. The other barriers aren't made of production cost, so cheap code touches them much less, and some of them it strengthens.

Where code protected a software company, it did so as a fixed cost a challenger had to pay again. Cheaper production shrinks that cost, and the barrier with it.

Why copying is the easy case

The evidence on AI and programming productivity is mixed. In one careful 2025 trial, experienced developers working in large codebases they knew well were actually 19 percent slower with AI tools (What Changes When Code Gets Cheap). So this argument doesn't need AI to make all software cheap. It needs something narrower: that AI makes copying cheap. And copying is the most favorable case there is.

Here's why. AI systems do their best work when they can check their own output cheaply and automatically, trying something, testing it, and trying again. When you copy a product, the original is both the specification and the test. You can run your version and the original side by side and compare.

In February 2026 an Anthropic researcher had sixteen Claude agents work in parallel to write a C compiler from scratch. It took about two weeks and just under $20,000 of model usage. The result, around 100,000 lines of code, could build a bootable Linux kernel and passed about 99 percent of most standard compiler test suites. The trick that unblocked it was using GCC, the existing compiler, as the reference to compare against. The copy leaned on the original at every step.

The same write-up is honest about the gap. The new compiler still relied on GCC for one part of booting Linux, and even fully optimized, its output ran less efficiently than GCC's with optimizations switched off. Hold on to that last one percent. It's where the exceptions live.

Code is a smaller share of the moat than it looks

Cheap copying still leaves a question of size. How much of what protects an incumbent is actually code?

About 24 percent. The other 70 percent doesn't move, and the 30 shrinks to 6. Even free code would cut the bill by only 30 percent.

And 30 percent is generous. In its 2025 fiscal year, Salesforce spent about 2.4 dollars on selling and keeping customers for every dollar it spent on research and development, which itself covers far more than writing code. Taking a customer from an incumbent means integrating with their systems, passing their security review, persuading their buyers, and migrating and retraining their people. Those are made of other people's time and decisions.

Scroll sideways to see the whole figure

So code that merely reproduces visible behavior is a weak moat, and getting weaker. But code can still defend a business when it contains something that isn't code:

• Edge cases learned in production. A database, a payments engine or a tax calculator encodes years of rare failures nobody outside has seen. You can't copy by comparison what you can't observe. The moat of a mature product often sits in that last percent the compiler didn't reach.
• Certification. Software in medical devices or aircraft is protected by approvals that take time and a regulator's decision.
• Operation at scale. Running a service at huge volume with high uptime is learned by doing it.
• The record itself. A system that holds a company's customers, contracts or ledgers is protected by what it holds and by the work that flows through it.

Code is defensible to the degree it contains something that took time in the world to learn, or someone's permission to hold.

Where the moat goes

The candidates for the new moat are many: data, distribution, trust, workflow position, network effects, specialized know-how, brand, speed of learning. Apply one test to each. Could a well-funded team with today's models reproduce it by spending effort, or would it also need time and someone else's agreement?

Scroll sideways to see the whole figure

Four of them carry most of the weight.

Data, but not the kind people guard. Most company data is less unique and less useful than it feels from inside, and large models arrive already knowing most of what's in a typical company's documents. Treating that data as a secret protects the wrong thing. The defensible part has three features, and secrecy isn't one of them. It records outcomes: which claim was paid, which contract clause led to a dispute, which suggestion a user accepted. It renews through use: Cursor, the coding tool, retrains its code-completion model every couple of hours on whether users accepted or rejected its suggestions, and reported fewer suggestions with a much higher acceptance rate. That loop needs users, so data and distribution come together. And you have the right to use it. In 2025 a US court ruled that a legal-search startup, Ross Intelligence, infringed Thomson Reuters' copyright by training on material derived from its Westlaw service, and an appeals court upheld the ruling in September 2026. As data becomes more useful to models, its owners close the gates: in 2025 Salesforce changed Slack's terms to stop third parties from bulk-exporting messages or using them to train models.

Distribution. A channel to customers is much harder to copy than the product traveling through it, because it rests on people who chose you before. Code can be copied. Trust can't. And when everyone can build, getting chosen becomes the scarce step. AI also makes outreach and demos cheap, which floods every channel with noise and raises the value of the channels noise can't easily enter: referrals, existing accounts, long reputations. The classic case predates generative AI. Microsoft bundled Teams into Office, so it reached every Office customer without a separate purchase decision; the European Commission took about five years from Slack's complaint to accept Microsoft's commitments to sell its suites without Teams. The risk is distribution you rent. In 2025, while OpenAI was reported to be buying the coding tool Windsurf, Anthropic cut nearly all of Windsurf's direct access to its Claude models with less than five days' notice (Why Labs Build Products).

Trust and permission. To be useful at work, an AI product needs access to email, documents, customer records, code or money. Companies grant that access slowly, through security questionnaires, legal review, procurement and a limited pilot. Some of those steps run on calendar time, not effort. A SOC 2 Type II report, the security attestation many enterprise buyers ask for, describes how a vendor's controls actually worked over an observation period of usually three to twelve months. Working harder can't compress that, and a model can't write a track record. Agents raise the price of this permission, because a tool that suggests text needs read access at most, while an agent that sends email or moves money must be trusted with actions. For many tasks the model could already do the work. What's missing is someone willing to let it (Data Access Is the Real Integration Project).

Position in the workflow. A tool people consult on the side has almost no switching cost; they just open another window. A system of record, the software where requests arrive, approvals happen and history is kept, collects permissions, configuration and years of data, and replacing it means asking many people to change how they work at once. AI cuts both ways here. Part of every switching cost is technical, like exporting data and rebuilding integrations, and agents now do that part well. The other part is organizational: retraining people, rewriting approval chains, re-earning the security sign-off. That part doesn't get cheaper.

The rest follow the same logic. A network effect, where a product gets more valuable as more people use it together, protects you because a copy has no users; but networks whose value was a searchable archive suffer, as Stack Overflow's monthly questions fell back to roughly their 2009 level by 2025. Specialized know-how holds when it's about a domain's rules and exceptions, and expires when it's about working around a model's weakness. And "we'll just move faster" is the moat Buffett's sentence rejects. Speed protects you only when each cycle leaves behind something competitors can't get, such as test cases from real work or a feedback loop on outcomes. Otherwise it's a head start, and head starts expire.

Whatever is made of effort gets cheaper as AI supplies the effort. What holds is made of time, rights and other people's decisions.

The two counterweights

None of this is automatically good news for startups.

Incumbents bundle. When good-enough AI arrives inside the tool people already open every morning, a better standalone product has to win one more purchase, login and security review. Google folded Gemini into its Workspace business plans in 2025. The opening for challengers is what Helmer calls counter-positioning: a business model the incumbent can't copy without hurting itself. Software sold per seat is the obvious case. If agents do part of the work, customers need fewer seats, and an incumbent paid per seat has reasons to slow down the product that shrinks its revenue. That worry is what sent shares of Thomson Reuters, RELX and Wolters Kluwer down between 13 and 18 percent in one day in February 2026, after Anthropic released agent plugins for legal and data work. It remains a hypothesis; incumbents can change their pricing and take the hit.

Labs move up the stack. Model labs keep shipping products that used to be startups. What they absorb is the generic part, the features every customer needs in the same form or that compensate for what models couldn't do yet (A Product That Improves With the Model). A model release can't ship one customer's approval chain, its data rights or its relationship with a vendor it already trusts. And notice what the labs themselves are doing: moving from what they built toward distribution and position.

What I'd take from this

For incumbents, most of the durable moats are already theirs: customers, records, data rights, security approvals. Their code is depreciating, and the threats are specific: a challenger with a pricing model they can't match without self-harm, and an agent layer that turns their records into a database someone else's software reads. Their behavior suggests they know it. They gate data, bundle AI and license content to newcomers who can pay.

For startups, a better product alone is a weaker bet than it used to be, because a fast follower with distribution arrives before you can earn your own. Distribution always beat product; the difference is that the window a better product used to buy has shrunk. The positions that hold are narrower: a business model incumbents can't copy without damaging their revenue, a domain narrow enough to earn trust and data rights faster than a generalist, a loop that turns usage into learning nobody else sees, or a capability a larger company would rather buy than rebuild (The Price of Know-how).

The serious competing view, which Microsoft's CEO Satya Nadella has voiced, is that business applications are databases with logic on top, and the logic will move to a layer of AI agents that makes the records interchangeable plumbing. I'd watch two signals. Customers routinely switching their system of record because an agent did the migration. And security approvals becoming portable between vendors. As of October 2026, neither is visible at scale.

So my practical rule is short: own what changes slowly, rent what changes fast. Relationships, rights, records and domain rules change slowly. Models and most generic tooling change fast.

And the test for any moat you think you have fits in one question. Could a well-funded team with today's models reproduce it by spending effort? Or would they also need time to pass and someone else to agree? If effort is enough, you have a head start. Head starts are worth having. They also expire, and the time to turn yours into something slower is while you still have it.

Check yourself

Why did code protect software companies only weakly in the first place?

Where it protected them, it worked as a large fixed cost a challenger had to pay again. AI shrinks that cost, and most durable software advantages were switching costs and network effects, which are made of customers and not code.

Why is copying the most favorable case for AI?

AI works best when it can check its own output cheaply and automatically. When you copy a product, the original is both the specification and the test.

What is the one question to test a moat?

Could a well-funded team with today's models reproduce it by spending effort? If effort is enough, you have a head start, which expires. If it also needs time to pass and someone else to agree, it is a moat.