How AI Startups Build Defensibility

By Brian Tr · Updated Oct 7, 2026

Defensibility is what keeps a competitor from copying your results and taking your customers once those results prove the market is worth chasing. For an AI startup the question is sharper than it was for classic software, because the thing that made the product impressive, a capable model, is available to almost everyone who can write an API call.

This page is the map. It covers why the model alone is rarely a moat, the candidate sources of defensibility, how they differ from classic SaaS, and how to assess and sequence them over time. Three of the moats get their own deep dives, which are linked below. If you want the general strategy concept first, start with economic moats and competitive advantage.

Two Lenses: Buffett's Moat and Helmer's Powers

Warren Buffett popularised the moat metaphor for investors. In his 1995 Berkshire Hathaway shareholder letter he wrote that he looks for "economic castles protected by unbreachable 'moats.'" The idea is simple: a profitable business attracts attackers, and the moat is whatever makes attacking it unattractive.

The metaphor is useful but vague about what a moat is made of. Hamilton Helmer's book 7 Powers (Deep Strategy, 2016) is more precise. Helmer defines power as the conditions that allow a company to achieve persistent differential returns, and, as he put it in an interview with the Acquired podcast, it needs two things at once: a benefit, something that makes the business model better, and a barrier that stops smart competitors from taking it away. Benefits are common. Barriers are the hard part.

He names seven powers:

1. Scale economies: unit costs fall as output grows.
2. Network economies: the product gets more valuable as more users join.
3. Counter-positioning: a newcomer's superior business model is one that incumbents won't copy because it would damage their existing economics.
4. Switching costs: customers face real friction or expense if they move.
5. Branding: the brand supports premium pricing or stronger preference that rivals can't easily duplicate.
6. Cornered resource: privileged access to an asset, such as talent, IP or data, that rivals can't readily secure.
7. Process power: embedded processes that deliver lower cost or better outcomes in ways rivals struggle to replicate.

The benefit-plus-barrier test is the most useful tool on this page. For any claimed moat, ask two questions. What does it do for our economics? And why can't a well-funded competitor neutralise it in a year? If you can answer only the first, you have a feature, not a moat.

Why the Model Alone Rarely Works as a Moat

The first source of defensibility founders reach for is the model itself, whether fine-tuned, prompted or built from scratch. It's also the weakest one for most startups, for two reasons.

Model commoditisation. The gap between the best models keeps closing. Stanford's 2025 AI Index Report states that the score difference between the top and 10th-ranked models fell from 11.9% to 5.4% in a year, and that open-weight models cut their gap with closed models from 8% to 1.7% on some benchmarks. When the leaders are that close, a startup built on a slight quality edge can lose it with the next release from someone else.

Thin-wrapper risk. If your product is a model plus a prompt plus an interface, anything you do can be copied by a team with the same access, and the model provider can add your feature to its own product. The question isn't whether wrappers are bad. It's whether the layer you built carries something the underlying model doesn't. We cover that in AI wrapper vs AI-native products and in application layer vs model layer.

Even the labs worry about this. A leaked internal Google memo, republished by SemiAnalysis in May 2023, argued that neither Google nor OpenAI had a secret sauce that open-source models couldn't approach. SemiAnalysis said the text came from an anonymous individual on a public Discord server. It's one researcher's view, not a verdict, but it shows how seriously insiders take the commoditisation point.

How this differs from classic SaaS: a SaaS company's code was usually hard to replicate quickly, so the product itself bought time. In AI, the model capability is often rented, and the time it buys is shorter. Defensibility has to come from what sits around the model.

The Candidate Moats

Here are the main sources of defensibility for AI startups, mapped to Helmer's powers where they fit.

Proprietary data and data flywheels

The intuition is that more usage produces more data, which improves the product, which attracts more usage. It's real in some cases and overstated in many. Martin Casado and Peter Lauten of a16z argued in The Empty Promise of Data Moats (May 2019) that most data advantages are scale effects, not network effects, that acquiring unique data tends to get progressively more expensive while its incremental value diminishes, and that data is defensible mainly when it comes from proprietary sources, measurably improves product quality, and is paired with verticalization and go-to-market strength. In Helmer's terms, data usually works as a cornered resource or as part of a scale economy, and only if the barrier holds. The deep dive is how AI data flywheels work.

Workflow integration and switching costs

When the product sits inside the customer's daily process, connected to their systems, configured to their rules and trusted by their staff, leaving becomes expensive. This is the classic switching-costs power, and for AI products it's often the most reliable one available early. The caveat is that lock-in earned through value lasts, while lock-in built on friction invites resentment and churn. For the general concept, see switching costs. For the AI-specific version, see workflow lock-in for AI products.

Distribution

Reaching buyers cheaply and repeatedly, through an existing audience, a channel partner, a marketplace, or a position inside software people already use, can matter more than product differences when the products are similar. Distribution isn't one of Helmer's seven powers by name; it tends to show up through scale economies, branding or counter-positioning. The deep dive is the AI distribution moat.

Network effects

True network effects are rarer in AI than the pitch decks suggest. They require that each additional user directly makes the product better for others, as in a marketplace or a shared protocol. Most AI products improve for everyone through shared learning, which Casado and Lauten classify as a scale effect. Some do have genuine ones, such as products where users share templates, agents or data with each other. See network effects for the underlying concept.

Brand and trust

For buyers handing an AI system their data, decisions or customer conversations, trust is a purchasing criterion. A reputation for accuracy, security and honest limits can justify choosing a vendor over a cheaper alternative. It's slow to build and fast to lose. Our page on AI trust and evaluation covers how startups earn it.

Regulatory and compliance position

In regulated fields such as healthcare, finance, legal and the public sector, certifications, audit trails and the experience of passing procurement can act as a barrier. A competitor with a better model still has to clear the same gates, which takes time. The risk is that compliance often becomes a baseline everyone eventually meets, and that rules change. Treat it as a head start, not a permanent wall.

Scale economies

Larger AI companies can sometimes spread fixed costs, negotiate better rates for compute, or invest more in evaluation and infrastructure. Whether that translates into a durable advantage depends on your cost structure, which differs a lot from software's near-zero marginal cost. See AI inference costs and gross margin for how the economics work.

Counter-positioning

This is the startup's special weapon. Per Helmer's definition, it works when you adopt a business model the incumbent won't copy because doing so would cannibalise its own. An AI-native vendor that sells completed work or outcomes can threaten a seat-based software incumbent whose revenue shrinks if customers need fewer licences. The incumbent can see it and still not respond. It's strongest early, and it fades once the incumbent has accepted the hit.

Comparing the Moats

The "typical strength" columns are a judgment framework, not measured data. Use them to start the conversation, then test each cell against your own market.

How to Assess Your Defensibility

A practical audit takes an afternoon and should be repeated each quarter.

1. List the claimed moats. Write down every reason you think a competitor can't take your customers. Most teams find three or four claims.
2. Apply the benefit-plus-barrier test. For each claim, write the economic benefit, such as lower cost, higher price or higher retention, and the specific barrier. "We have great data" fails. "We hold years of labelled outcomes from customers who contractually can't share them with rivals" passes.
3. Run the rebuild test. Imagine a competitor with your model access and ample funding. How long to match you, and what would they have to obtain that money can't buy quickly?
4. Check the evidence. Look for proof in your own numbers: retention by cohort, win rates against specific rivals, how often customers cite a reason for staying other than price.
5. Name the threat. Pick the strongest attacker, whether it's a model provider, an incumbent adding AI, or a well-funded startup, and trace how each moat holds up against that one.

Sequencing Moats Over Time

Defensibility is built, not present at launch. Helmer observes, as summarised by Think Insights, that different powers become available at different stages of a company's life: counter-positioning and cornered resource early, when the business model is still fluid, network economies, scale economies and switching costs as growth takes off, and branding and process power as the company matures.

For an AI startup, a sensible sequence looks like this:

• Launch: you have speed and, perhaps, counter-positioning. Use it to land your first customers before incumbents react. Expect little real defensibility.
• First customers: concentrate on workflow integration. Get connected to the systems and processes that make the product part of how the customer operates.
• Growth: start collecting data that is genuinely proprietary and measurably improves the product, and build the distribution channels that make acquisition cheaper than competitors' acquisition.
• Scale: invest in trust, compliance and brand, which compound slowly and are hard to buy quickly.

Two cautions apply. First, don't claim a late-stage moat in an early-stage pitch, because sophisticated buyers and investors will test it. Second, vertical focus often helps moats compound faster, because data, workflow and compliance all deepen when you serve one industry well. See vertical AI vs horizontal AI.

Competitive pressure still matters while you build. Porter's Five Forces is a useful check on whether buyers, suppliers or substitutes, including your own model provider, can squeeze the margin your moat protects.

How AI Defensibility Differs from Classic SaaS

Classic SaaS defensibility leaned on three things: a codebase that took years to rebuild, a customer base locked in by data entry and integrations, and sales machinery that competitors had to match. AI shifts each of them.

The codebase matters less. A working prototype that once took a team a year can now take a few engineers a few weeks, because the hard capability is rented. That shortens the head start a product gives you, so the moat has to come from somewhere else.

Lock-in changes shape. In SaaS, customers were locked in by stored records. In AI products, the lock-in is more often the accumulated configuration: the rules, evaluation sets, prompts and exceptions that teach the system how this particular customer works. That's harder to export than a spreadsheet, and it's a reason workflow depth matters so much.

Cost structure becomes part of the moat. Classic software has near-zero marginal cost, so scale economies mostly show up in sales and support. AI products carry real variable costs for every task, which means a startup that serves the same output more cheaply can price lower or keep more margin. That makes cost discipline a competitive weapon, not just a finance concern.

And the attack surface is wider. A SaaS startup mainly worried about other startups and incumbents. An AI startup also has to consider its own suppliers, since a model provider can move up the stack and compete directly. That's why the "which layer do we own?" question belongs at the top of any defensibility review.

Common Mistakes When Thinking About Moats

• Confusing a lead with a moat. Being six months ahead on features is a lead. A moat is the reason the lead doesn't evaporate when a rival catches up.
• Counting data you can't use. Collecting large volumes of interaction data doesn't help if you lack the rights to train on it, or if the data doesn't change output quality. Check both before putting it in a deck.
• Mistaking friction for lock-in. Making export difficult may raise switching costs in the short run, but customers who feel trapped leave at the first good alternative, and they tell others why.
• Building every moat at once. Spreading effort across brand, data, distribution and compliance usually produces none of them. Pick the one or two that fit your market and go deep.
• Treating the moat as finished. Every moat decays. Models improve, incumbents ship AI features, and regulation shifts. The audit above only works if you repeat it.

Putting It Together

Think of defensibility as a portfolio you assemble over time. Early on, counter-positioning and speed get you the first customers. Workflow integration then turns those customers into accounts that are costly to dislodge. Proprietary data and distribution compound during growth, and trust, compliance and brand take over as the long-term barriers. At each stage, the test stays the same: name the benefit, name the barrier, and be honest about how long it would take a well-funded rival to remove it.

Key Facts

• Origin of the moat idea: Warren Buffett wrote in his 1995 shareholder letter that he looks for "economic castles protected by unbreachable 'moats.'"
• Helmer's test: in his Acquired interview, Helmer names two necessary and sufficient conditions for power: a benefit and a barrier.
• Seven powers: scale economies, network economies, counter-positioning, switching costs, branding, cornered resource and process power, per the same summary.
• Models are converging: Stanford's 2025 AI Index reports the gap between the top and 10th-ranked models fell from 11.9% to 5.4% in a year.
• Data isn't automatically a moat: a16z's Casado and Lauten argue that data scale effects face rising acquisition cost and diminishing returns.
• Timing: counter-positioning and cornered resource become available early, switching costs and scale during takeoff, and branding and process power later.