Warren Buffett borrowed the image from medieval warfare: a castle surrounded by water, impenetrable from the outside. In business, the moat is whatever keeps competitors from eating your lunch — the network that grows more valuable with each new user, the switching costs that make leaving feel like surgery, the brand that commands a premium for reasons people can't quite explain. For decades, this framework served as a kind of diagnostic tool for investors and product builders alike. Build deep enough walls, fill them with enough water, and you could compound quietly for years. The question facing every product leader today is a simple, unsettling one: what happens when the enemy gets a boat?
Artificial intelligence is not merely a new feature to be added to the product roadmap. It is a systematic disassembler of the moats we built during the SaaS era. Research from Advisor Perspectives describes what they call "the commoditization of SaaS functionality" — as foundation models improve and costs fall, the barriers to replicating application features steadily diminish. An MVP that once cost $500,000 to build now costs $20,000. More troubling still, AI agents are beginning to bypass interfaces entirely, calling APIs directly and turning what were once multi-billion dollar platforms into, as one analyst put it, mere "data plumbing." The moat built on clever features, slick UX, or a proprietary algorithm is, in many cases, already gone.
And yet — and this is the part that gets missed in the panic — some moats are not just surviving this moment. They are widening. The research is consistent: defensibility in the age of AI has migrated away from the product itself and toward what surrounds it. The data flywheel, for instance, is the mechanism by which companies like Tesla and Stripe compound their advantage not through a product decision made in a boardroom but through the accumulated intelligence of millions of real-world interactions. Every Tesla on the road feeds driving data back into the model that improves every other Tesla. Competitors cannot buy that data, fabricate it, or catch up to it quickly — NFX research suggests a flywheel moat of this kind takes 18 to 36 months to reach defensible scale, and by then the leader is already on the next loop. Data alone isn't the moat; the feedback loop that continuously refines inference quality is.
The second surviving moat is one of the oldest in Buffett's original taxonomy: switching costs — but reimagined. In a world of interchangeable AI capabilities, the product that becomes the system of record for a customer's critical workflow does not need to be the cleverest tool in the shed. It needs to be the one that is so deeply embedded in how people actually work that removing it would cause more disruption than staying. Insight Partners calls this "workflow integration depth," and it explains why some legacy enterprise software companies still dominate despite being, by almost any aesthetic standard, objectively terrible products. The switching cost is not about the product's quality. It is about the cost of the migration, the retraining, the data transfer, the organizational memory stored invisibly inside the tool. Companies that are deliberately engineering for depth of integration rather than breadth of features are building moats that AI cannot easily dissolve.
There is a third category worth naming, one that feels less mechanical and more human: trust as infrastructure. The most defensible companies in regulated industries — healthcare, finance, legal — are discovering that compliance itself can function as a moat. Proactively achieving and marketing adherence to complex regulatory standards creates a barrier that a well-funded but newly arrived competitor cannot shortcut. More broadly, there is a kind of earned credibility that accumulates in categories where the cost of a mistake is high and where customers are, rationally, conservative. Domain expertise, paired with a track record, paired with proprietary data from years of operating in a specific field — this combination is genuinely difficult to replicate at speed, regardless of what the underlying model can do.
None of this means the old moats are dead across the board, or that every product is suddenly vulnerable. Network effects, where they are genuine and not merely a feature dressed up in the language of community, remain among the most powerful forces in business. But the lesson of this moment is that the moat has moved. It was, for a long time, inside the product — in the code, in the algorithm, in the interface. Increasingly, it lives outside it: in the data you own, in the workflows you are woven into, in the trust you have accumulated, and in the feedback loops that get stronger not because you decided they should, but because the business model demands it. The castle is still worth building. The water just comes from somewhere different now.
Sources and further reading:
- —Building a Moat in the Age of AI — Insight Partners
- —In the Age of AI, Moats Matter More Than Ever — Insignia Business Review
- —How AI Companies Will Build Real Defensibility — NFX
- —The Empty Promise of Data Moats — a16z
- —The Impact of AI on SaaS: A Risk Framework for Investors — Advisor Perspectives
- —The AI Flywheel: How Data Network Effects Drive Competitive Advantage — HGBR
