every pitch deck claims defensibility. usually the answer is either "we'll out-execute the competition," which is not a moat, or "we have a data flywheel," which is also usually not a moat, or "our tech is six months ahead," which is definitely not a moat. after spending a lot of time looking at startups, i've come to believe there are really only three kinds of durable defensibility in software businesses, and most pitches that claim a moat don't actually have one of the three.
the first is network effects. the product gets more valuable as more people use it. facebook, uber, airbnb, openai's model at some level — the value of the thing is a function of who else is on it. this is the strongest moat when you have it, because it's self-reinforcing: as you grow, the thing becomes better, which makes it harder for a competitor with fewer users to offer a comparable experience. the gotcha is that many pitches claim "network effects" when what they actually have is a network — a customer base — without effects. a saas tool with 10,000 customers is not a network effect; it's just customers. the test is: does each additional user make the product more valuable for existing users? if no, you don't have network effects. you just have traction.
the second is switching costs. the customer becomes too expensive to migrate. this is the moat for almost every enterprise saas company. you build a workflow around a product, integrate it with five other tools, train your team on it, accumulate historical data in it, and now the cost of switching is months of lost productivity plus a migration project nobody wants to own. most enterprise software is defensible not because the product is exceptional, but because the act of moving to a competitor is worse than the act of tolerating a merely-adequate incumbent. the version of this most founders underestimate is data gravity — once a lot of the customer's operational data lives in your system, they have to either export it or rebuild it elsewhere, and most of the time they'd rather pay you.
the third is economies of scale. you do the thing at a unit cost lower than anyone smaller can. this moat is common in infrastructure, less common in software, and genuine in the subset of software businesses where big capex or big data is required to compete. aws has this. anthropic and openai have it, to varying degrees, in training compute. most consumer saas companies do not. scale-based moats are real when the fixed costs of operating are large relative to per-user revenue — if doubling customers means you can cut prices 40% and still make more money, you're scale-defensible.
that's it. network effects, switching costs, economies of scale. i have looked very hard at pitch decks for a decade and i don't think i've seen a fourth that actually holds up under pressure. the things people claim as a fourth moat are almost always collapses of one of the three with different names. "brand" is sometimes a real moat, but only when it produces lower cost of acquisition at scale — which is an economy of scale. "regulatory capture" is a real moat, but it's usually a switching cost (customers are locked in by their own compliance needs) or a scale moat (only the biggest player can afford the regulatory team). "talent" is not a moat; you can't lock up the market for engineers, and even the most impressive team loses people over a decade.
the "tech is ahead" argument deserves its own paragraph because it's the most common mistake i see. in software, a technology lead of six months is usually a technology lead of six weeks once the other team sees what you did. building things takes time; copying things people have publicly demonstrated takes much less time. the only technologies that stay ahead are the ones that benefit from one of the three moats above — the ones that compound with scale, or lock in switching costs, or build a network. absent one of those, a technology lead erodes. you see this especially in ai, where every capability demonstrated publicly gets replicated by competitors within a few months. being six months ahead on capability is not a business; it's a press release.
the practical use of this taxonomy is as a diagnostic. if you are building a company, identify which of the three you're aiming for. be honest. if the answer is "none of them, but we'll out-execute," you are building a consulting firm with saas pricing, and you should plan accordingly — cash flows fine, but eventually a better-funded competitor copies your product and out-executes you. if the answer is "one of them eventually, if we grow," that's normal and reasonable; most companies are like that. but you have to know which one you're heading toward, because the moves that build network effects are different from the moves that build switching costs, and founders who aren't explicit about the target often end up with neither.
the short version: almost nothing is a moat. the things that are moats fall into three buckets. founders who are honest about which bucket they live in, if any, tend to build companies that survive. founders who confuse "we are growing" with "we are defensible" tend to wake up two years in to find that their moat has drained.