In May 2025 I wrote a piece called Seven Moats VCs Should Demand from AI Startups: How to Outrun Sherlocking. The argument was that a lot of founders were building businesses around capabilities OpenAI and Anthropic could reproduce in an afternoon, investors were funding them anyway, and the sensible question to ask was what happens to your business the morning after the platform ships your feature. I ended it with four words. Fund assets, not features.
Seventeen months on, my X feed is full of the same debate. Proprietary data, distribution, trust, brand, switching costs, network effects. Harry Stebbings is running episodes titled “Why Moats in AI are BS”. SignalFire says early-stage moats are mostly hallucinations and you earn them by doing the work. YC has rebooted Hamilton Helmer’s Seven Powers and added an eighth, speed. The Australian VCs at SXSW said hardware and velocity.
I still think the seven were sensible, and the founders who spent the last seventeen months building actual advantages rather than adding features will be in better shape than the ones who didn’t.
But I’ve spent most of the last year building AI systems myself, and that has changed what I think the threat is. “Can OpenAI copy my app” is now a fairly pointless question. Of course it can. The better one is why your business keeps winning customers when everyone has the same models, and increasingly the same tools.
The seven moats. What still holds?
I’d still use all seven when looking at a startup. I’d just be a lot more demanding about what counts.
Proprietary data. Probably the strongest, provided it is actually proprietary and actually useful. I’ve seen plenty of decks describing a million scraped websites in a vector database as a proprietary asset. It isn’t, somebody else can scrape them too. What interests me is information that is hard to collect, verify or reproduce: transaction histories, customer behaviour, relationships between companies and people, decisions and what happened afterwards. And it has to improve something. If your data doesn’t produce better results than what everyone else has, I’m not sure what the moat is.
Know-how. Expertise matters, but a competitor can hire experienced people too. A fund manager who spent twenty years learning to assess risk is valuable, what’s interesting is whether that knowledge has been captured, tested against outcomes and turned into something repeatable that improves. If your expertise is a prompt telling ChatGPT to act like an experienced investment banker, good luck.
Distribution. I’d weight this more heavily today. If building software keeps getting cheaper, acquiring customers becomes the bigger part of the problem. But 50,000 followers is not a distribution moat. Show me CAC, how many pay, what they pay and how long they stay, and tell me who owns the relationship. If most of your customers arrive through somebody else’s platform you have bugger all pricing power.
Brand and trust. More important as agents move from producing information to doing work. A bad report can be corrected. An agent that sends the wrong instruction to a supplier or makes an unauthorised payment is a different problem, and customers will want to know what the agent is allowed to do, what it did and who is responsible. A SOC 2 badge and a few logos don’t create that. Does the customer trust you with something that matters, and does it change who they buy from?
Embedded workflows. One of my stronger arguments in 2025 and the one I’m now least sure about. SaaS businesses made a fortune from being wired into customer records, processes and staff training, sometimes deliberately so. Agents could remove a lot of that. If an agent can migrate the records, reproduce the workflows and connect the competing service without anyone retraining, part of the switching cost goes. I haven’t seen it done at scale yet, I expect to. I’d rather own a business customers stay with because it keeps delivering than one they stay with because leaving is a nightmare.
Regulation. Still real in financial services, healthcare, defence. But spending £300,000 on lawyers and certifications creates a bill, not an asset. Which licences or approvals would a competitor actually struggle to get?
Real-time context. The one I’d change most. In 2025 I argued that live information a foundation model can’t see is an advantage. Connecting models to live data has got easy, so the feed itself isn’t worth much. Knowing what the information means for a particular customer, what should be done and whether that decision worked last time is where the value sits. Which is the thing I underweighted in the original piece, and I’ll come back to it.
Sherlocking was the small version of the problem
My original article was about Sherlocking, where the platform ships a feature an independent developer spent a year building. OpenAI adds something to ChatGPT and a startup charging for the same thing has a problem. That hasn’t gone away, it’s got worse.
But the platforms don’t need to copy every application any more. OpenAI and Anthropic are building systems where an agent uses external applications as tools, pulls capabilities from several providers and completes a much larger job. MCP is part of this. OpenAI has been doing the equivalent with its own connectors.
So you’ve built a good research tool, or a prospecting tool, or something that reads financial statements. An agent calls your service when it needs that capability, combines the result with two other tools, finishes the task, and the customer never opens your application. Next time it might call a competitor. Eventually it might do the job itself. Your product can be the best in its category and you’ve still gone from owning the customer relationship to supplying a replaceable capability. The platforms don’t need to copy your application if they can make it another tool in a bigger system.
Supplying services to millions of agents could be a perfectly good business. I’d just want to know who controls access, how the agent picks you, what you get paid and what happens when somebody offers the same result for half the price.
This is also why I keep saying SaaS is dead and Services as Software is replacing it. I’ve written that piece already and won’t repeat it, but the short version is that salespeople won’t open the CRM, find the record, update the opportunity and prepare the report. An agent retrieves the records, researches the customer, writes the proposal, calls whatever specialist tools it needs, updates the CRM and schedules the follow-up. The system of record stays, somebody has to keep the records, permissions and audit trail honest. The interface and the human seat mostly go. The vendor gets paid for transactions, API calls or outcomes instead of seats, and might even earn more if the volume of automated work goes up, but the pricing power that sat in the application interface is now up for grabs. Salesforce can see this, which is what Agentforce is.
The fight moves to who controls the orchestration, the records, the specialist services and the customer. And I wouldn’t assume the orchestration layer is permanently defensible either. If agents and the models underneath them become interchangeable, the same pressure applies there.
What does your business actually accumulate?
The fashionable answer right now is speed. Ship faster than the other bloke, keep shipping, and the moat is that nobody can keep up. Higgsfield says it went from $1m to $1bn of annualised run rate in eighteen months, which is the last four weeks of revenue multiplied by thirteen, and its CEO went on 20VC to say moats in AI are BS. YC calls speed the eighth power.
I think speed is necessary and on its own a bloody awful moat. If the speed is shipping code, everyone rents the same coding agents from the same three suppliers and the moment a competitor with more money or a better model turns up you’re level again. Speed of selling, learning and deciding is a better argument, a team with identical tools can still execute twice as fast, and if that lets you accumulate customers and knowledge before anyone catches up then fine, it compounds. But that’s the point. Speed is worth something because of what it lets you accumulate. Moving twice as fast while building nothing defensible just shortens the time until somebody catches you.
Which is the thing I underweighted in May 2025. The question I’d now put first is what your business accumulates each time it does the work, and whether that makes it better at doing the work again. Being hard to copy isn’t enough. A competitor with a sharper model or a better process can beat you without your history, so the history has to show up in the numbers.
Take two companies selling AI-powered sales outreach. Both can find prospects, research them, write the email and run the campaign. One does that perfectly well. The other also keeps a record of why those prospects were chosen, what was sent, how people responded, what objections came back and what actually turned into revenue. Over time it might understand which approaches work for which markets, customers and products.
I say might because collecting data is not learning from it. There’s an awful lot of rubbish talked about data flywheels. Logging every interaction and drawing arrows on a slide doesn’t mean you’ve built one. The cleanest example I know is card fraud. Visa and Stripe have seen billions of transactions and what happened after each one, which is information a new entrant simply hasn’t got, and used properly it means fewer fraudulent transactions getting through and fewer good ones being declined. Both of those are money. The engineering and the models matter too, I’m not pretending the data does it on its own. But that’s the kind of evidence I’d want from an AI business: does conversion go up, do mistakes go down, does CAC fall, and could a competitor get the same result without the history?
This is what we’re wrestling with building Arthur, our AI co-founder. I don’t want another system that produces a business plan, a deck and a marketing strategy and then forgets most of what happened. I want it to know the founder’s business, keep the relevant information, record the decisions, do the authorised work and track what came of it, then use that to do better next time. Fundraising is the obvious case. Any competent system can list investors and draft outreach. Knowing which investors were approached, why, what came back, what objections were raised and which approaches led to meetings or cheques is considerably more useful, especially if the history actually improves the next round of decisions. Whether that becomes an economic moat I can’t prove yet. We’re building the capability, which is not the same thing.
And there’s an ownership point I’d put in front of any founder. The customer’s information belongs to the customer. They should be able to see it, correct it and take it elsewhere. A business shouldn’t need to hold the data hostage to be valuable. What should be worth something is the systems, the validated knowledge and the accumulated experience of having done this a thousand times, which is what lets you deliver a better result than someone starting cold.
Who else gets to orchestrate
All of that assumes the orchestrator sits in a cloud platform. I don’t think it has to. I don’t think we keep sending every AI task to an enormous model in an enormous data centre.
Smaller models already run on consumer hardware, they’re improving, and the hardware is improving with them. Most everyday work doesn’t need the frontier model. Sorting email, filing documents, extracting fields, classifying transactions, remembering preferences, deciding which tool to call. And some of it doesn’t need a language model at all. If I want a portfolio’s exposure, a reconciliation or a tax calculation I want deterministic code doing the sum, the model just has to understand the question and pick the function.
So I can see personal agents running locally on the laptop and the phone, using small models for the routine work, calling a specialist model or service when needed and reaching for the big cloud model only when the task actually warrants it. That changes the privacy picture too. If the agent reads, organises and analyses locally, the documents, financial records and correspondence don’t need to leave the device. The agent sends a specific request out, not the whole conversation. (It still has to be built properly. A local agent calling external APIs can leak just as well as a cloud one.)
And it changes the orchestration question. If the intelligence on your own device can coordinate the work, choose the model and pick the service, why should one cloud platform control the whole process? Your agent becomes the orchestrator, deciding what stays local, which model is good enough for which task and which external service gives the best result. That weakens the SaaS vendor and the cloud AI platform at the same time.
I’d add one caveat, because it’s the bit I’m least sure about. Inference moving onto the device doesn’t automatically hand control to the customer. Whoever owns the operating system, the permissions, the default agent and access to the other apps on the device is in a very strong position, and that is Apple, Google and Microsoft. The power may simply move from the cloud AI platforms to the device ecosystems. Either way, if customers can choose models, agents can choose services and much of the processing runs on hardware the startup doesn’t control, the question of what an AI startup actually owns gets harder, not easier.
What I’d ask a founder today
The diligence questions from the original piece need updating.
Why do you keep winning customers when your competitors have the same models and tools?
Cheaper acquisition, better results, stronger relationships, better information, better margins. Which, and why does it persist?
What improves as you grow?
More customers and more transactions aren’t a moat on their own.
Does the extra activity make the product better, cut the cost or strengthen distribution, or are you just sending more requests to somebody else’s model?
Where do you sit in the agent economy?
Do you own the customer, provide a specialist service, hold the authoritative record or orchestrate the work?
What happens when an agent starts calling a competing service?
And if you’re building the orchestration layer, why should anyone keep using yours?
How much of your business do you control?
Can you change model provider? Who controls distribution?
How dependent are you on one cloud, one platform, one data source, and what happens when one of them doubles its price or starts competing with you?
What would it cost to compete with you successfully?
Not to rebuild the software, that’s a month. To acquire comparable customers, establish the trust, reproduce the useful information, deliver the same outcomes at the same margins. A competitor can clone your app in a month and still need years to build the business. Equally you might have spent three years on something a new entrant can now sell profitably in a few weeks. Money already spent is not a moat.
And I’d want the numbers behind all of it. Gross margin, retention, CAC, capital requirements and how each moves as the business grows. A brilliant product and a business that makes money are different things.
And for investors
I’ve written before about the parallel with the telecoms build-out, so briefly. Global Crossing went bust in 2002 with around $12.4bn of debt. It was right about demand for connectivity and disastrously wrong about what it could charge for capacity. The fibre survived. ST Telemedia ended up paying $250m for 61.5% of the reorganised business (Hutchison Whampoa was in the original deal and pulled out in 2003) and the original shareholders got nothing. AI infrastructure has the extra complication that fibre lasts decades and a GPU can be commercially obsolete while the debt that financed it is still outstanding.
Now add smaller models, better algorithms and local inference pulling the compute per task down. AI usage can grow enormously while the cost of the average task falls just as hard. That doesn’t mean cloud demand drops, cheaper inference will create a lot more usage, particularly once agents run continuously. But the link between demand growth and infrastructure returns gets a lot messier, and the same applies up the stack. If agents use interchangeable tools and cheap models handle the routine work, who captures the economics? The model labs, the infrastructure owners, the specialist services, the agent platforms, or the customer? I suspect the customer takes a large slice of it, which is wonderful for productivity and less wonderful for anyone paying today’s valuations on today’s pricing.
So I still stand by fund assets, not features. I’d just be far more careful about what counts as an asset, particularly if its value depends on controlling an interface, access to a model or a capability an agent can get somewhere else. And I’d be very wary of paying a premium for something because it looks hard to reproduce today. In AI, today isn’t a long time.
Go take a look, For the ❤️ of startups
Scout - who just got funded
Newly funded startups, pre-seed to Series B, as the rounds happen.
Raise - who’s deploying
New funds with fresh capital and cheques to write.Wire - what changed, what matters
The intelligence feed that filters the noise, with the “so what” attached.
If you have not joined the Fusion42 Community on Telegram —
it is probably time to do so.
For the ❤️ of Startups
✌🏼 & 💙
Derek
Thank you for reading. If you liked it, share it with your friends, colleagues and everyone interested in the startup Investor ecosystem.
If you've got suggestions, an article, research, your tech stack, or a job listing you want featured, just let me know! I'm keen to include it in the upcoming edition.
Please let me know what you think of it, love a feedback loop 🙏🏼
🛑 Get a different job.
Subscribe below and follow me on LinkedIn or Twitter to never miss an update.