Which AI Businesses Have Defensible Moats? A Founder's Self-Test

Which AI businesses have defensible moats? Very few. Most have a demo, early revenue, and a system prompt they mistake for a wall. The model is not your moat, because you and every rival rent the same foundation models from the same handful of labs. Raw capability commoditizes the day a new release ships.

Durable advantage lives somewhere a model cannot reach. This is a self-test for founders who want an honest read, not a pitch-deck answer. It walks five testable sources of defensibility, scores you on each, and names the way founders most often fool themselves. Clear the wrapper gate first. Then find the two moats that compound in your vertical.

The model is not your moat

Every founder building on AI rents the same engines. You call an API, your competitor calls the same API, and the weights that make the output good were trained by someone else. That capability is real, and it is rented. Anything you can do with a base model and a clever prompt, a competent team can reproduce in a weekend.

Andreessen Horowitz, surveying the generative AI stack, reached a blunt conclusion. There were no systemic moats, and the usual candidates did not look durable. The labs that invented the technology have struggled to hold pricing, and the application layer has struggled to hold users. If the frontier is shared, the frontier cannot be your advantage.

So the question is not how good your model is. It is what you own that the model does not. If your entire product is a thin interface and a system prompt over a public API, you have built the null hypothesis, not a wall, and clearing the AI wrapper trap is step zero. Hamilton Helmer's 7 Powers names the conditions a rival cannot cheaply copy. Four translate cleanly to AI: network economies, a private resource, switching costs, and process power. Here is how to test for each.

Data network effects, not a one-time dataset

A static dataset is a stock, and stocks decay. The corpus you scraped this quarter is scrapeable by the next team, or buyable from the same broker. A data network effect is a flow. Each customer's usage measurably improves the product for the next customer, so the advantage compounds while you sleep.

NfX draws the line cleanly. Data scale is linear and asymptotes quickly. A genuine data feedback loop is nonlinear and produces increasing returns. Waze is the canonical case, where every driver's location sharpens routing for every other driver in real time. The test is interdependence. Does user N plus one benefit from users one through N in a way a new entrant cannot simply buy?

For a vertical AI company, that is the line between a demo and a compounding machine. When corrections, edge cases, and outcomes flow back and make the next inference better, a rival who starts today cannot catch up by spending money. They would have to buy your years of accumulated usage, and that is not for sale. This is the mechanism behind data network effects in vertical AI.

Domain evals: proof of what correct looks like

In a regulated vertical, the moat is not knowing the answer. It is knowing what correct means and being able to prove it. A private, growing benchmark of domain-correct outputs, graded by real experts, is an asset a competitor cannot download.

This is why practitioners now treat evals as a competitive asset. Y Combinator's Garry Tan has called them an emerging moat for AI startups. When the base model changes every few months, the company with a trusted eval set ships the upgrade the day it lands, because it can measure whether quality rose or fell. The company without one guesses, and in law or insurance or health, guessing is a liability. Your eval set encodes expertise your rivals never thought to capture.

It compounds with the data loop too. Every corrected output is both a training signal and a new test case. Build the private benchmark and you get safer upgrades and a widening record of exactly where the domain is hard. That is the case for treating domain-specific evals as a moat.

Regulatory complexity as a wall

In Brazil the compliance surface is not a footnote. It is a wall. A product that touches personal data answers to the LGPD and its enforcer, the ANPD, which now runs inspections and levies administrative sanctions. Add sector regulators, a tax regime with few equals in complexity, and judicial procedure that shifts from court to court, and the surface area is enormous.

Encoding all of that correctly is a multi-year effort, and that is the point. Complexity a foreign entrant treats as pure cost is, to an operator who has lived it, a barrier. A well-funded outsider can copy your interface. It cannot copy ten years of knowing which filing fails on which technicality. The regulation is not the obstacle to the business. It is the wall around it.

This moat is quiet because it is unglamorous. Nobody demos their tax logic. It is durable precisely because it is boring, specific, and painful to reproduce, which is the argument for treating Brazilian regulatory complexity as a moat.

Taste: the judgment a model can't copy

When capability is rented and commoditized, judgment becomes the differentiator. Taste is what to build, what to leave out, and how the workflow feels to someone who does this job all day. It is the hardest of the five to copy, because it is not in the training data.

You see taste in the negative space. Two teams ship the same feature on the same model. One gives a domain expert three moves they did not know they wanted. The other buries the real job under settings. The base model is identical. The product is not. That gap is accumulated judgment, not a prompt.

Taste is also the least defensible if you coast, because it has to be renewed with every release. That is why it pairs with the others rather than standing alone. When an actuary or a lawyer looks at the product and says this was clearly built by someone who understands my work, that is the signal that taste is the moat once the model is a commodity.

Which AI businesses have defensible moats? The self-test

Start with the gate, because if you fail it nothing else matters. The wrapper check is pass or fail. Strip away the base model and the public API. Is there anything left that a competent team could not rebuild in a weekend? If the honest answer is no, you do not have a moat yet. You have a head start, and you should fix that before scoring anything else.

If you pass, four real moats remain, each scored from zero to two. Before you tally them, be honest about how founders fool themselves here. The biggest self-deception is confusing traction for a moat. Early revenue from being first is not defensibility. It is an invitation to be cloned. A proprietary dataset everyone can also buy or scrape is not proprietary. Workflow lock-in you claim but your customers do not feel is not lock-in.

Do not chase a perfect eight either. Real defensibility almost always stacks two of these, compounding inside one specific vertical, rather than spreading a thin layer across all four. The classic regulated-vertical-AI moat is three at once, where data network effects, domain evals, and regulatory encoding each make the others harder to copy. And no moat is permanent, so the work is widening the two you pick, on purpose.

Here is the scored checklist. Give yourself zero to two on each.

• Network effects. Does user N plus one benefit from users one through N in a way a new entrant cannot buy? Score zero if the data sits static, two if usage compounds.
• Evals. Do you hold a private, growing eval set of domain-correct outputs? Score zero if quality is vibes, two if you can prove correctness and upgrade models safely.
• Regulation. Does the product embed regulatory or procedural knowledge an outsider would need years to replicate? Score zero if it is generic, two if it encodes hard-won compliance.
• Taste. Would a domain expert say this was clearly built by someone who understands their work? Score zero if it feels generic, two if it feels inevitable.

How Avante builds defensibility on purpose

Avante Ventures is a venture studio building AI-native companies in Brazil and Latin America, and the whole model is to engineer these moats from day one rather than hope for them. The recurring pattern across the portfolio is a copilot to data to fund flywheel. Build an AI copilot that generates proprietary data, then use that data to raise and deploy capital. That is a data-network-effect engine by design, not by luck.

Brazil makes the regulatory and eval moats unusually deep. Services dominate the economy and software penetration is still low, so the ground to digitize is wide. Pair that with a dense regulatory surface and foreign entrants cannot parachute in. The depth comes from operators with ten or more years of Brazilian-market scar tissue, which is exactly where taste and regulatory encoding come from.

The six-stage system reads as a moat-construction sequence. Research and Partner pick a vertical where these moats can be built. Build and Traction instrument the data flywheel. Revenue and Compound widen it. With $500K to $1.5M deployed per venture, three to four ventures a year, and co-founder economics, the studio can fund the unglamorous eval and regulatory infrastructure a lone founder racing to a demo skips.

Venture studios have historically outperformed traditional venture capital, and building defensibility on purpose rather than hoping for it is a large part of why. The model is not the moat. The system that manufactures moats is. That is the logic behind the Avante studio thesis.

Frequently asked questions

Is a proprietary dataset a moat for an AI startup?

Not by itself. A static dataset is a stock that decays, and rivals can often buy or scrape the same thing. It becomes a moat only when it turns into a flow, where each customer's usage improves the product for the next in a way a new entrant cannot purchase. Interdependence is the test, not size.

Does being first to market give an AI company a moat?

No. Early revenue from being first is traction, not defensibility, and traction invites cloning. If a competent team can rebuild your product in a weekend on the same base model, your head start is a lead you have to defend, not a wall. Use the lead to build a real moat before someone copies you.

What is the strongest moat for a vertical AI company?

Usually a stack, not a single power. The durable pattern in regulated verticals is data network effects plus domain evals plus regulatory encoding, working together so each makes the others harder to copy. Two compounding moats in one specific vertical beat a thin layer of all five. Pick the two that fit your market and widen them.

Are evals really a competitive moat, or just testing?

They are a moat when they are private, domain-graded, and growing. A trusted eval set lets you ship model upgrades the day they land, because you can prove whether quality rose or fell. Competitors without one guess. In regulated fields, that eval set encodes expertise rivals lack and cannot quickly reproduce.

Why is the foundation model not a moat?

Because you rent it, and so does everyone else. You and your competitor call the same API and use weights trained by someone else, so raw capability commoditizes with each release. Andreessen Horowitz put it bluntly: there do not appear to be systemic moats in generative AI. Advantage has to come from what the model cannot reach.