The Only Moats That Survive AI

The Question Has Changed

Most people have not.

For decades, the dominant question in competitive strategy was: what is hard to build? Patents, engineering teams, integrations, proprietary algorithms. These were the barriers that protected revenue. Build the thing first, scale it faster than anyone else, and the cost of replication was your moat.

AI has made that question obsolete.

The new question is simpler and more brutal: what is hard to get?

The distinction matters because artificial intelligence compresses the time required to replicate intelligence, not the time required for physics to happen, humans to adopt, regulators to permit, or capital to compound. When you understand which side of that line your business sits on, everything else becomes clearer.

The Core Diagnostic

Investor Michael Bloch frames this as a filter that every founder and operator should run against their own business model:

"If your moat is bottlenecked by intelligence, you are on borrowed time. If it is bottlenecked by years, by human behavior, by physics, by political will, by capital, you are probably building something that lasts."

This is not pessimistic. It is architectural. The businesses that will hold defensible positions through the next decade are not the ones that build the best software. They are the ones that have already accumulated something that software cannot replicate.

Five categories of defensible position survive the AI compression wave. All five share a single common denominator: they required real-world elapsed time to accumulate, and no amount of intelligence accelerates that clock.

Position 1: Compounding Proprietary Data

The crucial word is compounding. Static datasets, no matter how expensive to assemble, become synthesizable. A competitor can approximate them with enough compute. The data that remains defensible is living data generated continuously through operations that have their own independent value.

The clearest example: an agricultural AI company mounts cameras to farm equipment and tracks billions of individual fruit across millions of trees across multiple growing seasons. Every pass through an orchard makes the model smarter. A competitor cannot replicate this by training on public data. They would need to drive the same cameras through the same orchards for years. The data advantage grows every season.

For clients in PEPS Ventures' portfolio, this maps directly. PEPS Ventures generates transaction-level data on Malaysian property valuations, deal structures, and counterparty behavior through every engagement. That dataset regenerates continuously. A competitor can build the same software product in months. They cannot replicate three years of transactional data without waiting three years.

The test for your business: does your data compound through operations, or does it have a collection date?

Position 2: Network Effects

Every additional participant makes the product more valuable for every existing participant. The defensibility is not in the software but in the density of the network itself.

What AI changes here is not the principle but the competitive intensity: it is now trivial to build a well-made competitor. That means a hundred alternatives are fighting to bootstrap the same network. Whoever already has liquidity compounds. Everyone else competes for scraps at the margin.

DoorDash is the canonical example. Cloning the app takes days. Cloning the driver population, restaurant catalog, customer base, and delivery density across thousands of cities takes years. The network liquidity, not the interface, is the asset.

The implication for smaller operations: if you have network liquidity, protect it. If you do not have it yet, be clear-eyed about how long it will take to reach the threshold where the network sustains itself. AI reduces the time to build. It does not reduce the time for users to adopt, trust, and integrate a network into their workflows.

Position 3: Regulatory Permission

Governments move at the speed of politics. AI moves at the speed of inference. The gap between those two velocities is a moat.

Procurement clearances, professional accreditations, banking licenses, spectrum rights, classified contracts, and industry certifications are all permissions that take years to obtain and cannot be accelerated by software. The surface area of regulation is expanding, not contracting, as AI capabilities increase and the stakes of AI-driven decisions grow higher.

For Malaysian operators: LPPEH accreditation, Bank Negara licensing, and NAPIC data access agreements are all forms of regulatory permission that function as structural barriers. A competitor can match your software capability in months. Replicating your regulatory positioning takes years of relationship-building, compliance track record, and demonstrated institutional trust.

The form of regulation changes constantly. The requirement for human institutional permission is unlikely to disappear. If anything, the more powerful AI becomes, the more valuable the institutional wrapper that holds accountability when something goes wrong.

Position 4: Capital at Scale

When the bottleneck shifts from software to atoms, the ability to deploy capital at massive scale becomes definitional. Chip fabrication plants cost tens of billions of dollars. Nuclear plants cost comparable amounts. Satellite constellations require similar investments. These physical systems cannot be simulated into existence.

Capital at scale is not only about the largest ventures. It operates at every level where physical assets are required. The pattern is the same: the first mover to start building gains a lead that grows every month a competitor remains unable to deploy.

For embedded executives and advisory practitioners: capital access at scale also means the institutional trust and track record that unlocks capital at favorable terms. Building that track record takes a career, not a sprint. The consultant who has seen thirty restructurings can access capital conversations that a smart new entrant cannot, regardless of how good their AI-assisted analysis is.

Position 5: Physical Infrastructure

Factories. Power plants. Battery networks. Data centers. These cannot be manufactured, installed, and interconnected at scale in weeks or months.

AI can design the system in a day. It cannot manufacture thousands of units and deploy them across a geography in a comparable timeframe. Physics sets a floor on timelines that intelligence cannot break through. The first mover to start building gains a lead that grows every month a competitor remains in the planning phase.

This is obvious for capital-intensive industries. It applies in less obvious places too: an advisory firm with ten years of documented engagements, a property firm with a twenty-year transaction history in a specific corridor, a data company with physical survey equipment already deployed across a geography. These are all forms of physical and institutional infrastructure that took years to assemble.

The Meta-Pattern

These five positions look different on the surface. The underlying structure is identical.

Time that cannot be parallelized is the meta-moat underneath all five. Network density takes years of human adoption. Regulatory permission takes years of political process. Infrastructure takes years to build. Data takes years of compounding. Capital relationships take decades to earn.

A company that already holds one of these positions is not merely defending. It is pulling further ahead every day because the head start is the moat itself.

This is why the question "what is hard to get?" is more durable than "what is hard to build?" Hard to build is a function of engineering cost, which AI is collapsing. Hard to get is a function of elapsed time, human behavior, and physics, none of which AI compresses.

The Diagnostic Tool

Run your business or your clients' businesses through these four questions.

Which of the five positions does this company hold? Score each: strong, moderate, weak, or none. Be honest. "We have proprietary data" is not enough. The question is whether it compounds continuously through operations.

Which position is the weakest? That is the moat most at risk from AI compression. The business that relies on workflow embeddedness or technical complexity as its primary defense is exposed. The question is not whether that moat will erode, but how fast.

Is the moat temporally brittle? A moat that depends on regulatory stability or current AI capability limits is a three-to-five year position, not a ten-year position. Name the assumption, set a review date.

Can you acquire a missing position, or is it structurally inaccessible? Some positions can be bought: physical infrastructure can be acquired, capital relationships can be inherited through partnerships. Others cannot: network liquidity requires organic adoption, regulatory permission requires a track record. Know which is which before designing your strategy.

What This Means for the One-Person Company

Solo operators and small advisory practices face an interesting version of this question. Most of our assets are not the five defensible positions above. We do not hold bank licenses or own satellite networks.

What we do hold: a compounding body of work, a network of clients who trust our judgment, and a track record in regulated contexts that new entrants cannot replicate quickly.

The one-person company's moat is a combination of compounding proprietary knowledge, pattern recognition developed over hundreds of engagements, network effects at the professional level through referrals and access to conversations that require trust, and regulatory permission in the form of professional credentials and institutional relationships.

These are not as powerful as a large manufacturer's infrastructure. They are real and they do compound.

The risk is treating them as permanent. AI is compressing the intelligence layer of advisory work. Analysis that took ten hours now takes one. The moat is not the analysis. It is the judgment, the relationships, and the institutional accountability that sits above the analysis.

If you are building your practice on "I can do better analysis than my competitors," you are building on sand. If you are building on "I have the relationships, the track record, and the institutional accountability that clients need when stakes are high," you are building on rock.

This is precisely where Scope Compression and 0→1 becomes relevant: AI compresses execution time, which means your defensible value must live in the judgment that precedes execution, not in the execution itself. And it is why How I Run 0→1 Product Sprints leads with positioning before process.

The question is not whether to use AI. It is whether you are using AI to reinforce your durable positions or to paper over the absence of them.