Moats Aren't Built — They're Recognised Too Late

There's a conversation that happens in almost every Series A board meeting, and it almost always arrives too late.

Someone — usually an investor, occasionally a new hire with a strategy background — asks the question: "What's your moat?" The founding team looks at each other. Someone mentions the product. Someone else mentions the customer relationships. A third person says something about the data. The conversation moves on, because there's a pipeline to review and a Q3 target that isn't going to hit itself.

Six months later, a well-funded competitor launches something that looks uncomfortably familiar.

This is not a story about bad founders. It's a story about a category error that most early-stage companies make — confusing traction with defensibility, and assuming the former will eventually produce the latter. It won't. Not automatically.

Traction is evidence that people want what you've built. Defensibility is evidence that they can't easily get it somewhere else. These are related but they are not the same thing, and the decisions that produce one do not automatically produce the other.

Consider Notion. By 2022 it had extraordinary traction — millions of users, genuine love, viral growth inside organisations. It was, by every early-stage metric, winning. But the core product was also structurally thin. A sufficiently motivated competitor with comparable design sensibility could — and did — attempt to replicate the experience. Linear, Coda, Obsidian, Confluence's continued investment: the category filled quickly because the switching costs were low and the workflow depth was shallow. Notion grew fast and was, for a period, genuinely replaceable.

Compare that to Veeva Systems. Founded in 2007 as a pharmaceutical CRM built on Salesforce's infrastructure, Veeva looked like a niche software bet for the first several years. It wasn't growing as dramatically as the B2C darlings of the same era. But it was making decisions — embedding into regulatory workflows, obtaining FDA compliance frameworks, building a content management layer that pharmaceutical companies needed to manage clinical trial submissions — that were making it progressively harder to leave. By the time competitors noticed what Veeva had actually built, the switching cost was not inconvenience. It was regulatory jeopardy. Replacing Veeva meant revalidating systems, retraining teams, and risking compliance exposure on live drug submissions. Veeva now holds over 80% market share in its core segment. Salesforce — with vastly more resources — has launched a Life Sciences Cloud to compete with it. The gap has not meaningfully closed.

The difference between Notion's early position and Veeva's is not product quality. It's structural depth. One was growing fast and remaining replaceable. The other was growing more slowly and becoming progressively harder to displace.

Ask most founders when they built their moat, and they'll describe it in the past tense. It emerged. It accumulated. It wasn't designed so much as discovered — and often only made visible by the first serious competitive threat.

“The complexity that looked like a liability was the moat.”

This is partly because genuine defensibility doesn't look like defensibility while you're building it. It looks like doing things the hard way.

Toast is a good example. The restaurant management platform launched in 2011 into an extremely competitive point-of-sale market. The decision that would later define its structural position — building hardware-plus-software-plus-payments as an integrated stack rather than staying pure software — was operationally brutal. Hardware slows everything down. It requires physical installation, inventory management, and a support infrastructure that pure SaaS companies don't need. Many observers thought Toast had overcomplicated the product unnecessarily. What they'd actually done was make switching to a competitor a physical act — you have to rip out terminals, retrain staff, and migrate payment infrastructure simultaneously. By 2025, over 156,000 restaurant locations ran on Toast as operational infrastructure. The complexity that looked like a liability was the moat.

The inverse is visible in the history of productivity tools. Slack grew faster than almost any B2B product in history. At peak adoption it was embedded in tens of thousands of organisations. But its structural position was always softer than the metrics suggested. When Microsoft bundled Teams into its Office 365 licences — effectively pricing Slack out at the enterprise tier — customers discovered that Slack's stickiness was mostly habitual rather than structural. The switching cost was workflow disruption, not genuine lock-in. Microsoft's distribution advantage overwhelmed Slack's product advantage, and Salesforce acquired Slack in 2021 partly to shore up the distribution gap that had always been there. Enormous traction. Structurally thin.

The word "moat" gets used loosely. In investor decks, it shows up as a slide with a 2x2 matrix and some circles. In board meetings, it's invoked to justify a premium valuation. In competitive analysis, it's what you claim to have and what you claim your competitors don't.

But structural advantage — the kind that actually makes a company difficult to compete with — has a more specific character. It compounds. It gets harder to replicate over time, not easier. And it's usually the product of decisions that cut across multiple domains simultaneously: product, commercial, legal, and operational.

Veeva's moat is instructive here because it's layered rather than singular. There is regulatory lock-in — its software is built to comply with 21 CFR Part 11, the FDA standard for electronic records and signatures. There is workflow depth — Vault manages regulatory submissions, quality control, safety reporting, and clinical operations, meaning a customer who wants to leave has to extricate Veeva from their most sensitive processes simultaneously. There is a growing network effect in clinical trials, where research sites, contract research organisations, and drug sponsors are all increasingly standardised on the same platform. None of these are the same moat. Together, they produce a position that is, as one analyst put it, "nearly impossible to exit without jeopardising compliance."

That's what structural advantage looks like when it has been allowed to compound.

A switching cost is only structural if the cost of leaving is real — not theoretical friction, but genuine operational disruption. A regulatory position is only structural if the licence took time and expertise to obtain, and if the market has moved in ways that make obtaining it later significantly harder. A data advantage is only structural if the data improves the product in ways that are genuinely hard to replicate — not because you have more rows in a database, but because the insight derived from that data is embedded in workflows that create dependency.

None of these are about being first. Veeva was not the first pharmaceutical CRM. Toast was not the first restaurant POS. First-mover advantage is real but fragile. What matters is what you do with the early position — specifically, whether you use it to make structural investments before the market gets crowded.

There's a reason this series is called The Moat Review rather than The Moat Guide. Moats aren't instructions. They're observations — and the observation that matters most is this: durable companies are not built from a single defensive strategy but from the compounding interaction of multiple decisions over time.

Procore, the construction management platform, is a useful illustration. It spent over fifteen years building before its IPO — an eternity by SaaS standards. What it was doing during those years was going deeper inside the construction workflow: project management, first, then document management, then financial management, then workforce management. Each layer added switching cost and reduced the surface area available to competitors. By the time Procore went public in 2021, it had built a position where a construction company that wanted to leave had to simultaneously replace its project management, its financial controls, its document trail, and its subcontractor communication infrastructure. The TAM looked narrow for many years. The moat, when it eventually became visible, was wide.

The inverse is equally visible. A founder who optimises for speed — self-serve onboarding, broad horizontal positioning, minimum viable contracts, no regulatory exposure — can grow very fast. And can find themselves, at Series B or C, in a market full of well-funded competitors with no structural reason for customers to stay.

The Moat Review is written for founders who are commercially strong but have not yet made structural defensibility a first-order priority — not because they don't care about it, but because the day-to-day pressure of building a company makes it easy to defer.

Each article takes one type of structural advantage — data network effects, switching costs, regulatory position, distribution infrastructure, IP, brand — and examines how the decisions that produce it are made, what they look like in practice, and where founders typically leave value on the table. Every argument is grounded in companies that have actually made these decisions, got them right, and in some cases got them badly wrong.

The goal is not to offer a framework. Frameworks are fine for slides. What's more useful — what this series is actually attempting — is to change the way you think about the decisions you're already making. Because the decisions that produce a moat are usually ones you're going to make anyway. The question is whether you make them with compounding intent.

Veeva didn't set out to build the most defensible position in pharma software. It set out to build a good CRM for pharmaceutical sales reps. The structural position emerged from decisions made over a decade — decisions about where to go deep, which regulations to absorb, which workflows to own, and which customers to take on even when they were operationally difficult. Those decisions compounded. So did the advantage.

The companies that become structurally difficult to compete with did not get there by accident. But they also didn't get there by following a playbook. They got there by recognising — earlier than most — that traction is not the same thing as position, and that the window for making the investments that create real defensibility is shorter than it looks.

This is that recognition, a few articles at a time.

The Moat Review is a series on structural advantage for founders of tech and SaaS companies. Next: Data network effects — why your product gets stickier with every user, and what separates a data moat from a data warehouse.

“Traction is evidence that people want what you've built. Defensibility is evidence that they can't easily get it somewhere else.”