The ritual
Sit through enough early stage pitches and you can feel the moment coming. The person on the other side looks at you, the patient smile arrives, and then it lands: so what’s your moat?
Everyone knows the rules. A right answer exists. Network effects, switching costs, a story tidy enough to fit on one slide. You pass. The honest answer, the one where you admit you can’t possibly know yet. You fail.
The honest answer is the one that loses, which tells you what the question is actually measuring.
Buffett’s word
Most founders have no idea: moat is Warren Buffett’s term. He started using it in his 1986 Berkshire letter and kept reaching for it for thirty years. Castle as the business, moat as the thing that keeps competitors from wading across. The underlying idea wasn’t his. Economists had been talking about barriers to entry for decades, and Porter had drawn the five forces. Buffett added a metaphor sticky enough to escape finance jargon.
The detail that didn’t travel with the word: in his 2007 letter he defined the moat precisely, as the thing that protects a business’s returns on invested capital. Not product, not vision. Returns. It was an investor’s word from the day it was named, built to help him decide which businesses would keep compounding his money.
Then Morningstar built it into a formal stock rating. From investing it seeped into venture, and from venture into product and engineering. By the time it reaches the geeks it’s three hops from Buffett, and no one remembers it was about returns on capital.
So a moat is not an unfair competitive advantage, though the two now get conflated by people who’d be surprised to learn they’re different. I myself thought they were the same up until recently. Buffett’s version was never about whether you’re good at something today. It was about whether the profit a business generates survives a decade of other people with deep pockets trying to take it. (His word for that profit, returns, is itself the giveaway. It is the vocabulary of a financier deciding where to park capital, not a man building anything.) The castle is the money the business makes and keeps. The moat is whatever stops a competitor from taking it away. Durability of profits was the whole idea.
Take durability out and the word turns to mush. A feature, a head start, good hiring, a patent, talent stack. They all get called moats now. None have anything to do with the original.
Atoms
The question works well among atoms and goes slippery among bytes.
In the physical world a moat is often the plain difficulty of reproducing the asset, and that difficulty is paid for in capital, geography, and physics. You can’t conjure a second railroad. You can’t will a fab into existence by next quarter. Atoms are slow and expensive to move, and the slowness is what protects the profit. Competition advances at the speed of poured concrete (and regulatory reviews), which is slow enough that the lead can be underwritten. Ask what protects the profit there and you get a straight answer. It is physical, and you can touch it.
The other kind of moat
That’s not all. Some of the strongest moats in the atoms world were never made of atoms at all. Coca-Cola’s moat is not the syrup or the bottling lines. Those are commodities anyone can match. The moat is the brand, the image the thing projects into a billion heads. See’s Candies, the business Buffett loved most, is the same. The kitchens are ordinary. The name is not.
A brand is not made of atoms nor bytes. You can’t pour it, ship it, or buy it on credit. It is made of time. It is the residue of decades of the product being there and being good, one purchase at a time. So the physical world actually handed you two moats, not one. The first built from capital and physics, the slow to copy asset. The second built from time, the brand and the habit and the trust. Atoms were the bonus. Time was the real thing, which is why Buffett’s favorite castles were the ones whose moats you couldn’t touch.
Bytes
Software just removes the first kind. Copying what you shipped costs relatively little, and no physics slows the copier. Hence the moat built from capital and atoms never forms. What’s left is the second kind, the one made of time. Which happens to be the only kind Coca-Cola ever really had.
So the moat isn’t the artifact, and it isn’t the code. It lives beside the code, in the trust you’ve earned, the habits you’ve trained, the switching costs you buried in somebody’s workflow.
Trust doesn’t get built in a sprint, it accrues. The captive user base that everyone eventually points to as the moat got captured by the dull confidence that the thing will work tomorrow because it worked every day until now. One reliable day counts for nothing. A thousand of them stacked together is a moat. Plot reliability against time and the moat is the area under the curve, which is just to say you can’t have one over time you haven’t lived yet.
The seed
Which is the contradiction.
If the real software moat is accumulated trust, a company twelve months old doesn’t have one. You’re being asked to display a decade you haven’t lived. The only founders who can actually show you a moat are the ones who already won, and this is survivorship bias in action.
Your listener knows this. He asks anyway, then grades the confidence of the fiction you invent to fill the silence. Refuse to make something up and you lose. Narrate one with feeling and you might walk out with a term sheet.
The exit doesn’t save it
Probabilistically, if you are successful, you’ll be acquired long before any decade long castle matters. But M&A doesn’t kill the moat question, only reshapes it.
A user base is an asset, not a moat. An acquirer makes a buying decision because building the capability from scratch would cost him more time and money than buying you. That gets you bought at roughly replacement cost. The moat is whatever lifts the price above that floor, because at that point he’s paying for the durability of the profit, not the headcount of users today.
And the buyer is the best informed adversary you’ll ever pitch to. He’s already run the build versus buy math on you.
The partner
The thing builders never absorb about the person across the table. He’s a money manager, not a technology visionary. His trade is risk, and he’s ultimately judged on the shape of a distribution of returns, not the elegance of any single bet. The portfolio, the staged checks, the ownership targets, the liquidation preferences, all of it is plumbing for capping the downside while leaving the upside open. The power law isn’t something he tolerates. It’s the whole game.
Once you see that, the moat question changes color. It isn’t a vision question, it’s a risk question: what keeps the money from draining out of the winning case before he can sell. You hear an invitation to describe the future you see, so you answer with vision and cleverness. He’s doing something colder. He’s pricing how long an outcome that hasn’t happened would hold up if it did. That’s underwriting. It’s also why he reaches for an underwriter’s words, returns and moat, rather than yours.
Most founders don’t make this connection. They walk into a risk meeting sure it’s a vision meeting. It only partially is.
Buffett walked
Ironically, the man who handed us the word won’t invest in the industry that swings it around all day. Buffett stayed in atoms and brands on purpose. His one big exception, Apple, he could only stomach by refusing to file it under technology. He called it a consumer products company with a sticky ecosystem. An eye candy company that happens to run iOS. He translated the bytes back into atoms before he’d write the check. His refusal to touch the rest isn’t a hole in the framework. It’s the framework working. And notice what he reframed Apple into: a brand and a switching cost. Both made of time.
And the structure of venture itself confesses the same thing. The power law that lets a fund manage risk is an admission that the moat is unknowable up front. You spray bets because you can’t tell which one will end up with one. The fund is built on nobody being able to know in advance. The partner asks what yours is as if he could.
Then AI
Whatever thin protection the artifact still offered is gone. Building got an order of magnitude cheaper and faster. When anyone can stand up a credible demo of your product over a weekend, and a real thing in a month, the thing you shipped does not guard much. I watched my son, a recent grad with no CS degree build a working version of an infrastructure API in a weekend, and wrote it up in Experience Got Cheap.
What’s left is the adjacency: trust, habit, network. The only moat still standing in bytes is the one made of time, and AI didn’t discount time. If anything, AI slop just made trust more dear.
A moat made of time still drains. Brands rot, habits snap on a platform shift or UX change, switching costs evaporate. A moat isn’t built once. It has to be defended, cleaned up, deepened all the time.
The real question
The literal moat question is the wrong instrument. The real implicit one is whether you know where defensibility will accrue in your business and whether you’re compounding the reliability that earns it. That one has an honest answer.
The rest is theater. Most of the people performing it can’t tell.