"We use the best AI model" is not a moat. Here's what actually is.

Start with an uncomfortable trend: foundation models’ capabilities are partly commoditizing. On many general tasks, multiple models converge fast, open-source advances, and call prices fall — which shortens any advantage built purely on “we can call a strong model.” But be precise: “models are fully commoditized” is not a settled fact. Frontier capability, cost, latency, long context, reliability, safety, and deployment can still differentiate. The right conclusion is narrow — only where the model capability a task needs is widely available and substitutable is the model itself insufficient as a durable moat.

So where does durable advantage live for an application-layer company? In four things beyond the model — the same moats this book has argued all along. Proprietary data rights and feedback loops that AI can’t easily copy (and note: it’s data rights and loops, not merely “owning some data”). Solid distribution. Deeply embedded workflow. And hard-won trust. A company’s AI fate turns on how its technical capability combines with these — and whether AI thickens or thins them.

This sets up the era’s defining fight: the AI-native attacker versus the incumbent. The attacker rebuilds a category AI-first, unburdened by legacy — but its own moats (data, distribution, trust) are usually not yet proven. The incumbent has three walls — its data, its distribution, its trust — and the resources to fold AI into products customers already use. On paper, the incumbent should win most of the time.

It’s worth holding both possibilities at once, because the honest base rate is uncertain. Incumbents have won most platform shifts in enterprise software precisely because switching costs and trust are sticky — but “most” is not “all,” and the times they lost (the ones survivorship bias quietly erases) were exactly when a new entrant reached a genuinely better product before the incumbent was willing to cannibalize itself. Probability, not prophecy, is the right posture.

The catch is Christensen’s innovator’s dilemma: incumbents are structurally bad at self-disruption. The AI product that would defend them often cannibalizes today’s revenue (agents eating seats), and every incentive — customers, profits, org design — points at protecting the present instead. So the real question isn’t “does the incumbent have the ammunition?” (it usually does) — it’s “will it fire, even at its own business?” The winners of the AI era will be the incumbents willing to disrupt themselves, and the AI-natives who build a genuine moat before the incumbents wake up. Watch the will, not just the wall.

This is Chapter 19 of “Compounding in the Cloud.”