When software costs $200 to build,
what's actually defensible?

Years of pipeline history, activity logs, and custom objects that sales orgs have built their entire process around. The data lives inside Salesforce and leaving means re-building institutional memory.

A distribution and lock-in company that agents will erode from below as they automate the workflows Salesforce was built to manage.

Deeply customised approval chains, ITSM processes, and integrations that IT orgs have built over years. The configuration is the product — not the platform.

Genuinely hard to rip out, but agents will progressively automate the manual steps that justify the platform's complexity.

SOX compliance certifications, CFO personal liability for payroll accuracy, and regulatory validations across 50+ countries. No one switches Workday unless the replacement is signed off by auditors first.

Regulatory trust and CFO risk aversion are the real lock-in — the software is almost irrelevant.

Firefly's licensed training data — the largest legal corpus for commercial creative AI. PDF/format standards embedded in document workflows worldwide. Behance community network.

The format standard and licensed training data are defensible; the creative tools themselves are under severe agent pressure.

10+ years of per-user financial history, direct IRS/HMRC filing relationships, and TurboTax's longitudinal model of how individual tax situations evolve year over year.

The tax authority relationships and historical financial data compound over time in ways that are genuinely hard to replicate.

A massive inbound content machine that captures SMB attention at scale. The CRM data accumulated over years. But the software itself is trivially rebuildable.

A distribution and brand company — the blog is the moat, not the product.

Historical ticket and conversation data that trains AI deflection models. Thousands of configured automations and integrations create operational switching friction.

AI agents are replacing the core workflow Zendesk was built around — ticket-based human support is the thing being disrupted.

4.6M merchants already on the platform. Shopify Capital, Payments, and carrier relationships. The software is the wrapper — the merchant base is the asset.

The software can be rebuilt for $200. What remains is the merchant network and the financial infrastructure sitting underneath it.

Banking licences in 46 countries, PCI Level 1, fraud models trained on trillions in transactions, and direct Visa/Mastercard relationships built over 15 years.

The most defensible company on this list. The regulatory and financial infrastructure cannot be replicated by an agent or rebuilt in a week.

Global carrier relationships, shortcode and phone number ownership at scale, SMS deliverability agreements with every major telco. The API is rebuildable. The carrier plumbing is not.

The physical telco relationships are the moat — but messaging channels themselves are at risk of displacement by app-native communication.

The data itself lives inside Snowflake. Years of pipelines, transformations, and queries. The Data Marketplace creates cross-organisational network effects that are genuinely hard to unwind.

Data gravity is real but the warehouse market is intensely competitive — Databricks, BigQuery, and Redshift are all credible alternatives.

Delta Lake format, Unity Catalog as the metadata graph of enterprise data ownership, and ML models trained and versioned inside the platform over years.

Increasingly the default AI/ML platform for serious data organisations — the open-source Delta Lake moat is wide and growing.

Government security clearances including TS/SCI, deep integration into defence and intelligence decision workflows, and political relationships that took a decade to build.

The clearances and government relationships are structurally unassailable — no agent can obtain a security clearance.

FDA 21 CFR Part 11 validation, deep integration in active clinical trial workflows, and the regulatory risk of switching CRMs mid-drug-approval.

Switching Veeva during an active drug approval could invalidate years of trial data. The regulatory consequence is the lock-in.

Project documentation — drawings, RFIs, submittals — that form legal records on multi-year projects. Subcontractor network effects: subcontractors join because GCs require it.

Legal record requirements and the subcontractor network create real stickiness, but the software layer is increasingly commoditised.

Transaction-level data across 100k+ locations for demand forecasting and fraud. Hardware — terminals and kitchen displays — creates physical switching costs on top.

Hardware lock-in plus data flywheel is a more durable combination than software alone — but the SMB restaurant market is brutally price-sensitive.

Regulatory certifications across 50 US states and 30+ countries. Switching core insurance systems requires regulatory re-approval in every jurisdiction — a years-long programme.

One of the most defensible companies on this list. The regulatory re-approval process makes switching functionally impossible in the medium term.

Billions of recorded interactions as training data. MiFID II and Dodd-Frank compliance recording requirements create regulatory stickiness in financial services.

Regulatory compliance recording is defensible; the broader customer engagement platform is being disrupted by AI-native alternatives.

Jira and Confluence as repositories of institutional knowledge — years of decisions, sprints, and architectural documentation. Every new hire learns the company through Jira.

The knowledge archive is the moat, not the UI. But agents will increasingly navigate and surface that knowledge without the human needing to live in Jira.

The conversation archive and the external partner network — vendors, clients, and contractors already in your Slack. Data gravity from years of institutional decisions made in threads.

Bundled by Microsoft Teams for most enterprises — Slack is fighting a distribution war against a product that costs nothing extra.

Contact network effects and Zoom Phone's carrier relationships. AI meeting intelligence trained on consented transcripts at massive scale.

The verb became the product, then the incumbents caught up. Zoom is now a distribution story fighting bundled competitors on every front.

Legal enforceability in 188 countries, court precedent on DocuSign signatures, and the brand trust that makes counterparties comfortable. Lawyers ask for DocuSign by name.

Brand trust in legal contexts is real — but the e-signature market has been largely commoditised by Adobe, HelloSign, and native platform tools.

Supplier pricing benchmarks aggregated across thousands of companies — a cross-organisational dataset that tells you whether you're paying too much. Impossible to replicate quickly.

The benchmark data is the product, not the procurement workflow. That data moat is genuinely defensible.

FDA audit trail requirements for clinical trial data. Changing systems mid-trial can invalidate results. The regulatory relationship is the product.

The regulatory consequence of switching is so severe that Medidata is effectively unswitchable during an active trial.

Longitudinal sentiment data tracked over years, and industry benchmark databases built from aggregate data across thousands of enterprise clients.

The benchmarks are valuable but the core survey product is highly commoditised — SurveyMonkey and free tools do 80% of what most users need.

An installed base with existing dashboards and pipelines. Essentially nothing else — the software is thin and the market has moved on.

Running on inertia. The BI market has consolidated around Tableau, Power BI, and Looker and Domo has no structural moat.

SOC 2, FedRAMP, and the authentication layer sitting in front of thousands of connected apps. Switching requires coordinating re-authentication across every app simultaneously.

Sits at a genuinely critical chokepoint — but Microsoft Entra is bundled into most enterprise contracts and is the most credible threat.

The Threat Graph — real-time threat intelligence from 25,000+ customers. Each new customer makes detection better for all others. A genuine data network effect.

One of the more defensible positions in software — the threat intelligence flywheel compounds in ways that are structurally hard to replicate.

Instrumentation embedded deep in production infrastructure across every service. Incident response muscle memory of engineering teams. Removing Datadog means re-instrumenting everything.

Deep production dependency is the moat — but cloud providers are bundling native observability tools that reduce the switching cost over time.

The unified customer identity graph — years of identity stitching across web, CRM, and behavioural data. Replacing it resets the graph to zero.

The identity graph is genuinely valuable but Segment is being squeezed by warehouse-native CDPs and Salesforce/Adobe's own data layers.

Threat intelligence across hundreds of thousands of enterprise endpoints, feeding detection models that improve with scale. Platform consolidation creates deep cross-product workflow dependency.

Scale-driven threat intelligence is a real moat — the more customers, the better the detection, creating a compounding advantage.

A global edge network across 300+ cities processing a significant share of all internet traffic — giving threat visibility that no software-only vendor can replicate.

The physical network is the product. No agent can spin up 300 data centres. This is a genuine infrastructure moat.

DWG and proprietary file formats embedded in contractual deliverables. Clients specify Autodesk-compatible files. A two-decade library of project assets in proprietary formats.

The format standard is a durable moat — but generative AI design tools are the most credible long-term threat to the core product.

FedRAMP High authorisation and deep integration with zero-trust architectures mandated across US federal agencies. Replacing Zscaler means re-architecting the entire network security model.

Government mandates and zero-trust architecture dependencies make this genuinely sticky — but Palo Alto and Microsoft are credible challengers.

Payroll tax filing relationships in 140+ countries, direct connections with tax authorities, and the liability infrastructure that comes with processing payroll for one in six US workers.

The tax authority relationships and employer liability make this structurally sticky — switching payroll providers is genuinely high-risk.

Auto-discovery instrumentation woven into production deployments. The dependency is harder to see than Datadog's — which makes it even harder to remove.

Similar position to Datadog — deep production dependency — but slightly more defensible due to auto-instrumentation making the lock-in less visible.

Shared design systems, component libraries, and collaboration graphs that entire product organisations are built around. Every engineer and PM is already in Figma.

Deep collaboration network effects — but AI-native design tools are the most acute threat to the core value proposition.

A large installed base with files stored there — but the storage is fungible. Google Drive and OneDrive offer the same functionality bundled into products people already pay for.

Running entirely on inertia against bundled competition. No structural moat remaining.

Document data models and query patterns deeply embedded in application codebases. Migration means rewriting application logic, not just moving data.

Code-level dependency is the moat — but the document database market is competitive and cloud-native alternatives are closing the gap.

Single-database HR and payroll architecture with direct tax filing relationships across all 50 US states. Nobody switches payroll providers mid-year.

Solid mid-market position with real regulatory stickiness — but a smaller moat than ADP and Workday, and more exposed to AI-native payroll entrants.

Telematics and sensor data from hundreds of thousands of vehicles and industrial assets. Physical hardware — cameras, GPS, sensors — creates switching costs on top of the data moat.

Hardware-plus-data is a more durable combination than pure SaaS. The physical fleet dependency compounds the switching cost.

Years of job history, customer records, technician schedules, and invoicing for trades businesses. Switching means migrating operational records and retraining every field tech.

Deeply embedded in the operational DNA of trades businesses — but AI scheduling and dispatching tools are beginning to challenge the core workflow.

Real-time payroll engine with jurisdiction-specific compliance rules baked in. ISO 27001, SOC 1/2, and payroll authority relationships across North America and Europe.

Compliance engine is the defensible core — workforce compliance failures have direct legal consequences, making buyers deeply risk-averse about switching.

Government procurement relationships, sole-source contracts, and software embedded in court, public safety, and local government operations where switching requires legislative approval.

Government procurement cycles and legislative oversight make this one of the most defensible positions in software. The moat is political, not technical.

Unified ID 2.0, publisher and data provider relationships across the open internet, and bidding intelligence trained on trillions of auction outcomes.

The open internet positioning as an alternative to walled gardens is a genuine strategic moat — but the deprecation of third-party cookies is an existential test.

Hyperconverged infrastructure deeply embedded in on-premise data centre operations. Migration requires planned downtime and significant re-architecture of running workloads.

Physical data centre dependency is real but the secular shift to cloud is the long-term threat — Nutanix is defending an on-prem estate that is slowly shrinking.

Immutable backup architecture and ransomware recovery capabilities that satisfy cyber insurance requirements. Post-breach, Rubrik's clean-room recovery evidence is what insurers and auditors ask for.

The intersection of cyber insurance requirements and incident response trust makes this stickier than it looks — but the market is competitive.

Decades of normalised financial data, earnings estimates, and portfolio analytics. Load-bearing Excel integrations that analysts' entire models are built on.

The data is proprietary and the workflow dependency is deep — but Bloomberg Terminal is the dominant moat in this space and FactSet is a tier below.

First-party event data from 150,000+ ecommerce brands — purchase history, browse behaviour, email engagement — feeding predictive models that improve with every send.

The per-brand intelligence compounds over time, but Klaviyo is deeply exposed to AI-native email tools that can bootstrap from smaller datasets.

An installed base with boards and automations built out. Nothing else — the functionality is generic and the market is crowded.

Pure distribution play. Asana, ClickUp, Notion, and Linear offer near-identical feature sets. An agent can replace the entire product category.