35 mechanics that make a product hard to copy. The downward axis is always depth; the groupings re-lay the section along the other axes of the catalogue.
The product gets better because other people use it: social graphs, communities, respondent pools, audience reach. The defining property is that value grows non-linearly with the number of participants, while an empty product is worthless — which is why the cold start is the hardest problem for the builder and the attacker alike.
Two sides need each other: sellers without buyers leave, buyers without sellers never arrive. This is a two-sided network effect with an aggravated cold start — the chicken and the egg — and therefore one of the most durable moats once the liquidity exists. In the sample the tag is the rarest of all: marketplaces are almost never vibe-codable, and their median price is the highest.
The product only pays off when the whole team is on it: co-editing, presence, permissions, team workflow. What separates it from network effects is that here it is your team, there it is strangers. One of the two weakest tags in the sample.
Third parties build businesses on top of you: apps, plugins, themes, integrators. The direction is the opposite of the integrations tag, where you connect to others — here others invest in you, and their investment becomes your moat: a two-sided network effect plus somebody else's switching costs working in your favour.
People who identify with the product and do its work for free: they onboard newcomers, produce content and templates, answer in forums and defend it in arguments. A relative of network effects and brand trust, but a separate mechanism — a community is labour and loyalty, not a graph and not a reputation.
Reputation a user earned inside a platform — ratings, reviews, statuses, achievements — that does not travel outside and works for the platform. Different from switching costs, where the hostage is data and configuration rather than social capital paid for with years of labour, and from brand, where the trust is in the vendor rather than the market's trust in the user, privatised by the platform. A rare moat built by other people's work and held up by other people's ambition.
People pay because it is this vendor and no other: security guarantees, a reputation in front of counterparties, "nobody ever got fired for this". The most durable tag in the sample — because it lives in people's heads rather than in the product, and code cannot reproduce it at all.
Behaviour on autopilot: the user does not choose the product, they use it without thinking. Different from switching costs, where what accumulates is data and configuration rather than neural pathways, and from brand, where the trust is conscious rather than reflexive. Practical lists of moats mention it constantly; the frameworks hide it inside branding.
A direct relationship with the people who read, watch or listen to you — a mailing list, subscribers, a channel community — with no platform standing between you. A relative of brand, community and distribution, but with its own mechanics: this is distribution you own rather than rent from a platform, and it carries over to whatever you build next.
Not winning a category but inventing one: whoever names and defines a category sets the criteria buyers choose by, and fits them perfectly. A marketing moat sitting on top of the brand one, from the category-design school and the book Play Bigger. In fairness, the softest moat on this list — and one practitioners keep naming anyway.
Data that cannot be reassembled at a sane price: indexes, crawls, live feeds, archives, maps, unique datasets. The formula of the moat is capital × time: even with the money, a rival needs years to accumulate the history.
Models you trained yourself — frontier or narrowly specialised — plus the compute and inference underneath them. The tag is not for wrappers around someone else's API: the moat exists only where the model is genuinely your own.
Infrastructure one person cannot stand up: global hosting, uptime guarantees, media pipelines, email deliverability, fleets of monitoring. The second most common tag in the sample, and present in 59% of the apps marked "no" — more often than not it is what makes a product impossible to reproduce alone.
Physical devices, or data that only the vendor's own hardware produces. In the sample the tag is rare and weak — mostly because what lands in it are companion apps rather than the device makers themselves.
Sole access to a scarce asset: talent, manufacturing capacity, rights, compute. Helmer calls it a cornered resource. Among the thirteen sampled tags it is only partly covered — content rights and proprietary data are there, while talent, capacity and compute are not covered at all.
Access to money a competitor does not have: patient investors, cheap debt, insurance float, cash on the balance sheet. It lets you subsidise prices, absorb losses longer than anyone else and buy up scarce resources. Product taxonomies do not tag it, but it decides market outcomes regularly.
The anchor product is sold cheap or at cost, and the profit is taken for decades from consumables, service and add-ons attached to the installed base. A relative of switching costs with its own mechanics: the moat is the economics of an annuity tied to a fleet of hardware, not accumulated data.
Locations, real estate, physical density of outlets: the spot your building stands on is a spot a competitor can no longer take. Nearly irrelevant to an app directory, but one of the oldest moats in the general catalogue.
Your unit costs are lower than a competitor's, so you can live profitably at prices that kill them. This is not infrastructure scale — "one person cannot stand it up" — but unit economics: scale economies in Helmer, cost advantage in Dorsey. Among the thirteen sampled tags it is covered only indirectly.
A market that feeds one player, or two: demand is so small, or fixed costs so high, that a second entrant is guaranteed not to pay back — so rational competitors simply never come. Morningstar's fifth moat, and the only one of their five not covered by the first batches. What protects you is not superiority but the arithmetic of entry.
Economies of scope: selling the next product to the same customer base at almost no cost. A bundle presses on single-product companies with arithmetic — their product competes with "included in what you already pay for". Hence Jim Barksdale's famous line that there are only two ways to make money: bundling and unbundling.
Owning several layers of the stack, from components to distribution. It buys quality, cost and speed that assemblers of other people's components cannot reach — at the price of capital and rigidity. It works as a moat where the interfaces between layers are the bottleneck of the product.
Unit costs fall predictably — usually by 10–25% — with every doubling of cumulative output. The principle was formulated by Bruce Henderson and BCG in 1966, on the basis of the aviation learning curve (T. P. Wright, 1936: the fourth aircraft took 80% of the labour of the second). The difference from moat 15 is fundamental: scale economies are about current volume, spreading fixed costs, while the experience curve is about total output across all history and the knowledge that cannot be extracted from it. A competitor with the same volume today but nothing accumulated yesterday sits higher on the curve — and cannot catch up while the leader keeps moving.
Regulated ground: payment licences, payroll, tax, KYC, HIPAA and SOC 2, legal liability. A moat made of time, lawyers and a right to be wrong that small players do not have — the price of a mistake here is not a bug, it is a revoked licence.
Licensed content, rights to music and media, curricula, libraries of templates and assets. A moat made of contracts and production rather than of code.
A state-granted monopoly on an invention (patents) or hidden know-how (trade secrets): the competitor is legally forbidden, or practically unable, to repeat it. In Dorsey's framework this is half of intangible assets; in the thirteen sampled tags it is not covered at all — there are brands and licences, but no patents.
Your format or protocol is the language in which an industry stores and exchanges its work: a competitor must be compatible with you, and you control compatibility. A relative of patents, which sometimes protect it, and of ecosystems, but the mechanics are its own — the lock is not on the user or the developer but on the industry's data itself.
Not following the rules better than anyone — that is the compliance tag — but taking part in writing them and owning the relationship with the state as a customer: lobbying, clearances, multi-year contracts, rules designed around incumbents. A moat made of politics rather than of product.
Accumulated history, configuration and habit make leaving painful regardless of how good the product is. In the sample this is the most half-hearted tag of all: the moat is real, but it is rarely enough on its own.
The breadth of your connectors and the endless work of keeping them alive: OAuth, calendars, banks, plugin ecosystems, platform partnerships. A boring moat, but historically an effective one — nobody wants to rebuild a thousand connectors and, more to the point, to repair them forever.
Polish, reliability, sync quality, depth of workflow, accuracy of import. This is execution, not structure — the moat AI eats. The most common tag in the sample, and the only one carrying a warning: if an app has nothing but this, it has no structural defence at all (of 67 such apps, 46 are "yes", 21 "kinda", 0 "no").
Know-how embedded in an organisation: thousands of interlocking practices that cannot be copied even when observed in the open. Helmer calls it process power, the rarest of his seven. It is absent from the thirteen sampled tags; execution polish is its weak product-level relative — AI reproduces polish, and organisational know-how not yet.
Iteration tempo as a compounding advantage: while a competitor ships one version, you run five cycles of hypothesis, release and data. In the AI era "speed is the only moat" became a mantra; it is worth working out where that is true and where it is not.
Owning the channel through which the product reaches the user: default slots, bundles, pre-installs, app-store shelves, armies of salespeople. The product can be worse and still win, because it is already where the user is. The biggest genuine gap in the thirteen sampled tags — a sizeable share of SaaS lives on distribution alone.
The attacker's moat, in Helmer's sense: a business model the incumbent can see and understand — and cannot copy, because copying it would destroy its own revenue. The incumbent is protected against equals and defenceless against whoever finds its moats unprofitable to repeat.