---
title: "Security"
description: "Security is defense by being the party that does not get robbed."
canonical: https://moa.giglabo.com/strategies/security/
locale: en
---

# Security

> Markdown twin of https://moa.giglabo.com/strategies/security/ — the same content as the HTML page, a fraction of the bytes.
> Every page of this site has one: append `.md` to any URL, or `index.md` to a directory URL.
> Site structure and the full page list for agents: https://moa.giglabo.com/llms.txt

Category: Defense · Role: Holds · Depth: 4

Gist: resistance to theft and unwanted access

## Moats

- [#7 Compliance](https://moa.giglabo.com/moats/7/) (direct, depth 3 · Drill rig) — Practising security ends in audits and certificates, and a regulated buyer cannot choose a vendor without them; each one is a year a rival must also spend.
- [#8 Brand and trust](https://moa.giglabo.com/moats/8/) (direct, depth 4 · Mine) — The record of not being breached is the trust asset: a buyer chooses the vault nobody has robbed, and a rival cannot show a history it does not have.

## Summary

Security is defense by being the party that does not get robbed. The customer hands you something valuable, money, data or access, and you keep it safe from theft and intrusion. What holds is the proof: certifications and audits a regulated buyer must see, and a record of no breaches that a rival cannot show. The locks themselves are copyable; the standing is not.

## How it works

The mechanism is the transfer of a fear. The buyer cannot verify your controls, so they buy the things they can verify: the audit report, the certification, the absence of your name in breach headlines, the insurer's willingness to cover you. Security therefore produces its edge through two channels. The first is regulatory: a buyer whose own auditor demands SOC 2, ISO 27001, PCI DSS or HIPAA can only buy from a vendor who has them, and each one is a year of work and a standing cost. The second is reputational: a decade with no incident is a claim a newcomer cannot make, and one breach removes it.

The engineering underneath, encryption, key management, least privilege, patching, is necessary and is not the edge; a rival can run the same stack. The edge is the paper and the record, and both are slow. Locks are bought; standing is earned.

## Why it holds — or only takes

Holds, and note where. The certifications are #7, compliance: depth 3, rented in the sense that an auditor sells the letters to anyone who pays and endures a year of process, and out of reach for a solo builder. The unbroken record is #8: the bank's real product is that nobody has ever lost money in it, and that belief, depth 4, takes years to form and one headline to destroy. The controls themselves hold nothing; the day a rival passes the same audit, the technical difference between you is invisible to the buyer. Dig the paper and protect the record.

## Do you have it

- Enterprise deals close on your audit report, not on a demo; procurement lists you as pre-approved.
- Insurers and auditors on the customer's side name you as acceptable without a separate review.
- You have a disclosure process and a public, dated record of fixes, and no breach in it.
- Rivals lose deals to you on a compliance checklist you both could have filled.

## How to dig it

- Get the first certification the buyer actually asks for, and treat the annual renewal as a product.
- Publish a security page: controls, sub-processors, the disclosure policy, the audit summary.
- Run a bug bounty or a disclosure programme so the record of fixes is public and dated.
- Design for the worst day: breach playbook, notification templates, insurance, outside counsel on retainer.
- Keep the surface small; every feature added is a control you must now audit.

## How it erodes

- One breach; the record is gone and the certificates do not bring it back.
- Certification becomes a checkbox every rival has; the audit that cost you a year costs them a vendor.
- The standard changes and your controls are now the old standard.
- Buyers stop asking: a market that no longer fears the risk pays nothing to remove it.
- Compliance is rented from a platform; a rival buys the same standing from the same supplier.

## Solo, without capital

A solo builder can be secure, with a small surface, managed services that carry their own certificates, and encryption by default, and can inherit some standing by building on providers a buyer already trusts. What you cannot do this quarter is hold the compliance moat: #7 is marked no for solo, because an audit needs a year, a budget and policies for a company you do not yet have. Sell to buyers who do not require the letters until you can afford them.

What the matrix says of its moats:

- [#7 Compliance](https://moa.giglabo.com/moats/7/) — Solo: ✗ no · Capital: ● high · AI: ↑ AI-resistant · Rent: ✓ rentable
- [#8 Brand and trust](https://moa.giglabo.com/moats/8/) — Solo: ~ partly · Capital: ◐ medium · AI: ↑ AI-resistant · Rent: ~ partly

## In nature, in business

Nature: —

Business: banks, vaults, locks

- **Stripe** — Stripe holds the top level of PCI certification so that a merchant on it is never audited for card handling; the paper is the product.
- **Brink's** — Brink's moves cash in armoured trucks and keeps it in guarded vaults; the customer buys a record of not having been robbed, not a truck.
- **Cloudflare** — Cloudflare sells the absorption of attacks; a site behind it buys the record of the sites that stayed up under the last ones.

## Combines with

- [Privacy](https://moa.giglabo.com/strategies/privacy/) — Keeping data safe from thieves and keeping it unread by you are sold to the same buyer on the same paper.
- [Prestige](https://moa.giglabo.com/strategies/prestige/) — An audit is an endorsement by an authority the buyer trusts more than you; the certificate is prestige in a binder.
- [Transparency](https://moa.giglabo.com/strategies/transparency/) — A public security page and disclosed fixes let the buyer check the record instead of taking your word.
- [Reliability](https://moa.giglabo.com/strategies/reliability/) — Not being breached and not going down are the same promise to the same buyer: nothing bad will happen here.

[This strategy on the map](https://moa.giglabo.com/strategies/?view=lanes&hl=security)
[Map this combination](https://moa.giglabo.com/strategies/?view=lanes&hl=security,privacy,prestige,transparency,reliability)

## Fights with

- [Low-friction](https://moa.giglabo.com/strategies/low-friction/) — Every control is a step the user must take; security adds the friction that low-friction exists to remove.
- [Iteration](https://moa.giglabo.com/strategies/iteration/) — Each change reopens the audit; a short release cycle and a stable certified surface pull apart.

[Map this tension](https://moa.giglabo.com/strategies/?view=lanes&hl=security,low-friction,iteration)

## Source

Strategy taxonomy © kepano (Steph Ango), paraphrased with attribution. Role and moat mapping © Moat Atlas. https://stephango.com/

## Related

- HTML version of this page: https://moa.giglabo.com/strategies/security/
- Русский: https://moa.giglabo.com/ru/strategies/security/
- Previous: Decentralization — https://moa.giglabo.com/strategies/decentralization/
- Next: Privacy — https://moa.giglabo.com/strategies/privacy/
- Atlas: https://moa.giglabo.com/
- Catalogue: https://moa.giglabo.com/moats/
- Calculator: https://moa.giglabo.com/calculator/
- Strategies: https://moa.giglabo.com/strategies/
- Site map for agents: https://moa.giglabo.com/llms.txt