In the folklore of startups there is always a castle, and always a moat. Picture the barbarians massing outside the gate — every rival company that wants to storm in and eat your lunch. Picture, just beyond the walls, a stretch of dark water that keeps them at bay. It is a comforting medieval image, and it has quietly become one of the most anxiety-inducing questions in Silicon Valley. On a recent episode of Y Combinator's podcast The Lightcone, hosts Garry Tan, Jared Friedman, Diana Hu and Harj Taggar sat down to answer a question that, they report, is haunting the brightest students on America's college campuses: in the age of artificial intelligence, does anyone have a moat at all?
The worry is specific and it is spreading. Smart undergraduates, the kind Y Combinator courts on its recruiting trips, keep raising the same objection. They can see how a founder might spin up an AI-agent company and pull in some revenue. What they cannot see is how that company survives. It all feels, in the meme of the moment, like a "ChatGPT wrapper" — a thin skin of product wrapped around someone else's model, cloneable in a weekend by anyone with a laptop and a caffeine habit. "They can see how you could build a business that makes some amount of revenue," Friedman explained, "but they don't really see how you can build a long, enduring business." His verdict was blunt: that instinct is wrong. "I actually think these businesses do have quite deep and interesting moats. But they're not totally obvious what they would be."
To find the not-obvious, the group reached for a book — one Tan cheerfully admits is "business-school fodder," the very genre startup culture loves to sneer at. At the recent AI Startup School, he recounted, he and OpenAI's Sam Altman shared a backstage laugh about how one of the most important texts of the moment is a strategy tome. That book is Hamilton Helmer's The Seven Powers: The Foundations of Business Strategy, published in 2016 by a man who taught economics at Stanford. Its examples — Oracle, Facebook, Netflix — now read like artifacts from an earlier internet. The Lightcone's project for the hour was a reboot: take Helmer's seven categories and re-run them against 2025's crop of AI companies to see what still holds.
Quite a lot, as it turns out. "It's a little bit confusing the way he uses the terminology," Tan conceded. "It's called The Seven Powers, but it would make a lot more sense if you just called the thing The Seven Moats, because that's really what he's talking about." And here is the framework's stubborn utility: the specific moats mutate, but the categories don't. "It turns out there's just only so many kinds of moats that a business can have, and they don't really change." The AI-agent versions look different, but they slot into the same seven buckets Helmer drew a decade ago.
00The Puddle in the Field
Before cataloguing the seven, the hosts delivered a warning that doubles as the episode's thesis: most founders think about moats at exactly the wrong time. Helmer's framework, deployed too early, becomes a trap — a reason not to start. "It would be pretty dumb," Friedman said, "for somebody to decide not to work on a startup idea because they can't see what the long-term moats of that idea could be." Using the framework to choose between two ideas by forecasting which will have the deeper moat five years out "just isn't how it works."
The reason is almost philosophical. A moat protects something; if there is nothing worth defending, the moat is beside the point. "Otherwise," Tan said, "it's just like a puddle in a field." The counsel that follows is pure Y Combinator: find a person with a real, painful problem and solve it. The world, Tan marveled, is strewn with such problems "lying in plain sight," so numerous and so severe that solving one can mint a company worth a billion, ten billion, even hundreds of billions of dollars. The moats, Hu added, "come later." First you go from zero to one. Only then do you dig.
Why has moat-anxiety metastasized precisely now? The hosts traced it to a single fear: the big model labs. If you build something valuable on top of OpenAI or Anthropic, what stops them from noticing, and simply absorbing your product? The answer the founders themselves keep giving is disarmingly simple. Varun from Windsurf, a past guest, put it plainly: at the beginning, "the only moat that startups have is really just speed."
08The Eighth Power: Speed
Speed is not one of Helmer's seven. The Lightcone thinks it should be — that it is, in fact, the first moat, the one that buys time to build all the others. The exhibit is Cursor. When founder Michael Truell came to speak to a YC batch, he described a product-development cadence that stopped the room: one-day sprint cycles. Through 2023 and 2024, the team would "restart the clock and try to ship things every day." Hu called it what it is. "That's insane speed. There's no big company that could ship something at that speed."
This is the startup's structural advantage rendered as physics. A Google or an Anthropic carries "a lot more craft" — product managers, operations, PRDs, spec docs — before a feature ships. A weeks-long cycle at a large company can stretch to months, and Google's own Bard-to-Gemini saga stretched to years. Cursor's answer to the threat of being crushed was simply to move faster than the crusher. For its first few years, Friedman noted, the deeper moats "didn't really matter that much." Cursor and Windsurf proved that code generation was a killer application, that the development environment was worth owning, and grew explosively. The moment to think about defense came only later — at scale, when Claude Code and Codex and the rest came knocking.
Bob McGrew, a recent guest, gave the hosts their favorite mental model for this early phase: today's AI startups are, in effect, "forward-deployed engineering teams for the labs." The territory is green-field; nobody yet knows which verticals will pay. Step one is to figure that out. "It wasn't even two years ago clear it was code gen or the IDE." You strike gold, then you keep digging — and only once you've found treasure do you assume competition is coming for it. Which brings us, at last, to the seven ways to guard the hoard.
01Process Power, or the Tyranny of the Last 10%
Helmer's process power is the moat of the Toyota assembly line: a business so intricately built that rivals simply cannot replicate all of it. The AI translation, Friedman argued, is "a really complicated AI agent that's been finely honed over multiple years to work really well under real-world conditions." He reached for YC's own portfolio — Jake Heller's Casetext as the original template, then newer names: Greenlight, which runs KYC checks for banks, and Casca, which handles loan origination, effectively telling banks which loans to make.
Here the hosts confronted the "ChatGPT wrapper" meme head-on. Yes, you could build a demo version of any of these in a weekend hackathon. That is exactly the confusion. "The version you build in a hackathon isn't useful to anyone," Friedman said. "If Casca or Greenlight fail, the banks will lose millions of dollars. This is mission-critical infrastructure. It's more like a self-driving car." The moat is not the demo; it is the excruciating final stretch that gets an agent from impressive to reliable.
The hackathon version is quicker than ever to get to. But the last 10% — getting it to work reliably across tens of thousands of KYC requests per day — is a particular type of painstaking drudgery that lots of engineers are just not excited to do.
Tan's grander example was Plaid, which must support thousands to tens of thousands of financial institutions, each a different website and crawler. "Can you imagine Plaid's CI/CD structure?" he asked. The modern twist: a company like that should now be wielding the latest code-generation tools to onboard every new bank on earth faster than anyone else — process power, supercharged. Hu tied it to the reigning misconception about effort: you can reach an 80% solution with 20% of the work, but these products demand 99% accuracy, and that last stretch costs ten or even a hundred times more. The Pareto principle, weaponized as a moat.
02Cornered Resources: The Diamond Mine in the Head
A cornered resource is a coveted, independently valuable asset others can't get — the pharmaceutical patent that survives FDA approval, so powerful that patents come with expiration dates. The modern regulatory analogue, Tan offered, is Scale AI's and Palantir's work with the Department of Defense: painstaking to reach, requiring the right hires, long stretches in Washington, and purpose-built secure facilities. But the resource he found most striking was intangible. "The cornered resource doesn't have to be a diamond mine," he said. "It could be the diamond mine in your customer's heads" — the brain space of the government insiders who now route AI ambitions through a Palantir or a Scale.
For ordinary startups, the accessible version is the forward-deployed engineer sitting beside a customer who would otherwise never touch good software — mapping a boring email-to-call-center workflow, then translating it into prompts, evals and, eventually, proprietary datasets to tune proprietary models. Character AI, Tan noted, fine-tuned models to cut serving costs tenfold; that too is a cornered resource. The best of all, the hosts agreed, is your own model doing the specific work better. But — crucially — that was once thought to be the only moat, and it isn't. Context engineering alone, Tan argued, "gets you 80 or 90% of the way there," which is "all people need for the first two years of their startup almost always." Cursor didn't begin with full fine-tunes of GPT. It began by making something people want.
03Switching Costs, Old and New
The third power is the moat of the trapped customer — the one who stays because leaving is agony. Hu invoked the SaaS classics: Oracle, where migrating a database is a thing companies simply do not do, and Salesforce, where switching CRMs means retraining the sales team and forfeiting perhaps a year of productivity, even for a better product. The AI era, the hosts argued, has forged a new kind of switching cost — one native to the technology. Companies like Happy Robot and Salient begin with deeply customized workflows, endure pilot periods of six months to a year, and emerge with seven-figure contracts. Happy Robot burrowed into DHL's logistics operations; Salient integrated with banks' idiosyncratic processes for debt recovery, fraud monitoring and compliance. Once you're that woven in, "you're kind of minted." No enterprise is going to run that gauntlet again for the next shiny voice agent.
The delicious irony, several hosts noted, is that AI cuts both ways. The same technology that builds new switching costs can demolish old ones: code generation can extract data from ossified legacy systems, and browser automation can pry loose data that vendors won't let you export. Friedman drew the distinction cleanly — the SaaS-era switching cost was the pain of migrating data; the AI-era switching cost is the pain of re-customizing the deep logic of an agent. And on the consumer side, a third flavor is emerging: memory. "It actually blew me away that Claude was so behind on memory," Hu confessed, describing how her "relationship with ChatGPT" had deepened over a year until it simply knew what she cared about. Personalization, she predicted, will only make that moat wider.
04Counter Positioning: The Incumbent's Trap
Counter positioning is doing something an incumbent can't copy without cannibalizing itself. The Lightcone found this power everywhere. In every category, a "Darwinian competition" pits established SaaS players building their own agents against AI-native upstarts building agents on top of them. The incumbents' fatal flaw is often their pricing: they charge per seat, per employee. "This is a very big Achilles heel," Friedman said. If your AI agents genuinely work, your customer needs fewer employees — so the more successful the incumbent's own agent becomes, the more it erodes its own revenue. "It's super hard to cannibalize your own revenue." Founder-controlled companies like Intercom, he wagered, might have the nerve to eat themselves; the others he holds little hope for.
The upstarts, by contrast, price around work delivered or tasks completed — which forces their products to actually complete the work. And here the hosts surfaced the episode's most human obstacle. Tan's closing advice to a recent YC batch was that founders should spend a month inside late-stage companies, because the loudest complaint he hears from those CEOs is how hard it is to reset an engineering culture to embrace AI. The incumbents are trapped twice over: they can't abandon per-seat pricing, and they can't build products that do the work anyway.
Then there is the second, subtler flavor of counter positioning: the advantage of the second mover. Time and again, Taggar noted, the eventual winner arrives late. Stripe came after Braintree and Authorize.net; DoorDash came after Grubhub and Postmates. In AI legal, Legora is counter-positioning against early winner Harvey — which bet heavily on fine-tuning when the winning move turned out to be the application layer. Giga ML entered customer support against a decacorn like Sierra with a product that "fundamentally just works better out of the box," enabling faster onboarding. And in language learning, Speak is growing explosively against Duolingo by refusing to play the gamification game, positioning itself simply as "the place you should come if you want to learn the language by speaking it."
05The Workforce Question — and a Word on Brand
The counter-positioning conversation forced a detour into the uncomfortable: what happens to the workers? The hosts refused to flinch, but their example complicated the doom narrative. Avoca builds customer-support software for HVAC companies — heating and air conditioning. Where a platform like ServiceTitan captures perhaps 1% of a contractor's spend, Avoca discovered it could claim 4 to 10% by taking over customer support itself. Tan's observation about those jobs was pointed: "Customer support for an HVAC services company is not a fun job, and you can tell because these jobs have 50 to 80% annual attrition rates." People quit them anyway. The workers who remain, Avoca reports, now manage AI agents and handle the weird cases — sometimes editing the prompts themselves — which Tan called "ten times more interesting" than reading from a script. The upshot, Hu argued, is that vertical AI SaaS could be "at least 10 times bigger than SaaS," because it taps a company's operational budget, not just its finite software budget.
Brand, Helmer's moat of Coca-Cola, is harder for young startups to claim — it takes time to accrue. But the hosts pointed to the single most astonishing case study of the era. "OpenAI's ChatGPT has more consumers using it per day than Google's Gemini," Hu marveled, despite Gemini's models being roughly equivalent and Google owning, in her words, "the biggest consumer brand on the planet." Someone with no users beat someone with all the users. "If someone had told me in 2022 that's how it would play out," she said, "I would have been fairly incredulous." Tan reframed it as counter positioning again: Google's greatest-cash-cow-in-history ad business made it reluctant to disrupt itself — even at the cost of its own stated mission to organize the world's information. And underneath ChatGPT's origin, he noted, was that eighth power once more: it shipped in months, with a couple of engineers. Speed. Number one.
06Network Economies as Data Flywheels
Helmer's sixth power is the network effect — Facebook, more fun as your friends pile in; Visa, more useful as more merchants accept it. In AI, the hosts argued, the shape of the network effect has changed. It now takes the form of data. The more data a company gathers, the better its custom models, the better the product, the more users — and the flywheel spins. OpenAI almost certainly feeds chats back into future models. Cursor, the hosts marveled, reportedly funnels "every mouse click and every keystroke" from its free users into its models, which is why its tab-autocomplete is so good; more developers make the product better, compounding the advantage. For enterprise startups, the equivalent is private workflow data — and the mechanism for converting it into a moat is evals. "We've talked a lot about evals being the key moat for AI startups," Hu said. Evals capture what worked and what didn't, feeding iteration on context engineering — a flywheel you can only turn by getting more usage.
07Scale Economies and the DeepSeek Shock
The last power is the classic economy of scale: build something enormous, spread the fixed cost, undercut everyone. UPS, FedEx, Amazon's delivery network. In AI, Friedman argued, this has played out less at the application layer than at the model layer — training a frontier model is ferociously capital-intensive, affordable to only a few, after which inference is cheap. Which is why last year's DeepSeek announcement was "earth-shattering": it suggested training a frontier model might be far cheaper than assumed, threatening to drain the labs' scale moat. Hu offered the correction the media missed: DeepSeek's real unlock was a cheaper method for reinforcement learning, but it still builds atop an expensive foundation model. The RL is cheap; the base is not.
Scale economies do surface in startups, and the hosts closed on one of Taggar's own: Exa, "search for AI agents," which must crawl a large chunk of the web — an expensive fixed investment reusable across every customer. Exa made that bet early, before agents took off, "even before ChatGPT launched," much as the labs bet early on transformers and scaling laws. Two companies in the most recent batch, Channel 3 and Orange Slice, are running the same play. As web agents improve, expect many more.
∞The Only Advice That Matters
For all the taxonomy, the Lightcone ended where it began — by telling founders to ignore most of it, for now. "You need to mainly focus on the first moat that isn't even in the book, which is speed," Tan said. Breaking your brain over whether you'll one day be a cornered resource is "thinking about it in the wrong way." Start instead with a single person in real pain — not "it'd be nice if I could do this," but the visceral kind: I am not going to get promoted this year. Maybe I'll get fired. This is so painful I don't want to go to work today. Find that, write software that dissolves it, and go from zero to one.
The moats, the barbarians, the seven powers — they are real, and someday they will decide who survives infinite competition and whose margins collapse to zero. But they are problems for the founder who has already built something worth defending. Everyone else is guarding a puddle in a field. "With that," Tan signed off, "see you guys next time."
Watch the full episode → youtube.com/watch?v=bxBzsSsqQAM