The Data Moat Was Always a Myth

Every enterprise software deck you will read this year makes the same claim:

“Our proprietary data is our moat.”

“The more customers we onboard, the more data we collect, the better our models become, the wider the moat grows.”

It is a clean story. Investors love it. Product leaders repeat it. Salespeople close with it. It has become, over the last two years, the default explanation for why any AI-adjacent enterprise software business should be valued at a premium.

There is only one problem. It has never really been true, and it is even less true now. The data moat was always a myth. What protected enterprise software companies was something else entirely, and understanding that something else is the difference between good investment decisions and expensive ones.

Call it the workflow moat. It is not glamorous. It does not photograph well in a pitch deck. It is also the only thing that has actually defended enterprise software companies for the last twenty years, and the only thing likely to defend them through the next ten.

Start with the simplest objection: the customer owns the data.

Almost every enterprise software contract of any significance contains language that says the data belongs to the customer, not the vendor. The vendor has a licence to process it for the provision of the service. The vendor sometimes has a right to use aggregated and anonymised derivatives for benchmarking. The vendor does not, in any meaningful commercial sense, own the customer’s data. If the customer switches vendors, they take the data with them. If the customer grows unhappy, they demand a data extract and get one.

This is not a theoretical point. This is what every major enterprise procurement function insists on, and what every regulator requires. The narrative that “the more customers we get, the more data we own” trips over clause 14.3 of the customer’s master services agreement.

Second, and more interesting, customer data is almost never the bottleneck for model quality.

For most enterprise workflows, the ceiling on what an AI product can do is not set by the training data. It is set by three other things: the quality of the foundation model, which is improving rapidly and is available to everyone; the quality of the retrieval and context engineering, which is increasingly solved by open tooling; and the quality of the evaluation and feedback loops, which is hard but is a craft, not a data asset.

Adding more customer data to a retrieval corpus mostly adds noise. Fine-tuning on customer data runs into privacy restrictions and, more practically, produces a single model that serves all customers worse than a well-engineered retrieval pipeline serves each customer on their own context. The compounding-data-moat story assumes a kind of training that enterprise agreements rarely permit and that almost never pays off commercially.

Third, data quality scales worse than data quantity. The valuable parts of any enterprise corpus are small, unevenly distributed, and expensive to label. The rest is overhead. Vendors claiming “we have a petabyte of unique data” are almost always selling you a petabyte of noise, with a few gigabytes of signal that they have not yet isolated. The next vendor, working with a few clean datasets and a better pipeline, will beat them on most tasks.

These three objections collectively demolish the data moat story. The story persists because something has to explain the durability of enterprise software incumbents, and “workflow entrenchment” is a harder thing to put in a deck than “proprietary data flywheel.”

Enterprise software companies are not defended by their data. They are defended by the way their product is tangled into their customers’ workflows. Three layers are doing the actual defending.

Call it workflow entrenchment. Once an organisation has rebuilt a core process around a particular system, moving off that system is not a software project. It is a change programme: retraining hundreds or thousands of people, rewriting policies, renegotiating with auditors, regulators, and downstream integrators, rewiring every other system that depends on the entrenched one. The cost of switching is not dominated by software licences. It is dominated by human behaviour.

This is why SAP survived the SaaS wave. It is why Siebel, for all its flaws, was painful to displace. It is why ServiceNow is hard to unseat inside the service management function even when a better product exists on paper. The moat is not the code. The moat is the organisation’s own nervous system, which has grown around the code.

Call it distribution capture. Large enterprise buyers do not evaluate tools individually. They evaluate vendors who are on the approved list, who have passed the security review, who have the right contractual flow-downs, who have an account team, who have a managing director their CFO knows. Getting onto that list takes years and a particular kind of investment. Getting kicked off takes a single incident. Incumbents defend this ground obsessively because it is where the actual decisions happen.

A brilliant new AI product with no distribution story will lose, repeatedly, to a mediocre incumbent product with a strong one. This is not a bug. This is how enterprise procurement is designed to work, and the people who designed it that way had reasons.

Call it compliance drag. Enterprise software deployed for a decade has accumulated thousands of audit reports, control attestations, exception approvals, regulatory filings, and risk register entries that reference it by name. Ripping out that system means rewriting those artefacts. Many of them cannot be rewritten without re-certifying the underlying controls, a multi-quarter exercise. The amount of paperwork a piece of enterprise software drags behind it is the silent reason many obsolete systems never die.

The moat is not proprietary data. The moat is accreted organisational commitment, and what is true of accreted organisational commitment is that AI erodes it unevenly.

Workflow entrenchment is the layer AI erodes least, and slowest. If anything, agents that operate against incumbent systems deepen entrenchment, because they absorb the idiosyncrasies of the system into themselves and hide those idiosyncrasies from the user. The more AI wraps a legacy system, the harder the legacy system becomes to displace. This is the unpleasant truth for challengers.

Distribution capture is eroded marginally. The AI-native startup that builds a great product still has to go through the same security reviews, the same master service agreements, the same procurement committees. The committee is not impressed by the model capability. The committee wants to know about SOC 2, ISO 27001 (and increasingly ISO 42001 for AI management systems), data residency, indemnity, and insurance. None of that is faster because the product is AI-native.

Compliance drag is, in fact, getting worse for new entrants. The EU AI Act, the Australian Voluntary AI Safety Standard on its path to mandatory, and equivalent regimes elsewhere, are layering new compliance cost specifically on AI-powered software. This hits small vendors disproportionately. The incumbents have compliance teams. The startups do not.

Incumbents are more protected in this cycle than the “data moat” crowd believes, and for the opposite reasons the “data moat” crowd gives. Workflow, distribution, and compliance are doing the defending, not some petabyte of customer data the vendor does not actually own.

This does not mean challengers cannot win. It means they win differently, and in different places.

They win in workflows the incumbent has not already captured. New categories of work, created by new regulation or new business models, are moat-free by definition. No workflow entrenchment, no approved-vendor list, no compliance incumbent. The AI-native startup that lands here first does not have to displace anyone. It can build the new moat itself.

They win by aligning with a compliance wave rather than fighting it. The startup that is deeply credible on AI governance, on the ISO 42001 control set, on the Australian Safety Standard, on the EU Act, becomes the trusted partner for enterprises scrambling to satisfy a regulator. The compliance is not a cost. It is the go-to-market. This pattern has worked before, most notably in cybersecurity, and it is available again for those who move early.

They win by building distribution deliberately, not by hoping product-led growth does the work, not by treating enterprise sales as a beneath-them chore. The AI-native startups that are winning large enterprise deals in 2026 are the ones whose founders spent eighteen months having coffee with CIOs before they had a closing deck.

They win by betting on workflow reinvention rather than automation. A product that automates the existing workflow competes directly with the incumbent, who has twenty years of workflow capture and cannot be beaten on that axis. A product that lets the customer do the workflow differently, faster, cheaper, better, is competing on a different axis. That is where AI-native entrants actually have leverage.

If you build enterprise software: stop selling the data moat story. Investors are becoming allergic to it, buyers never believed it, and the narrative is getting in the way of clearer thinking about why your product actually wins. If your real moat is a workflow your customers cannot re-engineer out of their operation in under two years, say that. It is more defensible and more interesting.

If you invest in enterprise software: discount the proprietary data narrative by about ninety per cent, and re-weight your diligence on workflow depth, distribution posture, and compliance posture. Most of the AI-application businesses funded in 2024 and 2025 are going to struggle to earn the multiples they were priced at, not because AI capability stalls, but because the moat story they told was never true. A smaller number, with real workflow moats, will quietly outperform.

If you buy enterprise software: when a vendor tells you that their proprietary data is their moat, treat it as a red flag. Ask instead what happens to your workflows if you stop paying them. If the answer is “very little,” they have a subscription, not a moat. If the answer is “we would have to change how we operate for two years,” they have a moat, and you should factor that into every decision you make about deepening the relationship.

The AI cycle is exposing that reality faster than previous cycles did, because the product layer is commoditising visibly while the workflow layer stubbornly resists. The companies that will thrive understand this honestly: their product is not the model, not the data, but the way the customer’s organisation moves and the depth to which they have entangled themselves in that movement.

In the next piece in this series, I want to take on the evolution that sits underneath this shift. Enterprise software is moving from system of record to system of action to something harder to name and far more consequential: a system of judgment.