The New Moat Playbook: What Actually Defends Enterprise Software in the AI Era
Enterprise software faces its first genuine moat-restructuring since SaaS disrupted on-premises.
In October 2025, Workday decided that five years ago would have been considered strategic suicide: they opened their data vault to Snowflake and Databricks through zero-copy clone partnerships. No extraction. No duplication. Direct analytics access to canonical HR and finance data. Wall Street analysts predicted margin erosion. Competitors assumed desperation. But boards evaluating this decision should recognise something more strategic: Workday just told us exactly where they believe defensibility lives in the AI era, and it’s not where most executives think.
Opening the vault is the smartest defensive move.
For two decades, data gravity was enterprise software’s primary moat. Moving data was expensive, risky, and created synchronisation nightmares. High extraction costs meant customers stayed locked in. Workday just eliminated that moat voluntarily. Why would a board approve this? Because they’ve read the same signals: the battle for the “front door” is already underway. If they didn’t provide seamless analytics access, customers would still extract data, and competing organisations would own the intelligence layer.
The travel industry provides instructive precedent. As illustrated in his December 2025 “Clouded Judgement” newsletter, Global Distribution Systems such as Sabre and Amadeus once controlled both the data layer and the customer interface. Then online travel agencies captured the “front door” while leaving the underlying system of record intact. Today, Booking.com’s market cap ($175B) dwarfs Amadeus ($30B). The system of record didn’t disappear, but it lost control of the front door, and with it, most of the economic upside.
Workday’s calculation: as long as they remain in the system where data gets written, they can afford to be open about where it gets analysed. The zero-copy partnership reveals where moats are actually migrating.
The Moat Migration Matrix: Where value is really accumulating
To understand where defensibility lies in 2026, map enterprises across two dimensions: go-to-market strategy and value capture.
- Fortress Infrastructure (bottom-left): Traditional SaaS moats like Salesforce’s data model, SAP’s ERP integrations. High switching costs but vulnerable to zero-copy unbundling. Strategic risk: margin compression as you become “state machines with APIs.” Most incumbents sit here today.
- Platform Infrastructure (bottom-right): The Workday/Snowflake strategy. Acknowledge infrastructure positioning, open the vault, and maintain authority as the write system. Strategic risk: losing pricing power to the orchestration layer above you. This is where Workday just moved.
- Fortress Intelligence (top-left): Proprietary AI models with closed ecosystems. OpenAI’s early strategy. Strategic risk: model commoditisation destroys the moat within 12-18 months as foundation models become increasingly capable and cheaper.
- Platform Intelligence (top-right): The winning position. Organisations are building context graphs and decision intelligence across multiple systems of record.
The uncomfortable truth: value is migrating from bottom-left to top-right. Most boards continue to defend Fortress Infrastructure’s positions, while shareholder value compounds in Platform Intelligence.
Context graphs: The data type that didn’t exist before
Here’s what makes Platform Intelligence defensible: existing systems of record capture what happened; they don’t capture why. A CRM displays the final discount but does not indicate who approved the deviation, what precedent justified it, or what cross-system context informed the decision.
Building on the framework, it introduced the concept of “context graphs”, living records of decision traces that capture the reasoning connecting data to action. This represents genuinely novel data because it was never treated as data in the first place.
As Snowflake and Databricks become the synthesis layer for multiple systems of record via zero-copy partnerships, they’re positioned exactly where these context graphs form at the intersection of multiple data sources, capturing cross-system intelligence that no single SoR owns.
The strategic distinction: knowledge graphs (entities and relationships) can be LLM-generated from existing data. Decision traces (the “why” behind approvals, exceptions, and judgment calls) represent data that doesn’t exist in structured form anywhere. Why was an exception granted? When a customer escalation succeeded, what pattern did the representative recognise?
This institutional judgment, currently living only in scattered Slack threads and tribal knowledge, is the truly novel data type. Organisations that systematise their capture will have data that cannot be synthetically reconstructed because the underlying raw data was never recorded.
As Andrej Karpathy observed about this new abstraction layer: “I’ve never felt this much behind as a programmer. The profession is being dramatically refactored.” The programmable layer now includes agents, subagents, prompts, contexts, memory, modes, tools, plugins, MCP servers, and workflows that orchestrate across systems rather than build within them.
Stress-testing the framework: What boards should question
- Data moats are actually strengthening, not dying: Opening vaults creates network effects through data sharing rather than destroying lock-in. The nuance: data ownership moats are eroding, whereas data network-effect moats are strengthening. The strategic question: Can you capture compounding value from networks that form around accessible data?
- Fortress strategies can win: Fortress Infrastructure wins when mission-criticality is extreme, and workflow integration matters more than data portability. Most enterprise software doesn’t operate under these conditions.
- Platform dependency risk: Organisations in the orchestration layer face existential vulnerability. Twitter destroyed a 16-year-old third-party ecosystem overnight in 2023. Facebook policy changes adversely affected Zynga (revenue declined from $1.3B to $700M in 18 months). Building on platforms you don’t control creates terminal risk when those platforms decide to compete directly.
Where value captured the $500K decision
Consider a procurement agent in 2027: it accesses pricing from Workday, compliance rules from Snowflake, vendor history from Salesforce, and budget workflows from ServiceNow. The agent executes a $500K purchasing decision in 3.2 seconds.
Which organisation captured the value? Not the four systems of record, they function as infrastructure. The value accrues to whoever constructed the context graph connecting compliance precedent to budget authority to vendor reliability scoring. That’s the intelligence layer.
The zero-copy partnerships reveal the strategic endgame: systems of record are acknowledging infrastructure positioning. Organisations building decision intelligence and cross-system orchestration are positioned to compound shareholder value.
For boards: map your portfolio across these quadrants quarterly and track migration patterns. The velocity of AI-driven restructuring means decisions made in early 2026 will largely determine which organisations build moats and which become commoditised infrastructure with compressed margins.
The question isn’t whether your data is locked in a vault. It’s about being positioned where a $500K decision happens in 3.2 seconds, and capturing the value rather than merely providing inputs.
This analysis synthesises insights from Benedict Evans (independent analyst and former a16z), Jamin Ball (Altimeter Capital), Ashu Garg and Jaya Gupta (Foundation Capital), and Andrej Karpathy (founder of Eureka Labs and former OpenAI/Tesla). Please review the first comment for the source links.
Originally published on LinkedIn.