AI Moved Your Moat

Building software used to be the hard part.

A small team with coding agents can ship what used to take twenty engineers, a couple of designers, a few QA engineers, and a couple of docs people. The barrier that came from "this is hard to build" is draining away.

You already know the conclusion everyone drew from that. If anyone can build it, go-to-market is the new moat. It's been the headline in Forbes — every company is now an AI wrapper, so G2M is the new moat¹. Way easier said than built.

The hard half is what it means if you sell security. Because in cyber, the moat doesn't just move downstream to G2M. It moves into the one thing a security buyer is trained never to hand out for free: trust.

And if you're a founder or CEO, it doesn't land just on a CMO or CRO's deck. It lands on yours.

When output is free, output is table stakes

That rule isn't confined to engineering. The same force is loose across the whole company. Product specs. Support replies. Sales follow-ups. Content. Campaigns. Outbound. All of it is getting cheaper to produce, and way too easy to scale.

When resources are scarce, you're forced to pick what's worth doing. Take the barrier away, and the temptation is just — do more.

But that's not a differentiator — everyone can do it. More decks, more emails, more posts, more everything. When output is free, output is table stakes.

So what's left? Judgment. A model can average what's already been said, defaulting to category consensus rather than your buyer's specific pain. It can't tell you what your buyer actually values. That comes from knowing your customer cold. AI can help you gather it and synthesize it. It can't do the knowing for you.

And be clear about what this doesn't say. Building got easy. Knowing what to build did not.

The novel idea — the one nobody in the category has had — is still scarce. So is the customer intimacy that aims it: a specific problem, for specific personas, inside a specific ICP. Product strategy didn't get commoditized. Product construction did.

Which means the moat didn't disappear. It moved.

The moat moved downstream from product development

For years, a hard-to-build product was its own moat — it took capital to hire the talent, and the ability to onboard, train, and manage the team. But "anyone can build it" is now closer to true than it has ever been.

Be precise about what fell. The moat was never the product. It was the barrier — the fact that building was hard bought you protection for free. That protection is gone.

Judgment is still scarce on both sides of the house. But the protection has to be rebuilt somewhere, and it gets rebuilt downstream: brand, positioning, distribution, relationship, trust. In other words, G2M. That's where most companies carry the least judgment — and where the deal actually gets decided.

Fair challenge: why G2M? The moat could land somewhere else. Price, if someone builds the same thing cheaper. Speed. Deep integrations and ecosystem lock-in. Compliance — FedRAMP and the certifications that take eighteen months and scare off entrants. In cyber, those are real. So is consolidation: your buyer is actively cutting vendor count, and platform gravity is its own kind of moat.

I still land on G2M. Most of those are either temporary or downstream of G2M anyway. Price isn't a moat, it's a countdown — someone is always cheaper, and AI just made cheaper easier. Speed erodes the moment the tooling commoditizes, which is the entire point. Lock-in is earned, not granted — you have to win the account before you can lock it in.

Compliance is the strongest of these, and I'll give it its due. An authorization like FedRAMP genuinely gates who gets to bid. If you have it and your competitor doesn't, that's a moat. But it's a moat around a market you still have to win inside — everyone in that authorized set is fighting for the same buyer, and the paperwork doesn't tell them who to believe.

Something has to get you shortlisted. Something has to get you believed. That's G2M. The other moats are what you build after G2M does its job.

But AI has come for G2M execution too. The motions commoditize the same way code did: the content, the outreach, the campaign mechanics, the first-draft copy.

The tools are just good enough that effort-plus-AI isn't a moat on either side of the house.

I've watched the engine move. At one company, where I was CMO, 74% of the pipeline was sourced through marketing channels. When G2M carries three-quarters of the pipeline, it isn't a support function. It's the engine.

Whether it's also a moat depends on whether it's fueled by growth-at-any-cost spending, or by market insight and thoughtful, targeted execution.

So if AI can run the G2M motions, then the moat inside G2M isn't the motions. It's what AI can't manufacture: knowing your market cold, the judgment and creativity to act on it, and being the human the buyer believes.

Human interaction just got more valuable, not less

Here's the part I love.

In a market flooded with AI-generated everything, genuine human interaction goes up in value. Not down.

The mechanism is scarcity. When content is infinite, and every inbox is full of machine-written outreach, the machine stuff becomes noise. The scarce, trusted signal becomes a real person who understands your problem. Abundance on one side raises the value of the scarce thing on the other.

Be precise, though, because the obvious objection is right there. Aren't AI SDRs and support bots replacing people right now? Yes. Some of them. And they should.

And don't stop at SDRs. If AI can run an SDR today, why not an AE in three years?

It can. For some of them. A rep whose value is knowing the product sheet, relaying information, and running the standard sequence is doing work a model already does faster and cheaper. That rep isn't safe. That rep was never safe. AI just started the clock.

But the rep who is a master of their market — who knows the competitive landscape cold, who has lived the buyer's problem, who hears what's underneath the question, who will tell a security buyer the honest thing even when the honest thing costs the deal — that rep gets more valuable, not less. Not because AI can't do parts of the job. Because the part it can't do is the part the buyer is actually paying for.

The line isn't humans versus AI. It's expertise versus everything else.

Not all human interaction rises. The transactional kind gets automated: the rep who just relays information, the tier-1 queue that just routes tickets. What appreciates is the judgment-and-trust-bearing kind.

The human who was only moving information depreciates. The human who brings judgment, taste, creativity, and trust appreciates.

In cyber, trust isn't a tactic. It's the product.

That's true in every category. In security, it's worse — because trust is what you're actually selling.

A security buyer purchasing your product is buying the belief that you will protect them when it counts. That isn't a feature comparison. It's an act of faith, made by a professional whose entire job is to be suspicious of unverifiable claims.

Which is why AI-generated outreach doesn't merely underperform in security. It backfires. You are sending synthetic, unverifiable claims to one of the few buyers on earth professionally trained to detect synthetic, unverifiable claims. That isn't neutral. It's evidence against you.

Gartner puts a number on the reversal: by 2030, 75% of B2B buyers will prefer sales experiences that prioritize human interaction over AI. They name the cause — the uncanny valley. In most categories, that's a preference.

In cyber, it's a disqualifier.

The line isn't humans versus AI. It's expertise versus everything else.

Where the moat actually lives

Picture two cyber vendors selling near-identical products. Both run AI to the hilt: same content volume, same automated sequences, same polished decks. One wins the deal.

Why? Not the motions. Those were a wash. The buyer trusted one team to understand the problem and get them to value fast. That difference is the moat — and every piece of that difference is human.

Walk it across the funnel.

Sales. 94% of buying groups rank their shortlist in order of preference before they ever talk to a seller. The vendor sitting at the top of that list wins nearly 80% of the time. (6sense, 2025 B2B Buyer Experience Report.)

Sit with that. The decision is largely made before your rep opens their mouth — or before their agent does. So the rep's job changed from informing to earning the trust that gets you ranked first, and then helping the buyer decide. The moat is a person who carries deep product-and-pain knowledge, makes it easy to see why you're the right call, and earns enough trust to get invited inside the decision. AI can draft the follow-up. It can't be the person the buyer believes.

And your buyer is the hardest audience in B2B. A security buyer's professional instinct is to assume the claim is inflated, the demo is staged, and the reference was hand-picked. They are paid to be right about who's lying. Nothing you generate will survive that. Only someone who actually knows the problem will.

Customer success. When products are more replaceable and switching is easier, the proof is the outcome, delivered fast. Expert CS that drives quick time-to-value isn't a cost center. It's a retention moat — and retention is the least glamorous, most decisive math in the business.

Run it. Take a $10M ARR company that wants to grow 30%, to $13M.

At 90% net revenue retention, next year opens at $9M from existing customers. You have to sell $4M in new-logo ARR just to hit the number. At 110% NRR, next year opens at $11M — you're already growing before a single new deal — so you need $2M in new logo revenue. Half the sales burden, from retention alone — which improves CAC payback, increases LTV, and makes your investors happy (or, perhaps, happier). It's how you build a business that compounds.

Marketing. This is where the commoditized and the uncommoditizable sit side by side. AI eats the production line: content churn, campaign ops, first-draft copy. Right next to it is the layer no model can touch:

• A brand that stands out. A model reverts to the mean — the average of what everyone in the category has already done. A distinctive brand is, by definition, not average. In a market of infinite sameness, standing out is scarce — and scarce is valuable. And it's not standing out to stand out — it's standing out in a way that connects. As my friend Tom Wentworth says, it's "taste squared."
• Positioning and messaging that truly match the customer's needs — for every persona. AI can generate a hundred message variants. It can't tell you which one rings most true for the CISO, the CTI analyst, or the cyber defender within your ICP. That takes real intimacy with each one's pain.
• Memorable, in-person events. As digital saturates, being in a room becomes premium — not because rooms are magic, but because attention there is undivided. Undivided attention is now the scarcest thing you can buy.
• Authenticity. Buyers have gotten very good at spotting generated content, and they discount it instantly. An honest human voice isn't a nice-to-have — it's the only signal that still clears the filter. Abundance made it the differentiator.
• Digital experiences that teach first. Help your buyer learn how to solve their problem before you sell. Then let them see it, experience it, maybe try it. Most vendors run that exactly backward.

Weak foundations plus AI just reach an empty room faster

Here's the trap. Teams read "AI plus G2M" as "produce more, faster." Producing more is not winning the market. AI will help you build the wrong features and run the wrong campaigns faster than ever.

So the discipline that matters most is subtraction. Pick the few things your customers truly value. Do those better than anyone. When more is free, choosing is the edge. Or, as anyone who has worked with me for more than 5 minutes can tell you — "do less, but better."

And it pays. At one company where I was CMO, we drove pipeline per marketing-program dollar up 67% and cost per opportunity down 51% on marketing-sourced opportunities (46% across all sources). Same team, same spend. Just better choices on ICP focus, program dollar allocation, and creative execution — made possible by veteran operators using analytics, intuition, and experience as their guide.

AI can scale bad ideas just as well as it amplifies good ones.

The whole game now

Building product got much easier. Shipping mass amounts of content got easier.

Standing out from the pack by knowing what your customer values, being the one they trust, and showing up when and how they need you — that got harder.

And that's the whole game now.