The moat
Switching costs of a deployed security architecture, data from sensors, and brand with CISOs. Network effects in threat intel are real but shared across the industry.
Pain, risk, or retraining required to leave.
The product gets better as more people use it.
Patents, data, licenses, process knowledge, regulation.
Fixed costs spread over a volume rivals cannot match.
Structural ability to be the low-cost producer.
Pricing power from trust, habit, or identity.