The AI Defensibility Read: Durable Moat, Wrapper, or Feature

Before the investment committee, you have to decide one thing about an AI startup: does it have a defensible edge, or is it a thin layer over someone else's model. This guide is for early-stage investors, platform and talent partners, and angels who need that verdict from the outside, before the founder hands over a single slide. It gives you five externally-observable dimensions, a way to score each one from public evidence, and three verdicts you can defend in the room.

The founder-facing tests you will find elsewhere assume you can paste the product's prompt into ChatGPT, interrogate the CTO, and open the data room. You usually cannot, not yet. So this read is built entirely on signals you can gather yourself: the team's ML depth from profiles, the model-stack clues in job posts and model cards, the repo and Hugging Face footprint, the margin economics, and the distribution evidence. A verdict built this way survives before diligence formally opens.

What the three verdicts mean

The read ends in one of three places: durable moat, wrapper with a path, or feature to pass. Each is a decision about defensibility, not about the quality of the product today.

A durable moat company owns something a well-funded rival cannot replicate inside a year: a compounding data flywheel, deep workflow lock-in, or distribution control, backed by in-house ML individual contributors. A wrapper with a path calls a foundation model through an API today but is accruing a real moat - law-firm relationships, ingested domain data, switching costs - that will outlast the model dependency. Harvey is the archetype: raised at a $3 billion valuation in 2025 on law-firm relationships and ingested case data while technically calling GPT-4 class models through an API. A feature to pass is a thin layer that a foundation lab could ship as a feature, that fails the substitution test, and that shows no compounding mechanism.

The five dimensions you can score from the outside

Five dimensions are observable without the data room: stack architecture, team ML depth, public footprint, margin economics, and the moat trio of data, workflow, and distribution. Each produces a score and a piece of cited public evidence.

The order matters. Architecture and team depth are the cheapest to read and the hardest to fake. Margin is the single cheapest wrapper tell when it is disclosed. The moat trio is the partner-level judgement that the earlier signals feed. Score them in that order so a clear fail on an early, high-confidence dimension can save you the later work.

Dimension one: stack architecture

Place the target in a three-tier taxonomy. Proprietary models, custom-trained on proprietary data, carry low AI-washing risk. Fine-tuned foundation models carry medium risk, where value depends on fine-tuning depth. API wrappers, which call third-party APIs with minimal customisation, carry high risk. Model cards and GitHub are your primary footprint sources, and dependency manifests and SDK references in public repos often reveal the underlying provider directly.

Dimension two: team ML depth

This is countable. Diligence frameworks explicitly ask for ML engineers versus "AI strategists" on the org chart, with a kill criterion of no in-house ML talent and outsourced model development. Count the individual contributors - ML engineers, research engineers, MLOps engineers - and divide by the leadership and advisory titles. The absence of foundational roles like data engineers, MLOps engineers, and AI governance leads is a documented red flag.

The talent-depth ratio and why scarcity makes it load-bearing

A strategist-heavy team signals narrative over capability. The scarcity of real ML builders is what makes this ratio decisive: in Refolk's index of professional profiles, the US holds far more ML individual contributors than any other market, so an absence that looks ordinary is actually structurally suspicious.

The table below is the index-wide pool, not any single company. Use it two ways: as scarcity context, and as a template for the per-target count you build in step three.

The read on geography is direct. With only 441 PyTorch ML engineers in Germany against 3,625 in the US, a European startup claiming custom-trained models while showing no ML individual contributors is fighting a pool that barely exists. The absence of builders is more suspicious outside US hubs, not less, because there is almost nowhere for those builders to have come from. And the strategist-class pool is led by "Head of AI" - a leadership title, not a builder's title. A company whose "AI team" is strategist-heavy is telling you where its weight sits.

Building this per-target count by hand means paging through profiles and job posts and classifying each title. Refolk runs the same query in plain English and returns the named people, so the numerator and denominator in step three are a search rather than an afternoon.

Reading the margin economics

The gross-margin band is the single cheapest external wrapper tell, because inference sits in cost of goods sold and does not fall meaningfully with scale. A disclosed sub-50% margin with a flat inference-to-revenue ratio implies a model dependency the founder cannot explain away.

The published bands are consistent. a16z's 2020 "The New Business of AI" by Casado and Bornstein pegged AI gross margins at 50 to 60%, well below the 60 to 80% or higher SaaS benchmark. ICONIQ's January 2026 reporting puts AI gross margins averaging 52%, up from 41% in 2024, with inference averaging 23% of revenue at scaling-stage AI B2B firms.

The second table turns the band into a fragility test. The diligence threshold is a gross margin below 50% for software or below 30% for AI-infra with no path to improvement.

The trajectory point is why "margin" is a signal and not a verdict. What makes it damning is a sub-50% margin and a flat inference ratio and no routing strategy to bring cost down. One without the others is noise.

The four public tests

Four tests are runnable from the outside with no cooperation from the founder. They convert "is this a wrapper" into four yes-or-no answers.

The substitution test: can a technical user get 80% of the output by pasting the core prompt into ChatGPT or Claude directly? If yes, you are looking at a wrapper. The API shutdown test: if the primary model provider revoked the API key tomorrow, does the product still deliver value? If no, it is a reskinned API. The feature announcement test: if OpenAI, Anthropic, or Google shipped the same feature, how many customers would stay? If most would leave, switching costs are near zero. The data test: does the product get better the more a specific customer uses it, delivering more value on day 90 than day 1 because of data only the company holds?

A documented pass/fail threshold exists for this battery: fail two or more of the tests and the target is a wrapper. Treat one fail as a flag to investigate and two as a verdict.

Weighing the moat trio: data, workflow, distribution

The partner-level call scores three moats and asks whether at least two hold. Proprietary data that compounds, workflow lock-in customers would miss if it disappeared, and distribution control are the three dimensions cited most consistently across frameworks.

Be honest about where the sources disagree. There is no single named "two of three" rule established publicly; it is a synthesis. Equidam lists five persisting moats - workflow capture, proprietary context and feedback loops, multi-model orchestration, distribution control, and compliance. Other frameworks count three or four, and they disagree on ordering: some weight distribution most heavily now, while others still weight proprietary data first. Score all three, name which one carries the company, and flag the disagreement rather than pretending it away.

The data moat is where most false positives hide, so hold it to a strict standard. Simply possessing a dataset that was expensive to collect is not durable, because it is static and can eventually be matched. A real data moat is living and compounding, where usage generates data that measurably improves the product for the next user. The flywheel is the moat, not the dataset.

The flywheel is the moat, not the dataset, and the 12-month clock is how you tell them apart.

Scale AI is the clean positive case: valued at $29 billion after Meta's 2025 investment, it built defensibility on proprietary data-labeling infrastructure rather than a model. The data accrues with use, which is what a static dataset never does.

How this read goes wrong

The most valuable part of a standard is the list of ways it lies to you. Each failure mode below has a specific check that defuses it.

The specific traps, and the check for each:

• Patent and job-post signal lag. Absence of patents can be timing, not absence of AI. Filings and postings are incomplete, skew toward larger firms, and carry known lags. Check across eight quarters, not one, before you read an absence as a fail.
• Model-card theater. A polished card proves documentation, not ownership. Over 90% of cards include architecture, evaluation metrics, and compute requirements, yet those evaluation scores are often created by the author rather than the community, and open-source weights get re-uploaded as "ours". Check commit history and base-model lineage.
• Substitution-test false negative. A target can pass because the UI hides a thin prompt. Reproduce the core output in a raw model yourself rather than trusting the demo.
• Scripted demos. Prepared demos are easy to stage. Request a live demonstration on data not previously processed, and treat resistance as a signal in its own right.
• Static "data moat". A large one-time dataset reads as a moat and is not one. Check for compounding usage loops, not volume.
• Margin mirage. A 50% margin can be fine if inference prices are falling. Condemning a company whose costs drop 80% next year is a false positive; read the routing strategy and the trajectory.
• Headcount ratio gaming. "Head of AI" is the single most common strategist-class title in the US index - a senior non-builder title can masquerade as ML depth. Check for individual contributors: ML engineers, research engineers, MLOps.
• Credential inflation. AI roles or partnerships get announced without the infrastructure or follow-through to support them. Cross-check job posts for the actual required skills, not the headline.

Google's Darren Mowry framed the underlying tell well: wrappers putting "very thin intellectual property around Gemini or GPT-5" signal a startup not distinguishing itself. The failure modes above are the ways that thin IP disguises itself as something more.

The pre-IC checklist

Run this before you write the verdict. Every item is something you can verify from public evidence.

Verdict: [DURABLE MOAT | WRAPPER WITH A PATH | FEATURE TO PASS]
Stack tier: [proprietary / fine-tuned / wrapper] - evidence: [model card / repo / dependency URL]
ML depth: [N] ML ICs : [M] strategist titles = [ratio] - evidence: [profile/job-post source]
Footprint: [X] HF models, [Y] repos, [Z] patents, [hiring velocity] over 8 quarters
Four tests: substitution [pass/fail], shutdown [pass/fail], feature [pass/fail], data [pass/fail]
Margin: [band] with inference ratio [trend]; fragility flag [raised/cleared]
Carrying moat: [data / workflow / distribution] - 12-month replication: [yes = not a moat / no = holds]

Keeping the read current

Re-run the footprint and margin dimensions on a cadence, because both move. Hiring velocity, new patent filings, and new Hugging Face models change the footprint read quarter to quarter, and the whole point of the eight-quarter window is that a single snapshot misleads. Margin economics move faster still: inference prices fall, routing strategies change, and a company you flagged on a 50% margin can cross into durable territory as its cost base drops.

The dimensions that move slowly are team ML depth and the data flywheel, which is exactly why they anchor the verdict. A compounding data moat and a credible bench of ML individual contributors take years to build and years to replicate, so a positive read on those two ages well. When you revisit a deal, re-read the fast-moving dimensions in full and spot-check the slow ones for a step change - a founding ML hire leaving, or an exclusive data relationship ending. The read is a living document, not a one-time verdict.