Compare moats

The FY2026 10-K (year ended 2026-01-31) shows real expansion inside the installed base: 118% Dollar-Based Net Retention, Base Customers up to 10,682 from 9,893, customers above $100,000 of ARR up to 1,456 from 1,229, and $1.0 million ARR customers "to 155 from 123, an increase of 26%". But the filing concedes "limited barriers to entry" and names "Microsoft Corporation, which owns GitHub" as principal competitor. Retention decelerates (130% FY2024, 123% FY2025, 118% FY2026), and since DBNR is reported "on a threshold basis of 130%," the FY2024 figure is a cap and the slide is steeper than it looks. Narrow, not wide: expansion must be re-won against a bundled hyperscaler.

source: sec.gov

The FY2025 10-K (fiscal year ended August 29, 2025) documents design-in niches but no durable excess return. In favour: the Competition section says some large rivals 'tend to have limited customization and service capabilities and are generally focused on higher-volume memory, storage, or compute products that are manufactured to industry-standard specifications'. It says the company's 'close collaboration with customers, customer-specific designs, long-lifecycle solutions, superior products and proprietary supply chain services create significant customer loyalty that may provide an advantage when competing against large international companies'. Against: the same filing says many competitors have 'substantially greater financial, technical, marketing, distribution and other resources' and 'lower cost structures'. Sales are made 'primarily pursuant to customer purchase orders and are not based on long-term supply agreements', and 'customers are not obligated to purchase our products even if we achieve a design win'. Large customers 'have exerted' pressure for price concessions, and the ten largest were 66% of fiscal 2025 net sales. GAAP operating income was 0.6%, 1.6% and 4.2% of net sales in fiscal 2023, 2024 and 2025, and fiscal 2024 had a net loss from continuing operations of $41.8 million. The 10-Q for the quarter ended May 29, 2026 (filed 2026-07-07, https://www.sec.gov/Archives/edgar/data/1616533/000161653326000043/peng-20260529.htm) adds that Advanced Computing nine-month sales fell 20.6%, reflecting 'both the ongoing Penguin Edge wind down and hyperscale hardware sales in 2025 that did not recur in 2026'. The filing's own advantage claim is hedged ('may provide an advantage'): design-in niches exist, but the 10-K shows no durable excess return.

source: sec.gov

The FY2025 10-K says 'we believe we have established a defensible competitive advantage through our power-first, innovation-driven strategy', resting on a power-native team, an application-agnostic framework for digital infrastructure design, end-to-end greenfield development capabilities, and the use of ASIC compute builds to rapidly and cost-effectively secure and monetize power. What separates this from no moat is scarce power: the filing says demand for energy capacity continues to outpace supply and that 'grid interconnection bottlenecks have further constrained access to power and digital infrastructure development', and Hut 8 reports 330 MW of utility capacity under construction at River Bend, commercialized in December 2025 through a 15-year triple-net lease supporting 245 MW of IT capacity, plus 1,230 MW of utility capacity under development. The same filing says 'The industries in which we operate are highly competitive and continuously evolving.', warns that these factors 'might not provide the competitive advantage we anticipate, or if they do, such competitive advantage might not endure', cites the River Bend lease (valued at $7.0 billion over the base term) as an example of expecting a significant portion of revenue from a limited number of customers, and says the company has not maintained consistent profitability. That supports narrow at most, not wide.

source: sec.gov

Stickiness comes from platform embedding, not IP. The 10-K rests differentiation on "our single platform with a unified data model," on "Consolidation of multiple tools into a single platform," and on deployment inside the customer's own perimeter for regulated buyers. Replacement means re-integrating a toolchain and re-certifying compliance. IP is the wrong label: only "16 issued patents and 25 pending patent applications," plus open-source licenses granting "broad permissions to use, copy, modify, and redistribute." The no-lock-in claim is the filing's own characterisation, footnoted to a Forrester study "commissioned by GitLab."

source: sec.gov

The strongest candidate moat source in the 10-K is design-in and qualification, a switching-cost argument, and the filing limits it too far to count. The risk factors say 'Our products are often incorporated into customers' systems at the design stage', and many specialty products 'are specifically designed for our OEM customers' systems or products'. But qualification is 'both product-specific and platform-specific', so a design win covers one platform. The filing notes that customers 'sometimes require us to re-qualify our products' for new platforms, which 'can be time-consuming and cause reductions in our net sales', so each new platform reopens the socket. It also says 'customers are not obligated to purchase our products even if we achieve a design win', and warns that OEMs designing in 'standardized or commodity components' could reduce demand for its 'higher priced specialized or customized solutions'. Scale is ruled out because the filing says many competitors have lower cost structures. Patents are ruled out as a durable source. The company holds about 1,650 of them and calls intellectual property 'an important aspect of our business', but it says its patents 'do not cover all of our technologies' and that competitors 'may design around our patented technologies'. It also says some products are 'built around mature industry standards and have less patent protection', so 'we cannot prevent our competitors from reverse-engineering and duplicating those products'.

source: sec.gov

The 10-K says 'we believe success depends on the ability to secure scarce assets like power, data center equipment, and customers', and places part of its claimed edge in 'our ability to use ASIC compute infrastructure development to rapidly and cost-effectively secure and monetize power'. Its examples: Vega was energized less than a year after acquisition for an all-in cost of about $455,000 per megawatt, which the filing calls 'a fraction of traditional data center costs', and Salt Creek was completed for about $250,000 per MW; Vega also has immediate access to some of the lowest locational wholesale power prices in North America. These are low-redundancy ASIC compute builds, which the 10-K says carry relatively low capital intensity by design. The 'fraction of traditional data center costs' comparison is against a different facility tier, and the filing gives no peer cost comparison and no cost figure for its AI campuses.

source: sec.gov

The 10-K positions GitLab against a leader rather than as one: "Our principal competitor is Microsoft Corporation, which owns GitHub." Competition reads from the challenger side, differentiating "from GitHub through flexible deployment options that work within enterprise security and compliance requirements, LLM neutrality with self-hosted gateway support" and an open core model. On AI it follows: Duo Agent Platform went "Generally available in January 2026," the last month of the fiscal year. What keeps it a follower rather than behind is cadence, "a new version of our software every month for 172 months in a row," plus a regulated-deployment franchise a SaaS-first rival does not cover.

source: sec.gov

The 10-K claims no share figure or rank in any segment. It says 'Our businesses compete with numerous global and local companies'. Its HPC and AI business 'competes primarily with global manufacturers of HPC and AI products and services'. For fault-tolerant solutions it says 'we primarily compete with manufacturers of enterprise servers and industrial computers'. Its memory business competes 'against memory module providers and, to a lesser extent, large semiconductor manufacturers'. The risk factors warn that larger competitors 'may be able to respond better to new or emerging technologies, such as generative AI'. Against that, the company's stated edge is customization and service, where it says some large rivals 'tend to have limited customization and service capabilities'. Its leadership language is self-description without share figures: Cree LED 'has been a leader in LED lighting technology', Stratus Technologies is 'a global leader in simplified, protected and autonomous computing platforms and services', and the memory business is 'a primary supplier of longer-lifecycle solutions to OEM customers'. A specialist that claims no rank and faces many larger, lower-cost rivals, while neither leading nor clearly trailing in its niches, is parity.

source: sec.gov

The 10-K says 'For example, we signed our first large scale single tenant AI data center lease and commenced construction of the site at our River Bend campus.', offered under the statement that to remain competitive with peers it may need to modify aspects of its business model. River Bend was commercialized in December 2025 through a 15-year triple-net lease supporting 245 MW of IT capacity; Fluidstack is expected to serve as tenant and Google is expected to provide a financial backstop, and initial delivery is targeted for Q2 2027. On speed, the filing says 'Through early engagement with Entergy Louisiana, we assumed key interconnection and development functions typically managed by the utility, such as the development of transmission and distribution infrastructure, materially accelerating originally quoted power delivery timelines.', and that Vega was energized 'less than a year after acquiring it'. It also warns that Hut 8 competes against companies 'that may be more established or have greater financial and other resources and/or expertise'. That describes a newer entrant moving quickly, not an established leader.

source: sec.gov

FY2026 gross margin was 87% against 89%, with cost of revenue up $35.6 million "primarily due to an increase of $18.4 million in third party hosting costs for SaaS and cloud usage," and management expects SaaS and Duo mix to bring costs that "may adversely impact our gross margins." Strain is explicit: GitLab "may be required to reduce our prices," competitors "may offer their products and services at a lower price or for free," and it "implemented user limits on our free SaaS product." Power retained: Premium lists at $29 per user/month billed annually, and seats bundle $12 and $24 of GitLab Credits. But "A majority of our subscriptions are on a one-year period."

source: sec.gov

The FY2025 10-K describes price as set by customers and the market. It says its large customers 'are able to exert, have exerted and we expect will continue to exert, pressure on us to make concessions on price and on terms and conditions'. It says 'The markets for our Integrated Memory products have historically been characterized by declines in average selling prices', and that 'Competitive pressure has led in the past and may continue to lead to intensified price competition resulting in lower net sales and lower profit margins'. Gross margin held in a narrow band: 28.8% in fiscal 2023, 29.1% in fiscal 2024 and 28.8% in fiscal 2025. The filing attributes each move to mix, for example higher-margin Advanced Computing service revenue in 2024, not to pricing. The 10-Q for the quarter ended May 29, 2026 (filed 2026-07-07, https://www.sec.gov/Archives/edgar/data/1616533/000161653326000043/peng-20260529.htm) reports gross margin of 27.8% versus 29.3% a year earlier (27.7% versus 28.9% for nine months), which it attributes to the Penguin Edge wind-down and sales mix. Third-quarter Integrated Memory sales rose 111.4% (75.6% for nine months) as 'accelerating AI-driven demand drove favorable pricing and increased volume', and the 10-Q says that business has 'gross margins which are lower than the Company average'.

source: sec.gov

The 10-K says ASIC compute, run through American Bitcoin, can only be profitable if hardware and electricity costs are below the price of the Bitcoin mined, which makes it a price-taking business. It also says Traditional Cloud and AI Cloud compete with cloud services providers for customers, and that the company has not maintained consistent profitability. River Bend's contracted triple-net lease economics are not in service yet; initial delivery is targeted for Q2 2027.

source: sec.gov

GitLab sits at the software-tooling layer, not compute or models. It consumes third-party LLM capacity — marketing "LLM neutrality and support for self-hosted AI gateways, including air-gapped environments" — so it captures no model-layer economics and bears inference as COGS, visible in the $18.4 million rise in hosting costs. Its distinctive position is the regulated perimeter.

Downstream integrator. Per the 10-K it buys memory from Samsung, Micron, SK hynix and Kioxia and processors from Intel and AMD, and turns them into specialty memory modules and managed AI/HPC clusters for OEM, enterprise, government and cloud customers.

Power-first developer building AI data center capacity, beginning with River Bend under a 15-year lease (Fluidstack is the expected tenant and Google is expected to provide a financial backstop; initial delivery is targeted for Q2 2027), and runs Bitcoin mining through majority-owned American Bitcoin.

• Enterprise Agile Planning add-on Unknown · Low source: sec.gov
• GitLab Dedicated (including Dedicated for Government) Unknown · Deep source: sec.gov
• GitLab DevSecOps Platform (Free, Premium, and Ultimate tiers) Unknown · Moderate source: sec.gov
• GitLab Duo Agent Platform (with GitLab Credits) Unknown · Low source: about.gitlab.com
• Self-Managed GitLab (on-premises and hybrid cloud deployment) Unknown · Deep source: sec.gov

• AI and HPC infrastructure (OriginAI, ICE ClusterWare) Unknown · Low source: sec.gov
• Cree LED chips and components (XLamp, J Series, high-brightness SMD) Unknown · Low source: sec.gov
• SMART Modular specialty memory and storage (DRAM modules, Zefr, CXL, flash/SSD) Niche · Moderate source: sec.gov
• Stratus fault-tolerant computing (ztC Endurance, ftServer, ztC Edge, everRun) Niche · Low source: sec.gov

• AI data center campuses (River Bend, Beacon Point) Unknown · Moderate source: sec.gov
• ASIC compute (American Bitcoin) Unknown · Low source: sec.gov
• Highrise AI Niche · Low source: sec.gov
• Hut 8 Canada (traditional cloud and colocation) Niche · Low source: sec.gov

Editorial prior, not backtested.

see exactly how it voted →

Editorial prior, not backtested.

see exactly how it voted →

Editorial prior, not backtested.

see exactly how it voted →