Compare moats
Up to three covered companies, band by band. Every call is a curated editorial judgment, never a disclosed figure — and every band carries its cited basis.
| Nebius Group | Palo Alto Networks | Cisco Systems | |
|---|---|---|---|
| Moat rating | narrow The FY2025 20-F positions Nebius as 'one of the few global, at scale, multi-tenant clouds purpose built for AI,' but the same filing names its central dependency plainly: 'We currently rely on Nvidia for the GPU chips we use' — a purpose-built neocloud renting a supply the hyperscalers it competes with also control, which is a real but narrow position. | narrow Real but bounded. The FY2025 10-K's own Competition section calls the enterprise security industry "intensely competitive" and names four categories of rival — platform incumbents (Cisco, Microsoft, Alphabet), independent security vendors (Check Point, Fortinet, CrowdStrike, Zscaler, Wiz), point-product startups, and the public cloud vendors — while conceding that "some of our competitors may have substantially greater financial, technical, and other resources, greater name recognition, larger sales and marketing budgets, broader distribution, more diversified product lines, and larger and more mature intellectual property portfolios." That record supports a defensible position, not an unassailable one: narrow, not wide. | narrow The FY2025 10-K shows a moat that still pays but no longer compounds: total gross margin of 64.9% and remaining performance obligations of $43,533 million (up 6%) against a Networking product category that fell from $34,570 million in fiscal 2023 to $29,229 million in fiscal 2024 to $28,304 million in fiscal 2025, and a product gross-margin bridge in which 'Product pricing' subtracted 1.6 percentage points. All of the reported category growth came from Splunk-carrying lines - Security +59% and Observability +26%. Real and durable, but bounded: narrow, not wide. |
| Moat type | cost scale The moat the filing describes is engineering: designs that 'optimize power and cooling efficiency, lower latency' plus 'a consistent track record of being one of the first-to-deploy the latest generation of NVIDIA GPU chips' — density and time-to-deploy at scale, not a switching lock. | switching costs The 10-K describes an installed estate standardised on one operating system — "All of our hardware and software firewalls incorporate the PAN-OS operating system and include the same rich set of features, ensuring consistent operation across our entire product line" — across hardware, containerised CN-Series and virtual VM-Series form factors, centrally administered through Panorama and Strata Cloud Manager. That estate is monetised as recurring contract: subscription and support was 80.5% of total revenue in fiscal 2025 (80.0% in fiscal 2024, 77.1% in fiscal 2023), on terms "typically one to five years." The company's own risk factors describe the friction from the other side — customers "may face real or perceived switching costs when switching to our solutions from legacy security vendors" and "have often invested substantial personnel and financial resources to design and operate their networks... [and] may prefer to purchase from their existing suppliers rather than add or switch to a new supplier." As the incumbent in most of those estates, that friction now runs in Palo Alto's favour. | switching costs The durable piece is the contracted annuity attached to installed equipment: total remaining performance obligations of $43,533 million, of which $21,961 million is services and $21,810 million is long-term (recognised beyond twelve months), carried at a services gross margin of 68.5% that has risen for three consecutive years from 66.4% and 68.1%. Customers keep paying for support on gear they already run. |
| Leadership | fast follower The 20-F's own claim is 'one of the FEW global, at scale' AI clouds — a differentiated challenger to the hyperscalers it names as the competitive field, not a claimed leader of it; the first-to-deploy record is a follower's speed advantage, not category leadership. | co leader The 10-K claims parity-plus, not primacy: "We believe we generally compete favorably with our competitors on the basis of these factors as a result of the features and performance of our portfolio, the ease of integration of our security solutions with technological infrastructures, and the relatively low total cost of ownership of our products," and reports that its "products and services have been recognized as leading in 25 categories by third-party industry analysts firms." It qualifies that immediately by conceding that some competitors carry greater resources, name recognition and distribution. Independent analyst placements match a co-leader read rather than a sole-leader one — a Leader in the inaugural 2025 Gartner Magic Quadrant for Hybrid Mesh Firewalls, a Leader for the third consecutive time in the 2025 Magic Quadrant for SASE Platforms, and a Leader in the 2026 Magic Quadrant for Endpoint Protection Platforms for the fourth consecutive year — in categories that name other Leaders too. | co leader The 10-K names no competitor and discloses no market share anywhere in Management's Discussion and Analysis. The positional facts it does give are scale and direction: Networking product revenue of $28,304 million in fiscal 2025 - by far the largest of its four categories - but down $6.3 billion from fiscal 2023, with channel partner financing volume falling from $32.1 billion to $27.1 billion to $24.9 billion across fiscal 2023-2025. |
| Pricing power | weak The filing frames a 'highly competitive' market with 'frequent introduction of new or improved solutions' and a GPU cost base set by a single supplier (NVIDIA) — a renter of compute competing on efficiency has little list-price control. | moderate Moderate, with the evidence pointing both ways in the same filing. Gross margin computed from the three years of income statements inside this FY2025 10-K runs 72.3% (fiscal 2023), 74.3% (fiscal 2024) and 73.4% in fiscal 2025 on revenue of $9.22 billion — against 68.8% in fiscal 2022 as reported in the prior-year 10-K (accession 0001327567-24-000029, filed September 6, 2024). Over the same span subscription and support rose from 77.1% to 80.5% of revenue: a mix shift toward software that has been margin-accretive, not margin-destructive, which is the direct answer to whether platformisation is simply discounting. Against that, the 10-K's risk factors state plainly that sales prices "may decline for a variety of reasons, including competitive pricing pressures, discounts, a change in our mix... or promotional programs," that the company "anticipate[s] that the sales prices and gross profits for our products could decrease over product life cycles," and that it "has also experienced demands for customer financing and deferred payments." Pricing is defended by bundle economics rather than commanded outright. | moderate The product gross-margin bridge attributes fiscal 2025's 0.2-point improvement to productivity (+2.0 points) and mix (+1.1 points) while 'Product pricing' subtracted 1.6 points; a legal dispute with a supplier cost a further 0.8 points. Total gross margin of 64.9% (product 63.7%, services 68.5%) is held by cost and mix, not by price. |
| Summary | Nebius sells a 'unified full-stack AI cloud that spans the complete AI journey – from compute capacity to software and services,' with hardware and software built in-house — the neocloud pitch of hyperscaler reliability at purpose-built efficiency, and a first-to-deploy record on new NVIDIA silicon. Two things bound the moat, both from the filing: it 'currently rel[ies] on Nvidia for the GPU chips,' the same constraint every neocloud shares, and it is a Nasdaq 'Controlled Company' whose founding shareholder holds concentrated voting power. The three non-core segments (Toloka, Avride, TripleTen) are separate businesses, not the cloud moat. | A deployed firewall estate is the anchor. Every Palo Alto firewall — appliance, VM-Series, CN-Series, Cloud NGFW — runs the same PAN-OS with the same feature set and is managed from one console, so the security policy, the operator skills and the integration work are all specific to the vendor, and 80.5% of fiscal 2025 revenue is the recurring subscription and support contract sitting on top of it (10-K, Business and Risk Factors). Platformisation is the attempt to convert that anchor into wallet share: the 10-K states the strategy as helping customers "simplify their security architectures through consolidating disparate point products" by packaging offerings "into a tightly integrated architecture," and the acquisitions are consistent with it — IBM's QRadar assets in August 2024 "to help accelerate the growth of our Cortex business," Protect AI in July 2025, and the CyberArk agreement signed in July 2025. The evidence that consolidation is real rather than a discount: remaining performance obligation grew 36% year over year to $18.4 billion against 31% revenue growth in the quarter ended April 30, 2026 (Palo Alto Networks FQ3 2026 results release, June 2, 2026) — contracted future obligation compounding faster than recognised revenue, which is the opposite of what buying revenue with price would produce. The counterweight is disclosed in the same filings: the 10-K warns sales prices "may decline for a variety of reasons, including competitive pricing pressures, discounts," anticipates that "sales prices and gross profits for our products could decrease over product life cycles," and reports "demands for customer financing and deferred payments." Against CrowdStrike in security operations and Zscaler in SASE, Palo Alto is competing across the whole surface rather than defending a monopoly on any one of them — hence a narrow moat, not a wide one. | The installed base still switches slowly - but the filing does not claim it is winning the AI datacenter on the strength of that base. The fiscal 2025 Networking decline is attributed to 'product shipments returning to normalized levels during the first half of fiscal 2025 from the elevated levels ... in the first half of fiscal 2024', to servers, and to 'a decline in campus switching' - normalisation, not disclosed share loss, so the whitebox/Arista thesis is not something this 10-K either confirms or denies. What the filing does disclose is the shape of the AI dollar Cisco is actually winning: Americas service provider and cloud growth 'driven by AI infrastructure revenue from webscale customers', funded by additional purchase commitments 'related to manufacturing Cisco Silicon One and other products to meet demand from webscale and other customers', which 'significantly increased our supply chain exposure, which has resulted in negative impacts to our product gross margin in recent periods and may result in further negative impacts in future periods'. Enterprise switching earns 63.7% product gross margin; webscale silicon costs margin to serve. The moat is intact where the annuity is and thin where the growth is. |
| Chain position | Layer-8 neocloud — a purpose-built AI compute provider reselling NVIDIA silicon at scale. | A security-software consumer of the AI stack rather than a supplier to it — it buys compute to run Precision AI and now sells protection for the stack itself through Prisma AIRS (AI model scanning, posture management, red teaming, runtime and AI-agent security). Distribution is two-tier and concentrated: 44.2% of fiscal 2025 revenue came through three distributors and more than 8,500 channel partners, while no single end-customer exceeded 10% of revenue in fiscal 2025, 2024 or 2023. | Supplies networking into AI datacenters: the 10-K ties Americas service provider and cloud growth to 'AI infrastructure revenue from webscale customers' and to Cisco Silicon One manufacturing commitments. |
| Products (share / barrier) |
|
|
|
| Long-horizon vote | -0.01 at weight 0.20 · swarm neutral Editorial prior, not backtested. | +0.13 at weight 0.20 · swarm neutral Editorial prior, not backtested. | +0.13 at weight 0.20 · swarm neutral Editorial prior, not backtested. |