Compare moats
Up to three covered companies, band by band. Every call is a curated editorial judgment, never a disclosed figure — and every band carries its cited basis.
| NetApp | CrowdStrike | Datadog | |
|---|---|---|---|
| Moat rating | narrow The FY2026 10-K shows a real, durable lock but not an unassailable one. On the durable side: "Our cloud storage services are based on the same ONTAP data management software that underpins our on-premises ONTAP storage infrastructure offerings", and the same filing's income statement shows the company holding a gross margin near 71% across all three reported years - $4,433M on $6,268M in FY2024, $4,613M on $6,572M in FY2025 and $4,899M on $6,925M in FY2026 - while revenue grew from $6,268M to $6,925M and income from operations widened from 19% to 24% of net revenues. Holding that margin through the memory-cost shock the same filing discloses is the commercial evidence the lock is worth something. On the limiting side, the filing says competition "is intense", that in public cloud "customers may choose native cloud services that are consumed as operating expenses", and that "New competitors or alliances among existing competitors could emerge and quickly gain significant market share" - and IDC's 1Q26 external-storage tracker (Blocks & Files, 2026-06-16, cited on the AFF/ASA product row below) ranks NetApp second behind Dell, not first. | narrow Narrow rather than wide because the FY2026 10-K argues both ways and its own risk factors are the harder side: it describes a self-reinforcing data advantage and says "we do not believe any of our competitors currently have a true platform offering equivalent to the Falcon platform", but the same filing calls the market for security and IT operations solutions "intensely competitive, fragmented", warns that "Competitive pricing pressure may reduce our gross profits", and still carries the July 19 Incident as having "had, and is expected to continue to have, an adverse effect on our business, sales, customer and partner relations, reputation" more than two years after it occurred. | narrow The FY2025 10-K grounds real stickiness — a trailing-12-month dollar-based net retention rate of "about 120%" as of December 31, 2025 and "approximately 84% of our customers were using two or more products" out of approximately 32,700 customers — but the same filing caps it. It names IBM, Microsoft and SolarWinds (on-premise infrastructure monitoring), Cisco, New Relic and Dynatrace (APM), Cisco and Elastic (log management) and "native solutions from cloud providers such as Amazon Web Services, or AWS, Microsoft Azure, and Google Cloud Platform" as competitors, plus "home-grown and open-source technologies", and concedes "many of our competitors have greater financial, technical and other resources, greater brand recognition, larger sales forces and marketing budgets". It further discloses an AI-native cohort "which cohort includes our largest customer and represented approximately seven percentage points of our year-over-year revenue growth for the quarter ended December 31, 2025" whose members "have rapidly increased their usage of our product and then optimized or may in the future optimize their usage". Sticky but bounded: narrow, not wide. |
| Moat type | switching costs The FY2026 10-K makes the source of the advantage explicit and it is the cost of leaving the data-management layer, not a network or a patent estate. The same ONTAP software runs the on-premises arrays and the cloud services ("Our cloud storage services are based on the same ONTAP data management software that underpins our on-premises ONTAP storage infrastructure offerings"), and the AFF family "allows customers to connect to clouds for more data services, data tiering, caching, and disaster recovery". A customer's volume layout, snapshot and replication workflow and operating tools therefore carry from the array into Azure, AWS and Google rather than being abandoned at the cloud boundary — the filing describes NetApp as "the only provider of enterprise-grade storage services natively embedded in the world's largest public cloud providers", so the usual moment of escape is instead the moment the relationship renews. | network effects The 10-K states the mechanism directly: "The more data that is fed into our Falcon platform, the more intelligent the AI Security Cloud becomes, the stronger our ability to anticipate and counter evolving adversary tradecraft, and the more our customers benefit, creating a powerful network effect that increases the overall value we provide." | switching costs The 10-K locates the durable hold in platform integration rather than protected IP. A single agent collects "metrics, traces, logs, and other data"; under "One Data Model" every ingested datum is "consistently tagged with metadata regardless of its type", so different data types can be "queried together, correlated, alerted on, and visualized in a common user interface"; more than 1,000 out-of-the-box integrations bind it to the customer's stack; and the attach ladder deepens (approximately 84% of customers on two or more products, 55% on four or more, 33% on six or more and 18% on eight or more as of December 31, 2025). Displacing Datadog means re-instrumenting an estate the filing describes as "frequently deployed across a customer's entire infrastructure, making it ubiquitous". |
| Leadership | co leader IDC's 1Q26 external enterprise storage systems tracker, as reported by Blocks & Files on 2026-06-16 (cited in full on the AFF/ASA product row below), ranks NetApp second worldwide behind Dell and ahead of Everpure, Huawei and HPE, attributing the placing to "its growing all-flash business and cloud-integrated data management". Second of five ranked vendors, in a market whose leader is someone else, is a shared front rank rather than an owned one - and the distinct claim NetApp makes in the FY2026 10-K is positional rather than volumetric: being "the only provider of enterprise-grade storage services natively embedded in the world's largest public cloud providers". | co leader Co-leader rather than clear leader because the only claim of platform primacy available is the company's own ("we do not believe any of our competitors currently have a true platform offering equivalent"), while the same 10-K describes a fragmented market and lists seven distinct categories of competitor, from legacy antivirus to network security, cloud security, identity and legacy SIEM vendors. | co leader The 10-K claims only that "We believe that we compete favorably with respect to the factors listed above" — never category leadership — and names a distinct credible rival set in each category it serves, while conceding many of those rivals have greater resources and brand recognition. It does claim one first: being "the first to combine the 'three pillars of observability' - metrics, traces, and logs - into a single end-to-end platform" with log management in 2018. That reads as the leading independent among several credible rivals, not a clear leader. |
| Pricing power | moderate It holds price rather than raising it. On the figures filed with the FY2026 10-K, gross margin was 70.7% of revenue in FY2024 ($4,433M on $6,268M), 70.2% in FY2025 ($4,613M on $6,572M) and 70.7% in FY2026 ($4,899M on $6,925M) - flat across three years in which revenue grew from $6,268M to $6,925M - and it held that level while absorbing a component-cost shock. It is no stronger than that because the filing's own risk factor lists "competitive pricing, customer price sensitivity" and "pricing and discounting pressures" among the drivers of gross margin, and discloses that the company "experienced inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have affected our gross margins" - a cost shock it is absorbing rather than fully passing on. | moderate The 10-K's risk factors state that "Competitive pricing pressure may reduce our gross profits" and that competing successfully may require "aggressive pricing", which is the company's own case against strong pricing power; the offsetting factor it cites is module consolidation on one sensor. | moderate Expansion is real but volume-driven rather than price-driven. The 10-K attributes the increase in trailing-12-month dollar-based net retention to about 120% (from "high-110%'s" a year earlier) to "increased usage growth from existing customers", and describes self-service expansion by "adding hosts or volumes of data monitored". The same filing warns that if customers "reduce their usage, fail to renew their subscriptions or renew on different terms", then "our revenue and dollar-based net retention may decline" — a usage-metered model hands the customer a dial that seat-based pricing does not. |
| Summary | NetApp sells storage hardware but the asset is ONTAP, the data-management software that has run its arrays for over three decades and now also runs inside the three largest public clouds as a first-party service. The FY2026 10-K organises the company into two segments, Hybrid Cloud (AFF and ASA all-flash arrays, AFX for AI workloads, FAS hybrid-flash, E/EF-Series, StorageGRID object storage) and Public Cloud (Azure NetApp Files, Amazon FSx for NetApp ONTAP, Google Cloud NetApp Volumes, Cloud Volumes ONTAP), and states that both rest on the same ONTAP software. That is the whole argument: an enterprise that has standardised its snapshots, replication and multiprotocol access on ONTAP carries those habits with it when it moves workloads to a hyperscaler, and NetApp is paid on both sides of the move. The evidence that the lock has commercial value is the margin's steadiness: across the three years the FY2026 10-K reports, gross margin sat at 70.7%, 70.2% and 70.7% of revenue ($4,433M on $6,268M, $4,613M on $6,572M, $4,899M on $6,925M) while revenue grew, and the filing's own percentage-of-revenue table shows no mix shift doing that work - product and services held near 46% and 54% of revenue throughout. The limits are equally in the filing. NetApp is second, not first: IDC's 1Q26 tracker puts it behind Dell in external enterprise storage, and the 10-K's competition section concedes that cloud providers are simultaneously partners and rivals, that consumption models "may reduce overall demand for our traditional on-premises offerings sold through a capital expenditure (capex) model", and that alternative architectures "may reduce or eliminate demand for some of our offerings". Component exposure is real too: the filing discloses "inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have affected our gross margins", and names NAND among the components whose supply can tighten. This is a durable second place built on software stickiness, not a structural monopoly. | A single lightweight sensor collects enterprise data once and reuses it across 33 cloud modules, and the pooled telemetry trains the models every customer is then defended by — the 10-K calls this crowdsourced, high-fidelity data "cloud-scale AI" and treats it as the fundamental differentiator from competitors. | Datadog's advantage is consolidation, not exclusivity. Per the FY2025 10-K it runs a modular platform of "over 20 products" fed by one agent and one tagged data model, deployed across a customer's whole estate with more than 1,000 integrations — so each additional product adopted makes the estate costlier to unwind, which shows up as roughly 120% dollar-based net retention and a multi-product attach ladder that thickened at every rung during 2025. What holds the rating at narrow rather than wide is that the filing itself names hyperscaler-native monitoring and open-source tooling as direct substitutes in the same categories, and flags an AI-native cohort including its largest customer that can optimize usage down as quickly as it ramped up. |
| Chain position | NetApp sits between the memory supply and the enterprise data centre. Upstream, the FY2026 10-K says "Third-party component costs make up a significant portion of our product costs" and singles out NAND as hard to manage "if supplies of certain components, including NAND, become limited relative to demand". Downstream, the hyperscalers are channel, partner and rival at once: the filing states "We both partner with and compete against cloud service providers through our cloud-based software and services offerings", while Azure NetApp Files, Amazon FSx for NetApp ONTAP and Google Cloud NetApp Volumes are delivered as those clouds' own natively embedded services. Distribution is a mix of direct sales and "an ecosystem of partners, including the leading cloud providers". | AI-native security platform — an adopter and reseller of AI rather than a supplier of AI infrastructure. | A software layer above the cloud rather than a supplier into it: the 10-K describes the platform as "cloud agnostic", deployable across "public cloud, private cloud, on-premise, multi-cloud, and hybrid environments", and monetizes the AI build-out through LLM Observability, which traces LLM chains and correlates them with APM. |
| Products (share / barrier) |
|
|
|
| Long-horizon vote | +0.13 at weight 0.20 · swarm neutral Editorial prior, not backtested. | +0.13 at weight 0.20 · swarm neutral Editorial prior, not backtested. | +0.13 at weight 0.20 · swarm neutral Editorial prior, not backtested. |