Amazon and the Moat the Market Still Calls Retail

Big tech is supposed to be a settled ranking. Apple has the consumer lock-in. Microsoft has the enterprise lock-in. Google has search. Amazon is the retailer that happened to build a cloud. NVIDIA is the AI cycle. Meta and Netflix are the attention businesses the MAG7/FAANG label still drags along. The market sorts on brand. The five-pillar grid sorts on whether the company is the record in the industry the label names — and in a second one.

The MAG7 tape still prices Amazon as a retailer with a server business attached. Microsoft clears the same four fortress boxes. Apple sits further behind than its reputation: strong on the network and the payment layer, intact on system of record and data, and with no regulatory lock-in to claim — the DMA is pressure on the App Store, not a lost licence. Alphabet, Meta, NVIDIA and Netflix do not print that fortress. Grouping them under one MAG7 factor is what produces the mis-rank.

Amazon and Microsoft both print strong on four of the five and intact on regulatory lock-in: GovCloud, FedRAMP and classified-cloud authorisations are held by every hyperscaler, so they bar small entrants rather than each other. That is the fact the rest of the piece has to live with, not a finding to talk around. Apple is strong on the network and the transaction layer, intact on system of record and proprietary data — iCloud records are portable, and Apple does not pool the private data it holds — and not applicable on regulatory lock-in: Apple never held a regulatory moat, and the DMA sideloading and third-party store mandates — not a hypothetical — are charged as a risk to the App Store rather than scored as a lost lock. Alphabet is strong on the network and the data, and only intact on the transaction layer, system of record and regulatory lock-in: search sends the buyer to the merchant's checkout rather than hosting it, Workspace is a real switching cost but it is not Active Directory, and the search-remedies appeal is still live. Meta's graph is strong and its regulatory pillar is not applicable — the DMA is a cost on how it combines data, not a licence it lost. NVIDIA's CUDA network is strong and its system of record is intact, which is what a cycle looks like when the customer can rewrite the stack. Netflix is a content company wearing a platform label.

The matrix does not separate Amazon from Microsoft. Both print four of the five default-resilient pillars strong, and the same intact regulatory box. The increment this page is arguing for is not an extra box. It is the second industry. Microsoft's four sit inside one graph: identity, documents, collaboration, GitHub, Azure. Amazon's four sit in that graph's cloud equivalent and in physical commerce — the marketplace, Prime, Fulfillment by Amazon, last-mile density. The market treats the physical half as the low-moat remainder. It is the increment.

Q2 2026 is the cleanest recent print of the stack, because it shows the two industries side by side rather than asking the reader to take the flywheel on faith. AWS is the profit pool. It is not the company.

The rows do not add. North America, International and AWS already sum to the company. Third-party seller services, at $46.8B, outsold AWS in the same quarter because that line is the marketplace sitting inside the geographic segments, not on top of them. North America and International together were $158.4B against AWS's $42.2B — roughly four-fifths of sales. AWS was about 60% of the $27.5B of operating income. That mix is the whole confusion. The profit pool lives in the cloud. The volume, the buyer-seller network, the last-mile density, and the advertising data live in the store. A ranking that starts from operating income will call Amazon a cloud company with a retail problem. A ranking that starts from the fortress pillars has to count both, because the network, the transaction layer and a large share of the proprietary data are the retail half.

The contracted book roughly doubled in two quarters, and the weighted-average remaining life moved from 4.1 years to 6.4 years. That is not a one-quarter reservation spike. It is the cloud system of record getting longer and larger at the same time. The concentration risk is real — a material share now sits with two frontier labs whose own funding is not yet self-sustaining — and it is a growth and ROIC fact, not a reason to pretend the physical stack does not exist.

The reason the physical half belongs on the fortress side of the ledger is switching cost that does not travel over a wire. An enterprise can dual-run Azure and AWS. Plenty do. A household does not dual-run two next-day delivery networks, and a third-party seller does not dual-run two fulfillment networks that both confer the Prime badge. Density in a metro compounds: more sellers draw more buyers, more buyers justify more same-day nodes, more nodes lower unit cost, lower unit cost draws more sellers. That loop is the same shape as a software network effect and a worse one to replicate, because the scarce input is warehouse location and trailer hours rather than API surface.

• System of record — AWS is the cloud record: S3, IAM, the account, the $496B of contracted usage. The store is the other record: the buyer's order history, the seller's catalog, the fulfillment node that last touched the SKU. An agent that reorders paper towels still has to clear that record.
• Transaction embedding — 1-Click and Prime on the consumer side; FBA and Buy Box on the seller side; AWS billed into the infrastructure of the companies that run on it. Automating the shopper does not remove the transaction. It still settles on Amazon.
• Network effects — the two-sided marketplace. Third-party seller services at $46.8B in a quarter is the network showing up as revenue, not as a metaphor.
• Proprietary data — purchase intent, last-mile telemetry, AWS usage. Advertising at $19.8B, +26%, is the cash register for the same data. It is not a separate moat. It is the store's data billed to brands.
• Regulatory lock-in — GovCloud, FedRAMP, DoD, HIPAA. The cloud half of the stack is the accredited substrate, but Azure, Google Cloud and Oracle hold the same authorisations, so the framework rates it intact, not strong. It is a floor every hyperscaler stands on, not a box that separates them.

Microsoft's four strong pillars are not weaker copies of these. They are the enterprise version: Active Directory is the identity record, Graph is the transaction layer, M365 is the bundle, Azure is the cloud. The difference is correlation. Microsoft's second franchise shares the customer's IT department with the first. Amazon's second franchise shares almost nothing with the first except the parent. A CIO can put the productivity suite and the cloud on the same vendor. A household's next-day grocery order does not sit in that meeting.

The other side of this ranking is not a straw man, and it is not Netflix. It is Microsoft, and a reader who holds that Microsoft has the widest moat in big tech is reading a real fortress, not a brand. Active Directory is a worse thing to leave than an S3 bucket. You can multi-cloud the workload. You do not multi-home the identity plane that every other SaaS app federates through. SharePoint holds the documents. Teams holds the channel. Copilot at 30 million paid seats is that graph with an agent sitting on it, which raises extraction cost rather than lowering it. Azure grew 43% in Q4 FY26, crossed $100B of revenue for the fiscal year, and carried $678B of commercial remaining performance obligation. On the five default-resilient pillars the matrix does not give Amazon a single extra box.

What the other side gets right is depth in one domain. If the question is which company is harder for a Fortune 500 IT organization to decommission, the answer is Microsoft, and it is not close. Amazon's cloud switching cost is real and it is not AD. The OpenAI relationship that is supposed to be Amazon's demand floor is the same counterparty Microsoft disclosed in the Q2 FY26 print at roughly 45% of the then-$625B commercial RPO; with Q3 and Q4 sequential adds described as non-frontier, that is still roughly two-fifths of the $678B Q4 book — and OpenAI is free to route work to any cloud. A ranking that weights enterprise identity over physical density will put Microsoft first, and it will not be making a category error. It will be making a different choice about which switching cost compounds.

The framework's choice is the uncorrelated second record. Microsoft's Azure and M365 reinforce each other inside one buyer. That is a bundle, and it is a strong one — the framework even routes Microsoft's bundling pillar into the resilient group. It is still one industry's IT budget. Amazon's store and Amazon's cloud share a balance sheet and almost no customer graph. A shock that hits enterprise software spend leaves the marketplace standing. A shock that hits consumer wallets leaves AWS standing. The case for ranking Amazon ahead is that diversification of the fortress, not a claim that IAM is deeper than Active Directory. Anyone who wants to invert the ranking has to argue that correlated depth beats uncorrelated breadth. That argument is coherent. It is also the argument the market is already making, which is why Amazon still trades as a retailer.

Apple is the second honest counter-example. The consumer ecosystem — iMessage, the App Store, Apple Pay, iCloud as the photo library — is the textbook switching-cost story, and the installed base printed another all-time high with the Q3 FY26 June quarter. Services at $30.7B and +12% is that lock-in billed as a high-margin subscription. The crack that matters is regulatory, and it runs through the App Store rather than a licence: the DMA already forced sideloading and third-party stores, and Siri's intelligence is now rented from Gemini on top of the search-default check. System of record and proprietary data sit at intact rather than strong, because the photo library can be moved and the private data is not pooled. A reader who thinks Apple has the widest moat is weighting device primacy and that installed base over Amazon's logistics-plus-cloud stack. That weighting was more defensible before the DMA. It is still the closest consumer-side case.

Alphabet, Meta, NVIDIA and Netflix are not the other side of this ranking. Google Cloud at +82% and a $514B backlog is the fastest hyperscaler print of the season, and it is still a growth line on a search company — Workspace is not the compliance layer of the Fortune 500, and the search-remedies appeal sits on the regulatory pillar. Meta can raise price per ad and still not put a regulated audit trail at risk. NVIDIA's Data Center line is the profit pool of a cycle the process-step piece already argued you can design around. Netflix is scaled content. Microsoft is the counter-case.

This page is not a claim that Amazon is cheap, and it is not a claim that the capex bill is a rounding error. Trailing-twelve-month free cash flow swung to an outflow of $7.6B in the same quarter the backlog doubled; 2026 capex is being spent to keep the cloud record. That bill is the subject of the hyperscaler build piece, which already ran Amazon through the contracted-before-poured test. The job here is narrower: the MAG7 label sorts on brand, the moat column sorts on whether the fortress runs through one industry or two, and Amazon is the name whose second industry is the one the label treats as a discount.

The lesson generalises past this cohort. When a market labels a company by its original product, check whether the second product is a second system of record or just a growth line. Google Cloud is currently a growth line on a search company. Azure is a second product inside one enterprise graph. AWS is a second record, and the first record is still the store. The MAG7 factor cannot see that distinction. The five-pillar grid can.