Summary. Most coverage of the AI wave focuses on the wrong question: which startups will die. Nine in ten always do. The structural question is the opposite: where can a business compete with Anthropic, OpenAI and Google when their bundles keep widening? Adobe, Salesforce and Intuit answered that question against Microsoft and won by occupying layers the bundle could not run efficiently. The same four positions are open today: protocol authority, workflow and data model authority, regulated domain expertise, and customer-side data and identity. The right question for any founder, board or PE thesis is which position a business occupies, and how deeply.
The Survival Question
A lot has been written about startup mortality in the AI wave. Most of it makes a category error. It treats a statistic, nine in ten startups die, as an insight. It is not an insight. It is the baseline condition of the business.
The interesting question in a platform wave is not who dies. It is who survives, and why.
In the Microsoft wave of the nineties and two-thousands, Lotus 1-2-3, WordPerfect and Netscape died on schedule. The product was good. The bundle was unstoppable. Office and Internet Explorer ate them. In hindsight that was predictable.
What was not predictable: Adobe survived. Salesforce beat Microsoft Dynamics. Intuit dominated a market in which Microsoft Money fought and lost. Three companies that held their own next to the dominant bundle and became platforms themselves. That is the historical anomaly worth analysing.
What did they do that Lotus and WordPerfect did not?
Adobe controlled the format. PostScript, then PDF. While Apple and Microsoft fought over operating system control, PDF became the cross-platform document standard and was later ISO-certified. Microsoft could not kill PDF through bundling because it was an open specification running in every printer, every browser, every government office. Photoshop and Illustrator sat on top as vertical workflow tools for a profession Microsoft never seriously tried to serve. Creative Cloud arrived later as subscription lock-in over asset libraries.
Salesforce defined the data model. CRM in the cloud, with an API that itself became a platform (AppExchange). Microsoft Dynamics competed on the product. Salesforce competed on the workflow architecture. Anyone introducing Salesforce built customisations, integrations, reports and processes on top of it. Coase would recognise the mechanism: the lock-in is in the asset specificity, not in the code. The data became the source of truth for entire sales organisations.
Intuit used regulation as a moat. QuickBooks and TurboTax are embedded in US tax law and accounting standards, with annual updates, bank integrations and an SMB audience that Microsoft never seriously addressed with Office. Domain depth (tax, bookkeeping, payroll) was what Microsoft Money lacked. Microsoft Money was retired in 2009. Intuit's Small Business and Self-Employed segment alone runs into ten-figure annual revenue today.
Three different strategies, one shared pattern. All three occupied a layer below or beside the platform bundle in which the platform could not operate efficiently.
The Four Positions in the AI Wave
First position: format and protocol authority. The cleanest example today is MCP. Anthropic published the Model Context Protocol in 2024 as an open specification under MIT licence. OpenAI, Google and a wide developer ecosystem adopted it in the months that followed. That is the Adobe move of this wave: do not keep the protocol proprietary, make it the standard, and capture the strategic position inside the standard. Other layers in this position are still open. Vector database formats are not standardised. Agent-to-agent communication protocols do not yet exist as a binding specification. Discovery formats for machine-readable site context (llms.txt, agent skills) are emerging but not yet settled. Whoever establishes an open specification that gets embedded in enterprises, agencies and developer tools is building the next Adobe-class position.
Second position: workflow and data model authority. Whoever defines the data model for AI-native work controls the application. The European examples are denser than the anglo-centric coverage suggests. Celonis sells a process-mining graph that becomes the operational truth of a company. Personio sells the HR data model that Mittelstand HR teams build their workflows around. Mews in hospitality from Prague, Sana for knowledge workflows from Stockholm, Pipedrive in SMB CRM from Tallinn each occupy a similar layer. None of them primarily sells an AI feature. They sell a data model in which the AI feature lives. In the agent space, the data model for multi-agent workflows is still unoccupied.
Third position: regulation and domain expertise. That is the Intuit position, and it is the most clearly capturable today. Harvey in US law, Hippocratic in medicine, Cradle in biotech from Delft, Legora for Scandinavian law, C.H. Beck in German-language legal publishing. The cleanest German example is DATEV: a cooperative of tax advisors with sixty years of accounting and payroll software embedded in the actual workflow of every Steuerberater in the country. Microsoft never seriously contested it, SAP never seriously contested it, and the foundation labs will not contest it either. The data model and the regulatory updates are the moat, not the code. What these companies share: proprietary or regulated data, complicated workflows, an audience that foundation labs cannot serve as a horizontal product. Anthropic will not build German tax software. OpenAI will not build an FDA submission pipeline. These verticals are systemically protected, not by technical superiority but by domain-specific friction. For Mittelstand boards already sitting in such a vertical, the Monday-morning action is not to chase a horizontal AI play. It is to deepen the domain layer: write down the regulatory updates that no horizontal vendor can keep current, the workflow steps that only your customer base demands, the data model nobody else has the right to read.
Fourth position: customer-side data and identity authority. Less pronounced in the Microsoft wave, decisive in the AI age. Bloomberg is the historical model: proprietary market data plus workflow plus community lock-in. The rule for this age is simpler: whoever controls the organisation's data controls the AI application. That is why Microsoft with Copilot-in-Office, Google with Gemini-in-Workspace, SAP with Joule and Atlassian with Rovo are pushing so aggressively. Org data is the scarcity, not the models.
What Follows for Founders, Boards and PE
The structural diagnosis is clear. Non-vertical, non-format, non-regulated wrappers on foundation models live exactly where Lotus 1-2-3 lived: in the path of the bundle. That is not bad luck. That is architecture. The same diagnosis applies inside larger companies. A vibe coding skunkworks that prototypes a wrapper around an off-the-shelf model is a useful exercise but it is not a moat unless it ships into one of the four positions above.
The non-trivial positions are protocol, workflow, regulation, data. Founders who occupy one have a structural answer to the bundle wave. Founders who occupy none are building on sand. The same lens works for boards stress-testing their roadmap and for PE investors checking a thesis against a five-year exit horizon.
The analytically interesting observation is that these positions are open today. Ten years ago no founder would have credibly proposed displacing Intuit in US tax law. Today the analogous position for AI-native verticals is open, because the entire application stack is being rebuilt. That is the rare configuration in which historical pattern and current gap line up.
The right question is not whether your business is in the ninety per cent that will die. It is: which of the four structural positions are you occupying, and how deeply.
Format. Workflow. Regulation. Data. Pick one, build the asset specificity, let the bundle absorb the rest.
From the Lab This Week
The strategic question this week was concrete: how can a German Mittelstand client legally and safely use claude code and claude cowork? The answer is not a product. It is two artefacts that each occupy one of the four positions above.
Position 3, in practice. An eighteen-page compliance briefing for the client's pre-workshop preparation. IT-security architecture, sub-processor map, GDPR plus EU AI Act mapping, BAIT and MaRisk materiality classification, a DORA incident-response playbook, and a Schrems-II Transfer Impact Assessment for cowork US inference. Four reviewer agents in parallel (DPO, legal, regulatory, IT security), orchestrated from a single claude code session. Twenty-eight findings, three convergences across all reviewers. Then human consolidation, then regulatory framing into five compliance artefacts and a contract template. The PDF is not an audit. It is a structured working document with primary-source citations the client and their Wirtschaftsprüfer can verify line by line. No major foundation lab will build this next year. None will build it the year after either. That is the DATEV pattern at SMB scale.
Position 1, in practice. A new endpoint shipped on drfloriansteiner.com: /.well-known/agent-skills/index.json, following the Agent Skills Discovery RFC v0.2.0 from Cloudflare. Returns 200 today. It advertises one skill so far (a verified llms.txt with a SHA-256 integrity hash). Future entries will include WebMCP tool descriptors and markdown-for-agents endpoints. The point is not the file. It is the position: an open specification, a well-known path, a small early bet on a discovery standard that has not yet settled. If the standard wins, the site is already in. If a different standard wins, the cost was an afternoon. That is the Adobe move at personal-website scale.
Two artefacts, two positions, one week. The reader's exercise: which of the four positions does your business actively occupy this week, and which one are you content to leave to someone else?