Cybersecurity stocks are back with a bang. These four are on Josh Brown's list

Cybersecurity remains the article's preferred AI-related investment theme, led by CrowdStrike, which is up 104% year-to-date after reporting Q2 revenue growth of 26% to $1.47B, record net new ARR of $333M, and raising full-year net-new ARR guidance to $1.35B. Amazon's AWS growth accelerated to 37% year-over-year and Q2 sales reached $200.6B, but its roughly $220B 2026 capex plan, $7.6B trailing free-cash-flow outflow, and $81.9B of long-term debt issuance are key return-on-investment risks. Technically, CRWD, Fortinet and Cloudflare are constructive, while Palo Alto is consolidating and Amazon remains range-bound below resistance near $270; Zscaler is a watchlist turnaround candidate after reclaiming its 200-day moving average.

Analysis

Cybersecurity’s AI premium is becoming bifurcated: platforms that can convert automated defense into incremental consumption revenue should sustain growth, while point products face rising pressure to prove that AI expands—not merely protects—their pricing power. CRWD’s token-based monetization is strategically important because it adds usage upside to an already sticky platform model; the second-order loser is lower-end endpoint vendors whose feature sets can be bundled into broader suites. NET is a separate beneficiary of AI traffic growth because security, edge delivery, and inference-adjacent network usage can compound together rather than compete for a fixed IT budget.

The principal near-term risk is not demand but expectations. Security leaders have materially outperformed IGV, leaving October/November results vulnerable to any deceleration in net-new ARR, billings, or free-cash-flow conversion even if headline revenue remains solid. FTNT is the highest operational-risk name: its earnings history argues against carrying an oversized position through results, while PANW needs evidence that platformization is producing durable margin and remaining-performance-obligation growth before its relative underperformance reverses.

AMZN is a different trade: the relevant question is whether incremental AWS gross profit can outpace depreciation, financing costs, and working-capital drag from infrastructure buildout. The market will increasingly value AWS on returns on incremental capital rather than cloud-growth optics. A credible path to capacity monetization over the next two quarters could re-rate AMZN; conversely, another capex increase without improving free-cash-flow visibility risks multiple compression despite strong reported operating income.

Contrarian opportunity is ZS. It has the most favorable setup for a relative rerating because expectations and valuation are lower than for the security leaders; a sustained improvement in billings, large-deal activity, and margin trajectory could close part of the discount quickly. The key distinction is that a technical recovery alone is insufficient—ZS needs fundamental confirmation at its next report to avoid becoming a failed bounce in a crowded quality-security tape.

Key Decisions for Investors

• Maintain an overweight long CRWD, but add only on pullbacks or a confirmed hold above the post-results base; use a closing break below $215 as a tactical stop and $207 as thesis-invalidating support. Target a 10-15% upside over 1-3 months versus roughly 7-10% downside to the 50-day area.
• Initiate a 1-3 month pair trade: long CRWD / short IGV in equal beta-adjusted dollars. This isolates security’s superior AI-driven budget priority from broad software multiple risk; cover if CRWD net-new ARR momentum slows materially or IGV begins outperforming by more than 8% after the next earnings cycle.
• Buy ZS only after fundamental confirmation—specifically billings/RPO acceleration and maintained or raised full-year guidance at the next earnings release. If confirmed, target a 15-20% relative rerating versus PANW/CRWD over 3-6 months; exit on a weekly close back below its 200-day moving average or renewed guidance compression.
• Treat FTNT as a tactical, not core, long: accumulate near $150-$160 support with a closing stop below $150, and reduce exposure before earnings unless channel checks show improving appliance demand and deferred-revenue momentum. Risk/reward is attractive only near support given its historical post-earnings gap risk.
• Keep AMZN on watch into the October 29 report rather than forcing exposure mid-range. Go long only if AWS growth, backlog conversion, and operating-income guidance demonstrate improving returns on incremental capex; a failure to show free-cash-flow stabilization alongside higher infrastructure spending would support an underweight versus MSFT/GOOGL over the following 6-12 months.