Greater AI spend not expected to kill cyber budgets,

Jefferies' survey of 30 CIOs found none expect cybersecurity to be among the top budget cuts to fund AI, with firms instead reallocating spend from services and software. Companies currently allocate roughly 6%–7% of cybersecurity budgets to AI-related security, a share expected to grow, supporting resilient demand for cybersecurity vendors as AI adoption accelerates.

Analysis

Expect a reallocation shock rather than a net spend shock: enterprises will shift dollars out of marginal services and broad software line items into embedded, telemetry-driven security and standalone AI-security modules over the next 12–36 months. That transfer favors vendors who sell high-margin, data-telemetry SaaS with native ML/automation (fewer human analyst hours) and penalizes consulting-heavy MSSPs and single-purpose point-products whose value can be replicated by models.

Second-order competitive effects: cloud hyperscalers and platform integrators (who can fold model-based code scanning and threat detection into existing dev and identity stacks) will increasingly act as gatekeepers, compressing go-to-market for specialist vendors and raising exit prices for acquirers. Hardware-centric security players and legacy appliance vendors will face slower replacement cycles as inference workloads for security remain modest near-term, keeping their revenue growth tepid relative to cloud-native peers.

Key risks and catalysts — watch three triggers on the 0–36 month horizon: (1) a major AI-related breach or model-poisoning event that forces emergency spending shifts and raises liability costs within 0–6 months; (2) FY budgeting windows (many enterprise cycles reset in Q4) where cuts to services/software show up as wins for productized security in 3–12 months; and (3) regulatory moves (e.g., AI/ML security standards or procurement rules) that accelerate spend on identity and model security over 12–24 months. A macro-led IT capex freeze remains the tail risk that would reverse the resilience trade in weeks to months.

Key Decisions for Investors

• Long CRWD (CrowdStrike) — 12–18 month hold. Rationale: endpoint + telemetry + automation moat; execute via 6–12 month call spread (buy LEAP or 12m ATM calls, sell 30% OTM calls) to cap cost. Risk/reward: asymmetric — expect 25–40% upside if adoption accelerates, with 20–30% downside in a tech drawdown; size position 3–5% of tech/cyber sleeve.
• Pair trade: Long PANW (Palo Alto) / Short ZS (Zscaler) — 6–12 month horizon, equal-dollar exposure. Rationale: PANW benefits from hybrid network+cloud security bundles and sustained enterprise renewals; ZS is more exposed to discretionary software reallocation and valuation contraction. Risk/reward: target 15–25% net return if PANW re-rates and ZS multiple compresses; tighten pair if ZS outperforms by >15% in 30 days.
• Long MSFT (Microsoft) — 12–24 months, buy shares or 18–24 month call spreads. Rationale: platform bundling of identity, GitHub-based code security and cloud controls reduces TAM leakage to niche vendors; acts as a defensive growth anchor in portfolios. Risk/reward: conservative play — expect steady 10–20% upside vs less than 15% drawdown in a severe macro slump.
• Short thematic exposure to commoditized threat-intel/code-scanning vendors (example: consider directional short or buy-put-spread on RPD/RAPID7-sized names) — 3–9 months. Rationale: LLM-driven tooling will compress prices and accelerate feature parity; trade as a volatility play ahead of earnings where guidance can show margin pressure. Risk/reward: high-volatility trade; cap downside with defined-risk options (put spreads) sized 1–2% of portfolio.