Josh Brown says these 3 cybersecurity stocks remain attractive

Rapid AI adoption is expanding enterprise attack surfaces, elevating cybersecurity from a discretionary technology purchase to a mission-critical operating expense. Cybersecurity equities are sustaining premium valuations despite broader software-sector multiple compression, supported by resilient demand for security products.

Analysis

The investable issue is not simply higher security budgets, but budget reallocation toward platforms that consolidate endpoint, cloud, identity and security-operations workflows. PANW and CRWD are best positioned to convert this into durable net-retention and operating-margin upside because AI-driven alert volumes increase the value of automation and proprietary telemetry. Conversely, vendors with a single-control-point value proposition face greater procurement scrutiny as CISOs seek fewer agents and lower integration costs; this is a structural headwind for subscale endpoint, identity and network-security vendors over the next 6-18 months.

Near term, the sector's premium valuation leaves little tolerance for billings deceleration or weak large-enterprise deal commentary. The key 1-3 month catalyst is earnings evidence that security spend is being funded from broader IT consolidation rather than merely defended as a budget line; that distinction determines whether growth can accelerate while margins expand. A meaningful reduction in high-severity breach frequency, a macro-driven pause in large transformations, or hyperscalers bundling credible native alternatives would compress the platform premium.

Consensus may be over-extrapolating the benefit to every cybersecurity name. AI also lowers adversaries' cost of attack, but it lowers vendors' cost of delivering detection and response; the winners will be those able to monetize autonomous workflows rather than pass savings through to customers. The more attractive relative-value expression is therefore quality-platform exposure against weaker infrastructure software, not broad cybersecurity beta after a valuation-led rally.

Key Decisions for Investors

• Initiate a 6-12 month long PANW / short IGV pair: PANW offers the clearest margin-upside path from platform consolidation, while IGV retains broad exposure to discretionary software multiple compression. Target 10-15% relative return; exit if PANW's next reported remaining-performance-obligation or billings trend materially decelerates versus management's outlook.
• Accumulate CRWD on post-earnings or macro-driven pullbacks rather than chase strength; use a 9-12 month horizon. The thesis requires sustained net-new ARR growth plus stable gross retention as customers adopt higher-value modules. Falsify on a two-quarter decline in module adoption or evidence that endpoint pricing is falling faster than cloud workload growth.
• Avoid or underweight FTNT until product-cycle demand and channel inventory normalize. Its network-security exposure has less direct monetization of AI-driven security-operations spend and is more vulnerable if customers redirect appliance budgets toward cloud and endpoint platforms.
• Monitor ZS and OKTA as read-through alerts, not outright longs: ZS is a beneficiary if zero-trust projects remain funded, while OKTA is the highest-beta identity-security proxy but carries execution and trust-recovery risk. Upgrade only if large-deal commentary and dollar-based retention demonstrate that identity spend is expanding rather than being absorbed into bundled platform contracts.