Why JPMorgan sees further upside in Palo Alto and CrowdStrike stocks

JPMorgan reiterated overweight ratings on Palo Alto Networks and CrowdStrike after Anthropic rolled out its Claude Mythos Preview AI model as part of Project Glasswing. The bank sees recent AI developments as a tailwind rather than a threat for leading cybersecurity players, supporting potential upside for the sector.

Analysis

Leading pure‑play cloud/security vendors stand to capture disproportionate revenue per customer as AI-driven applications exponentially increase telemetry, authentication events, and model–data access logs. That creates a two‑lever thesis: recurring ARR growth from new telemetry pipelines plus higher average revenue per user (ARPU) from managed detection/response and model‑risk services, but it also raises ingestion and egress costs that will pressure gross margins unless pricing or technical differentiation offsets them.

Second‑order winners include SOC automation tool vendors and MSSPs that can resell optimized ingestion stacks; hyperscalers that bundle native controls could conversely compress third‑party growth if they accelerate integrated security features. Near‑term catalysts are quarterly results showing telemetry growth rates and new AI‑specific product revenue (1–4 quarters); multi‑quarter proof points of margin expansion require >20% price realization or 15–20% efficiency gains in cloud costs.

Key tail risks: a high‑profile exploit of an LLM or a regulatory clampdown on model data flows could cause enterprise buyers to pause new deployments, reversing procurement cycles within 1–3 quarters. The consensus may be underestimating both the short‑term margin hit from runaway telemetry and the medium‑term competitive threat of hyperscaler native security — so position sizing and option structure matter for asymmetric upside capture.

Key Decisions for Investors

• Long PANW (6–12 months): buy a defined‑risk call spread (bull call) 6–12 months out, 25–35% OTM to target ~30–50% upside if AI telemetry monetization proves sticky; limit allocation to 1–1.5% of portfolio to cap premium loss (max loss = premium paid).
• Long CRWD (12–24 months): buy shares or long‑dated (12–18 month) calls to play durable endpoint + workload telemetry ARR growth; target 40% upside on sustained ARR acceleration and set a hard stop at 20–25% drawdown or hedge with cheap OTM puts.
• Pair trade (6–12 months): long CRWD / short FTNT (or other legacy perimeter vendor) equal notional — thesis: cloud‑native telemetry providers outgrow appliance‑centric vendors; size as 1–2% net exposure and rebalance on quarterly results showing telemetry growth divergence.
• Event hedge (0–3 months): buy inexpensive 1–3 month out‑of‑the‑money puts on the longs (or purchase a tail hedging structure) ahead of major AI product announcements or regulatory hearings — insurance cost should be <0.3% of portfolio for near‑term protection.
• Monitor triggers & rebalance: take partial profits (25–40%) on any stock move >30% in 2 months; redeploy into volatility after 10–15% pullbacks driven by headline risk rather than fundamental ARR slowdown.