How AI is changing the way we think about software security

A Barclays interview cites a CISO with a $15M annual budget reallocating spend away from lower-cost firewalls and reduced SD-WAN footprints to fund large-scale AI tool rollouts (e.g., MSFT Copilot, ChatGPT). Firms are prioritizing endpoint agents, identity management, and data-security posture solutions as non-human identities and machine-to-machine data flows proliferate, while traditional DLP tools prove insufficient. Major identity vendors are behind on solutions for autonomous NHIs, creating an opportunity for vendors that can capture the "AI tax"; legacy network-security providers risk share loss unless they pivot toward identity- and data-centric protection.

Analysis

The most durable winners will be companies that monetize the technical plumbing of automated workflows rather than the end-user UI: think high-density compute and storage vendors that sell predictable, scalable capacity for on-prem and hybrid LLM inference, and identity/data telemetry vendors that can instrument machine-to-machine flows and charge recurring subscription fees. This bifurcation creates a two-speed market where hardware providers see lumpy, capex-driven cycles while identity/Data Security Posture vendors earn sticky, multi-year ARR and higher gross margins.

Second-order supply-chain effects: procurement teams will reallocate spend away from line items with low-margin renewals (edge routers, long-tail firewalls, SD‑WAN appliances) toward higher-capex server/accelerator buys and professional services for integrations; expect upstream component demand shifts (SSDs, power delivery, NICs, liquid cooling) over the next 2–9 months and order-book volatility for legacy network OEMs. Talent reallocation toward MLOps/IAM specialists will raise wage inflation in cloud security and create hiring windows for specialists — an acquisition target set for deep-identity telemetry is a plausible 12–24 month buyout candidate.

Key risks: a large-scale exfiltration event tied to an enterprise LLM or a swift regulatory intervention on data routing could halt deployments within weeks and force budget reversion to traditional perimeter spend. Equally, if major platform providers (software/cloud) elect to bundle identity/data controls at low incremental price, independent vendors face rapid margin compression within 12–18 months.

Key Decisions for Investors

• Long SMCI (size 2–4% portfolio): buy on <10% pullback or initiate with 12‑month call options (LEAPs) to target +40–80% if order cadence for dense inference racks accelerates; stop-loss at -25% realized loss given execution-risk and high multiple.
• Core long MSFT (size 6–10% portfolio): implement a 9–15 month call spread (buy 1x near‑ATM 12‑month call, sell 1x further OTM 12‑month call) to own platform exposure while capping premium — objective +15–25% upside; downside scenario -12% if enterprise monetization lags.
• Tactical long APP (size 1–2%): buy 6–9 month OTM calls to play incremental monetization from AI-driven ad efficiency; target +30–50% re-rate on improved CPMs, cut to breakeven or smaller loss if quarter-on-quarter ad demand softens.
• Hedge / watchlist: add BCS to watchlist rather than aggressive trade — expect transactional/financing fee opportunities as corporates fund AI capex; consider a small tactical long (1% portfolio) around quarterly results if guidance on IT M&A or financing flow inflects positively.