How AI is changing the way we think about software security

A Barclays report finds CISOs (one interviewed manages a $15M annual budget) are reallocating spend from legacy network infrastructure—lower-cost firewalls and reduced SD-WAN—to fund large-scale AI tool rollouts (e.g., Microsoft Copilot, ChatGPT). This shift elevates endpoint and identity security priorities as non-human identities proliferate and major identity vendors lag, while traditional DLP tools prove insufficient for AI workflows. Legacy network security providers face potential headwinds unless they pivot to identity- and data-centric protection to capture the emerging 'AI tax.'

Analysis

The reallocation of security budgets toward AI creates a durable revenue bifurcation: vendors that can productize non-human identity management and data-security-for-LLMs will be able to charge recurring, per-automation premiums (an “AI tax”) that can lift SaaS gross margins by 300–800bps versus traditional appliance refresh cycles. Expect this to play out over 6–18 months as pilot-to-production AI rollouts move from savings-driven proofs to platform-commitment purchases; channel partners will re-tool to sell identity/DSPM bundles rather than one-off firewall refreshes.

A second-order winner set includes platform owners who can embed identity and data telemetry into an existing admin surface — this amplifies cross-sell and raises switching costs. Conversely, legacy appliance-first vendors that rely on refresh cycles and expensive on-prem sales teams face a two-way hit: lower replacement volumes and margin compression as customers opt for cheaper perimeter substitutes and reallocate those dollars to AI tooling.

Key reversal risks are sharp and fast: a high-profile NHI compromise or regulatory clampdown on model telemetry could trigger immediate pause decisions and a re-investment back into hardened network appliances within weeks. Over 12–36 months, the market structure risk is consolidation—either incumbents pivot successfully by acquiring identity/DSPM assets, or fast-growing specialists get acquired at premiums that re-price the sector; both outcomes are tradable if you monitor spend signals (vendor win-rates, MSSP migrations, Copilot/LLM telemetry adoption).

Key Decisions for Investors

• Long MSFT (1-year call spread): buy 12-month MSFT calls and sell higher strike to fund cost — target asymmetric 25–40% upside if Copilot/Entra monetization accelerates; max loss = premium paid. Size 3–5% of tech bucket; monitor Azure AD daily active metrics as an early indicator.
• Long identity/endpoint leaders vs short legacy firewall (pair trade, 9–12 months): long OKTA or CRWD 9–12 month calls (identity/agent-first exposure) and fund by buying FTNT or PANW 9–12 month puts, size 2–4% net notional. Rationale: capture secular reallocation to machine identities; risk: incumbents execute product pivots or price cuts.
• Tactical short on appliance refresh suppliers (FTNT, CSCO) via 6–12 month put spreads: expect 10–25% downside from compressed replacement cadence over next 6–12 months, limited downside via sold lower strike. Hedge with small long MSFT/OKTA exposure to protect against broad enterprise spend upswing.