Cyber Stocks Look to Go From Losers to Winners

Cybersecurity stocks have sold off this year alongside the broader software sector, but WestBridge Capital's Manthan Shah (overseeing >$7B in US investments) says rising AI-driven threat risk makes security a compelling long-term opportunity. Investors risk missing a burgeoning demand tailwind as AI increases attack surfaces, implying potential upside for cybersecurity names despite recent sector weakness.

Analysis

Winners will be the vendors that own high-fidelity telemetry and can monetize it as an annuity — think endpoint/XDR, identity tied to device context, and cloud workload protection — because those products enable stickier cross-sell and higher NRR. Second-order beneficiaries include observability/cloud infra (higher telemetry = higher egress/compute spend) and MSSPs who can aggregate signals across customers; expect enterprise cloud spend on security telemetry to rise 5–15% over the next 12–24 months for early adopters.

Competitive dynamics will bifurcate: vendors that convert signal breadth into deterministic automated response keep pricing power, while single-point solutions face margin pressure and potential bundling by hyperscalers. Over a 12–36 month window, look for M&A consolidation (large acquirers buying differentiated ML-driven detection) and for open-source model tooling to commoditize basic signature and rules-based controls, compressing TAM for undifferentiated players by an estimated 15–25%.

Key risks and catalysts: in the near term (days–months) earnings misses, product delivery slippage, or lack of headline incidents can push multiples lower; in the medium term (6–24 months) hyperscaler bundling or successful low-cost entrants could reverse the re-rating for commoditized segments. A structural positive catalyst is regulatory/hardening cycles (mandated reporting, minimum controls) which could force baseline upgrades across industries and re-expand addressable spend.

Contrarian view: the market has punished “software” indiscriminately, underweighting differentiation within security. The move is likely overdone for poorly positioned SMB-focused packagers but underdone for cloud-native XDR/identity vendors with NRR >120% and clear playbooks to monetize AI-driven telemetry — these should re-rate over 12–36 months even if the broader sector grinds sideways in the next quarter.

Key Decisions for Investors

• Long CRWD (CrowdStrike) — size 1.5–2.0% NAV via a 12–24 month call spread (buy longer-dated calls, sell higher strike) to cap premium. R/R: target 2.5–3x payoff if adoption accelerates; max loss = premium (~1.5–2% NAV). Catalyst: durable NRR acceleration and cross-sell cadence.
• Pair: Long PANW (Palo Alto Networks) / Short ZS (Zscaler) — equal notional, 6–12 month horizon. Rationale: favor integrated network + detection stacks over narrow SWG SASE plays; target 20–30% relative outperformance, stop-loss if pair moves 15% against.
• Tactical basket: Buy HACK (ETFMG Prime Cyber Security ETF) — 3% NAV, 6–12 month horizon to capture sector rebound and dispersion. Take profits on +25% and cut at -10%. Use this as low-friction exposure while id’ing best single-name longs for scale-up.
• Selective defensive: Buy FTNT (Fortinet) on pullbacks — 12 month hold, 1–1.5% NAV. Rationale: cash-flowing, hardware-accelerated inspection with pricing leverage for enterprise edge; target +25% upside, stop at -12%.