Greater AI spend not expected to kill cyber budgets, By Investing.com

Jefferies survey of 30 CIOs found none expect cybersecurity to be a top area cut to fund AI initiatives; companies currently allocate roughly 6%–7% of cybersecurity budgets to AI-related security, a share expected to grow. Threat intelligence and code security are viewed as most exposed to disruption from LLM providers, while identity, network, and endpoint security are seen as less exposed, implying sustained or rising demand for cybersecurity solutions and potential sector-level revenue resilience.

Analysis

Corporate IT will prioritize vendors that can convert AI-related telemetry into defensible, recurring revenue. Expect a 12–36 month rotation of discretionary IT spend into platform-level security (identity, cloud-native XDR, model-protection) rather than point tools; companies that own ingestion and telemetry (EPP/XDR agents, cloud-native proxies) will capture disproportionate wallet share and see gross margin expansion as services-led implementations are replaced by software-led subscription rolls.

A likely second-order effect is margin bifurcation inside the security universe: vendors focused on threat-intel and code-scanning face faster feature commoditization from large LLMs (pressure on pricing and services), while vendors with regulatory hooks (data residency, model-audit logs) and deep telemetry will see stickier pricing and multiple expansion. Cloud providers and MLOps-tooling vendors become natural partners/providers of embedded controls, shifting spend upstream and compressing standalone appliance markets over 1–3 years.

Key catalysts to watch are (1) a headline AI-model compromise that forces immediate, outsized security re-buy cycles (weeks → quarters of elevated spend) and (2) rapid release of open-source LLM-based defensive tooling that compresses vendor ASPs over 12–24 months. The consensus underprices the risk of commoditization: security automation via LLMs can reduce analyst FTE demand and MSSP revenue growth if vendors cannot attach high-value controls to their telemetry.

Key Decisions for Investors

• Long Palo Alto Networks (PANW) — buy shares or 12–18 month LEAP calls. Rationale: broad platform exposure to cloud and XDR; downside scenario is competitive feature parity. Target: 30–50% upside if security multiple re-rates; stop-loss: 25% below entry or if next two quarters show ARR deceleration.
• Pair trade: Long CrowdStrike (CRWD) / Short Accenture (ACN) — 6–12 month horizon. Rationale: CRWD benefits from endpoint/cloud telemetry and sticky subscriptions; ACN exposed to discretionary services cuts. Size market-cap neutral; take profits if spread widens >20% or narrow >10%.
• Tactical options: Buy SentinelOne (S) 9–12 month call spreads (debit spread) to capture re-rating in cloud-native endpoint players while limiting downside. Risk/reward roughly 3:1 if security spend accelerates; max loss = premium paid.
• Selective short of non-mission-critical SaaS vendors with >25% of revenue from discretionary IT (identify on a names basis in portfolio reviews) — 3–9 month tactical shorts. Rationale: corporates will reallocate budgets first from peripheral software/services; maintain small position sizes and event-driven stops if guidance stabilizes.