Palo Alto, CrowdStrike wrap best quarter ever as AI threats bolster cyber demand

Cybersecurity leaders Palo Alto Networks and CrowdStrike surged 95% and 113%, respectively, between April and June on AI-driven demand for stronger cyber defenses tied to Mythos-class models. Palo Alto says 1,200+ customers contacted it since Mythos with 800 meetings in six weeks, while CrowdStrike’s Falcon Shield ended fiscal Q1 with 4x annual recurring revenue growth. Despite the strong momentum, Bernstein flagged risk of investor disappointment if growth and AI-cycle hype post-Mythos/Glasswing outpace expectations and face regulatory/government pressure.

Analysis

The important market mechanism is not just higher demand for security, but a budget reallocation toward vendors that can sell outcome-based, identity-aware platforms. AI-driven attacks raise the cost of doing nothing, so CISOs will pay up for fewer, larger contracts; that favors CRWD and PANW over narrower point products and over firms still anchored in perimeter-era messaging. The second-order effect is that the security stack should keep consolidating, which is a headwind for standalone tools that cannot prove agentic-workflow protection or identity correlation.

That said, the move is already crowded and the setup is increasingly about execution rather than narrative. After a ~100% quarter, the next leg requires visible conversion from inbound interest into net-new ARR and stronger multi-product penetration; otherwise these names become vulnerable to multiple compression even if fundamentals remain healthy. PANW carries more balance-sheet and integration scrutiny from its large identity push, while CRWD likely has the cleaner incremental revenue conversion, but both now trade like premium growth compounders, not “good news” beneficiaries.

Contrarian view: the consensus may be overstating how quickly AI threats translate into incremental spend rather than just vendor mix shift. A lot of the apparent demand could be competitive displacement or accelerated renewal timing, which supports near-term bookings but not necessarily durable step-up in total security budgets. The thesis would be falsified if next-quarter guidance shows slower net-new customer adds, if identity attach rates plateau, or if regulators/governments force procurement delays that push budgets into later quarters.

Key Decisions for Investors

• Buy CRWD on a 5-10% pullback as the cleaner AI-security relative winner; target 1-3 month momentum continuation, but trim if next-quarter guidance fails to show accelerating ARR or if the stock re-rates above its growth premium without revision support.
• Prefer CRWD over PANW on a relative-value basis: long CRWD / short PANW for 1-3 months to express cleaner execution versus integration risk from the CyberArk platform buildout; cover the short if PANW shows faster-than-expected cross-sell or gross margin expansion.
• Avoid chasing the broad cybersecurity basket here; instead, use any sector pullback to add exposure selectively to leaders and underweight smaller point-solution vendors likely to lose budget share as buyers consolidate around platform vendors.
• Set an alert for any quarter where identity/agentic-security metrics stop compounding at double-digit sequential rates; that is the earliest sign the Mythos-driven demand is a front-loaded pipeline event rather than a durable demand regime.