Cybersecurity stocks are pulling away from the software sell-off, and AI is the reason

Wedbush channel checks show cybersecurity vendors are raising year-over-year sales targets to roughly 25%–30% heading into 2026 (versus a historical 12%–18%), driven by AI expanding attack surfaces and enabling more sophisticated attacks. The report highlights CrowdStrike (CRWD) at $429.64 with a $600 price target as the sector gold standard, Palo Alto Networks (PANW) at $166.95 with a $225 target and reporting earnings today, and Zscaler (ZS) at $177.72 with a $350 target—all carrying Wedbush Outperform ratings. The note argues AI makes security spending less discretionary and supports durable subscription and pipeline growth across the cohort, implying upside relative to the broader software sell-off.

Analysis

Market structure: Winners are AI-native cybersecurity platforms (CRWD, PANW, ZS and identity plays like CyberArk) because enterprise AI deployment expands attack surface and raises discretionary-to-essential spend; Wedbush channel checks (targets +25–30% vs typical 12–18%) imply demand outstripping legacy tool supply and skilled defenders, supporting higher ASPs and stickier subscription economics. Losers are point-product legacy vendors and pure-play app vendors without model/cloud protections; pricing power will shift to platform providers who offer XDR/zero-trust + model/data security. Cross-asset: expect modest spread tightening in high-grade corporates of large cyber vendors, elevated equity implied vol in software while skew favours puts; FX and commodity impacts are negligible outside risk-on/risk-off USD moves.

Risk assessment: Tail risks include (1) accelerated regulation (EU AI Act / CISA guidance) imposing compliance costs that could hit 5–15% of near-term EBITDA for small vendors, (2) a major breach at an incumbent (5–10% probability over 12 months) causing churn and multiple compression, and (3) AI commoditization reducing gross margins over 2–4 years. Immediate risk: PANW earnings today (price move ±10–20% intraday); short-term (3–12 months): re-pricing around proof of AI-security efficacy; long-term (1–3 years): consolidation and margin normalization. Hidden dependencies: cloud provider integrations (AWS/Azure/GCP) and channel partner economics; catalysts: large enterprise LLM rollouts, high-profile breaches, regulatory guidance in next 60–180 days.

Trade implications: Tactical: establish a 2–3% NAV long in CRWD (share entry near $420–450) targeting $600 in 12 months with an 18% stop; add 1% NAV via Jan 2027 420/600 call spread to lever upside. ZS: build a 1.5–2% NAV long, staggered (50% now, 50% on >10% pullback), target $350 in 12 months, stop 20%. PANW: avoid directional exposure into earnings; if result shows beat + guide-up, add 1.5% NAV long within 1–3 days post-earnings; if holding through event, buy 30–45 day protective puts (10% OTM). Pair trade: long equal-weight cyber basket (CRWD/PANW/ZS) 5% NAV funded by short IGV (iShares Expanded Tech-Software) 3% NAV to express relative security outperformance.

Contrarian angles: Consensus may underappreciate rapid margin pressure if AI lowers detection costs (commoditization) or if customers consolidate to cloud-native providers, compressing smaller vendors—this could cap upside despite high targets. Historical parallels: post-9/11 security spend surge then normalization warns against extrapolating one-year acceleration into perpetual growth; ZS’s implied upside (~97% to Wedbush PT) looks vulnerable to execution/multiple risk. Unintended consequence: rapid M&A/consolidation concentrates systemic risk (one platform breach has larger market ripple); limit any single-name exposure to 3% NAV.

Key Decisions for Investors

• Establish a 2–3% NAV long position in CRWD (buy shares around $420–450) targeting $600 within 12 months; size a Jan 2027 420/600 call spread for ~1% NAV to gain leveraged upside; set a hard stop at -18% from entry.
• Build a staggered 1.5–2% NAV long in ZS: deploy 50% now, add remaining 50% on a >10% pullback; target $350 in 12 months and use a 20% stop-loss to limit downside on execution risk.
• Do not initiate fresh PANW longs into earnings; if PANW reports revenue beat + guide raise, add 1.5% NAV within 1–3 days post-print. If holding through earnings, buy 30–45 day 10% OTM puts as protection (cost <1% NAV expected).
• Execute a relative-value pair: long equal-weight cyber basket (CRWD/PANW/ZS) 5% NAV versus short IGV (iShares Expanded Tech-Software) 3% NAV to capture security-specific re-rating while hedging broad software risk.
• Monitor regulatory signals (EU AI Act drafts, CISA/SEC model-security guidance) over the next 60–180 days; if binding model-security obligations are introduced, rotate +1–2% NAV into identity-centric vendors (PANW/CyberArk) and reduce exposure to non-compliant smaller vendors by 50%.