Raymond James says security stocks may face pressure despite strong fundamentals

Raymond James warns AI advances from Anthropic (unreleased Claude Capybara/Mythos) could compress cybersecurity vendor valuations and materially pressure the sector; some infrastructure names already trade at single-digit cash-flow multiples despite double-digit growth. Palo Alto Networks has fallen markedly over the last three months and is trading near its 52-week low, with additional near-term downside possible if investors price in AI-driven defensive obsolescence. Raymond James notes Anthropic's early access to defenders may mitigate immediate vendor exposure, and any AI 'bear' case will require tangible evidence of disruption rather than forward-looking concerns.

Analysis

The market is front-running an AI-driven shift in the offense/defense balance; that reaction is compressing multiples for incumbents faster than fundamentals can change. Expect a meaningful near-term rerating (weeks–months) because investors can re-price revenue durability quickly, even though the technical migration of security stacks and customer churn take quarters to play out.

Second-order beneficiaries include managed detection & response, bug-bounty/pentest marketplaces, and developer security toolchains — these capture marginal spend as customers prioritize continuous hardening and outsourced expertise. Conversely, signature- and telemetry-reliant vendors face higher R&D intensity and potential margin erosion as they retrofit behavior/AI layers; that creates both capex pressure and M&A windows for well-capitalized cloud/platform players.

Key tail-risks are binary: a widely exploited zero-day found via new models would force immediate customer churn and regulatory scrutiny (days–weeks), whereas controlled, defender-first releases and improved AI-based detection could materially blunt disruption (months). The market’s current move is therefore a timing mismatch — price action is near-term aggressive while the structural shift will be path-dependent over 6–24 months.

From a capital-allocation lens, the highest-expected returns come from defined-risk trades that capture continued sentiment de-rating yet maintain optionality for a technical recovery if vendors demonstrate defense wins or Anthropic limits access further.

Key Decisions for Investors

• Short PANW via defined-risk put spread: buy PANW 1-month 10% OTM puts and sell 1-month 20% OTM puts (initiate size 1-2% notional). Thesis: near-term sentiment-driven 15–30% move lower; reward ~2–4x premium if panic continues. Stop-loss: close if PANW recovers to within 5% of pre-trade price or if put bid collapses by 60%.
• Pair trade: long MSFT (3–12 months) / short PANW (equal notional, 50/50) — use stock for MSFT and PANW short via smaller notional or synthetic short (options). Rationale: cloud/platform defenders capture re-architecting spend; target relative outperformance +15–25% over 6–12 months. Risk: simultaneous sector rally; cap position to 3% NAV.
• Long CRWD 9–12 month call spread (buy 40–50% OTM call, sell 80–90% OTM call) as a convex defender play. Reward: re-rating if defenders prove AI-augmented efficacy; aim for 2–3x premium. Risk: general cyber multiple compression — limit to 1–1.5% NAV.
• Event hedge: buy a 3–6 month cybersecurity-sector put (ETF or basket) sized 0.5–1% NAV to protect against a catalyst (major zero-day exploit). This is insurance: large payout on systemic exploitation events that would create idiosyncratic drawdowns across the space.