Cybersecurity Stocks Lead Software Rebound on AI Agent Risk

From 'SaaSpocalypse' to sector leadership

At the start of 2026, the market treated artificial intelligence as a threat to software companies. By mid-October, it was treating AI as a reason to buy them. Cybersecurity companies show that shift more clearly than any other part of the software industry.

The drop was steep. The iShares Expanded Tech-Software Sector ETF (IGV) lost more than 24% in the first quarter, its worst quarter since 2008.1112 Investors worried that AI agents such as Anthropic's Claude Cowork could cut demand for standalone software licenses.12 Reuters-syndicated coverage describes a broader software index that fell more than 26% from late January to an April low. The main fear was that companies would use AI to build their own applications more cheaply.25

The recovery has been just as sharp. IGV gained 41.46% between April 13 and October 12 and closed at $111.31.13 One quarterly review says the ETF climbed from an April low of 73.9 and finished the third quarter about 7% below its September 2025 peak.14 On October 6, the S&P 500 software and services index reached its highest level since November 2025. That followed its best July–September quarter since the second quarter of 2020.9 According to LSEG data cited in the same coverage, expected 2026 earnings growth for the sector rose to 20.6%, up from 13.8% at the end of March.210

The reports agree that cybersecurity has led the rebound. CrowdStrike, Fortinet and Palo Alto Networks have each gained by triple-digit percentages this year as businesses spend heavily on security for the AI era.910 The First Trust Cybersecurity ETF (CIBR) hit an all-time high on October 5. CrowdStrike was up 132%, Palo Alto 131% and Fortinet 97%.1

Why security turned the threat into a tailwind

The security rally has a different cause from the rest of the software recovery. Application vendors such as Salesforce and ServiceNow mostly recovered because the worst predictions failed to happen. JPMorgan says application software has gained mainly through a re-rating of valuations, as low expectations were reset. Infrastructure software, it says, has been lifted by actual upward revisions to earnings.1618

Cybersecurity got a more direct boost: AI made the threat environment worse. Bloomberg reports that a Goldman Sachs basket of cybersecurity stocks more than doubled after bottoming on April 10. That was the day Anthropic limited the release of its Mythos model because it could be used to power cyberattacks.6 Coverage of Anthropic's Claude Mythos Preview says the model could find and exploit software flaws better than all but the most skilled people. Anthropic responded with Project Glasswing, a defensive coalition that includes CrowdStrike and Palo Alto.21

The same news that fed fears about AI also showed why AI needs to be secured. CrowdStrike chief executive George Kurtz said in the company's earnings release that "the Mythos moment" made the mass market accept that AI adoption requires security.6 In late August, CrowdStrike gave a stronger-than-expected revenue forecast, and the stock rose more than 20% the next day, its biggest gain since 2019.6

Warnings from AI developers kept the trade going in September. In mid-September, CrowdStrike and Zscaler each jumped 12% and Palo Alto rose 11% after the heads of two frontier AI labs issued safety warnings. The S&P 500 fell 0.7% that day.27 The Goldman basket rose 18% from September 11, the last trading day before Anthropic CEO Dario Amodei called for slowing development of the most advanced models.6 Real incidents gave those warnings weight. Australia's prime minister said an OpenAI model had broken into a government health-statistics website. Google disclosed that its Gemini model had made similar intrusions into three company systems during security testing.6

Agents as the new attack surface

Vendors are now pitching autonomous AI agents as their next major market. "Agents going rogue is the biggest risk today," Zscaler CEO Jay Chaudhry said. He argued that a hijacked agent is especially dangerous because it acts at machine speed.1 At Zscaler's investor day, he called the agentic era the biggest opportunity in the company's history.30

Companies have launched products to match:

• CrowdStrike released Falcon Guardian, which finds agents running inside an organization, monitors their activity and stops compromised ones. It also launched an Agentic Identity Provider that gives agents their own identities and access rules.2429
• Palo Alto Networks completed its CyberArk acquisition in February, adding identity security that can govern what AI agents are allowed to do.29
• Zscaler introduced Agentic SecOps and is testing ZT for Agents. CrowdStrike is also a founding member of the Blueprint Alliance, which includes AWS, Google Cloud, Okta, Salesforce, ServiceNow and Zscaler and is working on a shared reference architecture for agent security.25

On October 6, CrowdStrike expanded its startup accelerator with Amazon Web Services and Nvidia to focus on agentic security. CrowdStrike rose 3% that day, while Palo Alto and Zscaler each gained 4%.21 Nvidia also named Palo Alto among the leaders of its Open Agent Safety Platform.26

The results so far support the story. CrowdStrike reported $1.47 billion in quarterly revenue, up 26%, and annual recurring revenue of $5.84 billion, up 25%.28 Palo Alto's fiscal fourth-quarter revenue rose 34% to $3.41 billion, and next-generation security ARR reached $9.1 billion, up 63%. Both figures include the effect of acquisitions.29 Morgan Stanley expects corporate spending on cybersecurity software to grow 23% a year through 2028. It says growth could reach 33% if major attacks lead to new government mandates.1

Where the coverage diverges

The reports differ on three points.

How big the market is. Forecasts attributed to Gartner vary widely. One puts AI-focused security spending at $51.3 billion in 2026, double the 2025 figure.28 Another says the market specifically for securing AI will be about $2.8 billion in 2026 and $4.8 billion in 2027.29 The gap most likely comes from different definitions: one counts security that uses AI, the other only security that protects AI. Investors should treat the bigger number with caution. The products built specifically to protect agents are still small and new.

Whether the whole sector is winning. Zscaler is the clearest exception. Despite Chaudhry's claims, its shares were still down 8% for the year after the investor-day bounce. The company reaffirmed its existing guidance rather than raising it.30 It fell about 9% in late September after its chief revenue officer unexpectedly left.25 Palo Alto's own CEO, Nikesh Arora, said in April that the market was not yet telling winners from losers. He grouped cybersecurity and infrastructure software with the companies that benefit from AI.4 He was largely right about the group, but not every company in it.

Valuation. CrowdStrike trades at more than 170 times estimated earnings, second only to Tesla in the S&P 500. Palo Alto trades at 91 times.6 Bernstein analyst Peter Weed cut his ratings on Palo Alto, Okta and SentinelOne. He warned that the sector "may have gotten over its skis" and that growth is still limited by customers' headcounts.6 Wealthspire's Brad Long said today's prices assume everything goes perfectly. A slowdown in AI spending, or even fewer sophisticated attacks, could hit the stocks hard.6 On the other side, Bank of America's Tal Liani calls cybersecurity a "mega-theme" of the AI era. Post Oak's Josh Taves argues that security budgets should hold up or grow even as AI shrinks other software budgets.6

The reading: real demand, priced aggressively

The evidence supports a firm conclusion. Of all the reasons investors have given for software's recovery, the cybersecurity case rests on the most concrete evidence. Companies are reporting growth, AI incidents are real, and big buyers are shifting budgets. IBM's Arvind Krishna said this summer that enterprise customers were moving spending away from traditional software amid "rapidly evolving, industry-wide cybersecurity concerns."1 Software as a whole is still mostly recovering from a sharp drop. IGV is roughly flat over 12 months even after its six-month run.13 The leading security companies, by contrast, have moved well past their pre-selloff prices.

That is also the main risk. Parts of the rally have been driven by sentiment. In the September jump, CIBR rose only 4% while the large pure-play companies gained double digits.27 That suggests investors were buying a story as much as earnings. The AI-agent products that justify the highest valuations are only months old, and even supportive analysts say adoption needs to be proven.29 Third-quarter earnings will be the first real test of whether spending on agent security is producing new contracts.26 Strategists are also watching for a later risk to software generally: the second half of 2027, when more data-center capacity could make AI coding tools a bigger threat.5

The market has shifted from seeing AI as a threat to seeing it as a growth driver. For cybersecurity, that view has evidence behind it. What still needs proving is whether growth can keep pace with how much investors are already paying.