Wall Street's nerves over the spiraling cost of artificial intelligence rattled technology stocks last week, hitting cybersecurity companies particularly hard.
AI is creating new security risks and driving demand for protection, lifting cybersecurity stocks while also exposing them to negative shifts in market sentiment around the technology. Those competing forces showed up last week, when shares of the five largest U.S. cybersecurity companies all fell by double digits, far outpacing the broader selloff.
Palo Alto Networks and Cloudflare each lost about 18%, while CrowdStrike Holdings fell 17%. Fortinet and Zscaler dropped 13% and 11%, respectively. By comparison, the tech-heavy Nasdaq composite fell 4.5% for the week beginning Oct. 12. The WSJ Pro CyberIndex, a weighted average of the 20 largest cybersecurity companies by market value, fell 16.4% for the week.
Some cyber stocks began clawing back losses in recent days. Cloudflare was up about 5% from Friday's close in late trading Wednesday, while Palo Alto Networks had edged higher.
"A bunch of anxiety crept in about the affordability of AI," said Peter Weed, a senior analyst for software and cybersecurity at equity-research firm Bernstein. He said cybersecurity companies were caught up in the broader AI trade. As investors questioned how much companies could sustain spending on AI, they pulled back from stocks expected to benefit from that spending.
Sharp swings are becoming a feature of the sector as cybersecurity stocks become more closely tied to shifts in AI sentiment. This turbulence comes despite a strong run this year. Even after last week's retreat, the Nasdaq CTA Cybersecurity Index remains up more than 30% from 12 months ago. Over the same period, CrowdStrike is up roughly 90%, while Palo Alto gained more than 60%.
AI developments also spooked cyber investors earlier this year. CrowdStrike and Zscaler each dropped about 11% on Feb. 23 after AI developer Anthropic released Claude Code Security, a tool that finds software vulnerabilities and suggests fixes. Fortinet fell roughly 6% and Palo Alto dropped 3%.
The sector fell again in late March -- though the losses were less pronounced -- after details emerged about Anthropic's more powerful Mythos model.
Those earlier declines reflected fears that increasingly capable AI could disrupt established cybersecurity products. However, more capable AI models that can outperform most humans are making complex cyberattacks easier to carry out, driving shares higher as investors anticipate increased demand for security.
"The air pocket in the AI trade last week hit the cyber stocks, but that's a fundamental misunderstanding of the opportunity in cyber," said Jake Seid, co-founder and general partner at cybersecurity-focused venture-capital firm Ballistic Ventures.
Companies are already spending heavily to deal with these risks. Bank of America Chief Executive Brian Moynihan said during a recent earnings call that the bank brought in 1,000 outside contractors, in addition to roughly 3,000 existing staff, to patch software vulnerabilities exposed by frontier models including Anthropic's Mythos.
That doesn't necessarily mean more business for today's biggest cybersecurity vendors, though. Established companies face competition from rivals adding AI capabilities and well-funded startups building security products around the technology, said Dimitri Zabelin, senior AI analyst at research firm PitchBook.
"Both actual disruption and investors' perceptions of threats to incumbents' dominance could drive further volatility," Zabelin said.
Companies also have limits on how much they can spend, which could curb the growth seen this year.
"Cybersecurity, for better or worse, is a cost center, not a profit center," Weed said.
Chief information security officers he has spoken with expect spending to increase in the coming months, but not at the pace seen earlier this year.
"You do get acceleration over the next few quarters," Weed said. Sustaining faster growth next year would require another increase in spending pace. "I'm not hearing that expectation from CISOs."
Comments