China Cybersecurity Ban Report Sparks a Selloff. What Matters Next

Reuters reported on January 14, 2026 that Chinese authorities have instructed domestic companies to stop using cybersecurity software from more than a dozen U.S. and Israeli firms, citing national security concerns and fears that foreign software could transmit sensitive data abroad. The list includes $Broadcom (AVGO.US)$ -owned VMware, $Palo Alto Networks (PANW.US)$ , $Fortinet (FTNT.US)$ , and $Check Point Software (CHKP.US)$ , and also names like $Rapid7 (RPD.US)$ , $CrowdStrike (CRWD.US)$ , $SentinelOne (S.US)$ , $Alphabet-C (GOOG.US)$ -owned Mandiant, and Wiz.

Which stocks got hit

On the day of the report, Reuters said $Broadcom(AVGO)$   fell more than 4%, $Fortinet(FTNT)$   fell more than 2%, $Rapid7(RPD)$   fell more than 1%, while $Palo Alto Networks(PANW)$   was roughly flat and $Check Point(CHKP)$   closed slightly up. 

What these companies actually sell in China, and how big the exposure looks

$Broadcom (AVGO.US)$ : The relevant product here is VMware, which sits inside Broadcom's infrastructure software business and is widely used for virtualization and enterprise infrastructure. Broadcom does not break out VMware's China revenue, but it does disclose China exposure at the company level: in its latest 10-K, Broadcom said 17% of FY2025 net revenue and 20% of FY2024 net revenue came from shipments or deliveries to China, while also warning that shipment location is not the same thing as end customer location. Broadcom also discloses the absolute scale: $11,155 million of net revenue from China in FY2025.

$Palo Alto Networks (PANW.US)$ : PANW sells a platform that spans network firewalls, cloud security, and endpoint security, typically bundled as subscriptions plus support. The company does not disclose China revenue as a standalone line item, so you cannot do a clean "China percent of revenue" check from filings, but you can bound it using its geographic theater disclosure: in FY2025, Asia Pacific and Japan (APAC) revenue was $1,099.0 million out of $9,221.5 million total, about 11.9%. Separately, Reuters notes PANW lists multiple local offices in China, which signals that the company has built real on-the-ground presence even if the exact revenue mix is not disclosed.

$Fortinet (FTNT.US)$ : Fortinet is best understood as "secure networking" at scale, with firewalls and broader network security sold globally through channel partners. Like PANW, it does not disclose China revenue separately, but its 2024 10-K shows APAC revenue of $1,117.4 million out of $5,955.8 million total, or 19%. Reuters also notes Fortinet has offices in mainland China plus Hong Kong, which increases the odds that policy shifts can create operational friction even if the company's direct revenue exposure is not transparent in filings. 

$Check Point Software (CHKP.US)$ : Check Point sells enterprise security products like network security gateways and threat prevention software. The Reuters story names it on the reported list, but the report does not provide a revenue figure for China exposure. Reuters does note that Check Point lists support addresses in Shanghai and Hong Kong, so investors should assume there is at least some regional footprint even if the revenue scale is not publicly pinned down in this context. 

$Rapid7 (RPD.US)$ : Rapid7 sells security analytics workflows, including vulnerability management and detection and response tooling. It is explicitly named in Reuters’ reported list, and Reuters notes its shares fell more than 1% on the day, but neither Reuters nor the numbers cited above provide a clean, specific China revenue disclosure for Rapid7, so treat the revenue exposure here as not disclosed in this news-based snapshot. 

$CrowdStrike (CRWD.US)$ and $SentinelOne (S.US)$ : These two are a useful contrast case because Reuters reported both companies said they do not really sell into China, with CrowdStrike saying it does not sell into China and has no offices, hires, or infrastructure there, and SentinelOne saying it has no direct revenue exposure to China for similar reasons. If these names wobble on a headline like this, it is more about sector sentiment than about a direct revenue hit, at least based on what the companies told Reuters. 

What this means for investors, and what to do

This is the market relearning a simple rule: cybersecurity is not just a software category; it is a national security category, and that means access risk can change faster than your discounted cash flow model can refresh. The immediate selloff was not a verdict on product quality or demand trends; it was a repricing of geopolitical optionality, especially for companies with visible China footprint or meaningful China related shipments.

For investors, the playbook is to stop treating "China exposure" as a vague talking point and start treating it like a position-sizing variable. Names with clearer statements of minimal China business can be more resilient on policy shocks, while companies with larger disclosed China shipment shares or bigger regional footprints deserve a wider margin of safety. 

@TigerStars  @CaptainTiger  @TigerWire  @Daily_Discussion  @Tiger_chat  @Tiger_comments  @MillionaireTiger