−11.0%
since Oct 10
The idea
Security spending is consolidating: companies are ditching dozens of point tools for a handful of AI-powered platforms, and AI is making attacks worse, which pushes budgets toward whoever can keep up. I'm betting on the consolidators rather than the sector broadly, with platform leaders at the core and cloud, identity, AI-native defense, and attack-surface names layered around them. Two sector ETFs add ballast so one bad earnings report doesn't define the outcome, and I keep 10% cash to add to the core if the market overreacts to a single quarter. Horizon is one to two years.
What it owns
- These companies are winning by bundling multiple security tools into platforms that replace point products, capturing more budget per customer as consolidation accelerates. · Palo Alto NetworksIt bundles point products into platforms that replace customers' standalone tools, driving higher spending per customer through consolidation., CrowdStrike HoldingsIt started at the endpoint and keeps adding modules customers adopt instead of standalone tools, expanding total contract value through consolidation., MicrosoftIt sells security as part of licenses companies already pay for, making it the default consolidation choice, and owns the AI infrastructure powering modern defense., FortinetIt is converting its large firewall base into a broader platform where networking and security merge, capturing more budget per customer.32%
- These companies replace legacy network infrastructure with cloud services, capturing budgets that shift from old perimeter security to modern cloud-native defense. · ZscalerIt replaces the old corporate network perimeter with a cloud service, the legacy-replacement shift that consolidation budgets are funding., CloudflareIt sits in front of major internet traffic and layers security and AI services on top, growing by simplifying customer infrastructure onto one platform., Check Point SoftwareIt is a profitable incumbent pushing its own consolidated platform at a lower valuation, providing a value-priced way to own the same consolidation shift., Akamai TechnologiesIt is pivoting from content delivery to security and cloud compute, requiring security to keep growing as a larger share of its revenue.20%
- These companies built security around AI from inception or are rapidly extending existing platforms into AI-driven security, positioning for higher stakes as attacks become AI-generated. · RubrikIt protects and recovers data after ransomware hits and is building AI-driven security on top of that visibility, betting that higher attack stakes drive spending up., DatadogIt watches everything running in a company's cloud and is extending that visibility into security, converting monitoring customers into security customers., SentinelOneIt built defense around AI from the start and competes directly with larger consolidators at lower prices, requiring sustained fast growth to justify the higher-risk bet.14%
- These companies map and secure everything a company exposes to the internet, a function that becomes more urgent as AI accelerates attack probing. · QualysIt maps where companies are exposed to attackers before they strike, a function growing more urgent as AI accelerates attack probing and vulnerabilities multiply., Tenable HoldingsIt maps everything a company exposes to the internet, a growing job as AI lets attackers probe faster, and is expanding beyond basic vulnerability scanning., Varonis SystemsIt secures data by controlling who can touch what, increasingly critical as companies feed sensitive data into AI tools, and is converting customers to a cloud subscription model.10%
- These ETFs hold broad cybersecurity exposure, providing steady returns if overall security spending rises even if individual vendor picks underperform. · First Trust NASDAQ Cybersecurity ETFIt holds the broad cybersecurity sector, providing protection if security spending rises regardless of which individual vendor wins consolidation deals., Amplify Cybersecurity ETFIt holds broad cybersecurity exposure across a different fund structure than CIBR, spreading ballast across two providers to preserve returns on the spending trend.9%
- Identity controls are where most modern attacks begin, so consolidating buyers need independent identity platforms to protect their perimeters. · OktaIt is the largest independent identity platform, protecting where most modern attacks start, and must keep winning identity budgets against consolidated alternatives.5%
- Cash10%