−7.7%
since Oct 6
The idea
I believe security spending is consolidating from scattered point tools into a handful of AI-powered platforms, as AI raises the stakes for both attackers and defenders. The core holding is the four platform leaders driving that shift, backed by cloud and network players riding the same budget change, plus smaller bets on AI-native defense, identity, and attack surface tools. I keep 10% in cash to add if an earnings scare creates a better entry, and I'm sizing this for a one to two year horizon without betting the portfolio on any single name.
What it owns
- Large platforms are winning the shift away from point tools as companies consolidate their security spending onto fewer, larger vendors. · Palo Alto NetworksIt openly sells the consolidation move: replacing dozens of point tools with one platform, so its growth depends on customers folding more products into it each quarter., CrowdStrike HoldingsIt started at the endpoint and now pulls more of the security budget onto its single agent, a consolidation move in miniature that works as long as customers add modules instead of buying separate tools., MicrosoftIt wins consolidation by default: security comes bundled with existing licenses companies already pay for, and it needs CISOs to keep accepting bundled security over best-of-breed tools., FortinetIt pulls firewall, network, and endpoint spending onto one operating system, so it needs to keep converting hardware customers into broader platform contracts.41%
- Security delivered through cloud networks benefits from the same move to consolidation onto fewer, bigger vendors. · ZscalerIt replaces boxes of network gear with one cloud service that checks every connection, riding the same budget shift from a different angle., CloudflareIt bundles security into the network itself, so every new product it ships is another point tool a customer doesn't buy separately., Akamai TechnologiesIts security business now outweighs its old delivery business and defends the web traffic AI attackers go after first., Check Point SoftwareIt is the incumbent trying to become a platform rather than get consolidated away, priced like a skeptic's bet on the same trend.20%
- Younger vendors built around AI detection and recovery compete in a consolidating market by moving faster in their lanes. · RubrikIt is the AI-native defense piece: when AI makes attacks cheaper and faster, the ability to recover data becomes a budget line of its own., DatadogIt consolidates from the monitoring side: teams already watching their systems add security there instead of buying another tool., SentinelOneIt is the bet that AI-first detection can win share even in a consolidating market by growing faster than big platforms in its lane.14%
- Smaller point tools focused on specific threats are kept as diversifiers in case consolidation moves slower than expected. · Varonis SystemsIt watches the data itself, the thing AI attacks ultimately go after, and its shift to a cloud subscription model is the growth engine., QualysIt finds weak spots before AI-armed attackers do, spending that survives consolidation if it stays the tool of record for vulnerability management., Tenable HoldingsIt maps everything a company exposes to the internet, which matters more as AI lets attackers probe that surface constantly.10%
- Identity is the control point every consolidated platform must plug into to manage who gets access to what. · OktaIt is the independent control point for identity and access, the one point tool this take keeps because AI attackers go after logins first.5%
- Cash10%