Sat, September 19, 2026 | 5:00PM ET

Cybersecurity Stocks Will Secure the AI Era

Economic Strategist, Market Intelligence

The Federal Reserve just hiked interest rates for the first time since 2023. Worries about the existential threat of AI are growing, with some claiming a 10% chance that AI kills us all within the next decade. Meanwhile, war between the U.S. and Iran looks to be escalating, and evidence suggests that more and more bad actors are using AI to do bad things.

All these headlines weighed on the S&P 500 SPY this past week, which finished flat.

But one segment was the clear winner from all this doom and gloom, and that was cybersecurity. Global X’s Cybersecurity ETF BUG rose 11% in the last week, marking the largest percentage outperformance against the S&P 500 since May 8 — benefiting from all the security risks that arise as AI agents gain greater autonomy.

For enterprises, AI agents mean it has never been cheaper or easier to have their code exploited, their data leaked, or their identities compromised. That’s why it has become crucial to rely on cybersecurity companies that can help predict, avoid, and also bring a swift end to agentic attacks if they do happen.

As many already believe that AI is reducing job openings, fears that AI will soon be out of control have contributed to the already growing AI backlash, increasing the calls for regulation. Of course, President Trump doesn’t want the U.S. to lose its lead to China in the AI race, so he has pushed back on all these fears. On the other hand, Anthropic Chief Executive Dario Amodei and some of his rivals are recommending that AI developers “pace the frontier,” paying heed to these fears.

There’s a good chance that calls for a slowdown will fade away, and even if they don’t, signs suggest that AI has already become too dangerous. In recent weeks, news outlets have reported that Houthi militants in northern Yemen tried to use Claude for ballistic missiles. Prior to that, OpenAI’s agents escaped the company’s test environment, finding a way to get on the internet to hack a startup, Hugging Face.

For the purposes of this article, we won’t delve into whether it’s beneficial for the broader global economy to slow down from making such rapid advancements in AI. Instead, we’re going to turn our attention toward the investment opportunities that arise from a world always on alert.

As Nvidia Chief Executive Jensen Huang said, “The reason why there’s so much conversation today about cybersecurity is because the industry is getting ready to launch some products.” According to him, if the market is “hysterical,” that increases demand for cybersecurity products.

Even if such fears ultimately turn out to be overblown, cybersecurity stocks will arguably remain an attractive play – a staple of corporate spending, one might say – because companies won’t want to take any chances. Spending on global cybersecurity is expected to increase to more than $430 billion in 2030 from $178 billion in 2024, according to Global X forecasts derived from Gartner. It’s entirely possible that those estimates are modest because as AI adoption grows, companies might initially underestimate their need for security.

“If we believe that AI is in its early days and is only going to get better and more powerful, combined with the autonomous nature of these attacks, it is absolutely something that every company is going to need,” said CrowdStrike Chief Executive George Kurtz during the company’s last quarterly earnings call.

With that being said, here’s a breakdown of the business models of the top five biggest holdings in BUG (by weight). The ETF is also recommended by Fundstrat Head of Technical Strategy as a convenient choice for those interested in a pure-play cybersecurity ETF.

Okta (OKTA)

Okta specializes in the identity and access management space via its distribution, product breadth, and neutrality.
Executives said they noted an acceleration in annual contract value growth for both workforce identity and customer identity. That’s partly because of the threat posed by AI, which has now started to translate into identity modernization initiatives.
According to Okta president Eric Kelleher, recent surveys they ran across their customers show that 81% of chief information security officers that they talk to are aware right now that they are exposed, with agents deployed in their enterprises where they do not yet have an adequate security platform in place. I would say that’s bullish for their stock.
In the latest quarter, subscription revenue was $793 million, up 12% from a year ago, and professional services and other revenue was $12 million, down 33%, for total revenue of $805 million, up 11%. So the non-subscription segment is just 1.5% of revenue.
Okta shares are up 119% in 2026, compared to the S&P 500’s 12% advance.

Fortinet (FTNT)

Fortinet specializes in network and cloud security. According to executives, its new SASE [Secure Access Service Edge] Firewall addresses the fast-growing areas of SASE, AI, and quantum.
Executives said in the last quarter that the broader AI adoption and the risks that arise with it “drove both new business and upgrade activity,” which supported growth “across hardware, software and attached services.”
Fortinet arguably is in a good spot to benefit from the AI doom and gloom because its strategy focuses on securing data centers, protecting AI-driven applications, and delivering AI-native security operations, providing comprehensive support to those that want integrated platforms.
It’s making more money from services. In the latest quarter, product revenue was $773 million, up 52% from a year ago, and service revenue was $1.27 billion, up 14%, for total revenue of $2.05 billion, up 26%, so service is 62.3% of revenue.
Fortinet shares are up 118% in 2026, compared to the S&P 500’s 12% advance.

Palo Alto Networks (PANW)

Palo Alto also provides network security to enterprises. It said that its Frontier AI Defense Service was the first certified commercial partner for Mythos 5.
Executives recently highlighted that enterprises are increasingly prioritizing sovereign control of their AI, seeking the ability to independently develop, deploy, and govern AI using their own infrastructure, data, models, and talent.
In the most recent quarterly earnings, executives said they “expect a major acceleration” for cybersecurity products “as organizations utilize internal telemetry to fine-tune models for bespoke enterprise use cases.”
In the latest quarter, product revenue was $738 million, up 28.6% from a year ago, and subscription and support revenue was $2.67 billion, up 36.2%, for total revenue of $3.41 billion, up 34.5%. So subscription and support is 78.4% of revenue.
Palo Alto shares are up 103% in 2026, compared to the S&P 500’s 12% advance.

CrowdStrike (CRWD)

CrowdStrike focuses on endpoint security. Every product CrowdStrike sells runs on its Falcon platform.
Executives said in the most recent earnings call that AI is a tailwind and that they expect to continue to make money from it, especially as AI expands the attack surface.
CrowdStrike Chief Executive George Kurtz said during the company’s last quarterly earnings call: “The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market’s newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality.”
In the latest quarter, subscription revenue was $1.40 billion, up 27% from a year ago, and professional services revenue was a record $71 million, up about 7.6%, for total revenue of $1.47 billion, up 26%. So professional services are 4.8% of revenue.
CrowdStrike shares are up 110% in 2026, compared to the S&P 500’s 12% advance.

Qualys (QLYS)

Qualys is focused on vulnerability and exposure management. It quantifies cyber risk in business terms, communicates it via executive reporting and ticketing, and eliminates it by patching, mitigating, and tracking. It gives you inside and outside visibility of all assets with an attacker’s view of the network.
Executives recognized in the most recent earnings call that AI has completely changed the game for bad actors. Chief Executive Sumedh Thakar said that “AI is simultaneously becoming the greatest force multiplier and the most formidable challenge cybersecurity has ever faced.” Qualys appears well-positioned to benefit from that increased need for surveillance.
In the latest quarter, revenue was $182.2 million, up 11% from a year ago — effectively all of it from its cloud-based subscription platform.
Qualys shares are up 34% in 2026, compared to the S&P 500’s 12% advance.

The BUG ETF itself lists 31 holdings as of this writing. Our decision to limit our discussion to the five largest should not be misconstrued as a view that the other 26 are less innovative or somehow less likely to perform well.

As always, Signal From Noise should not be used as a source of investment recommendations but rather ideas for further investigation. We encourage you to explore our full Signal From Noise library, which includes a look at differences between hard and soft power, companies making “moonshot” bets, the investment trends driven by Gen Xers, the recent memory chip gold rush, the future of malls, and drone warfare. You can also find our take on space-exploration investments, defense stocks, and the business of farming.

Disclosures (show)

This research is for the clients of Fundstrat Direct only. Fundstrat Direct Subscription entitles the subscriber to 1 user, research cannot be shared or redistributed. For additional information, please contact your sales representative or Fundstrat Direct at fundstratdirect.com.

Conflicts of Interest

This research contains the views, opinions and recommendations of Fundstrat Direct. At the time of publication of this report, Fundstrat Direct does not know of, or have reason to know of any material conflicts of interest.

General Disclosures

Fundstrat Direct is an independent research company and is not a registered investment advisor and is not acting as a broker dealer under any federal or state securities laws.

Fundstrat Direct is a member of IRC Securities’ Research Prime Services Platform. IRC Securities is a FINRA registered broker-dealer that is focused on supporting the independent research industry. Certain personnel of Fundstrat Direct (i.e. Research Analysts) are registered representatives of IRC Securities, a FINRA member firm registered as a broker-dealer with the Securities and Exchange Commission and certain state securities regulators. As registered representatives and independent contractors of IRC Securities, such personnel may receive commissions paid to or shared with IRC Securities for transactions placed by Fundstrat Direct clients directly with IRC Securities or with securities firms that may share commissions with IRC Securities in accordance with applicable SEC and FINRA requirements. IRC Securities does not distribute the research of Fundstrat Direct, which is available to select institutional clients that have engaged Fundstrat Direct.

As registered representatives of IRC Securities our analysts must follow IRC Securities’ Written Supervisory Procedures. Notable compliance policies include (1) prohibition of insider trading or the facilitation thereof, (2) maintaining client confidentiality, (3) archival of electronic communications, and (4) appropriate use of electronic communications, amongst other compliance related policies.

Fundstrat Direct does not have the same conflicts that traditional sell-side research organizations have because Fundstrat Direct (1) does not conduct any investment banking activities, and (2) does not manage any investment funds.

This communication is issued by Fundstrat Direct and/or affiliates of Fundstrat Direct. This is not a personal recommendation, nor an offer to buy or sell nor a solicitation to buy or sell any securities, investment products or other financial instruments or services. This material is distributed for general informational and educational purposes only and is not intended to constitute legal, tax, accounting or investment advice.
The statements in this document shall not be considered as an objective or independent explanation of the matters. Please note that this document (a) has not been prepared in accordance with legal requirements designed to promote the independence of investment research, and (b) is not subject to any prohibition on dealing ahead of the dissemination or publication of investment research.
Intended for recipient only and not for further distribution without the consent of Fundstrat Direct.

This research is for the clients of Fundstrat Direct only. Additional information is available upon request. Information has been obtained from sources believed to be reliable, but Fundstrat Direct does not warrant its completeness or accuracy except with respect to any disclosures relative to Fundstrat Direct and the analyst’s involvement (if any) with any of the subject companies of the research. All pricing is as of the market close for the securities discussed, unless otherwise stated. Opinions and estimates constitute our judgment as of the date of this material and are subject to change without notice. Past performance is not indicative of future results. This material is not intended as an offer or solicitation for the purchase or sale of any financial instrument. The opinions and recommendations herein do not take into account individual client circumstances, risk tolerance, objectives, or needs and are not intended as recommendations of particular securities, financial instruments or strategies. The recipient of this report must make its own independent decision regarding any securities or financial instruments mentioned herein. Except in circumstances where Fundstrat Direct expressly agrees otherwise in writing, Fundstrat Direct is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice, including within the meaning of Section 15B of the Securities Exchange Act of 1934. All research reports are disseminated and available to all clients simultaneously through electronic publication to our internal client website, fundstratdirect.com. Not all research content is redistributed to our clients or made available to third-party aggregators or the media. Please contact your sales representative if you would like to receive any of our research publications.