In early April, Wall Street wrote the obituary on the cybersecurity sector.
Anthropic had just confirmed that its forthcoming AI model, codenamed Claude Mythos, was “far ahead of any other AI model in cyber capabilities” — language pulled from a draft blog post that leaked through a misconfigured content management system in late March.
The First Trust NASDAQ Cybersecurity ETF (NASDAQ:CIBR), the Amplify Cybersecurity ETF (NYSE:HACK) and the Global X Cybersecurity ETF (NASDAQ:BUG) all rolled over.
On April 9, CrowdStrike Holdings Inc. (NASDAQ:CRWD) had fallen 7% in a session. Cloudflare Inc. (NYSE:NET) dropped more than 13% on April 10 and Akamai Technologies Inc. (NASDAQ:AKAM) lost roughly 20% across three sessions.
Then the script completely flipped. The cybersecurity sector is now riding a six-week rally.
As of May 21, HACK was up 17.27% month-to-date, the largest monthly rate of change on its chart since the fund launched in November 2014. BUG was up 26.14% month-to-date, the largest monthly gain in its history since inception in October 2019.
The Cybersecurity Sector Reversal Nobody Priced In
Twelve names inside the BUG portfolio are up more than 20% in May alone.
| Company | MTD Return |
|---|---|
| Fortinet Inc. (NASDAQ:FTNT) | +54.19% |
| CrowdStrike Holdings Inc. | +45.85% |
| Akamai Technologies Inc. | +39.40% |
| Palo Alto Networks Inc. (NASDAQ:PANW) | +37.55% |
| Zscaler Inc. (NASDAQ:ZS) | +33.49% |
| SailPoint Inc. (NASDAQ:SAIL) | +31.17% |
| Gen Digital Inc. (NASDAQ:GEN) | +29.60% |
| SentinelOne Inc. (NYSE:S) | +26.91% |
| Rubrik Inc. (NYSE:RBRK) | +25.78% |
| Rapid7 Inc. (NASDAQ:RPD) | +23.90% |
| Tenable Holdings Inc. (NASDAQ:TENB) | +22.07% |
| Okta Inc. (NASDAQ:OKTA) | +20.90% |
What The Cyber Doom Call Missed
The April thesis was a clean syllogism. AI gets better at finding vulnerabilities. Vulnerability discovery was the moat. Therefore, the moat is gone.
The first two premises were correct. The third assumption is that enterprises would respond to a new threat by spending less on defending themselves.
They are doing the opposite.
Fortinet’s first-quarter report on May 7 delivered $1.85 billion in revenue, above the $1.73 billion expected, with adjusted earnings of 82 cents per share versus a consensus near 62 cents. Billings rose 31% year-over-year. Management raised full-year guidance, citing demand from AI data center buildouts.
Within 48 hours, BTIG upgraded the stock to Buy with a $125 price target. Susquehanna, Barclays, UBS Group, Cantor Fitzgerald, Scotiabank and Piper Sandler followed.
The Structural Case: Every AI Agent Needs A Credential
Research from Palo Alto Networks shows machines and AI agents already outnumber human employees by roughly 82 to 1 inside enterprise environments. Each one needs an identity, permissions, and access controls.
Most companies do not have a clean inventory of their machine identities today. As agentic AI workflows scale, machine identity management becomes mandatory.
That is the connective tissue behind the M&A wave. Palo Alto Networks closed its CyberArk Software acquisition this quarter and announced a Portkey deal on May 1 to secure AI agent operations.
The compounding rate is no longer about ransomware. It is about the surface area created by agentic AI itself — by tools that look a lot like Claude Mythos.
The pain became the windfall.
What It Means For Investors
The cybersecurity sector entered May trading as if a single technology release had repriced its entire competitive position. It exits May with three flagship ETFs printing record monthly returns and analyst targets being lifted across the leadership group.
When a sector everyone has written off rips six weeks in a straight line, the consensus call usually wasn’t wrong about the technology. It was wrong about how customers respond to it.
Image: Shutterstock
Login to comment