CrowdStrike and Palo Alto lead software rally on AI safety demand

Cybersecurity vendors are absorbing the capital that AI-safety anxiety is pushing out of frontier model developers, and on Sept. 14 that trade had a clear leaderboard: CrowdStrike Holdings and Palo Alto Networks at the front of a broad software advance.

"Security is the one line item in the AI budget that no board is willing to cut, because the threat surface grows every time an agent gets write access to production," said Wedbush analyst Dan Ives, who added Palo Alto Networks to the firm's Best Ideas List and reiterated an Outperform rating, calling the company a primary winner in AI-driven cybersecurity.

The rotation is visible across the group. CrowdStrike traded significantly higher after launching AI-native security products Falcon Guardian and SafeMind at its Fal.Con 2026 conference and expanding a partnership with OpenAI, with management telling the Goldman Sachs Communacopia and Technology Conference that demand for its agentic AI security platform is running ahead of plan. SentinelOne rose after Wedbush initiated coverage at Outperform with a $25 price target, citing its Wayfinder Frontier AI Services build-out with OpenAI. Zscaler climbed on the launch of its AI-native Agentic SOC platform and a fourth-quarter earnings beat. Fortinet advanced after being named a Leader in the 2026 Gartner Magic Quadrant for Hybrid Mesh Firewalls. Okta drew a price-target increase to $200 from $180 at Wells Fargo, which cited early AI tailwinds and growth potential in the mid-teens or higher.

The demand side of that trade got its loudest advertisement over the weekend, when Anthropic CEO Dario Amodei published an essay calling for a deliberate slowdown in frontier model development. The proposal drew support from other industry leaders and immediately repriced the hardware complex: Marvell Technology fell on concern that a coordinated pullback would dampen demand for custom accelerators and optical interconnects, Arm Holdings slid on the same logic plus an ongoing FTC antitrust investigation into its licensing practices, and Teradyne, KLA, Lam Research, Applied Materials and Onto Innovation all retreated as investors reassessed the AI infrastructure spending cycle. RELX, the data analytics publisher, rose more than 4% in London as capital rotated toward established information businesses and away from high-capex AI hardware.

That is the mechanism worth naming. The same headline that subtracts from semiconductor capital expenditure adds to security software budgets, because the argument for slowing model development is an argument that deployed AI is dangerous. Every enterprise that reads Amodei's essay and decides to govern its agents more tightly is a buyer of identity, endpoint and runtime controls. The cybersecurity sub-sector is the only part of the AI trade that monetizes the risk rather than the build-out.

The rotation has a second, less durable leg. Software broadly has been the weak half of technology for weeks, with Salesforce, ServiceNow and Atlassian each down between 6% and 9% in a single recent week while semiconductors rallied across the board. Money leaving those names needed a destination inside software, and security offered the cleanest story with the freshest product news. That flow component is transient by nature; the AI-safety demand component is not.

Valuation is where the two legs get tested. CrowdStrike and Palo Alto Networks both trade at substantial premiums to the broader software group on forward earnings, a multiple that only holds if net new ARR keeps compounding at current rates. The bull case rests on AI security becoming a separate budget line rather than a feature bundled into existing endpoint contracts — a shift that would expand the addressable market rather than redistribute it. The bear case is that platformization, Palo Alto's strategy of consolidating customers onto fewer vendors, compresses pricing across the group even as total spend rises.

The near-term calendar matters. Fortinet holds its virtual 2026 SASE Summit on Sept. 15, where management is expected to detail new AI-native security features, and the next round of quarterly reports will show whether the AI-safety narrative is converting into signed contracts or merely into multiple expansion. Until those numbers land, the rally is a sentiment trade with a genuinely improving story underneath it.

This article is for informational purposes only and does not constitute investment advice.