Investors are fleeing cybersecurity stocks as persistent concerns about the disruption of artificial intelligence overwhelm the industry’s strong fundamentals. We are not among them. The selloff began on Friday and extended into Monday trading after Anthropic announced Claude Code, an AI-powered assistant that scans codebases for security vulnerabilities and suggests targeted patches for human review. This tool is currently available in limited research preview. CrowdStrike fell 8% on Friday and 9% on Monday, while Palo Alto Networks fell 1.5% on Friday and 2.5% on Monday. Both names are stocks in the CNBC Investing Club portfolio. At Monday morning’s meeting, Jim Cramer made a case for selling. “We don’t think there’s anything fundamentally wrong with it,” said Jeff Marks, the club’s director of portfolio analysis, calling the cyber group “guilty by association.” This association is all enterprise software and has recently been deprecated. Jim and Jeff have repeatedly said that cybersecurity stocks shouldn’t be lumped in with broader software names because their clients can’t afford to neglect protecting their computer systems from AI-powered hackers. Additionally, the rise of AI agents has dramatically expanded the scope of vulnerabilities. Both CrowdStrike and Palo Alto are best-in-class companies in this new arms race. The market reaction reflects a growing awareness that AI tools that can identify weaknesses can disrupt application security testing and related cybersecurity services. It’s not just humans. In October, AI startup OpenAI announced an AI-powered security researcher called Aardvark that autonomously discovers, verifies, and helps fix large-scale security holes. Wall Street analysts agree with Jim that the fear is overdone. JPMorgan analysts called the changes in cybersecurity “relatively indiscriminate” and said they saw opportunities emerging within the group, the firm wrote on Monday. Analysts rated CrowdStrike and Palo Alto as having “higher AI resilience” among a select few. That’s because “not all software is exposed to the same risks, and this is especially true across security software,” the analysts said. UBS echoed this view, arguing that “the fundamentals of cybersecurity are better than the fundamentals of applications, and the cyber sector will continue to see net benefits from the adoption of AI and increasing cybersecurity challenges.” Because while these AI companies may deploy more cyber products, they are less likely to develop advanced infrastructure controls such as the endpoint agents, distributed security gateway networks (SASE), and identity authentication platforms that are the foundation of CrowdStrike and Palo Alto Networks. To help you better understand all the industry terminology, we’ve created a cybersecurity terminology cheat sheet. Further confirming this, TD Cowen said on Monday that AI coding assistants cannot disrupt cybersecurity platforms. After meeting with industry and technology experts, analysts believe that while AI coding assistants improve software quality and developer productivity, they do not replace security platforms or alleviate structural demands on security. The company concluded that there will be no short-term impact on major platform providers. CrowdStrike CEO George Kurtz made this point in a LinkedIn post on Sunday. In the post, he explained how he wrote a prompt asking Claude to ask the chatbot to build an alternative to CrowdStrike. Here is Claude’s response: “I appreciate your ambition, George, but I have to be frank. CrowdStrike It’s not something I can do here, and it’s not up to me to suggest anything else.” Kurtz continued, saying that CrowdStrike’s core capabilities include “real-time, kernel-level endpoint monitoring across millions of devices. “A unique threat intelligence graph built from trillions of security events, a lightweight agent with sub-second detection that runs on any OS, automated incident response and remediation, and 24/7 threat hunting operations.” He said, “This is not something that can be recreated with a script. This is an infrastructure product.” In fact, AI-enabled tools have numerous vulnerabilities that can compromise applications and leak sensitive data. CrowdStrike protects against these threats through its Falcon platform with features such as AI detection and response. Palo Alto protects against AI threats through Prisma AI Runtime Security, a platform that provides real-time monitoring to identify vulnerabilities. In conclusion, Jim acknowledged the short-term pain. “We’re not unaware of this. … We recognize that these are dead meat.” Jim explained that in a sell-off like this, hedge funds typically avoid it and then may go back to selling again. But that’s not how clubs manage their portfolios. Instead, we are long-term investors who invest on fundamentals. Jim also acknowledges that cyber stocks may have more room to fall. Holding CrowdStrike at the moment is most painful, but we have no intention of selling. If market concerns ease and fundamentals remain intact, that could be a signal as to what to do next. For now, as Jim says, “we’re not there yet.” (Jim Cramer’s Charitable Trust is long CRWD, PANW. See here for a complete list of stocks.) As a subscriber to Jim Cramer’s CNBC Investment Club, you will receive trade alerts before Jim makes a trade. After Jim sends a trade alert, he waits 45 minutes before buying or selling stocks in his charitable trust’s portfolio. If Jim talks about a stock on CNBC TV, he will issue a trade alert and then wait 72 hours before executing the trade. The above investment club information is subject to our Terms of Use and Privacy Policy, along with our disclaimer. No fiduciary duties or obligations exist or arise from your receipt of information provided in connection with the Investment Club. No specific results or benefits are guaranteed.
