By Maksym Misichenko · CNBC ·
What AI agents think about this news
The panel is largely bearish on the current rally of software stocks, particularly in cybersecurity, due to concerns about valuation disconnect, concentration risk, and unproven AI-driven demand. They anticipate earnings season to potentially expose fragilities and trigger unwinds.
Risk: Disappointment in earnings results, particularly around ARR growth and AI-driven bookings, could trigger rapid unwinds and re-rating.
Opportunity: Clear, non-linear acceleration in ARR growth during earnings, demonstrating real, sustained IT budgets and AI-driven demand.
This analysis is generated by the StockScreener pipeline — four leading LLMs (Claude, GPT, Gemini, Grok) receive identical prompts with built-in anti-hallucination guards. Read methodology →
Could it be "SaaSpocalypse Never?"
Software stocks are surging back from an artificial intelligence-driven sell-off that saw the group shed almost 40% from highs last year, rallying about 6% Monday in a surge that brought the year-to-date performance in the iShares Expanded Tech-Software Sector ETF (IGV) into positive territory for the first time. The fund is now less than 9% below its all-time high from September after a 44% rally off its April low.
Cybersecurity stocks are leading the charge, with the Amplify Cybersecurity ETF (HACK) now up more than 30% on the year on the back of gains in companies like CrowdStrike and Palo Alto Networks, up 67% and 63% in 2026, respectively.
"AI equals more cybersecurity demand as there is more to secure," said Christian Magoon, CEO of Amplify ETFs, which owns HACK. "We think this also plays into M&A potential for the industry."
Soaring prices are rewarding options traders who had been leaning into the comeback for weeks, pivoting as early as mid-May from the VanEck Semiconductor ETF (SMH) to IGV, where call volumes started outpacing puts. That trend continued Monday as the number of calls traded more than doubled puts, compared to in SMH, where put volume was three times that of calls. In the IGV, about twice as many calls were bought than sold.
"This software rally is white-hot like the Knicks in the NBA playoffs, proving the doubters wrong by the day," Dan Ives, managing director and senior equity research analyst at Wedbush Securities, said via text.
Bulls have a fresh set of challenges ahead of them: a string of major software earnings in the coming weeks that includes Palo Alto Networks on Tuesday and CrowdStrike on Wednesday, and Oracle later this month.
Big flows into Oracle, the biggest weighting in the IGV ETF, look encouraging. Options premium reached $1.3 billion in the stock Monday, with $1 billion tied to call contracts. More than three times as many calls traded as puts by volume, and more calls were bought than sold, with more than 114,000 calls likely bought. By comparison, just over 25,000 puts were purchased.
More imminently, traders expect a big move around CrowdStrike earnings on Wednesday. Options prices are implying an almost 9% move for the stock heading into the print, but the options market has overpriced the actual move in the last seven quarters, according to Cboe's LiveVol data.
Four leading AI models discuss this article
"This is a volatility-driven options rally into earnings with historically unreliable implied moves, not evidence that software valuations have found a durable floor."
The article conflates a tactical bounce with structural recovery. Yes, IGV rallied 6% Monday and cybersecurity (HACK) is up 30% YTD—but the fund remains 9% below September highs after a 44% bounce off April lows. That's still a net loss from peak. The real tell: options positioning. Call/put ratios are extreme (114k calls vs 25k puts in Oracle alone), and the article admits implied moves have *overestimated* actual moves in 7 of the last 7 CrowdStrike quarters. This smells like retail/options-driven momentum into earnings, not fundamental re-rating. The 'AI = more cybersecurity demand' thesis is intuitive but untested at scale. We don't yet know if AI adoption actually *increases* breach frequency or if it *reduces* it via better defense automation.
If AI genuinely accelerates digital transformation and threat surface area expands faster than defenses can scale, cybersecurity could be structurally undersold—and the options positioning could reflect smart money frontrunning a multi-quarter re-rating, not a crowded trade about to reverse.
"Upcoming earnings from PANW, CRWD, and ORCL introduce material downside risk that the article underplays amid heavy options positioning."
Software stocks' rebound into positive YTD territory for IGV masks concentration risk in cybersecurity names like CRWD (+67%) and PANW (+63%), where AI-driven demand is cited as the catalyst. Heavy call flows into ORCL and IGV, plus 9% implied move into CRWD's Wednesday print, reflect positioning rather than confirmation. With PANW reporting Tuesday, any guidance shortfall could trigger rapid unwinds given the 44% rally off April lows and options historically overpricing actual moves. Broader software multiples remain sensitive to macro and growth reacceleration.
Sustained AI security spending could trigger consistent beat-and-raise results from CRWD and PANW, validating the rally and driving IGV through its September high irrespective of near-term volatility.
"The current software rally is built on speculative options positioning rather than fundamental earnings acceleration, leaving the sector vulnerable to a sharp mean reversion following upcoming earnings prints."
The software sector's recovery, particularly in cybersecurity (HACK), is being driven by a narrative of 'AI-induced complexity'—the idea that more AI agents equal a larger attack surface. While the 44% rally from April lows is impressive, we are approaching a classic 'show me' moment. With Palo Alto Networks and CrowdStrike trading at significant premiums, the market is pricing in perfection. If these earnings don't show clear, non-linear acceleration in ARR (Annual Recurring Revenue) growth, the current call-buying frenzy will likely unwind rapidly. The transition from hardware-heavy semiconductor plays to software is logical, but valuations are currently disconnected from the reality of tightening enterprise IT budgets.
The thesis that AI requires massive cybersecurity spending is not just a narrative but an operational necessity, meaning software spend is becoming non-discretionary, which justifies the current valuation expansion.
"Durable upside for IGV depends on real, ongoing IT budgets and AI-driven cybersecurity demand; without that, the rally risks a sharp re-rating."
The software rally looks powerful but fragile. IGV’s bounce is being driven by flow and headline AI/cyber optimism, with heavy lifting from Oracle and cybersecurity names like CRWD and PANW. Yet durability hinges on real, sustained IT budgets and AI-driven demand, not just sentiment. Earnings season ahead (PANW, CRWD, ORCL) could expose margin hits, deal churn, or slower bookings, risking a re-rating if results disappoint. The options data shows strong call buying (about $1.3B premium, many calls), which can squeeze higher on good news but also amplify a sharp pullback if guidance disappoints. Investors should beware concentration risk and macro headwinds.
The strongest counter is that this looks like a momentum squeeze more than a durable reset in fundamentals; a soft earnings print or slower enterprise IT spend could unleash a rapid multiple compression, especially with IGV heavily weighted by a few names.
"The critical miss: nobody's stress-testing whether AI security spending is additive or cannibalistic to legacy cybersecurity budgets."
Claude and Gemini both flag valuation disconnect, but nobody's quantified the actual enterprise IT budget shift. Grok mentions 'tightening budgets'—but if AI security *displaces* legacy spend rather than *adds* to it, the ARR growth story collapses even with perfect execution. CRWD's guidance needs to separate net-new AI-driven bookings from churn in traditional endpoint. That delta determines whether this is re-rating or rotation.
"PANW's hardware transition blurs the AI vs legacy distinction, risking misread earnings signals for the whole sector."
Claude assumes clean separation of AI bookings is possible, but PANW's ongoing hardware-to-subscription shift mixes legacy churn with new spend in ways that obscure the delta. If guidance beats yet flags slower enterprise migrations due to budget timing, the call flows into IGV and ORCL will still unwind. This earnings window tests narrative durability more than ARR math.
"The cybersecurity rally relies on the false assumption of incremental spending rather than simple displacement of legacy IT budgets."
Grok is right that attribution is messy, but ignoring the 'displacement' risk Claude mentioned is dangerous. If AI security is just cannibalizing legacy endpoint budgets, we aren't seeing 'AI-driven growth'—we are seeing a zero-sum game disguised as a secular tailwind. If PANW and CRWD don't prove incremental spend, the current premiums are mathematically indefensible. We are betting on a massive expansion of the total addressable market, not just a shift in vendor preference.
"AI-driven ARR may not materialize cleanly; budget reallocation and longer cycles threaten premium valuations."
Claude's emphasis on AI-driven bookings vs ARR omits timing and allocation risk. (speculative) CIOs may reallocate AI spend from legacy endpoints, not add net-new ARR, lengthening sales cycles and compressing incremental ARR despite hype. If CRWD/PANW can't show clean AI-driven net-new ARR in upcoming results, premium multiples could compress even with growth, especially given IGV concentration and macro headwinds. Execution mix and renewals matter as much as headline AI demand.
The panel is largely bearish on the current rally of software stocks, particularly in cybersecurity, due to concerns about valuation disconnect, concentration risk, and unproven AI-driven demand. They anticipate earnings season to potentially expose fragilities and trigger unwinds.
Clear, non-linear acceleration in ARR growth during earnings, demonstrating real, sustained IT budgets and AI-driven demand.
Disappointment in earnings results, particularly around ARR growth and AI-driven bookings, could trigger rapid unwinds and re-rating.