Cybersecurity stocks are rallying on government hacking warnings — the one bright spot in a shaky tech tape

Verdict: The cyber demand story is real, but today's prices have already run past the entry gate — wait

Our stance on this idea is a wait over the multi-week-to-multi-month swing horizon the strategy itself implies: the cybersecurity demand thesis is genuinely supported — all four names grew revenue in the top quartile of IT peers (FTNT at 14.8% year over year, PANW at 34.5%) and generate elite free cash flow — but every entry condition is unmet today. The strongest support is the completed 60-month backtest on CRWD, which traded three times, won all three, and returned roughly 98.5%, alongside the thesis-defining revenue durability. The strongest risk is twofold: ZS sits at RSI 78, already past the 70 level the strategy uses to close positions, and provisional September 30, 2026 filings show net insider open-market selling at all four names — roughly $449.5M at CRWD alone. CRWD's latest quarter also showed net income down about 81% quarter over quarter to $5.3M on a 0.4% net margin, so if the momentum cracks, there is little earnings quality beneath three of the four names. The reassessment trigger is a dip to RSI(14) at or below 45 on any name followed by a daily close reclaiming its 20-day EMA with trend strength holding above 18. Note the backtest evidence is thin (three trades, zero triggers in the 12- and 24-month windows) and no robust parameter setup was established, so the historical result is encouraging but not statistically decisive.

Trade now

Hold on — none of this strategy's entry conditions are currently met. The business thesis (cybersecurity demand holding up while the broader AI trade wobbles, per the idea's own framing) is intact, and the backtest evidence is real: over a 60-month window on CRWD the rule set traded 3 times, won all 3, and returned about 98.5% with a worst peak-to-trough decline of 32.9%. But the same rule set produced zero triggers over the trailing 24-month and 12-month windows, and today every entry gate is unmet. The strategy buys pullbacks (RSI(14) at or below 45), and all four names currently sit well above that level — CRWD at 60.0, FTNT at 53.4, PANW at 56.3, and ZS at 78.0 (as of the October 24, 2026 observation, daily bars). ZS is actually in exit territory, with its RSI already above the 70 overbought level used to close positions. This is a case where an attractive thesis and a tradable setup diverge. The rules are designed to buy weakness that then reclaims its 20-day EMA with trend strength (ADX above 18) — a momentum-recovery pattern. Today the opposite is true: the group has already rallied on the government warnings about programming-tool threats cited in the thesis, so the entry condition would only arm after a meaningful pullback of roughly 15 RSI points for CRWD, 8–11 points for FTNT and PANW, and 33 points for ZS. "Waiting" here means holding off entirely until a daily close configuration satisfies the rules, not buying a fraction of the position early. The downside that matters: if the AI-spending fear trade the thesis is hedging against spreads into cyber, a cooling-off period could instead become a downtrend — the backtest's 32.9% drawdown is the scale of loss these names can deliver even in a profitable regime. Horizon: the strategy's own exits (2% stop, 4% take-profit, or RSI above 70 after 90+ bars) imply a multi-week-to-multi-month swing horizon, not a day trade. The pivotal condition is a dip to RSI(14) at or below 45 followed by a close back above the 20-day EMA with ADX above 18. No earnings dates for CRWD, FTNT, PANW or ZS are confirmed in the supplied data, so calendar risk cannot be pinned to a specific day. ### Technical details Entry rules (per ticker, daily bars), and current readings versus triggers (prices as of October 24, 2026): - **CRWD** (last close $257.57): RSI(14) 60.0 versus the trigger at or below 45 (far); close of $257.57 versus the 20-day EMA of $247.46 — price is above the EMA by about $10.11, so the "crossed above EMA" condition needs a dip-and-reclaim to occur (near, but not met today); ADX(14) 20.0 versus above 18 (met). Entry 1 additionally requires the day's low to touch the nearest support level ($250) while closing above it. Not all conditions met — no entry. - **FTNT** (last close $179.99): RSI(14) 53.4 versus at or below 45 (far); price is above the 20-day EMA of $178.19 by about $1.80 (near); ADX 26.5 versus above 18 (met). Nearest support $170.43; nearest resistance (take-profit reference) $180 — price is already pressing it. - **PANW** (last close $380.55): RSI(14) 56.3 versus at or below 45 (far); price above the 20-day EMA of $373.08 by about $7.47 (near); ADX 18.1, barely above 18 (met). Nearest support $380, nearest resistance $387.33. - **ZS** (last close $255.15): RSI(14) 78.0 — far above the 45 entry gate, and already above the 70 exit threshold; price sits about $37.78 above its 20-day EMA of $217.37. This is the most extended name in the basket and a candidate for profit-taking under the strategy's own overbought rule, not an entry. Exits: RSI(14) above 70 once a position has been held 90+ daily bars; take-profit at a close at or above the nearest resistance level or a 4.0% gain; stop-loss at a 2.0% loss or a close breaking the second support level. Position sizing is fixed-risk at 2% with a 25% maximum position size. Note that the backtest's exit fills were approximated on daily bars rather than intraday data, so the reported win rate and drawdown are coarse rather than precise. One sensitivity caveat: the parameter-sensitivity evaluation ran out of time before testing any alternative settings, so no robustness check across nearby parameter values exists — the published thresholds are the only tested configuration.

Cyber demand is real and the completed backtest did catch it — but only in one window

The bull case is straightforward: cybersecurity fundamentals are healthy across all four names, the defensive-demand story per CNBC's October 22 piece is independently supported by reported revenue growth, and the one completed 60-month backtest run captured a +98.5% return — though with important qualifications about trade count and window coverage. ### Demand resilience shows up in the reported numbers, not just the narrative The idea argues cyber budgets survive AI-spending anxiety; the reported financials agree. In their most recent quarters, CRWD grew revenue 23.3% year over year (fiscal Q4, ended January 31, 2026), FTNT 14.8% (fiscal Q4, ended December 31, 2025), PANW 34.5% (fiscal Q4, ended July 31, 2026), and ZS 24.9% (fiscal Q4, ended July 31, 2026). All four rank in the top quartile of IT-sector revenue growth against peers of roughly 800–900 companies. Sequential quarters confirm momentum: CRWD's latest revenue rose 6.2% quarter over quarter to $1.47B, FTNT's rose 10.7% to $2.05B, and PANW's accelerated 13.6% to $3.41B. That is the causal chain the thesis needs — customers actually spending, so the 'self-sustaining catalyst' claim is not just headline-driven. ### Cash generation is strong even where reported profits are thin Free cash flow — cash left after operations and capital spending — is the metric that matters here, and it is elite. PANW's latest quarter produced $1.25B of free cash flow (98th percentile among IT peers), FTNT $577.4M (94th percentile), CRWD $395.4M (91st percentile), and even the smallest name, ZS, generated $79.4M (68th percentile). FTNT alone converted a 32.8% operating margin and 29.6% net margin into $606.3M of net income in its latest quarter. This means the group can fund heavy R&D (CRWD spends 27.9% of revenue on R&D, ZS 26.9%) without external financing — a structural advantage if the AI threat environment extends the spending cycle. ### The completed backtest run was profitable, with a defined worst case On the 60-month daily window, the strategy traded three times on CRWD and won all three, returning 98.5% over the window. The worst peak-to-trough loss observed in that window was 32.9% — that is the maximum drawdown over five years, not a typical bad month — and exits were filled on daily bars rather than intrabar prices, so exit quality is approximate. Both the 24-month and 12-month windows recorded zero entry triggers, meaning the entry conditions simply did not occur in those periods; that is a watch-list status, not evidence against the setup. Note also that no robust parameter setup was established — the sensitivity evaluation exceeded its time budget — so the published…

Scores

• Conviction score breakdown: 48
• Thesis support: 70
• Trade readiness: 25
• Risk quality: 45
• Backtest evidence: 40
• Fundamentals trend: 60

Watch items

• CRWD — RSI (14)
• FTNT — RSI (14)
• PANW — RSI (14)
• ZS — RSI (14)