The Agentic AI Threat Is Turning Cybersecurity Into May's Biggest Tech Trade
Cybersecurity has quietly become the strongest corner of the tech sector this month. Semiconductors carried the bull market for much of this cycle, but the rotation now underway is pointed squarely at enterprise security software. The First Trust Nasdaq Cybersecurity ETFCIBR has hit six consecutive intraday records and is up over 20% in May 2026.
Chips recede, cyber takes charge
That 20%-plus monthly gain putsCIBR ahead of both the iShares Semiconductor ETFSOXX and the iShares Expanded Tech-Software Sector ETFIGV in May.SOXX is up nearly 75% this year and roughly 60% this quarter, even after pulling back just over 10% from its May 11 peak to its May 19 low.
Buyers moved back in fast, but the strongest tech line on the chart this month still belongs to cybersecurity.
The software comparison makes the divergence even sharper.IGV is up ~10% in May but remains down double digits year-to-date and sits more than 20% below its closing high.
Cybersecurity looks less like a bounce off the lows and more like genuine sector leadership.
CIBR is not a pure-play cybersecurity basket. Large positions in CiscoCSCO, AlphabetGOOGL, and BroadcomAVGO fold in networking, cloud infrastructure, and AI hardware.
That blend reflects what cybersecurity has become as a trade, a mix of software, cloud build-out, and enterprise AI spend, all under one roof.
Why analysts are raising targets now
Rosenblatt Securities lifted its price target on CrowdStrike Holdings to $640 from $555. The firm also raised its target on Palo Alto NetworksPANW to $275 from $225.
Analyst Catharine Trebnick pointed to agentic AI as the central driver.
Agentic AI refers to autonomous software that executes multi-step tasks without human prompts. Security teams and hackers are both deploying it, which is widening the range of threats enterprises need to defend against.
Trebnick said the market is under-appreciating major security platforms' growth potential as agentic AI expands the attack surface, per Investor's Business Daily. She added that the dynamic is also accelerating vendor consolidation.
The practical implication for investors is consolidation pressure. Enterprises dealing with a wider attack surface are pulling security spend toward fewer, larger vendors rather than managing dozens of point products.
That dynamic benefits platform-scale players most directly.
Trebnick added that Palo Alto's platformization strategy is resonating as customers consolidate vendors. They increasingly prioritize AI traffic inspection and unified policy enforcement across cloud and AI-driven infrastructure, she noted.
Cybersecurity had faced pressure from concerns that AI model builders such as Anthropic and OpenAI could develop competing security tools. Many cybersecurity stocks have rallied sharply since early April despite those concerns.
The sector's split performance
CRWD has posted seven consecutive intraday records and is up 27% year-to-date in 2026.PANW is up 33% year-to-date.
Both Palo Alto and DatadogDDOG recently cleared highs set in late 2025 to join the record run. FortinetFTNT and Cisco each added tens of billions in market cap this month.
The rally is not uniform. ZscalerZS and OktaOKTA are both bouncing but remain far below their prior highs.
DynatraceDT has underperformed the broader cybersecurity rebound. Check Point SoftwareCHKP is still fighting resistance from its dot-com-era ceiling.
The IBD computer security group currently ranks No. 11 out of 197 industry groups tracked. That's a strong sector positioning reading, not a fringe rotation.
The near-term test
The key level for the trade isCIBR's old breakout zone near $78, which corresponds to the ETF's October 2025 highs. A hold above that zone keeps cybersecurity in sector leadership.
A failure there changes the read on the entire record run.
Two major earnings reports arrive in early June. CrowdStrike reports fiscal first-quarter results on June 3.
Palo Alto reports fiscal third-quarter results on June 2. Both prints will land while the sector is trading at or near all-time highs.
Expectations are baked in, and any miss carries more downside risk than usual.
The case for the trade rests on a genuine demand shift. Enterprises are expanding their security budgets to cover AI-driven infrastructure, and the largest platforms are capturing that spend at scale.
The risk is that valuations are already reflecting a lot of good news. The record run has left less room for disappointment than it had a month ago.