Why Security Stocks Are Crashing While Breaches Surge

Lucas (0:01)

If you've been watching the tech sector lately, there's a weird dissonance playing out in real time. Cybersecurity stocks are getting hammered, yet the headlines about breaches are only getting louder.

It's October 20th, 2026, and we're seeing names like CrowdStrike down nearly 13 percent over just five days, while PaloAltoNetworks is shedding similar gains.

Luna (0:25)

It feels counterintuitive.

Usually, when attacks spike, you'd expect the defender's valuations to hold or rise. What's breaking that correlation right now?

Lucas (0:37)

The core issue is that the market is pricing in a transition, not just a threat environment. Investors aren't doubting the need for security.

They're doubting whether the current business models can sustain growth amid aggressive cost-cutting by enterprises. Look at Okta dropping 16 percent or Zscaler falling 7 percent. The concern is that CFOs are squeezing security budgets, viewing them as overhead rather than revenue drivers during this economic tightness.

Luna (1:06)

But isn't it also about the efficacy of these tools? If breaches keep happening despite massive spend, doesn't that erode confidence in the entire category?

Lucas (1:16)

Exactly. That brings us to the specific angle I want to drill into today.

The collapse of the perimeter defense model and how it's leaving traditional vendors exposed. For decades, companies bought firewalls and endpoint protection because the assumption was that if you built a strong enough wall, nothing would get in. But with AI agents moving autonomously across networks, that wall is irrelevant. Microsoft itself recently flagged that frontier AI models act like insider threats because they can bypass traditional controls.

Luna (1:49)

So the attackers aren't just hacking humans anymore, they're hacking the autonomous systems that run our businesses. How does that change the value proposition for vendors like CrowdStrike or ForNet?

Lucas (2:01)

It changes everything because it shifts the battleground from network traffic to identity and intent. CrowdStrike has been trying to pivot toward this behavioral analytics approach, which is why their stock is under pressure. It's an expensive and proven at scale transition. Meanwhile, companies like PaloAlto are betting on a unified platform strategy.

But that requires customers to rip and replace existing infrastructure, which is hard to sell when budgets are frozen.

Luna (2:29)

I'm curious about the customer side. Do CISOs actually feel safer with these new platforms, or are they just buying bigger spreadsheets of alerts?

Lucas (2:39)

That's the operational nightmare. We're seeing reports that security teams are ignoring critical alerts because they're drowning in noise. When an AI agent moves laterally through your cloud environment, it doesn't trigger a traditional signature-based alert. It looks like normal behavior.

So the vendor sells you a tool that claims to stop zero days, but in practice, it just adds another dashboard you have to stare at until you go blind.

Luna (3:05)

So the problem isn't just the technology failing, it's the human capacity to interpret it. Is there a middle ground where smaller firms can compete against these giants?

Lucas (3:16)

There is, but it's niche.

We're seeing a rise in specialized identity-focused startups that don't try to be the full-stack solution. They focus entirely on verifying who or what is making a request before any data moves. This is where the real money is flowing away from the broad platform giants. But for the major players, the stock price reflects the fear that they might become obsolete utility providers rather than strategic partners.

Luna (3:44)

It reminds me of the .com bubble, but inverted. Everyone knows they need the service, but nobody wants to pay the premium for it right now.

Lucas (3:53)

Precisely, and unlike the .com era, this isn't about hype alone. It's about a fundamental re-architecting of trust. Let's pause here for a moment to talk about how we keep the show running without ads, because that aligns with the independence we bring to these topics.

Luna (4:11)

Right, because listener support lets us dig into the data without chasing clicks or sponsor mandates.

Lucas (4:18)

We deliberately don't run ads on these shows. If you want to support that choice, the link is by me at coffee.com/vexingo.

That's F E X I N G O.

Luna (4:34)

Thanks for keeping the conversation honest and ad free.

Now, back to the market. Does this correction signal a buying opportunity or is the sector still overvalued?

Lucas (4:46)

It's a trap for the unwary. Just because a stock is down 20% doesn't mean it's cheap.

Many of these companies were priced for perfection in a high growth cloud economy. Now, with interest rates stabilizing but growth slowing, the multiple compression is painful. However, the ones that successfully pivot to outcome-based pricing, where you pay for prevented incidents rather than per-seat licenses will survive.

Luna (5:12)

Outcome-based pricing sounds great on paper, but how do you quantify a breach that didn't happen? Isn't that just marketing fluff?