Wedbush's cyber 'winners' were right — and the list has already split in two

In March, ahead of the RSA security conference, Wedbush went against a market that had been dumping cybersecurity stocks. The fear driving the sell-off sounded plausible: Anthropic and OpenAI were shipping their own AI security tools, and investors worried these AI-native products would sideline the established platforms. Wedbush called it an overreaction and published its winners list — CrowdStrike as the industry's "gold standard" and top pick, then Palo Alto Networks, Check Point, and Zscaler — arguing the AI-native tools it was being compared with are defensive additions rather than a replacement for the incumbent platforms. Its reasoning cut against the disruption story entirely: AI is not the incumbent's problem, it's the incumbent's demand engine.

The past six months sided with Wedbush

The mechanism matters more than the mood. AI does not just threaten companies by giving defenders better tools — it arms the other side. Autonomous agents can now find software flaws and launch attacks in seconds, using models so powerful that the labs that built them deemed them too dangerous to release publicly. That turns security from a budget line into a necessity, and it pushes enterprises toward the big platforms rather than away from them, because the attackers got faster than any in-house team can track. Wedbush's core claim was that the attack surface expands with every new agent, machine identity, and API — so demand for the incumbents grows instead of shrinking.

The tape validated that for the two names Wedbush put first. CrowdStrike reported its best quarter ever in late August: revenue up 26% to $1.47 billion, annual recurring revenue up 25% to $5.84 billion, a record $333 million in new ARR, and guidance for FY27 net-new-ARR growth raised to 34%. CrowdStrike and Palo Alto roughly doubled between April and June. The disruption scare that marked the stocks down in March has been priced out.

Here is where the "winners" label becomes the interesting part — because a sector call is not an allocation, and the four names have already split by the math.

Two leaders, priced for perfection

Run the same valuation-versus-growth lens across all four today and the list stops being uniform. CrowdStrike trades near $207 with a market cap around $212 billion — roughly 39 times trailing sales against 24% revenue growth. Palo Alto sits near $331, a $270 billion company at about 24 times sales with a forward price-to-earnings ratio near 238. Both already re-rated; they are now priced to keep accelerating.

The cost of that re-rating shows up in the recent tape. Expectations ran so far ahead that even good quarters got sold. CrowdStrike fell 7% in June when its guidance missed elevated expectations, and it is down about 8% over the past month. Palo Alto is down about 16% over the past month. That is the exhaustion that follows a doubled stock, not the mispricing Wedbush flagged in March. The divergence the original call was betting on — cheap platform leaders versus a worried market — has largely been harvested out of these two.

Two laggards, cheap for a reason

The discount now sits in the other two, and there it is earned, not free. Check Point trades near $132, a $13 billion company at roughly 13 times trailing earnings and five times sales, with a 30% operating margin and little debt. It looks cheap until you check the growth dial: revenue up about 5%. This is a value stock, cheap precisely because it does not grow — not a re-rating candidate Wedbush left behind. Zscaler, near $165 with a $27 billion market cap, fell from an extreme multiple to about eight times sales and is down 27% on the year, yet it still fails to turn a profit on a trailing GAAP basis. It is a fallen high-multiple growth name, a different animal from the other three.

So the honest read is not "buy the laggards." The names Wedbush got right — CrowdStrike and Palo Alto — are the ones whose easy gain is gone, and the names still carrying a discount are cheap because the market has real reasons to discount them.

A validated thesis is the hard version of the trade. "Wedbush picks winners" gives you the firm's direction and its ranking, and both proved useful. But the ranking was a starting point. The numbers now split that list in two — and knowing which bucket each name sits in, expensive growth leader or cheap laggard with problems of its own, is the judgment that was always doing the work.