🛡️StreetAccount Cybersecurity Check-in: From AI Casualty to Beneficiary (5-Nov) ‣ Focus Points • High-profile events have driven volatility, but AI-enabled attacks are broadly bolstering cybersecurity demand. • Broad platforms seen as best positioned to capitalize, while Endpoint, Network, Cloud Security all have identifiable tailwinds. • Vulnerability Management considered most exposed to AI disruption as frontier models increasingly replicate core capabilities. • Underperformers struggling with AI monetization, ARR declines, decelerating growth. • AI monetization is early but real, with recent earnings calls highlighting link to bookings, revenue. ‣ The Context • Cybersecurity stocks have experienced significant volatility this year as markets weigh net impact of growing AI adoption and agentic AI advancements. +ANT's Claude Code Security rocked the segment in Feb, which then dipped again in March on leak of Mythos' cybersecurity capabilities; Project Glasswing partners, including CRWD and PANW, later rallied on model's official release. Rogue agents, cyber-attacks and warnings from AI CEOs have since bolstered sentiment. ‣ The Winners • Perceived winners include Endpoint Security (CRWD, S) - analysts point to AI agents greatly expanding number of endpoints that need protection; Network Security/Firewall (PANW, FTNT, CHKP) - seen as retaining moat that is difficult for competitors or AI to meaningfully replace; and Cloud Security/SASE (ZS, NET, NTSK) - set to benefit from integration of AI to eliminate blind spots, anticipate zero-day attacks and detect unusual traffic. Analyst consensus suggests safest bets are broad platforms, considered best positioned to benefit from vendor consolidation (CRWD, PANW). Identity & Access Management (OKTA) also considered to be a beneficiary, with agents likely requiring identities, permissions and access controls similar to employees, though this is not yet a proven revenue driver. ‣ The Losers • Vulnerability Management (RPD, TENB, QLYS) broadly seen as segment most at risk of AI disruption due to growing capabilities of frontier models to scan and detect exploits within code and networks. The recent high-profile exposure of PHP vulnerabilities, discovered through the use of tools including OpenAI's GPT-5.6 Sol, further intensified scrutiny of these names. ‣ YTD Underperformers • CHKP -21% has faced a slower-than-expected turnaround, failing to convert AI-related demand into headline growth, ceding ground to cloud-native rivals CRWD and PANW. • RPD -1% has suffered from declining ARR and aggressive competition in vulnerability management. • ZS -0% has struggled with decelerating growth forecasts, exec departures, and high AI-related capex. • DT +8% has underperformed on disappointing profit outlook, while its acquisition of Arize, an AI observability and evaluation platform, is expected to dilute margins through FY27. % price moves are year-to-date as of market close 4-Nov. ‣ Earnings Takeaways • Recent earnings calls suggest AI infrastructure growth is translating into concrete product bookings and new security demand across the group, with companies tying AI directly to revenue or platform expansion. FFIV said direct AI use case bookings more than doubled from H1 and sized its AI addressable market by 2030 at roughly $11B. CHKP highlighted strong demand for AI security, though AI data center security revenue expected to be incremental only starting 2027. DT has begun monetizing its AI capabilities and says AI is increasing telemetry volume and complexity, lifting platform consumption and making unified observability more important. $CRWD $PANW $FTNT $CHKP $ZS $NET $OKTA $RPD $TENB $QLYS $DT $FFIV $S $NTSK $ANT #Anthropic# #Cybersecurity# #AI# #AgenticAI# #AIMonetization# #EndpointSecurity# #CloudSecurity# #NetworkSecurity# #VulnerabilityManagement# #VendorConsolidation# #FinTwit# #TechStocks# #Earnings# #Tech# Gain immediate access to earnings insights with #StreetAccount#:

Research|Cybersecurity: When AI Becomes the Hacker; Anthropic and OpenAI's Call to Slow Down Favors Security Platforms and Identity Vendors AI safety gap: Dario Amodei’s September 12 essay and Sam Altman’s public agreement signal that AI model capability is moving faster than lab safety engineering. The July 2026 OpenAI-Hugging Face incident involved roughly 1,200 agents, more than 70,000 messages and files, 8–9 zero-days, and about one-third of Hugging Face infrastructure needing rebuild. Security demand shift: The report highlights five urgent needs: runtime monitoring, non-human identity governance, layered isolation, software supply chain and vulnerability management, and tamper-resistant logs. Anthropic’s own review of 141,006 evaluation runs found real-world spillover incidents, including a malicious PyPI package downloaded by 15 real systems within an hour and a model scanning roughly 9,000 online targets. Public market beneficiaries: Security platforms PANW, CRWD, and S are best positioned because AI-speed attacks require correlation across endpoint, cloud, identity, network, and logs. Identity vendors OKTA and SAIL benefit from agent identity governance, while NET, AKAM, and FSLY gain from demand for WAF, bot management, and API security. Investment implications: CrowdStrike reported record net new ARR of $333m in FY27Q2 and raised the midpoint of full-year net new ARR growth guidance to 34%, with CEO George Kurtz linking demand to Mythos and the OpenAI incident. Potential pressure points include FROG after Artifactory was named in the attack chain, free or bundled security tools, and standalone AI security startups facing platform consolidation. Detailed Report

The UK’s Information Commissioner’s Office has fined South Staffordshire Water and its parent company £963,900 for a major data breach that exposed personal and financial information belonging to 663,887 customers and employees. The incident started with a phishing attack in September 2020 that installed malware. It went undetected for 20 months, allowing attackers to gain domain administrator access and publish names, addresses, bank details, login credentials and other sensitive data on the dark web. The ICO cited key security failures including monitoring of only 5% of the IT environment, use of obsolete software such as Windows Server 2003, and inadequate patching and vulnerability management.

Weekly|Singapore Gathering, Malaga ECOC Happy Hour, AI Labs Keep Training, Optics Supply Tightens, AIDC Power, CRM Dreamforce, PLTR Sovereign AI, BE First, thank you to everyone who joined our gathering in Singapore this week. Registration and attendance were well beyond our expectations, and the atmosphere was amazing. Members of both our analyst and developer teams were present and had great conversations with investors and industry experts. Next, our analyst Fabian will attend ECOC in Malaga, Spain on Sep 22-23 and will host a happy hour there. Please RSVP if you are interested. Coming back to the market, the AI hardware selloff after Amodei’s call for restraint looked overdone to us, and the subsequent rebound suggests investors are reconsidering what a slowdown would actually mean. We spoke with people at three frontier labs: internal training and compute expansion are continuing, while additional safety checks are more likely to lengthen evaluation and public-release timelines. Safety risks deserve attention, but our base case remains limited disruption to near-term infrastructure demand. The enterprise side helps explain that view. In our 41-company Tokenomics panel, less than 5% of AI spending goes to the most advanced frontier models. Existing deployments can keep expanding as models become cheaper, more reliable, and easier to integrate. Greater scrutiny also creates work for security platforms and identity providers: enterprises need to monitor agents in production, govern what they can access, and retain logs they can trust. Drug discovery gives us another reason to be constructive on AI demand beyond the current enterprise rollout. The Morgan Stanley Healthcare Conference commentary points to early spending across the workflow: TMO is already seeing AI-driven high-throughput experiments lift reagent consumption, CRL expects more shots on goal to support preclinical demand, and DHR is seeing early lab-automation adoption. SDGR says pharma AI budgets are increasingly incremental, with BMS an early proof point. Morgan Stanley’s healthcare specialist Dan Bone also highlighted Novo Nordisk’s use of Claude Science for drug-discovery challenges, GenScript’s completion of Lilly’s TuneLab validation loop for wet-lab services, and $290mn of financing for Anew Labs, which spun out of ByteDance’s internal drug-discovery team in June. The rally in names such as TWST shows investors are taking notice. For us, the demand case is that more AI-generated candidates can support repeated rounds of modeling, screening and physical validation, expanding compute use alongside laboratory spending. It is early to size that compute opportunity, but the evidence of incremental budgets and reagent consumption makes drug discovery a credible additional source of AI demand. Physical delivery remains the harder constraint across the infrastructure names we cover. CIOE orders and production schedules extend into 2027, but 3nm DSPs, lasers, and PCBs determine which optics vendors can ship. On power, our follow-up channel work supports 2.4–3.0MW of turbine nameplate per MW of IT for the off-grid designs we examined; that ratio doesn’t apply to the entire turbine market. Oracle’s results reinforce the value of earlier energization for Bloom, with permitting, manufacturing, and service capacity still the key checks. This Week’s Reports AI labs keep training despite the pacing debate. Our interviews point to longer evaluation and release timelines with limited near-term disruption to training investment or enterprise inference demand. Optics: orders extend into 2027, and access to supply determines who delivers. Our conference and CIOE notes track higher laser pricing, tight 3nm DSP capacity and the NPO/CPO ramp, with leading vendors best placed to turn strong demand into shipments. AIDC: nameplate capacity needs to be translated into dependable IT power. We answer six investor questions with new channel checks and a rebuilt off-grid sizing framework, separating redundancy, site derating and project readiness from headline turbine supply. Cybersecurity: AI safety concerns strengthen the case for platform and identity security. Our note maps the gaps exposed by agent incidents to runtime monitoring, non-human identity governance, isolation, vulnerability management and tamper-resistant logs. Premium Report Snapshot A portion of our research is reserved for Premium subscribers and is not distributed via Substack. Below is a snapshot of what Premium subscribers received this week beyond the Substack feed. Research | CRM: Dreamforce Clarifies Claudeforce Monetization as Salesforce Cedes the UI Deep | PLTR: Sovereign AI Expands the Opportunity; Partner Delivery Sets the Long-Term Ceiling Research & Roadshow | BE: Oracle Reinforces the Time-to-Power Thesis; Delivery Remains the Test Weekly Expert Interviews Summary A snapshot of the expert interviews we conducted during the past week is below; full transcripts and takeaways are available on the FUNDA platform. Meta: Muse Monetization and Advertising Share (META, GOOGL) Enterprise AI: Token Budgets and Model Routing (GOOGL) Microsoft: Internal AI Spend and Usage Mix (MSFT) RoboSoft: Workflow Automation and AI Spend Growth LendingClub: Production AI and Model Routing (LC, AMZN) Delta: Vertical Power Supply Bottlenecks and 800V Architecture (FLEX, GOOGL, MPWR, META) Vicor: Vertical Power Economics at Very High Current (VICR, NVDA) Detailed Report