A few months ago, I could swear that, at least by reading the headlines, the Software-as-a-Service (SaaS) business model was on its way out of existence. The pattern was that Anthropic would write a blog post about a software-oriented topic and most companies within that topic would see an immediate decline in share price. Here are some examples:

Legal Plugins for Claude Cowork, February 3, 2026

Anthropic released a legal-specific plugin for its Claude Cowork agentic desktop application, designed to automate contract review, NDA triage, compliance tracking, and legal briefings. Thomson Reuters shares fell as much as 18% in a single session, while RELX (parent of LexisNexis) dropped 14%, Dutch legal software provider Wolters Kluwer declined 13% in Amsterdam trading, and the London Stock Exchange Group dropped more than 8%. RELX’s drop was its steepest single-day decline since 1988.¹

Claude Cowork Industry-Specific Plugin Suite, Early February 2026

Beyond legal, Anthropic launched industry plugins targeting sales, finance, data marketing, and legal, which sent software stocks into a broad spiral as investors feared the SaaS business model was at risk. Financial data providers bore the brunt, with FactSet Research Systems dropping 10%, while S&P Global, Moody’s, and Nasdaq all saw sharp declines.²

Claude Code Security, February 20, 2026

Anthropic unveiled a new feature called Claude Code Security built into Claude Code on the web, and cybersecurity stocks were immediately in the red. CrowdStrike and Cloudflare each slumped about 6%. The selling continued into Monday, with CrowdStrike and Zscaler dropping about 10% each, Netskope and Tenable plummeting about 12%, SailPoint falling 9%, and Okta declining more than 6%.³

COBOL Modernization Blog Post, February 23, 2026

Anthropic published a blog post announcing that Claude Code could automate modernization of COBOL, the decades-old programming language underpinning critical systems across banking, insurance, government, and aviation, and IBM shares plunged 13.1%, marking the stock’s largest single-day loss since October 2000. About $31 billion was cut from IBM’s market value. Accenture and Cognizant Technology Solutions also declined, as both companies generate significant revenue from legacy system modernization.⁴

Claude Opus 4.6 with Financial Research Capabilities, February 6, 2026

Anthropic debuted Claude Opus 4.6, an advanced model capable of conducting sophisticated professional tasks, including spinning up and coordinating teams of AI agents. The model’s research and analysis abilities spooked financial services investors, as Anthropic said Opus 4.6 excels at financial analysis including screening, due diligence data gathering, and market-intelligence synthesis. This triggered another wave of losses adding to the global selloff already underway from the Cowork plugin releases.⁵

Cybersecurity Software Stocks Have Accelerated

We have observed a notable acceleration in the performance of certain cybersecurity software stocks, such as those included within the WisdomTree Cybersecurity Fund (WCBR). This is clear in Figure 1a, where we can see the year-to-date period versus the S&P 500 Index, and then we see the 1-Year, 3-Year and 5-Year periods and how they look notably different.

Figure 1a: Acceleration of WCBR’s Performance in 2026

Figure 1b: Standardized Performance

Cybersecurity Software May Have Been Written Off Too Early

The Platform Beats the Point Solution

The thesis that a code-scanning AI would hollow out the cybersecurity sector rested on a category error. Enterprise cybersecurity is not primarily a code-scanning business. It is a platform business, built on telemetry at scale, real-time threat intelligence, and the organizational trust that comes from years of deployment inside a customer’s environment. CrowdStrike’s (7.30% weight) fiscal Q1 FY2027 results illustrated this as clearly as any single data point could, with record net new ARR of $256 million, up 32% year over year; record operating cash flow of $591 million; and a four-for-one stock split that management would not have announced unless it had strong conviction in the trajectory ahead.⁶ The company explicitly framed its Falcon platform as purpose-built for the agentic-AI era, not threatened by it, but positioned to secure it. That is a materially different story than the one February’s sellers were pricing.

Palo Alto Networks (6.23% weight) reinforced the same point from a different angle. Its fiscal Q3 showed accelerating organic bookings growth, with management noting that customers are actively turning to Palo Alto to secure AI deployments at scale.⁷ Platformization, the strategy of consolidating more of a customer’s security stack onto a single vendor, is working, and AI complexity is accelerating demand rather than obviating it. A company managing agentic workflows, autonomous pipelines, and AI-generated code needs more security surface covered, not less.

Identity Becomes the New Perimeter

If there is one subtheme that the AI era has most clearly amplified within cybersecurity, it is identity. Okta’s (5.68% weight) fiscal Q1 FY2027 results made the structural argument directly:

AI agents represent a new category of workforce identity, one that must be governed, credentialed, and monitored alongside human users.

Every autonomous agent acting on behalf of a business creates a new identity surface. Okta’s management tied this explicitly to future demand, and the market rewarded the clarity of the narrative alongside solid financial execution.

SailPoint (2.86% weight) extended that logic further, announcing the acquisition of Entro Security in late June specifically to address machine and agentic identity, as the secrets, tokens, and privileged access that autonomous systems accumulate and that legacy identity tools were never designed to manage. SailPoint’s investor day in June, combined with a strong Q1 print and a platform-access product launch, gave investors a coherent view of what identity security looks like in a world of non-human agents.⁸ The message across both companies was consistent: more AI means more identities, and more identities means more addressable market, not less.

Resilience Replaces Prevention as the Central Bet

A third theme visible across the portfolio is a quiet but meaningful shift in how cybersecurity value is being framed. Prevention, stopping attacks before they happen, was once the dominant pitch. Resilience, recovering from attacks faster than the attacker expected, is increasingly where premium multiples are being awarded.

Rubrik’s (5.02% weight) fiscal Q1 FY2027 results captured this cleanly, with subscription ARR growing 32% year over year to $1.57 billion, revenue rising 39%, and management raising all guided metrics for the full year.⁹ Rubrik operates at the intersection of data security, identity, and recovery, and the investor community has begun to price that positioning as structural rather than cyclical. Commvault (4.51% weight), similarly, has spent the May-to-July window leaning into AI-driven cyber resilience, specifically marketing its "Minutes to Recovery" capability for frontier-AI-driven attack simulations. Its Q4 results, 19% revenue growth, 22% total ARR growth, 28% subscription ARR growth, reflected a company that the market is re-reading as a resilience platform rather than a legacy backup vendor.¹⁰

The Broadening Is Real

One of the more important features of this performance cycle is that it has not been concentrated in one or two names. The acceleration appears to be broad-based across endpoint, identity, cloud, observability, and resilience, the kind of breadth that tends to indicate a sectoral re-rating rather than a momentum rotation into a handful of winners.

Fortinet (6.04% weight) reported revenue up 20% year over year with product revenue rising 41% and billings up 31%, then raised its 2026 revenue guidance.¹¹ Tenable (6.35% weight), whose February selloff was tied to Anthropic’s code-scanning announcement, has since paired improving operating leverage with new AI-governance products and a Gartner designation as the company to beat in AI-powered exposure assessment.¹² SentinelOne (5.58% weight) reported accelerating revenue growth (21% year over year) alongside accelerating ARR growth (23%), with emerging solutions now representing half of total company ARR, evidence of successful platform expansion beyond the endpoint beachhead where the company started.¹³

Varonis (4.46% weight), meanwhile, has been executing a SaaS transition that the market had been skeptical of, while simultaneously launching Varonis Atlas, an AI data-security product powered by its AllTrue.ai acquisition. SaaS ARR excluding conversions increased 29% year over year; total SaaS ARR reached $683 million, up 69%. The data-security angle, specifically, securing the data that AI systems ingest and generate, gives Varonis a product narrative that would not have existed in quite this form two years ago.¹⁴

What This Means for the Thesis

The February pattern was real. Anthropic’s announcements did move stocks, and in some cases by meaningful amounts. But the mechanism driving that volatility was investor sentiment, not fundamental disruption. A code-scanning capability does not replace an endpoint detection platform. A legal plugin does not eliminate decades of curated case law. A COBOL modernization tool does not overnight dismantle IBM’s integrated mainframe ecosystem, though it may compress timelines and pricing for some consulting engagements.

What the May-to-July earnings cycle has demonstrated is that the underlying demand for enterprise cybersecurity is not contracting. If anything, AI complexity is expanding the attack surface that security vendors are paid to manage, and the companies with the most durable platforms, the clearest identity and resilience positioning, and the strongest telemetry advantages are the ones showing the most compelling fundamental trajectories. The numbers, across nearly the full breadth of a cybersecurity portfolio, are making that case without ambiguity.

¹ Sources: complexdiscovery.com. (2026, February 4). Market reaction or overreaction? Anthropic's legal plugin and the facts so far. Complex Discovery; legal.io. (2026, March 6). Anthropic's Claude legal plugin: One month on, the market fallout and what it means for legal teams. Legal.io.

² Sources: Mills, M. (2026, February 7). Anthropic's new AI tools trigger software industry selloff. Axios; Fortune Staff. (2026, February 6). Anthropic's Claude triggered a trillion-dollar selloff. A new upgrade could make things worse. Fortune.

³ Sources: Bakolia, R. (2026, February 20). Cybersecurity stocks fall after Anthropic unveils Claude Code Security. Seeking Alpha; CNBC. (2026, February 23). Cybersecurity stocks drop for a second day as new Anthropic tool fuels AI disruption fears. CNBC.

⁴ Source: Roush, T. (2026, February 23). IBM shares plummet 13%: Worst day since 2000 after Anthropic launches programming AI tool. Forbes.

⁵ Source: Nolan, B. (2026, February 6). Anthropic's Claude triggered a trillion-dollar selloff. A new upgrade could make things worse. Fortune.

⁶ Source: CrowdStrike Holdings. (2026, June 3). CrowdStrike reports first quarter fiscal year 2027 financial results. CrowdStrike Investor Relations.

⁷ Source: Palo Alto Networks. (2026, June 2). Palo Alto Networks reports fiscal third quarter 2026 financial results. Palo Alto Networks Investor Relations.

⁸ Sources: SailPoint. (2026, June 9). SailPoint Q1 fiscal year 2027 financial results. SailPoint Investor Relations; SailPoint. (2026, June 16). SailPoint investor day 2026. SailPoint Investor Relations.

⁹ Source: Rubrik. (2026, June 3). Rubrik reports first quarter fiscal year 2027 financial results. Rubrik Investor Relations.

¹⁰ Sources: Commvault. (2026, May 7). Commvault announces fourth quarter fiscal 2026 financial results. Commvault Investor Relations; Commvault. (2026, July). Commvault investor relations news. Commvault Investor Relations.

¹¹ Source: Fortinet. (2026, May 7). Fortinet reports strong first quarter 2026 financial results. Fortinet Investor Relations.

¹² Sources: Tenable. (2026, May 6). Tenable announces first quarter 2026 financial results. Tenable Investor Relations; Tenable. (2026, July). Tenable investor relations news. Tenable Investor Relations.

¹³ Source: SentinelOne. (2026, June 4). SentinelOne announces first quarter fiscal year 2027 financial results. SentinelOne Investor Relations.

¹⁴ Source: Varonis Systems. (2026, May 7). Varonis announces first quarter 2026 financial results [Press release]. U.S. Securities and Exchange Commission.