What to Buy in the Software Sector? Top Picks at a Glance

The moats of software companies are being redefined by AI. Only those holding exclusive data, robust network ecosystems, or specialized vertical know-how possess deep, defensible barriers.

Looking at the rotation of software stocks yesterday, we observed certain common characteristics among the surging stocks. In summary, these types of software companies possess deeper economic moats:

1. Exclusive, non-public data: Think healthcare companies with proprietary patient records, or firms with exclusive copyrights (e.g., $Spotify Technology (SPOT.US)$, $Netflix (NFLX.US)$ ).

2. Network effects and ecosystems: Especially B2C platforms that require massive scale, like $Roblox (RBLX.US)$ in the gaming space.

3. Bridges to the physical world: Companies where the margin for error is razor-thin, such as industrial control software and manufacturing execution systems (e.g., $Rockwell Automation (ROK.US)$ , $Honeywell (HON.US)$ ).

4. Specialized cybersecurity firms with vertical know-how: For example, $Palo Alto Networks (PANW.US)$ and $CrowdStrike (CRWD.US)$ in the chip design software space.

Symbols

The cybersecurity sector is particularly worth highlighting. Here is the underlying logic:

1. Expanding Total Addressable Market (TAM)

Anthropic recently sent a crucial signal with its Project Glasswing in cybersecurity: the industry is shifting from labor-intensive security to an "AI vs. AI" era. In its latest September threat report, Anthropic noted that AI-assisted attacks are evolving into multi-agent automated workflows capable of reconnaissance, exploitation, and data exfiltration.

The logic behind future security budgets is changing. As AI tech continues to iterate, the barrier to entry and cost for cyberattacks are dropping significantly. This leads to more complex and frequent attacks, forcing enterprises to continuously increase their security spending. It also creates a rigid demand for automated detection, response, and protection systems.

Cybersecurity hardware & infrastructure market will also benefit. As PANW’s CEO pointed out, security equipment has an average lifespan of seven years. The industry spends $200–$300 billion annually, meaning there is naturally about $1 trillion in old security infrastructure sitting out there. Gear deployed seven to ten years ago simply cannot withstand today's AI attacks, which operate at "machine speed." Enterprises must completely rebuild their security architectures to prepare for future threats. This is the origin of the $1 trillion upgrade demand.

On top of that, over the next five years, $5 trillion will be poured into building AI data centers. These facilities will run tens of thousands of AI agents, and all this new infrastructure will require a completely ground-up security framework.

2. Shifts in Business Models

Project Glasswing essentially reduces the scarcity of vulnerability discovery. In the past, finding vulnerabilities relied heavily on senior security researchers, which was a core moat for security vendors. In the future, frontier large language models (LLMs) will be able to automatically hunt for bugs, making this capability far less scarce.

Anthropic provides the "AI brain," while PANW and CRWD own the real-world security sensors, data, and execution layers. Single-point security products are increasingly inadequate; Endpoint, Cloud, Network, Identity, and SOC must be unified.

3. A Note on Risks

Anthropic itself could become part of the security platform. It has already launched Claude Security, allowing enterprises to use Claude directly to scan code, find vulnerabilities, and suggest fixes.

Once AI can autonomously find, analyze, and fix vulnerabilities, traditional security vendors will likely see their core functions swallowed up by these models.

Overall, Glasswing proves that AI is pushing cyberattacks toward automation, which increases enterprise demand for security platforms. At the same time, AI is devaluing the scarcity of traditional security capabilities. Therefore, the biggest winners will be top-tier vendors with massive security datasets, comprehensive security platforms, and automated response capabilities. This actually reinforces the moats of platform companies like PANW and CRWD, while further squeezing the survival space for small-to-mid-sized, single-point security vendors.

$Microsoft (MSFT.US)$ $Alphabet-A (GOOGL.US)$ $Palantir (PLTR.US)$ $Shopify (SHOP.US)$ $Salesforce (CRM.US)$ $Atlassian (TEAM.US)$

2.5M Views