Sector-wide selloff has created deep oversold conditions: ZS hit RSI 16 at its trough, PANW -18.6% in 30 days, CRWD -19.1% — but today's bounce (both now RSI ~45-50) suggests capitulation may be passing; OKTA remains the most damaged at -17.8% 30D with -8.5% vs SMA, while NET and S are relative strength leaders holding up best. Data center AI expansion thesis is intact — every new GPU server needs firewall, SASE, and endpoint protection.

ZS — RSI 48, $166.14, -4.1% vs SMA, -22.6% 30D

• Worst 30D performer in the scan. Trough RSI was 16 on Feb 23 — extreme capitulation. Today's +6.7% bounce from $155.70 (Feb 25) to $166.14 shows floor may be in.
• SASE/zero-trust leader with massive TAM. Every AI workload connecting across hybrid cloud needs ZS architecture.
• SMA at $173.19 = $7 overhead. Needs to clear that to confirm recovery.
• Entry zone: $155-168. Stop: $148. Target: SMA $173 = +4%, then prior range $185 = +11%.
• Risk: if enterprise security budgets freeze (macro), ZS is the most vulnerable high-multiple name.

PANW — RSI 45, $149.99, -6.2% vs SMA, -18.6% 30D

• Fell from $184 (Jan 26) to $140 trough (Feb 24) = -24% peak-to-trough. Today bounced to $150.
• Platformization strategy (consolidating security tools under one PANW umbrella) is a durable thesis with improving unit economics.
• Trough RSI was 25 (Feb 23) — meaningful oversold signal. RSI 45 today = partial recovery underway.
• Entry zone: $145-155. Stop: $138. Target: SMA $160 = +7%, then $175 = +17%.

CRWD — RSI 50, $378.66, -6.5% vs SMA, -19.1% 30D

• Fell from $468 (Jan 26) to $350 (Feb 23-24 range) = -25% peak-to-trough. Today's bounce to $378 is notable.
• Trough RSI was 29 (Feb 23) — oversold signal. Now at RSI 50 = recovered to neutral in a few days.
• Strong recovery speed vs peers suggests underlying demand thesis intact. CrowdStrike is the endpoint/cloud security leader.
• Note: CRWD still carries reputational risk from the 2024 outage, but it has been largely absorbed.
• Entry zone: $360-385. Stop: $342. Target: SMA $405 = +7%, then $430 = +14%.

OKTA — RSI 40, $75.05, -8.5% vs SMA, -17.8% 30D

• Worst SMA spread in the pure-play group at -8.5%. Identity/zero-trust leader but losing competitive ground to MSFT Entra.
• Fell from $91 (Jan 26) to $69.51 (Feb 23) = -24%. RSI trough was 26.
• RSI 40 today = recovery underway but slowest pace in the group. Still below SMA by $7.
• Thesis question: Is OKTA an acquisition target (by PANW or CRWD for identity integration) or does it stand alone? If standalone, thesis is shakier.
• Entry zone: $70-76. Stop: $67. Target: SMA $82 = +9%.

BUG ETF — RSI 46, $25.67, -4.5% vs SMA, -15.1% 30D

• Trough RSI was 26 (Feb 23-24). Broad cybersec ETF with tilts toward CRWD, PANW, NET.
• Accumulate as sector-wide vehicle — reduces single-name risk vs buying CRWD or ZS alone.

FTNT — RSI 50, $79.21, -2.6% vs SMA, -4.6% 30D

• Most resilient pure-play in the scan. Only -4.6% over 30 days = held up well while peers fell -18-23%.
• FTNT's legacy firewall business has been under pressure from SASE transition, but its integrated FortiOS platform across hardware + software gives stickiness.
• At RSI 50 and -2.6% vs SMA: neutral positioning. Not an urgent buy, not a sell. Clean hold or small add.

NET — RSI 56, $174.32, -2.1% vs SMA, -7.9% 30D

• Best RSI in the scan at 56. Closest to SMA at -2.1%. 7D hit was -8.9% but recovered. The go-to name for AI-era security infrastructure.
• Cloudflare is uniquely positioned: CDN + DDoS + Zero Trust Access + SASE + developer platform. One of few names that benefits from both AI workloads AND security spend.
• Not oversold, but the -7.9% 30D gives a decent entry. Hold existing; add cautiously on further dips.

S — RSI 55, $13.42, +0.2% vs SMA, -7.8% 30D

• Relative strength leader — at SMA, RSI 55, 7D barely positive. Small-cap pure-play on AI-native endpoint.
• Low price ($13) makes it volatile. But SentinelOne's AI-first architecture (Purple AI) differentiates it for next-gen threat detection.
• Watch: any revenue acceleration signal would be a strong catalyst.

HACK ETF — RSI 52, $73.69, -2.3% vs SMA, -8.1% 30D CIBR ETF — RSI 47, $63.78, -3.5% vs SMA, -11.5% 30D

• Sector ETFs recovering. HACK slightly stronger than CIBR. Both below SMA but trending upward.

Every GPU cluster being built for AI creates a measurably larger attack surface. This is the core thesis.

The math is simple:

• 1 MW of AI compute = ~2,000 servers
• 2,000 servers = 2,000+ endpoints needing protection (CRWD, S)
• 2,000 servers = high-bandwidth north-south traffic needing inspection (PANW, FTNT)
• AI services = API endpoints needing zero-trust access (ZS, OKTA)
• AI data = sensitive model weights + training data needing privileged access controls (CYBR)
• AI inference = global CDN traffic needing DDoS and edge security (NET)

The secular drivers:

1. Attack surface scales with compute — more servers, more network interfaces, more vulnerabilities. Security spend is non-discretionary once data centers are live.
2. AI workloads are multi-cloud by design — training might run on AWS, inference on Azure, data stored on GCP. SASE (ZS, PANW) is the architecture that secures this mesh without hairpinning traffic.
3. Nation-state threat escalation — AI research is a geopolitical asset. Data center security is now a national security priority in the US, EU, and key allies. Government contract tailwinds for CRWD, PANW.
4. Regulatory compliance cascade — AI Act (EU), CISA mandates (US), and insurance requirements are forcing enterprises to add zero-trust controls they previously deferred.
5. AI-native threat detection — Attackers are using AI to launch faster, more adaptive attacks. Security platforms need AI-native detection (SentinelOne's Purple AI, CrowdStrike's Charlotte AI). This creates an upgrade cycle from legacy tools to AI-native platforms.

Why this isn't priced in yet: The Feb selloff was indiscriminate — cybersec was sold with the broad tech market. But the fundamental case (data center spend → security spend) is a multi-year compounding trend. Gartner estimates security spend will grow 15%+ annually through 2028, driven largely by cloud and AI infrastructure expansion. The current pullback disconnects price from this fundamental trajectory.

Risk factors:

• Enterprise IT budget freezes (macro slowdown would hurt renewal rates)
• Platform consolidation: if PANW wins the platform war, standalone ZS/OKTA/S suffer
• Competitive pricing pressure as hyperscalers bundle security features natively

• What is the current status of CYBR (CyberArk)? M&A activity, earnings, or data feed error explains stale data — needs fresh fetch.
• Will PANW's platformization strategy compress margins in the near term before expanding them? This is the key PANW thesis risk.
• Can OKTA defend against MSFT Entra encroachment, or is it structurally disadvantaged? The identity market is winner-take-most.
• Has the ZS RSI 16 trough marked the bottom, or was the bounce a dead-cat? Needs volume and enterprise bookings data to confirm.
• Which cybersec names have the most direct hyperscaler partnerships for AI datacenter deployments? CRWD (AWS/Azure partnerships), PANW (Google Cloud), NET (all three) — worth deeper research.