Cybersecurity — Cyber-geopolitical war premium is fading fast. ZS is in freefall (-37.7% in 3M, -58.4% from highs). The sector ETFs (HACK, BUG, CIBR) are all in strong-down. NET is the lone name holding structure above SMA200. CRWD and PANW stabilizing but not reversing. The thesis that geopolitical conflict would permanently re-rate cybersecurity spending is being stress-tested — valuations are compressing even as threat landscapes remain elevated.

Is the war premium fading?

The short answer: yes, structurally — but the picture is nuanced name-by-name.

The original thesis was that elevated geopolitical tension (Russia-Ukraine, Middle East, Taiwan risk) would drive permanent step-up in enterprise and government cybersecurity budgets, re-rating the sector. The data now says:

• ZS (-37.7% in 3M, -58.4% from 52wk high, RSI 37.3): War premium has entirely deflated. ZS is back near multi-year lows in some metrics. This is the clearest evidence of thesis decay — a zero-trust leader getting punished despite threat environment.
• BUG ETF (-18.1% in 3M, -22.1% vs SMA200): The pure-play cyber ETF is in its worst drawdown since 2022. Broad institutional exits.
• CIBR ETF (-12.5% in 3M, -13.1% vs SMA200): Confirms cross-ETF sector weakness — not just single names.
• HACK ETF (-7.5% in 3M, -9.7% vs SMA200): Most defensive of the three ETFs, holding slightly better.

What's still holding:

• NET (RSI 51.1, +3.8% in 3M, above SMA200): NOT purely cybersecurity — Cloudflare is edge infrastructure + networking + security combined. Its resilience reflects AI-adjacent network demand, not security spending specifically.
• FTNT (RSI 50.0, +2.5% in 3M): The relative outperformer in pure-play cyber. Network firewall/SASE model with more hardware-embedded revenue that's less subject to SaaS multiple compression.
• PANW (+6.7% in 30D, RSI 49.5): Short-term stabilization. Platformization narrative (consolidating security vendors) is the most credible remaining thesis.

Tier 1 — Relative Strength

• NET $204.56 — RSI 51.1, above SMA200, "up" trend. 30D +13%. Not a pure cybersec name but the strongest in the security-adjacent universe. This week's -11% is the key data point — is it distribution or a buyable dip?
• FTNT $81.36 — RSI 50, flat vs SMA50. 3M +2.5% is the best pure-cyber 3M performance in the scan. SASE/firewall model.
• PANW $160.16 — RSI 49.5, 30D +6.7%. Platform consolidation narrative intact. Death cross present but short-term stabilizing.

Tier 2 — Damaged but Watchable

• OKTA $78.42 — RSI 49.8, flat vs SMA20, 30D +6.0%. Identity security has some defensive characteristics. -38.5% from 52wk high suggests valuation has already compressed significantly.
• CRWD $389.02 — RSI 43.3, 30D +1.1%. The 2024 CrowdStrike outage narrative overhang is fading, but stock remains -31.4% from highs. Endpoint leader with sticky platform.
• CYBR $408.85 — RSI 40.9, data slightly stale (last confirmed date: Feb 13). PAM/identity privilege management is a defensively positioned niche. Worth monitoring once fresh data available.

Tier 3 — Active Destruction

• ZS $140.15 — RSI 37.3, -37.7% in 3M, -44.5% below SMA200, -58.4% from 52wk high. The worst performer in the scan by a wide margin. Zero-trust SASE narrative was richly valued; now being punished. -49.3 alpha vs SPY over 1yr.
• S (SentinelOne) $12.91 — RSI 42, -6.5% this week, -13.9% in 3M. Small-cap security burning cash, -39.7% from 52wk high.
• BUG/CIBR — ETFs in active decline, -18%/-12.5% in 3M.

• NET — The only clear entry candidate. Dip to SMA50 ($190.69) on current week's -11% move. Entry $190–200, stop below $178. 1yr alpha +81.2 — this has been the right name to hold.
• FTNT — Entry at current levels ($80–82) given RSI 50, flat SMA50. Stop below $76 (SMA200 is $85.38 — a break below SMA50 signals deterioration).
• PANW — Entry $155–160 on any further dip. 30D momentum positive, platform consolidation story intact.
• No entry on ZS — -44.5% below SMA200. Knife-catching risk too high. Needs RSI > 42 + SMA20 reclaim before reconsidering.

The cyber-geopolitical premium has largely deflated at the sector level, but the damage is not uniform. ZS is the clearest casualty — a stock that once traded on "defense spending is going up forever" is now being priced on fundamentals that don't justify its prior valuation. The ETFs tell the institutional story: money is leaving the sector broadly.

The surviving thesis for names like PANW, FTNT, and NET isn't "geopolitics" anymore — it's platform consolidation (PANW), operational necessity (FTNT), and AI-infrastructure positioning (NET). Investors have learned to separate the "cyber-spending is up" narrative (sector macro) from "this specific company has pricing power and sticky revenue" (bottom-up). The first thesis is fading; the second is still being stress-tested.

Watch NET's reaction to this week's -11% move as the single most important data point for the sector's near-term direction.

Data: 2026-03-31 pre-computed summaries. CYBR data as of 2026-02-13 (stale — verify before trading).