Cybersecurity Scan
Cybersecurity Scan
Cybersecurity is a tale of three groups: one crown jewel (NET), one implosion (ZS/OKTA), and a recovering middle (CRWD, FTNT). Cloudflare is the standout with +71% 1-year and positive alpha — the only name in this scan actually beating the market. Zscaler and Okta are in freefall (-40% and -47% from 52-week highs). CrowdStrike recovered from its July 2024 outage saga but faces headwinds at RSI 59. Last scan was 16 days ago (2026-04-10).
Quick Snapshot
| Signal | Reading |
|---|---|
| Overall | 🟡 Diverging — cloud-native cybersec leaders vs legacy names breaking down |
| Crown jewel | NET $207, RSI 54, +71% 1Y — only name with positive 1Y alpha in scan |
| Implosion watch | ZS RSI 32, -42% 3M, -64% from 52wk high; OKTA -20% 7D, RSI 39 |
| Recovery play | CRWD +16% 30D, RSI 59 — post-outage rehabilitation ongoing |
| ETF picture | HACK/BUG/CIBR all RSI 54-57, weak-up — sector recovering but not leading |
Price Table
| Stock | Price | 7D | 30D | 3M | RSI | vs SMA200 | Trend | Status |
|---|---|---|---|---|---|---|---|---|
| NET | $207.07 | +3.2% | -5.0% | +9.4% | 54 | +2.3% | up | 🟢 Healthy |
| CRWD | $448.13 | +4.9% | +16.1% | -4.3% | 59 | -2.2% | weak-up | 🟢 Recovering |
| FTNT | $84.34 | +2.1% | +6.9% | +1.5% | 55 | +1.0% | up | 🟢 Healthy |
| HACK | $78.65 | -0.2% | +3.5% | -1.9% | 54 | -3.8% | weak-up | 🟡 Neutral |
| BUG | $26.49 | +0.2% | +5.5% | -12.4% | 54 | -14.9% | weak-up | 🟡 Neutral |
| CIBR | $67.24 | +0.7% | +6.3% | -6.6% | 57 | -5.5% | weak-up | 🟡 Neutral |
| PANW | $164.11 | -8.2% | -2.0% | -12.6% | 51 | -11.9% | weak-up | 🟡 Neutral |
| S | $12.79 | -11.0% | -10.5% | -10.1% | 45 | -20.1% | strong-down | 🔴 Breakdown |
| OKTA | $67.35 | -20.0% | -12.7% | -24.8% | 39 | -22.8% | strong-down | 🔴 Breakdown |
| CYBR | $408.85 | — | 0.0% | -11.5% | 33 | -6.2% | down | 🟡 Stale Data |
| ZS | $122.62 | -15.1% | -20.2% | -42.8% | 32 | -50.1% | strong-down | 🔴 Breakdown |
Tier Analysis
Tier 1 — Leaders
NET $207.07 | RSI 54 | +71% 1-Year | Positive Alpha Cloudflare is the only cybersec name posting meaningful positive alpha (+38% vs SPY over 1 year). The network edge story — combining security, CDN, and developer platform — is winning. RSI 54 is neutral, -5% 30D is a normal pullback in an uptrend. +229% over 3 years. The thesis is intact. This is the one cybersec name worth owning through macro uncertainty.
CRWD $448.13 | RSI 59 | +16% 30D | Post-Outage Recovery CrowdStrike is rehabilitating. +16% in 30 days, +238% over 3 years. The July 2024 global IT outage narrative is fading and the AI-native security platform is gaining share back. RSI 59 — not overbought but extended from the April flush. -2.2% below SMA200, -21% from 52-week high. The recovery is real but the entry here is not ideal.
FTNT $84.34 | RSI 55 | +1% 3M | Steady Fortinet is the quiet grinder. +1% 3M while peers swung violently. RSI 55, +1% above SMA200. The network security platform (firewalls, SASE) is less sexy but more operationally stable. 5-year alpha is +32% — the only other name besides NET with long-run positive alpha.
Tier 2 — ETFs (Diversified Exposure)
HACK $78.65 | RSI 54 | -3.8% below SMA200 Broadest cybersec ETF. -1.9% 3M suggests sector headwinds but not collapse. RSI 54 neutral. HACK is the safest way to hold the sector without single-name risk.
CIBR $67.24 | RSI 57 | -5.5% below SMA200 First Trust Cybersec ETF. +6.3% 30D recovery, RSI 57. More growthy composition than HACK. Still -6.6% 3M. Better relative performance than BUG.
BUG $26.49 | RSI 54 | -14.9% below SMA200 ETFMG Cybersecurity ETF. -12.4% 3M, -14.9% below SMA200 — the most distressed ETF in the group. Smaller/mid-cap weighting hurts in risk-off environments.
Tier 3 — Implosions
ZS $122.62 | RSI 32 | -50% below SMA200 | -64% from 52wk high Zscaler is in crisis. -42.8% in 3 months. -50.1% below SMA200. RSI 32 approaching oversold. The zero-trust network access story is structurally sound but the business model (consumption-based) is getting repriced in a belt-tightening IT environment. At RSI < 28 this becomes a speculative bounce candidate — but the structural breakdown is severe enough to demand patience.
OKTA $67.35 | RSI 39 | -20% 7D | -47% from 52wk high Okta printed a -20% week — something went wrong (earnings miss, guidance cut, or macro hit). RSI 39 approaching oversold but in freefall mode. -24.8% 3M, -22.8% below SMA200. The identity security platform thesis is intact but execution has been poor. This is a broken stock requiring a stabilization base before any entry.
S (SentinelOne) $12.79 | RSI 45 | -11% 7D | -40% from 52wk high SentinelOne continues to underperform. -11% in one week, -10% 3M. -20.1% below SMA200. The AI-native EDR platform is burning cash and faces CRWD recovery as a headwind. RSI 45 is not oversold. No thesis here.
CYBR $408.85 | RSI 33 | Stale Data (Feb 2026) CyberArk data is stale (last update Feb 2026). RSI 33 but cannot rely on this for entry/exit decisions. Skip until data refreshed.
Entry Zones
APPROACHING OVERSOLD (RSI 30-40) — Watch Closely
| Stock | Current | Zone | RSI | 30D Chg | Action | Notes |
|---|---|---|---|---|---|---|
| ZS | $122.62 | <$115 | 32 ↓ | -20.2% | 🔍 Watch | -50% below SMA200 = structural, not cyclical. Need RSI <28 + volume dry-up. |
| OKTA | $67.35 | <$62 | 39 ↓ | -12.7% | 🔍 Watch | Just had -20% week. Needs base formation (2-3 weeks) before entry interest. |
| CYBR | $408.85 | — | 33 | 0.0% | ❌ Skip | Stale data — cannot act on Feb 2026 RSI reading. |
Action Matrix
| Action | Stocks | Why |
|---|---|---|
| 🔒 HOLD | NET | +71% 1Y, positive alpha, only true cybersec leader |
| 🔒 HOLD | FTNT | Stable outperformer, 5Y positive alpha, hold through volatility |
| 📈 ACCUMULATE | HACK, CIBR | Diversified exposure; RSI 54-57; better risk/reward than individual broken names |
| 🔍 WATCH | CRWD | +16% 30D recovery real but RSI 59 extended — wait for pullback to RSI 48-52 |
| 🔍 WATCH | ZS | RSI 32 approaching oversold — need capitulation confirmation |
| ⚠️ AVOID | OKTA | In freefall, needs stabilization base — 2-3 weeks minimum |
| ⚠️ AVOID | S | Structurally breaking down, no catalyst |
| ❌ SKIP | CYBR | Stale data |
What Changed vs 2026-04-10
| Stock | Then (est) | Now | Move | Note |
|---|---|---|---|---|
| ZS | ~$145 | $122.62 | -20% 30D | Significant deterioration |
| OKTA | ~$77 | $67.35 | -20% 7D | Event-driven collapse |
| NET | ~$218 | $207.07 | -5% | Modest pullback in uptrend |
| CRWD | ~$386 | $448.13 | +16% | Post-outage recovery accelerating |
| FTNT | ~$79 | $84.34 | +6.9% | Quiet outperform |
| S | ~$14.4 | $12.79 | -11% 7D | Continued deterioration |
Key Discoveries
| Discovery | Implication |
|---|---|
| NET is the only cybersec name with positive 1-year alpha | Flight to quality within cybersec — platform plays win, point solutions lose |
| ZS -50% below SMA200 | This is structural repricing, not cyclical — zero-trust budgets are being cut |
| OKTA -20% in one week | Likely specific event (earnings). Check newsflow before any consideration. |
| CRWD recovery vs PANW divergence | CRWD regaining ground while PANW slides — platform war pendulum swinging back |
Open Questions
Related
10 eventsNo direct external sources are attached to this read.