Cybersecurity stocks are back with a bang. These four are on Josh Brown’s list
(This is The Best Stocks in the Market , brought to you by Josh Brown and Sean Russo of Ritholtz Wealth Management.) Josh — Back in the saddle after a week at my big financial advisor festival, Future Proof. If you saw the pictures floating around the internet, you already know it was epic. While we were out there, Michael Batnick and I taped the newest episode of The Compound and Friends podcast on stage, with two of my pals (and CNBC regulars) Dan Ives and Tom Lee. The conversation turned to fears about AI (is anyone talking about anything else?), and we went deep. As of this writing, over 150,000 people have watched it on YouTube , and approximately the same amount of people have downloaded it on Apple and Spotify. In light of that conversation, Sean and I are giving you an update on Amazon (AMZN) . Then we’re going to blaze through the entire universe of cyber plays — a theme we have been on since we started writing this column for you. Cybersecurity was supposed to be another category that AI disrupted. Instead, it became the category AI made more necessary. The threat surface is expanding faster than any team of human analysts can cover, and the companies selling automated defense are having their best years ever. This week’s sector spotlight covers Amazon and five cybersecurity names on The Best Stocks in the Market list, plus a look at two names that aren’t on it yet and why. The charts tell the story as well as the fundamentals do. CrowdStrike is up more than 100% this year and still looks constructive. Fortinet launched one of the cleanest uptrends in the market after a May earnings gap. Cloudflare just hit a new high. Palo Alto Networks topped near $400 and is digesting. Amazon round-tripped its entire post-earnings move and is asking for patience. And Zscaler , left for dead most of the year, is quietly doing something worth paying attention to. This is a big one, so buckle up and prepare to learn. Sean, take it away. As of Sept 21, there are 175 names on The Best Stocks in the Market list. Top sector ranking: Top industries: Top 5 best stocks by relative strength: Sector spotlight: AMZN + Cybersecurity Amazon.com, Inc. (AMZN): Sean — We last wrote about Amazon on July 31, 2025 . That afternoon, the company reported Q2 2025 earnings — AWS was growing 17.5% annually and investors were worried it was losing the AI race. Since that piece, AMZN has returned 8.2% against 22% for the S & P 500 , and the worries still remain, with added gripes about capex spending. The fundamentals continue to impress at Amazon, however. AWS has now accelerated five quarters in a row, growing 36.7% year over year in Q2 2026 — the fastest rate in 18 quarters. Investors are debating whether the $220 billion Amazon is spending this year ever earns a return. This will be the story for the rest of 2026 and into 2027. Q2 was the first $200 billion non-holiday quarter in company history – net sales of $200.6 billion, up 20%, with North America up 16%, International up 15% and AWS up 37% to $42.2 billion. AWS is now 21% of revenue and 60% of operating income. Those numbers were 17% and 59% when we wrote this up last year, at a 39% segment margin, up 650 basis points year over year. Backlog stands at $496 billion, growing triple digits, and AWS’s AI business and custom chips business each crossed a $25 billion annual run rate. Of the $62.6 billion in net income and $5.75 in EPS, $53.4 billion was non-operating other income, which was primarily the markup on Amazon’s Anthropic stake. That’s two-thirds of pre-tax income, which is why the S & P 500 (and tech sector) earnings growth was so high on a non-adjusted basis this quarter. Investors are right to question the spending. The bill is adding up — capex was $53.1 billion in Q2, the 2026 plan went to roughly $220 billion from $200 billion on memory prices alone versus about $128 billion in 2025. Because of this monster investment, trailing free cash flow swung to a $7.6 billion outflow from an $18.2 billion inflow as property and equipment purchases rose $66.1 billion. Amazon raised $81.9 billion of long-term debt over four quarters against $746 million the year prior. Return on invested capital sits near 12% versus a cost of capital around 11%, per S & P Global. These are big numbers, growing fast on the liability side of the balance sheet and on the expense side of the income statement. It is crucial for Amazon and the other hyperscalers to show evidence of payoff. Looking forward, Amazon guided Q3 net sales to $197 billion to $202 billion, or 9% to 12% growth, and operating income to $22.5 billion to $26.5 billion against $17.4 billion in Q3 2025. Amazon next reports October 29, and management has already said 2026 and 2027 compute capacity won’t meet demand, which could be good news for the cloud computing business. Josh — Amazon spent most of the summer under pressure, sliding from the mid-$280s down to the $232 area before the July 30 earnings report gave buyers a reason to move. The stock gapped hard on that print, opening above $271 from a $235 close the prior day, and briefly tagged $284 a few sessions later. Since then, price has completely round-tripped the move, giving back the entire post-earnings gap and settling back into the mid-$250s. The 50-day at $256 is now acting as resistance. The 200-day is at $240 and rising slowly beneath it. RSI is 48. That is the momentum reading of a chart going nowhere. Buyers and sellers are in a stalemate. Price is stuck in the middle of a wide range with no conviction from either side. Nothing in this indicator suggests urgency. Traders should avoid this one until price reclaims the $270s, where the post-earnings gap began to fail. Until then there is nothing to trade. Investors who are still hanging in can anchor to the 200-day at $240 as the line that keeps the longer-term thesis intact. Might want to grab a novel to read or something. Maybe find a copy of Ivanhoe and just go to town. This thing isn’t worth staring at. CrowdStrike Holdings, Inc. (CRWD): Sean — CrowdStrike has been a massive win this year. The stock is up 104% this year, and that’s after a 25% drawdown in February when consensus was that Claude could vibe-code cybersecurity out of existence. We last gave you all an update in May of this year. We wrote about CrowdStrike on 5/18, and the stock has returned 58.8% since, against 13.8% for the iShares Expanded Tech-Software ETF (IGV) and 3.5% for the S & P 500. It’s worth remembering the setup back then. Software was the market’s problem child, with IGV down 12% on the year on fears that AI would commoditize the whole category. Security turned out to be the exception and the narrative as a whole has mostly been uprooted. CrowdStrike also completed a 4-for-1 stock split on July 1, so the price on your screen looks a lot different than it did in May. The most recent bounce came last week, when CRWD jumped about 14% on Sept. 14 as investors rotated into cybersecurity on escalating AI risk headlines, and CEO George Kurtz told CNBC that on AI-enabled attacks, ” the genie’s out of the bottle .” Fundamentals have followed the price, perfect for how we view the world here at The Best Stocks column. Second-quarter revenue grew 26% to $1.47 billion, net new annual recurring revenue was a record $333 million (up 51% year over year), and ending ARR hit $5.84 billion, up 25%. Falcon Flex, the consumption-based contract structure Kurtz calls the “commercial harness,” now accounts for $2.29 billion in ARR, up 101%. Management raised full-year net new ARR guidance to $1.35 billion at the midpoint, $116 million above the initial outlook, and guided free cash flow margin to at least 30% for the year. The AI piece is where Kurtz has focused. CrowdStrike launched SafeMind, a pair of cyber-specific frontier models built with Nvidia that run an automated attack-and-patch loop against a digital “twin” of a customer’s environment. Kurtz was blunt about the design goal, saying the models are built “to solve the world’s most complex security problems.” Notably, SafeMind will be sold with token packs, a new monetization stream layered on top of Flex, and management laid out a path to $20 billion in ARR by fiscal 2035. Now here’s Josh on what the technicals look like. Josh — Fair warning that I am not trading this stock. I bought it shortly after the IPO five years ago and I am staying put, regardless of what happens with the chart. But this is the risk management section so for those with less conviction who still want to play, pay attention: CrowdStrike is one of the cleanest charts in the sector. This is a classic stair-step uptrend, the kind the poets of Ancient Greece composed odes to and bards of the north told tales about around the fire in days of old. The stock came into August earnings with serious momentum already built up, having broken out of the post-outage lows near $87 and run to a new high around $225. Then the Aug. 26 earnings print dropped and the stock gapped from $189 to open above $228, confirming that the fundamental reset Sean described above was real and buyers were not waiting around. Price pulled back briefly to the $203 to $215 range, which acted as the post-earnings base, and then extended again through September to current price of $238. The 50-day is at $207 and the 200-day is at $147, both well below price and trending sharply higher. RSI is 60. Constructive but not stretched. This reading tells you the stock has had a meaningful move without becoming extended in the way that precedes sharp corrections. There is room for this chart to run. Momentum is with the bulls. Traders can use the $215 to $220 zone as the reference. That was the consolidation base that formed right after earnings before the stock extended. A close back below $215 means the post-earnings base has broken down and the August gap is starting to get revisited. Use the close, not intraday dips. Investors can look to the 50-day at $207, which is now rising fast. Below $207 on a closing basis and the post-earnings structure has unraveled. I’ve been pounding the table on CRWD on television pretty much every week for what seems like a lifetime. It’s a core holding for me personally. So what we’re talking about here is how to trade it for those with shorter time horizons. Nothing in this chart is saying sell – not the trend, not the momentum indicator, not the volume or the behavior of the buyers and sellers. Palo Alto Networks, Inc. (PANW): Josh — Same thesis, not as good of a chart. Not bad, just not CRWD. That could change. Palo Alto Networks ran hard starting in early May. The stock on May 7 gapped the stock from the $184 area up through $207 in a single session, and it did not stop there. Buyers kept layering in through the rest of the month and the stock pushed all the way to $300 and beyond by early June. There was a digestion phase through the summer, then another leg higher that carried it to just under $400 before the sellers showed up. Since that peak the stock has been making lower highs, and it now sits at $364, below a declining short-term trend. The 200-day is at $241 and is not a meaningful reference at these levels given how far the stock has traveled. RSI of 53 is totally mid. Consistent with a stock that has been grinding lower off its highs without momentum in either direction. Not oversold, not set up for a snap-back. Just drifting. Traders can use the $320 to $330 zone as their reference. Price has tested that area multiple times and buyers have shown up there consistently. A close below $320 and the support that has held this stock up is gone. Investors can use the same zone as the anchor on a weekly closing basis. Below it and the whole structure from the summer lows is broken. Fortinet, Inc. (FTNT): Josh — Don’t fall in love with this one, she’ll break your heart eventually. But for now, it’s a hottie. I like the set-up. If I wasn’t married to Crowd, I might even bite. Fortinet was dead money for most of the past year before May earnings gapped it from $90 to $108 and launched one of the cleanest uptrends in the sector. Higher highs, higher lows, with the 50-day acting as the floor on every pullback. The stock sits at $170 now, consolidating in the $150 to $175 range it has been carving out since July. The 50-day is at $160 and rising. The 200-day is at $114 and irrelevant. RSI is 58. Healthy. The indicator has reset multiple times during this consolidation without getting oversold. Sellers are not pressing. Buyers keep showing up. The $150 area is the line for everyone. That is where the consolidation range has found its floor repeatedly, and the 50-day is rising to meet it. Traders and investors alike use a close below $150 as the signal that the post-earnings uptrend is done. Back to my trust issues … it’s worth pointing out that Fortinet has a history of earnings disappointments and spectacular post-report blow-ups, so keep the leash short and respect the level. We don’t love these things, they’re just pieces of paper. Cloudflare, Inc. (NET): Josh — Cloudflare is not a pure cybersecurity play but it belongs in this conversation. The company runs a global network that sits between the internet and its customers, handling DDoS protection, zero trust security, and AI workload delivery. The stock hit a new high last week and a potential breakout is in progress. That is the headline. The stock spent the first half of the year working through a volatile base, buyers and sellers fighting it out in the $163 to $260 range. Since May the buyers have been winning. The rising 50-day has acted as support on every meaningful pullback since June, and the 200-day at $228 is beginning to curl upward after a long flat stretch. When that line starts rising it tends to bring a new group of investors in. RSI is 58. Not even close to overbought. There is plenty of room for this move to extend before momentum becomes a concern. Buyers are in control and the indicator has room to run. Traders use the 50-day as the floor. It has held on every dip worth buying since June. A close below it means the breakout has failed and you exit. Investors anchor to the $260 to $270 zone, which was the base this whole move launched from. A weekly close back into that range and the thesis has broken down. Not on The Best Stocks in the Market Zscaler, Inc. (ZS): Sean — It is also worth noting that we have a couple of cybersecurity stocks not making the list. ZS is a big one that has not proven worthy of our list just yet. You can see the striking contrast between this chart and the ones we have shown you above. The stock was below its 200 day moving average last week and the normal momentum metrics like % below 52 week highs and trailing returns are all still in the red. Josh — The rap on this stock is that it’s “the bad one” because of a massive de-rating when The Street decided they would be competing with too many players and growth would slow materially. As a result, Zscaler spent most of the past year in a steady downtrend, cut in half from its October highs. But! Sometimes the pessimism on a name gets overdone and the stock price recovery begins in advance of a narrative change. Many of us would say the narrative change happens as a consequence of the stock price recovery, but we can debate that another time. ZS just crossed back above its 200-day for the first time all year, the 50-day is crossing above the 200-day in what looks like a golden cross, and RSI is at 63, the highest reading in twelve months. It also trades at a meaningful discount to CrowdStrike, Palo Alto Networks, and Fortinet, a valuation gap that existed for a reason but may start to close if this chart continues to improve. This is not on the list. But the chart is doing something it has not done in a long time, and the relative cheapness makes it worth watching if the breakout holds. SentinelOne, Inc. (S): Sean — SentinelOne is also not on the list, the chart looks decent but its market cap is far below our threshold of $25B or above. The reason we have a market cap limit is that the momentum factor is empirically better for larger stocks than smaller ones. The reason being – larger stocks have more eyes on them, the crowd of possible buyers is much broader. There are more investors, analysts, retail buyers, institutional teams, etc looking at and analyzing large stocks. Smaller stocks have a smaller crowd of possible investors, so the “wisdom” of this crowd is less robust than a larger stock with a ton of market participants. Josh — Two reasons I won’t buy this, even if and when it finally makes The Best Stocks in the Market list. One is that they took over the old Sears ticker symbol. Absolute kiss of death. Bad stock market karma. Two is that I used to make this mistake as a rookie stockbroker – seeing a big stock in a sector take off and trying to find the smaller one that could follow it with even higher beta. It can work, but it usually won’t. More often than not, you’ll look like an idiot for not just buying the A list name. The chart is actually decent. SentinelOne bottomed in early spring, crossed back above both moving averages, and ran from the low teens to nearly $30 before pulling back to where it sits now at $22. The 50-day at $20 is rising and has been support on the recent dip. RSI at 58 is constructive. The chart is doing the right things. Just not enough of the right things to overcome the two reasons above. Don’t drink and drive. Don’t buy a whole life policy. Don’t trade the ninth best stock in a sector. Man’s gotta live by a code, and this is mine. DISCLOSURES: (None) All opinions expressed by the CNBC Pro contributors are solely their opinions and do not reflect the opinions of CNBC, or its parent company or affiliates, and may have been previously disseminated by them on television, radio, internet or another medium. THIS CONTENT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY AND DOES NOT CONSTITUTE FINANCIAL, INVESTMENT, TAX OR LEGAL ADVICE OR A RECOMMENDATION TO BUY ANY SECURITY OR OTHER FINANCIAL ASSET. THE CONTENT IS GENERAL IN NATURE AND DOES NOT REFLECT ANY INDIVIDUAL’S UNIQUE PERSONAL CIRCUMSTANCES. THE ABOVE CONTENT MIGHT NOT BE SUITABLE FOR YOUR PARTICULAR CIRCUMSTANCES. BEFORE MAKING ANY FINANCIAL DECISIONS, YOU SHOULD STRONGLY CONSIDER SEEKING ADVICE FROM YOUR OWN FINANCIAL OR INVESTMENT ADVISOR. Click here for the full disclaimer.
