Trump says Iran war "close to over" amid hopes for more negotiations
Cloudflare (NYSE:NET) fell 13% Friday afternoon. Zscaler (NASDAQ:ZS) hit a fresh 52-week low at $120.77. CrowdStrike (NASDAQ:CRWD) shed another $32 a share on Thursday before bouncing overnight. The First Trust NASDAQ Cybersecurity ETF (NASDAQ:CIBR) is trading at $62.33, within pocket change of its 52-week low.
Here’s the thing. The market is dumping every name in the sector on the same headline — Anthropic’s new Claude Mythos Preview model — and treating the whole industry like it just got an extinction notice. That’s not what happened. What actually happened is that Anthropic split the sector into two camps on Tuesday, and Wall Street hasn’t read the memo.
The $100 Million Sorting Hat
On April 7, Anthropic announced Project Glasswing, a formal cybersecurity coalition built around Claude Mythos Preview — a model the company won’t release publicly because it has already found thousands of zero-day vulnerabilities, including a 27-year-old flaw in OpenBSD. Anthropic is putting $100 million in usage credits behind the effort and another $4 million into open-source security donations.
Here’s the part that matters for the trade. Anthropic named exactly 11 launch partners. That list: Amazon Web Services, Apple (NASDAQ:AAPL), Broadcom (NASDAQ:AVGO), Cisco (NASDAQ:CSCO), CrowdStrike, Google, JPMorgan Chase (NYSE:JPM), the Linux Foundation, Microsoft (NASDAQ:MSFT), NVIDIA (NASDAQ:NVDA), and Palo Alto Networks (NASDAQ:PANW).
Read that list again. CrowdStrike is on it. Palo Alto is on it. Cisco is on it. These are the defenders Anthropic is arming with the most capable cyber offense tool ever built — and they’re still getting dumped alongside the names Anthropic explicitly left out.
The excluded names are the trade on the other side of this. Cloudflare isn’t on the list. Zscaler isn’t on the list. Okta, SentinelOne, Fortinet, Qualys, Tenable — none of them. And in the case of Cloudflare, one report noted the company had actually benefited from its close Anthropic relationship last year, which makes the exclusion particularly stinging.
JPMorgan got this right within 24 hours. Analyst Brian Essex reiterated Overweight ratings on both CrowdStrike and Palo Alto on Wednesday morning, calling them "essential layers in the defensive stack" rather than disruption targets. JPMorgan’s 12-month targets: $475 on CRWD and $200 on PANW. Both imply meaningful upside from where these stocks closed Thursday, and the framing is what matters — security vendors inside Glasswing are partners, not roadkill.
RBC’s Matthew Hedberg piled on, calling the initiative "most positive" for CRWD and PANW and arguing it cements their position as sector consolidators. Benchmark’s Yi Fu Lee estimates Glasswing unlocks roughly $1 billion in new revenue across the two names as enterprises spend to bring shadow AI under control.
So why did both stocks get crushed on Thursday again? Fear is faster than analysis. And the market is pricing every cyber name off the same Anthropic headline. That’s the dislocation. Here’s how I’d play it.
The 4 Buys
1. CrowdStrike Holdings (CRWD) — $394.68. The flagship endpoint security platform, a Glasswing launch partner, and — not coincidentally — a company whose board just expanded the share buyback authorization by $500 million to $1.5 billion on April 6. Management is buying its own stock into the selloff. The consensus price target across 48 analysts sits at $505.93, roughly 28% above Thursday’s close, and the company carries a Strong Buy consensus. Shares are down about 17.6% year-to-date and trade 30% below the November 2025 high of $566.90. I’d be a buyer here. CEO George Kurtz told CNBC this week that AI-driven vulnerability discovery will actually drive up attack volume — which is bullish for the people selling the defense, not bearish.
2. Palo Alto Networks (PANW) — $155.28. JPMorgan’s top pick in the space after Glasswing. The stock is trading just $16 above its 52-week low of $139.57 and down 30% from the October all-time high of $223.61. Market cap is $127 billion with a $25 billion CyberArk acquisition closing and a Next-Gen Security ARR that grew 33% year-over-year to $6.3 billion last quarter. Palo Alto’s Chief Product Officer Lee Klarich, commenting on Glasswing, put it bluntly: "Now is the time to modernize cybersecurity stacks everywhere." Analyst consensus PT is $213.13, implying 37% upside from current levels.
3. Cisco Systems (CSCO) — $83.17. The stealth cyber play. Cisco is the only Glasswing launch partner trading in the green year-to-date, up 9.1% versus the S&P 500’s flat print, and it’s within 6% of its 52-week high of $88.19. This is the defensive pick — $2.60 annual dividend, a 0.74% yield that isn’t the reason to own it, and a security business that now includes the entire Splunk platform. Cisco’s networking AI + Splunk security data moat is exactly the kind of "full-stack" positioning Anthropic is partnering with. If you want cyber exposure without the single-name volatility, CSCO is the one I’d own.
4. First Trust NASDAQ Cybersecurity ETF (CIBR) — $62.33. For investors who don’t want to pick, this is the basket. What most people miss: CIBR’s top four holdings by weight — Palo Alto (8.80%), CrowdStrike (8.65%), Broadcom (8.28%), and Cisco (7.94%) — are all Glasswing launch partners. That’s roughly 34% of the fund’s weight in names that got Anthropic’s endorsement. The ETF is sitting at $62.33 with a 52-week low of $59.60, giving you roughly 4% of cushion from the floor. The expense ratio is 0.58%, AUM is $9.44 billion. Dollar-cost in, let the sector re-rate, and don’t watch the daily tape.
The 2 Dumps
1. Zscaler (ZS) — $122.40. Glasswing outsider. BTIG downgraded the stock from Buy to Neutral on Thursday after field checks came back cautious on six-to-twelve-month demand. The stock hit a fresh 52-week low of $120.77 Thursday, is down roughly 30% year-to-date, and trades at less than half its 52-week high of $336.99. Anthropic’s exclusion list is the kind of signal Wall Street takes seriously, and Zscaler being on it is not an accident. I’d sit this one out until a Glasswing partnership extension — or a different narrative — arrives.
2. Cloudflare (NET) — $167.21. Down 13% Friday afternoon, 34% below its October high of $253.30, and now wearing a CEO insider-selling problem. Matthew Prince sold $33.2 million in stock between April 6 and April 8 through a pre-planned 10b5-1 program, which is technically neutral but optically terrible into this selloff. Cloudflare was excluded from Glasswing despite its prior Anthropic relationship. The stock’s next earnings report hits April 30 and the AI-disruption narrative isn’t going away before then. Avoid for now.
The Bear Case — Because It Exists
To be clear: the fear isn’t made up. Mythos Preview is, by Anthropic’s own disclosure, capable enough that it "escaped its secured environment" during a sandbox evaluation and posted its exploit details to public sites. The same model handed to CRWD and PANW for defense could, in theory, eventually automate enough of the detection-and-response stack to pressure per-seat pricing models — the same "seat compression" thesis UBS used to downgrade ServiceNow this week.
I’m not dismissing that. But two things. First, enterprise security budgets don’t shrink when threats get worse, and Mythos is already making them worse — Treasury Secretary Scott Bessent and Fed Chair Jerome Powell held an emergency meeting with the CEOs of major Wall Street banks this week specifically to discuss Mythos’s systemic risk. That’s not a demand-destruction signal. That’s a "spend more, faster" signal. Second, the companies inside Glasswing get 6-to-12-month lead time on the same capabilities the attackers will eventually access. That’s the whole point of the $100 million in credits.
What to Watch
- April 16, 2026 — Taiwan Semiconductor (TSM) Q1 earnings, which will set the tone for the broader AI-compute backdrop that Glasswing depends on.
- April 30, 2026 — Cloudflare reports Q1. If NET’s AI-disruption fears are real, this is where they show up in the deferred revenue line.
- May 26, 2026 — Palo Alto Networks fiscal Q3 earnings, the first chance for CEO Nikesh Arora to quantify what Glasswing actually does to the Next-Gen Security ARR trajectory.
- June 9, 2026 — CrowdStrike Q1 earnings. The $1.5 billion buyback is active; watch for share count reduction commentary.
The cybersecurity selloff this week is the sector’s version of throwing out the good apples with the rotten ones. Project Glasswing is the sorting mechanism, and the market hasn’t finished sorting. That gap — between who’s actually inside Anthropic’s tent and who isn’t — is the trade.