Cybersecurity & Identity 2026–2029: Platforms, Identity, Data Resilience

Thesis: The Iran war turned cyber into kinetic — AI-powered Iranian attacks target critical infrastructure (Forbes, 21.08.2026), US water facilities were hacked (NPR, 12.08.2026), CSIS documents the escalation (06.08.2026). Security budgets are the last line item any CISO cuts, and the AI-agent wave creates a new attack surface: machine identities. Okta jumped 20 % after earnings because 'AI threat spikes demand for identity security' (CNBC, 26.08.2026). I own platform consolidators (CRWD, PANW with CyberArk, FTNT, NET), identity (OKTA, SAIL), data resilience (RBRK, VRNS) and cheaper challengers (S, TENB, QLYS, CHKP) where valuation gives room. Catalysts: Q3 earnings late October/November 2026, Palo Alto's CyberArk cross-sell numbers, federal infrastructure-hardening budgets, M&A (Varonis buyout chatter, TIKR 03.09.2026). Biggest risk: multiples — CrowdStrike, Palo Alto and Fortinet trade at or near 52-week highs after a 'cybersecurity rally' (Quiver, 10.08.2026), so a single guide-down can cost 25 % in a day (Seeking Alpha warned of a 30 % CrowdStrike drawdown, 17.08.2026); plus the Fed hiking into a bond rout compresses growth multiples. Sizing: no leader above 12 %, challengers 4–6 % each, keep 10 % cash for post-earnings dips. Exit: sell a name if net new ARR declines year-over-year for two quarters; trim leaders when forward sales multiple exceeds 20x.