Cybersecurity Is Not Optional Anymore — And the Market Top Is October 2027 at the Earliest

Why cybersecurity spending is no longer a choice

The standard argument for cybersecurity as an investment theme is that companies need to protect their data. This is true but incomplete. Cava's argument is more structural and more urgent.

When a company adopts AI — and at this point, every significant company is either adopting it or falling behind — it does not simply add capability. It adds complexity. Every new AI system, every data pipeline, every API integration, every automated decision process creates additional points of entry for attackers. The "attack surface" expands in direct proportion to AI adoption.

Simultaneously, attackers are using the same AI tools. Threat actors can now deploy multiChannel attacks at machine speed — simultaneously probing thousands of vulnerabilities, adapting in real time to defensive responses, and operating at a scale that no human security team can match manually. The asymmetry between attack capability and defensive capacity has shifted decisively.

The result: cybersecurity investment is no longer discretionary. It is a condition of operating. The CISO does not need to argue for budget — the board is asking why the budget is not larger. This is a structural demand driver, not a cyclical one.

The regulatory dimension amplifies it further, particularly in Europe. Frameworks like NIS2 and DORA are not suggestions — they impose mandatory security standards on critical infrastructure and financial entities, with liability attached. Non-compliance is not an option. This converts regulatory pressure directly into recurring revenue for cybersecurity vendors.

Not a bubble: a productivity miracle

Cava places cybersecurity within his broader thesis about the current market moment. The comparison he draws is to two historical inflection points: the commercial adoption of the Microsoft productivity suite in the 1990s, and the arrival of the internet for business use. In both cases, the productivity gains were real, the investment was massive, and the skeptics who called it a bubble missed the defining wealth-building period of their generation.

The current AI buildout is the third such moment. The hyperscalers are deploying capital at a scale that is measurably accelerating US economic growth. The productivity gains are already visible in corporate earnings — the 28% SP500 earnings growth reported for Q1 2026 did not come from accounting tricks. It came from companies doing more with the same or fewer people.

Cava's estimate for the duration of the current bull phase: approximately 18 more months of upside, with a market top no earlier than October 2027, and potentially extending to January 2028.

This is the most specific timeline he has provided. It is not a guarantee. It is an informed estimate based on the liquidity cycle, the AI investment horizon, and the historical patterns of productivity-driven market cycles.

The vehicle: CIBREU, not CIBR

For European investors seeking exposure to cybersecurity, Cava specifies the instrument: CIBREU, listed in London, denominated in dollars.

The distinction from the previously mentioned CIBR matters in practice. CIBREU offers higher liquidity and replicates the North American equivalent more precisely — which is the benchmark that matters when the leading cybersecurity companies (CrowdStrike, Palo Alto Networks, Zscaler, Fortinet) are all US-listed.

Current price: approximately 82. Cava's technical assessment: do not buy here.

Targets: 86, then 90. The upside from current levels is limited — approximately 5-10% to the first target. The risk-reward ratio at 82 does not meet the professional speculator's threshold.

Ideal entry zone: 72-75. This represents a meaningful pullback to the support level where the risk-reward ratio becomes at least 1:5 — risking one unit to make five. This is Cava's minimum acceptable ratio for a new position. At 72, the potential gain to the 90 target is roughly 25% against a risk to the next support level of approximately 5%.

The instruction: wait. The sector is in a clear uptrend. Waiting for the pullback does not mean missing the opportunity — it means entering it correctly.

CrowdStrike versus Zscaler: why the less-discussed name is more interesting

CrowdStrike (CRWD): A valid business with a clear uptrend. The problem is that everyone knows it. The mass of retail investors has entered, the position is crowded, and Cava estimates a 5-6% "barrida" is likely before the next meaningful move. Entering a crowded position before the sweep means being the weak hand that gets expelled.

Zscaler (ZS): More technically interesting. The stock recently completed what Cava identifies as a "false breakdown" — price was pushed below the key support at approximately $104, triggering stop-losses and expelling weak hands, before recovering. This is the classic sweep pattern. The weak hands have already been cleaned out. Current price: approximately $173.

The entry target for Zscaler: $130. A pullback to that level would represent a return to the prior range and would offer a risk-reward ratio consistent with professional entry criteria. At $130, the path to the prior high and beyond is clear, and the positions that needed to be closed have already been closed.

The patience required: Zscaler at $173 does not offer the entry. Zscaler at $130 does. The willingness to wait for that pullback — and to act on it when it arrives — is what separates the speculator from the investor chasing price.

---

Analysis based on a José Luis Cava video published May 28, 2026. For informational purposes only — not financial advice.