Cybersecurity Platform Consolidation: CrowdStrike's AI Momentum Clashes With Zscaler's Structural Headwinds

CrowdStrike is doubling down on AI-native security with major enterprise wins and a stock split, while Palantir extends its platform stickiness through long-term contracts and strategic partnerships; however, Zscaler's 53% annual plunge and Coforge's zero-trust offering built on Zscaler's platform suggest the consolidation wave is fragmenting into winners (broad AI platforms) and losers (point solutions).

What changed

Since the last update on July 9, the cybersecurity consolidation thesis has crystallized around a divergence between platform breadth and point-solution vulnerability. CrowdStrike announced it is doubling down on AI security capabilities and executing a stock split, signaling confidence in its AI-native identity and response platform despite the broader market downturn. Palantir secured a multi-year contract extension with major Mexican insurer GNP Seguros and announced a strategic partnership with SAP integrator SNP to accelerate secure SAP transformations, reinforcing the stickiness of its Foundry platform in enterprise operations. Coforge launched SecureEdge2Cloud, an AI-powered zero-trust offering explicitly built on Zscaler's platform, demonstrating that Zscaler is becoming a foundational layer rather than a standalone platform. Zeta Global announced plans to integrate Palantir's technology as part of a broader AI infrastructure shift. Meanwhile, Zscaler itself has plunged 53% over the past year, raising questions about whether zero-trust infrastructure alone can sustain premium valuations in a consolidation-driven market.

Source update

The new evidence splits into three coherent narratives:

CrowdStrike's AI platform momentum: Grant Thornton selected CrowdStrike to power its global cybersecurity platform, and investors are reacting positively to the company's doubling down on AI security and stock split announcement. The sources note that CrowdStrike is seeing five-fold demand for its AI-driven identity and response capabilities, a material acceleration in enterprise adoption that extends beyond traditional endpoint protection into broader identity and threat response workflows.

Palantir's platform stickiness and geographic expansion: Palantir won its first Latin America commercial customer with GNP and Rackspace, and formed a strategic partnership with SNP to embed Foundry into SAP transformation workflows. The sources emphasize that Palantir is helping enterprises extend AI into operations, moving beyond analytics into operational decision-making. A separate source notes that Palantir's 104% U.S. revenue growth is the key metric to watch, suggesting that domestic expansion is accelerating even as the stock has faced headwinds.

Zscaler's structural challenge and platform-layer positioning: Zscaler plunged 53% in a year, and the sources question whether the stock should be held or sold. However, Coforge's launch of SecureEdge2Cloud—an AI-powered zero-trust offering built explicitly on Zscaler's platform—indicates that Zscaler is becoming a foundational infrastructure layer upon which other vendors build, rather than a standalone platform. This is a critical shift: Zscaler may be losing direct enterprise adoption but gaining embedded value as a platform component.

Why it matters

CrowdStrike's AI demand surge validates the platform consolidation thesis. The five-fold increase in demand for AI-driven identity and response capabilities shows that enterprises are consolidating their security stacks around vendors that can deliver AI-native threat detection and response, not just compliance-driven point solutions. Grant Thornton's selection of CrowdStrike to power its global platform—rather than building a best-of-breed mix—demonstrates that buyers are willing to standardize on a single vendor's AI capabilities if the breadth and quality justify it. The stock split signals management confidence that the AI narrative will sustain share price appreciation, a bet that the consolidation wave will reward platforms that can deliver measurable AI-driven security outcomes.

Palantir's contract extensions and SAP partnership embed the platform deeper into enterprise operations. The GNP Seguros contract extension and SNP partnership are not merely sales wins; they represent the hardening of Foundry as an operational backbone. When Palantir integrates into SAP transformation workflows, it moves from a data analytics tool into a mission-critical system that shapes how enterprises manage their most sensitive business processes. This increases switching costs and customer lifetime value, making Palantir's platform "sticky" in the sense that replacing it would require rearchitecting downstream workflows. The 104% U.S. revenue growth metric suggests that this stickiness is translating into accelerating commercial traction, even as the stock has been pressured by valuation concerns.

Zscaler's decline reveals the limits of point-solution dominance in a consolidation wave. Zscaler's 53% annual plunge is not merely a valuation reset; it signals that zero-trust infrastructure, while foundational, is insufficient to command premium multiples when broader platforms (CrowdStrike, Palantir) can integrate zero-trust as a component of a larger AI-driven security or operations suite. However, Coforge's SecureEdge2Cloud offering—built on Zscaler's platform—suggests that Zscaler is not being displaced but rather absorbed into a larger ecosystem. This is a subtle but important distinction: Zscaler may be losing direct enterprise mindshare and stock-market appeal, but its technology is becoming embedded in higher-level platforms. The consolidation wave is not eliminating Zscaler; it is repositioning it as a foundational layer rather than a standalone platform.

Opposing sources and risks

The thesis faces material headwinds from multiple sources on file. Arete downgraded CrowdStrike to Neutral from Buy in late June, setting a $730 price target that implies significant downside from the current $187.18 level. UBS argued that Palantir has lost its AI moat, suggesting that the company's competitive advantages are eroding as other vendors build AI capabilities. Michael Burry has taken put options against Palantir, signaling that a prominent contrarian investor sees downside risk. Palantir has faced regulatory setbacks in Europe, including a Swiss courtroom loss and a French intelligence agency contract replacement, which could limit the company's ability to expand its platform internationally. Neo4j's acquisition of GraphAware to launch an intelligence analysis alternative to Palantir Gotham suggests that open-source and alternative vendors are building competitive offerings.

These sources do not invalidate the consolidation thesis, but they raise the risk that the winners in this wave may not be the companies currently trading at premium valuations. CrowdStrike's stock has fallen 72.6% in the past 30 days, suggesting that the market is pricing in significant execution risk despite the AI demand surge. Palantir's stock is down 0.9% in the past month but has fallen 37% year-to-date, indicating that investors are skeptical of the company's ability to convert platform stickiness into sustainable margin expansion.

What to watch

CrowdStrike's next earnings report and AI adoption metrics. The key question is whether the five-fold demand for AI-driven identity and response capabilities translates into revenue growth and margin expansion. If CrowdStrike can demonstrate that AI-driven security is driving both new customer acquisition and expansion within existing accounts, the stock split and platform momentum narrative will gain credibility. Conversely, if the AI demand surge fails to offset competitive pressure or if customers are adopting AI capabilities without increasing their overall spend, the thesis will weaken.

Palantir's U.S. revenue growth sustainability and international contract wins. The 104% U.S. revenue growth is a striking metric, but it is unclear whether this pace is sustainable or whether it reflects a one-time surge in AI-driven demand. The company's ability to win and retain major contracts in Latin America and Europe will determine whether platform stickiness translates into geographic expansion. The Swiss courtroom loss and French contract replacement are warning signs that regulatory and political risks could limit international growth.

Zscaler's positioning as a foundational platform layer. The critical question is whether Zscaler can monetize its role as a foundational zero-trust layer within larger platforms like Coforge's SecureEdge2Cloud. If Zscaler can establish revenue-sharing or licensing agreements with vendors building on top of its platform, it could stabilize its business even as direct enterprise adoption declines. Conversely, if Zscaler's technology is commoditized or displaced by open-source alternatives, the company's long-term value will erode.

Enterprise AI adoption rates and consolidation velocity. The broader question is whether enterprises are consolidating their security stacks around AI-native platforms or whether they are adopting AI capabilities from multiple vendors. If consolidation is accelerating, CrowdStrike and Palantir should see accelerating revenue growth and margin expansion. If enterprises are adopting AI capabilities in a best-of-breed fashion, the thesis will weaken, and point solutions like Zscaler could stabilize.

Related Arbora context

This thesis intersects with several related Arbora theses:

  • AI infrastructure and data center build-out (concept-ai-infrastructure-data-center): The cybersecurity platform consolidation wave is driven by the same underlying AI infrastructure expansion that is driving data center construction. As enterprises build out AI compute capacity, they are consolidating their security stacks around platforms that can protect and govern AI workloads.

  • AI-driven software platform re-rating (concept-ai-software-platform-re-rating): The divergence between CrowdStrike's momentum and Zscaler's decline mirrors the broader re-rating of AI-driven software platforms. Platforms that can integrate AI into core workflows (CrowdStrike, Palantir) are commanding premium valuations, while point solutions are facing margin compression.

  • Salesforce AI agent platform expansion via M&A (concept-salesforce-ai-agent-platform-expansion-ma): Salesforce's acquisition of Fin for $3.6 billion to build out Agentforce mirrors the consolidation dynamic in cybersecurity. Vendors are using M&A to rapidly build platform breadth and AI capabilities rather than relying on organic development.

Sources

This research is for informational purposes only and should not be construed as financial advice.