Cybersecurity Platform Consolidation: AI-Native Partnerships Deepen Despite CrowdStrike's Continued Collapse

CrowdStrike's 73% monthly plunge has been offset by a wave of AI-security partnerships with Cerebras, STACKIT, and Schwarz Digits, while Palo Alto's acquisition of Embrace and Zscaler's zero-trust momentum suggest the consolidation thesis is narrowing toward platforms with ecosystem depth and AI-native detection capabilities rather than point solutions.

What changed

CrowdStrike has announced multiple strategic partnerships to accelerate its AI-native security posture, even as its stock price has collapsed. The company partnered with Cerebras Systems to power AI detection and response on Cerebras's inference hardware, with Jim Cramer publicly endorsing the stock as AI agents proliferate and create new security threats. CrowdStrike also expanded its partnership with STACKIT (a European sovereign-cloud provider) and signed a new agreement with Schwarz Digits, positioning itself as a platform for identity and threat detection across hybrid cloud environments. Separately, Palo Alto Networks acquired Embrace, a platform for observability and security monitoring, signaling continued M&A activity to consolidate the security stack.

Zscaler has shown renewed momentum, with its stock up 15% over the past 30 days (as of 2026-07-25), driven by recognition of its zero-trust infrastructure and new marketing leadership. Multiple analyst notes highlight Zscaler's "Zero Trust Everywhere" narrative gaining traction and potential upside of 33% based on discounted cash flow models, despite the stock's 48% annual decline.

Palantir, by contrast, faces near-term headwinds. The stock tumbled ahead of earnings on 2026-07-22, with investor concerns about valuation and competitive positioning. However, supporting evidence notes that Palantir is turning AI into mission-critical infrastructure and could be 23% below fair value on split valuation views, suggesting a disconnect between near-term sentiment and longer-term platform stickiness.

Why it matters

CrowdStrike's partnership wave strengthens the consolidation thesis despite stock collapse. The Cerebras partnership is material because it addresses a specific, high-impact use case: AI agents are becoming rogue security threats, and enterprises need real-time detection and response at scale. By embedding CrowdStrike's threat detection into Cerebras's fastest inference hardware, the company is positioning itself as the security layer for AI workloads—a critical gap in enterprise deployments. This is not a point solution; it is a platform play that locks in customers across identity, endpoint, and AI-agent monitoring. The STACKIT and Schwarz Digits deals similarly expand CrowdStrike's reach into sovereign-cloud and regulated environments, where platform consolidation is accelerating due to compliance and operational complexity. The stock's 73% monthly decline is severe, but the partnership velocity suggests that enterprise adoption and platform stickiness are intact; the valuation reset may be creating a buying opportunity for long-term thesis believers.

Palo Alto's Embrace acquisition reinforces the observability-plus-security consolidation narrative. Observability (monitoring application and infrastructure behavior) is increasingly inseparable from security detection. By acquiring Embrace, Palo Alto is consolidating the stack vertically—from network security (Palo Alto's core) through cloud workload protection (Prisma) to application observability (Embrace). This mirrors the broader thesis that monolithic, integrated platforms are winning over point solutions because they reduce operational friction and improve threat correlation. The deal also signals that Palo Alto sees observability as a critical moat against competitors like CrowdStrike and Zscaler, who are expanding horizontally into adjacent domains.

Zscaler's recovery and analyst re-rating validate zero-trust as a core platform. Zscaler's 15% monthly gain and analyst notes on "Zero Trust Everywhere" gaining steam suggest that the market is re-rating the company's core narrative. Zero-trust architecture—verifying every access request rather than trusting network perimeter—is becoming table-stakes for enterprises managing hybrid and multi-cloud environments. The 33% upside estimate based on DCF models indicates that even after a 48% annual decline, the market may be underpricing Zscaler's recurring revenue base and the structural shift toward zero-trust adoption. This validates the thesis that zero-trust infrastructure is a consolidation winner, even if individual stocks face cyclical headwinds.

Palantir's pre-earnings tumble reflects valuation anxiety, not platform weakness. The stock's decline ahead of earnings is concerning for near-term momentum, but the supporting evidence—that Palantir is turning AI into mission-critical infrastructure and could be 23% undervalued—suggests the market is conflating valuation reset with fundamental deterioration. The thesis hinges on platform stickiness and ecosystem lock-in, not near-term stock performance. Palantir's extension of its Foundry platform through 2035 with a major construction firm (mentioned in the parent thesis) underscores that enterprise customers are making multi-decade commitments to Palantir's data and AI infrastructure, which is the opposite of a point solution being displaced.

Opposing sources and risks

Palantir CEO Alex Karp has publicly criticized the AI industry as "irresponsibly oversold," questioning whether frontier AI labs are delivering value to enterprise clients. This contradicts the thesis's assumption that AI-native platforms are becoming mission-critical. Additionally, Palantir has faced regulatory setbacks in Europe—a Swiss courtroom loss and the French domestic intelligence agency replacing Palantir for a local rival—which weakens the narrative of platform consolidation in regulated markets. Michael Burry's short position on Palantir and his broader skepticism of the AI bubble also represent a credible opposing view that platform valuations may be disconnected from fundamental earnings power.

CrowdStrike's 73% monthly collapse, while partially explained by valuation reset, also reflects investor concern that the company's growth may be slowing or that competitive threats are intensifying. An Arete downgrade to Neutral from Buy in early July signals that not all analysts are convinced by the partnership narrative.

Zscaler's 48% annual decline and prior 53% one-year plunge suggest that even zero-trust infrastructure may not sustain premium valuations if growth stalls or if larger platforms (like Palo Alto or CrowdStrike) subsume zero-trust capabilities into their broader suites.

What to watch

CrowdStrike's next earnings report and AI-agent threat detection adoption metrics. The thesis depends on CrowdStrike's ability to monetize AI-agent security as a new revenue stream. Watch for guidance on AI-related bookings and customer expansion into the Cerebras partnership.

Palo Alto's Embrace integration and observability-plus-security revenue contribution. The acquisition's success hinges on whether Palo Alto can cross-sell Embrace to its existing customer base and whether observability becomes a material revenue driver within 12 months.

Zscaler's next earnings and zero-trust adoption acceleration. If Zscaler's revenue growth re-accelerates and the company demonstrates that zero-trust is becoming a platform (not just a network function), the stock's recovery will validate the consolidation thesis. Conversely, if growth remains flat or if larger competitors subsume zero-trust, Zscaler's upside will be capped.

Palantir's earnings and Foundry platform expansion into new verticals. The thesis depends on Palantir's ability to expand Foundry beyond government and defense into commercial enterprises. Watch for new customer wins and multi-year contract extensions that signal platform stickiness.

Regulatory and geopolitical headwinds for Palantir in Europe. The Swiss legal loss and French contract exit are material setbacks. Watch for whether Palantir can stabilize its European footprint or if further regulatory pressure emerges in the UK (NHS contract) or other regulated markets.

Related Arbora context

This update reinforces the thesis in concept-ai-software-platform-re-rating, which tracks whether AI-driven software platforms are commanding premium multiples based on workflow integration quality. CrowdStrike's partnerships with Cerebras and STACKIT exemplify the kind of ecosystem depth that justifies platform valuations, while Palantir's Foundry extension and Palo Alto's Embrace acquisition show that consolidation is happening through M&A and partnership, not organic development alone.

The update also connects to concept-ai-infrastructure-data-center, since CrowdStrike's partnership with Cerebras directly addresses the security layer for AI inference infrastructure. As data centers scale for AI workloads, the security platform that can monitor and respond to AI-agent threats becomes a critical component of the infrastructure stack.

Sources

This research update is for informational purposes and does not constitute financial advice.