ETF News

Artificial intelligence is rapidly embedding itself across the full software lifecycle — from writing and testing code to monitoring infrastructure and repairing vulnerabilities. Security sits directly in the middle of this transition, and markets are beginning to price in the structural implications.

For decades, cybersecurity spending focused heavily on detecting threats, monitoring systems, and manually patching weaknesses after discovery. AI-driven tooling is now moving those functions earlier in the development process — and in some cases, automating them entirely.

That shift became tangible when Anthropic introduced Claude Code Security, a system designed to analyze software internally, detect complex vulnerabilities, and propose targeted fixes. Rather than relying on known threat signatures, it evaluates how code behaves — identifying logical weaknesses that traditional monitoring tools may never see. If AI systems increasingly handle vulnerability discovery and remediation, the distribution of value inside the cybersecurity stack could change significantly.

AI Is Expanding Security Demand — And Rewriting Its Economics

Artificial intelligence is not simply reducing cybersecurity needs. In many ways, it is increasing them. Defensive systems can scan codebases faster and identify more subtle weaknesses, but automated tools also lower the technical barrier for attackers and accelerate how quickly vulnerabilities can be weaponized.

This creates a paradoxical environment: total cybersecurity spending may continue to rise, yet its composition could shift meaningfully. Platforms built around continuous monitoring, manual review, or reactive threat detection may face pressure if preventative AI systems capture more of the workflow upstream. Investors are less concerned with whether security budgets grow than with where those budgets flow.

This is not the first such repricing. Weeks earlier, enterprise SaaS companies sold off sharply following the release of Claude Cowork, which demonstrated how agent-based systems could replicate knowledge-work functions traditionally delivered through subscription software. Cybersecurity is now experiencing a similar reassessment.

Equity Markets React

The release of Claude Code Security triggered an immediate repricing among listed cybersecurity firms. CrowdStrike declined 6.8%, Okta dropped 9.2%, Cloudflare fell 6.7%, and SailPoint lost 9.1%. The reaction reflects a shift in expectations rather than immediate operational disruption — investors evaluating what happens if vulnerability discovery becomes automated and remediation becomes embedded in development pipelines rather than managed through external security layers.

Canadian Cybersecurity ETFs Feel the Pressure

The repricing is clearly visible in Canadian-listed cybersecurity ETFs. Across the segment, assets total roughly $278 million. The group declined 5.82% over the past week and is down 8.67% year to date, with cumulative outflows of approximately $69,860 in 2026.

The Evolve Cyber Security Index ETF (CYBR), the largest dedicated fund at $140.4 million in assets, fell 7.22% over the week with over $5.3 million in redemptions. The First Trust Nasdaq Cybersecurity ETF (CIBR) is down 10.85% year to date but has attracted $5.36 million in net inflows, suggesting selective repositioning. The iShares Cybersecurity and Tech Index ETF (XHAK) has declined 10.17% year to date.

The broader Canadian Information Technology ETF category, by contrast, posted positive weekly performance and strong inflows — indicating investors may be rotating within technology rather than exiting it altogether. The picture is one of reassessment, not abandonment.

Group Data

Fund Data

Please note this article is for information purposes only and does not in any way constitute investment advice. It is essential that you seek advice from a registered financial professional prior to making any investment decision.