Overall software crowding has fallen to historically low levels, but popular cloud consumption and cybersecurity trades still warrant caution against de-crowding risk
AI summary card
Overall software crowding has fallen to historically low levels, but popular cloud consumption and cybersecurity trades still warrant caution against de-crowding risk
Bernstein believes the software sector has shifted from crowded to under-owned, increasing selective opportunities, but highly crowded names such as DDOG, PANW, TWLO, ORCL, and OKTA face greater drawdown risk when market pressure rises or growth expectations cool.
- Current crowding in the software sector is significantly below its historical average over the past 25 years, with enterprise application software most affected by the “software-as-a-service doomsday” narrative and concerns over GenAI substitution.
- Within the coverage universe, DDOG has the highest crowding, followed by PANW, TWLO, ORCL, and OKTA; CRM, GTLB, HUBS, and ADBE are at the least crowded end.
- Highly crowded trades typically underperform during periods of market stress: in months when the VIX is above average, the most crowded stocks lag the least crowded stocks by an average of 40 basis points per month.
- The first half of 2026 was a clear exception, with highly crowded stocks outperforming less crowded stocks by 12.8% in the overall market and 50.9% in the TMT sector, mainly driven by strength in semiconductors and hardware.
- The report recommends reducing portfolio tail risk through a balance of highly crowded and less crowded holdings, rather than making directional investments based solely on crowding.
Report interpretation
Overview
This report updates the crowding status of global software, U.S. small- and mid-cap software, and cybersecurity companies, and discusses its implications for stock selection, portfolio construction, and risk management. Since 2026, market concerns about GenAI disrupting enterprise software, pressure on seats and pricing, and saturation in the cloud market have driven a notable decline in application software positioning and valuations; cloud consumption infrastructure and cybersecurity have remained in strong favor due to cloud workloads, AI-native customers, and AI-related security demand. Bernstein believes overall software is no longer crowded and offers investment opportunities, but distinctions must be made within the sector among fundamentals, valuations, and positioning structures.
Core views
First, overall software crowding is far below its historical average, and an under-owned status provides room for valuation repair after fundamental improvement. Second, the structure of crowding has diverged significantly: consumption-oriented software such as DDOG and TWLO, as well as most cybersecurity companies, are favored, while seat-based application software such as ADBE, HUBS, GTLB, and CRM remains out of favor. Third, high crowding does not equate to poor fundamentals, but when high valuations, concentrated positioning, and excessive growth expectations coincide, exit liquidity can amplify drawdowns. Fourth, although ORCL and MSFT remain relatively crowded, their crowding has declined from historical levels, and the report recognizes their cloud business growth and operating execution. Fifth, less crowded application software may rebound, but this requires validation of AI impact, growth stability, management execution, and M&A discipline.
Analysis framework
The report combines Bernstein’s quantitative team’s crowding research with fundamental analysis, assessing crowding from perspectives including active managers’ positioning deviations, fund flows, cross-sectional relative rankings, and each stock’s own historical levels, and compares the historical performance of highly crowded and less crowded stocks during normal periods and periods of market stress. It then analyzes global large-cap software, U.S. small- and mid-cap software, and cybersecurity coverage companies one by one, cross-validating crowding with revenue growth, valuation, AI exposure, competitive landscape, and company execution risk.
Methodology notes
Identify stocks broadly overweighted by active managers, with concentrated holdings or overheated fund flows.
Crowding is used to measure investor positioning consensus and potential exit pressure. Highly crowded stocks may face synchronized selling during risk-off phases, while less crowded stocks may provide negatively correlated protection.
Compare both a company’s relative crowding rank among peers and its crowding level relative to its own history.
The report compares the relative crowding of 30 large-cap software and internet companies, while also observing how each company’s crowding changes over time, avoiding equating current ranking directly with an absolute overheating level.
Examine positioning structures in software, technology, and communication services sectors according to a unified industry classification.
The report uses the GICS framework and accounts for the classification changes after the traditional telecom sector was expanded into the communication services sector to include media and some internet companies.
Compare the relative returns of highly crowded and less crowded portfolios during periods of rising volatility.
This method is used to assess the impact of risk reduction, liquidity contraction, and synchronized selling on crowded trades, but crowding is not a standalone timing or valuation indicator.
Asset mapping & comparison
Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).
- ORCLA highly crowded global software name whose fundamentals are recognized
- Strengths
- OCI, the ERP suite, and Autonomous Database and multi-cloud databases are expected to accelerate revenue growth, with recent results solid and management disclosure improving.
- Weaknesses
- The scale of data center buildout, capital constraints, capital expenditure, and execution capability remain questioned by the market.
- Comparison
- It has the highest crowding in global software coverage, but has declined relative to its own history; ranked No. 4 in combined coverage.
- Risks
- Returns on large-scale data center investment falling short of expectations, rising capital pressure, or delayed delivery of growth.
- OKTAAn identity security name with recovering crowding
- Strengths
- Signs of growth bottoming are strengthening, commercial execution is gradually improving, and Agentic AI may increase demand for identity solutions.
- Weaknesses
- Historically, Auth0 integration was poor and security incidents occurred; growth recovery was once affected by reductions in U.S. federal agencies.
- Comparison
- It has moved from negative crowding back into the highly crowded tier, reflecting rising investor expectations for growth reacceleration.
- Risks
- Growth recovery being delayed again, product execution falling short of expectations, or security incidents damaging customer trust.
- DDOGThe most crowded cloud consumption software name within coverage
- Strengths
- Benefits from increasing enterprise cloud workloads, expansion of AI-native customers, and a leading position in cloud-native observability.
- Weaknesses
- The growth base has risen, and the loss or digestion period of some large AI customers may cause subsequent revenue deceleration.
- Comparison
- Crowding has reached a historical high, clearly ahead of other covered companies.
- Risks
- Significant growth deceleration from the fourth quarter of 2026 to 2027, leading to a synchronized decline in investor enthusiasm and valuation.
- PANWA highly crowded beneficiary of cybersecurity platformization
- Strengths
- It has a strong portfolio across cybersecurity, SASE, security operations, and identity products, and may benefit from AI-driven security demand and the CyberArk acquisition.
- Weaknesses
- Product lines vary in maturity, and execution certainty is lower in areas such as cloud security and endpoint security.
- Comparison
- It is among the most crowded names, but the report relatively prefers PANW among cybersecurity companies.
- Risks
- Platform integration falling short of expectations, acquisition execution risk, or AI security demand failing to translate into revenue acceleration.
- CRWDA cybersecurity leader with extremely high positioning and high valuation
- Strengths
- Its leadership in endpoint security is solid, and it benefits from cloud-first architecture upgrades and AI-related cybersecurity demand.
- Weaknesses
- Its valuation is difficult to justify with fundamental regression models, and sales and implementation cycles limit its ability to achieve growth elasticity similar to cloud consumption businesses.
- Comparison
- Positioning depth is so high that the fund-flow dimension of crowding analysis is affected.
- Risks
- Growth failing to meet momentum investors’ expectations for acceleration may trigger valuation and share-price corrections in the second half of 2026.
- ADBE, HUBS, GTLB, CRMA group of less crowded application software and developer tool names
- Strengths
- Positioning and valuation expectations have fallen significantly, and valuation repair may occur if growth stabilizes or the AI threat is lower than expected.
- Weaknesses
- They face GenAI competition, seat compression, cloud market saturation, management changes, or uncertainty over product strategy.
- Comparison
- They sit at the least crowded end of Bernstein’s coverage universe, in sharp contrast to popular trades in cloud consumption and cybersecurity.
- Risks
- Low crowding may reflect structural growth problems rather than merely market mispricing; a rebound requires support from earnings and strategic evidence.
Key data
- Software sector crowdingSignificantly below the historical average over the past 25 yearsConcerns over GenAI disruption and valuation derating in enterprise application software are the main reasons.
- Relative performance in months when the VIX is above averageThe most crowded stocks lag the least crowded stocks by 40 basis points per monthThis shows that less crowded holdings provide some portfolio protection during periods of market stress.
- Overall market performance in the first half of 2026Highly crowded stocks outperformed less crowded stocks by 12.8%The report believes this period deviated from the long-term pattern.
- TMT sector performance in the first half of 2026Highly crowded stocks outperformed less crowded stocks by 50.9%Mainly driven by the semiconductor and hardware sectors, which had high crowding and strong performance.
- Most crowded name within coverageDDOGCrowding has reached a historical high, reflecting expectations for accelerating cloud consumption and growth in AI-native customers.
- Highly crowded tier within coverageDDOG, PANW, TWLO, ORCL, OKTAConsumption-oriented software, hyperscale cloud platforms, and cybersecurity names dominate.
- Less crowded tier within coverageCRM, GTLB, HUBS, ADBEMainly affected by concerns over slowing growth, GenAI competition, and seat compression.
- ORCL crowding rankNo. 1 in global software coverage and No. 4 in combined coverageBoth crowding and valuation have fallen from their peak in the third quarter of 2025.
- MSFT crowding rankNo. 2 in global software coverage and No. 7 in combined coverageConcerns over capital expenditure, return on investment, and Copilot effectiveness have reduced crowding.
Impact & implications
At the portfolio level, investors should avoid treating concentrated positions in highly crowded growth stocks as low-risk core holdings, and may allocate to some application software names with stable fundamentals, pressured valuations, and lighter positioning to cushion synchronized selling during market risk-off periods. At the individual stock level, crowding must be assessed together with valuation and earnings delivery: ORCL, MSFT, and PANW are relatively crowded but have strong growth or platformization logic; DDOG, CRWD, and NET face risks from high expectations, high valuations, or growth deceleration. Less crowded ADBE, HUBS, GTLB, and CRM have contrarian repair potential, but still require evidence of growth, product strategy, and the impact of AI competition.
Risks
- Market stress or rising volatility may trigger synchronized deleveraging by active managers, and exit liquidity in highly crowded names can amplify drawdowns.
- Popular cloud consumption and cybersecurity stocks have high valuations and growth expectations, and any revenue deceleration may cause a rapid reversal in crowding.
- GenAI may intensify competition in application software and compress seat counts, pricing power, and long-term growth rates.
- Returns on data center and AI infrastructure capital expenditure falling short of expectations may affect ORCL, MSFT, and related cloud software demand.
- The low-crowding status of enterprise application software may stem from cloud market saturation, structural growth slowdown, or declining product competitiveness.
- M&A and integration risks may damage organic growth, capital allocation discipline, and investor confidence.
- Highly crowded trades were unusually strong in the first half of 2026, and historical relationships may not directly predict short-term relative returns.
What to watch
- DDOG’s new ARR, AWS-related activity, and changes in revenue from large AI customers in the third to fourth quarters of 2026.
- ORCL’s data center buildout progress, capital constraints, OCI growth rate, and delivery against its five-year growth guidance.
- MSFT’s Azure growth rate, paid Copilot adoption, capital expenditure growth, and returns on AI investment.
- Whether the rebound in enterprise application software following SAP and MSFT results can continue, and whether concerns over GenAI substitution ease further.
- OKTA’s growth reacceleration and the actual conversion of Agentic AI identity security demand.
- Whether CRWD and PANW can convert AI security demand into sustainable growth while maintaining reasonable valuations.
- Whether GTLB’s pricing, U.S. federal agency reductions, and three-year contract renewal headwinds can fade in the second half of 2026.
- Growth, margin, and AI progress disclosed by WDAY at the Workday Rising conference and Financial Analyst Day.
- Whether the VIX and active fund risk-reduction behavior drive the historical relative performance of highly crowded versus less crowded stocks to reemerge.