Software Overall Is No Longer Crowded, but Popular Trades Are Highly Concentrated in Cloud Consumption and Cybersecurity

Overview

The report updates the crowding conditions of global software, U.S. small- and mid-cap software, and cybersecurity companies, and discusses their implications for stock selection, portfolio construction and risk management. In 2026, GenAI substitution risk and the “SaaS doomsday” narrative drove capital outflows from application software, causing overall software crowding and valuations to decline significantly; at the same time, growth in cloud usage, expansion of AI-native customers and AI-related security demand have kept consumption-based software, hyperscale cloud providers and cybersecurity names highly popular.

Core views

At the sector level, software is no longer a crowded trade in the historical sense, but internal dispersion is significant. Consumption-based software such as DDOG and TWLO is benefiting from cloud usage and AI-native customer growth; ORCL and MSFT remain relatively crowded but below their own historical levels; most cybersecurity companies are supported by AI risks and regulatory demand. Seat-based application SaaS remains affected by slowing growth, pricing compression and concerns over GenAI competition, though results from SAP, Microsoft and Oracle have recently driven a rebound in application software. The research believes crowding should be used as a risk factor in addition to valuation and fundamentals, rather than as a standalone buy or sell signal.

Analysis framework

The report combines Bernstein’s quantitative team’s cross-regional and cross-industry research on position crowding, comparing the degree of overweighting by actively managed funds, fund flows, relative stock rankings and each stock’s own historical percentile; it also combines crowding with valuation, revenue growth, product demand, competitive landscape and catalysts to assess individual stock drawdown risk and subsequent return potential.

Methodology notes

• Quantitative Position AnalysisStock Crowding Framework

  Measures whether a stock has been widely overweighted in actively managed fund portfolios.

  The higher the crowding, the stronger the positioning consensus, but under market pressure it is also more prone to synchronized selling, declining exit liquidity and amplified drawdowns.

• Relative ComparisonCross-Sectional and Historical Crowding Comparison

  Compares a stock’s crowding relative to peers and its change relative to its own history at the same time.

  This method is used to distinguish among different states, such as overall sector crowding, concentration of capital within the sector, and individual stocks that remain crowded but have cooled meaningfully from historical levels.

• Portfolio Risk ManagementBalancing Crowded and Uncrowded Holdings

  Uses low-crowding holdings to hedge concentrated drawdowns in popular trades during periods of market stress.

  Historically, the least crowded stocks have often provided negatively correlated protection in months when severely crowded trades draw down, but fundamentals and valuation still need to be considered to avoid mechanically buying low-crowding names.

• Industry ClassificationGICS Industry Framework

  Conducts industry comparisons of software, internet and communication services companies according to GICS.

  The report uses an expanded communication services classification, which includes media as well as some internet companies such as Alphabet and Meta.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• Global Software Sector

  Selectively Bullish

  Strengths

  Overall crowding and valuations are both below historical levels, and recent results show that the AI impact may be slower than the market had previously expected.

  Weaknesses

  Sector growth dispersion is significant, and seat-based SaaS still faces slowing growth and pricing pressure.

  Comparison

  Compared with the overall technology sector, software’s current crowding is significantly lower; infrastructure software and cybersecurity have stronger capital positioning than enterprise application software.

  Risks

  Acceleration of GenAI substitution, reallocation of enterprise software budgets, and prolonged failure of low crowding to translate into fundamental improvement.

• ORCL

  Positive Focus

  Strengths

  OCI, ERP suites, Autonomous Database and multicloud databases are expected to drive accelerated revenue growth, with operating margins expected to remain relatively stable.

  Weaknesses

  The scale of data center construction, capital constraints and execution capability remain questioned by the market.

  Comparison

  It has the highest crowding within global software coverage, but has already declined relative to its own historical level.

  Risks

  Returns on capital expenditure falling short of expectations, execution missteps in data center expansion, and high positioning triggering de-risking drawdowns.

• DDOG and TWLO

  Fundamental Beneficiaries but Crowding Is Elevated

  Strengths

  Driven by growth in cloud usage, expansion of AI-native customers and consumption-based revenue models.

  Weaknesses

  Market expectations are high, and uncertainty remains over TWLO’s long-term growth potential in voice AI.

  Comparison

  Compared with seat-based application SaaS, consumption-based software has received stronger capital and growth support in 2026.

  Risks

  DDOG may see revenue growth slow from 2H26 onward due to customer churn, customer digestion periods and a high base.

• PANW, CRWD, OKTA and the Cybersecurity Sector

  Demand Is Positive but Valuation Requires Attention

  Strengths

  AI-related security risks, identity security, cloud migration and regulatory requirements provide demand tailwinds.

  Weaknesses

  Most products depend on longer sales cycles and human commercialization capabilities, making it difficult to replicate the instant consumption growth of cloud infrastructure.

  Comparison

  PANW is more likely to achieve meaningful acceleration from AI-driven cybersecurity demand; OKTA has potential from Agentic AI identity demand; CRWD has outstanding quality but a more challenging valuation.

  Risks

  High valuations, excessive growth expectations, weaker-than-expected sales execution and reversal of crowded trades.

• CRM, GTLB, HUBS, ADBE and Low-Crowding Application Software

  Contrarian Watch

  Strengths

  Positioning and valuation pressure are relatively fully reflected, and some companies still have stable cash flow, long-term competitiveness or potential for growth recovery.

  Weaknesses

  They face cloud market saturation, GenAI competition, macro pressure, management changes and uncertainty in product strategy.

  Comparison

  Compared with popular cloud consumption and cybersecurity stocks, these names have lower crowding and weaker market expectations.

  Risks

  Low crowding may reflect persistent structural growth issues rather than temporary mispricing.

Key data

• Software Sector CrowdingSignificantly below the historical average over the past 25 yearsGenAI substitution concerns and the “SaaS doomsday” narrative prompted capital outflows and compressed valuations.
• Most Crowded Names Within CoverageDDOG, PANW, TWLO, ORCL, OKTADDOG has risen to first place, with crowding reaching a historical high.
• Least Crowded Names Within CoverageCRM, GTLB, HUBS, ADBELow crowding mainly reflects concerns about growth, GenAI competition, the macro environment or company execution.
• Crowding Effect in High-VIX MonthsThe most crowded stocks lag the least crowded stocks by 40 basis points per monthReflects the impact of synchronized de-risking and insufficient exit liquidity during periods of market stress.
• Overall Market Performance in 1H26Crowded stocks outperformed uncrowded stocks by 12.8%The report views this stage as deviating from typical historical patterns.
• TMT Performance in 1H26Crowded stocks outperformed uncrowded stocks by 50.9%This may have been mainly driven by strength in the more crowded semiconductor and hardware sectors.
• Workday Long-Term Revenue GuidanceRevenue CAGR of 13%–14% through FY28Recent operations have stabilized, but the market still requires the company to provide more evidence of growth.
• GitLab Growth OutlookRevenue growth is expected to recover to above 20% next yearHeadwinds such as pricing, seat compression at U.S. federal agencies and timing mismatches in three-year contract renewals are expected to mostly ease in 2H26.
• CrowdStrike Share Price PerformanceUp approximately 80% over the past yearQuality and AI security demand have been recognized, but valuation and overly high growth expectations are the main risks.

Impact & implications

For portfolios, the software sector’s crowding below its historical average means that there is room for repair in valuations and positioning structure, but opportunities are uneven. Investors can use application software with solid fundamentals, pressured valuations and lighter positioning to balance highly crowded cloud consumption and cybersecurity holdings; for popular names such as DDOG, CRWD and PANW, the key is to test whether growth can meet high expectations. Although ORCL and MSFT remain relatively crowded, their crowding has declined from highs, and if cloud business growth, margins and returns on capital expenditure improve, they may still offer favorable risk-reward.

Risks

• Rising market volatility may trigger active funds to synchronously reduce highly crowded holdings, and insufficient exit liquidity would amplify drawdowns.
• GenAI may compress seat demand, software pricing and long-term growth rates, and intensify competition in enterprise applications and developer tools.
• If returns on AI and data center capital expenditure are below expectations, valuations of ORCL, MSFT and related cloud infrastructure companies will be affected.
• Consumption-based software such as DDOG may experience growth deceleration due to high bases, customer churn or digestion of customer spending.
• Cybersecurity company valuations may already price in overly strong expectations for acceleration in AI demand, while actual sales cycles limit the speed of revenue realization.
• Low-crowding stocks may have structural issues such as long-term growth, management execution or deterioration in competitive position.
• Crowded stocks were unusually strong in 1H26, and historical crowding patterns may continue to fail in the short term.

What to watch

• DDOG revenue growth in 2H26, churn among large AI-native customers and changes in AWS engagement.
• ORCL’s data center construction, capital constraints, OCI growth and execution of five-year growth guidance.
• MSFT’s Azure growth, CAPEX growth, investment returns and paid adoption rate of Office 365 Copilot.
• Whether the recent rebound in SAP and application software can be continuously validated by orders, cloud migration and cash flow growth.
• Further commentary at Workday’s October meeting and analyst day on FY28 growth, margins and AI opportunities.
• Whether GTLB’s revenue growth can recover to above 20% after temporary growth headwinds fade.
• OKTA’s growth inflection point and the actual contribution of Agentic AI to identity security demand.
• PANW’s progress in integrating CyberArk, and whether CRWD’s growth can support its current valuation.
• Relative return changes between highly crowded and low-crowding software stocks when the VIX rises.