5 software stocks AI can't replace

Key Concepts

• Infrastructure Software: The "plumbing" of enterprise IT; considered more defensible than application software due to high switching costs.
• AI-Native Displacement: The fear that AI will replace existing software applications, leading to market volatility.
• Observability: The ability to monitor and understand the health of complex IT infrastructure and applications (e.g., DataDog).
• Cyber Resilience: The capacity to recover data and maintain operations during cyberattacks or system failures (e.g., Rubric).
• Edge Computing: Processing data closer to the end-user to reduce latency, crucial for AI inferencing (e.g., Cloudflare).
• Agentic Workflows: The use of AI agents to automate business processes, which necessitates new security guardrails.

1. Investment Framework for the AI Era

Fatima Bulani (Citi) outlines a four-pillar rubric for identifying software winners in the current market:

1. Criticality: The solution must be essential today and become even more vital as AI adoption scales.
2. Platform Dominance: Companies must move beyond "one-trick pony" status, demonstrating success in multiple product categories and platform-oriented selling.
3. Financial Quality: Focus on companies with growth acceleration and the ability to capture a larger share of the customer's IT budget.
4. Management Quality: Betting on executive teams with proven track records of execution during periods of industry turbulence.

2. The "Plumbing" Thesis

Bulani argues that while application software faces high risks of displacement by AI, infrastructure software is highly insulated. Large organizations are reluctant to replace core "plumbing" (network security, data backup, observability) because these systems are deeply entrenched. This creates a "moat" that protects infrastructure providers from the volatility affecting other software segments.

3. Five Software Stocks to Watch

Palo Alto Networks (PANW)

• Role: Network and security operations.
• AI Thesis: As AI agents automate workflows, they require "guardrails" to ensure they behave correctly and access only authorized systems. Palo Alto is positioned to provide these controls.
• Key Catalyst: The $25 billion acquisition of CyberArk is viewed as the "lynchpin" for their future growth in identity and access management.

CrowdStrike (CRWD)

• Role: Endpoint security (servers, PCs, cloud environments).
• AI Thesis: If Palo Alto owns the network, CrowdStrike owns the "beachfront estate" of the endpoint. As AI tools are deployed directly on endpoints, CrowdStrike’s visibility into threat propagation becomes increasingly valuable.

DataDog (DDOG)

• Role: Observability and infrastructure monitoring.
• AI Thesis: AI increases the complexity of IT stacks. DataDog acts as an "MRI scan" for an organization’s IT footprint. The more complex the environment, the more critical DataDog’s visibility becomes.
• Evidence: Even "AI-native" frontier labs use DataDog to monitor their own infrastructure to prevent costly downtime.

Rubric (RBRK)

• Role: Backup, recovery, and cyber resilience.
• AI Thesis: A "boring but important" play. As AI agents generate massive amounts of new data, the need for robust backup and recovery increases. Rubric is modernizing a 30–40-year-old industry that had previously lacked innovation.

Cloudflare (NET)

• Role: Edge computing, network security, and developer infrastructure.
• AI Thesis: Cloudflare operates four distinct business lines that compete with giants like Cisco, AWS, and Palo Alto. Their edge network is essential for "AI inferencing," allowing developers to run applications closer to the end-user.
• Operational Shift: They have successfully transitioned from a product-led, developer-focused model to an enterprise-sales model by hiring top-tier talent from Palo Alto Networks.

4. Synthesis and Conclusion

The software sector is currently undergoing a "revolution" in how organizations manage their tech stacks. The primary takeaway is that investors should pivot away from vulnerable application software and toward infrastructure providers that offer critical, non-discretionary services. By focusing on companies that provide security, observability, data resilience, and edge infrastructure, investors can align themselves with the "plumbing" that will support the next generation of AI-driven enterprise operations. As Bulani notes, the key is to hitch one's wagon to management teams that have proven they can institutionalize sales and scale across multiple product categories.