💻 Seats vs. Compute
Why AI is splitting the software market
Welcome to the Free edition of How They Make Money.
Over 290,000 subscribers turn to us for business and investment insights.
In case you missed it:
It’s been rough to be a software investor
AI agents threaten to compress white-collar workflows, and markets have responded by repricing the entire sector. Over the past five years, the WisdomTree Cloud Computing ETF (WCLD) was cut in half, while the Nasdaq-100 (QQQ) has nearly doubled. Since our breakdown of the SaaSpocalypse last month, software stocks have dropped another 10%.
When narratives shift, markets rarely discriminate.
But look closer. A dispersion is emerging between those who sell human productivity and those who capture the rise in workloads.
Investors have questioned everything from seat-based pricing to enterprise IT budgets. Some predict agentic disintermediation on the horizon, with near-term earnings merely a distraction and terminal values revised toward zero.
The comparison to the printed press in the 2000s is common. But that analogy confuses disruption with extinction. The New York Times (NYT), once cited as a casualty of the Internet, is up nearly 6x over the past decade and has doubled the returns of the S&P 500.
Markets tend to extrapolate the present trend, bearish or bullish. But software is not a monolith.
The repricing underway is far more selective than it appears at first.
📉 The Great Divide in Software
For years, software was treated as one category:
Recurring revenue.
High gross margins.
Scalable business models.
Favoring growth over profitability.
Whether it was CRM or cybersecurity, most companies benefited from the same secular tailwinds: cloud migration, digital transformation, and expanding enterprise IT budgets.
AI is forcing a more nuanced distinction.
Some software businesses scale primarily with headcount. Revenue grows as customers hire employees and provision more seats. When hiring slows or when automation reduces the need for certain roles, that growth engine weakens.
Others scale with infrastructure usage. Their revenue increases as compute workloads rise, traffic expands, systems grow more complex, and security risks multiply. AI does not compress those forces. It intensifies them.
The distinction matters because these two models respond differently to AI.
Application software is tied to labor intensity.
Infrastructure software is tied to computational intensity.
As AI adoption increases, those forces move in opposite directions. Application software is a tax on labor. Infrastructure software is a tax on compute.
Seat-based pricing may face pressure as workflows become more automated. In contrast, software linked to usage, traffic, and system complexity can expand alongside AI-driven workloads.
🔒 Palo Alto: The Security Layer
If AI increases traffic and system complexity, it also increases risk.
Every new API endpoint, cloud workload, or AI-powered workflow expands the potential attack surface. As enterprises embed AI into products and internal operations, the need for visibility and protection grows alongside it.
Palo Alto Networks (PANW) remains the largest ‘pure-play’ cybersecurity company today. Its software helps organizations secure networks, cloud environments, and endpoints across increasingly distributed systems.
Security budgets tend to behave differently from productivity budgets. Companies may slow hiring or delay software upgrades, but they rarely reduce protection when systems become more complex.
The most recent quarter reinforced this dynamic. PANW just reported Q2 FY26 results (January quarter). Revenue grew 15% to $2.6 billion, as enterprises continued consolidating vendors and expanding their security footprint.
The company has steadily improved its operating margin over the past five years, reaching a new high of 14% in the past 12 months (15% in Q2).
The core Next-Generation Security (NGS) Annual Recurring Revenue (ARR) expanded 33% to $6.3 billion, while the RPO backlog rose 23% Y/Y to $16.0 billion. For perspective, the NGS business is larger and growing faster than CrowdStrike’s entire ARR.
Management noted that 110 customers adopted multiple Palo Alto products rather than a single standalone tool. It favors unified platforms, specifically Strata (Network Security), Prisma (Cloud Security), and Cortex (Security Operations/AI-driven SOC)
This shift is increasingly driven by AI, as customers look to consolidate their security stacks to defend against more sophisticated, autonomous threats.
The quarter was defined by aggressive M&A activity aimed at rounding out the ecosystem:
Identity & observability: The company recently closed its $25 billion acquisition of CyberArk and its $3.3 billion deal for Chronosphere. These additions are expected to be the primary growth engines for the remainder of the fiscal year.
Agentic AI: Palo Alto announced its intent to acquire Koi, an Israeli startup focused on agentic endpoint security. The goal is to secure autonomous AI agents and scripts that often operate outside traditional security visibility.
Product momentum: Prisma AIRS (AI Security) tripled its customer count to over 100 in just a few quarters, while the SASE business surpassed $1.5 billion in ARR.
Palo Alto just raised its revenue and ARR outlook substantially, but the increase is largely attributable to two recent acquisitions. A lowered EPS guidance reflected higher memory and storage costs, as well as share dilution from the massive CyberArk transaction. The stock fell after earnings as investors weighed the revenue surge against the near-term margin pressure and acquisition costs.
The company reiterated its long-term FY30 goal of $20 billion in NGS ARR and its FY28 target of 40%+ free cash flow margins (from mid-30s today).
🛜 Cloudflare: The Network Layer
If AI agents become the new users of the web, they still rely on the same foundational layer, the network.
Cloudflare (NET) operates at that layer. It routes traffic, secures endpoints, mitigates attacks, and increasingly runs compute at the edge. Unlike application software that scales with employees, network software scales with requests and workloads.
AI increases both.
As companies deploy AI features, API calls multiply. Systems become more distributed. Traffic patterns grow less predictable. Security risks expand. Each of those forces drives demand for routing, protection, and edge execution.
This is why Cloudflare’s growth trajectory has diverged from many application software businesses. Its revenue is tied less to hiring cycles and more to digital activity itself. The company’s revenue growth re-accelerated to its fastest pace in nearly three years.
In a world of agentic workflows and machine-to-machine communication, the network layer becomes more central, not less.
🔎 Datadog: The Observability Layer
If the network layer moves traffic, the observability layer explains what happens after that traffic arrives.
Datadog (DDOG) provides monitoring across logs, metrics, traces, and increasingly AI workloads themselves. In modern cloud architectures, where applications are distributed across services and regions, observability is mission-critical.
AI adds another layer of complexity. Models generate new workloads, services interact in more dynamic ways, and latency or performance issues carry greater consequences. As systems grow more intricate, visibility becomes more valuable.
The largest operating expense for most software businesses is sales & marketing (S&M). In contrast, Datadog is a typical case of product-led growth. Most of the gross profit is plowed back into R&D expenses.
Unlike seat-based application software, observability tools scale with infrastructure usage. More services, more traffic, and more compute translate into greater monitoring demand. This explains why Datadog has reported a steady increase in multi-product adoption, with 18% of its customers using over 8 products.
This dynamic helps explain why certain infrastructure-oriented software companies are seeing stabilization or re-acceleration even as parts of the broader SaaS universe remain under pressure.
As Datadog CEO Olivier Pomel noted last week, AI-native customers are “growing significantly faster than the rest of the business” as their workloads move into production and expand across users and tokens.
The keyword is production. As experimental AI deployments scale into real systems, monitoring demand scales with them.
🔮 What to Watch Next
If the divide between application and infrastructure software continues to widen, it should show up in the numbers.
Watch for:
Usage-based revenue trends: Companies tied to compute, traffic, and cloud workloads should see stabilization or acceleration before seat-based vendors.
Net retention dynamics: Infrastructure software should benefit from expanding workloads even if hiring remains muted.
Security and observability budgets: As AI adoption grows, spending on protection and monitoring should prove more resilient than spending on productivity tools.
Cloud CapEx and workload growth: If hyperscaler investment remains elevated, infrastructure-linked software stands to benefit.
New business models: Monitor shifts toward usage-based services or flat-tier subscriptions based on the service delivered.
The broader narrative may still treat software as one category. But the economics underneath are diverging.
And markets eventually reprice divergence.
That’s it for today!
Stay healthy and invest on!
Want to sponsor this newsletter? Get in touch here.
Thanks to Fiscal.ai for being our official data partner. Create your own charts and pull key metrics from 50,000+ companies directly on Fiscal.ai. Start an account for free and save 15% on paid plans with this link.
Disclosure: I own PANW, DDOG, and NET in App Economy Portfolio. I share my ratings (BUY, SELL, or HOLD) with members.
Author's Note (Bertrand here 👋🏼): The views and opinions expressed in this newsletter are solely my own and should not be considered financial advice or any other organization's views.
Great article, really appreciate the breakdown of cybersecurity companies by layers such as security and observability. Was wondering if A10 Networks would fall under the "network" layer and how it compares to $NET? Thanks, keep up the great work!
Great read. And lots to think about