Jim Cramer Says Sell Fortinet and Buy Palo Alto and CrowdStrike Instead
Fortinet beat earnings and still watched its stock crater nearly 20% in a week, sending shockwaves through the entire cybersecurity sector. Now one high-profile voice says the panic created a rare opportunity in two of Fortinet's biggest rivals.
Jim Cramer told investors to sell Fortinet (NASDAQ:FTNT | FTNT Price Prediction) and buy Palo Alto Networks (NASDAQ:PANW) and CrowdStrike (NASDAQ:CRWD) instead. He made the call on the evening of Thursday, October 29, 2026, after a brutal week for Fortinet. Its shares traded at $139.14 in Friday’s premarket, a one-week decline of 19.6%.
In Cramer’s view, Fortinet’s collapse is a problem specific to Fortinet, and the selling that spread into its rivals was guilt by association. That is one commentator’s opinion, and the numbers behind it deserve a closer look.
Why Fortinet Stock Collapsed After a Beat
Fortinet’s third-quarter report on October 28, 2026, exceeded estimates on the bottom line. Non-GAAP EPS came in at $0.91 against a $0.86 consensus, according to the company’s earnings release filed with the SEC. The weak spot was services. Product revenue jumped 37% on a FortiGate hardware upgrade, while service revenue grew only 13%, short of expectations.
Billings growth disappointed investors. Billings measure the total value of invoices a company sends out in a period, including multiyear subscription contracts that turn into revenue over time. Investors watch the figure as an early signal of future revenue. Fortinet shares plunged 26% in after-hours trading on Wednesday. Reports noted the slide pulled other cybersecurity names lower, including Tenable (NASDAQ:TENB).
Cramer’s Case Against Fortinet
Cramer argued that Fortinet’s product portfolio is narrow. “Fortinet offers a very limited set of cyber defenses. It is primarily a legacy firewall business,” he said. He added, “Fortinet’s weakness is not a tale about a slowdown in cybersecurity. It’s just a sign that it in itself isn’t doing well.”
His sharpest line: “Not only are Palo Alto and CrowdStrike not guilty by association, but my work shows that Fortinet has been what we call a share donor. Sell, sell, sell. To both of those two companies. Their stock should be bought, not sold.” A share donor is a company that keeps losing market share to its competitors.
The latest results from Palo Alto and CrowdStrike line up with that argument. Palo Alto’s Next-Generation Security annual recurring revenue (ARR) grew 63% to $9.10 billion, and the company logged about 22 net new platformizations in its fiscal fourth quarter, a record. CrowdStrike’s net new ARR rose 51% to a record $332.8 million, and Falcon Flex ending ARR exceeded $2.29 billion. Both companies offer broad platforms that customers consolidate onto, with AI security as the key selling point.
How the Rivals Traded Through the Sell-Off
CrowdStrike slid on Thursday as the Fortinet selling spread, according to MarketWatch. Over the full week, though, both rivals moved in the opposite direction from Fortinet. As of the most recent close, Palo Alto was up 7.2% for the week, and CrowdStrike was up 9.2%. Early Friday, Palo Alto rose 1.7% in premarket trading while CrowdStrike edged down fractionally.
What Fortinet Bulls Will Argue
Fortinet shares remain up 78.6% year to date, even after the drop. The non-GAAP operating margin expanded to 38.2%, and management raised full-year guidance for the third time. Chief Financial Officer Christiane Ohlgart said on the call that services weakness is a timing issue: “The good news is the customers are buying services, which you can see in deferred revenue, which you can see in service billings.” Management also expects service revenue to grow faster in 2027 than in 2026. A single quarter does not prove a lasting shift in market share.
Valuation matters as well. Fortinet trades at roughly 55 times earnings, so any further slowdown in services could keep pressure on the multiple.
What to Watch in the Next Reports
Cramer closed with this advice: “Do the homework. Know what the companies really do. That’s the only way to profit from these short-term, guilt-by-association moves, which tend to work themselves out.”
When Fortinet reports again, look for service revenue growth to show the deferred-revenue backlog turning into revenue. At Palo Alto, the numbers to track are Next-Generation Security ARR and the platformization count, both covered on its investor relations site. For CrowdStrike’s fiscal third quarter, check whether net new ARR and Falcon Flex adoption keep growing at their current pace. If they do, that would support Cramer’s share-shift argument.
Contact [email protected] for any questions or corrections.
Trey has been an editor and author at 24/7 Wall St. for more than a decade, where he has published thousands of articles analyzing corporate earnings, dividend stocks, short interest, insider buying, private equity, and market trends. His comprehensive coverage spans the full spectrum of financial markets, from blue-chip stalwarts to emerging growth companies.
Beyond 24/7 Wall St., Trey has created and edited financial content for Benzinga and AOL's BloggingStocks, contributing additional hundreds of articles to the investment community.
Trey's editorial expertise extends across multiple publishing environments. He served as production editor at Dearborn Financial Publishing and development editor at Kaplan, where he helped shape financial education materials. Earlier in his career, he worked as a writer-producer at SVE. His freelance editing portfolio includes work for prestigious clients such as Sage Publications, Rand McNally, the Institute for Supply Management, the American Library Association, Eggplant Literary Productions, and Spiegel.
Outside of financial journalism, Trey writes fiction and has been an active member of the writing community for years, moderating workshop sessions at regional conventions.
