H2'26 software and internet outlook: expectations are high for hot segments, while application software may get a reversal window
AI summary card
H2'26 software and internet outlook: expectations are high for hot segments, while application software may get a reversal window
Bernstein believes that after cloud consumption infrastructure and cybersecurity were sharply re-rated in H1 on AI and security demand, H2 may face normalization in growth and expectation gaps; application software names such as ServiceNow, Atlassian, and GitLab may instead have room for sentiment recovery.
- Cloud consumption infrastructure still benefits from GenAI and cloud modernization, but web indicators such as AWS SSO have flattened since May, and Q4 may see slowing growth against a high base.
- Cybersecurity demand is strong, but sales cycles, implementation support, and channel staffing constraints make a 'hockey-stick' acceleration difficult to achieve, and the market may still be disappointed by only a few extra points of growth.
- Application software had previously been suppressed by AI disruption narratives. If AI Labs go public, the narrative softens, and companies improve their own product stories, NOW, TEAM, and GTLB could see better risk/reward in H2.
- At the single-stock level, the report maintains Outperform on NOW, TEAM, DDOG, GTLB, OKTA, PANW, ZS, and S; and Market Perform on TWLO, ZM, CRWD, NET, and FTNT.
Report interpretation
Overview
This is Bernstein's H2'26 outlook report on growth software, cloud consumption infrastructure, and cybersecurity. The report compares the software sector at the start of the year to a 'Goldilocks' scenario: cybersecurity was hot, application software was cold, and cloud consumption infrastructure was just right. Entering the second quarter, investors rotated from momentum trades in semiconductors, storage, and power into software, with particular preference for the perceived safety of cloud consumption infrastructure and cybersecurity, driving related valuations sharply higher around earnings season. The report's core judgment is that the H2 script may flip: expectations for hot segments are too high, while previously pressured application software may see a better combination of narrative and fundamentals.
Core views
The report is selectively optimistic on H2'26 but places much greater emphasis on expectation management. In cloud consumption infrastructure, companies such as Datadog still have long-term appeal, but market expectations for revenue growth in the 30% to 40%+ range may be too high. Traditional enterprise and SaaS customers face very difficult year-over-year comps in Q4, while capacity constraints at hyperscalers and the prioritization of security hardening after Mythos/Glasswing could slow new projects. In cybersecurity, AI, regulation, and security incidents do create demand tailwinds, but sales and implementation are highly labor-dependent, and 6-9 month sales cycles limit the likelihood of a sudden sharp acceleration in growth. In application software, ServiceNow, Atlassian, and GitLab could benefit in H2 from easier year-over-year comps, easing negative AI narratives, and company-specific improvements in products and margins.
Analysis framework
The report combines customer roadshow feedback, leading web traffic indicators, breakdowns of cloud and AI customer mix, year-over-year base analysis, company channel checks, valuation-versus-growth reversion frameworks, and single-stock fundamental models to assess H2 revenue growth, valuation re-rating potential, and expectation risk. The analytical focus is not on denying AI and security demand, but on judging whether these demand drivers are sufficient to support the high growth expectations already priced in by the market.
Methodology notes
Use AWS SSO web metrics as a roughly one-quarter leading signal for demand in traditional web and mobile application workloads
The report believes this indicator has provided a good read on the strength of cloud-related demand over the past several quarters; it was still strong early in Q2 but has flattened since May, implying Q3 may remain stable while Q4 faces downside risk to growth against a high base.
Differentiate traditional cloud workload demand from AI Labs and VC-backed AI-native customer demand
The report argues that AI-native customers may still grow rapidly, but their revenue contribution is relatively small and may not be enough to offset high comps and project slowdowns among traditional enterprise and SaaS customers in Q4.
Compare software stock valuations using free cash flow multiples versus three-year revenue compound growth
The report notes that seat-based SaaS companies often sit on a lower valuation reversion line, and that application software names such as ServiceNow do not look expensive under this framework.
Cybersecurity growth is constrained by sales headcount, channel capacity, POCs, and implementation support
The report argues that although cybersecurity demand is strong, sales cycles are typically 6-9 months and net commercial capacity can only grow by the low teens to mid-teens, making it difficult to replicate the low-friction acceleration seen in consumption-based cloud infrastructure.
Asset mapping & comparison
Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).
- Cloud consumption infrastructure (DDOG, TWLO, NET, etc.)AI-native customers and traditional cloud modernization jointly drive consumption-based revenue growth
- Strengths
- GenAI, improved developer efficiency, and more applications going live are driving demand for upper-layer infrastructure, with strong H1 growth and valuation momentum.
- Weaknesses
- AWS SSO web indicators have flattened since May, traditional enterprise and SaaS customers face high comps in Q4, and limited capacity at some hyperscalers could delay projects.
- Comparison
- Viewed by investors as safer than application software, but H2 expectations are also higher.
- Risks
- If project slowdowns in Q3 extend into Q4, rapid growth from AI-native customers may not be enough to offset slowing traditional customers.
- Cybersecurity (PANW, CRWD, OKTA, ZS, S, FTNT, etc.)Driven by AI, regulation, security incidents, and enterprise security-hardening budgets
- Strengths
- Demand is resilient, and cloud modernization and security-risk narratives support long-term TAM, while multiple companies still have room for product and platform expansion.
- Weaknesses
- Sales, POCs, and implementation support are labor-dependent, and 6-9 month sales cycles limit the magnitude of short-term acceleration.
- Comparison
- Demand intensity may be no weaker than cloud consumption infrastructure, but revenue realization is lower frequency, more manual, and less likely to surge suddenly.
- Risks
- Valuations are already high, and if investors expect 'hockey-stick' growth, even a few extra points of acceleration may be viewed as insufficient.
- Application software SaaS (NOW, TEAM, GTLB)Previously pressured by AI disruption narratives, seat compression concerns, and complex financial modeling
- Strengths
- H2 year-over-year comps improve, negative AI narratives may ease, and some companies have signs of better product adoption, margins, or revenue models.
- Weaknesses
- They still need to prove AI will not erode the value of core workflows, and some companies still face pressure from seats, pricing, or contract renewals.
- Comparison
- Compared with the H1 favorites in cybersecurity and cloud infrastructure, application software may instead offer better expectation dispersion.
- Risks
- If AI Labs narratives shift back toward replacing existing software vendors, sector sentiment could come under pressure again.
- SERVICENOW INC (NOW.US)Core beneficiary in application software
- Strengths
- Valuation is relatively inexpensive, H2 federal business comps are easier, Now Assist adoption is improving, and customers are moving from pilots to broader deployments.
- Weaknesses
- AI consumption revenue contribution remains small in the short term; the report expects only tens of millions of dollars in H2.
- Comparison
- Among mid- and large-cap software stocks, it looks attractive on Price to NTM FCF minus SBC versus three-year growth CAGR.
- Risks
- Federal spending normalization may disappoint, or AI adoption expansion may be slower than expected.
- ATLASSIAN CORP (TEAM.US)Application software reversal candidate
- Strengths
- Concerns around AI-driven seat compression, DIY substitution, and the next revenue stream have eased somewhat, while margin improvement and better modeling visibility could improve sentiment.
- Weaknesses
- It still faces headwinds from Data Center accounting dynamics and revenue growth in the next fiscal year.
- Comparison
- The report believes risk/reward becomes more attractive after FQ4, with CY27Q1 potentially the trough in the toughest year-over-year growth comparisons.
- Risks
- Data Center EOL-related pressure may last longer than expected, or AI competition narratives may heat up again.
- DATADOG INC (DDOG.US)Beneficiary of cloud consumption infrastructure and AI workloads
- Strengths
- Strong product mix, broad platform coverage, and continued innovation around AI workloads support a favorable long-term fundamental outlook.
- Weaknesses
- Its largest 'Born in AI' customer may reduce spending equal to about 3-4% of total revenue, and traditional customers may encounter a soft patch in H2.
- Comparison
- The report is cautious in the short term after Q3, but still maintains Outperform over the long term.
- Risks
- High H2 comps and customer spending adjustments may create revenue volatility, and market expectations for 30% to 40%+ growth may not be met.
- GITLAB INC (GTLB.US)Application development platform and DevSecOps name
- Strengths
- The end of price increases, DOGE-related seat compression, and pressure from post-COVID three-year contract renewals are expected to fade gradually.
- Weaknesses
- It is still currently facing combined growth deceleration pressure of 600bps+.
- Comparison
- The report views it as a tactical H2 buy, arguing that a narrative reversal could emerge in Q4 and Q1 2027.
- Risks
- Growth headwinds may ease more slowly than expected, or competition in the developer tools market may intensify.
- TWILIO (TWLO)Communications-as-a-service and consumption-based SaaS
- Strengths
- Benefits from improving cloud consumption trends, with new opportunities in AI voice applications.
- Weaknesses
- Web indicators have weakened since June, AI voice contribution remains small, and its differentiated position in voice is less clear than in messaging.
- Comparison
- The report has no significantly differentiated view and maintains Market Perform.
- Risks
- H2 revenue growth may decelerate modestly.
- ZOOM (ZM)Enterprise communications and collaboration software
- Strengths
- Expansion among large enterprise customers, along with positive cross-sell performance for Zoom Phone and Zoom Contact Center.
- Weaknesses
- Weakness in the Online business continues to drag on overall revenue growth.
- Comparison
- The report maintains Market Perform, noting that the Anthropic investment could be a potential upside variable but is currently small in scale.
- Risks
- Continued drag from the Online business and uncertainty around the monetization of AI investments.
- OKTA (OKTA)Identity security and AI agent security narrative
- Strengths
- DOGE impact and renewal pressure from oversold seats during the COVID period are expected to be gradually absorbed, while partnerships with Anthropic and OpenAI strengthen the AI agent narrative.
- Weaknesses
- The stock has already rebounded from its lows earlier in the year, so further re-rating needs to be supported by realized growth acceleration.
- Comparison
- The report maintains Outperform and expects growth to rise from around 11% recently to about 13% in FQ4 and about 13-14% in CY2027.
- Risks
- The AI agent narrative may fail to translate into revenue, or mechanical growth acceleration may fall short of expectations.
- Palo Alto (PANW) and CrowdStrike (CRWD)Large cybersecurity platforms
- Strengths
- Both are aligned with cloud modernization and AI-driven security demand, with large long-term opportunity.
- Weaknesses
- Valuations are high, making it difficult to build a low-valuation story; CRWD's commercial capacity constraints may limit further step-ups in growth.
- Comparison
- If choosing between the two, the report prefers PANW because its organic growth, recent large integrations, and next-fiscal-year segment disclosures could improve transparency; CRWD remains Market Perform.
- Risks
- The market already expects very strong guidance, so only modest acceleration could still disappoint.
- Zscaler (ZS)Zero-trust and secure access platform
- Strengths
- The business remains resilient, and the report sees upside based on fundamentals and growth multiples.
- Weaknesses
- Competition from Cloudflare and the impact of enterprise browsers constrain expansion opportunities among existing customers, while pressure on new customers and NRR is greater.
- Comparison
- The report maintains Outperform, but acknowledges the lack of clear catalysts.
- Risks
- Narrative pressure may persist, leaving the timing and path of stock improvement unclear.
- SentinelOne (S)Endpoint security and potential M&A target
- Strengths
- The report believes it has high strategic asset value and could attract acquirers at a premium.
- Weaknesses
- The company has repeatedly failed to meet expectations for reacceleration or relative outperformance.
- Comparison
- Outperform is driven mainly by strategic value and M&A optionality rather than short-term operating momentum.
- Risks
- If M&A expectations fail to materialize, insufficient fundamental momentum may limit stock performance.
- Cloudflare (NET)Cloud networking, security, and developer platform
- Strengths
- The report remains positive on Act I and Act II businesses, which also benefit from cloud momentum and competitive pull versus ZS.
- Weaknesses
- The report is skeptical about the visibility of commercialization for Act III Workers and Act IV.
- Comparison
- Valuation is high, but there is no clear catalyst for downward revision, so it remains Market Perform.
- Risks
- If market hopes for Workers and more distant businesses break down, valuation may come under pressure.
- Fortinet (FTNT)Cybersecurity hardware and software
- Strengths
- Near-term revenue growth is set up better than previously expected, driven by memory-cost pricing, network segmentation, and OT security demand.
- Weaknesses
- These tailwinds may be cyclical, and its long-term software expansion capability is more limited than PANW's.
- Comparison
- The report maintains Market Perform, arguing that its exposure to longer-term tailwinds is weaker.
- Risks
- Normalization in memory pricing and slower OT security buildout could lead to cyclical deceleration.
Key data
- Recent returns in hot software segmentsAbout 50%-80%+, with some cybersecurity names around 100%From early April to early June, valuations for cloud consumption infrastructure and cybersecurity rose rapidly, and the market has already priced in strong H2 momentum.
- Datadog Q1 revenue growth and bullish expectationsQ1 was 32% YoY; some investors expect 30% to 40%+ YoYThe report believes Datadog remains strong over the long term, but such H2 growth expectations are too high.
- Datadog customer mixAbout 85% of revenue comes from enterprise and SaaS customersThese customers will face very difficult year-over-year comps in Q4, and cloud projects may also be affected by capacity constraints and security hardening.
- Estimated AWS ex-AI revenue growthAbout 14% (Q2'25) rising to about 20% (Q1'26)The report uses this data to show that traditional cloud demand has indeed improved significantly over the past several quarters.
- Estimated AWS AI growth contribution+3.5 percentage points (Q2'25) rising to +8 percentage points (Q1'26)AI demand remains an important tailwind for cloud and upper-layer infrastructure, but the report focuses on whether it is enough to offset slowing traditional customers.
- Expected Q2'26 cloud-related revenue growthOverall revenue growth expected to improve by about 200-300bps versus Q1'26The report believes Q2 earnings may still extend the strength, but risks rise in H2, especially Q4.
- Cybersecurity sales cycleTypically 6-9 monthsLonger sales cycles and implementation requirements limit cybersecurity companies' ability to accelerate rapidly and materially.
- Hiring capacity benchmark for large organizationsAbout 25% gross new hires; net capacity growth in the low teens to mid-teensThe report uses this framework to explain why net new ARR in cybersecurity is unlikely to suddenly rise in a 'hockey-stick' fashion.
- ServiceNow rating and target priceOutperform, PT $236The report is positive on easier year-over-year comps in federal business for H2, broader adoption of Now Assist, and AI-driven demand.
- Atlassian rating and target priceOutperform, PT $295The report recommends buying after FQ4, arguing that Data Center accounting dynamics and AI disruption concerns will gradually be absorbed by the market.
- Datadog rating and target priceOutperform, PT $180More cautious in the short term after Q3, but constructive long term on platform breadth, product mix, and innovation around AI workloads.
- GitLab rating and target priceOutperform, PT $60The report believes 600bps+ growth deceleration pressure will bottom in H1 and gradually turn into a tailwind from Q4 to Q1 2027.
Impact & implications
The investment implication is to shift from chasing the strongest H1 momentum to assessing expectation gaps in H2. For cloud consumption infrastructure and cybersecurity, the report is not turning bearish on fundamentals, but rather warns that valuation and revenue guidance may already reflect overly high expectations. For application software, the report argues that the market had previously over-penalized AI disruption risk, and that if AI Labs narratives become more moderate and enterprise software companies deliver better product stories or more modelable financial paths, application SaaS could become a more attractive reversal trade in H2.
Risks
- H2 cloud consumption infrastructure growth may normalize due to flattening web indicators, insufficient cloud capacity, and rising prioritization of security hardening.
- Rapid growth among AI Labs and 'Born in AI' customers may slow, and if ARR, MAU, or web indicators at OpenAI and Anthropic continue to cool, the cloud and infrastructure demand narrative will weaken.
- Cybersecurity valuations already reflect strong demand, but sales cycles, implementation support, and channel capacity constraints may cause actual acceleration to fall short of investor expectations.
- Application software may have reversal opportunities, but AI disruption, seat compression, Data Center EOL, federal spending, and renewal pressure may still weigh on valuations.
- Some names lack clear catalysts, especially ZS and NET, so even if fundamental valuation upside exists, it may be hard to realize quickly.
What to watch
- Changes in AWS SSO web indicators at end-June, through Q3, and ahead of Q4, especially whether they continue to flatten or resume growth.
- Revenue growth, customer spending, and guidance in Q2 and Q3 earnings for consumption-based cloud software such as Datadog and Twilio.
- ARR, MAU, and web indicators for AI Labs such as OpenAI and Anthropic, to assess whether demand from AI-native customers continues to slow.
- Normalization of ServiceNow's federal business comps, conversion of Now Assist from pilots to deployment, and H2 contribution from consumption revenue.
- Post-FQ4 Data Center accounting impact for Atlassian, the CY27Q1 year-over-year trough, and whether the AI replacement narrative continues to ease.
- Whether GitLab's growth headwinds bottom in H1 and turn into a few percentage points of tailwind from Q4 to Q1 2027.
- PANW's next-fiscal-year segment disclosures and progress on large integrations, as well as whether CRWD ARR growth stabilizes at below about 25%.
- Whether hiring, channel capacity, quota attainment, and pricing gains at cybersecurity companies can support better-than-expected net new ARR.
- Where software stock valuations sit relative to Price to GAAP FCF and three-year revenue CAGR reversion, to judge whether H2 capital rotates from hot segments into application SaaS.