North American cybersecurity software investor feedback: Cybersecurity demand remains necessary amid AI risks, but high platform valuations are broadening investor interest to Okta and Fortinet.

Overview

This Morgan Stanley software-industry feedback note examines investor reactions to its AI-cybersecurity work. It concludes that cybersecurity demand and platform share-gain prospects remain constructive, but stretched valuations are causing investors to seek exposure through comparatively cheaper names, particularly Okta and Fortinet.

Core views

Investor feedback broadly supported Morgan Stanley’s view that rising AI safety concerns should accelerate cybersecurity demand and favor broad platforms such as Palo Alto Networks and CrowdStrike. The institution notes that reports of jailbreaks and malicious autonomous-agent behavior reinforce the necessity of cyber spending. Its central spending framework ranks three scenarios from most to least likely: a Status Quo case, an Accelerated Spend/Catch-up case, and a case in which cyber cannot catch breaches and spending slows more broadly. Investors generally regarded the Status Quo as most likely, implying a gradual spending ramp and approximately 20%+ market growth. Morgan Stanley believes investors without existing exposure are more inclined toward the bear case, but expects sidelined investors and short covering to support the theme near term. The main constraint is valuation. Investors viewed CrowdStrike at 30x 2028 sales and Palo Alto Networks at 18x as stretched, with substantial market-growth and share-gain acceleration already reflected in their prices. Consequently, investor discussions increasingly shifted to Okta and Fortinet, and less often SentinelOne and SailPoint. Morgan Stanley characterizes Okta as a potential secular beneficiary of agentic identity, although it expects the opportunity to build gradually; nearer-term progress is tied to addressing technical debt. For Fortinet, the report sees product growth accelerating as technical debt is addressed, but remains negatively biased because difficult comparisons and a potentially stronger COVID-era refresh next year may constrain outperformance. It also flags read-through from Fortinet’s outcome to the broader firewall group, including Cisco and Check Point. Morgan Stanley raises Okta’s price target to $245 from $200 and maintains Overweight after Oktane. The revision reflects AI-related announcements including Agent SSO, A2A connections and the Blueprint Alliance, management’s view that identity and access management could become cyber’s largest market within five years because of agentic demand, and a broader identity-modernization opportunity. The target is based on raising the CY27 FCF multiple to 41x from 33x, implying 12.0x CY27 sales versus 9.6x previously. The institution argues this places Okta’s EV/Sales/g at about 1.2x, in line with platforms and above 0.8x for broader cyber software, to reflect its positioning and potential growth reacceleration. For Okta’s base case, Morgan Stanley forecasts 10% two-year revenue CAGR to $3.5 billion by CY27, a 29% FCF margin and $1.037 billion of CY27 FCF. Applying 41x EV/FCF produces a $245 valuation, or about 12x EV/CY27 sales. The bull case assumes stronger leadership and share gains in identity management, 13% two-year revenue CAGR to $3.7 billion, a 29% FCF margin and $1.094 billion FCF; 46x EV/FCF produces a $285 valuation. The bear case assumes competition from larger vendors limits growth, yielding 9% CY25e–CY27e revenue CAGR, $3.4 billion of CY27 revenue, a 29% FCF margin and $1.008 billion FCF; 23x EV/FCF produces a $145 valuation. CrowdStrike remains Morgan Stanley’s long-term platform-share-gain case. The report expects ongoing endpoint share gains, adoption of SIEM, identity protection and cloud-security modules, and favorable AI positioning to sustain 20%+ long-term topline growth. It sees durable 25%+ FCF CAGR over the next three years from platform traction, GenAI momentum and EBIT improvement. The $254 target uses 64x CY30e FCF of $5.44 billion discounted at 12%, implying roughly 36x EV/CY27 sales. Its detailed base case assumes CY30 ARR of $13.9 billion, a 22% five-year CAGR; CY30 revenue of $12.2 billion, a 21% five-year CAGR; operating margin rising from 22% in CY23 to 37% in CY30; and $5.48 billion of FCF. The bull and bear valuations are $308 and $103, respectively, under differing growth, margin and valuation-multiple assumptions.

Analysis framework

Morgan Stanley combines investor-feedback discussions with scenario analysis for cybersecurity spending, company operating forecasts, and risk-reward valuation cases. For Okta it applies CY27 free-cash-flow and sales multiples; for CrowdStrike it applies CY30 free-cash-flow multiples discounted back at 12%, with bull, base and bear outcomes informed by options-implied probabilities.

Methodology notes

• Industry AnalysisSupply-demand framework

  Cybersecurity-spending scenarios

  The report compares status-quo, accelerated catch-up, and cyber-slowdown scenarios to explain prospective market-growth paths and investor positioning.

• Valuation methodsEV/EBITDA valuation

  Free-cash-flow multiple valuation

  The report values Okta and CrowdStrike using enterprise-value-to-free-cash-flow multiples; CrowdStrike’s CY30 value is discounted back at 12%.

• Event-Driven and Behavioral FinanceEvent-driven analysis

  Risk-reward bull, base and bear cases

  The report uses alternative operating and valuation outcomes, with options-implied probabilities referenced for the risk-reward presentation.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• Okta, Inc. (OKTA.O)

  Covered cybersecurity and identity-management company; identified as a beneficiary of agentic identity.

  Strengths

  Large estimated TAM of more than $40 billion, identity-market share gains, identity modernization, and potential 15–20% FCF CAGR over the next few years.

  Weaknesses

  Growth acceleration is expected to occur gradually, with nearer-term progress tied to resolving technical debt.

  Comparison

  Its ~1.2x EV/Sales/g is aligned with cyber platforms and above the broader cyber-software group’s 0.8x.

  Risks

  Broader security-spending slowdown, competition from larger vendors including Microsoft, and slower resolution of execution issues.

• CrowdStrike Holdings Inc. (CRWD.O)

  Covered cybersecurity platform company with an Overweight thesis.

  Strengths

  Endpoint share gains, emerging-module uptake, favorable AI positioning, and expected durable 25%+ FCF CAGR over the next three years.

  Weaknesses

  Premium valuation is already pricing meaningful market-growth and share-gain acceleration.

  Comparison

  The target multiple implies a premium to large-cap SaaS/security peers.

  Risks

  Tougher customer acquisition from competition, lower-cost alternatives, and a softer hiring environment that pressures upsell activity.

• Fortinet (FTNT)

  Company investors are examining as a lower-valued cyber exposure.

  Strengths

  Product growth has accelerated as customers address technical debt.

  Weaknesses

  Morgan Stanley is negatively biased owing to difficult comparisons and uncertainty around the refresh cycle.

  Comparison

  Considered alongside Okta as an alternative to the more expensive core platforms.

  Risks

  Potentially difficult comparisons and uncertain durability of refresh-driven demand.

Key data

• Cyber market growth in most-likely scenario~20%+Morgan Stanley’s Status Quo scenario assumes a gradual ramp in cyber spending.
• Okta price target$245 from $200Target raised after Oktane; Overweight maintained.
• Okta base-case CY27 revenue$3.5B10% two-year revenue CAGR.
• Okta base-case CY27 FCF$1.037B29% FCF margin; valued at 41x EV/FCF.
• CrowdStrike target price$254Based on 64x CY30e FCF discounted at 12%.
• CrowdStrike base-case CY30 ARR$13.9B22% five-year CAGR.
• CrowdStrike base-case CY30 revenue$12.2B21% five-year CAGR.
• CrowdStrike base-case CY30 FCF$5.48BOperating margin forecast to rise from 22% in CY23 to 37% in CY30.

Impact & implications

Morgan Stanley’s feedback suggests investors still see cybersecurity as an important AI-linked spending theme, but platform valuations may shift incremental attention toward lower-valued alternatives. Okta is positioned as an agentic-identity beneficiary, while CrowdStrike’s premium is tied to continued platform adoption, AI positioning and margin expansion.

Risks

• For Okta, broader security spending could slow materially, competition from larger vendors such as Microsoft could intensify, or execution issues could take longer to resolve.
• For CrowdStrike, competition could impede new-customer acquisition, lower-cost alternatives could commoditize premium pricing, and softer hiring could reduce upsell activity.
• Morgan Stanley’s cyber bear scenario assumes a major breach that vendors may be unable to catch, accompanied by a broader cybersecurity slowdown.

What to watch

• The pace of cybersecurity-spending acceleration and whether the Status Quo scenario of roughly 20%+ market growth holds.
• Evidence that agentic-identity demand, identity modernization and Okta’s newer AI-related offerings are accelerating.
• Fortinet’s product-growth durability through difficult comparisons and the next-year refresh cycle.
• CrowdStrike endpoint demand, emerging-module adoption, AI momentum, margin improvement and upcoming earnings.