Channel Survey Indicates Divergent Cybersecurity Demand, with Palo Alto Networks Most Resilient
AI summary card
Channel Survey Indicates Divergent Cybersecurity Demand, with Palo Alto Networks Most Resilient
Survey results from 51 channel partners show that, while customer budgets are growing, innovation cycles, hardware price increases, and services investment are delaying new-tool purchases; focus on PANW's cross-platform strength while remaining cautious on names with elevated valuations or weakening channel momentum.
- PANW and CYBR are the vendors showing the clearest improvement in channel performance. PANW is expected to exceed expectations on revenue, NGS ARR, and profit metrics at the end of FY26, while providing FY27 guidance at least in line with market expectations.
- CRWD's channel signals for new business remain stable, with NG SIEM and Falcon Cloud Security standing out, but its valuation of roughly 100x CY27 free cash flow means the market has a high bar for upside.
- Channel performance for Netskope and SentinelOne is weak, and the report downgrades both to Hold; Okta's net channel outperformance is negative and its Hold rating is maintained.
- Higher hardware and component prices, customer prioritization of hardware purchases, and increased services and implementation spending could all weigh on near-term purchases of new software tools.
Report interpretation
Overview
Based on a survey of 51 cybersecurity resellers conducted with dbDIG, Deutsche Bank provides a preview of cybersecurity companies reporting earnings on an off-cycle basis. The survey indicates that industry demand is not accelerating universally: there is a lag between increased budgets and actual spending on new tools, while customers are also affected by rapid innovation, rising hardware costs, and increased services investment.
Core views
Palo Alto Networks is the standout company this quarter, with channel feedback indicating healthy platform demand and strong momentum in cybersecurity, Prisma SASE, and CyberArk-related identity security. CrowdStrike's execution remains stable, with notable improvement in NG SIEM and Falcon Cloud Security, though its high valuation limits room for error. New-business signals for Netskope, SentinelOne, and Okta are relatively weak or mixed, requiring stronger upside results to support near-term share-price performance.
Analysis framework
The analysis centers on the net percentage of channel partners exceeding quarterly targets and its sequential change, cross-checked against channel incentives, sales outlook for the next twelve months, management guidance methodology, consensus expectations, acquisition contributions, and valuation.
Methodology notes
Net Channel Outperformance
Compares the proportion of channel partners exceeding quarterly targets with those falling below targets, and tracks sequential and four-quarter-average changes to assess new-business momentum.
Earnings Upside Potential
Derives implied incremental business demand from company guidance midpoints for revenue, ARR, RPO, and profit, then compares it with survey findings and market expectations.
Valuation Threshold
Uses forward free-cash-flow multiples to assess the growth expectations already priced in by the market; Netskope's target price is based on DCF valuation.
Asset mapping & comparison
Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).
- Palo Alto Networks (PANW)Core Recommended Name
- Strengths
- Strong channel demand; healthy momentum in the cybersecurity platform, Prisma SASE, and CyberArk identity security; advantages in acquisition integration, AI security, and market-share gains.
- Weaknesses
- FY27 growth expectations partly depend on acquisition contributions; the organic NGS ARR growth target remains challenging.
- Comparison
- Relative to most peers, PANW is among the vendors with the clearest improvement in channel performance and is designated the top cybersecurity pick.
- Risks
- Hardware-demand volatility, weaker-than-expected acquisition integration, and RPO or organic ARR growth falling short of market expectations.
- CrowdStrike (CRWD)Covered Name
- Strengths
- Improving channel performance in NG SIEM and Falcon Cloud Security; positioned to capture incremental AI security spending over the long term.
- Weaknesses
- Channel outperformance declined slightly sequentially; valuation is approximately 100x CY27 free cash flow.
- Comparison
- Fundamental signals are more resilient than those of SASE and zero-trust vendors, but valuation pressure is higher than for most peers.
- Risks
- Insufficient upside in incremental ARR, overly high market expectations for accelerating AI demand, and changes in cloud-security competition.
- Netskope (NTSK)Covered Name
- Strengths
- Strong technology capabilities, including leading API/JSON inspection and data-security capabilities.
- Weaknesses
- Channel survey results are weak, and the stability of productivity following sales-representative expansion remains to be proven.
- Comparison
- Channel momentum is materially weaker than PANW's, with only 25% of surveyed channel partners exceeding targets.
- Risks
- Further deterioration in sales productivity, intensified SASE competition, and earnings upside insufficient to support the share price.
- Okta (OKTA)Covered Name
- Strengths
- Has a long-term beneficiary thesis through “Okta for AI Agents,” while management guidance is typically conservative.
- Weaknesses
- Net channel outperformance is negative, and momentum in products beyond IAM weakened sequentially.
- Comparison
- Channel performance trails PANW and CRWD, with insufficient evidence of near-term growth reacceleration.
- Risks
- No improvement in ACV growth, weaker-than-expected cross-selling of enterprise products, and Auth0 facing competition from open-source alternatives.
- SentinelOne (S1)Covered Name
- Strengths
- Cloud-security traction has improved.
- Weaknesses
- AI-SIEM momentum has slowed, and net channel outperformance declined sequentially.
- Comparison
- Survey results do not support significant upside and are weaker than those for platform vendors such as PANW.
- Risks
- Conservative new-business guidance, weaker AI-SIEM demand, and growth and profitability improvement falling short of expectations.
- Rubrik (RBRK)Covered Name
- Strengths
- Expanded product adoption and workload coverage are expected to support continued growth.
- Weaknesses
- Channel performance is mixed, and higher hardware prices may affect near-term demand.
- Comparison
- Fundamentals are stronger than those of some peers with weak channel performance, but near-term demand visibility is limited.
- Risks
- Rising hardware costs, insufficient upside in subscription ARR, and a limited magnitude of FY27 guidance increases.
Key data
- Survey Sample51 cybersecurity resellersConducted in partnership with dbDIG.
- CrowdStrike F2Q ARR Guidance Midpoint$5,794m, up 24.4% year over yearCorresponds to implied NNARR of $285m, up 28.9% year over year.
- CrowdStrike F2Q Revenue Guidance Midpoint$1,439m, up 23.1% year over yearActual revenue is expected to exceed the guidance midpoint by approximately the mid-to-high single-digit tens of millions of dollars.
- Netskope Channel Outperformance Rate25%Below the 43% average for the coverage group.
- Okta F2Q cRPO Guidance Midpoint$2,510m, up 10.8% year over yearExpected to exceed the guidance midpoint by approximately 1.5% to 2%.
- Palo Alto Networks F4Q NGS ARR Guidance$8,925m, up 60% year over yearImplies NNARR of $795m, including undisclosed acquisition contributions.
- Netskope Target Price$17Raised from $16, with the rating downgraded to Hold.
Impact & implications
The industry remains a long-term beneficiary of security demand in the AI era and platform consolidation, but near-term investment returns will depend more on differences in execution across companies. PANW has the conditions to continue outperforming due to its platform breadth, acquisition-integration capabilities, and AI security positioning; CRWD must deliver sufficiently strong incremental ARR performance to support its high valuation. For Netskope, SentinelOne, and Okta, investors should await clear improvement in sales productivity, platform-product penetration, or core contract value growth.
Risks
- Growth in cybersecurity budgets may not translate promptly into software-tool purchases.
- Higher hardware and component prices may crowd out customer budgets for software purchases.
- The AI security theme has driven significant gains in certain names, resulting in elevated valuations and expectations.
- Acquisition contributions, integration progress, and business-segment reclassifications may increase the difficulty of earnings comparability and forecasting.
- The channel survey sample is limited and may not fully represent end-market demand.
What to watch
- Whether PANW's initial FY27 guidance for revenue, NGS ARR, RPO, and operating margin is at least in line with market expectations.
- Whether CRWD's NNARR, Falcon Cloud Security, and NG SIEM performance are sufficient to support its high valuation.
- Whether Netskope sales-representative productivity stabilizes and NNARR reaches an approximately $10m upside threshold.
- The direction of Okta's ACV growth, demand for identity-governance and privileged-access products, and the competitive environment for Auth0.
- Changes in customer budget allocation among new tools, hardware, and implementation services.