Cybersecurity demand remains healthy, but an approximately 50% three-month rally has significantly raised the earnings bar

Overview

Drawing on the latest reseller survey and channel interviews, the report previews earnings for seven North American cybersecurity companies. It concludes that end demand and architectural modernization trends remain healthy, but sector share prices and valuations have risen rapidly, meaning market reactions will depend more on growth quality, forward guidance, and new-product monetization than merely on quarterly beats.

Core views

At the industry level, Morgan Stanley's channel checks show that the demand environment remains healthy, with the strongest momentum coming from firewall refreshes, advance purchases related to higher memory prices, and technical-debt replacement. SASE, endpoint security, and SecOps are also active, with larger deal sizes and broader multiproduct commitments, although overall sequential acceleration remains limited. Reported peer results also provide corroboration: FTNT product revenue grew 52% YoY, CSCO networking revenue grew 28% YoY, and FFIV systems revenue grew 32% YoY. Cybersecurity stocks have risen approximately 50% over the past three months, versus roughly 36% for the software sector, so merely “good” results may not be sufficient to drive share prices; the report expects most earnings releases could be followed by single-digit digestion. AI security revenue remains at an early stage, with key questions including sales cycles, contract duration, and pricing models. Feedback from Black Hat indicates that some customers are signing shorter-duration contracts as the AI security landscape continues to evolve. PANW is viewed as having one of the most favorable pre-earnings setups in the report. Channel feedback indicates that its partners are generally meeting or exceeding plan, and it was the strongest-performing vendor in on-site interviews. Firewall refreshes, Prisma SASE, software firewalls, Cortex XSIAM, identity, and AI security collectively support demand. Benefiting from greenfield AI-SOC projects and legacy SIEM replacement, XSIAM represents the clearest incremental growth driver outside the Network Security business. Prisma AIRS and Mythos currently contribute more to Unit 42 services and the sales pipeline. The report expects FQ4 RPO to be near or slightly above the high end of management's $20.9–21.0B guidance, representing approximately 33% YoY growth, with cRPO growth slightly above the market's roughly 28–29%. Product revenue growth is expected at approximately 22–23%, above the market's roughly 18–19%. Total revenue is expected to grow approximately 33% YoY, above management's roughly 32% guidance. NGS ARR is expected near the high end of the $8.90–8.95B guidance range, up approximately 60% YoY, while operating margin could reach roughly 30%. FY27 revenue growth guidance is expected at approximately 23–24%, above the market's roughly 21%, but the composition of growth is as important as the headline figure: CyberArk and Chronosphere contribute approximately $388M of revenue, approximately $1.6B of NGS ARR, and approximately $1.8B of RPO in FQ3, while organic NGS ARR and RPO grow 28% and 22%, respectively. Because FY27 includes more complete full-year contributions from both acquisitions, investors need to distinguish organic platform acceleration from M&A contributions. PANW has risen approximately 41% over the past three months and trades at roughly 57x CY27 EV/FCF, well above cybersecurity peers at approximately 25x. Therefore, strong quarterly results alone may not be sufficient; FY27 segment disclosures, FQ1 guidance, and the free-cash-flow margin will be more critical. The report reiterates OW. Demand for CRWD's Falcon platform remains broad, with healthy momentum across endpoint, Cloud Security, Identity, Next-Gen SIEM, MDR, Falcon Flex, and AI security. Next-Gen SIEM is particularly notable: CRWD can leverage existing Falcon endpoint telemetry without charging ingestion fees again for the same data, improving customers' total cost of ownership while enabling threat correlation, investigation, and response on a single platform. Falcon Flex is driving larger multiyear platform commitments and module expansion, but the central debate has shifted from total contract value to product activation, usage, and renewal quality. AIDR is viewed as an incremental AI security product, although its current contribution remains small; the survey of 35 resellers did not indicate sequential improvement. The report expects FQ2 NNARR of approximately $305M–$307M, 7–8% above the market-implied level and consistent with the beat cadence of the past four quarters. Revenue is expected to exceed the market by 1–2%, at approximately $1440, representing 23% YoY growth. Because the stock has already risen approximately 50% over the past three months, the report expects a typical beat could trigger modest digestion. Post-earnings performance will depend on the magnitude of the NNARR beat, the FQ3 ARR outlook, Flex activation, and management's confidence in full-year NNARR and ARR reacceleration. The report reiterates OW. ZS's core ZIA and ZPA businesses remain resilient, and the survey indicates continued positive net share gains relative to cybersecurity peers. However, the latest partner feedback is mixed, with reseller performance broadly in line with plan. The report has yet to see clear incremental acceleration from ZDX, Z-Flex, Data Security, AI Security, Zero Trust Everywhere, or Red Canary. The SASE market is increasingly shifting toward replacement of installed solutions, while customers are simultaneously evaluating integrated offerings from PANW, FTNT, NTSK, and others, and pricing pressure persists. The report expects FQ4 ARR growth of approximately 24–25% YoY, slightly above the market's roughly 24%, with NNARR of approximately $225M–$235M. Revenue is expected to come in slightly above management's $875M–$878M guidance. FY27 revenue and ARR growth guidance is expected at approximately 16–17%, broadly in line with the market. Given that ARR has exceeded expectations by an average of only approximately 0.4% over the past four quarters, while catalysts for platform monetization and organic reacceleration remain unclear, the report is unwilling to adopt a more positive stance ahead of earnings and reiterates EW and a $145 target price. OKTA's channel feedback remains positive sequentially, with partner performance generally in line with or slightly above expectations. In the survey, 91% of respondents said results met or exceeded expectations, up from 80% in the March survey. Partners also observed Okta pilots and trials for AI agents, as well as a larger OIG demand pipeline. The report expects cRPO of approximately $2,509M, up 10.8% YoY and 0.4% sequentially, below the three-year average seasonal increase of 2.7%. cRPO bookings are expected to grow 5.6%, a meaningful deceleration from 12.9% in Q1. Management may raise its full-year outlook in line with historical practice and put the company on a path to sustaining low-double-digit subscription and total revenue growth. However, the stock has risen approximately 45% over the past three months, versus 22% for large-cap software companies, 38% for PANW, and 14% for CRWD, so the near-term earnings catalyst may be limited. A truly meaningful reacceleration is more likely to be an FY28 event. The report reiterates OW and a $180 target price. SAIL's partners are generally performing in line with to slightly above expectations, migration activity continues to increase, and there have been two six-figure ACV deals and one seven-figure ACV deal involving customers in healthcare, manufacturing, and financial services. At its analyst day, the company outlined a path to more than $2.1B of ARR by FY29, but following a weak initial full-year outlook, investors still need more meaningful upside to results and progress in agentic products. The midpoint of management's Q2 total ARR guidance and market expectations are both approximately $1,220M, representing 24% YoY growth and 5.0% sequential growth, below the three-year average of 6.6%, with NNARR of approximately $57M, flat YoY. The report believes the company needs to carry the quarterly beat through to full-year guidance to preserve a path toward maintaining approximately 25% total ARR growth in FY27. SAIL trades at approximately 7x EV/CY27 sales, below cybersecurity peers at roughly 10x. The report reiterates OW and a $22 target price, but emphasizes that ARR performance must exceed the guidance midpoint by meaningfully more than the approximately 1% average of the past four quarters to bolster confidence. SentinelOne's near-term setup is improving. The latest checks show stronger net-new pipeline generation, broader Singularity adoption, and sustained interest in Purple AI. Some partners are above plan and cite healthy momentum in Singularity XDR, AI SIEM, Data, Cloud, MDR, and Purple AI. Its flexible business model and lower pricing appeal to cost-sensitive customers, enabling it to participate at a lower valuation in the endpoint, SIEM, and AI security themes benefiting CRWD. Emerging solutions accounted for approximately 50% of ARR in FQ1. The report expects FQ2 NNARR to be slightly above the market's roughly $50M, with ending ARR of approximately $1.21B, up approximately 21% YoY. Revenue is expected to be slightly above the $289M–$291M guidance range, up approximately 20% YoY, and operating profit could also exceed the $23M–$25M guidance range. However, a more durable rerating will require consecutive NNARR growth, progress with large enterprise customers, sustained share gains relative to CRWD and Microsoft, and profitable platform expansion. The report reiterates EW and a $17 target price. Netskope's survey and channel feedback improved sequentially, with healthy demand across SSE/SASE, CASB and data security, SD-WAN, and AI-related pipelines. Netskope One, NewEdge, and Zero Trust Engine are differentiated in protecting AI usage by leveraging more granular data context and real-time policy controls. However, the financial contribution from AI products remains early, and partner feedback is more indicative of defending share and winning selectively than broadly taking the market. The report expects FQ2 ending ARR of approximately $895M–$900M, with YoY growth slightly above the market's roughly 26%, implying NNARR of approximately $50M–$55M, above the market's roughly $47M–$49M. Revenue is expected at approximately $217M–$219M, above management's $213M–$215M guidance. Quarterly upside is expected to flow primarily into FY27 revenue guidance of $879M–$883M, but the true inflection may come in FQ3, when investors will need to assess whether sales representatives added in 2H FY26 can improve new-customer acquisition, sales productivity, and NNARR conversion. The report reiterates OW and a $14 target price. Overall, Morgan Stanley tactically favors PANW, S, and OKTA, expects solid but largely anticipated results from CRWD and SAIL, and is waiting for clearer platform monetization or growth inflection points from ZS and NTSK. The long-term cybersecurity opportunity remains positive, but near-term returns depend more on growth quality and guidance credibility amid elevated expectations.

Analysis framework

The report first assesses the strength of cybersecurity demand through reseller surveys, on-site partner interviews, and reported peer results, then analyzes product momentum, competitive positioning, deal sizes, and sales pipelines by company. It subsequently maps channel evidence to ARR, NNARR, RPO, cRPO, revenue, margins, and full-year guidance, while incorporating recent share-price performance and forward valuation multiples to determine whether a quarterly beat would be sufficient to serve as a catalyst. For PANW, the report also specifically distinguishes organic platform growth from contributions related to the CyberArk and Chronosphere acquisitions.

Methodology notes

• (Method Outside the Vocabulary)

  Reseller Surveys and Channel Checks

  The report tracks customer demand, sales pipelines, share shifts, deal sizes, and product momentum through reseller questionnaires and partner interviews, using these frontline signals to validate expectations for company results and guidance.

• Industry/Sector Analysis FrameworkVolume-price decomposition

  Decomposition of ARR, NNARR, Revenue, and Contract Quality

  Rather than examining revenue growth alone, the report distinguishes new ARR, existing ARR, contract duration, product activation, and renewal quality to determine whether growth reflects genuine usage, advance purchases, acquisitions, or changes in contract structure.

• Valuation Method

  Forward EV/FCF and EV/Sales Peer Comparison

  The report compares PANW's CY27 EV/FCF and SAIL's CY27 EV/Sales with cybersecurity peers to assess the extent to which good results are already priced in, rather than using these metrics to recalculate target prices.

• Event-Driven Trading and Behavioral FinanceExpectation Gap/Expectation Management

  Comparison of Earnings Beat Magnitude with the Market Bar

  The report compares forecasts with consensus expectations, management guidance, the historical cadence of beats, and recent share-price gains to determine whether earnings results can exceed elevated investor expectations.

• Competition and Strategy FrameworkMoat / competitive advantage

  Platform Capabilities, Pricing, and Architectural Differentiation

  The report compares vendors' platform integration, data architecture, product breadth, total cost of ownership, and pricing power, including CRWD's cost advantage from reusing endpoint telemetry and Netskope's differentiation through real-time policy controls.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• Palo Alto Networks (PANW)

  Benefits from firewall refreshes, SASE, XSIAM, platformization, and potential upside to FY27 guidance.

  Strengths

  Strong channel performance, expanding multiproduct contracts, and healthy momentum in Network Security and Cortex.

  Weaknesses

  High valuation and significant recent share-price appreciation, while cloud security is more likely to stabilize than reaccelerate.

  Comparison

  Approximately 57x CY27 EV/FCF, above cybersecurity peers at approximately 25x.

  Risks

  FY27 growth may be driven more by full-year M&A contributions from CyberArk and Chronosphere than by organic platform acceleration.

• CrowdStrike (CRWD)

  Benefits from endpoint modernization, Next-Gen SIEM, Falcon Flex, and AI security demand.

  Strengths

  Reuse of Falcon telemetry improves total cost of ownership, while the product platform offers broad coverage.

  Weaknesses

  The reseller survey did not indicate sequential improvement, and good results are already largely reflected in expectations.

  Comparison

  SentinelOne participates in similar endpoint, SIEM, and AI security themes at a lower price and valuation.

  Risks

  If Flex contracts fail to translate into activation, usage, and high-quality renewals, the value of platform commitments may be questioned.

• Zscaler (ZS)

  Core ZIA/ZPA remains resilient, but a clear next growth engine is still lacking.

  Strengths

  Shows positive net share gains relative to cybersecurity peers, with an attractive long-term AI security roadmap.

  Weaknesses

  Limited platform monetization, persistent SASE pricing pressure, and longer sales cycles.

  Comparison

  Customers are evaluating broader integrated offerings from PANW, FTNT, NTSK, and others.

  Risks

  If upside comes mainly from the core business or Red Canary, the debate over organic reacceleration will remain unresolved.

• Okta (OKTA)

  Positive channel feedback and improving pipelines for AI agent identity and OIG enhance the near-term setup.

  Strengths

  91% of survey respondents said performance met or exceeded expectations, and there is room to raise full-year guidance.

  Weaknesses

  cRPO bookings are expected to decelerate meaningfully, while major reacceleration is more likely in FY28.

  Comparison

  Up approximately 45% over the past three months, versus approximately 22% for the large-cap software group.

  Risks

  Recent share-price outperformance has raised earnings expectations, potentially limiting the quarterly catalyst.

• SailPoint (SAIL)

  Identity migrations and large deals support Q2, but more meaningful ARR upside is needed to build confidence.

  Strengths

  Positive channel checks, a valuation below cybersecurity peers, and a FY29 ARR target above $2.1B.

  Weaknesses

  Q2 NNARR is expected to be flat YoY, while agentic products still need greater traction.

  Comparison

  Approximately 7x EV/CY27 sales, below cybersecurity peers at roughly 10x.

  Risks

  If the total ARR beat and its flow-through to full-year guidance are insufficient, the path to sustaining approximately 25% growth in FY27 may lack credibility.

• SentinelOne (S)

  Improvements in the pipeline, Purple AI, and non-endpoint products create a favorable near-term setup.

  Strengths

  A flexible business model, lower pricing, and emerging solutions already accounting for approximately 50% of ARR.

  Weaknesses

  There is still insufficient sustained evidence of large-enterprise wins and market-share gains.

  Comparison

  Participates in the endpoint, SIEM, and AI security themes covered by CRWD at a lower customer cost and valuation.

  Risks

  If competitive intensity and sales execution remain inconsistent, the long-term rerating may be constrained.

• Netskope (NTSK)

  SASE, data security, and AI-related pipelines are healthy, but the NNARR inflection is more likely in FQ3.

  Strengths

  Netskope One, NewEdge, and Zero Trust Engine offer differentiation through data context and real-time policy controls.

  Weaknesses

  The financial contribution from AI products remains early, while sales productivity and NNARR have recently slowed.

  Comparison

  Current feedback is more consistent with defending share and winning selectively than broadly taking the market.

  Risks

  If new sales representatives fail to convert pipeline effectively in 2H FY27, the anticipated NNARR reacceleration may be delayed.

Key data

• Cybersecurity stock performance over the past three monthsApproximately +50%The software sector rose approximately +36% over the same period, thereby raising the earnings bar.
• PANW FQ4 RPOAt or slightly above the high end of $20.9–21.0B guidance, approximately +33% YoYcRPO growth is expected to be slightly above the market's roughly 28–29%.
• PANW FQ4 product revenue growthApproximately 22–23% YoYAbove the market's roughly 18–19%.
• Expected PANW FY27 revenue growth guidanceApproximately 23–24%Above the market's roughly 21%, but organic growth must be distinguished from M&A contributions.
• PANW valuationApproximately 57x CY27 EV/FCFCybersecurity peers trade at approximately 25x.
• Expected CRWD FQ2 NNARR$305M–$307M7–8% above the market-implied level.
• Expected ZS FQ4 ARR and NNARRARR approximately +24–25% YoY; NNARR approximately $225M–$235MThe core business is solid, but evidence of platform monetization remains limited.
• Expected OKTA cRPO$2,509M, +10.8% YoY+0.4% sequentially, below the three-year average seasonal increase of +2.7%.
• Expected SAIL Q2 total ARR$1,220M, +24% YoYEquivalent to +5.0% sequential growth, with NNARR of approximately $57M.
• Expected SentinelOne FQ2 ending ARRApproximately $1.21B, +21% YoYNNARR is expected to be slightly above the market's roughly $50M.
• Expected Netskope FQ2 ending ARRApproximately $895M–$900MNNARR of approximately $50M–$55M, above the market's roughly $47M–$49M.
• Okta channel survey91%Respondents said performance met or exceeded expectations, versus 80% in the March survey.

Impact & implications

The report believes that resilient cybersecurity spending, an intensifying threat environment, and architectural modernization continue to support the industry's long-term opportunity. However, near-term market reactions have shifted from “whether demand is healthy” to “whether growth exceeds higher expectations, possesses organic quality, and can be sustained.” Consequently, advance firewall purchases or a typical earnings beat may not be sufficient to drive highly valued companies; guidance that clarifies the composition of FY27 growth, product activation, sales productivity, and the commercialization path for AI security will be more impactful.

Risks

• Cybersecurity stocks have risen significantly over the past three months, with valuations above long-term averages, so a typical earnings beat could trigger a single-digit pullback or digestion.
• AI security revenue remains at an early stage, and sales cycles, contract duration, and pricing models have yet to stabilize.
• Advance firewall purchases may pull forward future demand, and upside driven solely by hardware may not generate a sustained market response.
• SASE competition and pricing pressure may limit the share gains and monetization pace of companies such as ZS and NTSK.
• PANW's M&A contributions may obscure organic growth quality, while a high hardware mix and component costs could also constrain margin upside.
• If CRWD's multiyear Falcon Flex commitments fail to translate into activation, usage, and high-quality renewals, the sustainability of growth may be questioned.
• SentinelOne's large-enterprise customer acquisition and Netskope's sales productivity require validation over more consecutive quarters.

What to watch

• Watch PANW's FY27 revenue guidance, Network Security/Cortex/Identity segment disclosures, and organic NGS ARR and RPO.
• Watch the magnitude of CRWD's NNARR beat, the FQ3 ARR outlook, Falcon Flex activation, and renewal quality.
• Watch whether ZS can demonstrate platform monetization beyond ZIA/ZPA and alleviate SASE pricing pressure.
• Watch OKTA's cRPO, cRPO bookings, full-year guidance raise, and AI agent identity product pipeline.
• Watch whether SAIL's total ARR and NNARR meaningfully exceed expectations and flow through to the full-year outlook.
• Watch SentinelOne's progress with large enterprise customers, consecutive NNARR growth, and profitable platform expansion.
• Watch whether Netskope's FQ3 guidance can confirm improvements in productivity, new customers, and NNARR driven by new sales representatives.
• Watch AI products' sales cycles, contract duration, pricing methods, and actual revenue contributions.