Cybersecurity: Cybersecurity demand is accelerating, but Bernstein sees sector valuations as largely full

Overview

This industry update examines whether strong cybersecurity demand, AI-related spending priorities and Flex licensing can justify the sector’s sharp re-rating. Bernstein accepts that the setup remains favorable and lifts valuation multiples, but argues that most covered shares now discount growth that is difficult to sustain; Zscaler is the principal exception.

Core views

Bernstein says its early-2026 positive cybersecurity thesis has played out strongly: AI-related demand indicators from its CISO and CIO surveys continued to improve, investor concern about AI labs offering cybersecurity products receded, and concern that cyber risk could slow AI-lab progress added to perceived demand support. Many covered cybersecurity stocks rose roughly 100% or more from the start of 2026, while investor crowding increased materially. The firm believes the demand backdrop is real, but its central conclusion is that the sector is now broadly fully valued. A key source of incremental growth is the spread of Flex contracts, effectively vendor site licenses allowing customers to consume products and services up to a contracted value. Bernstein argues this reduces customers' concern about making the wrong initial product choice, can speed the initial sale, and makes later upsells or cross-sells easier once customers discover additional needs. CrowdStrike is presented as the clearest case: Bernstein estimates re-Flex upsells added roughly $30-40 million of extra incremental ARR in the latest quarter beyond what its commercial capacity alone could have delivered. However, initial Flex sales still require normal selling effort, and future re-Flex opportunities are constrained by the installed base. The report cautions that cybersecurity differs from consumption-oriented infrastructure software. Cybersecurity priorities such as SSE/SASE, endpoint security, observability and communications/email security often scale with employee or endpoint counts, creating more natural ceilings than hyperscaler compute or databases. Network and cloud security are more linked to consumption growth, but even CrowdStrike's normalized "real" net-new ARR growth is estimated in the upper 20% range. With approximately 100% of CrowdStrike net-new ARR now on Flex and re-Flex deals beginning to lap, Bernstein believes growth may asymptote toward the high 20% range rather than the 40% or more apparently implied by its valuation multiple. Valuation is therefore the report's main tension. Bernstein finds a high correlation between next-twelve-month Rule of 40 and EV/Sales multiples, but says most covered names now trade close to or above regression-derived fair value even though its own Rule of 40 estimates are generally above consensus. Its revenue models remain well above sell-side expectations, yet still cannot support upside to prevailing valuations except for Zscaler. The firm nevertheless raises its sector regression and price-target multiples because demand is genuine, Flex improves growth headroom, and the market's cybersecurity valuation halo may not fade soon. It acknowledges that the revised targets are above its customary 25-35% premium to a growth DCF and expects that premium eventually to close, potentially taking more than a year. The revised target framework applies a 50/50 blend of P/next-twelve-month sales and unchanged DCF. Targets are $132 for CrowdStrike using 20x sales, up from 17x; $351 for Palo Alto Networks at 21x, up from 14x; $174 for Okta at 11x, up from 8x; $145 for Fortinet at 15x, up from 9x; $181 for Cloudflare at 17x, up from 16x; $25 for SentinelOne at 7x, up from 5.5x; and $298 for Zscaler at 14x, up from 9x. The DCF assumptions remain unchanged, with 10%-12% WACC and 3% terminal growth depending on the company. Palo Alto's model is the lone model revised, reallocating software-firewall revenue between Product and Subscription and NGS ARR, resulting in a few million dollars more quarterly revenue. Bernstein downgrades Palo Alto Networks, Okta and SentinelOne to Market-Perform because their shares trade near fair value with balanced upside and downside. Okta may have upside model-surprise potential through its role in AI-agent infrastructure, but the report says the timing of AI-agent scaling, pricing model and demand scale remain unclear. SentinelOne is viewed as the most attractive strategic takeout candidate, potentially for an AI lab, hyperscaler or cyber peer; its typical estimated takeout premium of roughly 30% to the growth DCF is still below the updated $25 target. CrowdStrike is described as technically and commercially strong, but its stock trades well above the sector regression; if it re-rates and capital remains in cybersecurity, Bernstein believes Palo Alto could benefit from fund flows because of its scale, AI exposure and NGS ARR profile. Zscaler is the one covered name with material upside and retains an Outperform rating. Bernstein attributes its deceleration primarily to an intentional shift from transactional, opportunity-based selling toward relationship-based selling designed to balance net-new customer additions with upsell and cross-sell. The three-year transformation began with sales-talent changes in FY25, followed by proof of the expansion motion in FY26, when net retention remained 115% and pipeline supported maintaining 115% through FY27. FY27 is focused on scaling net-new sales. Net-new contribution stopped falling in FQ4'26, and Bernstein expects it at least to stabilize, aided by the sales leader's record and AI-risk-driven SSE modernization priority. It notes competitive pressure from Cloudflare, but views Palo Alto, Microsoft and Fortinet as targeting largely different customer segments and sees considerable opportunity to migrate large enterprises from legacy web security and VPN products to SSE/SASE.

Analysis framework

Bernstein combines CISO and CIO demand-survey signals, company operating models, observed Flex-contract mechanics, and cross-sectional valuation regressions. It compares EV/Sales multiples with next-twelve-month Rule of 40 estimates, then blends revised P/NTM Sales multiples with unchanged growth-DCF outputs to set price targets and assess relative valuation.

Methodology notes

• Valuation methodsDCF (Discounted Cash Flow)

  Growth DCF valuation

  The report retains company-specific DCF assumptions, including 10%-12% WACC and 3% terminal growth, and blends each DCF result equally with a sales-multiple valuation.

• Valuation methodsPS valuation

  P/NTM Sales valuation

  Bernstein raises next-twelve-month sales multiples using a sector regression to reflect the market's higher valuation of cybersecurity growth.

• Quantitative, Factor, and Portfolio Theory

  EV/Sales versus NTM Rule of 40 regression

  The firm compares enterprise-value-to-sales multiples against projected next-twelve-month Rule of 40 to judge whether individual cybersecurity valuations are above or below regression-implied levels.

• Industry AnalysisSupply-demand framework

  Cybersecurity demand and commercial-growth analysis

  The report links AI-related security spending, product-adoption constraints, Flex licensing and customer scaling limits to the sector's possible revenue-growth path.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• Zscaler (ZS)

  The only covered name Bernstein identifies as having material upside and maintains at Outperform.

  Strengths

  Potential stabilization or improvement in net-new growth, sustained 115% NRR, SSE/SASE modernization opportunity and a maturing relationship-selling transition.

  Weaknesses

  Net-new customers became a small share of growth during the sales transition.

  Comparison

  Cloudflare is identified as a competitive pressure; Palo Alto, Microsoft and Fortinet are viewed as serving primarily different customer segments.

  Risks

  Recovery of investor confidence may take several quarters and depends on demonstrating stable growth.

• Palo Alto Networks (PANW)

  Downgraded to Market-Perform as trading valuation approaches fair value.

  Strengths

  NGS ARR exceeds CrowdStrike's ARR, with similar AI-demand tailwinds and higher organic net new and year-on-year growth according to the report.

  Weaknesses

  Limited valuation upside after re-rating.

  Comparison

  Bernstein expects PANW and CrowdStrike multiples to converge over time and sees PANW as a potential recipient of cybersecurity fund flows if CrowdStrike re-rates.

  Risks

  Potential dependence on a CrowdStrike de-rating for relative fund-flow support.

• CrowdStrike (CRWD)

  A Flex-contract case study, but the stock is viewed as trading above sector-regression expectations.

  Strengths

  Strong technical and commercial execution; re-Flex upsells are estimated to have added ~$30-40MM of incremental ARR.

  Weaknesses

  Valuation appears difficult to support relative to growth potential, even after Flex benefits.

  Comparison

  Trades well above sector regression expectations, whereas Palo Alto appears more in line.

  Risks

  Growth could settle in the high 20% range rather than the 40%+ apparently implied by valuation.

• Okta (OKTA)

  Downgraded to Market-Perform as valuation reaches fair value.

  Strengths

  Potential upside exposure to AI-agent infrastructure.

  Weaknesses

  The timing, pricing model and ultimate demand scale for AI-agent-related monetization remain unclear.

  Risks

  AI-agent commercial benefits may not exceed Bernstein's current model.

• SentinelOne (S)

  Downgraded to Market-Perform despite being viewed as the most attractive strategic takeout target.

  Strengths

  Potential fit for an AI lab, hyperscaler or cybersecurity peer.

  Weaknesses

  The ordinary estimated takeout premium is below the updated $25 target.

  Comparison

  Potential acquirers cited include Anthropic, Google and Palo Alto Networks.

  Risks

  Strategic-takeout potential is not presented as sufficient to support upside beyond the revised target.

• Fortinet (FTNT)

  Covered cybersecurity company receiving a higher valuation multiple and $145 target.

  Weaknesses

  The report sees most covered names, including Fortinet, as broadly fairly valued after re-rating.

  Comparison

  Viewed as targeting customer segments different from Zscaler's primary opportunity.

• Cloudflare (NET)

  Covered cybersecurity company receiving a higher valuation multiple and $181 target.

  Comparison

  Identified as a source of increased competitive pressure for Zscaler.

Key data

• Covered-stock performance~100%+Many covered cybersecurity names appreciated by this amount from the start of 2026.
• CrowdStrike re-Flex incremental ARR~$30-40MMBernstein estimate of extra incremental ARR in the latest quarter versus commercial capacity alone.
• CrowdStrike normalized net-new ARR growthUpper 20%Bernstein's estimate after adjusting for easier year-on-year comparisons.
• Zscaler net retention rate115%Remained strong through FY26; pipeline is expected to support 115% through FY27.
• Zscaler target price$298Based on a 50/50 blend of 14x P/NTM Sales and DCF; the sales multiple rises from 9x.
• Palo Alto Networks target price$351Based on a 50/50 blend of 21x P/NTM Sales and DCF; the sales multiple rises from 14x.
• Typical takeout premium for SentinelOne~30%Versus Bernstein's growth DCF; below the updated $25 target price.

Impact & implications

The report argues that cybersecurity's AI-driven demand and improved commercial execution justify higher valuation multiples in the near term, but do not validate the acceleration embedded in most share prices. It identifies Zscaler as the principal remaining valuation opportunity while viewing most other covered names as fairly valued after the sector re-rating.

Risks

• Cybersecurity growth may be constrained by endpoint and employee-based spending ceilings, limiting the acceleration implied in current valuations.
• Flex contracts reduce expansion friction but still require normal initial-sale effort and depend on the installed base for later re-Flex opportunities.
• Zscaler's sales transformation may take several quarters to restore investor confidence if net-new growth does not stabilize.
• Okta's AI-agent infrastructure opportunity has uncertain timing, pricing and demand scale.

What to watch

• CISO and CIO survey evidence on cybersecurity spending and AI-related security priorities.
• Whether Flex-contract expansion continues to add incremental ARR, particularly at CrowdStrike.
• Whether CrowdStrike's normalized net-new ARR growth remains near the upper 20% range or accelerates further.
• Zscaler's FY27 execution in rebuilding net-new customer growth while maintaining 115% NRR.
• The persistence or eventual closing of cybersecurity's valuation premium to Bernstein's growth-DCF framework.