AI Strengthens Cybersecurity Demand, but Growth Elasticity Will Be Highly Divergent
AI summary card
AI Strengthens Cybersecurity Demand, but Growth Elasticity Will Be Highly Divergent
Bernstein believes industry demand is strong but already fully reflected in high valuations, prioritizing OKTA and PANW, which has potential for a sharp demand inflection, while remaining cautious on the growth, catalysts, or valuations of CRWD, ZS, S, NET, and FTNT.
- AI accelerates attacks, social engineering, and vulnerability exploitation, driving demand for identity, data protection, application security, operational technology security, and real-time threat response.
- Most enterprise security products require lengthy sales cycles, proofs of concept, and manual deployment, making cloud-consumption-like steep growth unlikely in the near term.
- Firewalls and distributed denial-of-service protection can scale with data center bandwidth, cloud containers, and software-as-a-service applications, making network security the most likely area to achieve growth acceleration.
- OKTA is listed as the current top pick, and PANW is preferred in the relative choice between PANW and CRWD.
- Sector valuations are expensive and positioning is crowded; if results remain merely solid without meaningful acceleration, share prices may face an expectations gap.
Report interpretation
Overview
This report reviews the non-cyclical earnings takeaways for U.S. small- and mid-cap software cybersecurity companies and the earnings outlook for the coming weeks. The core view is that artificial intelligence both expands the attack surface and increases attack speed and social engineering capabilities, thereby supporting security budgets; however, buyers are still uncertain about the long-term winners and may shorten contract durations while trialing venture-backed startups. Strong industry demand does not mean revenue can steepen rapidly, because sales, testing, deployment, and operations all face significant human-capital bottlenecks.
Core views
Near-term security spending will focus on defending against AI-enhanced attacks and securing AI agents and human-machine collaborative applications, including application security testing and patching, operational technology modernization, identity threat detection and response, identity management, data protection, access governance, and email security. By contrast, security information and event management, security service edge, and secure browsers ranked lower in survey priorities, and new customer acquisition may come under pressure. Network security has greater growth elasticity because pricing and demand can scale with infrastructure size. At the stock level, OKTA is the top pick, with PANW preferred over CRWD on a relative basis; ZS has valuation upside but lacks clear catalysts, S’s investment case depends heavily on a potential acquisition, while NET and FTNT face valuation and growth sustainability issues, respectively.
Analysis framework
The report combines CIO and CISO surveys, buy-side discussions, webinars, disclosed quarterly results, product-category demand, commercialization and deployment friction, competitive dynamics, and valuation for a cross-sectional comparison, while distinguishing between products that can naturally expand with infrastructure usage and those that depend on enterprise sales and implementation processes.
Methodology notes
Budget Priorities and Purchase Intentions
Uses surveys and buy-side discussions to identify priorities in AI security, identity, data protection, application security, and operational technology security, while assessing contract duration, new-vendor trials, and willingness to purchase from new customers.
Speed of Demand-to-Revenue Conversion
Compares low-friction, self-service adoption and usage-based expansion in cloud infrastructure with enterprise security products that require sales, proofs of concept, competitive testing, deployment, and ongoing operations to determine whether growth can accelerate sharply.
Scale Sensitivity of Network Security
Analyzes how physical and virtual firewalls and distributed denial-of-service protection naturally expand as data center bandwidth, cloud containers, and software-as-a-service applications go into production.
Fundamental Value and Market Narrative
For ZS, the report references both free cash flow after stock-based compensation and growth multiples, and combines sector crowding, catalysts, and expectation gaps to assess the path to the target price.
Asset mapping & comparison
Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).
- OKTACurrent Top Pick
- Strengths
- Identity and customer identity management are supported by the adoption of AI agents, partnerships with Anthropic and OpenAI strengthen the market narrative, and the baseline growth rate is expected to recover mechanically.
- Weaknesses
- No upside is shown between the target price and the 2026-08-07 table closing price; the investment case depends on growth acceleration driving a re-rating.
- Comparison
- Receives the clearest near-term buy expression among the covered names.
- Risks
- AI identity demand materializes below expectations, partnership narratives do not translate into revenue, or growth recovery is weaker than forecast.
- PANWCore Preference
- Strengths
- Network security can be directly driven by data center and cloud container expansion; identity and threat intelligence support organic growth in new annual recurring revenue, and segment disclosure is expected to improve transparency.
- Weaknesses
- Valuation is high, and large-scale M&A integration increases execution complexity.
- Comparison
- Between PANW and CRWD, the report prefers PANW’s growth-acceleration potential.
- Risks
- Demand acceleration falls short of expectations, M&A integration is difficult, or high valuation compresses.
- CRWDHigh Quality but Valuation-Constrained
- Strengths
- Demand is strong for threat intelligence, identity, endpoint detection and response, and AI detection and response, and annual recurring revenue may still maintain high growth of around 25%.
- Weaknesses
- Sales and delivery capacity face expansion bottlenecks, and growth may remain stable rather than accelerate meaningfully.
- Comparison
- Long-term business quality is recognized, but near-term relative allocation is weaker than PANW.
- Risks
- Investors expect steep growth, so even stable growth may create a negative expectations gap.
- ZSValuation Upside but Lacking Catalysts
- Strengths
- The business remains durable, demand from existing customers to secure AI applications can support expansion, and valuation analysis shows potential fundamental upside.
- Weaknesses
- New customer acquisition is difficult, the sales force lacks sufficient hunter-type talent, and security service edge ranks low in purchasing priority.
- Comparison
- Compared with Cloudflare, it faces competitive pressure and has more difficulty maintaining net revenue retention.
- Risks
- Lack of catalysts, lengthy sales-capability buildout, intensifying competition, and uncertainty around the timing of share-price recovery.
- SStrategic Value-Driven
- Strengths
- As a potential acquisition target, it has strategic value, and a transaction could be completed at a premium.
- Weaknesses
- Re-acceleration as a standalone business and relative growth performance continue to disappoint.
- Comparison
- Growth prospects are weaker than CRWD and other major vendors.
- Risks
- A potential acquisition does not occur or the acquisition price is lower than expected, while fundamentals continue to lag.
- NETHigh-Quality Business but Expensive Valuation
- Strengths
- The core networking business is highly correlated with cloud demand, and the security business has shown good progress relative to ZS.
- Weaknesses
- The market assigns high value to Workers and longer-dated businesses, but visibility into their incremental growth and monetization is limited.
- Comparison
- It has competitive momentum relative to ZS, but its valuation is harder to support with fundamentals.
- Risks
- AI-native application adoption could favor new delivery architectures that are unfavorable to proxy networks, and a breakdown in longer-dated business expectations could trigger a sharp valuation pullback.
- FTNTNear-Term Improvement but Long-Term Caution
- Strengths
- Memory-cost pricing, regulatory requirements, network segmentation, and operational technology security demand are improving near-term revenue growth.
- Weaknesses
- The relevant drivers may be cyclical or one-off, and software-product expansion capability is weaker than PANW.
- Comparison
- Compared with PANW, long-term platformization and software expansion opportunities are more limited.
- Risks
- Memory prices normalize, operational technology buildout slows, and revenue decelerates cyclically.
Key data
- OKTA Growth ExpectationsAbout 13% for the quarter ending January 2027; about 13% to 14% for calendar 2027The company is expected to move past the roughly 100-basis-point drag from DOGE and gradually digest the impact of oversold three-year contract seats during the pandemic period.
- CRWD Growth AssessmentAnnual recurring revenue year-over-year growth slightly below 25%Demand remains strong, but expansion of commercial capabilities and implementation constraints may limit further meaningful acceleration.
- PANW New Annual Recurring RevenueLikely to achieve more than 20% organic growthIdentity and threat intelligence demand, along with the network security business, are the main drivers.
- ZS Valuation RangeApproximately $180 to $224Approximately $180 is based on free cash flow after stock-based compensation, while $224 is the target price under the growth-multiple method; the text mentions a current price of about $131, while the 2026-08-07 table lists $168.68, indicating a price-basis discrepancy in the original report.
- Target PricesOKTA $141; PANW $253; CRWD $103; ZS $224; S $19; NET $164; FTNT $102All ratings are maintained, with no disclosed unified upgrade or downgrade action in this report.
- Sector Rating DistributionOutperform 51.2%; Market-Perform 35.8%; Underperform 13.1%Bernstein’s global equity rating distribution as of 2026-06-30.
Impact & implications
At the industry level, AI security spending provides a sustained demand foundation, but investment returns will depend more on whether vendors can quickly convert demand into new customers, expand sales capacity, and reduce deployment friction. Identity, threat intelligence, and network security directly linked to data center and cloud container expansion are more likely to exceed expectations; categories that depend on new-customer migrations, such as security service edge, are relatively weaker in the near term. At the investment level, investors should avoid mechanically extrapolating the cloud infrastructure growth curve to all cybersecurity companies, and should focus on comparing valuations, growth visibility, and catalysts.
Risks
- Cybersecurity sector valuations are expensive and positioning is crowded; a lack of meaningful growth acceleration could trigger valuation compression.
- Buyers have not yet identified the long-term winners in AI security and may shorten contract durations while shifting to trials with startup vendors.
- Sales, proofs of concept, deployment, and maintenance for enterprise-grade security products create expansion bottlenecks.
- AI security budgets may crowd out existing priorities such as security information and event management, security service edge, and secure browsers.
- Cloudflare’s competition with ZS, enterprise browser substitution, and reduced new-customer additions may pressure the total addressable market and net revenue retention.
- NET’s longer-dated businesses such as Workers, S’s potential acquisition, and ZS’s valuation recovery all depend on catalysts that remain unclear.
- FTNT’s memory pricing and operational technology security demand may peak, leading to cyclical deceleration.
- Some current-price bases in the report text and tables are inconsistent, so they should not be used to directly calculate a unified expected return.
What to watch
- Whether PANW’s network security business accelerates meaningfully with data center capacity and cloud container expansion.
- Whether PANW’s organic new annual recurring revenue can reach more than 20%, and the transparency of segment disclosure in the new fiscal year.
- Whether CRWD’s annual recurring revenue growth can remain around 25%, and whether commercial delivery capability improves.
- Whether OKTA can reach about 13% growth in the quarter ending January 2027 and convert AI partnerships into new customers.
- ZS’s new customer acquisition, buildout of hunter-type sales talent, and expansion among existing customers.
- Whether S sees progress on a strategic transaction or acquisition.
- Whether NET’s Workers business can demonstrate independent growth and monetization capability.
- FTNT’s memory pricing, operational technology demand, and the magnitude of subsequent revenue deceleration.
- Whether customer contract durations shorten due to uncertainty in vendor selection.