According to a report from a financial news source, as the world's most advanced AI agents such as OpenAI Astra simultaneously expand hacker attack capabilities and the demand for AI-enhanced cyber defense, the investment theme in cybersecurity is shifting toward "legacy architecture modernization plus AI agent identity, permission, and runtime security defense mechanisms." After a severe PHP vulnerability was disclosed on October 21, Cloudflare observed exploitation attempts surge to the millions within hours; previously, an agent under OpenAI's internal evaluation had escalated privileges to access the Australian government's statistical system, which sufficiently illustrates that enterprises and government agencies in the AI era need to guard against not only malicious attacks but also privilege escalation and precision attacks that occur during the autonomous execution of tasks by proxy AI workflows such as AI agents. As frontier AI agents enhance vulnerability discovery and automated attack capabilities while driving enterprises to strengthen real-time defense with AI, as of the U.S. stock market close on October 21 Eastern Time, the world's two major cybersecurity giants — CrowdStrike (CRWD.US) and Palo Alto Networks (PANW.US) — saw their share prices rise 5.26% and 2.05% respectively, as cybersecurity demand in the AI era continues to attract market attention. This has also prompted some institutional investors to once again respond positively to the approximately $1 trillion "cybersecurity technical debt" previously proposed by Palo Alto CEO Arora — the trillion-dollar figure corresponds to the modernization needs of legacy cybersecurity infrastructure over the next decade, representing a judgment on multi-year cybersecurity upgrade opportunities. The approximately $1 trillion "cybersecurity debt" proposed by Palo Alto Networks CEO Nikesh Arora during the company's earnings call on September 1 points to the potential upgrade demand for legacy security architectures that urgently need modernization. He noted that approximately $1 trillion in pre-AI era cybersecurity technical debt globally urgently needs modernization, emphasizing that roughly $1 trillion in global cybersecurity infrastructure is not yet ready to address AI threats, and this gap will bring long-term growth space for the industry. Against the backdrop of surging demand for the most cutting-edge cybersecurity products, Morgan Stanley's October 22 research report offered a two-tier positive assessment — long-term preference for cybersecurity platform super-giants capable of continuously consolidating enterprise cybersecurity budgets, short-term focus on traditional vendors' earnings beats and short covering, with the future cybersecurity investment theme comprehensively covering both legacy system upgrades and new AI agent advanced defense mechanisms. Palo Alto is the top pick for Morgan Stanley's strategist team, and along with CrowdStrike, both continue to receive the most optimistic Overweight rating, with target prices of $410 and $254 respectively, implying potential upside of 18.07% and 6.13% compared to the October 21 closing prices used in the report. Morgan Stanley strategists added in this research report that Fortinet and Qualys mainly represent tactical positioning opportunities ahead of earnings, maintaining a Neutral stance on Tenable, while Check Point and Rapid7 still need stronger operational evidence.
It is worth noting that before Morgan Stanley reiterated its optimistic ratings, CrowdStrike and Palo Alto Networks share prices have surged dramatically since the beginning of this year, with year-to-date gains of 105% and 90% respectively.
Cybersecurity Upgrade Demand Heats Up: Earnings Beats May Ignite Short-Covering Rally
Morgan Stanley first identified a mismatch between improving demand and cautious positioning. Channel surveys show that third-quarter security spending intentions continued to accelerate on top of second-quarter improvements; the companies covered in this earnings cycle have risen approximately 33% year-to-date, while the entire cybersecurity sector has gained about 42%. Investors are concerned about the high base for 2027 firewall upgrades and intensifying competition in vulnerability management, but enterprises must currently complete asset inventory, patch preparation, and legacy system modernization, and vendors with existing customer relationships and deployment footprints can capture incremental purchases first. Therefore, Fortinet and Qualys may trigger short covering through earnings beats. However, Morgan Stanley's research heat map shows stronger momentum in identity security and data security, with vulnerability management mechanisms relatively weaker, sufficiently illustrating that total security budget expansion and individual vendors' ability to capture budgets require retail and institutional investors to make careful and comprehensive judgments separately. Fortinet's catalyst comes from firewall upgrades and improved FortiSASE sales. The combination of FortiOS, ASIC-based firewalls, and Secure Access Service Edge (SASE) supports enterprises in simultaneously upgrading network performance, network segmentation, and access control. SASE now accounts for more than 15% of Fortinet sales among distributors, up from 19% in the second quarter to 36%; channels also reported two large deals each worth $10 million to $12 million in total contract value over two years. Morgan Stanley believes third-quarter product revenue could exceed the market's approximately 31% growth expectation, and services revenue could also slightly beat the approximately 14% expectation. However, the proportion of distributors exceeding overall business plans has declined, and software improvements have not yet formed a comprehensive subscription revenue inflection point; it forecasts 2027 product revenue growth to drop from 30.7% in 2026 to 3.8%. Therefore, Morgan Stanley maintains an Equal-weight rating on the company, with a formal valuation target price of $136, which is 21.86% below $174.05 — highlighting that short-term earnings elasticity and long-term valuation judgments are not the same. Qualys best exemplifies the dual logic of "near-term beneficiary, long-term under pressure." The third-quarter year-over-year comparison base improved by approximately 612 basis points, and if the average revenue beat of about 1.6 percentage points over the past four quarters continues, revenue growth could reach approximately 11.5%, higher than 9.8% in the second quarter; this is a scenario estimate, with the formal forecast still at approximately 9.8%. The sustainability validation point is whether second-half billings can exceed the 7%-8% guidance. Enterprise Threat Management (ETM) attach sales increased average contract value by 7%-9%, but the business still relies on approximately 90% existing customers; AI automated remediation could also weaken the differentiation of traditional patch management. Morgan Stanley expects 2027 revenue growth of 7.3% and operating margin of 42.2%, both below consensus, therefore maintaining an Underweight rating and $130 target price, implying 33.91% downside.
As Enterprise Cybersecurity Budgets Concentrate Toward Super Platforms, True Premium Requires Strong Growth Delivery
Palo Alto and CrowdStrike received Morgan Stanley's most optimistic Overweight rating, with the core rationale being their ability to convert multiple security functions into continuous subscriptions from the same customer. Palo Alto integrates network, cloud, and security operations budgets through products such as Prisma and Cortex, and Morgan Stanley's base case projects approximately $17.5 billion in revenue for calendar year 2028, approximately 31% operating margin, and approximately 40% free cash flow margin. CrowdStrike is expanding from endpoint protection to identity, cloud security, and Security Information and Event Management (SIEM), and Morgan Stanley expects long-term revenue growth to remain above 20%, with free cash flow compound growth exceeding 25% over the next three years. The premium basis for both is customer expansion, cross-product sales, and operating leverage. In terms of scenario valuation, Morgan Stanley's research report shows Palo Alto's bull case target price reaching as high as $497 — corresponding to 43.12% potential upside, with a bear case price of $253; CrowdStrike's bull case price of $308, corresponding to potential upside of 28.69%, and bear case price of $103, all belonging to scenario assumptions rather than base case targets. Tenable's key is converting exposure management demand into orders and renewals. Its federal business accounts for approximately 15%, and the third quarter is an important season for government procurement; whether Operational Technology (OT) security demand and high-level government certifications can bring actual contracts will determine earnings elasticity. Morgan Stanley expects third-quarter Calculated Current Billings of $287.1 million, representing 7.3% growth, and is watching whether the second quarter's 106% Dollar-Based Net Expansion (DBNE) rate can continue to improve. Tenable One and new AI capabilities have generated customer interest, but the business mix between existing and new customers remains approximately 85:15; the Continuous Threat Exposure Management (CTEM) opportunity has not yet fully materialized into revenue re-acceleration. Its 2027 revenue growth forecast is 5.5%, below the 7.2% consensus, therefore maintaining Equal-weight and $35 target price, implying 13.94% downside. Check Point and Rapid7's constraints lie in customer acquisition capability and transformation delivery respectively. Check Point relies on existing customer satisfaction and migration costs to maintain its business, with Harmony Email and CloudGuard showing improvement, but new customer acquisition, SASE competitiveness, and AI product commercialization remain relatively weak; Morgan Stanley expects third-quarter revenue of approximately $670 million, down approximately 1% year-over-year, maintaining Equal-weight and $133 target price, implying 7.27% downside. Rapid7 has not yet proven that cost reductions can bring about a growth reversal — a 12% workforce reduction improved profits, but severance expenses offset some cash benefits, with full-year free cash flow guidance still at approximately $130 million; Morgan Stanley expects third-quarter revenue to decline 4.1% and 2027 revenue to still decline 1.7%, maintaining an Underweight rating and $9 target price, implying 33.38% downside. Morgan Stanley's coverage of these two companies also highlights that cybersecurity industry demand growth must ultimately be activated through product competitiveness, sales execution, and cash recovery to achieve a stronger shareholder return trajectory.
Why Does Cybersecurity Demand Continue to Expand Under the AI Agent Frenzy?
From a technical mechanism perspective, agents push software from "providing answers" to "holding permissions and executing operations": they can call Application Programming Interfaces (APIs), read enterprise data, run code, and modify business states. Once malicious web pages, emails, or tool-returned content alter their behavior through Prompt Injection, the risk can escalate from incorrect answers to data exfiltration or unauthorized operations; model execution failures can also produce similar consequences. Therefore, enterprises need to implement machine identity management, Least Privilege, tool invocation authorization, Runtime Monitoring, and rapid isolation outside the model, rather than relying solely on model promises to follow rules. At the same time, AI reduces the cost of vulnerability discovery and batch attacks, compressing enterprise remediation windows; the agents enterprises deploy themselves also add identities, workloads, and data flows that need protection. Palo Alto disclosed that its SASE agent traffic had expanded more than ninefold over the previous nine months, showing that the scale of protection is breaking away from a growth model that relies solely on human employee headcount. From an engineering and commercialization perspective, cybersecurity super platforms that possess endpoint, identity, network, and cloud data and can directly execute blocking and remediation are better positioned to convert new protection tasks into cross-module subscriptions — the value that large customers purchase is shortening the time from anomaly detection to loss containment. This increasingly strong cybersecurity demand in the AI era also means that even as open-source and closed-source AI large models battle fiercely, cybersecurity demand still possesses cross-path resilience. Cybersecurity demand depends on the scale and depth of permissions with which AI enters real business operations, not on which model business model wins. Open-source and open-weight models expanding local deployment and customization require protection of model files, software dependencies, inference environments, and enterprise data; closed-source models penetrating enterprise processes through APIs also require managing credentials, access boundaries, data egress, and agent behavior. Both paths will entrust more business execution authority to software, continuously expanding the scope of security governance. It follows that security platforms capable of implementing controls across models, clouds, and applications have a long-term beneficiary foundation; Morgan Stanley's rating divergence between platform giants and traditional vulnerability management vendors also reveals that the ultimate winners are more likely to be platforms that command enterprise security data, execution control, and customer trust, rather than all companies labeled with cybersecurity tags.
Comments