According to a latest cybersecurity industry report from Morgan Stanley, the rapid development of AI agents is increasing security risks for enterprises, and cybersecurity spending is expected to accelerate further. Large security platforms such as Palo Alto Networks (PANW.US) and CrowdStrike (CRWD.US) are best positioned to gain market share. However, high valuations have become investors' biggest concern, prompting some capital to shift toward relatively cheaper names including Okta (OKTA.US), Fortinet (FTNT.US), SentinelOne (S.US), and SailPoint (SAIL.US).
Morgan Stanley said that after recent conversations with investors, it found that the market broadly agrees AI security risks will drive cybersecurity demand growth, and also acknowledges that large platform vendors have the potential to further expand market share. But CrowdStrike and Palo Alto Networks are already trading at roughly 30 times and 18 times 2028 estimated sales, respectively, leading many investors who have not yet entered to wait for a better buying opportunity.
Notably, with more reports emerging about AI agent "jailbreaks" and malicious behavior by autonomous agents, the cybersecurity investment theme may struggle to cool down significantly. This also means investors who have been waiting for a pullback in large cybersecurity stocks may ultimately have to re-enter the market.
AI Agents Bring New Security Challenges, Cybersecurity Spending Expected to Accelerate
Morgan Stanley previously conducted dedicated research on AI and cybersecurity and outlined three possible scenarios for future cybersecurity spending: maintaining the status quo, enterprises accelerating efforts to catch up on security investment, and cybersecurity vendors failing to keep pace with the speed of attacks and vulnerabilities, ultimately causing industry-wide spending to slow. Based on investor feedback, most believe the first scenario is most likely, meaning enterprises will not suddenly significantly increase cybersecurity budgets, but as new risks brought by AI continue to rise, cybersecurity investment will gradually accelerate. Under this scenario, Morgan Stanley expects the cybersecurity market growth rate could accelerate to above approximately 20%.
Meanwhile, some investors who previously had no allocation to cybersecurity stocks are more worried about an extreme scenario, in which a major security incident occurs in the future and existing cybersecurity vendors cannot respond effectively. But Morgan Stanley believes that in the short term, these investors may instead face greater pressure from missing out, because the market is reassessing the allocation value of cybersecurity assets in the AI era. The report argues that as autonomous AI agents increasingly interact with enterprise systems, data, and applications, what enterprises need to protect is also changing. Traditional cybersecurity demand has not disappeared, while new security needs around AI agent identity, permissions, and behavior governance are emerging.
Palo Alto and CrowdStrike Stand Out, but High Valuations Make Investors Hesitate
From a competitive landscape perspective, Morgan Stanley believes Palo Alto Networks and CrowdStrike remain the main beneficiaries widely recognized under the AI cybersecurity trend. CrowdStrike in particular has been expanding from traditional endpoint security into areas such as SIEM, identity protection, and cloud security. Morgan Stanley believes that continued market share gains, growing adoption of emerging modules, and a favorable positioning in AI could help CrowdStrike sustain revenue growth above 20% over the long term.
The report shows that Morgan Stanley expects CrowdStrike's ARR to grow 25.8% year over year in fiscal 2027 and 24.7% in fiscal 2028; over the same period, its operating margin is expected to rise from 25.1% to 27.2%.
Morgan Stanley also updated its financial model for CrowdStrike. The bank now expects the company's fiscal 2028 ARR to reach $8.236 billion, up from its previous forecast of $8.115 billion; fiscal 2028 net new ARR is expected to reach $1.629 billion, raised by about 8.1% from the previous estimate. Revenue over the same period is expected to reach $7.337 billion.
In terms of product mix, CrowdStrike's future growth drivers are gradually shifting from traditional endpoint security toward new businesses such as next-generation SIEM, cloud security, and identity protection. Morgan Stanley expects the share of ARR related to Cloud, Identity, and Next-Gen SIEM to continue rising and eventually surpass the traditional endpoint security business.
However, valuation remains the most obvious concern for investors when looking at CrowdStrike and Palo Alto Networks. This also explains why, while optimistic about the overall outlook for the cybersecurity industry, more and more investors are beginning to look for relatively cheaper alternative names.
Capital Looks for "Cheaper" Cybersecurity Stocks, Okta's Visibility Rises Notably
In Morgan Stanley's recent investor conversations, Okta and Fortinet became the most frequently mentioned companies outside the two core platforms, while SentinelOne and SailPoint also appeared in about one-quarter of the discussions. Among them, Okta attracted particular attention. Morgan Stanley believes that as the number of AI agents increases, "Agentic Identity" may become a new long-term growth direction for the cybersecurity industry. In the future, enterprises will not only need to manage the identities and access rights of human employees, but also confirm who different AI agents are, what permissions they have, which systems they can access, and how they interact with each other. This further increases the importance of identity and access management (IAM). At Okta's recent Oktane conference, the company launched multiple AI-related products, including Agent SSO, A2A connections, and the "Blueprint Alliance" aimed at helping enterprises protect and govern AI agents. Company management also said that driven by AI agents, IAM could become one of the largest markets in the entire cybersecurity industry over the next five years.
Morgan Stanley therefore sharply raised its price target on Okta from $200 to $245 and maintained an "Overweight" rating. The 22.5% increase in Okta's price target was mainly due not to a significant upward revision in near-term earnings forecasts, but to a higher assessment of the company's long-term valuation. The bank raised Okta's 2027 estimated free cash flow valuation multiple from 33 times to 41 times, corresponding to about 12 times 2027 estimated enterprise value/sales, up from 9.6 times previously. Morgan Stanley believes this valuation better reflects Okta's competitive position in AI agent identity management and the growth opportunities brought by identity system modernization.
Risk-reward analysis shows that Morgan Stanley's base case gives Okta a $245 valuation, corresponding to about $1.037 billion in free cash flow in 2027; under a bull case, the target valuation could reach $285.
Morgan Stanley expects Okta's free cash flow to compound annually at 15%-20% over the next few years. At the same time, the bank estimates the identity and access management market is worth more than $40 billion, leaving Okta substantial room to gain share.
However, Morgan Stanley believes the growth brought by AI agent identity will not explode immediately. In the short term, Okta's current improvement comes more from enterprises addressing accumulated technical debt, while AI agent-related opportunities are expected to materialize gradually.
Fortinet Also Draws Attention, Focus on Whether Network Equipment Refresh Cycle Can Continue
In addition to Okta, Fortinet is also a key company investors focus on when seeking relatively lower-valuation cybersecurity names. Morgan Stanley noted that over the past several quarters, Fortinet's product growth has accelerated markedly as enterprises addressed previously accumulated technical debt. But the market is now focused on whether this growth can continue, especially as the company may face a higher year-over-year base next year when the pandemic-era equipment refresh cycle comes into full effect. The bank is currently relatively cautious on this, believing that a higher comparison base may make it harder for Fortinet to continue beating expectations. At the same time, this trend could also affect the entire firewall industry, including Cisco (CSCO.US) and Check Point (CHKP.US).
Although SentinelOne and SailPoint were mentioned less frequently in investor conversations, both companies have growth rates of about 20% and more attractive valuations, so they are also beginning to enter the watchlists of more investors.
Cybersecurity Demand Expected to Accelerate, High Valuations Push Capital Toward Alternatives
Morgan Stanley summarizes the current cybersecurity sector as expensive in valuation but increasingly indispensable in spending. AI agents can improve corporate productivity on the one hand, but on the other hand they also expand the potential attack surface and create new security needs such as identity verification, access permissions, and AI behavior governance. Morgan Stanley believes this trend could accelerate growth in the cybersecurity market while further strengthening the market position of large platform vendors.
But for investors, the question has gradually shifted from "whether AI will increase cybersecurity demand" to "at what price should one participate in this trend." Palo Alto Networks and CrowdStrike's industry positions are widely recognized, but high valuations limit some capital's willingness to enter; meanwhile, relatively lower-valuation companies such as Okta, Fortinet, SentinelOne, and SailPoint are gaining more attention as a result.
Comments