A notable shift is underway in how the market views the intersection of AI and the cybersecurity sector. In a deep-dive report released on August 18, analysts at BofA Securities highlighted that just months ago, the prevailing concern was that AI would upend the business models of traditional security vendors, eroding the moats around their established products and platforms. However, with the rapid emergence of sophisticated attack methods like AI agents, the market's perspective is changing, revealing that AI is actually expanding corporate attack surfaces while simultaneously boosting the speed and complexity of cyber threats.
This dynamic signals that AI's relationship with cybersecurity is evolving from that of a disruptor to a catalyst for demand. The deeper a company's AI integration, the greater the need for robust security capabilities across identity, data, endpoints, and cloud environments. Rather than being a casualty of the AI wave, cybersecurity is now positioning itself as an indispensable piece of infrastructure for the scalable deployment of AI technologies.
These changing perceptions are already visible in market performance. Over the past two months, the CIBR ETF has climbed 16.1%, the HACK ETF has surged 38%, and IVG has gained 14.9%, all while the S&P 500 has risen just 3.6%. At the same time, valuations in the cybersecurity space have expanded noticeably, indicating that capital is actively repricing the sector's growth outlook.
How AI-Driven Threats Are Redefining Security Requirements
The earlier market anxiety about AI's impact on cybersecurity stemmed from a straightforward premise: AI lowers technical barriers, potentially enabling companies to automate security tasks more efficiently while also empowering attackers to launch cheaper and more frequent assaults, thereby diminishing the value of traditional security products. Yet, with the rapid progress of agentic AI, that logic is being turned on its head. AI agents are now capable of executing tasks across systems, autonomously identifying vulnerabilities, and operating continuously with minimal human oversight, giving rise to a new category of agent-driven attacks that have become a top concern for chief information security officers.
Unlike conventional attacks, AI-powered threats not only expand the attack surface but also elevate both the speed and sophistication of intrusions. For enterprises, broader AI deployment translates into more identities, permissions, data sets, and workloads that need to be managed. If security capabilities fail to keep pace, the efficiency gains from AI can quickly transform into fresh security liabilities. As a result, AI is creating a self-reinforcing demand loop: AI expands the attack surface, which escalates attack complexity, which drives increased security spending, ultimately benefiting security vendors.
Shifting From Defensive Spending to AI Infrastructure
An even more significant change is the evolving role of cybersecurity itself. Previously, it was largely viewed as a defensive line item in corporate IT budgets, making the sector's valuation vulnerable to macroeconomic swings and enterprise budget cycles. In the age of AI, however, security is becoming a prerequisite for scaling AI adoption. Companies must ensure AI agents are properly authorized, manage machine identities and access privileges, safeguard data flowing through AI workflows, and maintain continuous monitoring of cloud environments, endpoints, and networks. In short, without adequate security measures, an enterprise's AI strategy is unlikely to reach true scale. This reframes the demand logic for cybersecurity from mere risk prevention to enabling AI-driven growth, suggesting that the larger the AI investment, the greater the potential security spending pool.
Valuations Undergo a Repricing Cycle
The shift in demand dynamics is already making its mark on valuations. According to BofA data, the median EV/2027 Sales multiple for cybersecurity companies has risen to roughly 5.8 times, up from 4.5 times just two months ago, while the average multiple has expanded from 7.0 times to 9.0 times. Concurrently, cybersecurity ETFs have outperformed the broader market in recent weeks, underscoring a surge in investor attention toward the sector. The core of this repricing is not merely short-term earnings improvements, but rather the market beginning to assign greater growth certainty to cybersecurity. If AI continues to broaden corporate digital assets, machine identities, and automated workflows, security demand will expand in tandem, effectively redefining the industry's long-term total addressable market.
Growth Expectations Must Catch Up With Higher Valuations
That said, the sharp rise in valuations also means the market's expectations for future growth have been ratcheted up. BofA notes that the cybersecurity software sector currently trades in a range of roughly 5 times to 10 times EV/Sales, with valuation dispersion across companies largely reflecting differences in growth rates, success in entering new markets, and the predictability of their business models. Consequently, the AI-driven demand catalyst does not guarantee an equal valuation premium for every company in the space. Firms that continue to earn market favor will need to demonstrate that AI not only introduces new risks, but also converts into tangible orders, recurring revenue growth, and a larger serviceable market. Looking ahead, the industry's central focus is set to pivot from whether AI will disrupt cybersecurity to precisely how much incremental demand AI will generate for the sector.
Comments