BTIG has identified Zscaler (ZS.US) as its top large-cap pick and Netskope (NTSK.US) as the preferred small-to-mid-cap choice in the security and infrastructure software sector for the first half of 2026. Other favored stocks include Snowflake (SNOW.US), SailPoint (SAIL.US), and Datadog (DDOG.US). The firm reviewed 2025 performance and outlined key themes for 2026 in the security and infrastructure software space.
Analyst Gray Powell and his team noted, "In security, demand has stabilized, with covered companies expected to maintain 15%-16% revenue growth in 2026, similar to 2025 levels. While securing AI workloads remains a core demand driver, enterprises are likely to prioritize evaluating existing vendors' mature capabilities rather than immediately investing in emerging AI-specific security solutions. This shift in procurement strategy will be gradual."
The team emphasized that platform strategies remain critical, with companies offering top-tier products and cross-functional expansion capabilities standing out. In observability, analysts expect clients to focus on vendor consolidation to streamline operations, viewing AI adoption as more of a tailwind than a risk.
**2025 Recap** "For our security and infrastructure software coverage, 2025 was a tough year. Despite solid revenue performance, the sector significantly underperformed major indices. The median return was -0.8% year-to-date, compared to the Nasdaq's 22% gain," Powell noted. Top performers included Cloudflare (NET.US), MongoDB (MDB.US), CrowdStrike (CRWD.US), Snowflake, and CyberArk Software (CYBR.US), all benefiting from AI in different ways. Underperformers typically fell into two categories: single-point solution providers in commoditized segments or those facing AI-related headwinds.
Despite weak stock performance, operational results were strong, with median forward revenue estimates rising over 1%. Snowflake saw the largest upward revision (+6.3%), followed by Okta (OKTA.US) and Elastic (ESTC.US) (both +3.7%). The steepest downgrades were OneSpan (OSPN.US) (-11.4%), Rapid7 (RPD.US) (-7.0%), and SentinelOne (S.US) (-5.2%).
**2026 Outlook** "Cybersecurity growth stabilized in 2025, with covered firms on track for 16% growth this year, expected to continue in 2026. We are most bullish on cloud security, secure service edge/zero trust, and identity. Additionally, we see expanding vendor opportunities in SIEM (Security Information and Event Management)," Powell stated.
While AI security is an emerging theme, most organizations are likely to rely on existing vendor solutions for AI workload protection over the next 12-18 months. BTIG's top AI-related picks include Netskope, SailPoint, Cloudflare, Zscaler, Palo Alto Networks (PANW.US), and CrowdStrike.
Platform consolidation remains a priority, though skepticism persists about vendors offering top-tier products across multiple security categories. Analysts favor firms with strong multi-product portfolios, particularly those driving adoption in adjacent procurement centers. CrowdStrike, Zscaler, and Palo Alto Networks excel in platform strategies.
"We remain optimistic about observability, with vendor consolidation benefiting Datadog and Dynatrace (DT.US). AI-driven workload surges should further boost vendors," Powell added. Palo Alto's entry into observability via its Chronosphere acquisition introduces a potential disruptor, though aggressive pricing in other verticals (like endpoint security) had minimal impact on market leader CrowdStrike. A similar dynamic may play out between Datadog and Dynatrace.
Comments