After underperforming the Nasdaq by 22%, BTIG is betting on a V-shaped reversal for 2026 security software: Zscaler (ZS.US) and Netskope (NTSK.US) leading the way.

BTIG believes that in the first half of 2026, in the security and infrastructure software sector, Zscaler (ZS.US) is the preferred large-cap stock, and Netskope (NTSK.US) is the preferred mid-cap stock. Other targets that the institution is bullish on include Snowflake (SNOW.US), SailPoint (SAIL.US), and Datadog (DDOG.US). BTIG reviewed the performance of 2025 and made projections for 2026, outlining the core themes in the security and infrastructure software sector that they cover. The team of analysts led by Gray Powell stated: "In terms of security, we have observed that demand has stabilized and companies are expected to maintain revenue growth of 15%-16% in 2026, similar to the level in 2025. While securing AI workloads remains a core demand scenario, we believe that enterprise customers will prioritize evaluating the capabilities of existing vendors in their purchasing decisions, rather than immediately investing heavily in emerging, specialized security solutions tailored for AI scenarios. This shift in procurement strategy will gradually progress over time, and we expect the process to be incremental." The analyst team further pointed out that a platform strategy remains a core focus, and companies that have top-tier product competitiveness and can expand functionality across existing procurement centers and adjacent markets are more likely to stand out. In terms of observability, analysts expect customers to focus on vendor consolidation to streamline operations, and believe that the tailwinds from AI adoption will outweigh the risks. 2025 Review "For our coverage targets in security and infrastructure software, it was a challenging year. Despite robust revenue performance, this sector significantly lagged behind major indices. The median return rate from the beginning of the year until now is -0.8%, while the Nasdaq index rose 22%," Powell and his team stated. The analyst pointed out that the top five performing companies were Cloudflare (NET.US), MongoDB (MDB.US), CrowdStrike (CRWD.US), Snowflake, and CyberArk Software (CYBR.US), all expected to benefit from AI in different ways. Companies with poor performance during the year, according to the analysts, are typically either companies offering single-point solutions in niche markets commoditized by large platform vendors, and/or companies facing AI-related headwinds. Analysts added that despite poor stock performance this year, operational performance remains strong. Revenue expectations for typical companies in the coming year have been raised by over 1%. The companies with the largest upward revision in revenue forecasts for 2026 are Snowflake (+6.3%), with Okta (OKTA.US) and Elastic (ESTC.US) tied for second (+3.7%). The companies with the largest downward revisions are OneSpan (OSPN.US) (-11.4%), Rapid7 (RPD.US) (-7.0%), and SentinelOne (S.US) (-5.2%). 2026 Outlook "During 2025, network security growth gradually stabilized. Covered companies are expected to achieve 16% growth this year, and we expect to maintain a similar growth rate in 2026. We are most bullish on cloud security, secure access service edge (SASE)/zero trust, and identity authentication. In addition, we believe that the market disruption opportunities for vendors in the Security Information and Event Management (SIEM) field are continuing to expand," Powell and his team stated. Analysts noted that while AI security is an important emerging theme, it is expected that in the next 12 to 18 months, most organizations will still rely on existing vendor solutions to protect AI workloads. BTIG's top AI-related targets include Netskope, SailPoint, Cloudflare, Zscaler, Palo Alto Networks (PANW.US), and CrowdStrike. Platform integration remains a key theme. However, our field research shows that there is still skepticism in the market about whether vendors can truly provide top-tier products across multiple security categories. We favor companies with strong multi-product portfolios, especially those that can drive product adoption in the same or adjacent procurement centers. Analysts believe that CrowdStrike, Zscaler, and Palo Alto Networks are performing well in the platform theme. "We remain optimistic about observability. We see customers prioritizing vendor consolidation, benefiting Datadog and Dynatrace (DT.US). Vendors are expected to see the benefits of the surge in AI workloads," Powell and his team stated. Analysts pointed out that Palo Alto's entry into the observability market through the acquisition of Chronosphere has introduced a potential disruptive catalyst to the industry. However, analysts added that they have seen Palo Alto engage in aggressive pricing in other verticals (such as endpoint security), but it has had almost no impact on market leader CrowdStrike. "In the observability field, we see a similar competitive situation with Datadog and Dynatrace," Powell and his team stated.