Have cybersecurity stocks risen too far? Bernstein: AI demand remains strong, but sector valuations are already at highs; downgrades Palo Alto (PANW.US), Okta (OKTA.US), and SentinelOne (S.US)

Bernstein said in its latest American Software, Inc. Class A industry report released on September 17 that cybersecurity demand driven by artificial intelligence is still strengthening, and enterprise security budgets and new contract models are also driving industry growth, but after the sharp rally since 2026, valuations in the cybersecurity sector have expanded significantly, with most covered companies now approaching or even exceeding the reasonable valuation levels calculated by the firm. Based on this, Bernstein downgraded Palo Alto Networks (PANW.US), Okta (OKTA.US), and SentinelOne (S.US) to "Neutral." Among currently covered companies, only Zscaler (ZS.US) still has relatively significant valuation upside. Bernstein pointed out that at the beginning of this year it was strongly bullish on the cybersecurity industry, with the core logic being precisely the new security demand brought by AI. Subsequently, even as AI labs successively launched their own cybersecurity products, which briefly sparked investor concerns that traditional security software companies could be displaced, the firm still maintained a positive judgment on the industry's fundamentals. Facts proved that cybersecurity demand continued to strengthen. Bernstein's mid-year Chief Information Security Officer (CISO) and Chief Information Officer (CIO) surveys both showed further improvement in demand signals, while recent increased discussion that cybersecurity risks could limit the pace of AI lab development further improved investor views on traditional cybersecurity companies. But the problem is that share price gains may have already outpaced the pace of fundamental improvement. Bernstein said that since the beginning of 2026, many cybersecurity stocks it covers have posted cumulative gains of about 100% or even higher, while sector crowding has risen significantly. AI continues to drive security spending, but valuations have clearly "run ahead" Bernstein believes the core contradiction in the cybersecurity industry has now changed: at the beginning of the year, the market focused on whether AI would bring opportunities or threats to traditional cybersecurity vendors. Now, as demand is gradually validated, the question investors need to face has become how much future growth is already priced into current share prices. The valuation analysis in the report shows that cybersecurity companies' EV/next-12-month sales multiples are generally higher than those of application software companies, with some companies' valuations even exceeding those of consumer infrastructure software companies that also benefit from the AI investment boom. Taking Cloudflare (NET.US) and CrowdStrike (CRWD.US) as examples, as of September 14, both companies' EV/next-12-month sales multiples reached about 36x. Bernstein's regression analysis further shows that, except for a few companies, there is a high correlation between the "Rule of 40" and valuation multiples, and most covered companies are now close to or above the reasonable valuation levels corresponding to the model. It is worth noting that Bernstein's own growth forecasts for these companies are already generally above Wall Street sell-side consensus. But even using these relatively optimistic revenue forecasts, apart from Zscaler, the firm still finds it difficult to identify sufficient upside from current valuations. In other words, Bernstein is not arguing that the cybersecurity industry's fundamentals are deteriorating, but rather that the valuation premium the market has assigned to this sector has risen markedly, and share prices now demand more future growth. Flex contracts become a new growth engine for cybersecurity companies In addition to AI demand, Bernstein specifically pointed out that a flexible contract model known as "Flex" is helping cybersecurity vendors accelerate revenue growth. A Flex contract can be understood as vendors offering customers a model similar to an "enterprise-wide universal license," in which customers commit a certain amount in advance and can then flexibly use different products and services under the vendor's umbrella within the contract amount. The advantage of this model is that enterprise customers do not need to accurately predict at the initial purchase exactly which cybersecurity products they will need in the future. When new security threats emerge, customers can quickly add other products without having to go through the full procurement and sales process again. For cybersecurity vendors, this also greatly reduces the difficulty of upselling and cross-selling to existing customers. CrowdStrike is an important case of this model. Bernstein estimates that in its latest quarter, CrowdStrike's additional expansion and upsell generated through Flex contracts contributed an extra roughly $30 million to $40 million in new annual recurring revenue (ARR), exceeding what might have been achievable through normal sales capacity alone. This means that growth for cybersecurity companies comes not only from expanding market demand, but also from the business model itself improving sales efficiency. AI demand is strong, but cybersecurity growth still has natural limits However, Bernstein believes that although Flex contracts can enhance growth rates, they are not enough to fully support the growth expectations implied by some cybersecurity stocks' current prices. The core reason is that cybersecurity software is fundamentally different from usage-based infrastructure software such as cloud computing and databases. For hyperscale cloud service providers or database platforms, as customers' computing volume, data volume, and AI workloads increase, consumption can in theory continue to expand rapidly, so revenue has a strong usage-driven effect. Cybersecurity products, by contrast, have more obvious natural growth limits. For example, in areas such as SSE/SASE, endpoint security, observability, and communications and email security, where AI is driving enterprises to increase investment, demand is usually tied to the number of employees or endpoint devices, and these metrics grow at a relatively stable pace. By comparison, network security and cloud security are more correlated with computing usage, and therefore have more pronounced consumption-driven growth characteristics. Bernstein cited CrowdStrike as an example, noting that after excluding the easier year-over-year base effects, its "true" new ARR growth rate is in the high 20% range. As Flex contracts gradually enter the year-over-year base, its overall growth may eventually approach the high 20% range, rather than the 40%-plus growth level that the current valuation appears to imply. The firm believes that strong demand and business model innovation are real, but may not be enough to satisfy the high growth expectations already priced into the current share price. Palo Alto, Okta, and SentinelOne downgraded Based on its latest valuation model, Bernstein significantly raised valuation multiples for cybersecurity companies and correspondingly lifted price targets for several companies, but at the same time downgraded the investment ratings on three of them. Specifically, Palo Alto Networks' price target was raised from $253 to $351, but its rating was downgraded from "Outperform" to "Neutral"; Okta's price target rose from $143 to $174, with its rating also cut to "Neutral"; and SentinelOne's price target was raised from $21 to $25, but its rating was also downgraded to "Neutral." Bernstein said all three companies had previously been viewed by it as "too cheap," but after re-rating over the past quarter, their current share prices have basically returned to reasonable levels relative to its updated industry valuation model, so the risk-reward ratio is no longer as attractive as before. At the same time, the ratings on CrowdStrike, Cloudflare, Fortinet (FTNT.US), and Zscaler remain unchanged. However, Bernstein is particularly cautious about CrowdStrike's current valuation. The firm noted that CrowdStrike currently trades at a valuation clearly above the level corresponding to the industry regression model, while Palo Alto is relatively closer to the model valuation. Both companies benefit from cybersecurity demand growth brought by AI, so over the long term, their valuation gap may gradually narrow. SentinelOne's potential M&A value draws attention Despite downgrading SentinelOne, Bernstein still views the company as an attractive potential strategic acquisition target within its coverage. The report noted that SentinelOne could become a potential acquisition target for AI labs, hyperscale cloud computing companies, or even other large cybersecurity vendors, including Anthropic, Alphabet Inc. Class C parent Alphabet (GOOGL.US), and Palo Alto Networks, among others. However, this view reflects Bernstein's judgment on potential strategic fit and does not mean the relevant companies are currently in acquisition negotiations. As for Okta, Bernstein believes its biggest potential future upside variable may come from AI agent infrastructure. As AI agents begin to access enterprise applications, databases, and other digital resources on behalf of users, the importance of identity verification and permission management is expected to increase, which could create new demand for Okta. But Bernstein also emphasized that it is still difficult to determine when AI agents will truly mature on a large scale and achieve commercial deployment, and how related products will be priced and the eventual scale of demand are also unclear. Zscaler maintained at "Outperform"; sales transformation enters a critical stage Among the cybersecurity companies covered in this Bernstein report, Zscaler stands out as somewhat unusual. The report shows that Zscaler closed at $191.58 on September 16, while Bernstein sharply raised its price target from $224 to $298 and maintained its "Outperform" rating. By contrast, the then-current share prices of Palo Alto, Cloudflare, CrowdStrike, Okta, and Fortinet were all already above Bernstein's updated price targets. Bernstein believes the main reason for Zscaler's earlier growth slowdown was not that its products lost competitiveness, but that the company actively adjusted its sales strategy, gradually shifting from a transactional sales model that mainly relied on new customer acquisition to a model that places greater emphasis on long-term customer relationships, upselling, and cross-selling. This three-year sales transformation has now entered its final stage. Zscaler maintained a net revenue retention (NRR) rate of 115% in FY2026, and the company expects its existing sales pipeline to support maintaining this level in FY2027. Latest quarterly data show that the declining trend in contribution from new customers appears to have stopped, and Bernstein expects that if this metric can stabilize or even improve again, the company's revenue growth rate may also stabilize. At the same time, although Zscaler faces pressure from competitors such as Cloudflare, there is still considerable market space for large enterprises migrating from traditional web security and VPN to modern SSE/SASE architectures.