AI boom drives up cybersecurity stock valuations; Morgan Stanley: capital begins searching for 'cheaper' targets. Okta (OKTA.US), Fortinet, Inc. (FTNT.US), and others draw market attention.

Morgan Stanley said in its latest cybersecurity industry report that as AI agents develop rapidly, the security risks facing enterprises are also increasing, and cybersecurity market spending is expected to accelerate further, with large security platforms such as Palo Alto Networks (PANW.US) and CrowdStrike (CRWD.US) most likely to gain market share. However, high valuations have become investors' biggest concern, prompting some capital to shift its attention to relatively lower-valued names such as Okta (OKTA.US), Fortinet, Inc. (FTNT.US), SentinelOne (S.US), and SailPoint (SAIL.US). Morgan Stanley said that after recent conversations with investors, it found that the market generally agrees AI security risks will drive growth in cybersecurity demand, and also agrees that large platform vendors have the potential to further expand market share. But CrowdStrike and Palo Alto Networks are already trading at roughly 30 times and 18 times 2028 estimated sales, respectively, leading many investors who have not yet entered to wait for a better buying opportunity. It is worth noting that with more and more reports emerging about AI agent "jailbreaks" and malicious behavior by autonomous agents, the cybersecurity investment theme may be difficult to cool noticeably. That also means investors who have been waiting for a pullback in large cybersecurity stocks may ultimately have to re-enter the market. AI agents bring new security challenges; cybersecurity spending is expected to accelerate Morgan Stanley previously conducted dedicated research on AI and cybersecurity and proposed three possible scenarios for future cybersecurity spending: maintaining the status quo, enterprises accelerating efforts to fill gaps in security investment, and cybersecurity vendors being unable to keep up with the pace of attacks and vulnerabilities, ultimately causing spending across the entire industry to slow. Based on investor feedback, most believe the first scenario is most likely, meaning enterprises will not suddenly increase cybersecurity budgets sharply, but as new risks brought by AI continue to rise, cybersecurity investment will gradually accelerate. Under this scenario, Morgan Stanley expects the cybersecurity market growth rate could accelerate to more than about 20%. At the same time, some investors who had previously not allocated to cybersecurity stocks are more worried about an extreme scenario, in which a major security incident may occur in the future and existing cybersecurity vendors cannot respond effectively. But Morgan Stanley believes that in the short term, such investors may instead face greater pressure from missing out, because the market is reassessing the allocation value of cybersecurity assets in the AI era. The report argues that as autonomous AI agents increasingly touch enterprise systems, data, and applications, the objects enterprises need to protect are also changing. Traditional cybersecurity demand has not disappeared, while new security needs around AI agent identity, permissions, and behavior governance are emerging. Palo Alto and CrowdStrike stand out, but high valuations make investors hesitate From a competitive landscape perspective, Morgan Stanley believes Palo Alto Networks and CrowdStrike remain the main beneficiaries widely recognized by the market under the AI cybersecurity trend. CrowdStrike in particular has continued to expand from traditional endpoint security into areas such as SIEM, identity protection, and cloud security. Morgan Stanley believes continued market share gains, growing adoption of emerging modules, and a favorable positioning in AI could help CrowdStrike maintain revenue growth of more than 20% over the long term. The report shows Morgan Stanley expects CrowdStrike's fiscal 2027 ARR to grow 25.8% year over year and fiscal 2028 ARR to grow 24.7%; over the same period, operating margin is expected to rise further from 25.1% to 27.2%. Morgan Stanley also updated its financial model for CrowdStrike. The bank now expects the company's fiscal 2028 ARR to reach $8.236 billion, higher than its previous estimate of $8.115 billion; fiscal 2028 net new ARR is expected to reach $1.629 billion, about 8.1% above its previous forecast. Revenue over the same period is expected to reach $7.337 billion. From a product mix perspective, CrowdStrike's future growth drivers are also gradually shifting from traditional endpoint security to new businesses such as next-generation SIEM, cloud security, and identity protection. Morgan Stanley expects ARR related to Cloud, Identity, and Next-Gen SIEM to account for an increasing share of the company's total ARR and eventually surpass the traditional endpoint security business. However, valuation remains the most obvious concern for investors when looking at CrowdStrike and Palo Alto Networks. That also explains why, while bullish on the overall outlook for the cybersecurity industry, more and more investors are beginning to look for relatively cheaper alternatives. Capital seeks "cheaper" cybersecurity stocks; interest in Okta rises noticeably In Morgan Stanley's recent investor conversations, Okta and Fortinet, Inc. became the most frequently mentioned companies besides the two core platforms, while SentinelOne and SailPoint also appeared in about one-quarter of the discussions. Among them, Okta drew particular attention. Morgan Stanley believes that as the number of AI agents increases, "Agentic Identity" may become a new long-term growth direction for the cybersecurity industry. In the future, enterprises will not only need to manage the identities and access permissions of human employees, but also need to confirm who different AI agents are, what permissions they have, which systems they can access, and how they interact with one another. This further increases the importance of identity and access management (IAM). At Okta's recent Oktane conference, the company released multiple AI-related products, including Agent SSO, A2A connections, and the "Blueprint Alliance" aimed at helping enterprises protect and govern AI agents. Company management also said that driven by AI agents, IAM could become one of the largest markets in the entire cybersecurity industry over the next five years. Morgan Stanley therefore sharply raised its Okta target price to $245 from $200 and maintained its "Overweight" rating. The 22.5% increase in Okta's target price was mainly not due to a significant upward revision to near-term earnings forecasts, but rather to a higher judgment on the company's long-term valuation. The bank raised Okta's 2027 estimated free cash flow valuation multiple to 41 times from 33 times, corresponding to about 12 times 2027 estimated enterprise value/sales, above the previous 9.6 times. Morgan Stanley believes this valuation better reflects Okta's competitive position in AI agent identity management and the growth opportunities brought by modernization of identity systems. Risk-reward analysis shows that Morgan Stanley's base case gives Okta a valuation of $245, corresponding to about $1.037 billion in free cash flow in 2027; under a bullish scenario, the target valuation could reach $285. Morgan Stanley expects Okta's free cash flow to compound annually at 15%-20% over the next few years. At the same time, the bank estimates the identity and access management market is worth more than $40 billion, leaving Okta with considerable room to gain share. However, Morgan Stanley believes the growth brought by AI agent identity will not explode immediately. In the short term, Okta's current improvement comes more from enterprises addressing technical debt accumulated in the past, while AI agent-related opportunities are expected to materialize gradually. Fortinet, Inc. also draws attention; whether the network equipment refresh cycle can continue becomes a focus In addition to Okta, Fortinet, Inc. is also a key company investors are focusing on when looking for relatively lower-valued cybersecurity targets. Morgan Stanley noted that over the past several quarters, Fortinet, Inc.'s product growth has accelerated noticeably as enterprises dealt with previously accumulated technical debt. But the market is now focused on whether this growth can continue, especially as the company may face a higher year-over-year base next year when it enters the concentrated pandemic-era equipment refresh cycle. The bank is currently relatively cautious on this, believing that a higher comparison base may make it more difficult for Fortinet, Inc. to continue beating expectations. At the same time, this trend could also affect the entire firewall industry, including Cisco Systems, Inc. (CSCO.US) and Check Point (CHKP.US). Although SentinelOne and SailPoint were mentioned less frequently in investor conversations, both companies have growth of about 20% and more attractive valuations, so they have also begun to enter the watchlists of more investors. Cybersecurity demand is expected to accelerate; high valuations push capital to seek alternatives Morgan Stanley summarizes the current cybersecurity sector as expensive in valuation, but increasingly indispensable in spending. AI agents can, on the one hand, improve corporate productivity, and on the other hand, expand the potential attack surface and create new security needs such as identity verification, access permissions, and AI behavior governance. Morgan Stanley believes this trend is expected to accelerate growth in the cybersecurity market while further strengthening the market position of large platform vendors. But for investors, the question has gradually shifted from "whether AI will increase cybersecurity demand" to "at what price should we participate in this trend." The industry positions of Palo Alto Networks and CrowdStrike are widely recognized, but high valuations limit some capital's willingness to enter; at the same time, relatively lower-valued companies such as Okta, Fortinet, Inc., SentinelOne, and SailPoint are gaining more attention for this reason.