From AI agent privilege escalation to PHP vulnerabilities, the market is increasingly focused on the "security premium" of the AI era! Morgan Stanley looks ahead to the long-term bull market and short-term opportunities in cybersecurity.

Title context: From AI agent privilege escalation to PHP vulnerabilities, the market is increasingly focused on the "security premium" of the AI era! Morgan Stanley looks ahead to the long-term bull market and short-term opportunities in cybersecurity. Text: As OpenAI Astra and other of the world's most cutting-edge AI agents are simultaneously expanding both hacking capabilities and the demand for cyber defense strengthened by AI technology, the main investment theme in cybersecurity has thus moved toward "upgrading old architectures + identity, permission, and runtime security defense mechanisms for AI agents." After a severe PHP vulnerability was disclosed on October 21, exploitation attempts observed by Cloudflare rose to the million level within hours; previously, an agent under OpenAI's internal evaluation had accessed the Australian government's statistical system beyond its authority, which is enough to show that in the AI era, enterprises and government departments need to guard not only against malicious attacks, but also against privilege escalation and precise attack behavior occurring while agentic AI workflows such as AI agents autonomously execute tasks. As frontier AI agents enhance vulnerability discovery and automated attack capabilities and push enterprises to strengthen real-time defense with AI, as of the U.S. stock market close on October 21 Eastern Time, shares of the world's two major cybersecurity giantsCrowdStrike (CRWD.US) and Palo Alto Networks (PANW.US)rose 5.26% and 2.05%, respectively, and cybersecurity demand in the AI era continues to attract market attention. This has also led some institutional investors to once again respond positively to Palo Alto CEO Arora's recent mention of roughly $1 trillion in "cybersecurity technical debt"the $1 trillion here corresponds to the modernization needs of legacy cybersecurity infrastructure over the next decade and is a judgment on the multi-year cybersecurity upgrade opportunity. The roughly $1 trillion "cybersecurity debt" previously proposed by Palo Alto Networks CEO Nikesh Arora on the company's earnings call on September 1 points to potential upgrade demand from legacy security architectures that urgently need modernization. He pointed out that about $1 trillion of pre-AI-era cybersecurity technical debt worldwide urgently needs modernization, emphasizing that about $1 trillion of global cybersecurity infrastructure is not yet ready to cope with AI threats, and this gap will bring long-term growth space to the industry. Against the backdrop of surging demand for the most cutting-edge cybersecurity products, a Morgan Stanley research report on October 22 gave a two-tier positive judgmentfavoring over the long term cybersecurity platform super-giants that can continuously consolidate enterprise cybersecurity budgets, and focusing over the short term on traditional vendors' earnings beats and short covering. The main line of future cybersecurity investment will fully cover two types of demand: upgrades of existing systems and advanced protection mechanisms newly added for AI agents. Palo Alto is the top pick (Top Pick) of Morgan Stanley's strategist team, and together with CrowdStrike it continues to receive Overweight, the most optimistic stock rating, with target prices of $410 and $254, respectively, implying potential upside of 18.07% and 6.13% compared with the October 21 closing prices used in the report. Morgan Stanley strategists added in this research report that Fortinet and Qualys mainly represent tactical allocation opportunities ahead of earnings, that they maintain a Neutral rating on Tenable, and that Check Point and Rapid7 still need stronger operating evidence. It is worth noting that before Morgan Stanley reiterated its optimistic ratings, CrowdStrike and Palo Alto Networks shares had surged dramatically since the start of this year, with year-to-date gains of as much as 105% and 90%, respectively. Cybersecurity upgrade demand is heating up: earnings beats may ignite a short-covering rally What Morgan Stanley first sees is the mismatch between improving demand and cautious positioning. Channel surveys show that willingness to spend on security in the third quarter continued to accelerate on top of the improvement in the second quarter; the companies covered in this earnings cycle are up about 33% year to date, while the entire cybersecurity sector is up about 42%. Investors worry that the 2027 firewall refresh faces a high base and that vulnerability management faces more intense competition, but enterprises must immediately complete asset inventories, patch preparation, and legacy system upgrades, and vendors with existing customer relationships and deployment footprints can be the first to obtain additional purchases. Therefore, Fortinet and Qualys may trigger covering through earnings beats. However, in Morgan Stanley's research report heat map, identity security and data security are stronger, while vulnerability management mechanisms are relatively weaker, which is enough to show that the expansion of total security budgets and the ability of specific vendors to capture budgets require retail and institutional investors to make careful and comprehensive judgments separately. Fortinet's catalyst comes from firewall refresh and improving FortiSASE sales. The combination of FortiOS, ASIC firewalls, and Secure Access Service Edge (SASE) supports enterprises in simultaneously upgrading network performance, network segmentation, and access control. The proportion of resellers for which SASE accounts for more than 15% of Fortinet sales rose from 19% in the second quarter to 36%; channels also reported two large deals each with a two-year total contract value of $10 million-$12 million. Morgan Stanley believes third-quarter product revenue may exceed the market's growth expectation of about 31%, and services revenue may also slightly exceed the expectation of about 14%. But the proportion of resellers whose overall business exceeds plan has declined somewhat, and software improvement has not yet formed a full subscription revenue inflection point; it forecasts that product revenue growth will slow from 30.7% in 2026 to 3.8% in 2027. Therefore, Morgan Stanley still rates the company Equal-weight, with a target price of $136 on the formal valuation page, 21.86% below $174.05highlighting that short-term earnings elasticity and long-term valuation judgment are not the same. Qualys best reflects the dual logic of "near-term benefit, long-term pressure." The third-quarter year-over-year comparison base improved by about 612 basis points; if the average revenue beat of about 1.6 percentage points over the past four quarters continues, revenue growth could reach about 11.5%, higher than 9.8% in the second quarter; this is a scenario estimate, and the formal forecast remains about 9.8%. The continuous verification point is whether second-half billings can exceed the 7%-8% guidance. Enterprise Threat Management (ETM) attach sales raise average contract value by 7%-9%, but the business still depends on existing customers for about 90%; AI automated remediation may also weaken the differentiation of traditional patch management. Morgan Stanley expects 2027 revenue growth of 7.3% and an operating margin of 42.2%, both below consensus, so it maintains Underweight and a $130 target price, implying 33.91% downside. As enterprise cybersecurity budgets concentrate toward super-platforms, the real premium must be delivered through strong growth Palo Alto and CrowdStrike receive Overweight, the most optimistic bullish rating Morgan Stanley gives, with the core being the conversion of multiple security links into continuous subscriptions from the same customer. Palo Alto integrates network, cloud, and security operations budgets through products such as Prisma and Cortex. Morgan Stanley's base case forecasts calendar 2028 revenue of about $17.5 billion, an operating margin of about 31%, and a free cash flow margin of about 40%. CrowdStrike is expanding from endpoint protection to identity, cloud security, and security information and event management (SIEM). Morgan Stanley expects long-term revenue growth to remain above 20%, with free cash flow compounding at more than 25% over the next three years. The basis for both companies' premium is customer expansion, cross-selling, and operating leverage. In terms of scenario valuation, Morgan Stanley's research report shows that Palo Alto's bull-case target price is as high as $497corresponding to potential upside of 43.12%and its bear-case price is $253; CrowdStrike's bull-case price is $308, corresponding to potential upside of as much as 28.69%, and its bear-case price is $103. All are scenario assumptions rather than base targets. The key for Tenable is to convert exposure management demand into orders and renewals. Its federal business accounts for about 15%, and the third quarter is also an important season for government procurement. Whether operational technology (OT) security demand and high-level government certifications can bring actual contracts will determine earnings elasticity. Morgan Stanley expects third-quarter Calculated Current Billings of $287.1 million, or growth of 7.3%, and is watching whether the 106% net dollar expansion rate (DBNE) in the second quarter can continue to improve. Tenable One and newly added AI capabilities have attracted customer interest, but the business mix between existing and new customers remains about 85:15; the continuous threat exposure management (CTEM) opportunity has not yet been fully reflected in revenue reacceleration. Its 2027 revenue growth forecast is 5.5%, below the 7.2% consensus, so it maintains Equal-weight and a $35 target price, implying 13.94% downside. The constraints on Check Point and Rapid7 lie in customer acquisition capability and transformation delivery, respectively. Check Point relies on existing customer satisfaction and migration costs to maintain its business; Harmony Email and CloudGuard have improved, but new customer acquisition, SASE competitiveness, and commercialization of AI products remain relatively weak; Morgan Stanley expects third-quarter revenue of about $670 million, down about 1% year over year, and maintains Equal-weight and a $133 target price, implying 7.27% downside. Rapid7 has not yet proved that cost cuts can bring a growth turnarounda 12% workforce reduction improves profit, but severance expenses offset part of the cash benefit, and the full-year free cash flow guidance remains about $130 million; Morgan Stanley expects third-quarter revenue to fall 4.1% and 2027 revenue to still decline 1.7%, maintaining an Underweight rating and a $9 target price, implying 33.38% downside. Morgan Stanley's coverage of these two companies also highlights that cybersecurity industry demand growth must ultimately be activated into a stronger shareholder return trajectory through product competitiveness, sales execution, and cash collection. Why does cybersecurity demand continue to expand under the AI agent frenzy? From a technical mechanism perspective, agents push software from "providing answers" to "holding permissions and executing operations": they can call application programming interfaces (APIs), read enterprise data, run code, and modify business states. Once malicious web pages, emails, or tool-returned content change their behavior through prompt injection, the risk may escalate from incorrect answers to data leakage or unauthorized operations; improper execution by the model itself may also produce similar consequences. Therefore, enterprises need to implement machine identity management, least privilege, tool-call authorization, runtime monitoring, and rapid isolation outside the model, rather than relying solely on the model's promise to follow rules. At the same time, AI lowers the cost of vulnerability discovery and mass attacks, compressing enterprises' remediation windows; the agents enterprises deploy themselves also add identities, workloads, and data flows that need protection. Palo Alto disclosed that traffic from its SASE agents had expanded more than 9x in the previous nine months, showing that the scale of protection is breaking away from a growth model that relies solely on the number of human employees. Derived from engineering and commercialization perspectives, cybersecurity super-platforms that own endpoint, identity, network, and cloud data and can directly execute blocking and remediation are better positioned to convert new protection tasks into cross-module subscriptionsthat is, the value large customers buy is shortening the time from detecting anomalies to containing losses. This increasingly strong cybersecurity demand in the AI era also means that even as open-source and closed-source AI large models compete fiercely, cybersecurity demand still has cross-route resilience. Cybersecurity demand depends on the scale and depth of permissions with which AI enters real business, not on which model business model wins. Open-source and open-weight models expand local deployment and customization, requiring protection of model files, software dependencies, inference environments, and enterprise data; closed-source models penetrate enterprise processes through APIs and likewise require management of credentials, access boundaries, data egress, and agent behavior. Both routes will hand more business execution authority to software, continuously expanding the scope of security governance. It follows that security platforms capable of implementing controls across models, clouds, and applications have a long-term benefit basis; Morgan Stanley's rating divergence between platform giants and traditional vulnerability management vendors also reveals that the eventual winners are more likely to be platforms that master enterprise security data, execution control, and customer trust, rather than all companies labeled with cybersecurity.