AI boom drives up cybersecurity stock valuations; Morgan Stanley: Capital begins seeking 'cheaper' targets; Okta (OKTA.US), Fortinet, Inc. (FTNT.US) and others draw market attention.

Morgan Stanley said in its latest cybersecurity industry report that as AI agents develop rapidly, the security risks facing enterprises are also increasing, and cybersecurity market spending is expected to accelerate further, with large security platforms such as Palo Alto Networks (PANW.US) and CrowdStrike (CRWD.US) most likely to gain market share. However, high valuations have become investors' biggest concern, prompting some capital to turn its attention to relatively lower-valued names such as Okta (OKTA.US), Fortinet, Inc. (FTNT.US), SentinelOne (S.US), and SailPoint (SAIL.US). Morgan Stanley said that after recent exchanges with investors, it found that the market generally recognizes that AI security risks will drive growth in cybersecurity demand, and also agrees that large platform vendors have the potential to further expand market share. But CrowdStrike and Palo Alto Networks are already valued at about 30 times and 18 times their expected 2028 sales, respectively, leading many investors who have not yet entered to wait for a better buying opportunity. It is worth noting that with more and more reports emerging about AI agent "jailbreaks" and malicious behavior by autonomous agents, the cybersecurity investment theme may find it difficult to cool noticeably. This also means that investors who have been waiting for a pullback in large cybersecurity stocks may ultimately have to re-enter the market. AI agents bring new security challenges; cybersecurity spending is expected to accelerate Morgan Stanley previously conducted dedicated research on AI and cybersecurity and proposed three possible scenarios for future cybersecurity spending: maintaining the status quo, enterprises accelerating efforts to fill gaps in security investment, and cybersecurity vendors being unable to keep up with the pace of attacks and vulnerabilities, ultimately causing spending across the entire industry to slow. Based on investor feedback, most believe the first scenario is most likely, meaning enterprises will not suddenly increase cybersecurity budgets sharply, but as new risks brought by AI continue to increase, cybersecurity investment will gradually accelerate. Under this scenario, Morgan Stanley expects the cybersecurity market growth rate could accelerate to more than about 20%. At the same time, some investors who previously had no allocation to cybersecurity stocks are more worried about an extreme scenario, namely that a major security incident may occur in the future and existing cybersecurity vendors cannot respond effectively. But Morgan Stanley believes that in the short term, such investors may instead face greater pressure from missing out, because the market is reassessing the allocation value of cybersecurity assets in the AI era. The report argues that as autonomous AI agents increasingly come into contact with enterprise systems, data, and applications, the objects enterprises need to protect are also changing. Traditional cybersecurity demand has not disappeared, while new security needs around AI agent identity, permissions, and behavior governance are emerging. Palo Alto and CrowdStrike stand out, but high valuations make investors hesitate From the perspective of the competitive landscape, Morgan Stanley believes Palo Alto Networks and CrowdStrike remain the main beneficiaries widely recognized by the market under the AI cybersecurity trend. CrowdStrike in particular has continuously expanded from traditional endpoint security into areas such as SIEM, identity protection, and cloud security. Morgan Stanley believes that continued market share gains, growing adoption of emerging modules, and a favorable positioning in AI could help CrowdStrike maintain revenue growth of more than 20% over the long term. The report shows that Morgan Stanley expects CrowdStrike's fiscal 2027 ARR to grow 25.8% year over year and fiscal 2028 ARR to grow 24.7%; over the same period, its operating margin is expected to rise further from 25.1% to 27.2%. Morgan Stanley also updated CrowdStrike's financial model. The bank now expects the company's fiscal 2028 ARR to reach $8.236 billion, higher than its previous estimate of $8.115 billion; fiscal 2028 net new ARR is expected to reach $1.629 billion, raised by about 8.1% from the previous forecast. Revenue over the same period is expected to reach $7.337 billion. From a product structure perspective, CrowdStrike's future growth drivers are also gradually shifting from traditional endpoint security to new businesses such as next-generation SIEM, cloud security, and identity protection. Morgan Stanley expects the proportion of ARR related to Cloud, Identity, and Next-Gen SIEM to continue rising as a share of total company ARR and eventually surpass the traditional endpoint security business. However, valuation remains the most obvious concern for investors when looking at CrowdStrike and Palo Alto Networks. This also explains why, while remaining bullish on the overall outlook for the cybersecurity industry, more and more investors are beginning to look for relatively cheaper alternatives. Capital seeks "cheaper" cybersecurity stocks; attention on Okta rises noticeably In Morgan Stanley's recent investor discussions, Okta and Fortinet, Inc. became the most frequently mentioned companies besides the two core platforms, while SentinelOne and SailPoint also appeared in about one-quarter of the conversations. Among them, Okta has drawn particular attention. Morgan Stanley believes that as the number of AI agents increases, "Agentic Identity" may become a new long-term growth direction for the cybersecurity industry. In the future, enterprises will not only need to manage the identities and access permissions of human employees, but also need to confirm who different AI agents are, what permissions they have, which systems they can access, and how they interact with one another. This further raises the importance of identity and access management (IAM). At Okta's recent Oktane conference, the company released multiple AI-related products, including Agent SSO, A2A connections, and the "Blueprint Alliance" aimed at helping enterprises protect and govern AI agents. Company management also said that driven by AI agents, IAM could become one of the largest markets in the entire cybersecurity industry over the next five years. Morgan Stanley therefore sharply raised its Okta target price from $200 to $245 and maintained an "Overweight" rating. The 22.5% increase in Okta's target price was mainly not due to a significant upward revision in near-term earnings forecasts, but rather to a higher judgment on the company's long-term valuation. The bank raised Okta's valuation multiple on expected 2027 free cash flow from 33 times to 41 times, corresponding to about 12 times expected 2027 enterprise value/sales, up from 9.6 times previously. Morgan Stanley believes this valuation better reflects Okta's competitive position in the AI agent identity management space and the growth opportunities brought by modernization of identity systems. Risk-reward analysis shows that Morgan Stanley's base case gives Okta a valuation of $245, corresponding to about $1.037 billion in free cash flow in 2027; under the bull case, the target valuation could reach $285. Morgan Stanley expects Okta's free cash flow compound annual growth rate to reach 15%-20% over the next few years. At the same time, the bank estimates that the identity and access management market is worth more than $40 billion, leaving Okta with considerable room to gain share. However, Morgan Stanley believes the growth brought by AI agent identity will not explode immediately. In the short term, Okta's current improvement comes more from enterprises addressing technical debt accumulated in the past, while AI agent-related opportunities are expected to materialize gradually. Fortinet, Inc. also draws attention; whether the network equipment refresh cycle can continue becomes the focus In addition to Okta, Fortinet, Inc. is also a key company investors are focusing on when looking for relatively undervalued cybersecurity names. Morgan Stanley pointed out that over the past several quarters, Fortinet, Inc.'s product growth has accelerated noticeably as enterprises dealt with previously accumulated technical debt. But the market is now focused on whether this growth can continue, especially as the company may face a higher year-over-year base next year when it enters the concentrated refresh cycle for pandemic-era equipment. The bank is currently relatively cautious on this, believing that a higher comparison base may make it more difficult for Fortinet, Inc. to continue exceeding expectations. At the same time, this trend may also affect the entire firewall industry, including Cisco Systems, Inc. (CSCO.US) and Check Point (CHKP.US). Although SentinelOne and SailPoint were mentioned less frequently in investor discussions, both companies have growth rates of about 20% and more attractive valuations, and therefore have begun to enter the watchlists of more investors. Cybersecurity demand is expected to accelerate; high valuations push capital to seek alternatives Morgan Stanley summarizes the current cybersecurity sector as expensive in valuation, but increasingly indispensable in terms of investment. On the one hand, AI agents can improve corporate productivity; on the other hand, they also expand the potential attack surface and create new security needs such as identity verification, access permissions, and AI behavior governance. Morgan Stanley believes this trend is expected to drive an acceleration in cybersecurity market growth while further strengthening the market position of large platform vendors. But for investors, the question has gradually shifted from "whether AI will increase cybersecurity demand" to "at what price should we participate in this trend." The industry positions of Palo Alto Networks and CrowdStrike are widely recognized, but high valuations limit some capital's willingness to enter; at the same time, relatively lower-valued companies such as Okta, Fortinet, Inc., SentinelOne, and SailPoint are gaining more attention for this reason.