The AI boom is driving up cybersecurity stock valuations: capital is beginning to find “cheaper” targets such as Okta (OKTA.US) and FTNT.US (FTNT.US) are receiving market attention

The Zhitong Finance App learned that Morgan Stanley said in the latest cybersecurity industry report that with the rapid development of AI agents, the security risks faced by enterprises are also increasing, and cybersecurity market spending is expected to accelerate further. Among them, large security platforms such as Palo Alto Networks (PANW.US) and CrowdStrike (CRWD.US) are most likely to gain market share. However, overvaluation has now become the biggest concern of investors, and as a result, some of the funds are turning their attention to the relatively low valuations of Okta (OKTA.US), Fita Information (FTNT.US), SentinelOne (S.US), and SailPoint (SAIL.US).

Morgan Stanley said that after recent exchanges with investors, it was discovered that the market generally acknowledged that AI security risks would drive the growth of cybersecurity demand, and also agreed that large platform vendors have the potential to further expand their market share. However, the valuations of CrowdStrike and Palo Alto Networks have reached about 30 times and 18 times the expected sales in 2028, respectively, making many investors who have not yet entered the market choose to wait for a better time to buy.

It is worth noting that as more and more reports of AI agents “jailbreaking” and malicious acts of autonomous agents appear, it may be difficult to significantly cool down the topic of cybersecurity investment. This also means that investors who have been waiting for major cybersecurity stocks to pull back may eventually have to re-enter the market.

AI agents bring new security challenges Cybersecurity spending is expected to accelerate

Morgan Stanley has previously conducted special research on AI and cybersecurity, and proposed three possible scenarios for future cybersecurity spending: maintaining the status quo, companies speeding up security investment, and cybersecurity vendors unable to keep up with the growth rate of attacks and vulnerabilities, which will eventually lead to a slowdown in overall industry spending.

Judging from investor feedback, most people think the first scenario is most likely to occur, that is, enterprises will not suddenly drastically increase their cybersecurity budget, but as the new risks brought about by AI continue to increase, cybersecurity investment will gradually accelerate.

Under this scenario, Morgan Stanley predicts that the cybersecurity market growth rate may accelerate to about 20% or more. At the same time, some investors who have not previously allocated cybersecurity stocks are more concerned about the extreme situation, that is, large-scale security incidents may occur in the future, and existing cybersecurity vendors are unable to respond effectively. However, Morgan Stanley believes that in the short term, such investors may face greater pressure to break out because the market is re-evaluating the allocation value of cybersecurity assets in the AI era.

According to the report, as autonomous AI agents are increasingly exposed to enterprise systems, data, and applications, the objects that enterprises need to protect are also changing. Traditional cybersecurity requirements have not disappeared, and new security requirements around the governance of AI agent identity, authority, and behavior are emerging.

Palo Alto, CrowdStrike have outstanding advantages, but high valuations make investors hesitate

Judging from the competitive landscape, Morgan Stanley believes that Palo Alto Networks and CrowdStrike are still the main beneficiaries generally recognized by the market under the AI cybersecurity trend. CrowdStrike, in particular, has continued to expand its business from traditional terminal security to SIEM, identity protection, and cloud security. Morgan Stanley believes that the continued increase in market share, the increase in the adoption rate of emerging modules, and the favorable position in the AI field are expected to help CrowdStrike maintain revenue growth of more than 20% over the long term.

According to the report, Morgan Stanley expects CrowdStrike's ARR to increase 25.8% year-on-year in FY2027 and 24.7% in FY2028; operating profit margin is expected to increase further from 25.1% to 27.2% during the same period.

Morgan Stanley also updated CrowdStrike's financial model. The bank currently expects the company's ARR to reach US$8.236 billion in fiscal year 2028, higher than the previous forecast of US$8.115 billion; the net increase in ARR for fiscal year 2028 is expected to reach US$1,629 billion, up about 8.1% from the previous forecast. Revenue for the same period is expected to reach $7.337 billion.

Judging from the product structure, CrowdStrike's future growth momentum is also gradually shifting from traditional terminal security to new businesses such as next-generation SIEM, cloud security, and identity protection. Morgan Stanley expects that the proportion of Cloud, Identity, and Next-Gen SIEM-related ARRs in the company's total ARR will continue to increase and eventually surpass traditional terminal security services.

However, valuation is still the most obvious concern for investors when facing CrowdStrike and Palo Alto Networks. This also explains why, while optimistic about the overall prospects of the cybersecurity industry, more and more investors are looking for relatively inexpensive alternatives.

Okta's interest in finding “cheaper” cybersecurity stocks to fund is clearly heating up

In Morgan Stanley's recent investor exchanges, Okta and Feita Information became the most frequently mentioned companies in addition to the two core platforms, and SentinelOne and SailPoint also appeared in about a quarter of the exchanges.

Among them, Okta received particular attention. Morgan Stanley believes that as the number of AI agents increases, “agentic identity” (Agentic Identity) may become a new long-term growth direction for the cybersecurity industry. The future of enterprises will need not only to manage the identity and access rights of human employees, but also to confirm who the different AI agents are, what permissions they have, what systems they can access, and how they interact with each other.

This makes identity and access management (IAM) even more important. At Oktane's recent Oktane conference held by Okta, the company unveiled a number of AI-related products, including Agent SSO, A2A connectivity, and the “Blueprint Alliance” to help enterprises protect and govern AI agents. The company's management also said that, driven by AI agents, IAM may become one of the largest markets in the entire cybersecurity industry in the next five years.

As a result, Morgan Stanley raised Okta's target price from $200 to $245 and maintained an “overweight” rating.

The main reason for raising Okta's target price by 22.5% this time is not a drastic increase in recent profit forecasts, but rather a better judgment on the company's long-term valuation. The bank raised Okta's 2027 estimated free cash flow valuation ratio from 33 times to 41 times, corresponding to about 12 times the expected corporate value/sales in 2027, up from 9.6 times the previous one. Morgan Stanley believes that this valuation can better reflect Okta's competitive position in the field of identity management for AI agents and the growth opportunities brought about by the modernization of identity systems.

According to the risk-return analysis, Morgan Stanley's basic scenario gave Okta a valuation of 245 US dollars, corresponding to the company's free cash flow of about US$1,037 billion in 2027; under the optimistic scenario, the target valuation could reach 285 US dollars.

Morgan Stanley expects Okta's compound annual free cash flow growth rate of 15% to 20% in the next few years. At the same time, the bank estimates that the identity and access management market is over $40 billion, and Okta still has room to increase its market share for a long time.

However, Morgan Stanley believes that the growth brought about by AI agent identity will not explode immediately. In the short term, Okta's current improvements come more from companies resolving technical debts accumulated in the past, and opportunities related to AI agents are expected to gradually unfold.

Feita Information is also receiving attention whether the network equipment update cycle can continue to be the focus

In addition to Okta, Feita Information is also a company that investors focus on when looking for relatively undervalued cybersecurity targets.

Morgan Stanley pointed out that in the past few quarters, as companies dealt with previously accumulated technical debts, the growth of Feita Information products accelerated markedly. However, what the market is currently concerned about is whether this growth can continue, especially after entering the centralized equipment renewal cycle during the pandemic next year, and the company may face a higher year-on-year base.

The bank is currently relatively cautious about this, believing that a higher comparison base may make it more difficult for Feita information to continue to exceed expectations. At the same time, this trend may also affect the entire firewall industry such as Cisco (CSCO.US) and Check Point (CHKP.US).

Although SentinelOne and Sailpoint are mentioned less frequently in investor exchanges, both companies have a growth level of about 20% and at the same time have more attractive valuations, so they are also beginning to enter the attention of more investors.

Cybersecurity demand is expected to accelerate high valuations and drive funding to find alternative targets

Morgan Stanley summed up the current cybersecurity sector as being expensive to value, but investment is increasingly essential. On the one hand, AI agents can improve enterprise productivity; on the other hand, they also expand the potential attack surface and bring about new security requirements such as authentication, access rights, and AI behavior governance. Morgan Stanley believes that this trend is expected to accelerate the growth of the cybersecurity market while further strengthening the market position of large platform vendors.

However, for investors, the question has gradually changed from “whether AI will increase demand for cybersecurity” to “at what price to participate in this trend.” Palo Alto Networks and CrowdStrike's position in the industry is widely recognized, but high valuations limit the willingness of some capital to enter; at the same time, Okta Information, and companies with relatively low valuations such as SentinelOne and SailPoint are getting more attention as a result.