Cybersecurity Stocks Are So Hot Investors Question Staying Power

Shares of cybersecurity companies have soared in recent months on bets that the threats posed by cutting-edge AI models will be a boon for their businesses. But some of the stocks have run up so much that investors are questioning whether they’ve gone too far.

A basket of cybersecurity stocks tracked by Goldman Sachs has more than doubled since hitting a low on April 10 after Anthropic restricted the release of its Mythos AI model over concerns it could power cyberattacks. Crowdstrike Holdings Inc., Palo Alto Networks Inc. and Fortinet Inc. have all gained more than 130% since then, putting them among the 10 best performers in the S&P 500 over that span.

The Goldman basket, which closed at a record high on Wednesday, fell more than 1% on Thursday amid a widespread selloff across the tech sector.

The rapid gains have made security stocks some of the most expensive in the market. CrowdStrike is priced at more than 170 times estimated earnings, which is second only to Tesla Inc. in the S&P 500, according to data compiled by Bloomberg. Palo Alto Networks is the fifth-most expensive in the index at 91 times profit projected over the next 12 months. Fortinet’s multiple of 48 ranks 16th.

“If you’re looking to get in now, you have to recognize that what you’re paying reflects the expectation that everything will be perfect in the future,” said Brad Long, chief investment officer at Wealthspire, which has about $593 billion in assets. “The tailwinds for cybersecurity are obvious, but if we see any weakness — if the AI capex cycle slows, or even if we stop seeing so many sophisticated AI attacks — then their revenue could slow and the stocks could sell off materially.”

The rally is in stark contrast to the beginning of the year, when AI disruption fears sparked an indiscriminate selloff across the software industry. While those worries have subsided for many software companies amid strong financial performance in the sector, a series of recent warnings from within the AI industry about grave threats posed by the technology have provided investors with another reason to buy cybersecurity stocks.

The Goldman cybersecurity basket has jumped 18% since Sept. 11, the last trading day before Anthropic Chief Executive Officer Dario Amodei called for slowing development of the most advanced models.

With the need for stronger cybersecurity defenses now widely accepted, the question is whether the companies can deliver revenue and profit growth to satisfy expectations implied by their nose-bleed valuations.

“Cybersecurity may have gotten over its skis,” Bernstein analyst Peter Weed recently cautioned while cutting his ratings on Palo Alto, Okta Inc. and SentinelOne Inc.

While the group is seeing real demand, “implicit in the sector stock prices seem to be a degree of acceleration that could rival consumption software like hyperscaler compute or databases,” he wrote in a Sept. 17 note. But cybersecurity growth is likely to be constrained by practical factors like customers’ employee headcount, Weed said.

Still, fundamentals appear to be heading in the right direction. In late August, a better-than-expected revenue forecast from CrowdStrike sent the stock up more than 20% the day after earnings, the most since 2019.

“The Mythos moment translated into mass-market acceptance that AI adoption needs security,” Chief Executive Officer George Kurtz said in a statement in the earnings report. “Every enterprise will run on AI, and securing it is the largest market opportunity in our history.”

There have been a number of AI-assisted hacks this year, as well as breaches by AI agents that have alarmed cybersecurity experts and AI developers.

On Thursday, Australian Prime Minister Anthony Albanese said an OpenAI model had hacked a government website earlier this year, gaining unauthorized access to files on a site for reporting healthcare statistics.

In July, OpenAI said its AI models inadvertently hacked Hugging Face Inc. Last week, Google revealed its Gemini AI model made similar incursions into three company systems during security testing.

“We believe the market is increasingly pricing in a step-function increase in cyber risk, supporting both higher security spending and a more constructive valuation framework across the sector,” Bank of America analyst Tal Liani wrote in a Sept. 18 note. He called cybersecurity “a mega-theme and enabler of the AI era” while raising his price targets on CrowdStrike, Okta, and SailPoint Inc.

Despite the run-up in cybersecurity stock prices, valuation signals can be deceiving if growth outpaces expectations, according to Josh Taves, managing director at Post Oak Group.

“I understand if people are approaching security with a little more trepidation given how much it has risen this year, but while I expect budgets for other kinds of software will decrease as AI models take over, security spending should hold strong or even increase,” he said. “Traditional valuation metrics don’t hold as much water in an environment like this. Investors will pay more because the demand backdrop is so strong.”

Photo: Cables feed into a server inside a comms room. Photo credit: Chris Ratcliffe/Bloomberg