Bernstein: Cybersecurity Valuations Overstretched, Downgrades Palo Alto and Two Others
nashnova research
Bernstein cut Palo Alto Networks, Okta, and SentinelOne from outperform to market-perform, arguing that ~100% gains since early 2026 have pushed implied growth expectations well beyond fundamental improvement — the stocks ran too far, not the businesses.
What is the core reason for the downgrade?
All three stocks have rallied roughly 100% or more since early 2026, front-loading future growth into current prices.
This means → Bernstein is not turning bearish on fundamentals. The call is that the valuation premium the market assigns is now too high for the risk-reward to work.
The central question has shifted from "Is AI an opportunity or threat for cyber?" to "How much future growth is already priced in?"
Price targets went up — isn't that a contradiction?
Palo Alto's target rose from $253 to $351, Okta from $143 to $174, SentinelOne from $21 to $25.
In plain terms = Bernstein acknowledges all three are better businesses than previously expected, so it raised "fair value" — but the stocks have already blown past that fair value, hence the downgrade.
For context, Palo Alto, Cloudflare, CrowdStrike, Okta, and Fortinet all trade above Bernstein's updated targets.
Where does the sector's valuation stand now?
Cybersecurity EV/NTM-revenue multiples (how much the market pays per dollar of forward sales) are broadly above application-software peers — some even exceed AI-benefiting consumer infrastructure names.
Cloudflare and CrowdStrike both trade at roughly 36× NTM revenue.
Bernstein ran a regression on the "Rule of 40" (revenue growth + margin ≥ 40%) and found most covered names at or above the model-implied fair multiple — even using Bernstein's own estimates, which already sit above Street consensus. Outside Zscaler, the firm sees no meaningful upside left.
Can Flex contracts sustain the growth the stocks imply?
Flex contracts — where a customer commits a dollar amount upfront, then flexibly draws on different products within that budget — are accelerating upsell and cross-sell across the sector.
CrowdStrike is the clearest case: Bernstein estimates Flex-driven expansion added roughly $30–40 million in incremental ARR in the latest quarter.
But that is not enough. This means → cybersecurity demand has a natural ceiling tied to headcount and endpoint count, growing at a steady clip — fundamentally different from cloud infrastructure's usage-based, open-ended expansion. Strip out easy base effects, and CrowdStrike's "true" net-new ARR growth is in the high-20s percent range, not the 40%+ the valuation implies.
Why is Zscaler the sole outperform?
Zscaler is the only cybersecurity name in Bernstein's coverage still rated outperform, with a target lifted from $224 to $298.
Its Sept 16 close was just $191.58 — well below target, while every other covered name trades above its target.
This reflects Bernstein's view that Zscaler's earlier slowdown stemmed from a deliberate sales-strategy overhaul, not competitive weakness. That three-year transformation is now in its final stage, with FY2026 net revenue retention holding at 115%.
What is left for SentinelOne and Okta?
Despite the downgrade, Bernstein flags SentinelOne as an attractive potential acquisition target, with possible buyers including Anthropic, Alphabet, and Palo Alto Networks. In plain terms = being bought is a value catalyst independent of where the stock trades on its own.
Bernstein stresses this is a strategic-fit analysis — no acquisition talks are known to be underway.
Okta's biggest upside wildcard is AI-agent infrastructure: as AI agents begin accessing enterprise apps on behalf of users, identity verification demand could surge — but the timeline, pricing, and ultimate demand scale all remain unclear.
市场有风险，内容仅供研究参考，不构成投资建议。