AI Agents Fuel a New Cybersecurity Boom

Rosenblatt Securities analyst Catharine Trebnick identifies AI-agent security as a growing cybersecurity opportunity as AI evolves from conversational tools to autonomous systems. Demand is expected to increase for CrowdStrike and Palo Alto Networks products that monitor AI agents, identities and permissions. Trebnick argues that more capable frontier AI models should reinforce the competitive position of established cybersecurity platforms.

Analysis

The investable question is not whether agentic AI expands the attack surface, but whether it creates incremental security spend or merely reallocates existing identity, endpoint and cloud budgets. PANW is better positioned to monetize a platform consolidation cycle: agent governance can be bundled into Prisma, Cortex and identity-adjacent workflows, lifting wallet share and reducing vendor count. CRWD has the cleaner endpoint/identity telemetry advantage, but its valuation leaves less room for a thematic multiple expansion unless agent-security modules visibly accelerate net-new ARR and retention.

Near term, this is more likely a sales-cycle and narrative catalyst than an earnings catalyst; enterprises will pilot controls over the next 1-3 quarters while waiting for clearer internal AI deployment standards. The 6-18 month structural beneficiary is the vendor with policy enforcement across identities, data, cloud workloads and endpoints, rather than a point solution that only discovers AI agents. Second-order pressure falls on standalone identity and cloud-security vendors—OKTA, TENB and potentially ZS—if customers demand unified policy, telemetry and remediation rather than another dashboard.

Consensus may be overstating the immediacy of a discrete "agent security" budget. Many autonomous-agent deployments remain narrow and human-supervised, while large enterprises can initially govern them through existing privileged-access, data-loss prevention and identity controls. The thesis is falsified if PANW and CRWD commentary indicates pilots are not converting into paid modules, or if billings/RPO growth and remaining-performance-obligation trends fail to improve by the next two earnings cycles.

Key Decisions for Investors

• Prefer PANW over CRWD on a 6-12 month pair basis: long PANW / short CRWD in equal dollar amounts if the relative spread moves to a new 12-month CRWD premium. PANW offers greater cross-platform attach potential; exit if PANW's next two billings or RPO prints underperform CRWD by more than 500 bps.
• Maintain CRWD as an event-driven watch rather than chase the theme: initiate only following evidence of paid AI/identity module attach in earnings commentary and a post-results pullback. Target a 10-15% upside over 3-6 months versus an 8% stop, with ARR growth and gross-retention stability as confirmation metrics.
• Monitor OKTA and ZS for 1-3 quarter competitive-displacement signals. Consider a tactical short basket only if either reports weaker large-customer expansion while PANW or CRWD cites platform consolidation; absent that evidence, agent-security rhetoric alone is insufficient for a short.
• Set an alert around enterprise AI governance regulation and major disclosed agent-related breaches. A high-profile incident would pull forward security spending and favor PANW/CRWD; conversely, delayed enterprise AI rollouts or guidance that frames controls as existing-product functionality would cap incremental revenue expectations.