AI Agents Fuel a New Cybersecurity Boom

Rosenblatt Securities analyst Catharine Trebnick identified autonomous AI-agent security as a growing cybersecurity opportunity, driven by demand to monitor agents, identities and permissions. She expects increasingly capable frontier AI models to reinforce established security platforms, benefiting providers such as CrowdStrike and Palo Alto Networks.

Analysis

The monetization question is not whether agent security becomes a budget line, but whether it is incremental to existing identity, endpoint and cloud-security spend. PANW is better positioned to bundle agent governance into Prisma Cloud, Cortex and its platformization strategy, limiting standalone-vendor pricing power; CRWD has a cleaner endpoint/identity telemetry advantage but faces a higher proof burden that agent activity is observable from its existing sensor footprint. Near term, the narrative supports security-platform multiples, though revenue impact is unlikely to appear meaningfully before FY27 budget cycles.

The more investable second-order effect is increased identity-security intensity: autonomous workflows multiply non-human identities, privileged credentials and machine-to-machine access faster than employee headcount. This favors PANW's broader cloud/network control plane and, outside the named names, Okta (OKTA), CyberArk (CYBR) and Microsoft (MSFT). It is unfavorable to point solutions whose products sit outside the policy-enforcement path, as enterprise buyers will prefer consolidated audit trails and remediation over another detection dashboard.

Consensus may overstate the immediacy of a new AI-security TAM. Agent deployments remain concentrated in bounded enterprise pilots, and many controls can initially be absorbed into current SIEM, identity and cloud-security modules rather than generating discrete ACV. The bullish case becomes materially stronger only if management begins disclosing AI-related net-new ARR, elevated identity-module attach rates, or measurable expansion in cloud-security remaining performance obligations over the next two earnings cycles.

For the next 1-3 months, this is a relative-quality rather than a broad cybersecurity-beta trade: PANW's platform cross-sell can convert interest into billings sooner, while CRWD's valuation is more exposed if AI enthusiasm fails to translate into module adoption. Over 6-18 months, a high-profile agent-permission failure or audit-driven governance mandate would accelerate procurement and favor incumbents with integrated telemetry; conversely, slower enterprise agent deployment or price-led bundling by MSFT would compress the standalone opportunity.

Key Decisions for Investors

• Prefer long PANW versus short a diversified cybersecurity basket (HACK) over 3-6 months: seek platform-driven billings upside with less dependence on a separately priced AI-security SKU. Reassess if PANW's next two reports show weakening NGS/Prisma momentum or if management cannot identify incremental AI-related module demand.
• Maintain CRWD as a watch-list long rather than chase narrative strength: initiate only following evidence of identity/cloud-module attach acceleration or a post-earnings drawdown that improves risk/reward. Falsifier: net-new ARR decelerates while sales-and-marketing intensity rises, implying AI governance is not producing incremental wallet share.
• Add CYBR to the agent-security monitor list for 6-18 months; non-human privileged identity is the most direct spend consequence if autonomous workflows move into production. Upgrade to a position upon disclosed machine-identity ARR or a material enterprise governance mandate, rather than on thematic commentary alone.
• Hedge the thesis through long PANW / short OKTA only if enterprise buyers demonstrate preference for integrated security platforms over identity specialists; close the spread if OKTA reports accelerating large-deal growth or improving dollar-based net retention, which would validate independent identity demand.