CSCO's Splunk AI Push Gains Momentum: Can It Outpace DDOG & CRWD?

Cisco's Splunk added more than 280 customer logos in fiscal Q4 2026, surpassing its annual target of 1,000 additions, while Cisco's security portfolio delivered double-digit order growth. Cisco expanded Splunk's AI security and observability tools for agentic-AI deployments, including AI POD, agent monitoring, token-cost analytics and security operations capabilities. Competitive pressure remains substantial from Datadog and CrowdStrike, while CSCO trades at 21.27x forward earnings versus 20.39x for the sector and its $1.32 EPS consensus estimate has declined by $0.05 over 30 days.

Analysis

The investable issue is not feature parity but procurement ownership. CSCO can bundle observability into network-refresh and security-platform contracts, lowering standalone sales friction and potentially improving Splunk retention; however, this also makes Splunk’s incremental revenue harder to isolate and risks discounting rather than high-margin net-new ARR. DDOG and CRWD remain better pure-play beneficiaries if agentic-AI workloads create a new, usage-driven telemetry layer rather than a consolidated enterprise-security budget.

Near term, the signal is insufficient to alter estimates: logo additions and product launches do not establish consumption, attach rates, or renewal pricing. Over the next 1-3 months, CSCO needs to demonstrate security/observability growth translating into software mix expansion and stable gross margin; absent that, its above-sector multiple leaves limited room for a narrative-driven rerating. For DDOG, AI workload monitoring can expand log, trace and GPU-related usage, while CRWD’s SIEM momentum offers the clearest displacement vector against legacy Splunk deployments.

Contrarian view: CSCO’s installed base is a distribution advantage but can be a handicap in AI observability. Cloud-native buyers prioritize cross-cloud, developer-led tools and may resist infrastructure-vendor lock-in; therefore, product breadth alone is unlikely to compress DDOG’s growth premium. Conversely, CRWD’s rapid SIEM growth raises execution and pricing risk: a material slowdown in module adoption would expose a premium valuation more sharply than it would affect CSCO.

Six-to-eighteen months, the likely market structure is coexistence rather than winner-take-all: CSCO owns hybrid-network telemetry, DDOG captures developer observability, and CRWD monetizes security operations. The key falsifier is evidence that customers standardize on one data layer and reduce duplicate telemetry spend; monitor net retention, SIEM migrations, and security-platform bundle discounting.

Key Decisions for Investors

• Maintain a neutral CSCO stance into the next earnings release; upgrade only if security/observability growth accelerates while gross margin holds and management quantifies Splunk ARR or attach-rate expansion. A guidance cut or further consensus EPS erosion would invalidate a bullish rerating thesis.
• Prefer DDOG over CSCO on a 6-12 month relative basis for AI-observability exposure, sized modestly given valuation sensitivity. Thesis requires sustained usage growth and stable net retention; exit the pair if DDOG reports decelerating consumption or CSCO discloses material Splunk bundle penetration with improving software margins.
• Maintain CRWD as the higher-beta security-platform exposure, but avoid chasing strength ahead of earnings. Add only on evidence that Next-Gen SIEM growth converts into durable multi-module adoption; a sequential ARR slowdown or rising sales-and-marketing intensity would be a clear risk trigger.
• No action in QBTS: the article provides no linkage between quantum computing economics and enterprise observability or security spending.