Evercore sees AI as growing cybersecurity threat

Evercore warned that frontier and agentic AI could materially increase the volume, speed and sophistication of cyberattacks by enabling thousands of autonomous agents to identify targets, probe vulnerabilities and deploy exploits continuously. The firm views the resulting expansion in enterprise attack surfaces and machine identities as supportive of durable cybersecurity spending, particularly for identity and security vendors including Okta, Palo Alto Networks, CyberArk, SailPoint and CrowdStrike. The near-term balance of cyber offense and defense may tilt toward attackers, but the spending implications are constructive for the cybersecurity sector.

Analysis

The investable implication is not simply higher cybersecurity budgets; it is a re-ranking within security spend toward identity governance, privileged access, machine-identity lifecycle management, and runtime detection. OKTA and CYBR have the cleanest direct exposure to the non-human identity bottleneck, while PANW can bundle identity, cloud, network and SOC automation into an existing platform footprint. CRWD benefits if incident frequency drives endpoint/XDR consolidation, but its valuation leaves less tolerance for any net-retention or module-adoption deceleration.

Near term, this is more likely a narrative support than an earnings-moving catalyst: CISOs typically reallocate budget during annual planning cycles, implying a 1-3 quarter lag before agent-security demand appears in bookings and RPO. The key verification points are management commentary on AI-agent identities, identity attach rates, net new ARR, and large-enterprise deal cycles. A material breach tied to autonomous exploitation could compress procurement cycles and create a sharp sector bid, but it would also expose vendors with weak platform integration or high implementation friction.

Consensus may be overpaying for broad “AI security” exposure while underappreciating that autonomous agents can commoditize portions of alert triage and basic endpoint tooling. The durable pricing power should accrue to vendors controlling the policy and identity layer, where switching costs and audit requirements are highest. This favors CYBR/OKTA selectively over a blanket long cybersecurity basket; PANW remains the better defensive platform expression if buyers prefer vendor consolidation over adding specialized tools.

Key Decisions for Investors

• Initiate a 3-6 month pair: long CYBR / short CRWD in equal dollar amounts. Thesis is superior direct exposure to privileged and machine identities versus more crowded endpoint/XDR expectations; target 10-15% relative upside, with a stop if CYBR billings growth trails CRWD by more than 10 percentage points for two consecutive reported quarters.
• Accumulate PANW on market weakness rather than chase the theme. Its platform-consolidation model should capture incremental spend even if enterprises avoid adding point products; reassess if next-quarter remaining performance obligations or NGS ARR guidance indicates sustained mid-teens-or-lower growth.
• Place OKTA on an earnings watch list, not a full-size position, pending evidence that agent identity is translating into paid enterprise adoption. Buy only if management quantifies machine-identity attach or raises forward subscription guidance; the falsifier is continued large-customer seat contraction or deteriorating dollar-based net retention.
• Avoid using APP or SMCI as proxies for this theme. Their AI exposures do not monetize the enterprise security-control layer, and any sympathy move would be a liquidity-driven narrative trade rather than a fundamentals-backed cybersecurity position.