Agentic security is the billion-dollar challenge for some clever startup to solve

Cybersecurity investors say rapidly deployed AI agents are creating urgent security gaps—including uncontrolled access to critical data, weak non-human identity management, and limited auditability—after real-world incidents involving rogue agent behavior. Merlin Group and Microsoft’s M12 see a large startup opportunity in comprehensive agentic identity, governance and AI endpoint-security platforms, with M12 suggesting the category could produce the next Okta or a "CrowdStrike for AI." The investment case is tempered by concern that enterprises will reject fragmented point solutions and that incumbent endpoint and antivirus providers will also enter the market.

Analysis

The investable implication is likely consolidation rather than a broad cybersecurity rerating. Enterprises facing agent-permission risk will favor platforms that can combine discovery, privileged access, policy enforcement, telemetry and auditability; this favors CYBR, MSFT and PANW’s existing control-plane distribution over point products, while making standalone agent-security vendors attractive acquisition targets rather than durable public-market competitors. CRWD has a credible adjacency in runtime detection, but endpoint-only positioning is insufficient if the budget owner defines the problem as identity governance.

OKTA has strategic optionality because agent identities expand the addressable identity surface, but also the highest execution burden: buyers will demand governance and privileged-access workflows, not another authentication layer. Its upside therefore depends on attaching governance products and demonstrating net retention improvement, whereas CYBR is better positioned if agent credentials are treated as privileged non-human identities. MSFT’s bundled security stack may cap pricing across the category, particularly for lower-complexity customers, even as it expands overall adoption.

Near term, this is a sentiment and product-roadmap catalyst, not yet a material earnings driver; security budgets generally require a visible incident, board mandate, or procurement-cycle reset before incremental spend converts. Over 6-18 months, a major agent-enabled breach or regulatory requirement for action-level logging could accelerate platform consolidation and raise valuation premiums for identity and security-data vendors. The contrarian risk is that model providers embed permissioning, sandboxing and traceability into their platforms, commoditizing a meaningful portion of the proposed standalone security layer.

Key Decisions for Investors

• Prefer long CYBR over OKTA for the next 6-12 months: express through an equal-dollar pair rather than outright beta. The thesis is that privileged non-human identity becomes a required control while OKTA must prove broader governance attach; exit if CYBR’s recurring-revenue growth decelerates materially relative to OKTA or if OKTA shows sustained governance-led reacceleration.
• Maintain or add selectively to CRWD only on evidence that AI-runtime modules are monetizing through higher module adoption, not product announcements. Treat the next two earnings cycles as the validation window; reduce if incremental ARR growth fails to improve despite AI-security messaging, since Microsoft bundling can limit standalone endpoint pricing.
• Use MSFT as the lower-volatility beneficiary rather than chasing early-stage agent-security narratives: its distribution can monetize through higher security-suite penetration even if the category becomes commoditized. The key falsifier is evidence that large enterprises are selecting specialist platforms over bundled controls in meaningful procurement volumes.
• Set a watch trigger for a disclosed agent-related enterprise breach, new federal/critical-infrastructure audit mandates, or explicit CISO budget reallocations toward non-human identity. That event would justify increasing CYBR/CRWD exposure and reassessing private-market acquisition beneficiaries; absent it, avoid assuming a near-term revenue inflection from category enthusiasm alone.