Cybersecurity Rally: Can AI Protection Convert into Revenue?

This piece looks at whether the "AI protection" demand behind the October 23 cybersecurity rally is new spending or existing security budgets being relabeled. It sets out what CrowdStrike, Palo Alto Networks and Cloudflare each need to turn it into revenue, and uses Fortinet, the smallest gainer, as a counter-example. Prices are as of the US close on Friday, October 23, 2026. At the time of writing (before the US open on Monday, October 26), Monday's session had not started.

1. A rally that mostly recovered lost ground

On October 23, CrowdStrike (CRWD) closed up 8.25% at $257.57. It ranked first on Aya's US heat list with a score of 83, on 1.5x normal volume. The same day Palo Alto Networks (PANW) rose 7.22%, Cloudflare (NET) 7.29% and Zscaler (ZS) 7.31%. The whole group moved together, which points to an industry-level driver rather than news at any one company.

Looking at that day alone overstates how optimistic the market is. Over two weeks, the rally mostly recovered the previous week's losses. On October 14, a report that OpenAI might buy a cybersecurity startup raised fears that AI model companies would compete directly with security vendors. On October 16, worries about how AI spending will be financed spread through tech and the group fell again. Measured from the October 13 close, by October 23 CRWD was still down 1.39%, PANW 4.15%, NET 6.32% and Fortinet (FTNT) 5.65%. None of the four had fully recovered.

What to see: the "rally" was a rebound from the 10/20 low, and FTNT rebounded the least.

2. What drove the move

Public reporting points to three catalysts, and the evidence behind each is not equally strong.

The first and most concrete was a PHP vulnerability. PHP is the programming language behind a large share of website back ends. According to 24/7 Wall St. (Oct 26), researchers at Wiz and Calif used OpenAI and Google models to find a severe PHP flaw in August, and it was disclosed on October 21. OpenAI funded the audit. The NSA and FBI then told operators to patch immediately or take vulnerable legacy systems offline, and some government websites in the UK, Finland and Japan went down temporarily. TradingKey, citing VulnCheck, reported that AI has roughly doubled vulnerability discoveries year over year. On October 23 OpenAI CEO Sam Altman said: "I no longer think we're gonna be able to just patch all the bugs." The episode gave the market a real example of AI making attacks more frequent and faster, and of defensive demand rising with them.

The second was Evercore ISI's quarterly survey of channel partners (the resellers and integrators that sell vendors' products), published October 23. It found security budgets strengthening and no demand cliff. Customers' top priorities were securing data and AI, protecting identities, and locking down cloud environments.

The third was CrowdStrike's own product news. On October 21 it expanded its partnership with NVIDIA. It is integrating Falcon Guardian, its AI detection and response product, with NVIDIA OpenShell, a secure runtime, and plans to integrate NVIDIA Sentry for enforcement in silicon. The goal is to make sure an AI agent (an AI program that carries out tasks on its own) cannot get around the security controls that constrain it.

Correlation is not causation here. The NVIDIA deal was announced on October 21, the same day the PHP flaw went public. CRWD rose 5.26% that day, but NET, which had no comparable news, rose 5.32%, so the stock moves cannot isolate the partnership's effect. The safer reading is that the October 21–23 rally was driven by industry-level news (AI-found vulnerabilities plus the channel survey), with the NVIDIA deal at most a company-specific plus for CRWD.

3. Question 1: Is AI-agent protection new budget or a relabel of existing spend?

The short answer: it cannot yet be shown to be a separate new budget. The evidence so far looks more like customers adding modules to security platforms they already use, i.e., incremental spend from existing customers.

The evidence is in what the companies disclose. None of the four reports revenue or ARR (annual recurring revenue, the annualized value of subscription contracts and the key progress metric for subscription companies) from "AI security" or "AI-agent protection" on its own. CrowdStrike's fiscal Q2 FY27 release (quarter ended July 31, 2026) describes AI only at the product level, e.g., extending AI detection and response across leading AI gateway partners, with no dollar figures. PANW's fiscal Q4 FY26 release gives no separate metrics for Prisma AIRS, its AI security product. Fortinet is the only one with a number: its CFO said on the Q2 call that billings for AI-driven security operations grew 25%. (Billings are amounts invoiced in the period, including prepayments that will be recognized as revenue later.)

The numbers that actually accelerated are platform-expansion metrics. CrowdStrike's Falcon Flex ARR reached $2.29B, up 101%. Falcon Flex is a licensing model where customers buy a pool of credit and then draw on modules as needed. Net new ARR was a record $333M, up 51%, and the company raised its full-year net new ARR growth guidance by 630 basis points to 34%. 51% of customers use six or more modules. These figures show customers are buying more, but they measure expansion of the whole platform and do not reveal how much comes from AI-agent protection.

The evidence on the other side matters too: revenue growth is not accelerating. CRWD's revenue grew 26% in the quarter, and consensus expects 24.9% growth this fiscal year and 22.8% next year, so analysts are actually modeling a slight slowdown. On X, @nanalyzetweets, citing an a16z chart, noted that CRWD, PANW and FTNT have grown a lot but shown no revenue acceleration, and that either fundamentals catch up or valuations revert.

My inference: AI-agent protection is most likely to appear first as extra modules switched on inside existing platform contracts. So the first observable signals are net new ARR and Flex ARR. Revenue will follow two to three quarters later, because subscription revenue is recognized over the contract term rather than all at once. Whether it ever becomes a separate budget line can only be confirmed once at least one company starts disclosing AI-security ARR or customer counts on their own.

4. Question 2: Three companies in different positions (plus a fourth)

Before asking how each company converts this into revenue, it helps to be clear about where each one sits in the attack-and-defense chain.

	CRWD	PANW	NET	FTNT (control)
Core battleground	Endpoint/cloud workload/identity, SaaS subscription	Network firewall + SASE + SecOps + identity (CyberArk)	Global network edge: app security, zero trust, developer platform	Hardware firewall (in-house FortiASIC), SD-WAN, SASE, OT
Latest quarter revenue growth	+26% (FY27 Q2)	+34% (FY26 Q4, incl. M&A)	+36% (2026 Q2)	+26% (2026 Q2)
Revenue mix	Mostly subscription	Product ~22%, rest subscription & support	Subscription/usage	Product ~38%, service ~62%
AI angle	AI-agent detection & response, NVIDIA partnership	Prisma AIRS (no metrics disclosed)	"Agentic Internet," machine-to-machine traffic	FortiGate refresh driven by AI data centers and OT
Latest FCF margin	25.7%	FY adjusted 38.4%	8%	47.2%

CRWD is closest to the AI agent itself. Agents run on servers and endpoints, so CrowdStrike's detection and response can sit right alongside them, and the NVIDIA deal extends that protection down to the chip. For CrowdStrike, conversion depends on whether the Flex credit model lets customers easily add agent protection to their contracts.

PANW is building a one-stop platform through acquisitions, adding identity security (CyberArk, closed February 11, 2026 for $21.1B) and observability (Chronosphere). Its numbers need adjusting for this: Q4 next-generation security ARR rose 63% to $9.1B, and a large share of that came from acquisitions. One third-party estimate puts organic growth at roughly 25–30% (beancount.io, Sep 13, 2026); the company does not disclose that figure. CEO Nikesh Arora says OpenAI, Anthropic and Google have all approached PANW about partnerships, and argues that customers consolidating vendors will favor large platforms.

NET is betting on a different story: AI answer engines and agents will turn internet traffic into machine-to-machine traffic, and Cloudflare's edge network sits where that traffic passes (CEO Matthew Prince, Q2 2026 results). It has the fastest growth of the four but the thinnest profits: a 13.8% non-GAAP operating margin and an 8% FCF margin. Non-GAAP gross margin also fell to 73.1% from 76.3% a year earlier, so the growth is not cheap.

FTNT is PANW's most direct competitor in network perimeter security, but its business model is very different. Q2 revenue was $2.05B. Product revenue was $773M, up 52% and about 38% of the total, driven by strong sales of hardware firewalls built on its own chips. The company attributes the growth to higher FortiGate volumes and prices from AI data center and OT (industrial network) demand. Billings grew 33%, non-GAAP operating margin hit a record 38%, and full-year revenue guidance was raised to $8.02–8.18B.

5. Question 3: If AI security is new budget for the whole industry, why did FTNT gain the least?

This is the best counter-example for testing the core question. On October 23 FTNT rose only 4.05% and Check Point 4.64%, while CRWD, PANW, NET and ZS averaged 7.52%. The twist is that FTNT is the only one of the four that has said publicly that AI (data center buildouts) is already lifting its revenue.

What to see: the moves split into two tiers, with the network-appliance names FTNT and Check Point up only about 4%.

Explanation A: an "AI narrative premium." The market pays a premium for the "security software/platform for the AI era" story and files FTNT under network hardware. Two pieces of evidence support this. First, FTNT moves less in both directions: in early trading on October 14, the day of the OpenAI acquisition report, PANW fell 4% and FTNT only 1%; on October 21, when the PHP flaw went public, CRWD and NET each rose more than 5% while FTNT rose 1.83%. Second, posts on X (e.g., @allday_stocks) attributed the rally to the PHP flaw and AI-driven security risk, which is a software-and-vulnerability story. The weakness of this explanation is that its only evidence is price behavior. FTNT also rose 111% over the past 52 weeks, the most of the four, so the market has not ignored it. It is simply unwilling to add an extra AI-narrative premium on top.

Explanation B: subscription versus hardware cycle. Nearly 40% of FTNT's revenue comes from one-time hardware sales, its growth follows the firewall refresh cycle, and the market thinks that cycle is peaking. The evidence here is harder because it comes from analysts' own forecasts. Consensus has FTNT's revenue growth slowing from +19.7% in Q3 to +13.4% in Q4 and +11.4% for 2027, versus +19.4% for 2026. The average analyst rating is Hold (2.86), and the mean price target of $169.45 is below the $179.99 price. Through this lens, a PHP vulnerability does not change when companies replace firewalls, so FTNT naturally reacts less to this kind of event. The weakness is that the slowdown forecast has been around for a while: it explains why FTNT normally trades at a lower multiple, but not directly why it rose less on October 23 specifically.

A minor possibility: with FTNT reporting on October 28, some investors may have preferred to wait for the results. There is no direct evidence for this, so it is only speculation.

The two explanations are not mutually exclusive. My view is that B is the underlying driver, since it rests on verifiable forecast data, and A amplifies it through sentiment. The implication for the core question is direct. If AI security really were a new budget benefiting every layer, FTNT, which is already booking real AI-related revenue, should have been rewarded just as much. The opposite happened, which suggests the market is pricing the expectation that AI security becomes high-margin subscription revenue, not AI revenue that has already been booked.

6. What the market is betting on

To compare all four on the same basis I use enterprise value divided by calendar-2027 consensus revenue. (Enterprise value is roughly market cap minus net cash; the multiple shows how much investors pay for each dollar of future revenue.)

What to see: CRWD's multiple is about 2.5x FTNT's, a gap far wider than the difference in their growth rates.

EV/CY27E revenue is about 35.2x for CRWD, 31.2x for NET, 20.2x for PANW and 14.2x for FTNT. Consensus growth for the same period is 22.8%, 28.8%, 14.5% (PANW FY28) and 11.4%. NET's multiple can be explained by having the fastest growth. CRWD grows more slowly than NET but carries a higher multiple, so the market is paying extra for the quality of its profits and cash flow (25.7% FCF margin) and for its position as the leader in AI-agent security.

A rough reverse calculation shows what CRWD's price implies (this is an estimate, not a forecast). Assume a mature CRWD is worth 25x free cash flow with a 30% FCF margin. Its current EV of about $259.6B would then need about $10.4B of annual FCF, which implies about $34.6B of revenue, roughly 4.7x CY27 consensus. Growing at about 22% a year, that would take roughly eight more years. In other words, the price already assumes high growth lasting into the next decade. Also worth noting: CRWD and FTNT both trade above their mean analyst targets ($247.25 and $169.45), while PANW and NET are still below theirs.

What to see: sell-side models do not assume AI will make growth accelerate. High valuations reflect prices running ahead of earnings expectations, not expectations being raised sharply.

7. What to watch next

Wednesday, October 28, after the close: FTNT Q3 2026 results, with the call at 4:30 pm ET. This is the most direct test of the hardware-cycle explanation. Watch three things: whether billings meet or beat the $2.25–2.35B guidance range, whether product revenue keeps growing fast, and what management says about Q4 and 2027 refresh demand and AI data center orders. A sharp slowdown in product growth would support the market's low multiple; billings that again clearly beat guidance would mean the "cycle peak" view needs revising.

November 5: NET Q3 results (date per yfinance). Revenue guidance is $736–737M. Watch whether growth in cRPO (signed contracts to be recognized as revenue within 12 months) holds around 35%, and whether gross margin keeps slipping.

Around November 19: PANW fiscal Q1 FY27 results (yfinance marks this date as an estimate; check the company's announcement). Next-generation security ARR guidance is $9.54–9.56B. Watch whether the company starts disclosing organic growth or Prisma AIRS metrics.

December 1: CRWD fiscal Q3 FY27 results (per yfinance). Full-year ending ARR guidance is $6.603–6.612B. Watch whether net new ARR sets another record, and whether Falcon Guardian / AI detection and response gets its own customer or ARR disclosure. This is the first measurable checkpoint for whether AI-agent protection is turning into revenue.

Follow-up on the PHP vulnerability (how widely it is exploited, and whether more high-severity bugs are found by AI) will keep moving sentiment, but it is event-driven and no substitute for the financial metrics above.

8. Conclusion

The October 23 "rally" mostly recovered the previous week's losses: measured from October 13, all four stocks are still down, with CRWD only 1.39% short of where it started. No company yet discloses revenue from AI-agent protection, and the visible acceleration (CRWD net new ARR +51%, Flex ARR +101%) looks more like platform expansion than a separate new budget. FTNT is already booking real revenue from AI data centers, yet it rose only 4.05% on October 23 and trades at just 14.2x EV/revenue. That suggests the market is buying the expectation that AI security becomes high-margin subscription revenue, not AI revenue already earned. CRWD's roughly 35.2x EV/revenue requires many more years of high growth, and four earnings reports over the next two months (10/28, 11/5, ~11/19, 12/1) will test that expectation in turn.

Appendix: Data and Sources

A1 Valuation comparison (as of 2026-10-23 close)

Metric	CRWD	PANW	NET	FTNT
Close ($)	257.57	380.55	325.73	179.99
Market cap ($bn)	263.7	311.3	116.0	132.1
EV ($bn)	259.58	310.79	115.35	128.55
Current FY consensus revenue ($bn)	6.008 (FY27)	14.173 (FY27)	2.872 (2026)	8.122 (2026)
Next FY consensus revenue ($bn)	7.379 (FY28)	16.228 (FY28)	3.698 (2027)	9.048 (2027)
CY27E revenue ($bn)	7.379	15.372	3.698	9.048
EV/CY27E revenue (x)	35.2	20.2	31.2	14.2
Forward P/E (yfinance)	159.9	78.0	193.7	47.5
Mean analyst target ($)	247.25	398.52	343.42	169.45
Mean rating (1=Strong Buy)	1.70	1.69	1.94	2.86

Formula: EV/CY27E revenue = EV ÷ CY27E revenue. PANW CY27E = 5/12×14.173 + 7/12×16.228 = 15.372; CRWD FY28E (Feb 2027–Jan 2028) used as a proxy for CY27E. All four use the same basis (EV ÷ consensus revenue). FTNT consensus was available, so company guidance was not substituted. All multiplications and divisions were checked with verify_calc.

A2 Latest-quarter financials (company releases)

Metric	CRWD FY27 Q2 (to 2026-07-31)	PANW FY26 Q4 (to 2026-07-31)	NET 2026 Q2	FTNT 2026 Q2
Revenue	$1.47bn, +26%	$3.41bn, +34%	$696.1m, +36%	$2.05bn, +26%
Subscription/service	Sub $1.40bn, +27%	Sub & support $2.672bn	—	Service $1.275bn, +13.7%
Product	—	$738m (21.6%)	—	$773m, +51.9% (37.7%)
ARR/RPO/billings	Ending ARR $5.84bn, +25%; NNARR $332.8m; Flex ARR $2.29bn, +101%	NGS ARR $9.10bn, +63%; RPO $21.2bn, +34%	cRPO +35%	Billings $2.37bn, +33%
Profitability	Non-GAAP op income $371.6m	FY26 adj. FCF margin 38.4%	Non-GAAP op margin 13.8%	Non-GAAP op margin 38%
FCF	$377.4m (25.7%)	—	$56.4m (8%)	$966m (47.2%)
Next-Q guide	Revenue $1.523–1.529bn	Revenue $3.30–3.31bn; NGS ARR $9.54–9.56bn	Revenue $736–737m	Revenue $2.01–2.10bn; billings $2.25–2.35bn
FY guide	FY27 revenue $5.991–6.011bn; ending ARR $6.603–6.612bn	FY27 revenue $14.1–14.2bn	2026 revenue $2.864–2.870bn	2026 revenue $8.02–8.18bn; billings $9.35–9.55bn

Formulas: FCF margin = FCF ÷ revenue (FTNT 966/2048 = 47.2%; CRWD 377.4/1470 = 25.7%); product share = product ÷ total revenue (FTNT 773/2048 = 37.7%; PANW 738/3410 = 21.6%); FTNT product YoY = 773/509 − 1 = 51.9%.

A3 Timeline

Date (ET)	Event
2026-02-11	PANW closes CyberArk acquisition ($21.1bn)
2026-07-29	FTNT Q2 2026 results, full-year guidance raised
2026-08-06	NET Q2 2026 results
2026-08-26	CRWD FY27 Q2 results
2026-09-01	PANW FY26 Q4 results
2026-10-14	Report of OpenAI buying a security startup; PANW −4%, CRWD −3%, FTNT −1% early trading
2026-10-16	AI financing jitters; PANW −7%, CIBR −4%
2026-10-21	PHP flaw disclosed; CRWD–NVIDIA expanded AI-agent security partnership
2026-10-23	Evercore ISI channel survey; sector rally; Altman's "can't patch all the bugs" remark
2026-10-28	FTNT Q3 results (after close, call 4:30 pm ET)
2026-11-05	NET Q3 results (yfinance)
~2026-11-19	PANW FY27 Q1 results (yfinance estimate)
2026-12-01	CRWD FY27 Q3 results (yfinance)

A4 Price-change calculations (yfinance closes)

Ticker	10/13	10/20	10/21	10/22	10/23	10/13→10/23	10/20→10/23	10/21 day
CRWD	261.21	227.37	239.34	237.94	257.57	−1.39%	+13.28%	+5.26%
PANW	397.03	340.28	347.25	354.92	380.55	−4.15%	+11.83%	+2.05%
NET	347.70	291.69	307.22	303.61	325.73	−6.32%	+11.67%	+5.32%
FTNT	190.76	170.93	174.05	172.98	179.99	−5.65%	+5.30%	+1.83%

Formula: change = end close ÷ start close − 1. On 10/23, ZS +7.31% and Check Point +4.64% (eastmoney.quote); CRWD/PANW/NET/ZS average = (8.25+7.22+7.29+7.31)/4 = 7.52%.

A5 Aya heat data (US list, 2026-10-23 close)

Rank	Ticker	Heat	Discussion/Trading	Change	Rel. volume	Bull/Bear (self-tagged)
1	CRWD	83	86 / 81	+8.2%	1.5x	Bull 67% / Bear 33% (15 posts)

PANW, NET and FTNT were not in that day's US top 20.

Market views (reported only, not endorsed)

• Evercore ISI channel survey (via 24/7 Wall St., Oct 23): budgets strengthening, no demand cliff; priorities are data & AI, identity, cloud.
• Deutsche Bank (via TradingKey, Oct 23): infrastructure and security firms, including CRWD, PANW and Snowflake, are early beneficiaries of rising AI token usage; some of the upside is already priced in.
• Nikesh Arora (PANW CEO, via 24/7 Wall St., Oct 14): "We've seen both OpenAI and Anthropic and even Google come to the table in terms of partnerships."
• Sam Altman (via 24/7 Wall St. citing Gizmodo, Oct 23): "I no longer think we're gonna be able to just patch all the bugs."
• @allday_stocks (X, Oct 23): attributed the rally to the PHP flaw and AI-driven risk, and listed FTNT as a laggard.
• @nanalyzetweets (X, Oct 25): citing an a16z chart, said CRWD, PANW and FTNT have grown a lot but shown no revenue acceleration; either fundamentals catch up or valuations mean-revert.
• RBC (via itiger): PANW's fiscal Q4 eased concerns about the CyberArk deal.

Sources

• Prices: eastmoney.quote (Tencent), Oct 23 close; yfinance get_price_history / get_ticker_info, Oct 23–26 pre-market
• Consensus: yfinance get_revenue_estimate, Oct 26 (FMP consensus unavailable due to subscription limits)
• Fortinet Q2 2026 8-K Ex. 99.1, Jul 29, 2026: https://www.sec.gov/Archives/edgar/data/0001262039/000126203926000018/ftntq2-2026ex991.htm
• CrowdStrike FY27 Q2 release (syndicated), Aug 26, 2026: https://www.01net.it/crowdstrike-reports-second-quarter-fiscal-year-2027-financial-results/
• Palo Alto Networks FY26 Q4 release, Sep 1, 2026: https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-reports-fiscal-fourth-quarter-and-fiscal-year-2026-financial-results
• Cloudflare Q2 2026 8-K Ex. 99.1, Aug 6, 2026: https://www.sec.gov/Archives/edgar/data/0001477333/000147733326000053/q226exhibit991.htm
• CrowdStrike–NVIDIA announcement, Oct 21, 2026 (via WebSearch of ir.crowdstrike.com and others)
• 24/7 Wall St., Oct 14 / 16 / 23 / 26, 2026 (links in Chinese edition)
• TradingKey, Oct 23, 2026: https://www.tradingkey.com/analysis/stocks/us-stocks/262236289-cybersecurity-stocks-crowdstrike-cloudflare-rally-ai-vulnerability-discovery-php-flaw-tradingkey
• Fortinet Q3 2026 results date announcement, Oct 2, 2026 (via WebSearch: finviz / investingnews)
• FTNT Q2 2026 call highlights (via WebSearch: Zacks / MarketBeat, Jul 29, 2026)
• PANW M&A and organic growth estimates (via WebSearch: PANW 10-Q Apr 30, 2026; beancount.io Sep 13, 2026)
• X posts: grok-x x_search, Oct 21–26, 2026

For information and research discussion only; not investment advice.