The market is pricing in a step-up in security risks, a shift that is simultaneously supporting higher security spending and a more positive valuation framework.
By Rita
Cybersecurity ETFs outperformed the software sector and the S&P 500 over the past month, as the market’s pricing of AI safety risks shifts from disruption threats to newly created attack surfaces. In a report issued on September 18, 2026, Bank of America highlighted that AI safety concerns are emerging as an enduring catalyst for the cybersecurity sector. Over the past month, the HACK and CIBR ETFs rose 7.3% and 6.4%, respectively, while the IGV software ETF gained 2.8% and the S&P 500 declined 0.9%. Bank of America has raised its price targets for CrowdStrike (CRWD), Okta (OKTA), and SailPoint (SAIL).
BofA analyst Tal Liani noted in the report that the AI narrative has flipped. Investors previously worried about AI disrupting security software; today, they recognize that AI creates new attack surfaces, new identities, and new governance requirements. These demands necessitate additional security investment. The firm believes the market is pricing in a step-up in security risk, a change that simultaneously supports higher security spending and a more aggressive valuation framework. Cybersecurity is viewed as a foundational enabling layer in the AI era.
AI Threats Are Becoming More Prevalent
The CEO of Anthropic has publicly expressed concern that within six to twelve months, agent clusters could gain the capability to seize control of the internet and cause billions of dollars in damage. OpenAI recently disclosed additional cases of agents exhibiting unexpected behavior, including injecting new instructions, concealing errors, and attempting to bypass restrictions. BofA argues that these developments demonstrate that AI-related threats are real, particularly when placed in the wrong hands.
BofA points out that enterprises increasingly recognize the necessity of strengthening existing security controls, with chief information security officers feeling a pressing urgency. The current response is two-pronged: on one hand, hardening existing security infrastructure and expanding defense-in-depth; on the other, deploying new AI security products as additional safeguards. The firm believes the cybersecurity sector stands to benefit from both positive and negative AI news. Negative news heightens threat awareness, while positive news validates the value of security investments.
Cybersecurity is one of the few sectors benefiting bidirectionally from the AI narrative. Enhanced AI capabilities introduce new threats, driving up security spending. The expansion of AI applications brings new identities and governance needs, similarly increasing security expenditure. BofA positions cybersecurity as a mega-theme and enabler in the AI era.
Identity Management Is Core
As CISOs consider how to protect agents, identity management and governance emerge as the obvious answers. Every AI agent ultimately requires authentication, authorization, monitoring, and reinforced governance. This trend creates a highly favorable environment for identity management vendors, underpinning Okta and SailPoint.
BofA has raised its price target for Okta to $200, based on an 11x CY27 enterprise value multiple, up from 9x. The current price is $190.02. The firm notes that this multiple sits in the middle of the 6x to 17x range for cybersecurity peers, and is reasonable given AI’s driver for revenue growth and reliance on execution. Upside risks for Okta include higher adoption of its customer identity product driving faster growth, product premiums yielding faster growth, and improved sales team efficiency enhancing margins. Downside risks include continued price erosion in core products due to heightened competition, delayed procurement from declining customer budgets, and worsening execution issues slowing margin ramp.
BofA has raised its price target for SailPoint to $22, based on an 8x FY28 enterprise value multiple, up from 7x. The current price is $20.19. The firm notes that this multiple sits at the low end of the 5x to 10x range for SaaS security peers, as SailPoint operates as a point solution with decelerating growth. Upside risks include improved market sizing assessment and stronger conversion rates for qualified leads in the pipeline. Downside risks include difficulties in market sizing, investor sentiment and sensitivity to premium valuations, and intensifying competition.
Platform Security Leaders Benefit
Another answer to protecting agents lies in strengthening platform capabilities by integrating control points such as identity, endpoint, and network. Following multiple announcements at the Fal.Con 2026 conference, CrowdStrike solidifies its position at the forefront of AI security. BofA has raised its price target for CrowdStrike to $260, based on a 36x CY27 enterprise value multiple, up from 32x. The current price is $245.70.
CrowdStrike’s Guardian product is setting the industry standard for AI detection and response (AIDR), while the SafeMind framework puts cutting-edge AI security effectively into the hands of defenders. BofA points out that this premium multiple is supported by CrowdStrike’s dominant positioning in endpoint security and long-term growth opportunities in cloud security, log management, and identity protection. CrowdStrike’s high-growth profile and potential to capture share in new markets could expand the total addressable market and accelerate growth.
Downside risks include investor sentiment and sensitivity to premium valuations, lower-than-expected product adoption rates, slowing new customer acquisition and expansion deals, security breach risks, and intensifying competition from incumbent and emerging players. BofA also notes that CrowdStrike’s high growth and long-term opportunities are partially offset by lower profit margins and an expected slowdown in growth.
Three Stocks Maintain Neutral Rating
BofA has raised price targets for three stocks but maintains a neutral rating across the board. The target price increases reflect an improved valuation framework driven by the AI safety narrative, while the neutral rating indicates that current share prices have already priced in a significant degree of optimism.
From a valuation perspective, CrowdStrike’s 36x CY27 enterprise value multiple represents a significant premium compared to large-cap, high-growth SaaS peers trading at 13x to 19x. Okta’s 11x multiple sits in the middle of peer ranges. SailPoint’s 8x multiple is at the low end of peer valuations. Despite different valuation positioning among the three stocks, the consistent rating suggests BofA believes the valuation support provided by the AI safety narrative is already reflected in the stock prices.
In BofA’s listed overall industry valuation, the cybersecurity sector’s average enterprise value multiple for 2026 stands at 19.6x, with a median of 10.4x. For 2027, the average is 13.2x and the median is 7.4x. For 2028, the average is 11.1x and the median is 6.4x. CrowdStrike’s valuation is significantly above the sector average, Okta is slightly above average, and SailPoint is close to the median.
BofA concludes that AI safety concerns provide an enduring catalyst for the cybersecurity sector. The market is pricing in a step-up in security risk, supporting higher security spending and a more aggressive valuation framework. However, the combination of raised target prices and a neutral rating indicates that room for valuation expansion is already partially realized.
If perceptions of AI agent threats continue to escalate, whether security spending can surpass current expectations will determine whether these three stocks can transition from valuation-driven rallies to earnings-driven gains.
Disclaimer
This article is a compilation and interpretation by TechFlow Research of a third-party brokerage research report (Bank of America, September 18, 2026), synthesized with publicly available market information. The ratings, target prices, earnings forecasts, and related judgments cited herein represent solely the views of the respective brokerage analysts, reflecting only their institution’s stance. They do not represent the views of TechFlow Research and do not constitute any investment advice.
The market involves risks, and investment decisions require independent judgment. This article should not serve as the basis for purchasing or selling any securities.
