Corporate technology leaders are opening their wallets for security software at the fastest pace in recent quarters, a shift that analysts say reflects the growing urgency of defending AI-driven operations. The clearest signal came Thursday, when Citigroup raised price targets on four cybersecurity vendors after its latest chief information officer survey showed budgets accelerating.
The bank’s CIO survey found that projected cybersecurity spending over the next twelve months is now growing at about 7%, up roughly one percentage point from the prior quarter. More telling, 82% of CIOs said enterprise AI investments are increasing their security outlays, up from 71% previously. The findings suggest that as companies deploy AI across cloud infrastructure and agent-based workflows, they are being forced to spend more to protect those systems.
Citi analyst Fatima Boolani framed the data as evidence that cybersecurity demand is entering a more durable phase. She raised the firm’s price target on Palo Alto Networks (PANW) to $440 from $410, on CrowdStrike (CRWD) to $295 from $260, and on Zscaler (ZS) to $260 from $245, maintaining Buy ratings on all three. Okta (OKTA) saw its target lifted to $215 from $205, though its rating stayed at Neutral.
Wells Fargo struck a similarly constructive tone on demand, even as it remained cautious on one name. Analyst Richard Poland raised the bank’s target on Fortinet (FTNT) to $160 from $135 while keeping an Underweight rating. The revised target still implies a double-digit decline from the stock’s recent close of $184.05, reflecting a view that valuation has run ahead of fundamentals despite improving channel checks.
CompanyRatingNew TargetPrevious TargetCrowdStrike (CRWD)Buy$295$260Palo Alto Networks (PANW)Buy$440$410Zscaler (ZS)Buy$260$245Okta (OKTA)Neutral$215$205Fortinet (FTNT)Underweight$160$135
Note: Targets reflect analyst revisions announced October 15, 2026.
Spending Priorities Shift Toward Cloud and Exposure Management
The survey pointed to a broadening of security priorities beyond identity-centric tools. Cloud security reclaimed the top spot among the three investment areas CIOs ranked highest, while vulnerability management and exposure management saw a notable jump in priority. Citi interpreted the shift as evidence that enterprises are now focused on protecting expanding cloud assets and managing increasingly complex attack surfaces, rather than concentrating spending on a single control layer.
Identity security remains a critical architectural control point in an agentic environment, the bank noted, but the survey suggests companies are balancing that focus with investments in network security and overall security posture management. The resurgence of vulnerability management may reflect rising concern about reducing exposure and improving remediation workflows as AI-driven environments grow in scale and complexity.
Hyperscale cloud providers continue to hold an advantage in cloud security purchasing decisions, according to the survey. But across the full technology stack, Microsoft (MSFT), Palo Alto Networks and CrowdStrike emerged as the clearest beneficiaries of customer wallet share.
Cybersecurity also remains the top destination for enterprise tool consolidation, with 37% of CIOs selecting it — up four percentage points from the prior quarter. Security spending held steady at about 9% of overall IT budgets. While security still trails data analytics and generative AI in terms of twelve-month investment priority, the gap narrowed to three percentage points from ten points in the previous survey.
Valuation Fatigue Meets Hard Data
The sector’s valuation has expanded dramatically over the past year. Citi noted that forward twelve-month enterprise value to sales multiples now sit at 22 times, compared with 10 times six months ago and 14 times a year earlier. That re-rating has created what the bank described as valuation fatigue, with substantive earnings estimate revisions remaining limited outside a few exceptions.
What changed, according to Citi, is the combination of hard data showing accelerating budgets and multiple lines of evidence pointing to sustained industry growth. That justified a modest increase in terminal value multiples for select companies, particularly leaders in the space. The bank’s framework rests on four pillars supporting a higher valuation floor for the sector: low risk of AI-driven disintermediation, attractive thematic exposure, scarcity value of scale and fundamentals, and the notion that cybersecurity companies are effectively becoming insurance policies against AI risk.
Security Threats Keep Escalating
The analyst commentary arrives against a backdrop of increasingly sophisticated attacks. Earlier this month, CrowdStrike reported that hackers used AI-powered tools to target South Korean financial institutions and steal data. Anthropic disclosed incidents in which its AI models gained unauthorized access to real-world systems during security testing. Google DeepMind CEO Demis Hassabis called such episodes “early warning shots,” underscoring the risks accompanying broader AI adoption.
Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report found that 95% of surveyed security leaders expressed concern about attacks powered by advanced AI models. The survey covered more than 1,600 leaders across 11 countries.
IBM (IBM) added quantitative weight to those concerns. Its 2026 Cost of a Data Breach report found that one in four malicious breaches involved AI-enabled techniques, with those incidents averaging $6 million in losses compared with $4.99 million across all breaches. Suja Viswesan, vice president of IBM Security Software, said AI is making attacks faster and cheaper while breaches keep getting more expensive.
The spending implications extend beyond traditional network defense. Gartner (IT) forecast in August 2026 that spending on securing AI systems would reach $4.78 billion in 2027, up 68.7% from roughly $2.84 billion in 2026. Shailendra Upadhyay, senior principal analyst at Gartner, noted that conventional security tools often treat AI applications like any other software and require significant updates to address AI-specific threats.
Market Reaction and Year-to-Date Performance
Despite the bullish analyst commentary, cybersecurity stocks have pulled back from recent highs. CrowdStrike and Palo Alto Networks have fallen more than 13% from their October 6 record closes, while Fortinet has retreated from its October 13 peak. The declines came amid a broader technology selloff and renewed competitive concerns, including reports that OpenAI was in early talks to acquire security startup Trail of Bits.
Zscaler and Okta remain well below their 2021 peaks, down 41% and nearly 28%, respectively. Retail sentiment on Stocktwits has turned largely bearish across the group, with only CrowdStrike registering a neutral reading.
Yet the year-to-date performance tells a different story. Okta leads with a 145% gain, followed by Fortinet at 132%, CrowdStrike at 113% and Palo Alto Networks at 104%. Zscaler is the outlier, down 1.84% this year. The First Trust NASDAQ Cybersecurity ETF (CIBR), which holds these names, has risen 47% over the same period.
The divergence between short-term price action and longer-term fundamental signals leaves investors weighing whether the recent pullback represents a buying opportunity or the start of a more sustained de-rating. Citi’s survey data suggests the spending backdrop remains supportive, but valuation levels that have more than doubled in six months leave less room for disappointment if revenue growth fails to keep pace with elevated expectations.
——————————————————-
Click Here For The Original Source.
