Cybersecurity stocks have had an extraordinary 2026. CrowdStrike and Palo Alto Networks are both up roughly 50% year to date. The investment thesis is simple: AI creates more threats, more threats create more spending, more spending benefits the companies that sell the defences.
The thesis is logical. The problem is that the revenue growth rates tell a different story.
Paradox
Despite the surge in AI-related threats and the expansion of enterprise attack surfaces, revenue growth at many cybersecurity companies is decelerating, not accelerating. The CEOs talk about AI constantly. They describe training their teams, preparing for new threat vectors, and building AI-native platforms. But when asked directly about the revenue impact, the answers become vague.
Netscope's CEO said the company is "training teams and preparing for the impact of AI." That is not a revenue driver. That is a cost.
Palo Alto Networks posted strong numbers in its latest quarter, but its organic growth rate, excluding the CyberArk and Chronosphere acquisitions, tells a more nuanced story than the headline 31% suggests.
Valuation disconnect
CrowdStrike trades at more than 150 times forward earnings. Palo Alto trades at roughly 79 times. These multiples are priced for acceleration, not deceleration.
The market is betting that the AI threat landscape will eventually translate into faster revenue growth. That bet may prove correct. AI agents operating across enterprise networks do expand attack surfaces. Machine identities are proliferating. The complexity of securing agentic deployments is real.
But "eventually" is doing significant work in these valuations. Investors are paying 2028 prices for 2026 revenue growth, and the gap between the expectation and the delivery is wide enough to create risk if the acceleration takes longer than the market assumes.
New threat category
Cybersecurity spending is growing. AI is creating new threat categories. The structural tailwinds are real. But stock prices that are up 50% on the promise of AI-driven growth need to see that growth materialise in the income statement, not in the CEO's prepared remarks.
The paradox is that the companies most likely to benefit from AI in the long term are being valued as though the benefit has already arrived. It has not. The stocks have run ahead of the revenue, and the next few quarters will determine whether the revenue catches up or the stocks come back.
