AI Cybersecurity Stocks: The Trade Is Priced. Mostly.
We ranked 28 cybersecurity stocks against their own five-year EV/Sales history as of October 5, 2026. The big platforms sit at the 96th to 98th percentile. Four names still growing revenue 10% or more sit below the 40th, led by Zscaler.
Cybersecurity has been the best-performing corner of tech since April. AI agents escaping sandboxes and hacking test targets turned "security spending goes up" from a forecast into the consensus, and the stocks priced it quickly: a Goldman Sachs cyber basket more than doubled from its April 10 low. We ranked 28 security and security-adjacent stocks against their own five-year valuation history, as of October 5, 2026. The result is lopsided. The platforms everyone names trade at or near five-year-high multiples, and most of the stocks near their lows are there for a reason. Most, not all.
If you only read one thing
The short version: The AI cyber trade is priced. CrowdStrike, Palo Alto Networks, Fortinet, and Cloudflare sit at the 90th to 98th percentile of their own five-year EV/Sales range. The interesting names are the ones the rally skipped while revenue kept growing: Zscaler (14th percentile, 25% growth), Elastic, Tenable, and SentinelOne. Government cyber contractors split hard: CACI is near its five-year high, while Booz Allen and Parsons are near their lows.
How to read the numbers
Each figure answers one question: compared with what this stock has cost over its own last five years, what does it cost today? We compute trailing EV/Sales weekly from SEC filings and market prices and rank today's value in that five-year distribution. The 98th percentile means the stock was cheaper than today about 98% of the time.
We use EV/Sales across this sector. Many security companies report little or no GAAP profit (stock compensation is large, and acquisitions add amortization), so P/E is missing or meaningless for a big part of the group. EV/Sales also accounts for cash and debt, which vary a lot from company to company here. The tradeoffs are in our guides on when to use P/E, P/S, EV/Sales, or EV/EBITDA and what a valuation percentile is and how we compute it.
The takeaway: Every number below compares a stock with its own past, not with other stocks. A high percentile means expensive by that company's own standard. It does not by itself mean overvalued.
The full table
| Ticker | Layer | EV/Sales | EV/S 5y %ile | Revenue growth |
|---|---|---|---|---|
| FFIV | Network and app security | 7.4 | 99.6 | ~9% |
| CACI | Defense cyber | 1.95 | 97.9 | 11% |
| CRWD | Platform | 51.5 | 97.7 | ~26% (Q) |
| PANW | Platform | 26.7 | 97.7 | ~34% (Q, incl. CyberArk) |
| FTNT | Platform | 17.5 | 96.2 | ~26% (Q) |
| CSCO | Platform (benchmark) | 7.3 | 93.5 | ~12% |
| NET | Edge and agent traffic | 48.4 | 90.4 | ~36% (Q) |
| OKTA | Identity | 12.0 | 88.7 | 11% |
| SAIL | Identity | 9.5 | 87.9† | 20% |
| DDOG | Telemetry | 24.9 | 82.8 | ~36% (Q) |
| RBRK | Backup and recovery | 16.1 | 80.9† | 42% |
| CVLT | Backup and recovery | 5.3 | 67.6 | 15% |
| QLYS | Exposure management | 9.5 | 60.9 | 10% |
| AKAM | Edge and API security | 4.5 | 56.5 | ~5% |
| SAIC | Defense IT | 1.05 | 53.3 | −1% |
| VRNS | Data security | 7.8 | 48.5 | 16% |
| MSFT | Bundler (benchmark) | 11.5 | 46.4 | ~18% |
| S | Security operations | 7.3 | 39.2 | 21% |
| TENB | Exposure management | 3.9 | 28.9 | 10% |
| ESTC | Search and SIEM | 5.0 | 24.8 | 16% |
| ZS | Zero-trust access | 9.9 | 14.0 | 25% |
| RPD | Security operations | 0.5‡ | 7.3 | 0% |
| LDOS | Defense IT | 1.14 | 4.8 | ~4% |
| BAH | Defense IT | 1.05 | 2.9 | −7% |
| GEN | Consumer security | 4.1 | 1.5 | 20% |
| PSN | Defense cyber | 0.93 | 0.6 | −7% |
| NTSK | Zero-trust access (2025 IPO) | 8.8 | too new to rank | 30% |
| CHKP | Platform | 4.7 | snapshot only | ~1% |
The platforms are priced for the thesis
CrowdStrike, Palo Alto, and Fortinet all sit between the 96th and 98th percentile. CrowdStrike at 51.5 times trailing sales is the most expensive large security company in the table, about double its own five-year median of 24.0. Palo Alto at 26.7 is also about double its median of 13.1. Cloudflare, which handles traffic at the network edge, including bots and agents, is at the 90th. Even Cisco, a slow grower, trades at the 93rd percentile of its own range.
The most stretched name relative to its growth is F5. At the 99.6th percentile with about 9% revenue growth, it is priced at the very top of its own history on single-digit growth.
The takeaway: The four biggest security platforms all trade near the most expensive levels of their last five years, at roughly double their own median EV/Sales. The market has already paid for the AI security spending boom.
Why this is not the 2024 power trade
The obvious comparison is the 2024 "AI needs power" trade, which rewarded people who saw early that data centers would run short of electricity. Our data shows how different the starting points were. In January 2024, Vistra's EV/Sales sat at the 47th percentile of its trailing five years and NRG's at the 38th. Those were mid-range starting points with a physical shortage ahead of them: you cannot build a power plant in a quarter. Vistra's EV/Sales reached the 99th percentile of its range by June 2024.
The cyber platforms start this cycle at the 96th to 98th percentile. Security also has no equivalent of a power shortage. Software capacity is not scarce, and a security budget can move to whichever vendor ships the better product. Revenue can still grow into the multiple. There is little room left for the multiple itself to expand.
One honest caveat: the power trade was not cheap everywhere either. The grid-equipment makers (Eaton, Quanta, Hubbell, nVent, Vertiv, Modine) were already at the 95th to 100th percentile of their own EV/Sales range in January 2024 and kept climbing for two more years. A high percentile is not a timing signal. It tells you that you are paying for the good news up front. Friedberg's case for cyber spending, which we covered in what David Friedberg argued on All-In about AI cyber defense, also includes a compute race that leads straight back to power; the AI power theme page tracks that side.
The takeaway: In 2024 the power generators started from the middle of their own valuation range with a real shortage behind them. The cyber platforms start at the top of their range with no shortage. That does not make them bad businesses. It means the easy re-rating already happened.
Compressed, still growing
The more useful list is the short one at the bottom: names whose multiple compressed while revenue kept growing at 10% or more.
- Zscaler (ZS): 14th percentile, 25% trailing revenue growth. The stock fell about 31% in one day after its May guidance, and the multiple never recovered with the sector.
- Elastic (ESTC): 25th percentile, 16% growth.
- Tenable (TENB): 29th percentile, about 10% growth.
- SentinelOne (S): 39th percentile, 21% growth.
Two low names fail the growth test. Rapid7 sits at the 7th percentile with flat revenue, which looks like a stock that is cheap for a reason. Gen Digital sits at the 1.5th percentile with 20% growth, but it sells consumer antivirus and identity protection, a different business from the enterprise platforms the AI thesis is about. Varonis sits in the middle of its range with Thoma Bravo's Proofpoint reported to be in talks to acquire it.
The takeaway: Zscaler, Elastic, Tenable, and SentinelOne are the security stocks the rally left behind while their revenue kept growing. Zscaler is the clearest case. Rapid7 is cheap too, but its revenue stopped growing.
Identity: the purest exposure, mostly bought
Every AI agent is a new kind of login, with credentials, permissions, and a record of what it touched. Securing those non-human identities is the most direct way to sell into the agent wave, and the big platforms bought their way in. Palo Alto closed its CyberArk acquisition in February, Cisco closed Astrix Security in June, according to this map of the 2026 identity consolidation wave, and CrowdStrike agreed to buy SGNL in January (CNBC on CrowdStrike's SGNL deal).
The public pure plays left are Okta and SailPoint. Okta sits at the 89th percentile on 11% growth, with EV/Sales nearly double its five-year median of 6.1. SailPoint sits at the 88th percentile on 20% growth, though its history is short. Both are priced for the agent story to show up in revenue.
The takeaway: Identity security is the most direct way to profit from companies deploying AI agents, but most of the specialists were bought. The two public pure plays left, Okta and SailPoint, are already near the top of their own valuation ranges.
Government cyber: the widest split
| Ticker | EV/Sales | EV/S 5y %ile | Revenue growth |
|---|---|---|---|
| CACI | 1.95 | 97.9 | 11% |
| SAIC | 1.05 | 53.3 | −1% |
| LDOS | 1.14 | 4.8 | ~4% |
| BAH | 1.05 | 2.9 | −7% |
| PSN | 0.93 | 0.6 | −7% |
The federal budget is split too. The Pentagon requested $20.5 billion for cyberspace activities in fiscal 2027, while civilian cyber spending dips from $12.46 billion to $12.23 billion, including a $707 million cut to CISA. Revenue explains much of the spread: CACI is growing 11% and trades near its high, while Booz Allen and Parsons are shrinking 7% and trade near their lows. Leidos, at the 5th percentile with slightly positive growth, fits the pattern least well. These are services firms where security is a minority of revenue, so we track them on the theme page rather than in the cybersecurity screen.
The takeaway: Among government contractors, CACI is priced near its five-year high while Booz Allen, Parsons, and Leidos are near their lows. Shrinking revenue at Booz Allen and Parsons explains much of that gap; Leidos is the one that fits least well.
The bear case
- The typical budget isn't growing. The IANS and Artico survey of 500-plus security leaders found median 2026 budget growth of 0%, against an average of 5%.
- Microsoft bundles security into its enterprise licenses. At the 46th percentile, it sits lower in its own range than any other large name in the table, and it is the default option for many buyers.
- AI labs ship security products. When Anthropic announced Claude Code Security on February 20, CrowdStrike fell 8% and Okta 9%.
- Analysts are already cautious. A Bernstein analyst said the sector "may have gotten over its skis," per Insurance Journal's report on the cyber stock rally.
- There is no room for a miss. Zscaler's 31% one-day drop in May happened at a much lower multiple than CrowdStrike's today.
The takeaway: The risks are concrete: most security budgets are flat, Microsoft bundles security into licenses many companies already pay for, AI labs are entering the market, and multiples near five-year highs leave no cushion for a disappointing quarter.
Signposts
- Platform growth. At the 98th percentile, CrowdStrike and Palo Alto need revenue growth to hold above 20% through next year's reports.
- The median budget. If 2027 surveys show the median security budget growing, the spending boom is broad. If not, it is a few big buyers.
- Zscaler's organic growth. The next two quarters show whether the May reset was a one-off or a trend.
- Identity consolidation. Whether the buyout wave reaches the remaining public companies.
- Final federal appropriations. Whether the civilian cyber cut survives Congress.
The takeaway: The AI cyber trade is priced for the platforms and partly priced for identity. Where it is not priced, at Zscaler, Elastic, Tenable, and SentinelOne, there is usually a specific worry to check first. That is where the research starts.
Every number above updates weekly on the AI cyber defense theme page, which groups the full basket by layer. The cybersecurity valuation screen ranks the security vendors by EV/Sales percentile, and each ticker has its own band chart, starting with Zscaler's EV/Sales history and CrowdStrike's EV/Sales history. If the band charts are new to you, read how to read a valuation band chart first.
Data: SEC EDGAR XBRL filings and market prices, computed by StockResearch as of October 5, 2026. Names outside our standing universe were computed with the same pipeline and cross-checked against independent price-to-sales snapshots. January 2024 percentiles were computed from the same weekly series using only the trailing five years available at that date. Latest-quarter growth figures come from company earnings releases. Jake is the founder of StockResearch.app, where he writes data-first research on valuation dislocations. Nothing here is investment advice or a recommendation to buy or sell any security. Do your own research.