UBS has released its 2026 cybersecurity industry outlook, maintaining a positive view on the sector. Despite an 11% decline since November 2025 (underperforming the IGV index's -7% return), many core trends from 2025 are expected to persist. Enterprise cybersecurity budget growth is forecast to continue outpacing overall IT spending growth, M&A activity is set to continue, and AI-powered security alongside identity security are becoming central themes. Within these areas, UBS continues to view CrowdStrike (CRWD.US) and Palo Alto Networks (PANW.US) as favorably positioned within its coverage universe, benefiting from their market-leading breadth of product portfolios, an advantage already reflected in their valuations. Furthermore, AI-driven security use cases are expected to mature further, with the firm anticipating that companies like CrowdStrike and SentinelOne (S.US) may disclose their agentic Annual Recurring Revenue (ARR) metrics for the first time. Overall, stock selection is expected to remain challenging; similar to 2025, UBS believes the best allocation opportunities lie in mid-cap names where the platform narrative is still evolving, leading to a favorable view on Okta (OKTA.US) and Zscaler (ZS.US).
Sub-sector expectations and channel checks, based on a Chief Information Security Officer (CISO) survey conducted by UBS in November 2025, indicate that cloud security, identity security, and security operations & analytics (SecOps & Analytics) are poised for strong growth (with 62%, 59%, and 55% of respondents planning budget increases, respectively). Expectations are more cautious for firewall (only 33% planning increases), vulnerability management, and Managed Security Service Provider (MSSP) spending areas. These results largely align with trends observed from partners, with one partner noting this month that the hardware firewall market has become purely a refresh market. Looking ahead to Q4 2025 earnings, survey results are mixed: there are no clear signs of budget loosening, and firewall growth continues to slow, but pipeline strength was generally robust in January.
Core themes and debates for 2025 were underscored by data on the traditional threat landscape, which highlighted ongoing challenges: ransomware incidents surged 47%, and severe zero-day attacks occurred periodically. Looking to 2026, core industry themes will revolve around AI for Security, Security for AI, and an Identity Security Focus. AI for Security encompasses both securing AI systems and leveraging AI to enhance security capabilities. The top positioned vendors in coverage are CrowdStrike, Palo Alto Networks, and SentinelOne. Security for AI involves securing third-party and internally developed AI/agent deployments through robust application/model controls, addressing key enterprise pain points. The best-positioned vendors in coverage are CrowdStrike, Palo Alto Networks, and Zscaler. In Identity Security, the focus is on heightened concerns stemming from AI/agent technologies, which are driving increased demand for securing both human and non-human identities. The top vendors in coverage are Okta, Palo Alto Networks, and CrowdStrike.
A note of caution is that some investors are beginning to question the long-held view that cybersecurity software is immune to disruption from AI-native companies. While UBS generally expects incumbents to continuously enhance their AI security use cases, the narrative of increasing competition with foundational model providers could potentially impact industry valuation multiples.
Performance adjustments and valuation data show that cybersecurity stocks performed in line with the software sector in 2025 (IGV index up 1%, cybersecurity sector roughly flat). Nevertheless, the cybersecurity sector continues to trade at a slight valuation premium: the median Next-Twelve-Months (NTM) Enterprise Value-to-Sales (EV/S) multiple for cybersecurity companies is 5.6x, compared to 5.0x for the software sector. UBS has lowered its 2026 revenue and current contract billings (CCB) estimates for Tenable (TENB.US), citing trends towards shorter contract durations and reduced upfront billings as near-term headwinds, while maintaining its Q4 and full-year 2025 estimates. Additionally, the firm adjusted price targets for Rapid7 (RPD.US), Cloudflare (NET.US), and Palo Alto Networks ahead of their Q4 2025 earnings releases.
Comments