U.S. stocks tied to artificial intelligence split in notable fashion last week. Nvidia surged again after earnings, reinforcing that demand for AI infrastructure is still running strong. At the same time, cybersecurity names saw a clear valuation rebound, with CrowdStrike (CRWD) up 20.5% in a single day and Okta (OKTA) rising close to 29%.
That strength was not shared across the group. Zscaler (ZS) had dropped more than 30% after its prior-quarter results, and SentinelOne (S) also delivered weak after-hours trading after its latest earnings release. The contrast pointed to a change in how investors are pricing the sector.
Capital is moving down the AI stack
The article argues that as capital starts moving beyond compute and looks for the next layer of AI revenue, investors are no longer willing to pay equally for every “AI plus cybersecurity” narrative. The market is screening for something more specific: which companies are actually capturing incremental demand created by AI.
One of the biggest debates in software over the past six months has been whether AI agents could weaken the SaaS model. Traditional SaaS pricing is often built around human seats. If a company has 100 employees, that can translate into 100 Salesforce, ServiceNow, or other enterprise software accounts.
If more work is handled by agents in the future, headcount could shrink, or one employee could manage dozens of agents. In that case, software sold on a human-seat basis could face a problem it did not have before: usage rises, but the number of paying seats may not increase at the same pace. That has been one of the core ideas behind this year’s “SaaS doomsday” trade.
Cybersecurity works differently. AI may reduce some human seats, but it is also creating more non-human entities that need to be managed and protected. The old security perimeter centered on employees, computers, and applications. That list is already expanding to include machine identities, APIs, and a growing number of AI agents.
An agent may not need a traditional employee account, but it still has to log into enterprise systems. It does not sit in front of a PC, yet it still needs to access databases, call APIs, and connect to cloud services. The key implication for cybersecurity is that the number of digital objects requiring protection is rising.
That is the opposite of the pressure facing parts of traditional SaaS. AI may mean fewer people in some workflows, but it is unlikely to mean fewer identities, devices, interfaces, data assets, or machines to secure. It may mean more. On that basis, cybersecurity has become a natural place to watch as investors look for the next destination of enterprise AI budgets beyond infrastructure.
Why some AI security names jump while others fall
Even inside cybersecurity, the market has started to draw sharp distinctions.
Cloudflare (NET) reported Q2 2026 revenue of $696.1 million, up 36% year over year, an acceleration from 34% in Q1. Its current remaining performance obligations, or cRPO, rose 35% from a year earlier, also improving from 34% in the previous quarter.
CrowdStrike showed a more pronounced shift. Net New ARR in Q1 FY27 was $256 million, up 32% year over year. By Q2, Net New ARR had reached about $333 million, with growth accelerating to 51%.
Okta’s revenue growth remained 11%, but cRPO improved from 12% year-over-year growth in Q1 to 14% in Q2, while RPO growth reached 17%.
For subscription and platform software companies, reported revenue largely reflects orders booked in the past. What investors are focusing on now are indicators that speak more directly to what the next few quarters may look like.
CRWD is the clearest example. In its latest quarter, the company posted revenue of $1.47 billion, up 26% year over year, and ending ARR of $5.84 billion, also up 25%. On the surface, those figures looked solid rather than spectacular. But Net New ARR at $333 million, up 51%, had a much stronger effect on investor response.
That visible reacceleration in new orders has become a central pricing logic in the latest cybersecurity trade. High growth by itself is no longer scarce. Reaccelerating growth is.
The reverse case makes the same point. Zscaler reported Q3 FY26 revenue growth of 25%, with ARR also up 25%. Taken alone, those numbers would not normally qualify as a weak quarter. Yet the stock still fell more than 30% because investors started questioning whether its FY27 growth rate could keep moving higher.
SentinelOne saw a similar reaction. In Q2 FY27, revenue reached $292 million, up 21% year over year, and ARR climbed to $1.218 billion, up 22%. The company also raised its full-year revenue outlook. Even so, the stock still fell more than 5% at one point in after-hours trading because profit guidance and forward expectations did not clear a market bar that had already been raised.
AI tailwinds are not distributed evenly
The article goes a step further and argues that even within cybersecurity, CrowdStrike, Cloudflare, and Okta are benefiting from AI in different ways.
CRWD: enterprise security is becoming a system, not a point product
CrowdStrike’s traditional strength has been endpoint security. Today, though, it is much more than anti-virus software installed on PCs. Its business spans endpoint, cloud security, identity, security operations, observability, data protection, and threat intelligence.
That matters more in the agent era. When an agent completes a task, it usually does not stay inside one system. It may first obtain an identity, then pass access controls, call an API, move into a cloud workload, read a database, and finally write results back into another enterprise system.
As that happens, the boundaries between endpoint, identity, cloud, and runtime become less distinct. The company with more complete telemetry has a stronger case to become the unified control layer for enterprise security operations. The latest acceleration in Net New ARR is presented as an early sign that enterprises are willing to pay for a broader security platform.
NET: more agents could mean more internet traffic
Cloudflare stands out from the group because it is difficult to classify as a traditional cybersecurity company alone. Alongside security and zero trust, it also operates a global network, the Workers developer platform, and edge computing capabilities.
That means AI may affect Cloudflare through more than security budgets. It may also directly lift usage on Cloudflare’s network. As of Q2, the number of developers on the platform had surpassed 7.4 million. Nearly 2 million were added in a single quarter, more than the roughly 1.5 million added during all of 2025.
Management also disclosed a notable shift: for the first time in Q2, more than half of traffic on the Cloudflare network was not generated directly by humans. Requests from AI agents are still increasing. Whether agents replace many people or not, they still need network access, model calls, API access, database reads, code execution, and communication with other agents.
Cloudflare sits at the intersection of those activities. In that sense, NET looks less like a narrow security bet and more like a bet that a growing share of internet traffic in the future will not be initiated by humans.
OKTA: identities inside companies may no longer belong only to employees
Okta’s setup calls for more caution. In Q2 FY27, the company reported revenue of $805 million, up 11% year over year. RPO reached $4.858 billion, up 17%, while cRPO came in at $2.585 billion, up 14%. That cRPO figure did improve from 12% in Q1.
Still, based on management’s disclosures, the current improvement is mainly coming from large customers, core workforce and customer identity products, and newer offerings such as Identity Governance.
The larger significance of agent identity is that it could open a market that did not previously exist for Okta. Historically, the company managed employees and customers. Going forward, enterprises may also need to manage agents. Okta has already rolled out capabilities around AI agents including discovery, registration, access control, and lifecycle management.
It is too early to say how much revenue agent identity is contributing today. Even so, the article argues that it adds a new layer of volume potential to a relatively mature identity market. A company that once had only tens of thousands of employees could one day be running hundreds of thousands, or more, machine identities and agents at the same time. If that shift takes hold, the addressable market for identity changes with it, and OKTA could be re-rated.
The market is asking where AI spending turns into revenue
The article ends with a simple question: where does all the money spent on AI ultimately show up as revenue? Cybersecurity may be one of the earlier sectors offering a clear answer.
The reasoning is straightforward. AI can replace some human work, but it does not reduce digital activity inside enterprises. If anything, it increases it. That means pressure on one category of software can become incremental demand for another.
The latest earnings cycle also separated the two groups more clearly. Having an AI story is no longer enough. Orders, revenue, and whether growth is actually speeding up now carry more weight. The second phase of AI, the piece argues, may only just be getting started.