Bank of America said in a Sept. 18, 2026 report that AI security concerns are becoming a lasting catalyst for the cybersecurity sector, with market pricing shifting away from the idea that AI will disrupt security software and toward the view that AI is creating new attack surfaces.
Over the past month, the HACK and CIBR ETFs gained 7.3% and 6.4%, respectively. Over the same period, the IGV software ETF rose 2.8% and the S&P 500 fell 0.9%. Against that backdrop, BofA raised its price targets for CrowdStrike (CRWD), Okta (OKTA) and SailPoint (SAIL).
AI narrative shifts toward security spending
BofA analyst Tal Liani said the AI narrative has reversed. Investors had previously worried that AI would disrupt security software. The bank now says investors increasingly see AI as a source of new attack surfaces, new identities and new governance requirements, all of which call for additional security spending.
According to the report, the market is pricing in a step-change increase in security risk. BofA said that shift supports both higher security spending and a more constructive valuation framework, with cybersecurity viewed as a foundational enabler in the AI era.
AI threats seen as more widespread
The report cited public comments from Anthropic’s chief executive, who said agent clusters could gain the ability within 6 to 12 months to take over the internet and cause billions of dollars in damage. It also pointed to recent disclosures from OpenAI describing additional cases of agents showing unexpected behavior, including inserting new instructions, concealing errors and attempting to bypass restrictions.
BofA said those developments show AI-related threats are real, especially in the wrong hands. It added that enterprises are increasingly recognizing the need to strengthen existing security controls, and that chief information security officers are feeling a greater sense of urgency.
The bank described the current response as a two-pronged approach: hardening existing security infrastructure and expanding defense in depth, while also deploying new AI security products as an added layer of protection. In BofA’s view, cybersecurity is one of the few sectors that can benefit from both positive and negative AI news. Negative news raises threat awareness, while positive news helps validate the value of security spending.
BofA said cybersecurity is a rare two-way beneficiary in the AI narrative. More capable AI systems create new threats and can drive higher security budgets. Broader AI adoption creates new identities and governance needs, which can also lift spending. The bank framed cybersecurity as both a major theme and an enabler in the AI era.
Identity management stands at the center
As chief information security officers think through how to protect agents, BofA said identity management and governance are the obvious answer. Every AI agent will ultimately need authentication, authorization, monitoring and stronger governance, the report said. That trend creates a favorable setup for identity vendors and supports BofA’s view on Okta and SailPoint.
BofA raised its price target on Okta to $200 from a prior target based on 9x CY27 enterprise value, and now uses 11x CY27 enterprise value. The current price cited in the report was $190.02. The bank said that multiple sits in the middle of the 6x to 17x range for cybersecurity peers and is reasonable given AI-driven revenue growth and execution dependence.
For Okta, BofA listed upside risks including faster growth from stronger adoption of customer identity products, faster growth from product premiumization and margin improvement from better sales force efficiency. Downside risks include continued price erosion in core products as competition intensifies, delayed purchases due to lower customer budgets and slower margin expansion if execution issues worsen.
BofA also raised its price target on SailPoint to $22 from a prior framework based on 7x FY28 enterprise value, and now uses 8x FY28 enterprise value. The current price cited in the report was $20.19. The bank said that multiple sits at the low end of the 5x to 10x range for SaaS security peers because SailPoint is a point solution and its growth is slowing.
For SailPoint, BofA said upside risks include better ability to assess market size and stronger conversion of qualified prospects in the pipeline. Downside risks include difficulty assessing market size, investor sentiment and sensitivity to premium valuations, as well as rising competition.
Platform security leaders may also benefit
BofA said another answer to protecting agents is to strengthen platform capabilities by integrating control points across identity, endpoints and networks. The report said CrowdStrike reinforced its position at the front edge of AI security after making multiple announcements at the Fal.Con 2026 conference.
BofA raised its price target on CrowdStrike to $260, based on 36x CY27 enterprise value, up from 32x previously. The current price cited in the report was $245.70.
The bank said CrowdStrike’s Guardian product is setting an industry standard for AI Detection and Response, or AIDR, while its SafeMind framework is putting frontier AI security capabilities into the hands of defenders. BofA said the premium valuation is supported by CrowdStrike’s strong position in endpoint security and by long-term growth opportunities in cloud security, log management and identity protection.
The report added that CrowdStrike’s high-growth profile and its ability to take share in new markets could expand its total addressable market and accelerate growth.
BofA also listed downside risks for CrowdStrike, including investor sentiment and sensitivity to premium valuations, weaker-than-expected adoption of new products, slower new customer acquisition and expansion deals, security vulnerability risk and tougher competition from both incumbent and emerging vendors. At the same time, the bank said CrowdStrike’s high growth and long-term opportunity are partly offset by lower margins and expected growth deceleration.
Targets move higher, ratings stay Neutral
Even after raising price targets on all three names, BofA kept Neutral ratings on CrowdStrike, Okta and SailPoint. The bank said the higher targets reflect an improved valuation framework tied to the AI security narrative, while the Neutral stance reflects the view that current share prices already discount a meaningful amount of optimism.
On valuation, CrowdStrike’s 36x CY27 enterprise value multiple stands at a significant premium to the 13x to 19x range for large high-growth SaaS peers. Okta’s 11x sits in the middle of its peer range. SailPoint’s 8x is near the low end. BofA said the three stocks occupy different valuation positions, but the identical ratings suggest the support from the AI security narrative is already showing up in prices.
The bank’s broader sector valuation data showed average enterprise value multiples for cybersecurity at 19.6x in 2026, with a median of 10.4x; 13.2x in 2027, with a median of 7.4x; and 11.1x in 2028, with a median of 6.4x. On that basis, CrowdStrike trades well above the sector average, Okta is slightly above average and SailPoint is close to the median.
What the report concludes
BofA said AI security concerns provide a durable catalyst for the cybersecurity sector. In its view, the market is pricing in a step-change in security risk, supporting both higher spending expectations and a more constructive valuation framework.
At the same time, the combination of higher price targets and Neutral ratings suggests that part of the valuation expansion has already been realized. The report said that if concern over AI agent threats continues to build, whether security spending can exceed current expectations will determine whether these three stocks can move from valuation-driven gains to earnings-driven upside.
This article is a整理与解读 by Chaoxiang Research of a third-party broker report from Bank of America dated Sept. 18, 2026, combined with public market information. The ratings, price targets, earnings forecasts and related judgments cited in the article are the views of that broker’s analyst and represent only the position of that institution, not the view of Chaoxiang Research, and do not constitute investment advice.
Markets involve risk, and decisions should be made independently. This article should not be used as a basis for buying or selling any security.