Bank of America said in a research note dated Sept. 18, 2026 that the market is repricing AI-related security risk, shifting from fears that artificial intelligence could disrupt security software to a view that AI is creating new attack surfaces, new identities, and new governance requirements. The bank said this step-change in perceived risk is supporting both higher expected security spending and a more constructive valuation framework for cybersecurity companies.
Over the past month, cybersecurity exchange-traded funds outperformed both software and the broader U.S. equity market. HACK rose 7.3% and CIBR gained 6.4%, compared with a 2.8% rise in the iShares Expanded Tech-Software Sector ETF (IGV) and a 0.9% decline in the S&P 500. In that setting, BofA raised its price targets on CrowdStrike, Okta, and SailPoint.
AI narrative shifts toward new attack surfaces
BofA analyst Tal Liani said the AI narrative has reversed. Investors had previously worried that AI would undermine the value of security software. The bank now sees a different setup: AI is generating new attack surfaces, new identities, and new governance needs, all of which require additional security investment.
BofA described cybersecurity as a foundational enabler in the AI era and one of the few sectors that can benefit from both positive and negative AI news. Negative developments raise awareness of threats. Positive developments validate the need for security spending.
BofA says AI threats are becoming more widespread
The report cited public comments from Anthropic’s chief executive, who warned that within 6 to 12 months, clusters of agents could gain the ability to take over the internet and cause billions of dollars in damage. It also pointed to recent disclosures from OpenAI describing additional cases of agents showing unexpected behavior, including inserting new instructions, concealing errors, and attempting to bypass restrictions.
BofA said those developments show AI-related threats are real, especially in the wrong hands. The bank added that enterprises are increasingly recognizing the need to strengthen existing security controls, and chief information security officers are feeling greater urgency. It said the current response has two tracks: hardening existing security infrastructure and expanding defense in depth, while also deploying new AI security products as an added layer of protection.
In BofA’s view, stronger AI capabilities create new threats that push security spending higher, while broader AI adoption creates new identity and governance needs that also lift spending. That is why the bank sees cybersecurity as both a major AI theme and an enabling layer.
Identity management seen as a core area
As chief information security officers think through how to protect agents, BofA said identity management and governance stand out as an obvious answer. Each AI agent will ultimately need authentication, authorization, monitoring, and stronger governance. The bank said that trend creates a favorable backdrop for identity vendors and supports Okta and SailPoint.
BofA raised its price target on Okta to $200 and based that target on an 11x CY27 enterprise value multiple, up from 9x previously. Okta’s current price was listed at $190.02. The bank said 11x sits in the middle of the 6x to 17x range for cybersecurity peers and is reasonable given AI’s support for revenue growth and the company’s execution dependence.
The report said upside risks for Okta include stronger adoption of customer identity products leading to faster growth, premium pricing driving faster growth, and better sales force efficiency improving margins. Downside risks include continued price erosion in core products as competition intensifies, lower customer budgets that delay purchases, and worsening execution issues that slow margin expansion.
BofA also raised its price target on SailPoint to $22, based on an 8x FY28 enterprise value multiple, up from 7x previously. SailPoint’s current price was listed at $20.19. The bank said that multiple sits at the low end of the 5x to 10x range for SaaS security peers because SailPoint is a point solution and its growth is slowing.
For SailPoint, BofA listed upside risks including improved ability to assess market size and stronger conversion of qualified prospects in the pipeline. Downside risks include difficulty assessing market size, investor sentiment and sensitivity to premium valuations, and tougher competition.
Platform security leaders also stand to benefit
BofA said another answer to protecting agents is to strengthen platform capabilities by integrating control points across identity, endpoint, and network security. The report said CrowdStrike reinforced its position at the front edge of AI security after making multiple announcements at the Fal.Con 2026 conference.
BofA raised its price target on CrowdStrike to $260, based on a 36x CY27 enterprise value multiple, up from 32x previously. CrowdStrike’s current price was listed at $245.70.
The bank said CrowdStrike’s Guardian product is setting an industry standard for AI Detection and Response, or AIDR, while its SafeMind framework is helping put frontier AI security capabilities into the hands of defenders. BofA said the company’s premium valuation is supported by its strong position in endpoint security and by long-term growth opportunities in cloud security, log management, and identity protection. It also said CrowdStrike’s high-growth profile and ability to take share in new markets could expand its total addressable market and accelerate growth.
BofA listed downside risks for CrowdStrike as investor sentiment and sensitivity to premium valuations, weaker-than-expected adoption of new products, slower new customer wins and expansion deals, security vulnerability risk, and stronger competition from both incumbent and emerging vendors. The bank also said CrowdStrike’s high growth and long-term opportunity are partly offset by lower margins and expected growth deceleration.
Targets raised, but all three remain Neutral
Even after lifting its price targets on CrowdStrike, Okta, and SailPoint, BofA kept Neutral ratings on all three stocks. The bank said the higher targets reflect an improved valuation framework tied to the AI security narrative, while the Neutral stance reflects the view that current share prices already discount a meaningful amount of optimism.
On relative valuation, BofA said CrowdStrike’s 36x CY27 enterprise value multiple carries a clear premium to the 13x to 19x range for large high-growth SaaS peers. Okta’s 11x sits in the middle of its peer range. SailPoint’s 8x is near the low end. The different valuation positions, paired with the same rating, suggest BofA believes much of the AI security valuation support is already in the price.
Sector valuation backdrop and report conclusion
BofA’s broader sector data showed average enterprise value multiples for cybersecurity at 19.6x in 2026, with a median of 10.4x. For 2027, the average was 13.2x and the median was 7.4x. For 2028, the average was 11.1x and the median was 6.4x. Against that backdrop, CrowdStrike screens well above the sector average, Okta slightly above average, and SailPoint close to the median.
BofA said AI security concerns are becoming a durable catalyst for the cybersecurity sector. The market’s repricing of security risk supports both higher security spending and a more constructive valuation framework. At the same time, the combination of higher price targets and Neutral ratings suggests that part of the valuation expansion has already been realized.
If concern around AI agent threats keeps rising, whether security spending can exceed current expectations will determine whether these three stocks can move from valuation-driven gains to earnings-driven upside.
Disclosure
This article is a整理 and interpretation by Chaoxiang Research of a third-party brokerage report from Bank of America dated Sept. 18, 2026, combined with public market information. The ratings, price targets, earnings forecasts, and related judgments cited in the article are the views of the brokerage analyst and represent only the position of that institution, not the view of Chaoxiang Research, and do not constitute investment advice.
Markets carry risk, and decisions should be made independently. This article should not be used as a basis for buying or selling any security.
By Rita.
