Bernstein Downgrades Cybersecurity Leaders After AI-Driven Rally

Bernstein downgraded Palo Alto Networks, Okta, and SentinelOne to Market Perform, arguing that a roughly 100% sector rally since early 2026 has pushed valuations above fair value. The move came four days after cybersecurity stocks posted record highs on fears of AI-driven cyberattacks, a rotation that had pulled capital out of semiconductors and into security vendors.

The shift followed a rapid narrative change initiated by Anthropic’s CEO, who warned that AI systems could compromise internet infrastructure within a year. Despite simultaneous gains in CrowdStrike and Palo Alto Networks, the semiconductor sector fell, reflecting a trade-off where investors sought protection from AI risks rather than exposure to chip buildout.

AI Threats Drive Security Demand

Investors rotated into cybersecurity because AI agents are now executing attacks at scales beyond human capability. CrowdStrike reported that AI-triggered detection leads are growing 2.5 times faster than human-driven ones, while Palo Alto Networks’ Unit 42 used AI to uncover over 14,000 unknown vulnerabilities. This operational reality justified higher security budgets, allowing investors to maintain AI exposure without betting on slowing chip demand.

The logic was simple: if AI models become more capable, they create more sophisticated threats, requiring more robust defense infrastructure. This view led to a surge in security vendors while semiconductor peers like those in the VanEck Semiconductor ETF declined, as the market priced in a potential pause in the hardware buildout.

Valuations Outpace Fundamental Growth

Analyst Peter Weed at Bernstein noted that while AI-driven security demand is real, the stocks had run too far. He raised price targets for all three downgraded names, signaling long-term confidence but short-term overvaluation. Palo Alto Networks’ target increased to $351 from $253, Okta to $174 from $143, and SentinelOne to $25 from $21.

The market reacted immediately to the downgrade. Palo Alto Networks fell more than 4% in the days following the note, and Okta and SentinelOne dropped alongside it. The First Trust Nasdaq Cybersecurity ETF gave back 1.76% by Friday, erasing a portion of the gains recorded just four days earlier during the sector’s peak.

Zscaler Remains Top Pick

Among Bernstein’s coverage, Zscaler was the only name retained as an Outperform. Weed described it as the cheapest cybersecurity vendor in the group, lifting its price target to $298 from $224. This valuation implies significant upside relative to its peers, which had already priced in the AI security premium. The divergence highlights that not all security stocks benefited equally from the narrative shift.

The episode underscores the fragility of narrative-driven trades. While the fundamental case for AI security spending remains intact, the speed of the rally left little room for further gains at current prices. Investors are now reassessing which vendors offer genuine value versus those that have merely capitalized on short-term fear.