Key Takeaways
- AI‑driven cyber attacks rose 89% in the past year, according to CrowdStrike’s threat intelligence, signaling a shift in the threat landscape.
- Investors reacted negatively to the news, pulling back shares of major cybersecurity firms despite no loss of revenue or customers.
- Platform‑oriented vendors (CrowdStrike, Palo Alto Networks, Fortinet) are showing concrete growth in bundled‑services contracts, suggesting customers prefer consolidated defenses.
- Other self‑described platforms (SentinelOne, Cloudflare, Zscaler) have thinner evidence of true platformization, with Cloudflare and Zscaler operating in adjacent or orthogonal business models.
- Point‑solution players like Okta remain focused on identity verification, arguing that securing AI agents hinges on controlling access rather than offering a full security stack.
AI‑Powered Threats Are Accelerating
“Attacks carried out by artificial intelligence (AI)-powered hackers jumped 89% last year.” That stark figure comes directly from CrowdStrike’s own threat report, which is built from telemetry gathered while defending real‑world customers every day. The statistic is not a click‑bait headline or a vendor‑driven scare tactic; it reflects observable activity in the wild. As AI tools become cheaper and more accessible, threat actors can launch relentless, tireless campaigns that never need a paycheck or sleep, forcing defenders to rethink the economics of security spend.
Market Reaction Highlights Valuation Sensitivity
This week the cybersecurity sector felt the sting of that data: CrowdStrike (CRWD) and Palo Alto Networks (PANW) are both down more than 13% from their Oct. 6 record highs, while Fortinet (FTNT) slipped from its recent peak and Okta (OKTA) fell over 7%. The dip was sparked by a rumor that OpenAI might acquire a cybersecurity startup and enter the fray directly. Importantly, none of the named companies lost a customer or a dollar of revenue over the news; what they lost was the “benefit of the doubt” that comes with trading at lofty multiples—many were north of 100× earnings after posting over 100% gains in 2026 alone. Investors are now weighing whether the current price levels justify the growth story or whether a valuation reset is underway.
Platforms, with Real Receipts
When it comes to proving that customers are consolidating their security budgets, CrowdStrike leads with hard numbers. Its Falcon Flex bundling program—described internally as a “buy‑now‑add‑later” deal that lets clients pay once and pull new tools off the shelf as needed—has grown its contracted value past $2 billion, more than doubling in a single year. “That’s real evidence customers are choosing to put more tools under one roof instead of just renewing what they already had,” the article notes. This behavior aligns with the expectation that AI‑powered attacks make a patchwork of disconnected tools feel riskier by the month, pushing enterprises toward unified platforms.
Palo Alto Networks Leans Into Platformization
Palo Alto Networks is pursuing the same strategy, adding roughly 220 new “platformization” deals in a recent quarter—more than double the pace from two years earlier. The company is getting better at convincing existing customers to bundle more of its products together rather than buying a single point solution and walking away. By upselling additional modules to its installed base, Palo Alto is attempting to turn its flagship firewall and endpoint offerings into a broader security suite that can compete with CrowdStrike’s all‑in‑one approach.
Fortinet Leverages Firewall Scale for Cross‑Sell
Fortinet earns its place in the platform conversation through sheer scale. It already holds the top spot in network firewalls, a position that gives it a foothold in the majority of corporate networks. The company is using that dominance to cross‑sell newer security categories—such as secure SD‑WAN, cloud security, and AI‑driven threat protection—to the same customers who already rely on its perimeter defenses. The logic is simple: once a customer trusts Fortinet for the edge, it is more likely to adopt additional services from the same vendor, creating a sticky, multi‑product relationship.
Platforms With Caveats
Not every vendor that calls itself a platform can point to the same depth of evidence. SentinelOne (S) reports roughly $1.2 billion in annual recurring revenue, about one‑fifth of CrowdStrike’s $5.84 billion ARR, placing it earlier in the bundling journey. Cloudflare (NET) labels itself a “connectivity cloud company”; its security (Zero Trust) offering is just one of three service lines alongside network and developer services, confirming that security is a slice of a larger business rather than the whole. Zscaler (ZS) takes a different tack altogether: it routes a company’s internet traffic through its own cloud, inspecting it like a security checkpoint everything must pass through before reaching its destination. Because Zscaler’s model is neither a traditional tool bundle nor a pure point solution, it “doesn’t fit neatly into either the ‘platform’ or ‘point solution’ camp,” making classification ambiguous.
The Point Solution: Okta’s Identity Focus
Okta (OKTA) remains a pure‑play identity provider, doing one job: verifying who’s logging in and what they’re allowed to touch. As AI agents begin to require their own logins, the relevance of that function intensifies. According to MarketBeat, Okta’s president Eric Kelleher says the question companies keep asking isn’t whether to use AI agents, but how to keep them in check. Okta’s pitch boils down to answering three core concerns: where an agent lives, what it’s allowed to touch, and what it’s allowed to do. By concentrating on identity and access management, Okta argues it can secure the proliferating ecosystem of AI‑driven workloads without needing to become a full‑stack security vendor.
What This Means for Investors and Buyers
The data suggest a bifurcating market. On one side, platforms with demonstrable growth in bundled contracts—CrowdStrike, Palo Alto Networks, and Fortinet—are positioned to capture higher wallet share as enterprises seek simplified defenses against AI‑fueled threats. On the other side, vendors with thinner platform credentials or distinct architectural approaches (SentinelOne, Cloudflare, Zscaler) may need to prove that their unique value propositions can survive in a world where consolidation is increasingly attractive. Meanwhile, pure‑play identity firms like Okta will continue to thrive as long as controlling access remains the linchpin of AI security. For investors, the recent price pull‑back offers a chance to reassess whether the premium multiples paid during the 2026 rally are justified by the underlying shift toward platformization, or whether a more selective approach—favoring those with clear, measurable bundling momentum—is warranted.
https://www.fool.com/investing/2026/10/17/as-ai-supercharges-hackers-cybersecurity-stocks-sp/