From NET to CRWD: Is Money Flowing into Cybersecurity Companies in the AI Second Half?

AI has reduced the demand for human resources but has brought more agents, providing cybersecurity with a new incremental budget.

Written by: DaiDai, MSX Maitong

Edited by: Frank, MSX Maitong

Last week, the U.S. stock market showed an interesting divergence.

NVIDIA's stock surged after its earnings report, continuing to prove that the demand for AI infrastructure is far from over; meanwhile, CrowdStrike (CRWD) rose 20.5% in a single day, and Okta (OKTA) approached 29%, marking a clear valuation recovery in the cybersecurity sector.

On the other hand, Zscaler (ZS) saw its stock drop over 30% after its last quarterly report, and SentinelOne (S) also had disappointing after-hours performance following its latest earnings report.

Both are cybersecurity companies discussing AI, reflecting a clear change behind the scenes:

As funds begin to seek new AI revenue sources beyond computing power, the market is no longer willing to uniformly buy into all "AI + cybersecurity" narratives but is starting to filter—who is truly capturing the new demand brought by AI?

1. Computing Power is Costly; Software Should Start Making Money

Over the past six months, one of the biggest controversies in the software industry has been whether AI agents will ultimately shake the SaaS business model.

Traditional SaaS is largely built on human resources.

For example, a company with 100 employees might mean 100 Salesforce, ServiceNow, or other enterprise software accounts.

However, if more and more tasks are completed by agents in the future, leading to a reduction in the number of employees, or if one employee can manage dozens of agents, then some software that charges based on human seats may indeed face a problem it has never encountered before:

The usage of software is increasing, but the number of paying users may not increase correspondingly.

This has also been one of the core logics behind this year's market trading of the so-called "SaaS apocalypse theory."

However, the uniqueness of cybersecurity lies in the fact that while AI reduces some human seats, it also creates more non-human entities that need to be managed and protected.

For example, in the past, a company's security perimeter mainly revolved around employees, computers, and applications, but today this list has rapidly expanded: beyond employees, there are machine identities, beyond applications, there are APIs, and increasingly more AI agents.

This means that an agent may not require a traditional employee account but still needs to log into the enterprise system; it does not sit in front of a computer but needs to access databases, call APIs, and connect to cloud services.

Thus, the truly important aspect of AI for cybersecurity is that the digital objects that enterprises need to protect are increasing.

This is in stark contrast to the logic faced by many traditional SaaS companies.

AI may lead companies to need fewer people, but it is unlikely to reduce the identities, devices, interfaces, data, and machines that need protection; in fact, it may very well be the opposite.

Because of this, as the market begins to look for the next corporate budget beyond AI infrastructure, cybersecurity naturally becomes a direction worth observing.

2. The Same AI Security Narrative: Some Soar, Some Plummet?

However, even though they all discuss AI security, the market has started to show clear differentiation.

First, let's look at Cloudflare (NET), a representative company, whose latest Q2 2026 revenue reached $696.1 million, a 36% year-on-year increase, up from 34% in Q1; cRPO grew 35% year-on-year, also improving from the previous quarter's 34%.

CrowdStrike's changes are even more pronounced, with Q1 FY27 Net New ARR at $256 million, a 32% year-on-year increase; by Q2, Net New ARR had reached approximately $333 million, with a year-on-year acceleration to 51%.

Okta's revenue growth remains at only 11%, but cRPO has improved from a year-on-year growth of 12% in Q1 to 14% in Q2, with RPO year-on-year growth reaching 17%.

Ultimately, for subscription-based and platform software companies, revenue is largely a reflection of past orders, while the current market is beginning to focus on more indicators that can tell investors "what will happen in the next few quarters."

CRWD is the most typical example; in the latest quarter, the company's revenue was $1.47 billion, a 26% year-on-year increase; the ending ARR was $5.84 billion, a 25% year-on-year increase, which seems "unremarkable," but the Net New ARR of $333 million, a 51% year-on-year increase, greatly stimulated the market.

This clearly accelerating new order curve also represents the most important pricing logic of this round of cybersecurity market: high growth itself is no longer scarce; what is scarce is the re-acceleration of growth.

Looking back, it becomes even clearer.

Zscaler's last quarter Q3 FY26 revenue grew 25% year-on-year, and ARR also grew 25%; while the absolute numbers are not considered a bad earnings report, the stock still plummeted over 30% because funds began to doubt whether its FY27 growth could continue to rise.

SentinelOne's latest quarter faced a similar situation.

Q2 FY27 revenue reached $292 million, a 21% year-on-year increase; ARR reached $1.218 billion, a 22% year-on-year increase, and the company also raised its full-year revenue forecast, but in after-hours trading following the earnings report, the stock still fell over 5% because the profit guidance and future expectations did not exceed the market's already elevated threshold.

3. More Agents, Bigger Business for Cybersecurity Companies?

Interestingly, if we continue to follow this logic, we find that even though they all belong to the cybersecurity industry, the AI dividends received by CRWD, NET, and OKTA are actually different.

1. CRWD: Enterprise Security is Becoming More Like a Complete System

CrowdStrike's traditional advantage comes from endpoint security.

However, today it is far more than just an antivirus software installed on computers; its business covers multiple aspects including Endpoint, Cloud Security, Identity, Security Operations, Observability, Data Protection, and Threat Intelligence.

This is especially important in the agent era.

Because an agent completing a task often does not stay in just one system. It may first obtain an identity, access the API after permission authentication, enter the Cloud Workload, read the database, and finally write the results back to another enterprise system.

Thus, the boundaries between Endpoint, Identity, Cloud, and Runtime will become increasingly blurred; whoever has more complete telemetry will have the opportunity to become the unified control platform for enterprise security operations.

The recent acceleration of Net New ARR also preliminarily proves that enterprises are willing to pay for larger security platforms.

2. NET: The More Active the Agents, the More Internet Traffic

Cloudflare is the most unique among these companies.

Because it is actually difficult to simply define it as a traditional cybersecurity company; besides Security and Zero Trust, it also has global networks, Workers development platforms, and edge computing capabilities.

Therefore, AI's impact on Cloudflare does not only occur in "security budgets" but may directly increase the usage on the Cloudflare network.

As of Q2, the number of developers on the Cloudflare platform has exceeded 7.4 million, with nearly 2 million added in just one quarter, even surpassing the approximately 1.5 million added throughout 2025.

Management also disclosed an interesting phenomenon: for the first time in Q2, over half of the traffic on the Cloudflare network was not generated directly by humans.

Requests from AI agents are still increasing, and regardless of how many people the agents ultimately replace, they still need to connect to the internet, call models, access APIs, read databases, execute code, and exchange information with other agents.

Cloudflare just happens to be at the intersection of these variables.

Thus, NET's more accurate positioning is more like a bet that in the future, there will be more and more traffic initiated not by humans on the internet.

3. OKTA: In the Future, Those with "Identity" in Companies May Not Just Be Employees

Okta's situation needs to be viewed more cautiously.

In the latest Q2 FY27, the company's revenue was $805 million, an 11% year-on-year increase; RPO reached $4.858 billion, a 17% year-on-year increase; cRPO reached $2.585 billion, a 14% year-on-year increase.

Compared to Q1's 12%, cRPO has indeed improved.

However, from management's disclosures, the current improvement still mainly comes from large clients, core Workforce/Customer Identity, and new products like Identity Governance.

And the greater significance of Agent Identity is that it opens up a market that did not exist before for Okta—previously, Okta managed employees and customers, but in the future, enterprises must also manage agents.

Currently, Okta has begun to introduce capabilities around AI agents for discovery, registration, access control, and lifecycle management.

Although it cannot yet be said how much revenue Agent Identity has brought to Okta, it has indeed re-added quantitative imagination to an already mature identity market.

In the past, a company might have only tens of thousands of employees; in the future, it could potentially operate hundreds of thousands or even more machine identities and agents simultaneously.

If this trend really occurs, the market boundaries of identity will also change, and OKTA will undoubtedly face a revaluation.

In Conclusion

Where will the money spent on AI ultimately turn into revenue?

Cybersecurity may be one of the industries that provide answers relatively early.

The reason is not complicated: AI can replace some people but will not reduce digital activities within enterprises; it may even lead to more than before.

This means that the challenges posed by AI to some software companies may precisely become the incremental market for another set of software companies.

However, the latest round of earnings reports has also started to distinguish between the two types of companies; merely having an AI story is no longer enough; the weight of whether orders, revenue, and growth have truly accelerated is becoming significantly larger.

The second half of AI may just be beginning.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.