Written by: Rita

Cybersecurity ETFs have outperformed the software sector and the S&P 500 over the past month, as the market's pricing of AI security risks shifts from disruption threats to new attack vectors. According to a report from Bank of America released on September 18, 2026, AI security concerns are becoming a lasting catalyst for the cybersecurity sector. HACK and CIBR ETFs rose 7.3% and 6.4% respectively in the last month, while the IGV software ETF rose 2.8% and the S&P 500 fell 0.9%. Bank of America raised the target prices for CrowdStrike (CRWD), Okta (OKTA), and SailPoint (SAIL).

Bank of America analyst Tal Liani noted in the report that the AI narrative has reversed. Investors who were previously concerned about AI disrupting security software now recognize that AI creates new attack vectors, identities, and governance needs. These needs require additional security investment. The bank believes that the market is pricing a step increase in security risks, which supports higher security spending and a more aggressive valuation framework. Cybersecurity is viewed as a foundational enabler in the AI era.

AI threats becoming more common

The CEO of Anthropic has publicly expressed concerns, suggesting that within 6 to 12 months, agent clusters may possess the ability to take over the internet and cause billions of dollars in damage. OpenAI has recently disclosed additional cases of agents showing unexpected behavior, including inserting new instructions, concealing errors, and attempting to circumvent restrictions. Bank of America believes these developments indicate that AI-related threats are real, especially in the hands of the wrong people.

Bank of America points out that companies are increasingly recognizing the need to strengthen existing security controls, with Chief Information Security Officers feeling a sense of urgency. The current response is a two-pronged approach: on one hand, reinforcing existing security facilities and expanding depth of defense, and on the other hand, deploying new AI security products as additional safeguards. The bank believes that the cybersecurity sector can benefit from both positive and negative news regarding AI. Negative news raises threat awareness, while positive news validates the value of security investments.

Cybersecurity is one of the few sectors that benefits bidirectionally from the AI narrative. The enhancement of AI capabilities brings new threats that drive increased security spending. The expansion of AI applications introduces new identities and governance needs, also driving increased security spending. Bank of America positions cybersecurity as a major theme and enabler in the AI era.

Identity management is key

As Chief Information Security Officers consider how to protect agents, identity management and governance become obvious answers. Every AI agent ultimately requires authentication, authorization, monitoring, and enhanced governance. This trend creates a favorable environment for identity management vendors, supporting Okta and SailPoint.

Bank of America raised Okta's target price to $200, based on an 11 times CY27 enterprise value multiple, up from 9 times. The current price is $190.02. The bank believes this multiple is in the middle range of 6 to 17 times among cybersecurity peers, and considering AI's impact on revenue growth and dependence on execution, this valuation is reasonable. Upside risks for Okta include faster growth due to higher adoption rates of customer identity products, quicker growth driven by product premiums, and improved profit margins from enhanced sales team efficiency. Downside risks include continued price erosion of core products due to increased competition, procurement delays caused by decreasing customer budgets, and worsening execution issues slowing margin improvement.

Bank of America raised SailPoint's target price to $22, based on an 8 times FY28 enterprise value multiple, up from 7 times. The current price is $20.19. The bank notes that this multiple is at the lower end of the 5 to 10 times range among SaaS security peers, as SailPoint's growth is slowing as a point solution. Upside risks include improved assessment capabilities in market size and enhanced conversion rates of qualified customers in the pipeline. Downside risks include difficulties in assessing market size, investor sentiment and sensitivity to premium valuations, and increased competition.

Platform security leaders benefit

Another answer to protecting agents is to enhance platform capabilities by integrating control points such as identity, endpoints, and networks. CrowdStrike has solidified its position at the forefront of AI security following multiple announcements made at the Fal.Con 2026 conference. Bank of America raised CrowdStrike's target price to $260, based on a 36 times CY27 enterprise value multiple, up from 32 times. The current price is $245.70.

CrowdStrike's Guardian product is setting the industry standard for AI detection and response (AIDR), and the SafeMind framework effectively empowers defenders with frontline AI security. Bank of America notes this premium valuation is supported by CrowdStrike's strong positioning in endpoint security and long-term growth opportunities in cloud security, log management, and identity protection. CrowdStrike's high growth characteristics and potential to gain market share in new markets could expand the total addressable market and accelerate growth.

Downside risks include investor sentiment and sensitivity to premium valuations, lower-than-expected adoption rates of new products, slowdown in acquiring new customers and expanding deals, security vulnerability risks, and increased competition from existing and emerging vendors. Bank of America also notes that CrowdStrike's high growth and long-term opportunities are partially offset by lower profit margins and anticipated growth deceleration.

Three stocks maintain neutral ratings

Bank of America raised the target prices of three stocks but maintained neutral ratings for all. The increase in target prices reflects the improved valuation framework brought by the AI security narrative, while the neutral ratings indicate that current stock prices already reflect a considerable degree of optimism.

In terms of valuation comparison, CrowdStrike's 36 times CY27 enterprise value multiple has a significant premium compared to large high-growth SaaS peers' 13 to 19 times. Okta's 11 times is in the middle range among peers. SailPoint's 8 times is at the low end among peers. The differing valuation positioning of these three stocks but consistent ratings indicate that Bank of America believes the support of the AI security narrative for valuations is already reflected in prices.

In the overall industry valuations listed by Bank of America, the cybersecurity sector has an average enterprise value multiple of 19.6 times for 2026, with a median of 10.4 times. For 2027, the average is 13.2 times, with a median of 7.4 times. For 2028, the average is 11.1 times, with a median of 6.4 times. CrowdStrike's valuation is significantly higher than the sector average, Okta is slightly above average, and SailPoint is close to the median.

Bank of America believes that AI security concerns provide a lasting catalyst for the cybersecurity sector. The market is pricing a step increase in security risks, supporting higher security spending and a more aggressive valuation framework. However, the combination of increased target prices and neutral ratings suggests that the room for valuation expansion has already been partially realized.

If the awareness of AI agent threats continues to rise, whether security spending can exceed current expectations will determine whether these three stocks can shift from valuation expansion to earnings-driven gains.

Disclaimer

This article is a compilation and interpretation by ChaoXiang Research of a third-party brokerage research report (Bank of America, September 18, 2026), in conjunction with publicly available market information. The ratings, target prices, earnings forecasts, and related judgments quoted in the text represent the views of that brokerage analyst and solely reflect the position of their institution, not the views of ChaoXiang Research, nor does it constitute any investment advice.

The market carries risks, and decisions should be independent. This article should not be used as the basis for buying or selling any securities.