The Zhitong Finance App learned that Citi said in a research report released recently that the bank's latest Chief Information Officer (CIO) survey shows that the cybersecurity spending trend has improved, the cybersecurity budget growth rate will accelerate to 7% over the next 12 months (NTM), and artificial intelligence (AI) deployment has clearly become a catalyst for the growth of security investment. Businesses seem to be expanding their focus from simply protecting security to protecting expanding cloud computing assets and managing increasingly complex, multi-layered attack surfaces.
Cybersecurity continues to be the number one destination for enterprise tool integration. According to Citi, this is beneficial to large-scale platform vendors such as Palo Alto Networks (PANW.US) and CrowdStrike (CRWD.US). At the same time, the tailwind factors brought about by agentic (agentic) technology are showing, but it is still in its early stages, so the competitive landscape and ultimate winner are still yet to be determined. Among them, Okta (OKTA.US) is in an enviable position.
In the context of this positive investigation, Citi raised the target prices of some cybersecurity companies, reflecting improved cybersecurity spending indicators, increased confidence in the smooth wind factors in specific fields, and ultimately increased confidence in the upward space for profit forecasts for the next 12 months.
Cybersecurity budget trends show acceleration
Overall, the growth rate of cybersecurity spending has improved, and the cybersecurity budget growth rate will accelerate by about 1 percentage point to about 7% over the next 12 months; corporate AI investment is clearly driving the increase in cybersecurity spending, and 82% of CIOs said that corporate AI investment is increasing cybersecurity spending, up from 71% previously.
Although cybersecurity still lags behind the highest-ranked data analysis/generative AI in terms of investment priorities over the next 12 months, the gap between the two has narrowed to 3 percentage points from 10 percentage points in the previous quarter.
At the same time, cybersecurity remains the primary area of enterprise tool integration. The proportion of CIOs choosing this field rose 4 percentage points to 37%; cybersecurity spending remained at around 9% of the overall IT budget.
Cloud security, identity security, and vulnerability management/exposure management are top investment priorities
Cloud security, identity security, and vulnerability management/exposure management (VM/EM) were the top investment priorities in the cybersecurity sector in the Citi survey. From the perspective of entering the top three priorities, cloud security has taken back the lead, and VM/EM rankings have also improved markedly.
Unlike the previous quarter—when identity security, endpoint security, and web security dominated the top priority choices—CIOs seemed to have a more balanced configuration of basic security control layers including cloud security, identity security, cybersecurity, and VM/VA/EM.
Citi continues to believe that identity security is a key architectural control point in an increasingly intelligent environment. However, the survey shows that enterprises are expanding their scope of attention, not just focusing on identity security-centered spending, but moving away from protecting expanding cloud assets and improving overall security landscape management.
According to Citi, the resurgence of VMs is particularly noteworthy. This may reflect an increasing focus on reducing exposure, repairing workflows, and attack surface management, as enterprises deal with larger AI-enabled environments and rapidly growing infrastructure complexity.
Judging from overall market attention, VM/EM has also recently become a hot topic (including executive orders, C-suite management's awareness of this issue and related concerns, and technological advances in major laboratories making this issue the focus of attention). Citi believes that these factors may jointly drive the rapid rise of this broader segment.
Hyperscalers (Hyperscalers) still have an advantage in cloud security procurement decisions, but overall, Microsoft (MSFT.US), Palo Alto Networks, and CrowdStrike are clearly the main beneficiaries of customer wallet shares in the overall technology stack spend configuration.
Higher valuation multiples
Citi pointed out that the accelerated trend in cybersecurity spending shown by hard data has alleviated sector valuation fatigue — the sector's valuation has been clearly revalued. Currently, the 12-month EV/sales volume (EV/S) for the 12-month period is 22 times, compared to 10 times 6 months ago and 14 times 1 year ago; with few exceptions, substantial profit forecast increases have been limited.
However, there is more clear and multi-faceted evidence that cybersecurity budgets and industry growth will remain strong for a longer period of time, which makes it reasonable for the bank to increase the final valuation multiplier. The bank slightly raised the final value multiplier from some companies to reflect its confidence that the accelerated budget will eventually translate into higher structural growth, as well as relevant evidence, especially for leading cybersecurity companies.
This judgment is based on the bank's basic view that the combination of the following factors will keep the entire cybersecurity sector at a high valuation bottom: 1) lower/lowest risk of laboratory and AI disintermediation; 2) attractive thematic investment exposure; 3) scarce asset size and fundamental value; 4) these companies are essentially becoming “insurance policies” for AI risks.
Specifically, Citi raised the target price of Palo Alto Networks from $410 to $440 to give a “buy” rating; raised the target price of CrowdStrike from $260 to $295 to give it a “buy” rating; raised the target price of Okta from $205 to $215 to give it a “neutral” rating; and raised the target price of Zscaler (ZS.US) from $245 to $260, giving it a “buy” rating.