From NET to CRWD, in the second half of the AI cycle, is money starting to flow into cybersecurity firms?

Last week, US stocks showed an interesting divergence.

Nvidia surged after its earnings report, continuing to prove that demand for AI infrastructure is far from over; at the same time, CrowdStrike (CRWD) rose 20.5% in a single day, Okta (OKTA) climbed nearly 29%, and the cybersecurity sector also saw a notable valuation recovery.

But on the other side, Zscaler (ZS) once plunged more than 30% after its previous quarter's earnings, and SentinelOne (S) also delivered lackluster after-hours performance following its latest report.

All are cybersecurity companies, and all are talking about AI, but what this reflects is a very clear shift:

As capital begins to look beyond compute for new AI revenue sources, the market is no longer willing to uniformly pay for every "AI + cybersecurity" story—it is starting to filter.—Who is actually capturing the new demand created by AI?

1. Compute Is Burning Cash—Now Software Needs to Earn It

Over the past six months, one of the biggest debates across the software industry has been whether AI agents will ultimately disrupt the SaaS business model.

That's because traditional SaaS is largely built on headcount.

For example, a company with 100 employees might mean 100 Salesforce, ServiceNow, or other enterprise software accounts.

But if more and more work is done by agents in the future, and headcount shrinks—or one employee manages dozens of agents—then some software billed on a human-seat basis could indeed face a problem it has never encountered before:

Software usage is rising, but the number of paying human seats may not rise in tandem.

This has also been one of the core logics behind the market's so-called "SaaS doomsday" narrative this year.

But what makes cybersecurity unique is that while AI reduces some human seats, it also creates more non-human objects that need to be managed and protected.

For example, in the past, a company's security perimeter was mainly built around employees, computers, and applications. Today, that list is rapidly lengthening: beyond employees there are machine identities, beyond applications there are APIs, and further down the line, more and more AI agents.

That means an agent may not need a traditional employee account, yet it still needs to log into enterprise systems; it doesn't sit in front of a computer, but it needs to access databases, call APIs, and connect to cloud services.

So the real significance of AI for cybersecurity is that the number of digital objects enterprises need to protect is itself growing.

This is exactly the opposite of the logic facing many traditional SaaS companies.

AI may mean companies need fewer people, but it will hardly reduce the identities, devices, interfaces, data, and machines they need to protect—if anything, it will likely increase them.

That's also why, as the market starts hunting for the next enterprise budget beyond AI infrastructure, cybersecurity naturally becomes a direction worth watching.

2. All Talking AI Security, but Some Surge While Others Plunge?

However, even among companies all pitching AI security, the market is starting to draw clear distinctions.

Take Cloudflare (NET) first. As a representative company, its latest Q2 2026 revenue reached $696.1 million, up 36% year-over-year, accelerating from 34% in Q1; cRPO grew 35% year-over-year, also improving from 34% in the previous quarter.

CrowdStrike's change is even more pronounced. Q1 FY27 Net New ARR was $256 million, up 32% year-over-year; by Q2, Net New ARR had reached approximately $333 million, with year-over-year growth accelerating directly to 51%.

Okta's revenue growth is still only 11%, but cRPO improved from 12% year-over-year growth in Q1 to 14% in Q2, while RPO grew 17% year-over-year.

At the end of the day, for subscription-based and platform software companies, revenue is largely the realization of past orders, while the market today is focusing more on metrics that can tell investors "what will happen in the coming quarters."

CRWD is the most typical example. In its latest quarter, revenue was $1.47 billion, up 26% year-over-year; ending ARR was $5.84 billion, up 25% year-over-year, which looks "unremarkable" at first glance—but Net New ARR of $333 million, up 51% year-over-year, was a major catalyst for the market.

This clearly accelerating new-order curve also represents the most important pricing logic in this round of cybersecurity rally: high growth alone is no longer scarce; it's growth that re-accelerates that's scarce.

Looking at the other side makes this even clearer.

Zscaler's Q3 FY26 revenue grew 25% year-over-year, and ARR also grew 25%. On paper, that's hardly a bad earnings report, yet the stock still plunged over 30% because capital began to question whether its FY27 growth could keep moving upward.

SentinelOne's latest quarter tells a similar story.

Q2 FY27 revenue reached $292 million, up 21% year-over-year; ARR reached $1.218 billion, up 22% year-over-year. The company also raised its full-year revenue guidance, but in after-hours trading following the report, the stock still fell more than 5% because its profitability guidance and forward expectations didn't clear the already elevated bar set by the market.

3. The More Agents, the Bigger the Cybersecurity Business?

What's even more interesting is that if you follow this logic further, you'll find that even within the same cybersecurity industry, CRWD, NET, and OKTA are capturing very different AI dividends.

1. CRWD: Enterprise Security Is Increasingly a Full-Stack System

CrowdStrike's most traditional strength comes from Endpoint—terminal security.

But today, it is far more than just an antivirus suite installed on computers. Its business now covers multiple areas, including Endpoint, Cloud Security, Identity, Security Operations, Observability, Data Protection, and Threat Intelligence.

This matters especially in the agent era.

That's because when an agent completes a task, it often doesn't stay within a single system. It may first obtain an identity, authenticate its permissions, access an API, enter a Cloud Workload, read a database, and finally write results back into another enterprise system.

As a result, the boundaries between Endpoint, Identity, Cloud, and Runtime are blurring. Whoever holds more complete telemetry has the best chance of becoming the unified control plane for enterprise security operations.

The latest acceleration in Net New ARR is also preliminary proof that enterprises are willing to pay for a larger security platform.

2. NET: The More Active Agents Are, the More Internet Traffic

Cloudflare is the most unique company in this group.

That's because it's hard to simply define it as a traditional cybersecurity company. Beyond Security and Zero Trust, it also has a global network, the Workers development platform, and edge computing capabilities.

As a result, AI's impact on Cloudflare isn't limited to "security budgets"—it could also directly increase usage on Cloudflare's network.

As of Q2, Cloudflare's platform had surpassed 7.4 million developers, adding nearly 2 million in a single quarter—even exceeding the roughly 1.5 million added in all of 2025.

Management also disclosed a very interesting phenomenon: in Q2, for the first time, more than half of Cloudflare's network traffic was not generated directly by humans.

Requests from AI agents are still increasing, and no matter how many people agents eventually replace, they still need to connect to the internet, call models, access APIs, read databases, execute code, and exchange information with other agents.

Cloudflare happens to sit at the intersection of all these variables.

So NET's more accurate positioning might be a bet that, in the future internet, there will be an increasing amount of traffic not initiated by humans.

3. OKTA: The "Identities" in a Company May No Longer Be Just Employees

Okta's situation needs to be viewed more cautiously.

In the latest Q2 FY27, the company reported revenue of $805 million, up 11% year-over-year; RPO reached $4.858 billion, up 17% year-over-year; cRPO reached $2.585 billion, up 14% year-over-year.

Compared to 12% in Q1, cRPO has indeed improved.

But based on management's disclosures, the current improvement is still mainly driven by large customers, the core Workforce/Customer Identity business, and newer products like Identity Governance.

Meanwhile, the bigger significance of Agent Identity is that it opens up a market that didn't exist for Okta before—previously, Okta managed employees and customers; in the future, enterprises will also have to manage agents.

Okta has already begun rolling out capabilities around AI agents, including discovery, registration, access control, and lifecycle management.

While it's still too early to say how much revenue Agent Identity has contributed to Okta, it has genuinely added new scalability potential to an already mature identity market.

In the past, a company might have had tens of thousands of employees. In the future, it could easily run hundreds of thousands or even more machine identities and agents simultaneously.

If this trend truly materializes, the market boundary of Identity will shift accordingly, and OKTA will undoubtedly face a re-rating.

Final Thoughts

Where will all this money being spent on AI eventually turn into revenue?

Cybersecurity is likely one of the earliest industries to provide an answer.

The reason isn't complicated: AI can replace some people, but it won't reduce digital activity inside enterprises—in fact, it will likely only generate more of it.

This means that what AI challenges in some software companies may well become incremental market opportunity for others.

But the latest round of earnings has also begun to separate the two categories. Having an AI story alone is no longer enough—orders, revenue, and whether growth is actually accelerating now carry significantly more weight.

The second act of AI may have only just begun.