Bank of America Research Report: Concerns about AI safety are rising, and cybersecurity has become one of the few "mutually beneficial" sectors in the AI narrative

Written by: Rita

The cybersecurity ETF has outperformed the software sector and the S&P 500 over the past month, as the market's pricing of AI security risks shifts from disruptive threats to new attack surfaces. A report released by Bank of America on September 18, 2026, indicates that concerns about AI security are becoming a lasting catalyst for the cybersecurity sector. The HACK and CIBR ETFs rose 7.3% and 6.4%, respectively, over the past month, while the IGV software ETF increased by 2.8% and the S&P 500 fell by 0.9%. Bank of America raised the target prices for CrowdStrike (CRWD), Okta (OKTA), and SailPoint (SAIL).

Bank of America analyst Tal Liani noted in the report that the AI narrative has reversed. Investors who previously worried about AI disrupting security software now recognize that AI has created new attack surfaces, new identities, and new governance needs. These needs require additional security investments. The firm believes that the market is pricing in a step increase in security risks, which supports higher security spending and a more aggressive valuation framework. Cybersecurity is seen as a foundational enabling layer in the AI era.

AI Threats Become More Common

The CEO of Anthropic has publicly expressed concerns that within 6 to 12 months, agent clusters may have the capability to take over the internet and cause billions of dollars in damage. OpenAI recently disclosed additional cases of agents exhibiting unexpected behaviors, including inserting new instructions, concealing errors, and attempting to bypass restrictions. Bank of America believes these developments indicate that AI-related threats are real, especially in the wrong hands.

Bank of America pointed out that companies are increasingly recognizing the need to strengthen existing security controls, and Chief Information Security Officers feel a sense of urgency. The current response is a dual approach: on one hand, reinforcing existing security infrastructure and expanding depth defense, and on the other hand, deploying new AI security products as additional safeguards. The firm believes that the cybersecurity sector can benefit from both positive and negative news regarding AI. Negative news raises threat awareness, while positive news validates the value of security investments.

Cybersecurity is one of the few sectors that benefits in both directions from the AI narrative. Enhanced AI capabilities bring new threats, driving increased security spending. The expansion of AI applications brings new identities and governance needs, which also drive increased security spending. Bank of America positions cybersecurity as a major theme and enabler in the AI era.

Identity Management is Key

As Chief Information Security Officers consider how to protect agents, identity management and governance become the obvious answers. Every AI agent ultimately needs authentication, authorization, monitoring, and enhanced governance. This trend creates a favorable environment for identity management vendors, supporting Okta and SailPoint.

Bank of America raised Okta's target price to $200, based on an 11x CY27 enterprise value multiple, up from 9x. The current price is $190.02. The firm believes this multiple is in the middle range of 6 to 17x for cybersecurity peers, and this valuation is reasonable considering AI's impact on revenue growth and execution reliance. Upside risks for Okta include higher adoption rates of customer identity products leading to faster growth, product premiums leading to faster growth, and improved sales team efficiency leading to margin enhancement. Downside risks include continued price erosion of core products due to intensified competition, delayed procurement due to reduced customer budgets, and worsening execution issues leading to slower margin recovery.

Bank of America raised SailPoint's target price to $22, based on an 8x FY28 enterprise value multiple, up from 7x. The current price is $20.19. The firm noted that this multiple is at the lower end of the 5 to 10x range for SaaS security peers, as SailPoint, being a point solution, is experiencing decelerating growth. Upside risks include improved assessment capabilities of market size and enhanced conversion rates of qualified customers in the pipeline. Downside risks include difficulties in assessing market size, investor sentiment and sensitivity to premium valuations, and intensified competition.

Platform Security Leaders Benefit

Another answer to protecting agents is to strengthen platform capabilities by integrating control points such as identity, endpoint, and network. CrowdStrike solidified its position at the forefront of AI security after announcing multiple initiatives at the Fal.Con 2026 conference. Bank of America raised CrowdStrike's target price to $260, based on a 36x CY27 enterprise value multiple, up from 32x. The current price is $245.70.

CrowdStrike's Guardian product is setting industry standards for AI detection and response (AIDR), and the SafeMind framework effectively brings cutting-edge AI security into the hands of defenders. Bank of America noted that this premium valuation is supported by CrowdStrike's strong positioning in endpoint security and long-term growth opportunities in cloud security, log management, and identity protection. CrowdStrike's high growth characteristics and potential to gain market share in new markets may expand the total addressable market and accelerate growth.

Downside risks include investor sentiment and sensitivity to premium valuations, lower-than-expected adoption rates of new products, slowing customer acquisition and expansion deals, security vulnerability risks, and intensified competition from existing and emerging vendors. Bank of America also pointed out that CrowdStrike's high growth and long-term opportunities are partially offset by lower profit margins and expected growth deceleration.

Three Stocks Maintain Neutral Ratings

Bank of America raised the target prices for three stocks but maintained neutral ratings for all. The target price increases reflect improvements in the valuation framework brought about by the AI security narrative, while the neutral ratings indicate that current stock prices already reflect a considerable degree of optimistic expectations.

In terms of valuation comparison, CrowdStrike's 36x CY27 enterprise value multiple has a significant premium over large high-growth SaaS peers' multiples of 13 to 19x. Okta's 11x is in the middle range among peers. SailPoint's 8x is at the lower end among peers. The different valuation positioning of the three stocks, but consistent ratings, indicate that Bank of America believes the support of the AI security narrative for valuations has already been reflected in prices.

In the overall industry valuation listed by Bank of America, the cybersecurity sector has an average enterprise value multiple of 19.6x for 2026, with a median of 10.4x. For 2027, the average is 13.2x, with a median of 7.4x. For 2028, the average is 11.1x, with a median of 6.4x. CrowdStrike's valuation is significantly higher than the sector average, Okta is slightly above average, and SailPoint is close to the median.

Bank of America believes that concerns about AI security provide a lasting catalyst for the cybersecurity sector. The market is pricing in a step increase in security risks, supporting higher security spending and a more aggressive valuation framework. However, the combination of target price increases and neutral ratings suggests that the potential for valuation expansion has already been partially realized.

If awareness of the threats posed by AI agents continues to rise, whether security spending can exceed current expectations will determine whether these three stocks can shift from valuation expansion to profit-driven increases.

Disclaimer

This article is a compilation and interpretation of third-party brokerage research reports (Bank of America, September 18, 2026) by ChaoXiang Research, combined with publicly available market information. The ratings, target prices, earnings forecasts, and related judgments quoted in this article are the views of the analysts of that brokerage and represent the position of their respective institutions, not the views of ChaoXiang Research, and do not constitute any investment advice.

The market carries risks, and decisions should be made independently. This article should not be used as the basis for buying or selling any securities.