Morgan Stanley Flags 5 Cybersecurity Stocks Riding AI Wave

Key Moments

Morgan Stanley identified five cybersecurity companies it believes are well placed to benefit from rising demand for AI-focused security and identity protection.
Microsoft, Palo Alto Networks, CrowdStrike, and SailPoint received constructive commentary, while SentinelOne retained a more cautious Equal-weight stance.
Across the group, management teams pointed to AI agent governance, identity security, and high-value telemetry as central themes shaping future growth.

Morgan Stanley’s Cybersecurity Focus After RSA Conference

Morgan Stanley laid out its favored cybersecurity stocks after recent discussions with management teams and takeaways from the RSA Conference, a major gathering for the cybersecurity industry. The firm called out five companies it believes are strategically positioned as enterprises increase the use of AI agents and require stronger protection around artificial intelligence and identity.

Overview of Highlighted Cybersecurity Names

Company	Ticker / Exchange (as provided)	Morgan Stanley Stance / Notable Themes
Microsoft	Not specified	Incrementally more positive; strong focus on AI agent governance and identity security, growing security market share
Palo Alto Networks	Not specified	Seen as well-positioned across AI security, with Prisma AIRS, AI Gateway, and XSIAM driving the strategy
CrowdStrike	Not specified	Recently upgraded to a top pick, leveraging proprietary telemetry and kernel-level visibility
SailPoint	Not specified	Viewed as a near-term beneficiary of identity security expansion around agentic AI
SentinelOne	Not specified	Rated Equal-weight, with emphasis on kernel-level telemetry and evolving partnerships

Microsoft: Expanding AI Agent Governance and Security Footprint

Morgan Stanley reported a more constructive stance on Microsoft after engaging with the company’s security leadership. According to the firm, Microsoft is concentrating on governance of AI agents and on treating these agents as first-class entities within its identity security framework.

The Security Copilot offering has shifted into a set of embedded, workflow-native agents across Microsoft’s Defender, Purview, and Entra products. Morgan Stanley noted that Microsoft is continuing to win share in security, citing about 1.6 million customers and an estimated $20 billion security revenue run rate.

Within this ecosystem, Sentinel and identity services are viewed as critical platform foundations, while adoption of the E5 bundle remains a central factor in the company’s growth trajectory in security.

Palo Alto Networks: Building a Full-Stack AI Security Architecture

Morgan Stanley characterized Palo Alto Networks as favorably positioned on multiple fronts of the AI security transition. The firm pointed to the company’s Prisma AIRS initiative, which is designed to secure the entire lifecycle of AI agents and already counts more than 100 early customers.

The recently introduced AI Gateway is described as a key governance and control layer for AI traffic, offering real-time policy enforcement capabilities. In the security information and event management (SIEM) category, Palo Alto’s XSIAM platform takes in roughly 17TB of telemetry each day, with more than 600 customers and net revenue retention above 120 percent.

The company also rolled out several additions to its product lineup, including a refreshed Prisma Browser aimed at securing autonomous AI agents, as well as a new platform to automate management of digital certificates.

CrowdStrike: Telemetry and Kernel-Level Visibility Underpin Top-Pick Status

Morgan Stanley recently elevated CrowdStrike to a top-pick rating, highlighting its proprietary telemetry and kernel-level visibility as major advantages over peers. Management underscored that a substantial share of SIEM data is sourced directly from CrowdStrike’s own sensors.

The company drew attention to Falcon AIDR, which focuses on protection at the prompt layer, and introduced Agentworks to further enhance analyst efficiency. Falcon Flex is gaining momentum as a driver of consolidation, contributing to an average selling price increase of about 48 percent in re-flex use cases.

CrowdStrike also unveiled the Charlotte AI AgentWorks Ecosystem, which supports custom AI security agents and is being built in partnership with companies such as Amazon Web Services and NVIDIA. Additionally, the firm broadened its collaboration with Intel to optimize its Falcon platform for AI-enabled PCs.

SailPoint: Identity Security Positioned for Agentic AI Demand

Morgan Stanley views SailPoint as a near-term winner from the buildout of identity security capabilities around agentic AI deployments. The firm noted that offerings tied to AI represented 17 percent of net new annual recurring revenue in the fourth quarter.

Management sees a sizeable transition opportunity, with roughly $350 million in perpetual and term licenses that could migrate to new models at a two to three times uplift. This conversion potential implies about $1 billion in cumulative top-line opportunity over time, according to the firm’s assessment.

SentinelOne: Equal-Weight Rating with Emphasis on Telemetry and Partnerships

Morgan Stanley continues to assign an Equal-weight rating to SentinelOne, taking a more balanced view relative to its other highlighted cybersecurity names. Company leadership pointed to kernel-level telemetry as a distinguishing characteristic and signaled doubts about the sustainability of traditional SIEM architectures.

Guidance from SentinelOne reflects a restrained outlook, with revenue growth expectations of roughly 20 percent at the midpoint for FY27. Even so, management cited improving pipeline activity as a possible early sign of re-acceleration.

The company announced an expanded multi-year partnership with Google Cloud focused on building integrated security offerings. SentinelOne also named Barry Padgett as its new president and chief operating officer.