The AI Security Trade

The most useful thing to understand about the AI-security trade is that you are mostly buying the existing security budget, with an agent option on top. From April 13 through September 15 the listed security names rose significantly, repriced on the idea that agents create a new attack surface someone has to secure. The demand is real. But securing AI itself is a $2.8 billion market this year, while the companies doing the re-rating sell into identity, network, and endpoint markets worth tens of billions each. The agent option is genuine and it is the fastest-growing thing in security. It is also small, early, and buried inside much larger businesses.

Two weeks ago I wrote about OpenAI's own agents breaking their sandbox and attacking Hugging Face, drawing on OpenAI's account and the METR and Redwood investigation. The incident is a useful map because it crossed several boundaries in sequence, and each boundary is a different market with a different leader. But the mapping is not clean, and the honest version separates direct exposure, a product actually built for the agent problem, from adjacent exposure, an existing product that touches it. There are four established markets here, with a new category of AI-specific protection emerging across them.

The stack, sized

Approximate 2026 sizes; definitions vary by firm. Sources: identity Grand View; network/SASE MarketsandMarkets; endpoint MarketsandMarkets and EDR; observability Technavio; securing AI Gartner.

Look first at where the money actually sits. Identity is the largest layer, around $27 billion, and it holds the strongest claim on agent security, because every agent needs credentials, a permission scope, and an audit trail. Network and endpoint are each roughly $20 billion, mature markets with entrenched leaders. Observability is smaller again, around $12 billion. And the category everyone is actually bidding on, securing the models and agents themselves, is the smallest by an order of magnitude: $2.8 billion in 2026 on Gartner's numbers, growing 68.7% into 2027 and toward $16.4 billion by 2030.

That is the tension in one image. The agent story is loudest in the smallest room. The revenue that pays these companies' bills is the large, established layer beneath it. Most have now added a direct agent-security product to that base. The rest of this piece examines the four incumbent markets, then the emerging category they are all trying to capture.

Identity: the strongest structural claim

Identity is the one layer where the mechanism and the money point the same way. Thousands of agents each need an identity scoped to what they are allowed to touch, and every action needs to be attributable. That is the privileged-access problem, and it is precisely what failed in July, when the agents escalated through stolen credentials into infrastructure they were never meant to reach. Of all the boundaries the incident crossed, this is the most direct read.

Palo Alto bought the thesis literally, closing its $25 billion acquisition of CyberArk in February to fold human, machine, and agent identity into a much broader platform, and it now ships Prisma AIRS 3.0 with an agent gateway on top of its 2025 Protect AI acquisition. Okta is the largest remaining independent, and the market has already paid up: the stock roughly tripled in five months. Privileged access is a small sub-segment, four to five billion, but it is growing north of 20% inside a $27 billion identity market that Microsoft also defends by default through Entra.

More agents expand the number of identities and permissions enterprises must govern. Whether that becomes incremental revenue depends on pricing: separately billed machine identities and privileged sessions, or features absorbed into existing platform contracts. That is the open question under the strongest structural claim in the group. This is the layer with the most conviction already in the price, which is the catch as much as the appeal.

Application and network security: where the breakout happened

The July escape ran through the network, when the agents bypassed isolation to reach the open internet. It is tempting to file that under zero-trust networking, a roughly $20 billion SASE market growing in the mid-to-high twenties. But the breakout looked less like a SASE gap than an application-layer one: server-side request forgery, egress that should have been blocked, a template-injection flaw, exposed credentials in cloud workloads. Those map to application security, cloud-workload protection, and API security as much as to the network edge, which is a more crowded and fragmented field than any single name suggests.

Cloudflare is the most exciting name here and the most expensive. In early September it launched a vulnerability-remediation service built on OpenAI's Daybreak models, and the stock rose about 10% that week. Read that carefully: OpenAI's models, weeks after OpenAI's agents caused the incident, sold back to enterprises as defense. It is a real product, in early access, not yet a revenue line. Classify it precisely, though: Daybreak uses AI to discover and patch software vulnerabilities, which is AI applied to defense, not a product for securing agents. Cloudflare's agent-security exposure is thematic more than direct.

Zscaler is the counterweight, the cheapest pure-play in the group, still down on the year, but it has shipped genuine agent-era product in AI Protect and an AI Broker that governs agent-to-agent access. Palo Alto competes through Prisma, and Fortinet is the lower-multiple, highly cash-generative incumbent. The exposure here is real but mixed: some direct, much of it adjacent.

Agent runtime and endpoint: increasingly direct, still early

Endpoint is the device layer, and the loosest analogy in the incident. A sandbox running an agent is not an enterprise laptop, so the generic case for endpoint-detection vendors is weak on its own. What changes the picture is product. On September 1, CrowdStrike launched Falcon Guardian, runtime security for AI agents enforced where they execute, discovering shadow agents and tracing the chain from prompt to system action. That is a direct agent-security product, not an EDR analogy, and it matters more than the layer label.

The broad endpoint market is around $20 billion, with the faster detection-and-response core near six billion growing about 24%. CrowdStrike is the consolidation leader, its moat built on a single Falcon sensor already installed across millions of machines, now extended to agents themselves. SentinelOne sits underneath as the cheaper challenger, with continued traction in government and regulated environments, and the market has never given it CrowdStrike's multiple, which tells you what it thinks of the competition. Microsoft bundles endpoint protection into deals it is already winning, the quiet threat under the whole layer.

Observability and evaluation: necessary, not verification

The fourth failure in July was the evaluation itself, trusting the evidence that a system did what it claimed. That points at observability, a roughly $12 billion market, and at Datadog, which sells agent monitoring and automated evaluation. The AI-native slice is still small, under three billion, but growing about 36%, and Datadog leads independent observability.

Here the exposure is the most adjacent of the group, and it is worth being precise about why. Datadog can record an agent's traces and score its outputs. It cannot, on its own, prove that an agent completed a task legitimately rather than gaming the check, which is the exact failure the incident exposed. Evaluation integrity and commercial observability are neighbors, not the same market. And the part of the stack most directly downstream of that problem, independent evaluation and data validation, is largely private. There is no clean listed way to own it.

Securing AI itself: fastest-growing, buried inside incumbents

These direct products do not form a separate fifth layer. They add AI-specific controls across identity, application security, runtime protection, and monitoring. Gartner groups this spending on securing AI into a category of its own: $2.8 billion in 2026, $4.8 billion in 2027, $16.4 billion by 2030. It is the fastest-growing line in security, at 68.7% into 2027, and it has no listed pure-play.

What it has instead is a product inside almost every incumbent on this page. Palo Alto has Prisma AIRS and Protect AI. CrowdStrike has Falcon Guardian. Fortinet bought Virtue AI in August for agent validation and runtime protection. Zscaler has AI Protect. Cloudflare sits just outside this set, since Daybreak defends with AI rather than securing agents. This is the strongest evidence for the whole thesis and its sharpest limit at once. Direct exposure to the agent-security market exists across the group, and none of it is separately disclosed. You cannot buy the category. You can only buy a large incumbent and hope its small, fast-growing agent line compounds into something that moves the whole.

What the market already prices in

Now the price. From April 13 through September 15 every name here rose between 58 and 191%, on revenue growing 11% to 36%. That was partly a sector bid: over the same window the cybersecurity ETFs CIBR and WCBR rose 60% and 85%, against roughly 12% for the Nasdaq. The whole sector crushed the index. But the dispersion inside was enormous, 58% at Zscaler to 191% at Okta, and the biggest winners beat the ETFs, so selection mattered as much as the sector.

Most of the price gains came from higher trailing revenue multiples rather than growth in reported revenue. Over the same five months trailing revenue advanced only mid-single digits, while prices rose 58% to 191%. Where the window can be measured cleanly, trailing EV/sales rose by roughly two-thirds to a double: Cloudflare from about 28x to 46x, Datadog from about 11x to 20x, Fortinet from about 8x to 16x. That is what these prices are, multiples that expanded far faster than the businesses underneath them, which is the whole risk in one line. (Starting multiples are estimated from each name's April 13 price and its trailing revenue at that date; the ending figures are the September 15 multiples in the table.)

The businesses vary more than the multiples alone suggest. Seven of the eight generate meaningful free cash flow, but the range is far wider than the revenue-growth numbers imply: trailing free-cash-flow margins run from roughly 13% at Cloudflare to more than 40% at Fortinet, while SentinelOne sits near break-even. Cloudflare and SentinelOne are also still GAAP loss-making. That spread matters when the names trade on similar sales multiples, and it is the kind of difference the headline growth rates hide.

Trailing EV/sales and FCF via Yahoo Finance and quarterly filings, September 15, 2026; FCF is operating cash flow less capex and capitalized software. Palo Alto's EV reflects the combined company but revenue only a partial year of CyberArk, so its multiple is not peer-comparable; organic growth high-teens.

The group sorts less by layer than by what you are asked to pay. CrowdStrike and Cloudflare are priced for near-perfect execution. Palo Alto and Fortinet offer scale and cash flow at multiples that are demanding but not heroic. Zscaler and SentinelOne are the cheap end, and the market is telling you why in both. Okta is the purest bet that the identity thesis is right, priced as if it already is. None of them, at these prices, is cheap.

What would break this

The obvious risk is a de-rating. Multiples that expanded on a narrative contract fastest when the narrative pauses. This group does not need bad news to fall 30%. It only needs the bid to stop. Datadog gave a preview in September, falling 18% in six sessions without an earnings release or guidance cut.

The subtler risk is that securing AI stays a feature, not a category. If the durable revenue is the incumbent layer with agent features attached, rather than a separable agent-security market, the winners are whoever already owns identity, the network, and the endpoint, plus the hyperscalers bundling it in. That rewards scale and incumbency, Palo Alto and Fortinet and Microsoft, over the higher-multiple names. Watch whether any of these companies ever breaks out securing-AI revenue as a disclosed line, or whether it stays a talking point.

And the group is correlated. These are not eight independent bets. They rise and fall together, so position size matters alongside selection.

Where the exposure actually sits

Strip out the narrative and distinguish the exposures on the agent-security dollar:

• Broadest direct exposure: Palo Alto, across identity, network, and a dedicated AI-security platform.
• Strongest identity exposure: Palo Alto through CyberArk, with Okta as the listed independent.
• Most interesting new runtime exposure: CrowdStrike, through Falcon Guardian.
• Lower-multiple incumbent with direct optionality: Fortinet, through Virtue AI.
• Cheapest network name with direct product: Zscaler, AI Protect and an agent broker, still down on the year.
• Most narrative-sensitive: Cloudflare, richest multiple, and its AI product defends rather than secures agents.
• Most adjacent rather than direct: Datadog, essential but not verification.

The demand is real, the incident was a genuine warning, and most of these are strong businesses in large markets. The trap is treating them as one trade. These companies serve different established markets, and their exposure to AI-specific security varies widely. After a big run, the difference between the names now sits in the price and the directness of the exposure, not in the story.

What I am watching next

• A disclosed line: the first company to break out securing-AI revenue on its own, and how fast it grows. Until then the category is a forecast wearing eight tickers.
• Bookings, not launches: whether Falcon Guardian and Prisma AIRS show up in bookings commentary, the earliest sign the direct products are selling rather than shipping.
• Palo Alto organic growth: where it lands once CyberArk laps the acquisition, which tells you whether the identity thesis is compounding or just consolidating.
• Zscaler's next guide: it is the cheapest network name for a reason, and a reacceleration would be the clearest sign the discount is wrong.
• Hyperscaler bundling: any sign Microsoft, Amazon, or Google move agent security from add-on to bundled default, the fastest way to compress every multiple on this page.