AI Security Is Growing, but Not Every Security Stock Is Cheap — U.S. Cybersecurity Investment Strategy
Based on U.S. closing prices on October 21. We compare AI security demand, earnings, cash flow, and dilution at PANW, CRWD, FTNT, ZS, and CHKP to identify current investment candidates and prices worth waiting for. We also reviewed OKTA, NET, TENB, and S.
Read as text
GOGUMA TEAM · US CYBERSECURITY
October 22, 2026 · U.S. Security Company Investment Strategy
AI Security Is Growing,
Not Every Security Stock
Is Cheap
Separating Demand, Earnings, Stock-Based Compensation, and Purchase Price
Check Point · Fortinet · Palo Alto Networks
CrowdStrike · Zscaler
Check Point CHKP · NASDAQ _$143.43 +1.83% vs. previous close _ Consider an initial defensive position at the current price
Fortinet FTNT · NASDAQ _$174.05 +1.83% vs. previous close _ Initial review price: $155.00 (−10.94%)
Key comparisons: Palo Alto Networks (PANW) $347.25 · CrowdStrike (CRWD) $239.34 · Zscaler (ZS) $231.33
Prices: U.S. regular-session closing prices on October 21, 2026, in USD
Additional comparisons: Okta (OKTA) · Cloudflare (NET) · Tenable (TENB) · SentinelOne (S)
**Industry growth and shareholder returns are not the same thing.**Distinguish current investment candidates from prices worth waiting for. An initial review price is neither a price target nor an automatic order.
Separate the Companies to Buy Now from Those to Wait On
**For a defensive, diversified investment at current prices, consider Check Point (CHKP) first. Fortinet (FTNT) is the top choice for investors seeking both growth and earnings quality, but $155 is the initial review price for new purchases.**Reassess the investment thesis for Zscaler (ZS) at $195 and Palo Alto Networks (PANW) at $271. Don’t chase today’s rally in CrowdStrike (CRWD) or Cloudflare (NET).
This is not a blanket call to “buy security stocks.” AI is generating real demand for security, but that demand will not flow equally into every company’s earnings. Good products, growing revenue, cash left for shareholders, and an attractive purchase price are separate questions. This report addresses each of the four.
| Company · Ticker | October 21 Close | Action for New Investments | Initial Review Price |
|---|---|---|---|
| Check Point · CHKP | $143.43 (+1.83%) | Consider an initial defensive position | Current price: $143.43 (0.00%) |
| Fortinet · FTNT | $174.05 (+1.83%) | Wait for a better price; don’t chase | $155.00 (−10.94%) |
| Zscaler · ZS | $231.33 (+7.84%) | Hold off on new positions after the sharp rally | $195.00 (−15.70%) |
| Palo Alto Networks · PANW | $347.25 (+2.05%) | Assess acquisition-driven growth and dilution; wait for a better price | $271.00 (−21.96%) |
| CrowdStrike · CRWD | $239.34 (+5.27%) | Don’t chase on collaboration news | No new price level set |
All prices are in USD and reflect U.S. regular-session closes on October 21, 2026. The percentage in parentheses after the current price is the daily change; the percentage after the initial review price shows its distance from the current price. An initial review price is a potential buying level based on the Goguma Team’s assumptions, not a price target, automatic order price, or forecast of a decline. The rationale for EPS and valuation multiples is provided below. CHKP · FTNT · ZS · PANW · CRWD
Existing investors need to ask different questions from new buyers. We do not recommend selling an entire position and waiting to reenter simply because the price looks expensive. If the underlying assumptions for growth and cash flow remain intact and you can tolerate the risk, holding should be the priority. Conversely, if the company’s per-share value has declined, or you cannot tolerate the concentration or potential losses, reduce your position rather than waiting to break even.
**Your reason for buying matters more than the stock’s name.**CHKP is a defensive candidate to assess based on both cash generation and valuation, not an explosive AI growth stock. FTNT offers a different choice focused on earnings quality, PANW and CRWD on platform competitiveness, and ZS on cloud security growth.
AI is increasing the need for security, but budgets do not automatically grow
AI agents go beyond simply generating answers: they read files, run code, and connect to other systems. Companies must control not only human logins but also agents’ permissions and actions. Attackers are automating vulnerability scans and impersonation, too. That is why demand for security spanning identity and access, endpoints, cloud, data, and networks is growing.
But the pace at which security needs are growing is not the same as the pace at which customers are willing to spend more. In the IANS–Artico 2026 survey, the average security budget growth rate was 5%, but the median was 0%. Budgets were flat or lower at 55% of respondent organizations. AI accounted for an average of 3% of budgets, while 38% of organizations said their AI budgets came from outside the security department. This does not mean 38% of total AI spending.IANS budget survey · IANS survey details
In this environment, customers have strong incentives to consolidate existing vendors rather than keep adding security tools indefinitely. Platform companies can bundle multiple capabilities to expand contracts. On the other hand, if major platforms or cloud services include some features, independent companies may have less pricing power.After the industry argument that “AI increases risk,” the next question is “who wins the paid contracts?”
How much of the overnight news is confirmed?
On October 21, CrowdStrike and NVIDIA expanded their collaboration to connect AI agent security with software and semiconductor infrastructure. The OpenShell integration and BlueField-4-based security plans could broaden the products’ reach. However, we should not estimate AI-specific revenue or ARR that was not disclosed in this announcement and add it to existing total ARR. It would also be wrong to conclude that revenue is zero simply because it was not disclosed.Official CrowdStrike and NVIDIA announcement
PANW said Prisma AIRS exceeded $100 million in ARR in its first full year after launch. ARR is the annualized value of recurring contracts, not revenue recognized in that quarter. This is an example of monetized AI security, but it does not justify calling all of the company’s next-generation security ARR AI revenue.PANW annual results announcement
The market reaction was strong. On October 21, CIBR rose +2.72% and HACK +3.24%, outperforming QQQ at about +1.06%. Over the past month, however, performance diverged: ZS was up about +11.68%, while PANW fell −6.59% and NET −12.64%. A one-day rebound should not be extrapolated into an industry-wide trend reversal. ETF volume or share prices alone cannot confirm institutional buying or short covering, either.CIBR · HACK · NET price history
The comparison covers U.S.-listed stocks. CyberArk is not treated as an independent investment candidate following the completion of its acquisition by PANW, and Wiz, acquired by Google, is not recommended as though it were an independent listed company. CRWD prices reflect the 4-for-1 stock split on July 2. No sharp decline was calculated by comparing prices before and after the split.CyberArk acquisition completed · CRWD results adjusted for split
Fortinet and Check Point: Earnings Quality and Entry Price
Fortinet — Not the cheapest company, but it converts earnings into cash well
Fortinet's Q2 revenue was $2.048 billion, up 26% year over year. Product revenue rose 52%, while service revenue grew by about 14.2%. Demand for product replacements is indeed strong. However, it would be an overreach to assume this pace will continue indefinitely or to dismiss overall growth by looking at service growth in isolation.
GAAP operating income was $689 million, and conventional free cash flow was $966 million. In the same quarter, stock-based compensation expense was $81 million, or about 3.9% of revenue—lower than at the high-growth companies in this comparison. We distinguished conventional FCF from the company's adjusted FCF of $996 million. Its strength lies not only in product competitiveness but also in a business model that converts revenue into earnings and cash. Fortinet Q2 official financial materials
The issue is valuation. At $174.05, the stock trades at about 50.6 times the midpoint of the 2026 adjusted EPS outlook of $3.44. For a new position, the Goguma Team applied a 45x multiple and set $155 as the initial price to consider. That multiple is no guarantee of a bargain. The assessment gives a premium for low stock-based compensation and strong cash generation, while accounting for the risk of slowing product growth. If already holding the stock, the preference is to hold as long as earnings assumptions remain intact. If both product and service growth slow, or the EPS outlook is lowered, the $155 level should be reassessed.
Check Point — Accessible even at the current price, but not risk-free
Check Point's Q2 revenue increased just 1%, but subscription revenue rose 12%. That is slow compared with high-growth platforms. In return, at $143.43, the stock trades at about 18.6 times the midpoint of the 2026 GAAP EPS outlook of $7.70. Using adjusted EPS of $10.45 would put the multiple at about 13.7x, but the article's conclusion does not rely solely on that lower adjusted multiple. Check Point Q2 presentation and annual outlook
There are also clear counterarguments. Q2 conventional FCF was $160.7 million, down about 37% year over year. Net income fell while EPS rose, so the impact of share count reduction from buybacks needs to be separated out. Cash and marketable securities totaled about $4.203 billion at the end of June, but the company also had about $1.975 billion in convertible notes, measured at book value. It should not be described as cash-rich with no debt. Check Point official 6-K financial statements
Goguma's conclusion is that a defensive starter position can be considered even at $143.43. It should be approached as an alternative to aggressive AI growth stocks, without taking a large position all at once. Peanut preferred to wait for $136. Goguma judged that a price difference of about 5% was not enough to rule out any entry at current levels. However, if subscription growth and cash generation both deteriorate, the position should not be held stubbornly on the grounds that “defensive stocks are safe.”
PANW and CrowdStrike: Platform strength, valuation pressure
Palo Alto Networks — Weighing the benefits of platform consolidation against acquisition costs
PANW's Q4 FY2026 revenue was $3.410 billion, up 34%, and next-generation security ARR rose 63% to $9.1 billion. However, growth also includes acquired businesses. It cannot all be described as organic growth in the existing business. The company said a large LLM customer switched from an incumbent provider to Chronosphere, contributing significantly to ARR. Such transferred contracts should not be treated as recurring demand every quarter. PANW official earnings call remarks
Platform expansion aligns with customers’ demand to consolidate tools. But growing revenue is not the same as increasing the cash available to each existing share. There is a wide gap between quarterly GAAP operating income of $172 million and adjusted operating income of $1.011 billion. Stock-based compensation and related payroll taxes totaled about $487 million. It is easy to justify the price based on adjusted earnings alone if you do not also account for acquisition integration, stock-based compensation, and additional cash spent on acquisitions.PANW earnings supplement · PANW 10-K
$347.25 is about 83.2 times the FY2027 adjusted EPS midpoint of $4.175. The new initial review price of $271 applies a 65-times multiple. We recognize the quality of the platform and the results from paid AI security offerings, but believe there needs to be more room for organic growth and per-share cash flow after acquisitions. We did not split the difference by averaging in Peanut’s $300 price. A lower price is not a reason to buy if the growth assumptions fail.
CrowdStrike — The business is growing, but so are expectations you have to pay for
The company’s FY2027 second-quarter revenue rose 26% to $1.471 billion, while ARR grew 25% to $5.84 billion. New ARR growth was also solid. The industry thesis remains valid: the need to secure AI agents’ endpoints and execution environments is growing.
However, GAAP operating loss was $33.2 million, while stock-based compensation and related payroll taxes totaled about $399 million, compared with conventional FCF of $377.4 million. Stock-based compensation may not require an immediate cash outlay, but it can affect existing shareholders’ ownership and future share repurchases. We do not treat FCF minus SBC as official earnings, but neither do we ignore that cost.CrowdStrike official Q2 results
At $239.34 per share after the split, the stock trades at about 190.7 times the FY2027 adjusted EPS midpoint of $1.255. Much of the high growth rate is already reflected in the price. The partnership with NVIDIA is good news, but it does not erase the burden of this multiple before the deal’s scale and per-share profitability are confirmed. We are holding off on chasing the stock with new purchases. Existing holders should decide whether to maintain their positions based on customer retention, new ARR, cash conversion, and their actual risk tolerance.CrowdStrike earnings and outlook materials
CRWD’s shares outstanding on the specific date of September 8 differ from the diluted weighted-average share count used to calculate annual EPS. We did not treat the resale registration of shares already issued as acquisition consideration as new company fundraising.CRWD S-3ASR
Zscaler and the other candidates: same security sector, different cash quality
Zscaler — Distinguishing slower growth from investment spending
Zscaler’s FY2026 fourth-quarter revenue rose 25% to $898.2 million. Total ARR also grew 25%, but growth was 20% excluding acquired Red Canary. This does not mean growth has stopped. However, valuation should be assessed based on the pace excluding acquisition effects.
In the same quarter, operating cash flow was $279.3 million, while FCF fell to $60.8 million. This was driven by a significant increase in $218.5 million of capital expenditures and spending on internal-use software. It would be wrong to simply conclude that “the business has collapsed,” but we need to see whether the cash invested is recovered through future revenue and earnings. Quarterly stock-based compensation was $211.6 million, about 23.6% of revenue.Zscaler official financial materials
At the October 6 investor event, the company reaffirmed its existing outlook; it did not raise it anew on October 21. At $231.33, the stock trades at about 47.4 times the midpoint of FY2027 adjusted EPS guidance of $4.88. Goguma Team’s initial review price of $195 applied a 40x multiple, below Carrot’s $204.96 and Peanut’s $200. Goguma concluded that a larger margin of safety was needed given growth excluding acquisitions, high stock-based compensation, and investment payback risks. Even if the price falls, we will not force a buy if organic growth and cash conversion have deteriorated.Zscaler reaffirms October 6 outlook
Not every comparable stock makes the buy list
| Stock · Closing price | Potential investment merits | Why we are not adopting it now |
|---|---|---|
| Okta · OKTA $208.64 (+7.54%) | Identity security, Q2 revenue +11%, cRPO +14%, and conventional FCF of $227 million. | Hold off on chasing the sharp gain today. cRPO, the value of contracts expected to be recognized as revenue within 12 months, should not be translated directly into accelerated revenue in the next quarter. |
| Cloudflare · NET $307.22 (+5.32%) | Revenue +36%, combining networking and developer platforms with security. | Hold off on a new position. The stock trades at about 244.8 times adjusted EPS guidance. Not all revenue is pure-play security revenue, and margins, investment needs, and dilution are significant concerns. |
| Tenable · TENB $40.67 (+4.34%) | Exposure management, an adjusted EPS multiple of about 20.6x, and cash generation. | Excluded from preferred buys; keep it on the watchlist as a lower-priority name. Considering conventional FCF, stock-based compensation, and cash and share count after refinancing, it is difficult to conclude that a low adjusted multiple alone makes the stock cheap. |
| SentinelOne · S $22.77 (+3.50%) | Revenue growth of +21% and ARR growth of +22%. | Hold off on a new position. Stock-based compensation was about 31.5% of revenue in FY2027 Q2, while conventional FCF was −$13.2 million in the same quarter. These figures alone do not establish an immediate liquidity crisis. |
Financial figures are from each company’s latest reported quarter and do not cover the same fiscal year or quarter-end. All closing prices are from the U.S. regular session on October 21.Okta earnings · Cloudflare Q2 earnings · Tenable earnings · SentinelOne Q2 earnings
Why we did not simply adopt the majority view on Tenable
The debate’s four roles leaned toward the possibility of a limited initial purchase of TENB. Goguma did not adopt the preferred-buy recommendation. Q2 conventional FCF was $39.2 million, compared with $46.3 million in stock-based compensation. The $45.3 million of unlevered FCF presented by the company also adds back cash interest and financing costs. It should not be treated as cash that remains entirely available to shareholders. The simple market-cap yield implied by the annual conventional FCF outlook is around 6%, depending on share-count assumptions, but this is not a guaranteed return that accounts for the economic cost of stock-based compensation.Tenable cash flow definitions and outlook
In September, the final $800 million convertible note offering, repayment of existing loans, and share repurchase were completed. Accordingly, we did not combine cash at the end of June with the July share count to produce a supposedly precise current enterprise value. The $400 million revolving credit facility secured in October was initially undrawn, so we do not add it as debt already borrowed. The company was not excluded solely because an exact current share count was unavailable.Given low accounting earnings and the cost of stock-based compensation, we are not sufficiently convinced that the potential reward for taking on the risk at the current price is large enough. Tenable announces completion of note offering · Revolving credit facility announcement
How were the review prices calculated?
The multiples below are not the market’s definitive answer or an optimal buy price proven by statistical analysis. The team applies a multiple it is willing to accept to each company’s annual adjusted EPS guidance as a form of price discipline. The forecasts cover different fiscal periods, so they should not all be ranked as if they were estimates for the same next 12 months of EPS. Adjusted EPS excludes expenses such as stock-based compensation, so GAAP earnings, conventional FCF, and dilution should be evaluated separately.
| Company | EPS forecast and period used | Assumptions and calculation | Current price and initial review price |
|---|---|---|---|
| FTNT | Adjusted $3.41–$3.47 Year ending December 2026 | Midpoint 3.44 × 45 = $154.80 → $155 | $174.05 → $155.00 (−10.94%) |
| ZS | Adjusted $4.86–$4.90 Year ending July 2027 | Midpoint 4.88 × 40 = $195.20 → $195 | $231.33 → $195.00 (−15.70%) |
| PANW | Adjusted $4.16–$4.19 Year ending July 2027 | Midpoint 4.175 × 65 = $271.375 → $271 | $347.25 → $271.00 (−21.96%) |
| CHKP | GAAP arithmetic estimate $7.30–$8.10 Year ending December 2026 | $143.43 ÷ midpoint 7.70 = approximately 18.63×. Assess earnings and cash flow risks together. | Consider an initial position at $143.43 (0.00%) |
Company guidance is a forecast made at the time it was announced, not a guarantee of achievement. CHKP's GAAP EPS is an arithmetic estimate derived by subtracting the company-provided $2.75 difference from its adjusted EPS guidance of $10.05–$10.85. The initial review prices are rounded to whole dollars so that decimal precision is not mistaken for valuation accuracy.
What to do if prices fall
**If FTNT reaches $155, ZS $195, or PANW $271, review the investment assumptions at that time and decide whether to enter.**Do not lower the review price just because the stock has fallen, or wait for a new high just because it has rebounded. If the revenue and earnings outlook and cash flow assumptions remain intact, and the investment is affordable, consider initiating a position. Conversely, if the price has fallen because earnings expectations were cut, do not use the old EPS estimate and call the stock undervalued.
The stocks could continue to rise from their current prices. In that case, waiting would mean missing out on potential returns. We acknowledge that cost. But we set these prices to avoid taking the same risk as the “buy a good company at any price” approach. We are not claiming this is an excess-return strategy validated by historical performance simulations.
Set separate conditions for reducing holdings
Existing holdings may be reassessed and reduced if the loss of major customers or a slowdown in organic growth is reflected in the outlook; if heavy investment continues while cash generation worsens; or if stock-based compensation or acquisitions cause per-share value growth to lag significantly behind company growth. A substantial and widening gap between the share price and per-share value calculated using conservative assumptions is also a value-based reason to reduce holdings. If actual funding needs or concentration risk exceed manageable levels, reduce exposure regardless of the company's outlook. Do not apply the same stop-loss percentage to every company.
**A waiting price is not a promise to “buy no matter what” when it is reached.**Instead, it is a guideline to review the existing assumptions and make a decision when the price is reached, rather than putting it off. Do not keep moving the buy threshold when the assumptions remain unchanged.
Evidence that would change the conclusion at the next earnings report
An earnings announcement is not just an occasion to check revenue growth. It is a chance to see whether new contracts are increasing even excluding acquisition effects, whether the gap between accounting earnings and cash is narrowing, and how much the share count is growing in exchange for that growth. In particular, distinguish AI collaboration announcements that translate into paid contracts and customer expansion from those that do not.
| Confirmed earnings calls | Korea time | Key factors that could change this assessment |
|---|---|---|
| Fortinet · October 28 16:30 EDT | October 29 05:30 KST | Demand for product replacements, services growth, annual EPS, and conventional FCF. If both weaken, the $155 assumption may also need to be lowered. |
| Tenable · October 28 16:30 EDT | October 29 05:30 KST | After the refinancing, review cash, debt, and actual share count, along with conventional FCF and SBC. Reassess the lower-priority rating if per-share cash improvement is confirmed. |
| Check Point · Nov 2 08:30 EST | Nov 2 22:30 KST | Sustained subscription growth and cash flow recovery. Determine whether buybacks alone are supporting EPS. |
| Cloudflare · Nov 5 17:00 EST | Nov 6 07:00 KST | Growth and margins, cash recovery after AI infrastructure investment, and subsequent financing transactions. |
These are call times confirmed by the companies and may differ from the release times of earnings press releases. The end of U.S. daylight saving time in November is reflected. The next official announcement dates for PANW·CRWD·ZS·OKTA could not be confirmed in this research, so no estimated dates were added to the calendar.FTNT schedule · TENB schedule · CHKP schedule · NET schedule
Goguma Team’s final picks
Onion’s thesis that AI security demand will expand was reflected in the industry outlook. Acorn’s cautions about acquisition effects, fiscal periods, and valuation-multiple comparisons, along with Carrot’s review of dilution, cash, and risk limits, were reflected in our price discipline for each stock. Peanut argued for waiting for lower prices for CHKP·TENB, and proposed higher initial review prices than Goguma adopted for FTNT·ZS·PANW. Rather than averaging different prices, we assessed the growth and cash-flow quality needed to justify them.
As a result, CHKP is the current portfolio candidate, while FTNT is the top growth-oriented candidate to wait for at a better price. Reassess assumptions for ZS and PANW at $195 and $271, respectively. CRWD and NET have industry tailwinds, but we would not chase them at current prices. TENB is not a top buy solely on the basis of its lower adjusted multiple. For existing holdings, decide separately whether to hold or trim based on whether the business outlook, per-share value, and funding risks remain sound.
Security is likely to become more important as AI grows. But if that importance is already more than fully reflected in share prices, or the value flows to employee compensation and acquisition costs, shareholder returns may fall short of expectations. The key to this investment is not predicting the future of AI security, but deciding how much to pay for its future cash flows.
Data as of: Research conducted on the morning of Oct 22, 2026; share prices are the U.S. regular-session closing prices on Oct 21. Company earnings follow the fiscal periods specified in each section. We cross-checked company announcements, SEC filings, IANS research, and raw market data, and the four roles held three rounds of independent and shared discussion. Some Gemini calls timed out and were replaced with independent Codex analysis; Claude Opus participated in every round. Current EV was not finalized for companies whose latest changes in shares outstanding and cash could not all be confirmed. All views are conditional opinions based on public information and do not guarantee investment returns.
Comments 0
to comment Login