The cybersecurity sector has been on a tear in 2026, with investors betting that businesses will boost their security spending to defend against AI-driven threats. The S&P Kensho Cybersecurity Index has climbed 41% this year, compared to an 11% gain for the S&P 500. However, the most popular picks among investors—cloud security provider CrowdStrike Holdings Inc (NASDAQ: CRWD) and identity management specialist Okta Inc (NASDAQ: OKTA)—have seen their valuations surge to elevated levels, a development that warrants caution for those eyeing this space.

So far, there is little evidence that fresh worries about AI security have translated into stronger revenue growth for these two companies. Citigroup equity analyst Fatima Boolani, who covers cybersecurity names including CrowdStrike and Okta, noted that current valuations in the sector have reached "jaw-dropping levels." Even though AI adoption brings new types of cyber threats and creates potential for business expansion, the "attractiveness" of these stocks has "diminished considerably."

Take CrowdStrike as an example. Its shares are up 103% year-to-date. Data from S&P Global Market Intelligence shows that CrowdStrike's enterprise value is now 36 times its expected revenue for the next fiscal year, approaching the highest price-to-sales multiple since its public listing. But in the fiscal year ending in January, the company's revenue growth decelerated to 21.7% from 29.4% in the prior year. Growth is expected to recover modestly to 24.8% in the current fiscal year, before easing back to around 22% in fiscal 2028 and 2029. Such a growth trajectory makes it hard to justify the current valuation multiple.

By contrast, ServiceNow Inc (NYSE: NOW), traditionally known for enterprise workflow automation software—covering areas like HR and customer support—is also venturing into the security software arena. It has maintained a steady growth rate of 20%–22% over the years, with an expected 22.2% growth in the current fiscal year ending in December. Yet its price-to-sales multiple stands at just 8 times next year's projected revenue.

Turning to Okta, the company helps businesses verify employee identities and manage system access controls, placing it in one of the hottest segments of cybersecurity. The driving force behind this momentum is the proliferation of AI agents, which can perform tasks on behalf of users without requiring individual approval at each step. Okta has just introduced a new product tailored for AI agent security. However, Okta's revenue growth slowed to just 11.8% in the fiscal year ending in January, with an expected 11.2% growth in the current fiscal year—slightly below Salesforce Inc (NYSE: CRM)'s projected 11.5%. Despite this, Okta trades at 9 times its expected revenue, a significant premium compared to Salesforce's multiple of under 5 times.

Granted, Okta expects its contracted revenue backlog to grow at a slightly faster pace of 14% next year, but that still does not suffice to support the current valuation. The median price-to-sales ratio in the software industry is 4 times, well below Okta's, while the median revenue growth rate for the industry over the next 12 months is 13%, which is higher than Okta's current pace. This suggests that even though the AI agent security tool suite—fully launched in April—looks promising on the surface, Okta's valuation is already running ahead of its actual AI-related performance.

Analysts at Bernstein wrote in a September 17 research note: "It is difficult to assess when the AI agent business will mature enough for scalable deployment, and hard to predict whether its commercialization returns will exceed our current models." The report described the company as part of a group of cybersecurity names whose "valuations have already fully priced in." The analysts added that the pricing model and market demand for Okta's AI security tools "remain unclear."

If AI brings such massive cyber threats, why aren't these companies growing revenue faster? Enterprise cybersecurity spending is indeed on the rise, but the space is crowded and competition is intensifying. Beyond established security vendors like CrowdStrike, Palo Alto Networks Inc (NASDAQ: PANW), and Okta, both Alphabet Inc (NASDAQ: GOOGL) and Microsoft Corp (NASDAQ: MSFT) boast substantial security product lines. For instance, Google acquired cybersecurity firm Mandiant in 2022 and purchased another security vendor, Wiz, in March of this year. Meanwhile, a wave of startups has emerged specifically to tackle security issues related to AI agents.

Moreover, AI labs such as OpenAI and Anthropic could potentially develop their own cybersecurity tools in the future. Currently, many security vendors, including CrowdStrike, build their AI products on top of the foundational large language models from OpenAI and Anthropic. KeyBanc Capital Markets analyst Eric Heath observed: "Large language models excel at reasoning over vast amounts of data; frontier model makers can build AI agents that reason, filter, and assess data, performing work that would otherwise require security analysts to investigate, analyze, and remediate manually."

Heath has tracked job postings from OpenAI and Anthropic and concluded that both companies' "ambitions in cybersecurity are greater than their current product lineup suggests." For vendors like CrowdStrike that rely on AI labs' models to develop products, there is a risk: if these AI labs raise prices, vendors will feel the squeeze directly. And if AI companies start selling directly to customers, they could undercut established security vendors with aggressive pricing. SentinelOne Inc (NYSE: S), a cybersecurity software firm, highlighted this risk explicitly in its August earnings report: "If new competitors introduce products or services that are similar or competitive to ours, we may be unable to achieve effective pricing optimization through adjustments, and may struggle to attract new customers under our existing pricing model."

Until investors gain clarity on just how disruptive frontier AI labs will be to the cybersecurity industry, continuing to pile into cybersecurity stocks at current valuations would merit a more cautious approach.