Bernstein Cuts PANW, OKTA, SentinelOne, Lifts Targets

Bernstein downgrades three cybersecurity leaders to Market Perform from Outperform after a near-100% sector rally stretches valuations to fair value, even as price targets move higher.

Lead

Bernstein on Wednesday cut Palo Alto Networks (PANW), Okta (OKTA), and SentinelOne (S) to Market Perform from Outperform, arguing that a near-100% rally across the cybersecurity sector since early 2026 has lifted most names in the group to or above their estimated fair value. In a move that crystallized the paradox defining the sector's current moment, the firm simultaneously raised price targets on all three -- PANW to $351 from $253, OKTA to $174 from $143, and SentinelOne to $25 from $21 -- signaling upgraded long-run fundamentals even as it withdrew its near-term conviction. The triple-cut triggered a sharp morning reversal in names that had been among the primary beneficiaries of the AI-safety rotation sweeping software markets through the summer.

Why Did Bernstein Raise Targets While Cutting Ratings?

The simultaneous target increase and rating cut reflects a recalibration of Bernstein's industry valuation model rather than a retreat on the fundamental thesis. The firm revised its fair-value estimates upward to account for accelerating AI-driven security demand -- mid-2026 CISO survey data showed 43% of respondents expected cyber budgets to outpace overall IT spending, versus just 20% expecting IT to lead. That revision raised the firm's valuation anchors across the coverage universe, but also revealed that the stocks had largely pre-empted the upgrade. Palo Alto Networks was trading near $375 in Wednesday's morning session, comfortably above the freshly raised $351 target, making the effective signal a mild caution rather than a neutral hold. The raise-and-cut structure communicates that the fundamental outlook improved but that the market moved faster.

What Does This Mean for AI Stocks in the Cybersecurity Sector?

The action lands after one of the fastest sector re-ratings in recent memory. Cybersecurity names surged through the summer as enterprises responded to an expanding wave of AI-enabled threats and elevated regulatory scrutiny of AI system integrity. In the single week ending September 14, CrowdStrike (CRWD) and Zscaler gained 12% apiece while Palo Alto rallied 11%, extending a trend running since January. Combined gains across Bernstein's cybersecurity coverage approached or exceeded 100%, compressing the discount to fair value that had initially attracted institutional accumulation.

Bernstein's note stresses that the structural AI demand story remains intact. Gartner projects a 68.7% increase in AI-related security spend from 2026 to 2027, with cloud security, identity, and endpoint protection ranking as top enterprise budget priorities. Software emerged as the biggest beneficiary in recent IT budget surveys. The concern is sequencing: robust fundamentals have arrived, and so have the investors who positioned for them months in advance.

Crowding Scores and the Valuation Ceiling

A secondary rationale in Bernstein's report is crowding. As the AI-safety rotation attracted institutional capital across the summer, concentration metrics for the cybersecurity basket climbed markedly. Elevated crowding scores raise the risk of amplified drawdowns on any negative catalyst -- a disappointing earnings print, a macro turn, or competitive disruption from AI-native security entrants that bypass incumbent platform economics. That dynamic weighs against the risk-reward of entering new positions at current levels, even for investors who accept the long-run growth case.

The firm does not apply the same valuation discipline universally. Zscaler retains an Outperform, identified as the sole remaining name in Bernstein's coverage offering what the report characterizes as relatively significant upside potential after the sector-wide compression. CrowdStrike was not included in Wednesday's rating action, leaving its standing unchanged.

Market Reaction

The three downgraded names reversed sharply on the open. Palo Alto, which had touched $383 intraday earlier in the session, pulled back as the Bernstein note circulated, with Okta and SentinelOne following in lockstep. The moves illustrated a familiar dynamic in concentrated sector rallies: a price-discipline call from a high-conviction house accelerates profit-taking even when the underlying growth thesis commands wide acceptance. Broader software indices and the Nasdaq retreated in sympathy through the morning.

Outlook

The Bernstein action does not mark a bearish turn on cybersecurity demand. AI is generating a genuine and measurable step-up in enterprise security requirements, and budget data supports continued spending growth through at least 2027. The downgrade is, in effect, a price-discipline call: PANW, OKTA, and S were attractively valued relative to fair value six months ago -- they are not today. Restoration of Outperform status for the trio likely requires either a pullback sufficient to reopen the valuation gap or a meaningful upward revision to earnings power, conditions not currently embedded in Bernstein's model. Zscaler remains the desk's preferred instrument for investors seeking direct cybersecurity exposure at the current market juncture.