Analysis
CrowdStrike and Okta shares are trading at valuation premiums built substantially on the expectation that AI-agent security spending will materialize at scale, even though neither company has yet disclosed AI-specific revenue large enough to justify the re-rating on its own, according to The Information. CrowdStrike's price target now sits at $260, based on 36 times estimated calendar 2027 sales, up from 32 times previously; Okta's target of $200 reflects 11 times estimated 2027 enterprise value to sales, up from nine times.
Where The Re-Rating Actually Came From
The multiple expansion traces to specific product announcements at CrowdStrike's Fal.Con conference in early September: Guardian, a tool for detecting and responding to AI-agent activity, and SafeMind, a system meant to let security teams run frontier AI models safely inside their own environments. Bank of America analyst Tal Liani captured the underlying thesis: "Every AI agent ultimately requires authentication, authorization, monitoring, and heightened governance" -- a real structural argument for why agentic AI adoption should increase demand for identity and endpoint security products, but a thesis based on anticipated future spend rather than revenue CrowdStrike or Okta have actually booked from these specific products yet.
“Public-market investors are effectively pricing in a future product cycle before either company has reported a quarter that confirms it.”
A Sector-Wide Pattern, Not Two Isolated Stocks
This isn't unique to CrowdStrike and Okta individually -- the S&P Kensho cybersecurity index has returned 41% this year against 11% for the S&P 500, meaning the market is repricing the entire cybersecurity sector on the same AI-driven-demand thesis, roughly four times faster than the broader market has moved. That breadth makes the bet somewhat less company-specific and more of a sector-wide wager that AI-agent proliferation inside enterprises requires meaningfully more security spend across the board.
Why The Bear Case Is Real
The gap between valuation and disclosed AI revenue is the central risk: paying 36 times sales for CrowdStrike assumes AI-driven security demand converts into actual contracted revenue at a pace that matches the multiple expansion already priced in, and if enterprise AI-agent deployment slows -- following the token-cost and ROI-measurement challenges Pulse covered elsewhere this issue -- the security-spend thesis underlying both stocks' premiums could prove to have gotten ahead of itself. Public-market investors are effectively pricing in a future product cycle before either company has reported a quarter that confirms it.
What To Watch
CrowdStrike and Okta's next quarterly earnings reports, specifically whether either company breaks out AI-agent-security product revenue as a distinct line item, will be the first real test of whether this valuation premium reflects genuine demand or a narrative that's run ahead of the numbers.
