UBS Research Analysis: Cybersecurity Valuations Exceed Pandemic Peaks, Q3 Earnings Must Beat Expectations

By Rita

UBS Group found that cybersecurity stocks have surged spectacularly since April, with valuations exceeding pandemic-era peaks. In its US Software report released on September 28, 2026, UBS noted that the sector's current market-cap-weighted enterprise value to 12-month forward free cash flow stands at 62x, and enterprise value to 12-month forward revenue at 15x, both higher than pandemic peaks. Expectations have been lifted by heightened market attention to AI security incidents, but fundamentals have not accelerated correspondingly, meaning Q3 earnings need to significantly beat estimates to support current valuations.

UBS analyst Roger Boyd pointed out that excluding CrowdStrike (CRWD), Fortinet (FTNT), Palo Alto Networks (PANW), and Qualys (QLYS), most vendors saw no acceleration in Q2 revenue and billings growth, with Q3 guidance remaining broadly flat. Since the release of Mythos on April 7, cybersecurity stocks excluding these four have risen by an average of 62%. UBS believes that even a minor miss in Q3 results from CRWD or PANW could spill over and impact the entire sector.

Cybersecurity Valuations Have Exceeded Pandemic Peaks

Cybersecurity stock valuations have surpassed pandemic-era peaks. The current market-cap-weighted enterprise value to 12-month forward free cash flow stands at 62x, and enterprise value to 12-month forward revenue at 15x, compared to 59.1x and 14.9x during the COVID period. Market expectations for strong Q3 earnings, an expanding competitive narrative around frontier labs, and increasing AI security-related headlines are expected to drive greater sector volatility through year-end.

UBS noted that cybersecurity stocks underperformed the broader software index in the first four months of 2026, as frontier labs launched dedicated network models, vulnerability discovery systems, code security products, and agent defense frameworks, seemingly competing with established vendors. Since April, frontier labs have rolled out controlled access programs alongside cybersecurity vendors, while the AI threat landscape continues to evolve; cybersecurity stocks have doubled, outperforming the software index. Yet, fundamentals remain relatively unchanged.

Fundamentals Have Not Yet Caught Up to Valuation Expansion

Q2 results were generally acceptable, but only a handful of companies achieved an acceleration in growth, with the majority of Q3 outlooks remaining flat. UBS customer and partner surveys indicate rising industry interest, but there is divergence on whether incremental capital will actually flow into the space. UBS observes that ex-CRWD, ex-PANW, and ex-FTNT stocks have averaged a 62% gain since April; if Q3 does not broadly beat estimates, it will reinforce the view that large platforms are capturing incremental AI security budgets. Conversely, even slight softness in CRWD's or PANW's Q3 results could dampen sector interest.

UBS outlines three key debates: Does Q3 require broader tailwinds? UBS believes it does. Are competitive concerns with frontier labs resurfacing? UBS believes that at minimum, frontier labs will continue to expand their cybersecurity capabilities. What role do infrastructure vendors play in AI security? UBS suggests that Microsoft's, ServiceNow's, and NVIDIA's entry may intensify the competitive debate.

AI Lab Competition Is Rising

Cybersecurity has become an increasingly prominent focus area for frontier labs in 2026. OpenAI has rolled out GPT-6 Astra (the first model designated as a "critical" level cybersecurity capability in the readiness framework v2), GPT-5.6 Sol, GPT-5.5 Cyber, the Daybreak Blue controlled access program, and more. Greg Brockman stated that OpenAI is applying Astra-tier capabilities to protect its internal infrastructure, and OpenAI DevDay 2026 (September 29) is the next venue likely to host further cyber-related announcements.

Anthropic has launched Claude Code Security, a preview of Claude Mythos, Project Glasswing, and the Cyber Verification Program, among others. Google has unveiled Big Sleep, Gemini 3.5/3.8 Flash Cyber, AVDH, and Fairwind (with over 650 partners). Microsoft AI introduced MAI-Cyber-1-Flash, MDASH, and Project Perception. Meta launched CyberSecEval. xAI rolled out Grok 4.7 and Grok for Security Teams. These products overlap more directly with existing cybersecurity stacks. Vulnerability discovery, code review, exploit reasoning, investigation, triage, detection engineering, prioritization, and remediation are increasingly being handled by frontier or network-dedicated models.

Infrastructure Vendors Enter the Security Stack

In July, NVIDIA launched the Open Secure AI Alliance with over 35 technology and cybersecurity partners. ServiceNow is rapidly expanding its cybersecurity business through acquisitions such as Armis and Veza. Microsoft continues to grow its AI security suite, while NVIDIA is swiftly building an AI security platform via OpenShell and Sentry. NVIDIA subsequently unveiled its own security platform, including OpenShell (an open-source secure runtime for AI agents) and Sentry (DPU-based real-time segmentation and response). At launch, OpenShell integrated with CrowdStrike, Palo Alto Networks, Cisco, and JFrog. It is designed to place policy enforcement, sandboxing, and access control outside the agent reasoning loop, creating a security layer that the models themselves cannot bypass. Multiple customers have described using OpenShell or other open-source frameworks to build or customize secure multi-agent environments.

UBS points out that historically, infrastructure vendors adding security capabilities has rarely yielded strong results, but given the scale perceived by the market, the competitive narrative is intensifying. Model capabilities and enterprise security ownership remain distinct. Models can identify vulnerabilities, investigate alerts, and recommend actions, but they cannot independently own enterprise telemetry, identity systems, policy infrastructure, enforcement points, or operational liability. UBS believes a more relevant distinction lies between security analytics and security controls. Frontier labs will continue to focus on security analytics, with limited capabilities in executing runtime security. Vendors whose primary value proposition is analytics face mounting pressure.

Enterprise Governance Needs Drive Security Budgets

Comments from frontier lab leadership about "slowing down the frontier" have made customers more cautious, yet UBS research shows enterprises have not widely slowed their AI adoption. Instead, customers are increasing their focus on sandboxing, observability, authorization, model selection, agent monitoring, and data governance, while continuing to deploy AI. Multiple surveys indicate that AI security is increasingly being budgeted alongside AI deployment rather than as standalone initiatives.

Customers state that more powerful models create additional governance demands rather than reducing security spend. Customers are increasingly highlighting agent identity, authorization, data protection, observability, and human-in-the-loop controls as new focal points, while continuing to leverage AI for security operations. Partners note that identity security is the top priority, followed by governance, as well as extended data security posture management, data loss prevention, and data access governance. UBS expects investment to increase across these areas.

UBS's portfolio allocation recommendations for the cybersecurity sector focus on three key themes. First, valuations have already exceeded pandemic peaks, requiring Q3 earnings to significantly beat estimates to justify current levels. Second, the competitive narrative involving frontier labs and infrastructure vendors may resurface, putting pressure on analytics-led vendors. Third, enterprise governance needs are driving a convergence of security budgets with AI deployment, benefiting identity, governance, and data security segments.

Disclaimer

This article is a compilation and interpretation by TechFlow Research of a third-party brokerage research report (UBS Group, September 28, 2026), combined with organized public market information. The ratings, target prices, earnings forecasts, and related judgments cited herein represent the views of the brokerage's analysts, reflect only the stance of their respective institutions, do not constitute the opinions of TechFlow Research, and should not be construed as any investment advice.

The market involves risks, and decisions must be made independently. This article should not serve as the basis for buying or selling any securities.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps