Morgan Stanley analyst Keith Weiss noted that cybersecurity remains a top spending priority for organizations globally.

Weiss noted longer-term tailwinds are intact as recent technological advancements (GenAI, Public Cloud) expand the attack surface area, creating new product opportunities for securing AI and leveraging AI to automate security operations.

In the near term, the analyst flagged risks investors might not fully appreciate heading into 2025.

Also Read: This Analyst Downgrades Upstart But Says SoFi Tech Could Become ‘American Express’ Of Fintech

While the spending environment is showing signs of stability post-US elections, budgets remain tight, with CIOs and CISOs looking to consolidate multiple vendors. Some of the most significant security players ( Palo Alto Networks, Inc (NASDAQ: PANW ) and CrowdStrike Holdings, Inc (NASDAQ: CRWD )) have only recently increased near-term discounting and “platformization” efforts to drive consolidation and accelerate share gains. This is likely to have a broader negative pricing impact in 2025.

The average security company derives ~7% of sales from the U.S. Public Sector. The Federal government spent over $20 billion annually on security products and services (+10% CAGR over the last 5 years), which has been a significant source of growth for security vendors in recent years.

With the incoming U.S. administration proposing substantial cuts to federal spending through initiatives like DOGE (Department of Government Efficiency) and recent reports of downsizing CISA (Cybersecurity and Infrastructure Security Agency), this could be a headwind to IT/security budgets next year.

After a significant rise in 2023, there are emerging signs that ransomware attacks may be peaking. Security stocks have outperformed broader software driven by multiple expansions on negative estimate revisions.

Current security valuations are above the broader software and longer-term average, reflecting improving future growth rates and a more balanced risk-reward.

Weiss sought idiosyncratic opportunities in companies with emerging product cycles, particularly those aligned with GenAI. This includes Cloudflare, Inc. (NYSE: NET ), which has a chance in Edge AI inference.

The analyst also favors Fortinet, Inc (NASDAQ: FTNT ) and Palo Alto Networks, given the network security refresh in the second half of fiscal 2025 and 2026. Turnaround stories such as Okta, Inc (NASDAQ: OKTA ) also commanded the analyst’s attention.

Weiss noted Fortinet as a multi-year positive revisions story with firewall refresh demand sustaining through 2027 and higher software attach rates driving stronger-for-longer recurring services growth from the refresh cycle.