Cybersecurity Stocks Are Tearing It Up. But Only One Passes the Valuation Gate

What more do investors want from cybersecurity? After a brutal first half of 2026 when the "SaaSpocalypse" narrative threatened to hollow out the entire software sector, the names that survived are now leading the comeback. Palo Alto Networks is up nearly 100% year-to-date. Cloudflare just ripped higher than 15% after a blockbuster Q2 beat. And Zscaler, after languishing down 25% for the year, has finally joined the party with a 21% monthly bounce.

The tailwind is undeniable. AI is expanding the attack surface in ways that enterprise CISOs can't ignore. CEO Nikesh Arora at Palo Alto described the trajectory of agentic AI as reaching "unprecedented autonomous execution" — capable of scanning environments, generating bespoke exploits, and orchestrating end-to-end campaigns at machine speed. JPMorgan Chase Private Bank projects global cybersecurity spending will hit $240 billion this year, with AI-related security spend growing three to four times faster than the broader industry.

But here's the question the Citrini Research headline doesn't answer: are these three stocks actually the same bet?

Looking at the numbers, they're not even close.

Palo Alto Networks: The Market's Favorite, Arguably Overpaid for It

PANW has been the poster child for this rally. The stock is up 117.9% over 120 days and 97.5% year-to-date, trading at $363 with a $296 billion market cap. The CyberArk acquisition closed in February, establishing identity security as a core pillar — and machine identities now outnumber human identities by more than 80 to 1, which is precisely the problem CyberArk's platform solves. The company topped Q3 estimates with $3 billion in revenue, up 31% year-over-year, and raised full-year guidance to $11.4 billion.

But when a stock has nearly doubled in four months, the market has arguably baked in extraordinary execution from here on out. PANW trades at 28 times trailing sales and a forward P/E of 261. Revenue growth of 19.5% is solid, not spectacular — and that 31% Q3 figure included $388 million from CyberArk and Chronosphere acquisitions. Yes, the FCF margin of 35.8% is the best in the group and operating margins are positive at 9.6%, making PANW the most profitable of the three. But the valuation assumes that platform consolidation plays out flawlessly, integration goes smoothly, and growth reaccelerates organically.

The moat is real. The platform strategy that consolidates network, cloud, endpoint, and identity security into a single ecosystem is durable under stress. But durable moats at 28x revenue, after a nearly 100% run, carry a different risk/reward equation than battered names.

Cloudflare: Growth at the Highest Cost

NET's Q2 results last Thursday were excellent. Revenue of $696.1 million, up 36% year-over-year, handily beat estimates. Non-GAAP EPS of $0.29, up 38%. Management raised full-year revenue guidance to $2.87 billion, implying roughly 32% annual growth. Current remaining performance obligations grew 35%, confirming contractual backing for that trajectory.

The agentic internet thesis — AI agents querying thousands of sites, creating exponential billable traffic for Cloudflare's edge infrastructure — is the kind of secular tailwind that justifies premium multiples. CEO Matthew Prince called it a "paradigm shift" toward machine-to-machine traffic. Record growth in paying customers, large enterprise deals, and developer adoption on the Workers platform suggest the story is working.

But NET trades at 42.6 times trailing sales, five times the multiple of Zscaler on a like-for-like basis. The stock has climbed 52% year-to-date and 53% over 120 days. Operating margin is still deeply negative at -9.3% on a GAAP basis, and even non-GAAP profitability hit only 13.8% in Q2. The $151 million restructuring charge tied to a 20% workforce reduction masks operational friction and signals that the AI-driven operating model is expensive and unproven. Gross margins compressed from 76.3% to 73.1%, pressured by a mix shift toward higher-compute, lower-margin developer products.

NET has the fastest growth. It also carries the highest execution risk, and the 42x revenue multiple demands perfection for years.

Zscaler: The Battered Name Trading Like the Thesis Is Broken

ZS has been the odd one out. Down 25% year-to-date. Down 37% over the trailing twelve months. The stock's 52-week high of $337 feels like another era, and the market appears to be treating it as a laggard in a sector that's supposed to be leading.

But the numbers don't scream disaster. Revenue growth of 24.6% year-over-year, consistent and respectable. Gross margins of 76.7%, the highest of the three. Free cash flow margins of 28%, up 28.8% year-over-year. The company just reported fiscal Q2 revenue of $815.8 million with EPS of $1.01, beating estimates of $0.89. ARR grew 25% to $3.36 billion. The balance sheet is clean: $982 million in cash, a current ratio of 186%, $890 million in trailing free cash flow.

And the stock trades at 8.6 times trailing sales. Five times cheaper than NET. Three times cheaper than PANW.

The zero-trust architecture ZS pioneered — securing every identity and connection rather than relying on network perimeter defense — is precisely what AI agents need. Nearly 90% of organizations have suffered an identity-centric breach. Credential abuse is the dominant threat vector. That's ZS's core competency. Yet the market still prices it as if the thesis is cracked.

The recent 21% monthly bounce suggests selling exhaustion. But the stock is still down a quarter for the year. The valuation disconnect relative to growth, profitability, and cash flow metrics is arguably the most underappreciated risk/reward setup in the entire cybersecurity sector.

Where the Risk/Reward Actually Sits

The three names are riding the same secular tailwind but priced for completely different futures. PANW is priced for flawless platform execution. NET is priced for the agentic internet thesis to play out without a stumble. ZS is priced for continued underperformance despite revenue growth and cash flow metrics that aren't materially different from the others.

Through a GARP lens — growth at a reasonable price — ZS is the only name that passes the gate. Revenue growing 24.6%, FCF margins of 28%, gross margins of 76.7%, and a valuation at 8.6x sales. This has the fingerprints of a stock that's been thrown out with the bathwater while the fundamentals tell a different story. The market's pessimism arguably went too far.

PANW is a high-conviction long-term story with a dominant moat, but at nearly 100% gains and 28x revenue, new money is better positioned on a pullback. NET has the most aggressive growth profile and the most interesting secular thesis, but 42x revenue for a company still operating at a GAAP loss is a bet, not an investment. The growth has to be flawless.

The Action

ZS: Upgrade to Buy. The valuation gap is real, the moat is intact under stress, and the recent momentum suggests the market is starting to recognize the disconnect. I don't think investors need to chase the rally — the better risk/reward is likely on a deeper pullback. But the setup is compelling, and investors awaiting a chance to double down shouldn't let this buying opportunity go to waste. I'd reassess if revenue growth drops below 20% or if the zero-trust narrative loses enterprise traction.

PANW: Hold, but don't chase. Existing holders can ride — the moat is durable and the earnings trajectory is strong. New buyers should wait for a clearer entry. The stock is up 117% in four months. That's not the time to be aggressive.

NET: Wait. Strong growth, interesting thesis, but the valuation demands perfection the market hasn't earned. A pullback to more reasonable multiples would be a different conversation.

The cybersecurity sector isn't going anywhere. AI is making it bigger, not smaller. But that doesn't mean every stock in the sector is the same opportunity. Some are priced for perfection. Some are priced for failure. And the difference between the two is where the real money is made.