Goldman Sachs rethinks what's next for cybersecurity stocks

There is a pattern in technology spending cycles that Goldman Sachs thinks is repeating right now, and investors who recognize it early tend to be rewarded.

When cloud infrastructure scaled between 2015 and 2020, security spending lagged by approximately 2 years before inflecting from less than 1% of infrastructure spend to more than 3%, according to a Goldman Sachs note shared with me at TheStreet.

Goldman's recent industry conversations suggest the AI enterprise cycle is following the same script, with the inflection expected in the second half of 2026 and into 2027.

The firm's conversations included callbacks specifically with Palo Alto Networks (PANW). 

And the timing of those conversations coincides with a Q3 fiscal 2026 earnings report that CEO Nikesh Arora called "a standout quarter" — one he believes represents a "watershed moment" for the entire cybersecurity industry.

PANW is up 45.56% year-to-date, according to Yahoo Finance. Goldman thinks the real move may still be ahead.

Goldman's core observation is that the AI security lag is about to close

The Goldman framework, outlined in the note shared with TheStreet, draws a direct parallel between the cloud security lag from 2015 to 2020 and the current AI enterprise cycle.

Also Read: More on Palo Alto Networks

In the cloud era, security spending took roughly 2 years to move from below 1% of infrastructure spend to above 3%. Goldman believes a similar 3%-5% benchmark is appropriate for AI security. And Palo Alto Networks itself made comments consistent with that framing, according to the note.

The lag is tied specifically to agentic enterprise adoption. As AI agents move from proof of concept to permanent production deployments, the security requirements become non-negotiable. 

More Wall Street:

• JPMorgan resets S&P 500 price target for the rest of 2026
• Vanguard challenges the S&P 500 as a one-stop strategy
• Goldman Sachs resets Broadcom stock forecast

Agentic containers become persistent rather than ephemeral. Consensus emerges on runtime security tools. Goldman expects this shift to begin moving the needle for enterprise security growth in the second half of 2026, with full acceleration into 2027.

"The latest advancements at the AI frontier have increased the level of urgency around cybersecurity, and redefined the shape of the industry for the coming years," said Palo Alto Networks Chairman and CEO Nikesh Arora on the Q3 earnings call.

Palo Alto Networks' Q3 results showed the inflection is already beginning

Palo Alto Networks reported fiscal third-quarter 2026 results on June 2:

• Total revenue of $3.0 billion, up 31% year over year
• Next-Generation Security Annual Recurring Revenue (ARR) of $8.1 billion, up 60% year over year
• Remaining performance obligations of $18.4 billion, up 36% year over year
• Adjusted free cash flow of $910 million, up from $578 million in the prior year period
• Trailing 12-month adjusted free cash flow margin of 38.5%, up 430 basis points year over year
• Non-GAAP diluted EPS of $0.85, up from $0.80
  Source: Palo Alto Networks Third Quarter 2026 Results

According to an earnings call transcript compiled by Investing.com, Arora framed the demand environment in terms that go beyond a single quarter.

"These results are materializing as AI fundamentally redefines the enterprise tech stack, elevating cybersecurity to a mission-critical priority for every organization," Arora said on the earnings call. 

He added that the events of Q3 "have increased the terminal value of the entire cybersecurity industry."

For Q4 fiscal 2026, Palo Alto guided for NGS ARR of $8.90 billion to $8.95 billion, representing a 59% to 60% year-over-year growth, and total revenue of $3.345 billion to $3.355 billion, up 32% year over year.

Bloomberg via Getty Images

The AI security architecture that makes PANW's platform critical

Chief Product and Technology Officer Lee Klarich described the AI security challenge on the earnings call in terms that explain why the inflection Goldman is forecasting is structural rather than cyclical.

AI security spans the entire deployment lifecycle. That’s from model scanning and AI red-teaming before deployment, through real-time runtime threat detection, to Security Operations Center integration. 

The speed requirement is the differentiating factor. Attackers using advanced AI models can carry out attacks from start to finish in minutes. Legacy security architectures with mean time to detection measured in days simply cannot respond.

Related: Cramer flags 2 major winners from AI 'game changer' Mythos

Palo Alto's XSIAM platform, which is designed to ingest data from all sensors, analyze it in real time using AI, and apply automated response, is built for this environment. 

Klarich said proving to customers that XSIAM can achieve mean time to resolution in minutes is "a very powerful proof point" driving platform consolidation.

Arora added that north of 1,200 customers have requested meetings, with 800 already completed in the last six weeks alone. That is a demand signal that is difficult to manufacture.

For investors, Goldman's framework suggests the best of PANW's AI security cycle is still in front of it. The lag is closing. The platform is proven. The urgency is real.

Related: Morgan Stanley resets PANW stock price target on demand trends