Palo Alto Networks and CrowdStrike Up 89% and 106% in 2026: Inside the Cybersecurity Rally

Shares in Palo Alto Networks and CrowdStrike have risen 89% and 106% respectively since the end of 2025, even after both fell by more than a tenth from the records they set on 6 October. The rally has been driven less by any single contract than by a change in how investors think about artificial intelligence: a technology that in February looked like a threat to security software has become its biggest source of demand.

Palo Alto Networks closed at $348.04 on 4 November, against $184.20 at the end of last year. CrowdStrike closed at $241.00, up from a split-adjusted $117.19, after a four-for-one stock split that took effect on 2 July. Both stocks peaked on 6 October, at $419.91 and $278.86 respectively, and have since given back 17% and 14%.

A year that began with a sell-off

The scale of the gains is more striking given how 2026 started. On 17 February, Palo Alto Networks reported fiscal second-quarter revenue of $2.59bn, up 15%, but guided third-quarter earnings below Wall Street estimates. Its shares fell 7%, leaving them down 11% for the year at that point, according to CNBC.

Worse followed. On 23 February, cybersecurity stocks fell for a second day after Anthropic released Claude Code Security, a tool that scans code for vulnerabilities, in a limited preview. CrowdStrike and Zscaler lost about 10% each and Palo Alto Networks about 3%, as investors extended to security the fear that AI would displace software business models. Salesforce had already lost about a third of its value since the start of the year, and ServiceNow more than 34%.

The sector's chief executives pushed back. George Kurtz of CrowdStrike wrote that a code-scanning capability did not replace a security platform, and Nikesh Arora of Palo Alto Networks said he was confused by the idea that AI threatened cybersecurity, because customers wanted more of it. Bank of America analysts argued the tool mainly threatened code-scanning specialists. At their lows earlier this year, Palo Alto Networks traded at $139.57 and CrowdStrike at a split-adjusted $85.68.

The Mythos moment

The turn came on 7 April, when Anthropic disclosed Claude Mythos, a model it said it would not release publicly because of its ability to find software vulnerabilities, and launched Project Glasswing, a programme giving a dozen launch partners access to use it for defensive work. CrowdStrike and Palo Alto Networks were both on the list, alongside Amazon Web Services, Apple, Google, Microsoft and Nvidia. Anthropic said the model had identified thousands of previously unknown flaws in critical software, and committed up to $100m in usage credits to the effort.

The practical effect was to shrink the time companies could assume they had to patch. Mozilla said it had fixed 271 Firefox vulnerabilities found with the model. The US Treasury and the Federal Reserve convened financial executives to discuss the implications. OpenAI followed on 11 May with Daybreak, its own programme for finding and fixing flaws, with both security vendors again among the early users.

For the two companies, the demand response was immediate. Arora said in June that more than 1,200 customers had contacted the company since Mythos and that it had held 800 meetings in six weeks. He described the so-called SaaSpocalypse for cyber as dead. Kurtz, presenting CrowdStrike's results for the quarter to 30 April, said the worlds of cybersecurity and frontier AI had collided, and called it the "Mythos moment".

The shares responded in kind. CrowdStrike rose 95% and Palo Alto Networks 113% between April and June, the best quarter on record for each, according to CNBC.

The numbers behind the rally

The second half brought the financial evidence. On 26 August, CrowdStrike reported second-quarter revenue of $1.47bn, up 26%, and record net new annual recurring revenue of $332.8m, up 51%. Ending ARR reached $5.84bn.

Falcon Flex, the licensing model that lets customers deploy and swap modules across the platform, more than doubled to over $2.29bn of ARR, with 935 accounts added in the quarter. The company raised full-year revenue guidance to between $5.99bn and $6.01bn, and its shares rose 11% in after-hours trading.

Palo Alto Networks followed on 1 September with fiscal fourth-quarter revenue of $3.41bn, up 34%, and next-generation security ARR of $9.10bn, up 63%. Full-year revenue was $11.48bn. Those figures include CyberArk, the identity security company it bought for about $25bn in a deal that closed on 11 February and has since been rebranded Idira, and Chronosphere, an observability business acquired for more than $3bn in January.

The company guided to fiscal 2027 revenue of $14.10bn to $14.20bn, growth of 23% to 24%, and Arora said AI was "elevating cybersecurity to the top of the CIO priority list". The stock nonetheless fell after the report, as investors weighed a GAAP net loss of $282m and the acquisition-related charges behind it.

Product news supported the narrative. At its Fal.Con conference in early September, CrowdStrike unveiled Falcon Guardian, which monitors and controls AI agents on the devices where they run, and an identity service that registers each agent in a single directory. Kurtz's line was that AI had not changed the attack but had changed its speed. Palo Alto Networks is positioning Idira for the growth in machine identities as agents multiply, a point BTIG made when it raised its targets in August, and has agreed to buy Koi, an Israeli start-up that secures AI agents.

BTIG wrote after the Black Hat conference that AI agents had fundamentally changed the threat landscape and that deployment of AI security tools was in its early innings. The sector then got an unexpected push on 14 September, when Anthropic's chief executive Dario Amodei published an essay calling on frontier labs to slow capability gains so that safeguards could catch up, and OpenAI's Sam Altman said he agreed. CrowdStrike jumped 12% and Palo Alto Networks 11% that day.

Why the shares have slipped since October

Both stocks closed at records on 6 October, the day BTIG raised its Palo Alto Networks target to $425. The pullback since has had several causes, none of them a set of company results.

On 14 October, reports that OpenAI was in early talks to acquire the security firm Trail of Bits knocked 4% off Palo Alto Networks and 3% off CrowdStrike, on the thought that the best-funded AI labs might compete with incumbents rather than partner with them. Arora had said on his most recent call that OpenAI, Anthropic and Google had all come to the table as partners.

Then on 28 October, Fortinet beat estimates but cut its full-year service revenue forecast to between $5.15bn and $5.17bn, from $5.18bn to $5.22bn. Its shares fell 20%, and Palo Alto Networks and CrowdStrike dropped 5% and 4% in sympathy. The next day a broader repricing of AI-linked technology stocks, triggered by Alphabet reporting negative free cash flow, took a further 3% to 4% off both.

Valuation is the underlying concern. At the September peak of the rally, 24/7 Wall St put CrowdStrike at 192 times forward earnings and Palo Alto Networks at 90 times. Bernstein analysts have warned that sector expectations have risen sharply and that post-earnings disappointments could recur if investors expect even more from Mythos and Glasswing.

Yet the demand data continue to improve. Citi analyst Fatima Boolani raised her targets on 15 October, to $295 for CrowdStrike and $440 for Palo Alto Networks, citing a survey of chief information officers showing security spending intentions improving as AI deployments spread. Evercore ISI's channel survey on 23 October found a strengthening budget outlook with no demand cliff ahead.

On 2 November, Deutsche Bank's Brad Zelnick upgraded CrowdStrike to buy with a $300 target, arguing that investors underappreciate how much AI could expand the market. The shares fell 3% anyway, a sign of how much profit-taking is competing with the fundamentals.

What to watch

The next tests are close. Palo Alto Networks reports fiscal first-quarter results on 18 November, having guided to revenue of $3.30bn to $3.31bn and next-generation security ARR of $9.54bn to $9.56bn. CrowdStrike reports on 1 December, with guidance for revenue of $1.523bn to $1.529bn and net new ARR of $343m to $347m, which would be another quarter of growth near 30%.

Beyond the numbers, the questions for the rest of the year are:

• Whether the pipeline of AI-driven deals converts into bookings at the pace both companies have implied, or whether the Mythos surge was a one-off.
• How the AI labs position themselves: as partners supplying models to the security platforms, or as competitors selling their own defensive tools.
• Whether the consolidation of spend onto a few platforms, the trend Arora calls platformisation, continues to favour the two largest vendors over smaller rivals such as Fortinet and Zscaler.
• How much of the premium multiple survives a market that is already questioning the returns on AI spending more broadly.

What is not in doubt is that 2026 has changed the sector's relationship with AI. A technology that in February was priced as a threat to security software has, nine months later, become the reason enterprises are spending more on it. The remaining argument is about the price.