Why worry about 2027 while favoring third-quarter performance?

  • Morgan Stanley’s channel checks show that willingness to spend on cybersecurity accelerated further in the third quarter compared with the second. Companies are prioritizing technical debt and patching vulnerabilities, making it easier for vendors with established customer bases to upsell.
  • Investors have grown cautious as firewall vendors face tougher comparisons and competition in vulnerability management intensifies. The bank believes improving demand alongside bearish positioning could make third-quarter earnings beats trigger short covering. It favors Fortinet and Qualys more in the near term, is neutral on Tenable and more cautious on Check Point and Rapid7; any sustained rally is constrained by growth conditions in 2027.

Can Fortinet turn hardware refreshes into more software revenue?

  • Equipment refreshes, network segmentation and demand for high performance continue to support firewall sales. Partner feedback included two orders, each a two-year contract worth 10 million–12 million dollars in total; Morgan Stanley expects products to remain the main source of a third-quarter earnings beat.
  • Customer acceptance and deployment speed for FortiSASE have improved, and bundled sales with firewalls have strengthened. The share of resellers for whom SASE accounts for more than 15% of their Fortinet business rose from 19% in the second quarter to 36%, supporting growth beyond hardware.
  • Overall channel performance, however, is becoming more mixed: the share of resellers exceeding business targets fell from 44% to 36%, while the share missing targets rose from 15% to 27%. Improving software feedback coexists with a weakening overall channel, constraining the case for a broad acceleration in recurring revenue.

How much of Qualys’s growth acceleration comes from an easier comparison base?

  • The year-over-year comparison base in the third quarter is about 6 percentage points easier than in the prior quarter. Adjusting for the average earnings beat over the past four quarters, Morgan Stanley estimates revenue could grow approximately 11.5% year over year, above the actual 9.8% in the second quarter; however, this scenario requires slightly stronger sequential performance than the previous trajectory, and the growth rate in its formal model remains 9.8%.
  • Sustainability depends on whether second-half billings can exceed the company’s growth guidance of 7%–8%. ETM add-on sales raise the average deal size by 7%–9%, but about nine-tenths of business comes from existing customers, with a limited contribution from new customers.
  • Patch management remains a capability valued by large, complex customers, while automation and self-remediation technologies could gradually erode differentiation. The bank therefore favors the near-term earnings outlook while maintaining its underweight rating.

Why are billings more important than current-quarter revenue for Tenable?

  • Revenue recognition lags changes in the business, while billings and current remaining performance obligations provide a more timely reflection of demand. Morgan Stanley forecasts third-quarter current billings of 287.1 million dollars, up 7.3% year over year; management previously said its second-half billings expectation was 8 million–10 million dollars higher than initially expected.
  • U.S. federal business accounts for about 15%, with deals concentrated in the third quarter. The key is whether second-quarter momentum in operational technology business and new certifications can translate into orders. Tenable One adoption has improved, but about 85% of business comes from existing customers; the bank remains neutral, and a higher valuation requires revenue to stabilize and reaccelerate.

Why is the same optimism harder to extend to Check Point and Rapid7?

  • Check Point’s partner business is still growing at a mid-single-digit rate, while its ability to acquire new customers and compete in network transformation is constrained. Morgan Stanley expects third-quarter revenue of approximately 670 million dollars, down about 1% year over year, close to the midpoint of company guidance and market consensus; strengths in email and cloud security are not yet enough to change the overall growth rate.
  • Rapid7’s total annual recurring revenue fell about 2% year over year in the second quarter. After a 12% workforce reduction, its 2026 non-GAAP operating profit guidance was raised significantly, but cash severance costs offset near-term savings, and free cash flow guidance remains approximately 130 million dollars. Cost improvement and a sales recovery are two separate hurdles.