Why could security budgets accelerate?

  • In the third-quarter survey, resellers’ average expectation for year-over-year growth in overall security business revenue in 2026 rose to 13%, above 11% in the second quarter and 10% in the first. The share expecting full-year growth above 15% also rose from 18% to 34%. This is an upward revision of the channel’s full-year business expectations.
  • Funding sources are broadening: 78% of respondents said customers fund AI security products from other AI budgets, up from 55% in the second quarter; the share relying on vendor consolidation to free up funds fell from 45% to 22%. Security spending is therefore receiving funding beyond the reallocation of existing spending, and legacy system upgrades are also an important driver.

How does the timing of the two AI security opportunities differ?

  • Morgan Stanley attributes the main drivers in 2026 to legacy system upgrades and the use of AI to improve security operations, such as security operations center automation. Spending to secure AI itself, including its data, applications and identities, is mainly expected in 2027.
  • The share of respondents expecting AI data security to be one of customers’ strongest spending areas over the next 12 months rose from 55% to 72%, while the share for AI application security rose from 28% to 41%. However, the share of resellers reporting that Microsoft Purview is currently outperforming plan fell from 62% to 44%, indicating a gap between rising future purchasing priorities and current sales performance.
  • There is also a timing split in AI agent identity security: the share saying customers have already invested rose from 33% to 38%, but the share expecting spending to begin only in 2027 or later also rose, from 23% to 41%.

Firewall demand is strong, so why is its durability still constrained?

  • 69% of respondents said customers were buying firewalls early in anticipation of price increases or supply constraints, up from 65% in the second quarter; the share purchasing more than two quarters ahead rose from 5% to 16%. On this basis, Morgan Stanley believes Fortinet, which has guided for a fourth-quarter slowdown, could deliver stronger-than-expected results.
  • Purchases brought forward also change the timing of demand. Among Fortinet resellers, the share whose customers are upgrading equipment fell from 33% to 18%, while the share whose customers plan to upgrade rose from 48% to 64%; the combined share was broadly unchanged. Planned demand remains substantial, but current upgrade activity has weakened.

Why does Morgan Stanley prefer PANW and CrowdStrike?

  • Evidence that PANW is benefiting from platform consolidation has strengthened: the share of respondents naming it the biggest beneficiary of consolidation rose from 45% to 56%; among its resellers, the share reporting year-over-year growth in AI security product sales rose from 72% to 93%. The bank maintains its top-pick assessment, but platform discounts remain significant, and the improvement in Prisma SASE’s above-plan performance has been accompanied by a narrower share of resellers reporting sales growth.
  • CrowdStrike’s incremental business comes more from existing customers buying additional modules: the share of resellers reporting next-generation SIEM performance above plan rose from 20% to 37%, and the share for exposure management rose from 26% to 33%; the share for its core endpoint detection and response product remained at 37%. This supports the bank’s positive view of its expansion potential beyond endpoint replacement.
  • Identity security vendors also diverged: the share of SailPoint resellers exceeding expectations rose from 38% to 60%, Okta was broadly stable, and CyberArk fell from 38% to 14%. The industry tailwind has not benefited every company evenly.

Can improvement in vulnerability management support a change in the long-term view?

  • The shares of Qualys and Rapid7 resellers meeting or exceeding expectations rose from 64% and 58% to 70% and 80%, respectively; Tenable’s rose from 73% to 82%, but the share exceeding expectations alone fell from 27% to 9%. The improvement mainly reflects more consistent achievement of plans, with weaker evidence of accelerating growth.
  • Morgan Stanley sees the most compelling near-term opportunity in Qualys but maintains its underweight rating: its core products already cover many existing customers, new customer growth is insufficient, and rising expenses are pressuring margins and free cash flow. This allows a near-term channel recovery and a cautious long-term view to coexist.