Faster attacks are driving more automation and intelligence sharing in security operations. Morgan Stanley believes in-house capabilities will complement vendor tools, but whether tool consolidation can lead to greater customer spending remains an open question.
Patch management and infrastructure refreshes support third-quarter demand, giving established vendors an opportunity to upsell existing customers. But Fortinet’s channel performance is mixed, while Qualys’s acceleration benefits from an easier comparison base, making near-term earnings opportunities distinct from the long-term growth outlook.
Morgan Stanley’s third-quarter channel survey shows that resellers’ average growth expectation for their security businesses in 2026 rose to 13%. Legacy system upgrades and AI budgets both support demand, but advance firewall purchases, the timing of AI protection spending and divergent vendor performance limit the case for a broad acceleration.
The disclosure of vulnerabilities in PHP’s underlying software before patches were released highlights the risk that enterprises’ remediation will lag attacks. Morgan Stanley sees the near-term opportunity concentrated in web application firewalls, while broader spending momentum in 2026 will come from legacy-system upgrades and the use of AI to improve security efficiency; however, the sector’s earlier gains had already outpaced expectations for earnings improvement.
