7 Cybersecurity Stocks Riding the AI Security Boom

• U.S. cybersecurity stocks jumped after warnings about erratic AI behavior. Palo Alto Networks rose 10.0% and Fortinet 8.8% in the September 11–18 trading week.
• Seven cybersecurity stocks now offer investors distinct ways to profit from protecting AI systems, with 2026 share-price returns ranging from a 13.9% loss to a 125.1% gain.
• A 125% stock rally does not settle which cybersecurity company is best positioned for 2027. Revenue, products, and the ability to win new AI security contracts tell a more interesting story.

UU.S. cybersecurity stocks jumped after Anthropic and OpenAI’s warnings about advanced AI behavior brought a familiar investor question into sharper focus: who gets paid to keep powerful AI agents under control? The Global X Cybersecurity ETF gained 10.7% from September 11 through September 18. Palo Alto Networks (NASDAQ: PANW) | PANW Price Predictionclimbed 10.0%, and Fortinet (NASDAQ: FTNT) gained 8.8%. Investors saw an immediate business opportunity in a risk that many companies are only beginning to understand. The stock gains came before any of these vendors reported a surge in revenue specifically attributable to protecting AI agents.

The catalyst was a series of reports and executive comments about AI systems acting outside expected boundaries in controlled tests. Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman argued for more caution as AI gains the ability to use tools and take actions. President Trump and Nvidia CEO Jensen Huang pushed back against slowing American development. Those tests do not establish that commercial AI systems are routinely escaping their controls. But put an agent in charge of writing code, opening financial records, or operating industrial software, and a mistake or malicious instruction becomes a security problem. Companies will need to set limits on what agents can do, detect violations, and stop a bad action before it spreads.

That prospect is why cybersecurity investors moved so quickly. The seven companies in Table 1 already sell security products to enterprises; each has a different route to an AI protection sale. Palo Alto Networks can test exposures and defend networks and clouds. Fortinet can enforce policies through its firewalls and network products. Cloudflare (NYSE: NET) can protect applications exposed to internet traffic. Tenable (NASDAQ: TENB) and Qualys (NASDAQ: QLYS)identify weaknesses, Rapid7 (NASDAQ: RPD) investigates threats, and Varonis (NASDAQ: VRNS) guards sensitive data. Investors now have to determine which of these companies can turn urgency into contracts and earnings. The stock returns show how differently the market has answered so far.

According to Table 1, quarterly revenue ranges from $180.0 million for Varonis to $3.41 billion for Palo Alto Networks. Fortinet leads in YTD share-price performance at 125.1%, followed by Palo Alto at 113.5%, while Rapid7 is down 13.9%. YTD means the change from the December 31, 2025 close through the September 23, 2026 close, excluding dividends. Revenue covers each company’s entire business, not just AI cybersecurity. Palo Alto’s latest fiscal quarter ended July 31; the other reported quarters ended June 30.

Table 1. Latest Quarter Revenue and 2026 YTD Share Performance

The table illustrates why the AI security theme cannot be treated as one trade. Fortinet’s 125.1% advance accompanies a large, profitable network-security business. Palo Alto’s 113.5% rise reflects investor confidence in a broad security platform. Tenable and Varonis have much smaller revenue bases, but their products address specific problems that AI agents make more urgent. Rapid7 shows the other side: enthusiasm for AI products has not been enough to offset weaker financial results and a negative YTD return. A rising market for security will not necessarily lift every stock.

Palo Alto Networks: The Broadest Route to AI Security Spending

Palo Alto Networks has an advantage that a new AI-security startup cannot easily reproduce. It already sells products that protect networks, cloud applications, and security operations to large organizations. A customer can add AI protection and testing through a vendor that is already part of its security budget. In September, Palo Alto introduced Unit 42 Continuous Frontier AI Defense, an annual subscription service that uses advanced AI models alongside its security expertise to keep testing customer systems for weaknesses. That is a clearer potential source of incremental spending than merely describing an existing product as AI-powered.

Its reported scale also stands apart. Revenue for the quarter ended July 31 reached $3.41 billion, up 34% from a year earlier. Next-generation security annual recurring revenue reached $9.10 billion, up 63%. The recurring-revenue number is not AI cybersecurity revenue; it covers a much broader group of products. It does, however, show how large a platform Palo Alto can use to introduce another service. A security team already relying on the company has a simpler purchasing decision than one evaluating an entirely new vendor for every emerging AI threat.

There are limits to the bullish case. Consolidating more security functions in one platform can make the company more valuable to a customer, but it also raises expectations that Palo Alto can integrate products well and deliver results across every area it claims to cover. Its share price has already risen 113.5% this year, so a good product announcement is less likely to impress investors if contracts and earnings do not follow. Palo Alto is a leading company in AI cybersecurity; that does not mean the stock is attractive at every price.

Fortinet: Strong Earnings Behind the AI Story

Fortinet gives investors a second large-scale route into the theme. Its firewalls already sit at the points where companies control traffic entering and leaving networks. As AI systems move into data centers and enterprise operations, customers may want faster inspection, policy enforcement, and protection around the applications agents use. Fortinet’s FortiAI offerings address AI workloads and governance, while its FortiSOC platform uses agentic AI to assist security teams in investigating and responding to threats.

The financial performance is substantial. Fortinet reported $2.05 billion in second-quarter revenue, up about 26% year over year, with GAAP operating income of $689.3 million. That profitability gives Fortinet room to develop security products while selling through an existing customer base. Its product revenue grew sharply in the quarter, but investors should not assign all of that growth to AI security; firewalls and conventional security needs remain major drivers. With the stock up 125.1% YTD, Fortinet has been the strongest performer in Table 1. The test for 2027 is whether new AI offerings enlarge its software and services opportunity rather than leaving the company dependent on the next hardware replacement cycle.

Cloudflare: Protecting the Applications Customers Actually Use

Cloudflare approaches AI from the internet edge, where applications interact with users and automated systems. Its AI Security for Applications offering addresses attacks against AI-powered apps, and its gateway and access tools can help enterprises inspect connections involving AI services and agents. This is a different position from Fortinet’s firewall base. Cloudflare may see malicious requests before they reach an application, making its ability to detect prompt attacks and other abuse commercially relevant as businesses expose more AI services online.

Its second-quarter revenue rose 36% to $696.1 million, the fastest reported revenue growth among the June-quarter companies discussed here. The stock’s 78.7% YTD gain reflects substantial enthusiasm for that growth and for its broader role in AI-era internet traffic. But Cloudflare also reported a GAAP operating loss of $205.7 million in the quarter. Investors therefore have to judge two separate propositions: that the company can continue expanding sales rapidly, and that security products can help turn its reach into stronger earnings. Cloudflare is an attractive challenger in AI application security, but its revenue growth alone does not establish that AI cybersecurity is already a large standalone business for it.

The Specialists: Finding Risk, Investigating Threats, and Protecting Data

Tenable focuses on what a company might expose before an attacker strikes. Its Tenable One platform can identify vulnerable assets and AI use across applications and services. That capability becomes more valuable when an organization cannot tell how many agents it has launched or which data those agents can reach. Tenable reported $268.5 million in second-quarter revenue, up 8.6% year over year, and its stock gained 53.8% YTD. The investment opportunity is to make AI exposure management a reason for more customers to adopt its broader platform; the question is whether that produces faster growth than its current single-digit revenue increase.

Qualys operates in the related business of finding, measuring, and helping customers reduce risk. It is developing an AI-native Risk Operations Center to bring those tasks together and has emphasized both using AI for security and protecting AI systems. Second-quarter revenue was $182.2 million, up 11% year over year, while the stock gained 39.2% YTD. For an investor, Qualys offers a more measured financial story than the biggest AI-security names. It can benefit if organizations increase spending on finding and fixing vulnerabilities, but it must show how much of that demand becomes additional contracts rather than a feature in an existing risk-management subscription.

Rapid7 offers threat detection, investigation, and managed security operations. AI can help its analysts and customers handle alerts that would otherwise consume hours of manual work. Yet its second-quarter revenue of $210.9 million declined 1.5% year over year, and annualized recurring revenue declined 2.0%. The stock is down 13.9% YTD, the only negative return in Table 1. That makes Rapid7 a useful reminder that a company can address the right technology problem while still facing a difficult business transition. Investors looking for a recovery should watch for a return to growth in recurring revenue, rather than assuming a stronger AI message is enough.

Varonis has a different asset: knowledge of where sensitive company data resides and who can access it. As agents search corporate files and take actions on behalf of employees, that information becomes crucial. Varonis has introduced Atlas to protect AI applications and the data behind them, including controls intended to inspect live AI requests. Its second-quarter revenue grew to $180.0 million from $152.2 million a year earlier, and SaaS revenue reached $171.7 million as customers continued moving from older licenses. The stock’s 47.3% YTD gain is smaller than those of the large platform leaders, but Varonis may have a distinct opportunity if protecting data from over-permissioned agents becomes a regular enterprise purchase. Its GAAP operating loss also means growth must eventually produce better profitability.

My Best Company Going Into 2027

Among these seven companies, Palo Alto Networks is my choice as the best-positioned business going into 2027. It has the largest quarterly revenue in Table 1, a sizable recurring-revenue platform, and products across the network, cloud, and security-operations layers where an AI incident could begin or spread. Its new annual testing subscription gives investors a specific product to monitor for adoption. Those advantages create several opportunities to sell to the same customer rather than relying on one narrow type of AI threat. Fortinet is the strongest alternative for investors who prioritize demonstrated operating profitability and the network-security installed base; Cloudflare may have more application-layer growth potential, but also has a larger gap between sales growth and GAAP profitability.

The distinction between best company and best stock purchase matters after Palo Alto’s 113.5% YTD rise. Investors entering now are paying for a great deal of success before the company has isolated AI security revenue in its results. My preference for Palo Alto rests on the breadth of its products and ability to bring new services to existing customers, not on a prediction of the next few months of share-price performance. If Fortinet demonstrates that AI-specific security services are accelerating its recurring sales, or if Palo Alto’s new subscriptions fail to gain traction, the ranking could change. The 2027 decision should follow customer adoption and earnings rather than last week’s headlines.

Investor Takeaway

AI does not need to become unpredictable on a vast scale for cybersecurity spending to increase. Ordinary commercial deployments create practical needs: identify the agent, restrict its permissions, inspect what enters a model, and protect the records it can retrieve. Palo Alto Networks, Fortinet, Cloudflare, Tenable, Rapid7, Qualys, and Varonis sell different parts of that protection. Their YTD returns show that investors have already rewarded some of those positions heavily while remaining skeptical of others.

For investors deciding what to follow into 2027, Palo Alto offers the most complete platform and a new subscription product aimed at continuous security testing. Fortinet backs its network-security opportunity with strong operating income; Cloudflare brings rapid sales growth and application-layer reach. Tenable, Qualys, and Varonis address narrower but potentially valuable security needs, while Rapid7 must first improve its financial trend. Table 1 is the starting point, not the final verdict: the strongest AI cybersecurity investment will be the company that turns a necessary defense into repeatable sales and earnings at a price that leaves shareholders room to benefit.

Contact [email protected] for any questions or corrections.