The market’s understanding of the relationship between artificial intelligence (AI) and the cybersecurity industry is undergoing a significant shift. Just months ago, investors were still worried that AI would upend the business models of traditional cybersecurity vendors, eroding the moats around their existing products and platforms. But as new attack vectors such as AI agents rapidly emerge, the market is beginning to recognize that AI is expanding corporate attack surfaces while simultaneously driving up the speed and complexity of cyberattacks. The cybersecurity sector has thus transformed from a “potential victim” of the AI wave into indispensable infrastructure for AI deployment at scale.<\/p>\n
According to a report by Wall Street CN, BofA Securities (Bank of America Securities) published an in-depth research note on August 18 pointing out that the relationship between AI and cybersecurity is shifting from “disruptor” to “demand catalyst.” The deeper enterprises integrate AI into their operations, the higher their requirements become for security capabilities across identity, data, endpoints, and cloud environments. This shift in logic is already reflected in market performance: over the past two months, the CIBR ETF has risen 16.1%, the HACK ETF has surged 38%, and IVG has gained 14.9%, while the S&P 500 Index has risen only 3.6% over the same period.<\/p>\n
AI Threats Are Reshaping Security Demand<\/p>\n
The market’s earlier concerns about AI’s impact on the cybersecurity industry stemmed from a seemingly straightforward logic: AI lowers technical barriers, potentially helping enterprises conduct security work more efficiently while also enabling attackers to launch assaults at lower cost, thereby diminishing the value of traditional security products.<\/p>\n
But with the rapid development of Agentic AI, this logic is undergoing a fundamental transformation. AI agents can execute tasks across systems, autonomously discover vulnerabilities, and operate continuously with limited human oversight. The resulting “agent-driven attacks” are becoming a new category of risk that corporate Chief Information Security Officers (CISOs) are prioritizing.<\/p>\n
Compared with traditional cyberattacks, AI-driven threats mean not only an expanded attack surface but also a simultaneous increase in attack speed and complexity. For enterprises, the broader the AI deployment, the more identities, permissions, data, and workloads they need to manage. If security capabilities cannot be upgraded in tandem, the efficiency gains from AI could instead translate into new security risks.<\/p>\n
AI is thus creating a new closed loop of security demand: AI expands the attack surface, attack complexity rises, enterprises increase security spending, and security vendors benefit.<\/p>\n
From “Defensive Spending” to “AI Infrastructure”<\/p>\n
The more important shift lies in the changing role of cybersecurity.<\/p>\n
Previously, cybersecurity was largely viewed as defensive spending within corporate IT budgets, and sector valuations were susceptible to macroeconomic conditions and corporate IT budget cycles. But in the AI era, security is increasingly becoming a prerequisite for enterprises to scale their AI initiatives. Companies need to ensure AI agents are properly authorized, control machine identities and access privileges, protect data within AI workflows, and continuously monitor cloud environments, endpoints, and networks.<\/p>\n
In other words, without adequate security capabilities, an enterprise’s AI strategy can hardly achieve true scale. This shifts the demand logic for cybersecurity from simply “risk prevention” toward “enabling AI growth.” The larger the AI investment, the greater the potential security spending opportunity.<\/p>\n
Sector Valuation Is Being Repriced<\/p>\n
The shift in demand logic is already manifesting at the valuation level. BofA data shows that the median EV\/2027 Sales multiple for cybersecurity companies currently stands at approximately 5.8x, up from just 4.5x two months ago; the average valuation has expanded from 7.0x to 9.0x.<\/p>\n
MetricTwo Months AgoCurrentChangeMedian EV\/2027 Sales4.5×5.8x+1.3xAverage EV\/2027 Sales7.0x9.0x+2.0xCIBR ETF Gain\u2014+16.1%\u2014HACK ETF Gain\u2014+38.0%\u2014IVG Gain\u2014+14.9%\u2014S&P 500 Index Gain\u2014+3.6%\u2014<\/p>\n
Note: Data covers the past two months, sourced from BofA Securities’ August 18 report.<\/p>\n
Cybersecurity ETFs have clearly outperformed the broader market recently, indicating that capital flows are increasingly focused on this sector. From a valuation perspective, the core driver of this repricing is not merely short-term earnings improvement but the market’s willingness to assign higher growth certainty to cybersecurity. If AI continues to expand enterprises’ digital assets, machine identities, and automated workflows, security demand will expand accordingly. This means the long-term total addressable market (TAM) for the cybersecurity industry is being redefined by AI.<\/p>\n
Valuation Expansion Still Requires Earnings Validation<\/p>\n
That said, the sector’s valuation has already expanded significantly, which means the market’s expectations for future growth have risen in tandem.<\/p>\n
BofA believes the cybersecurity software industry is currently valued in a range of roughly 5x to 10x EV\/Sales, with valuation differences across companies essentially reflecting growth rates, new market expansion capabilities, and business model certainty. Therefore, AI-driven demand catalysts do not mean all cybersecurity companies will receive the same degree of valuation premium.<\/p>\n
Companies that can sustainably earn market recognition need to demonstrate that AI is not only creating new security risks but also translating into actual orders, annual recurring revenue (ARR) growth, and a larger serviceable market. Going forward, the industry’s key focus will shift from “will AI disrupt cybersecurity” to “how much incremental demand can AI actually generate for cybersecurity.”<\/p>\n
For investors, this shift in the pricing logic of the cybersecurity sector means that screening criteria need to evolve from a simple “AI beneficiary concept” to more rigorous earnings validation. Only companies that can convert AI-driven security demand into sustainable revenue growth are likely to continue commanding market premiums in this round of valuation reset.<\/p>\n","protected":false},"excerpt":{"rendered":"The market’s understanding of the relationship between artificial intelligence (AI) and the cybersecurity industry is undergoing a significant…\n","protected":false},"author":2,"featured_media":143524,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[179,405,7537,70692,70693,3886,313,70694,70695,1102],"class_list":["post-143523","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-agentic-ai","tag-ai-agents","tag-artificial-intelligence-agents","tag-bofa-securities","tag-cibr-etf","tag-ciso","tag-cybersecurity","tag-hack-etf","tag-ivg","tag-sp-500-index"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/143523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=143523"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/143523\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/143524"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=143523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=143523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=143523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}