Evercore's Peter Levine talks 2026 cybersecurity playbook

Key Concepts

• Cybersecurity Market Dynamics: The current state of the cybersecurity market, including underperformance relative to broader tech, and the divergence in performance between different companies.
• AI Impact on Cybersecurity: The role of Artificial Intelligence in both increasing attack sophistication and offering new defensive capabilities.
• Consolidation Trend: The increasing trend of mergers and acquisitions within the cybersecurity industry, driven by the desire for streamlined solutions and data integration.
• Defensible Subsector: The argument that cybersecurity remains a strong investment area due to fundamental, structurally stable demand drivers.
• CISO Priorities: The focus of Chief Information Security Officers (CISOs) on streamlining security infrastructure and consolidating vendors.

---

Cybersecurity Market Overview & AI's Influence

The cybersecurity ETF has underperformed broader tech this year, particularly over the last three months. However, this masks a significant disparity in performance within the sector. Companies like Cloudflare and Crowdstrike have demonstrated strong performance, while SentinelOne and Fortinet have struggled. This divergence suggests a shift in the cybersecurity landscape, rather than a simple sector-wide weakness.

Peter Levine of Evercore highlights that despite broader software trends favoring “picks and shovels” (hardware/semiconductors), cybersecurity remains a fundamentally strong subsector. He attributes this to the structural stability of security needs, driven by factors like rising geopolitical tensions (China, Russia, cyber warfare), the increasing sophistication of attacks leveraging AI, ransomware extortion, and evolving regulatory requirements. He notes a lack of significant AI monetization within many cybersecurity companies until now, predicting a change in 2024/2025.

Consolidation in Cybersecurity: A Looming Wave

A key discussion point revolves around a potential consolidation wave within the cybersecurity industry. The acquisition of Armis by ServiceNow for $7 billion, along with ServiceNow’s acquisition of an identity company, exemplifies a trend of non-traditional software companies entering the security space.

Levine believes consolidation is occurring because CISOs and organizations are seeking to streamline their internal security infrastructure. Having data consolidated with a single vendor is also advantageous for leveraging AI capabilities. He identifies Palo Alto Networks as a top pick for 2026, specifically due to its position to benefit from this consolidation trade.

The increasing difficulty for cybersecurity startups to secure funding further fuels this trend. AI exacerbates the problem of siloed security systems, making a unified platform approach more appealing. Companies like Crowdstrike, Palo Alto, and Zscaler are actively making acquisitions to build these consolidated cybersecurity platforms.

Acquisition Opportunities & Valuation

The recent struggles of many cybersecurity stocks create opportunities for larger players to acquire companies at relatively lower valuations. Levine suggests this benefits companies like Crowdstrike, Palo Alto, and Zscaler, allowing them to expand their offerings through strategic acquisitions. He specifically notes that Palo Alto Networks is unique among large-cap cybersecurity companies in possessing a comprehensive security portfolio.

Data & Statistics

• ServiceNow Acquisition: ServiceNow acquired Armis, a private security company, for $7 billion.
• ETF Performance: The Cybersecurity ETF has underperformed broader tech, especially in the last three months.
• Funding Challenges: Cybersecurity startups are facing increased difficulty in fundraising.

Logical Connections

The discussion flows logically from an overview of the current market conditions to an analysis of the underlying drivers of performance. The conversation then pivots to the emerging trend of consolidation, linking it back to the challenges faced by smaller companies and the strategic advantages for larger players. The role of AI is woven throughout, acting as both a threat (increasing attack sophistication) and an opportunity (enabling consolidation and improved security solutions).

Technical Terms & Concepts

• CISO (Chief Information Security Officer): The executive responsible for an organization’s information and data security.
• ETF (Exchange Traded Fund): A type of investment fund traded on stock exchanges.
• Geopolitical Tensions: Political tensions between countries, often leading to increased cyber warfare.
• Ransomware: A type of malicious software that encrypts a victim's files and demands a ransom to restore access.
• Siloed Systems: Isolated and independent systems that do not share data or functionality.
• Endpoint Security: Security measures focused on protecting individual devices (laptops, smartphones, etc.).
• Identity Security: Security measures focused on verifying and protecting user identities.
• Network Security: Security measures focused on protecting computer networks from unauthorized access.

Synthesis/Conclusion

The cybersecurity market is undergoing a period of significant change. While the sector as a whole has faced headwinds, underlying demand drivers remain strong, fueled by geopolitical tensions, the rise of AI-powered attacks, and regulatory pressures. A key takeaway is the accelerating trend towards consolidation, driven by CISOs seeking streamlined solutions and the benefits of integrated data for AI-driven security. Companies positioned to lead this consolidation, like Palo Alto Networks, are likely to outperform, while smaller, less well-funded companies may become acquisition targets. The increasing importance of AI in both attack and defense will continue to shape the cybersecurity landscape in the coming years.