Morgan Stanley outlined its preferred cybersecurity stock picks following recent meetings with company leadership teams and observations from the RSA Conference, a major cybersecurity event.

The firm highlighted five companies positioned to capitalize on the growing demand for artificial intelligence security and identity protection as enterprises increasingly deploy AI agents across their operations.

Microsoft

Morgan Stanley expressed an incrementally positive view on Microsoft following discussions with its security leadership. The tech giant is prioritizing agent governance and extending identity protections to AI agents as first-class entities. Security Copilot has evolved into embedded, workflow-native agents across Defender, Purview, and Entra platforms. Microsoft continues to gain market share in security with roughly 1.6 million customers and approximately $20 billion in revenue run rate. Sentinel and identity services serve as key platform anchors, while E5 adoption remains a primary growth driver.

Palo Alto Networks

Morgan Stanley views Palo Alto as well-positioned across multiple vectors of the AI security shift. The company is building a comprehensive approach through Prisma AIRS, focused on securing the full agent lifecycle, with over 100 early customers already signed on. The newly launched AI Gateway is positioned as a core governance layer for AI traffic with real-time policy enforcement. On the SIEM front, XSIAM leverages deep telemetry ingesting roughly 17TB per day, with over 600 customers and net revenue retention exceeding 120 percent.

Palo Alto Networks announced several new products, including an updated Prisma Browser designed to secure autonomous AI agents and a new platform to automate digital certificate management.

CrowdStrike

Morgan Stanley recently upgraded CrowdStrike to a top pick, citing proprietary telemetry and kernel-level visibility as key competitive advantages. Management emphasized that a large portion of SIEM data originates from CrowdStrike’s own sensors. The company highlighted Falcon AIDR for prompt-layer protection and launched Agentworks to expand analyst productivity. Falcon Flex continues gaining traction as a consolidation enabler, driving average selling price uplift of roughly 48 percent in re-flex scenarios.

CrowdStrike introduced the Charlotte AI AgentWorks Ecosystem, a platform for custom AI security agents, in partnership with companies including Amazon Web Services and NVIDIA. The company also expanded its collaboration with Intel to optimize its Falcon platform for AI-powered PCs.

SailPoint

Morgan Stanley sees SailPoint as a near-term beneficiary of identity security buildout around agentic AI. AI-oriented offerings represented 17 percent of net new ARR in Q4. The migration opportunity remains significant, with roughly $350 million in perpetual and term licenses that can convert at a two to three times uplift, implying approximately $1 billion in top-line opportunity over time.

SentinelOne

Morgan Stanley maintains a more measured Equal-weight rating on SentinelOne. Management highlighted kernel-level telemetry as a key differentiator and expressed skepticism around traditional SIEM architectures. While guidance remains measured at roughly 20 percent revenue growth at the midpoint of FY27, management pointed to improving pipeline trends as indicators of potential re-acceleration.

SentinelOne announced an expanded multi-year collaboration with Google Cloud to develop integrated security solutions. The company also appointed Barry Padgett as its new president and chief operating officer.