Bank of America laid out a set of cybersecurity names it views as well placed to capture increased enterprise spending as artificial intelligence reshapes the threat landscape and expands what corporate security teams must protect. The bank underscored providers moving beyond legacy perimeter tooling to confront rising risks tied to machine identities, cloud-native workloads and AI-driven attacks.
SentinelOne
BofA gives SentinelOne a Buy, noting the company's profile is broadening beyond a pure endpoint vendor as AI, data and cloud-oriented offerings now account for roughly half of its annual recurring revenue. The bank pointed to a growing prevalence of agentic threats and highlighted SentinelOne's Singularity platform for its automation and autonomous detection capabilities. Those features, BofA said, enable organizations to consolidate multiple security products into a single AI-native system. The firm cited strong ARR growth and improving profitability as supportive of its positive view, while also flagging elevated investor expectations after a recent rally in the stock price.
Company activity cited by the bank includes the rollout of a Purple AI Agentic Investigation capability for autonomous threat analysis and plans to integrate its security toolset with Amazon Bedrock AgentCore. In addition, the note referenced a Market Outperform rating reiterated by Citizens, which the bank said pointed to customer traction in AI-detection and response.
Zscaler
BofA retained a Buy rating on Zscaler, positioning the company at the intersection of Zero Trust adoption, network transformation and the rise of AI-driven workflows. The bank observed that the proliferation of distributed users and cloud-hosted applications enlarges the attack surface that enterprises must secure. It said Zscaler's cloud-native architecture and expanding AI capabilities deepen the firm's integration into customer environments, a factor the bank used to justify a higher valuation multiple.
CrowdStrike
The bank said it is updating its model ahead of CrowdStrike's August 26 earnings report, while maintaining a constructive view that AI has transitioned from an emerging threat to a platform advantage for select security vendors. BofA argued that an expanding AI attack surface is prompting broader board- and CISO-level spending and accelerating vendor evaluation cycles, including demand for tools focused on monitoring and governing AI systems. The research note also noted that several analyst firms, including Benchmark, Wells Fargo and TD Cowen, raised price targets on CrowdStrike prior to its results, citing strong sales momentum and demand tied to AI security.
SailPoint
BofA assigned SailPoint a Neutral rating, framing identity governance as core infrastructure for an era in which machine identities and cloud workloads increase access risk. The bank pointed to SailPoint's Agentic Fabric initiative and its completed acquisition of Entro Security as positioning the company to address governance for non-human or agent identities. However, BofA said execution risk on new products keeps its view cautious and results in a more balanced risk-reward profile relative to peers. The note also referenced follow-on positive ratings from other firms, including Truist and Cantor Fitzgerald, after SailPoint's investor day.
BofA's broader view
The bank's overarching thesis is that AI is reshaping both attack vectors and defensive approaches, prompting security buyers to seek platforms that can detect, respond and govern AI-related risks. That dynamic, BofA said, favors companies with AI-native capabilities and cloud-first architectures able to consolidate multiple security functions. At the same time, the firm acknowledged company-specific risks such as heightened expectations following rallies, execution uncertainty for newly integrated technologies, and near-term earnings sensitivity around upcoming results.
Investors and corporate buyers, according to the note, will be watching how effectively vendors convert AI-driven demand into sustainable revenue and margin improvement while managing integration and product execution risks.