Key Takeaways
- The cybersecurity sell-off may have overstated AI disruption: AI's most direct threat is likely concentrated in areas representing just 10% of the total addressable market (TAM).
- AI could reinforce the advantage of established vendors: Established providers already own the data, customer relationships and enterprise context needed to secure increasingly complex AI environments.
- AI agent security could be the next major growth opportunity: AI may need cybersecurity to scale with rising demand for identity and governance, creating potential earnings growth that is not yet fully captured in forward estimates.
The Cybersecurity sell off
Cybersecurity and broader software stocks came under pressure mid 2025 to early 2026 as investors worried that frontier AI models could commoditise parts of the security stack and reduce organisational security budgets. Two Anthropic announcements added to these concerns. The company initially launched Claude Code Security, a research-preview tool that scans codebases for vulnerabilities and suggests patches. Anthropic further announced Claude Mythos Preview, reporting in testing, the model identified thousands of previously unknown (zero-day) vulnerabilities, in every major operating system and web browser, and could build working exploits for some of them when directed to. 1
The effect has been pronounced in the Australian ETF market, with the cybersecurity category recording its weakest quarter of flows in Q3 2026 extending the outflows that began in Q2.
Was the sell off warranted?
Since it’s April low, the Global X Cybersecurity ETF (BUGG) has rallied over 90%2, extending its gains in September after Anthropic CEO Dario Amodei raised safety issues about the pace of AI development, a position Sam Altman and Elon Musk quickly backed.3
Investor concerns were not without merit though. AI-powered tools are becoming increasingly effective at vulnerability discovery, code review and application security testing. These functions, however, represent only around 10% of the total addressable market (TAM) according to Morgan Stanley estimates, suggesting the reaction to Anthropic's announcements may have overstated the disruption facing the entire cybersecurity sector. 4
The fundamentals tell a similar story. Between the July 2025 peak and April 2026 trough, the blended 12-month forward earnings estimates for BUGG’s underlying index rose 21%, suggesting prices fell on sentiment, not on deteriorating earnings expectations.5
The advantage of established players
While AI's disruptive potential in cybersecurity has so far been concentrated in vulnerability detection, wider enterprise adoption of AI is expanding security requirements elsewhere. As AI agents and applications become embedded across business workflows, areas such as identity and access management (IAM), infrastructure security and governance are becoming increasingly important.
Incumbents hold a structural advantage in these areas. Years of operating within customer environments have given them proprietary data and platforms deeply embedded in complex enterprise workflows. 6 Therefore, despite access to AI models becoming widely available, the enterprise context required to deploy them effectively remains with incumbents. They are also building on this by embedding AI into their platforms through products such as Okta for AI Agents bringing AI directly into the workflows they already secure.
Demand appears to favour this approach. According to a McKinsey survey, roughly 30% of Chief Information Security Officers (CISOs) lack confidence in existing controls for emerging AI risks, yet they are seeking vendor-led solutions rather than building them internally. 7 For established providers with existing customer relationships and integrated platforms, that preference represents a natural extension of their offering.
AI remains a tailwind for cybersecurity
Much of the market debate has focused on whether AI will disrupt cybersecurity, the more important question may be whether AI can be deployed at scale without it. As enterprises deploy autonomous AI agents, those agents increasingly require access to company data and systems. This creates a new identity challenge, and with it, the next opportunity for the sector, of which, IAM is likely to be one of the primary beneficiaries.
AI agents form part of a category known as non-human identities (NHIs), which require a different approach to IAM. Traditional IAM authenticates a user and grants access for the duration of a session. AI agents, by contrast, act autonomously and continuously across systems, so access needs to be evaluated in real time rather than trusted for a session.8 As a result, an unsecured agent can cause far more damage than a single compromised user. The scale of the challenge is already significant. AI agent identities are estimated to outnumber human identities by 100 to 19, yet according to IBM, fewer than half of organisations report securing NHIs within AI workflows.10
This gap is where the opportunity lies, further highlighted by Morgan Stanley estimates of the total addressable market. In its base case, Morgan Stanley expects the agentic identity opportunity to lift the total identity market from just over US$20bn today to more than US$60bn by 2030, a 28% CAGR.
Furthermore, while overall cybersecurity budgets are forecast to grow at a CAGR of around 2.5% over the next three years, the share allocated to AI agent security is expected to more than triple to 15%.11 Organisations are also likely to keep identity security with established third-party vendors, given their proprietary data and governance concerns about allowing one AI model to oversee the actions of another.
Justifying valuations
Cybersecurity continues to trade at a premium to the broader market on a 34.8x forward P/E versus 18.5x for global equities.12 Against its own history, however, the valuation does not seem stretched. Since BUGG's underlying index hit its April 2026 low, the forward P/E has re-rated from 18.8x, its lowest level since 2023. The current multiple is now in line with its average of 34.5x and well below the 40-66x range that held through the first eight months of 2023. The multiple has returned to familiar levels rather than extremes, reflecting a normalisation in sentiment rather than renewed speculation. After such a strong rally, some investors may feel they have missed the trade. However, the rebound shows investors are increasingly recognising the potential of the theme, and the opportunity may still have room to run. If the tailwinds outlined above play out, namely rising demand for identity and governance as AI agents scale and incumbents' advantage in capturing it, earnings growth could support current valuations and leave scope for further re-rating. With much of this growth sitting beyond the 12-month horizon of current estimates, the runway for the sector extends well past today's numbers.
Conclusion
The market has focused on the disruption AI could bring to cybersecurity, while potentially overlooking the new security demands it creates. As AI agents scale, identity, access and governance are likely to become increasingly important. Established providers are well positioned to capture this opportunity, while valuations have returned to historical norms. Cybersecurity may therefore prove to be a necessary speed bump in the AI buildout, rather than one of its casualties.
Investors seeking exposure to companies which stand to benefit from the increased adoption of cybersecurity technology may wish to consider the Global X Cybersecurity ETF (BUGG).
Risks
Considerations for investing
All investments involve risk. An investment in this fund may be affected by risks related to: Markets, Investment Objective, Index Tracking, ETF Pricing, Liquidity, Currency, Concentration, & Emerging Markets. The nature and level of risk may vary depending on the fund’s investment strategy and assets. The value of your investment can rise or fall, see the PDS for a full list of risks.
