Cloud & Workload Security

International Business Machines announced a new collaboration with Zscaler and Red Hat to tighten application security for enterprise clients. The joint effort combines IBM and Red Hat software platforms with Zscaler threat intelligence to provide real-time protections at the application layer. The partners plan to coordinate vulnerability discovery, automated policy updates, and validated software remediation workflows for shared customers. International Business Machines is a US-based IT group with a reported market value of about $214.0 billion, and its integrated solutions and services span the Americas, Europe, the Middle East, Africa and the Asia Pacific. One figure to watch is how much of IBM's reported US$24.6b of annual recurring revenue comes from security and hybrid cloud offerings connected to Red Hat and Zscaler style deployments.

CrowdStrike Holdings announced that its Falcon cybersecurity platform is now available in the OpenAI Marketplace, giving enterprise customers another route to deploy its tools. The company's shares have climbed 32.36% over the past 30 days and 46.94% over 90 days, contributing to a 142.55% year-to-date increase and a one-year total shareholder return of 122.86%. CrowdStrike last closed at $275.04, against a most-followed fair value estimate of $235.67 that uses an 8.59% discount rate and implies the stock is 17% overvalued. The company is pushing beyond endpoint security into next generation SIEM, identity, cloud security and exposure management, each already contributing hundreds of millions of ARR. Investors are counting on those businesses to scale toward multi billion dollar ARR and support higher long term revenue and profit margins from a broader security platform.

Zscaler reaffirmed its fiscal 2027 outlook, guiding first-quarter revenue to about US$935 million to US$939 million and full-year revenue to roughly US$3.91 billion to US$3.94 billion, while outlining a long-term ambition for much higher annual recurring revenue. The company also announced a collaboration with IBM and Red Hat aimed at protecting private applications during the gap between vulnerability disclosure and patching. The reaffirmed guidance supports Zscaler's near-term execution story, though slower expected revenue growth remains a key risk if competition tightens or deal cycles lengthen. Zscaler's narrative projects US$5.3 billion in revenue and US$178.4 million in earnings by 2029, requiring 16.6% yearly revenue growth and a US$241.6 million earnings increase from negative US$63.2 million today. More cautious analysts assume revenue of about US$5.2 billion and earnings near US$16 million by 2029, a more restrained view of how quickly Zscaler's newer security pillars could scale.

Zscaler announced a new partnership with IBM and Red Hat to help secure private applications during active vulnerability windows. The collaboration combines Zscaler's Autonomous Application Shield with IBM and Red Hat remediation tools to deliver application-specific protections, while Lightwell supplies validated open source fixes. The joint solution targets real-time safeguards against exploitation attempts, including those using AI-powered and opportunistic attack methods. Zscaler, a US software provider with a market cap of $32.9b, runs a cloud-based security platform that inspects traffic and enforces access rules for enterprises worldwide. The company said the key markers ahead are early access adoption of Autonomous Application Shield with Lightwell by large enterprises and any contribution to annual recurring revenue tied to application shielding and AI-driven response.

SentinelOne has rolled out general availability of its Wayfinder Threat Hunting for Cloud service, extending coverage to AWS, Azure, and Google Cloud and tying the launch directly to its AI-led Singularity Platform. The stock last closed at US$25.80, with a 1-month share price return of 29.78% and a year-to-date share price return of 76.23%. The most followed narrative on SentinelOne pegs fair value at $24.25, leaving the stock modestly above that estimate and 6% overvalued, while the SWS DCF model points the other way, putting shares roughly 6.2% below an estimated future cash flow value of $27.49. Analysts behind the popular narrative use an 8.57% discount rate and assume revenue growth in the high teens with margins eventually moving toward US software averages, even as SentinelOne still reports a loss of $340.1 million on $1.10b of revenue. The company's new Flex licensing model is accelerating multi-product adoption, and expansion beyond endpoint security into cloud security, identity, and data protection, including the Prompt Security acquisition for GenAI risk, is expected to lift average contract value and diversify revenue streams.

CrowdStrike expanded its Google Cloud relationship on September 1, announcing Falcon capabilities designed to protect enterprise AI applications against prompt injection, sensitive-data leakage, and malicious AI activity through Google's Agent Gateway, alongside broader connections between Falcon and Gemini Enterprise. The move follows a fiscal second quarter in which revenue rose 26% year-over-year to approximately $1.47 billion, annual recurring revenue reached approximately $5.84 billion, up 25%, and net new ARR added during the quarter totaled $332.8 million. ARR from customers using Falcon Flex exceeded $2.29 billion, up 101% from a year earlier, while operating cash flow increased to $530.3 million from $332.8 million and free cash flow rose to $377.4 million from $283.6 million. Management raised its full-year fiscal 2027 net new ARR growth outlook to 34% at the midpoint. Jim Cramer highlighted CrowdStrike on Mad Money on October 1, noting the stock rallied 39% and that the Charitable Trust owns it, though the company still trades at roughly 210x forward earnings versus 96x for Palo Alto Networks and reported a $33.2 million GAAP operating loss against $371.6 million in non-GAAP operating income. Legal exposure from the July 2024 outage remains unresolved, with discovery ongoing in Delta's lawsuit and the company disclosing requests for information from the Justice Department and SEC concerning revenue recognition, ARR reporting for certain customers, and the outage.

Tenable Holdings, Inc. announced the appointment of Charlie Bell to its Board of Directors. Bell, a technology executive with nearly four decades of software engineering and operational leadership experience, spent over two decades at Amazon Web Services, where he helped build its cloud infrastructure from inception into a global, multi-billion dollar business and served as a Senior Vice President. Most recently he served as Executive Vice President of Security, Compliance, Identity and Management at Microsoft, overseeing enterprise security strategy, product engineering and threat intelligence operations. Tenable Co-CEOs Mark Thurmond and Steve Vintz said Bell's engineering-first perspective and cloud-scale product architecture experience will reinforce the company's strategic direction as it advances its AI-powered exposure management platform. Bell said Tenable's massive data lake and advanced exposure intelligence position it uniquely to address the complexities of today's AI attack surface.

CrowdStrike announced its fourth annual Cybersecurity Startup Accelerator, a global program for startups building the future of cybersecurity for the agentic era, alongside Amazon Web Services and NVIDIA. Applications are open worldwide through Monday, November 2, 2026, with the eight-week program running from Monday, January 11 through Monday, March 8, 2027. New this year, participants get an accelerated path to build with CrowdStrike, including access to Falcon Foundry agent creation, Falcon APIs, opportunities to develop verified integrations, and publication in the CrowdStrike Marketplace, while AWS expands go-to-market support for AWS Partner Network onboarding, technical validation, and AWS Marketplace listings, and NVIDIA Inception provides technical training and developer resources. At the conclusion of the program, up to ten startups will advance to pitch live at RSAC 2027, April 5 to 8, where the 2027 winner will be selected, and outstanding companies may also be considered for investment from the CrowdStrike Falcon Fund. The Accelerator has now supported more than 90 startups globally, with participating companies raising nearly $1 billion in funding and multiple alumni going on to be acquired; last year's winner Jazz more than doubled its book of business, nearly tripled revenue, increased inbound leads 5x, and grew its pipeline 10x, while runner-up Above Security added new customers and received a strategic investment from the Falcon Fund, and fellow cohort member Fabrix Security was acquired by Silverfort.

The First Trust Cybersecurity ETF (CIBR) reached an all-time high on Monday as the tech-heavy Nasdaq Composite (^IXIC) notched a fresh record, with the fund's main holdings CrowdStrike (CRWD), Palo Alto Networks (PANW), and Fortinet (FTNT) all sitting near all-time highs after surging 132%, 131% and 97%, respectively. Rubrix (RBRK), F5 (FFIV), and Cloudflare (NET) also sit near record highs after a strong rally this year. Alarm bells from leadership at Anthropic and OpenAI prompted a rally in cybersecurity stocks last month, and the surge in AI agent usage and the popularity of Meta's (META) Muse have also highlighted the need for the industry. "Agents going rogue is the biggest risk today," Jay Chaudhury, CEO of Zscaler, told Yahoo Finance's Brian Sozzi on Monday, adding that a hijacked or rogue agent on a corporate network is far more dangerous because it works at machine speed. Morgan Stanley analysts, who have Overweight recommendations on Palo Alto Networks, CrowdStrike, and Okta (OKTA), expect corporate spending on cybersecurity software to grow by 23% annually through 2028, potentially accelerating to 33% annually if major cyberattacks spur new government mandates.

Promevo launched Insights by Promevo, a platform it calls the first to unify AI agent governance, Gemini Enterprise adoption and Google Cloud cost management into a single view. The platform delivers real-time observability across three areas: AI license optimization that identifies idle or underutilized licenses and quantifies reclaimable spend, AI agent governance and security that inventories custom-built agents and maps their permissions and data access, and AI cost attribution that connects every agent to its underlying Google Cloud resource consumption and costs. Promevo says native consoles offer fragmented data with limited 28-day lookback windows, while Insights consolidates these silos with extended historical retention, and it does so without ever reading or storing an organization's sensitive prompt or response content. The same view extends beyond Gemini Enterprise into the rest of a customer's Google Cloud environment, covering cloud FinOps, asset discovery and hierarchy, and cross-project IAM access intelligence. CEO Karthik Kripapuri said customer organizations already run thousands of agents, and the platform is available today for customers using Google Workspace and Gemini Enterprise, with expansion planned in the coming days and weeks.

Cloudflare has entered a strategic partnership with Deutsche Telekom under which the German carrier will add Cloudflare's security and connectivity solutions to its enterprise portfolio and the two companies will directly connect their networks. Deutsche Telekom will also train and certify its professionals on the Cloudflare platform through T-Systems, giving customers support for consulting, implementation and managed security services. The deal covers protection of applications, networks and data as well as AI workloads, and the companies plan to work on digital resilience and sovereignty in Europe, including protection of critical data and infrastructure and the use of post-quantum cryptography. The Zacks Consensus Estimate for Cloudflare's 2026 and 2027 revenues indicates year-over-year growth of 32.5% and 28.6%, respectively. Cloudflare shares have jumped 77% in the year-to-date period compared with the Zacks Internet – Software industry's return of 9.9%, and the stock trades at a forward price-to-sales ratio of 35.28 versus the industry's average of 4.42.

Netskope shares have climbed about 24.5% since its last earnings report, outpacing the S&P 500, after the company posted second-quarter fiscal 2027 revenue of $220.5 million, up 29% year over year and above guidance. The company reported a non-GAAP loss of 3 cents per share, an improvement from a loss of 6 cents a year earlier, while annual recurring revenue reached $899 million, up 27%, and remaining performance obligations hit $1.35 billion, up 36%. Netskope raised its full-year fiscal 2027 revenue guidance to a range of $888 million to $892 million, roughly 26% growth, up from a prior range of $879 million to $883 million, and guided third-quarter revenue to $227 million to $229 million, about 24% growth. Management pointed to AI Security as the fastest pipeline build in company history, with roughly one-third of that pipeline in or entering the proof-of-concept phase, and said about 50% of sales representatives are still new or ramping, positioning the company for accelerated net new ARR in the second half. The company ended the quarter with approximately $1.1 billion in cash, cash equivalents and marketable securities, and carries a Zacks Rank #2 (Buy).

TrendAI, the AI security business unit of Trend Micro Incorporated, announced it has expanded support for Claude's Compliance API in TrendAI Vision One to cover Claude Code and Cowork session transcripts from Claude Enterprise. The move builds on the integration TrendAI announced with Anthropic in June 2026 and adds visibility into how engineering and knowledge-work teams use AI agents day to day. Claude's Compliance API returns session records for Claude Code and Cowork, including prompts, responses and tool calls, each tied to a verified user, and TrendAI now brings those records into TrendAI Vision One so security teams can investigate AI activity in context, correlate it with endpoint, identity, cloud and network signals, and build custom detections. Rachel Jin, Chief Platform and Business Officer and Head of TrendAI, said coding and knowledge-work agents are now doing real work inside the business and security teams should be able to see and investigate that work the same way they do everything else. TrendAI Vision One also continues to ingest activity logs from Claude Enterprise, covering user logins, admin actions and configuration changes, and from Claude Platform, covering admin, system and resource events. The Claude Compliance API integration in TrendAI Vision One is available now for TrendAI Vision One customers using Claude Enterprise.

Cantina unveiled The Brain, a shared context and memory layer that gives its autonomous security agents persistent knowledge of each customer's environment, connecting identities, infrastructure and prior investigations so agents can investigate alerts with less discovery work. The Brain combines structured records, which link entities through stable identifiers such as a repository, service and its cloud resources, with agentic memory that retains context not captured by relationships, including why a team considered a pattern benign or what an earlier investigation established about a suspicious IP address. Its current implementation covers identities, cloud assets such as AWS and Vercel, MDM-managed devices, repositories, vulnerabilities and the relationships between them, with data residing in individual workspaces and knowledge records supporting topic locks and review of proposed facts. In an observational comparison of 40 low-severity Okta alerts split across two workspaces, the Brain-enabled workspace averaged 170.8 seconds from alert creation to closure versus 220.4 seconds in the comparison workspace, 22.5% less elapsed time, and averaged 12.15 tool calls per alert versus 19, or 36.1% fewer calls; comparing the 20 Brain-enabled alerts with the 18 comparison alerts that ran on the same model, Claude Opus 4.8, the Brain-enabled sample averaged 22.5% less elapsed time and 27.8% fewer tool calls. Cantina launched from stealth in July backed by $8 million in funding led by Framework Ventures, bringing its total funding to $16.5 million, and its autonomous OffSec agent, Apex, used The Brain in one captured application-security investigation to retrieve surrounding topology from a GitHub repository, including its load balancer, database, cache, jobs, Datadog service, other repositories and AWS resources.

Radware Ltd. introduced Radware Agent Trust Management, a new solution designed to help organizations participate more securely in the emerging AI agent economy by facilitating how trusted AI agents interact with their applications. The solution captures an agent's declared intent through active conversation, continuously assesses whether its actions remain consistent with that intent, and controls what agents are permitted to do, moving businesses beyond broad allow-or-block decisions. According to Radware's H1 Global Threat Analysis Report, 77% of organizations are actively deploying or implementing AI agents, yet only 17.2% report full visibility into the AI agents operating within their environments. Radware Agent Trust Management is available now as part of Radware Cloud Application Protection services, extending Radware's bot management capabilities to address the distinct visibility, trust assessment and governance requirements of AI agents. David Aviv, chief technology officer at Radware, said organizations need to be able to embrace this shift while maintaining visibility and control over agent activity.

Palo Alto Networks shares jumped 5.1% in the afternoon session after BTIG raised its price target on the cybersecurity provider to $425 from $404 and reiterated a Buy rating following discussions with management. BTIG analyst Gray Powell cited growth potential from Chronosphere, CyberArk, and Prisma AIRS, forecasting pro forma revenue growth above 17%. Separately, NVIDIA launched its Open Agent Safety Platform to govern and secure artificial intelligence agents across compute systems from testing to deployment, and named Palo Alto Networks as one of the industry leaders collaborating on the safety initiative. The shares closed the day at $391.64, up 4.5% from the previous close. Palo Alto Networks is up 118% since the beginning of the year and is trading close to its 52-week high of $396 from August 2026.

Cisco Systems reported double-digit order growth across its entire security portfolio, including Splunk, in the fourth quarter of fiscal 2026, with Security revenues rising 14% year over year to $2.23 billion. More than 1,500 customers bought newer offerings such as Secure Access, XDR, Hypershield and AI Defense in the quarter, lifting total net new customers since launch to more than 6,400, while firewall orders climbed more than 30% year over year. Observability revenues, a smaller part of the business, increased 6% to $275 million in the quarter, and for the full fiscal 2026 Security revenues grew 2% to $8.23 billion while Observability revenues rose 4% to $1.10 billion. Cisco also said nearly 4,500 enterprises signed up for Cisco Cloud Control and more than 8,600 customers use Resilient Infrastructure Services powered by Cisco IQ, and it launched Antares, a family of open-weight small language models for identifying known code vulnerabilities. The company faces intensifying competition from Datadog, which has more than 750 AI customers, and CrowdStrike, whose Falcon Flex annual recurring revenue surpassed $2.29 billion, up 101% year over year. Cisco shares have appreciated 38.5% year to date, and the Zacks Consensus Estimate for earnings stands at $1.32 per share, implying 32% growth.

SentinelOne announced that its Wayfinder Threat Hunting service now covers AWS, Azure, and Google Cloud, extending AI-powered Singularity telemetry and expert human-led hunting across endpoints, identities, and cloud control planes to address threats such as IAM privilege escalation, unauthorized access, and data exfiltration. A key element of the launch is a unified, continuous hunting workflow that fuses SentinelOne and Google Threat Intelligence, giving security teams consolidated visibility and enriched Purple AI summaries across their entire hybrid cloud environment. The move follows the earlier expansion of Wayfinder Frontier AI Services, which added AI-powered code risk analysis and compromise assessments using advanced OpenAI models, and reinforces SentinelOne's push beyond endpoint security into AI, identity, and cloud. SentinelOne's narrative projects $1.8 billion in revenue and $213.5 million in earnings by 2029, yielding a $24.25 fair value, an 8% upside to its current price, while the most pessimistic analysts still saw only about 16.7% annual revenue growth and no profitability in three years. Investors are still watching the risk that hyperscaler partners eventually prioritize their own security stacks, and that higher compliance costs and rising localization demands could reshape both narratives once the announcement is fully reflected in forecasts.

Microsoft Azure Red Hat OpenShift for Microsoft Azure Government has attained Department of Defense Impact Level 5 certification, Red Hat announced. The IL5 classification defines the highest level of security controls required for sensitive, mission-critical information and systems in cloud environments, covering Higher sensitivity Controlled Unclassified Information, Unclassified National Security Systems, and mission-critical information. The certification follows the platform's IL4 certification in July 2024 and adds to its existing FedRAMP High Authorization, ITAR, DFARS, IRS 1075, and CJIS credentials. Launched in 2023, the co-developed and jointly-operated turnkey application platform lets U.S. government agencies build, deploy, and run containerized applications at scale while meeting security and compliance requirements for highly-sensitive workloads. Chris Smith, vice president of North American Government Sales at Red Hat, said the service lets agencies accelerate cloud-native deployment without compromising lifecycle-wide security, while Leigh Madden, vice president of National Security at Microsoft, called the certification a significant milestone for mission-critical government workloads.

National Telecom Public Company Limited, or NT, has reaffirmed the readiness of its cloud security in line with international standards, in support of the Cloud Cybersecurity Standard B.E. 2567 issued by the National Cyber Security Agency, or NCSA, which takes effect from 10 September 2026. Dr. Yuthasak Nithipaichit, Senior Executive Vice President of NT's Digital Group, said during a panel discussion titled "Enabling Cloud with Trust" organised by the NCSA that NT has shifted its cloud service approach from a primary focus on resource access, or Cloud First, to placing equal emphasis on security, or Cloud Security First. NT currently holds several key certifications, including ISO/IEC 27001:2022, ISO/IEC 27701:2019, CSA STAR Certification, ISO/IEC 27017:2015 and ISO/IEC 27018:2019. NT believes that the enforcement of the NCSA standard, together with the availability of certified auditors, will make it easier and more systematic for cloud service providers in Thailand to undergo assessment. It also noted that cloud security requires cooperation from user agencies that own the data as well as users within the system, in order to achieve a secure and trustworthy Cloud Ecosystem overall.

CrowdStrike shares jumped 4.5% to a fresh 52-week high of $261.33, extending a multi-session rally. Morgan Stanley analyst Keith Weiss reaffirmed a buy rating and raised his price target to $254 from $238, citing a broader sector tailwind from emerging agentic AI safety concerns that is accelerating enterprise security spending and expanding identity-perimeter budgets. Nvidia Chief Executive Jensen Huang had previously highlighted CrowdStrike at a Goldman Sachs technology conference as Nvidia's primary cybersecurity partner, pointing to their joint SafeMind threat-detection architecture. Separately, cloud security firm Tamnoon announced it integrated its managed remediation workflows into CrowdStrike Falcon Cloud Security. The stock is up 131% since the beginning of the year.