U.S.-listed cybersecurity stocks split sharply after quarterly earnings, with traders rewarding companies that showed accelerating order indicators and punishing those whose forward-growth signals fell short of elevated expectations. CrowdStrike gained 20.5% in one session and Okta rose nearly 29%, while Zscaler fell more than 30% after its results and SentinelOne dropped more than 5% in after-hours trading.
The contrast emerged despite solid revenue growth across all four companies. The market response placed greater weight on metrics that indicate future demand—especially net new annual recurring revenue, remaining performance obligations and current remaining performance obligations—than on reported revenue alone.
CrowdStrike and Okta delivered the clearest evidence that new business or contracted revenue was improving. Zscaler and SentinelOne, by comparison, reported growth that remained substantial but did not satisfy traders looking for a stronger acceleration in the quarters ahead.
Order growth drives CrowdStrike’s rally
CrowdStrike reported fiscal second-quarter 2027 revenue of $1.47 billion, up 26% from a year earlier, according to its quarterly earnings release. Its ending annual recurring revenue, or ARR, reached $5.84 billion, a 25% increase.
The figure that attracted the most attention was net new ARR, which measures the annualized value of subscription business added during the quarter. CrowdStrike generated about $333 million of net new ARR, up 51% year over year. That represented a marked pickup from the previous quarter, when net new ARR was $256 million, up 32% from the corresponding period a year earlier.
That acceleration gives CrowdStrike a stronger near-term growth profile than its headline revenue increase suggests. Security companies with large subscription bases can sustain revenue growth for some time on existing contracts, while net new ARR offers a more immediate reading of sales execution and customer demand.
CrowdStrike has increasingly presented itself as a platform spanning endpoint protection, cloud security, identity protection and security operations. The strategy is designed to increase the number of products customers use and tie security spending to a single operating environment, rather than a collection of separate tools.
Okta’s contracted revenue outlook improves
Okta’s fiscal second-quarter 2027 revenue rose 11% year over year to $805 million, according to the company. The identity-security provider’s revenue growth was slower than CrowdStrike’s, but its contracted-revenue measures improved.
Okta reported remaining performance obligations, or RPO, of $4.858 billion, up 17% from a year earlier. Current RPO, which represents revenue expected to be recognized over the coming 12 months, reached $2.585 billion, up 14%. That growth rate accelerated from 12% in the previous quarter.
RPO is closely watched in subscription software because it captures signed business that has not yet been booked as revenue. Current RPO narrows that view to a more immediate period, making it useful for assessing whether a company’s sales pipeline is converting into revenue likely to arrive within the next year.
Okta’s rally indicated that traders saw the improving cRPO growth rate as evidence that demand for its identity products was firming. The company has tied that opportunity to the management of machine identities, including AI agents and automated software that need permission to access corporate systems, applications and data.
An enterprise may reduce some human software licenses as routine tasks become automated, but each automated workflow can introduce new service accounts, application programming interfaces, or APIs, and software agents. Those entities need authentication, access limits and monitoring, extending identity security beyond employee logins.
Strong revenue was not enough for Zscaler and SentinelOne
Zscaler reported fiscal third-quarter 2026 revenue growth of 25% year over year, while ARR also increased 25%, according to the company. The figures reflected continued demand for cloud-delivered security services, yet Zscaler shares fell more than 30% after the report.
The scale of the decline showed how far expectations had risen for companies viewed as beneficiaries of AI-related enterprise spending. A business can post double-digit growth and still face a severe market reaction if bookings, guidance or other forward-looking measures do not show the acceleration traders had anticipated.
SentinelOne faced a similar, though less extreme, response. The company reported fiscal second-quarter 2027 revenue of $292 million, up 21% year over year, and ARR of $1.218 billion, up 22%. SentinelOne also raised its full-year revenue outlook, according to its earnings release, but its shares fell more than 5% in post-market trading.
The reaction suggests that stronger guidance alone no longer guarantees a positive response. Cybersecurity valuations increasingly depend on whether a company can demonstrate that demand is building faster than it did in prior quarters, particularly as businesses reassess security budgets around AI deployment.
AI agents expand the security perimeter
The sector’s earnings divide comes as AI is changing the systems cybersecurity vendors are asked to protect. Companies are deploying automated agents that can retrieve information, call APIs, trigger workflows, access cloud applications and move data between services with limited human involvement.
That creates a growing class of non-human identities. Unlike an employee account, an AI agent may operate continuously and interact with multiple systems in rapid succession. Organizations need to determine what the agent is, who authorized it, what data it can reach and whether its activity remains within approved limits.
Okta has described capabilities aimed at discovering, registering, controlling access for and managing the lifecycle of AI-related identities. CrowdStrike’s platform approach addresses a related problem: an automated tool may create risks across endpoints, cloud workloads and identity systems rather than within a single security category.
Cloudflare’s second-quarter 2026 results offered another indication of how machine activity could translate into security and network demand. The company reported revenue of $696.1 million, up 36% year over year, compared with 34% growth in the first quarter. Current RPO rose 35%, versus 34% in the prior quarter.
Cloudflare also said its platform surpassed 7.4 million developers by the end of the quarter after adding nearly 2 million developers in three months. That quarterly increase exceeded the roughly 1.5 million net developers it added during all of 2025. The company said more than half of traffic on its network during the quarter was not generated directly by humans.
That traffic does not automatically translate into revenue, but it places Cloudflare’s network and security services close to a rapidly expanding source of internet activity. More automated requests can require performance infrastructure, bot management, API security and zero-trust controls, depending on how customers deploy those services.
Cybersecurity earnings have therefore become less about whether companies are growing and more about the direction of that growth. CrowdStrike’s accelerating net new ARR and Okta’s improving cRPO gave traders measurable evidence of strengthening demand, while the reactions to Zscaler and SentinelOne showed the cost of falling short of increasingly demanding forward-growth expectations.
Want to understand AI’s impact beyond cybersecurity? Explore how tokenized equities are reshaping traditional stock market exposure.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
