Microsoft (MSFT.US) experienced widespread service disruptions, and the US stock cybersecurity sector responded higher before the market

The Zhitong Finance App learned that due to widespread service interruptions at Microsoft (MSFT.US) — many services, including Outlook and Teams, were unable to be used properly for several hours — cybersecurity stocks rose in the premarket on Friday. As of press release, Palo Alto Networks (PANW.US) is up more than 3%, CrowdStrike (CRWD.US) and Okta (OKTA.US) are up nearly 3%, Rubrik (RBRK.US) is up more than 2%, FTNT.US (FTNT.US) and SentinelOne (S.US) are up nearly 1%, while Microsoft is down nearly 2%.

According to reports, Microsoft's Outlook, Teams, and Copilot services have not been restored more than 12 hours after the failure occurred, affecting the operations of enterprises, individual users, and some government departments. This was one of the company's longest-running service outages. Microsoft attributed the failure to a server issue and said there was no evidence of malicious activity. Microsoft said that after introducing repair measures on a wider scale and making efforts to restore services, the company has observed signs that the operation of the system is stabilizing.

The development of AI technology and the upgrading of cyber attacks are boosting the cybersecurity sector

The widespread interruption of Microsoft services (although the company said there was no evidence of malicious activity) and the rise in cybersecurity stocks before the market on Friday highlighted the company's high dependence on cloud office platforms and the stability of digital infrastructure. Judging from the performance from the beginning of the year to date, cybersecurity stocks have become one of the segments with outstanding performance in the US technology sector in 2026. According to the data, the cybersecurity-themed ETF First Trust Nasdaq Cybersecurity ETF (CIBR) has accumulated a cumulative increase of more than 35% during the year, clearly outperforming the Nasdaq 100 Index's increase of about 12% during the same period.

In terms of individual stocks, since the beginning of the year, Palo Alto Networks has risen by more than 75%, CrowdStrike by more than 96%, Okta by more than 111%, Rubrik by 44%, Feita Information by more than 63%, and SentinelOne by nearly 49%.

The development of AI technology and the escalation of cyber attacks have become the core driving force for the rise in the US stock cybersecurity sector. As the spread of AI applications accelerates, the cyber attack surface of enterprises expands, and threats such as ransomware and identity theft continue to evolve, the demand for cybersecurity products and services remains resilient.

The rapid spread of AI is driving cybersecurity requirements in two directions. On the one hand, after enterprises deploy AI models, agents, and cloud applications, the amount of data, systems, and identities that need to be protected continues to increase, and the cyber attack surface expands accordingly. On the other hand, hackers are also beginning to use AI to improve attack efficiency and make cyber threats more automated and complex. According to the “2026 Global Threat Report” published by CrowdStrike, the activity of attackers using AI increased 89% in 2025. IBM research shows that currently about a quarter of data breaches involve AI technology, and the average loss caused by related incidents is about 6 million US dollars, which is higher than the average loss of 4.99 million US dollars in global data breaches.

The growth in corporate cybersecurity budgets has also provided fundamental support to the industry. According to a survey released by the Boston Consulting Group (BCG) in August this year, 83% of cybersecurity leaders surveyed are increasing cybersecurity spending. Nearly 90% of companies have experienced cyber attacks in the past year, and more than 80% of respondents expect to continue to increase related budgets until 2027. It is worth noting that new security investments by enterprises are gradually being skewed towards fields such as cloud security, data security, and threat intelligence, and more than half of the respondents plan to increase spending in these fields. As enterprises incorporate AI agents, models, and related data into their daily operations, AI system security is also expected to become a new budget growth point.

However, the sharp rise in the cybersecurity sector during the year also meant that valuation pressure could not be ignored. Stock price increases of some cybersecurity companies are already clearly ahead of performance growth, and market expectations for future revenue, orders, and profitability have risen accordingly. Citi previously pointed out that the ratio of corporate value to sales in the cybersecurity sector in the next 12 months will rise to about 22 times, far higher than about 10 times half a year ago. In other words, even if industry demand is still strong, high valuations may amplify stock price fluctuations if the company's subsequent performance fails to exceed market expectations, or if the customer's budget growth falls short of expectations.

Cybersecurity stock financial reports will be released one after another

In terms of financial reporting, investors will focus on the performance of Palo Alto Networks, CrowdStrike, Rubrik, and SentinelOne in the near future. Among them, Palo Alto Networks will announce the results for the first quarter of the 2027 fiscal year after the US stock market on November 18. The market estimates that the company's revenue for the quarter was approximately US$3.31 billion, up about 33.7% year over year; adjusted earnings per share were approximately $0.97. Considering that the company has continued to promote the integration of cybersecurity platforms and increase the layout of AI security products, investors will focus on the growth of orders for platform-based businesses, progress in commercialization of AI security products, and the company's guidance on revenue and billing amounts (billings) for subsequent quarters.

Rubrik plans to announce results for the third quarter of the 2027 fiscal year on November 30. The company expects third-quarter revenue of approximately US$430 million (guidance range of US$429 million to US$431 million), an increase of about 22.7% year-on-year, and adjusted earnings per share of approximately US$0.08 (guidance range of US$0.07 to US$0.09). The company's revenue for the previous quarter increased 38% year over year to reach US$427.3 million; ARR subscriptions increased 33% year over year to reach US$1.66 billion, and various performance guidelines for the 2027 fiscal year were raised. As ransomware attacks and AI-related data risks rise, companies' demand for data backup, recovery, and network resilience solutions continues to grow. Investors will focus on watching their ARR subscription growth rate, free cash flow performance, and full-year guidance.

CrowdStrike is expected to announce results for the third quarter of the 2027 fiscal year on December 1. The market currently expects the company's revenue for the quarter to be approximately US$1.53 billion, an increase of about 23.8% year-on-year, and adjusted earnings per share of approximately US$0.31. The company's previously announced strong second-quarter results, with the addition of ARR reaching a record US$333 million, an increase of 51% year over year; the company also raised the median value of the new ARR growth guide for fiscal year 2027 to a 34% year-on-year increase. Additionally, Falcon Flex's ARR surpassed $2.29 billion, up 101% year over year. Therefore, whether the penetration rate of the new ARR and Falcon Flex business in the next quarter and the annual results guidance can be further raised will be the focus of market attention.

SentinelOne is expected to announce Q3 FY2027 results on December 3. The company's previous third-quarter revenue guidance was US$309 million to US$311 million, with adjusted earnings per share guidance of US$0.08 to US$0.09; revenue guidance for the full year of fiscal year 2027 was US$1.02 billion to US$1.27 billion. As SentinelOne is still in a stage of continuous improvement in profitability, in addition to focusing on revenue growth and customer development, the market will also focus on whether its non-GAAP operating margin, cash flow, and full-year profit guidance can meet or exceed expectations.

As for Feita Information, the company announced its results for the third quarter of 2026 on October 28 — revenue increased 20% year over year to US$2.08 billion, product revenue increased 37% to US$765 million, bill amount increased 29% to US$2.34 billion; non-GAAP earnings per share were US$0.91, and operating cash flow reached US$946 million. At the same time, the company raised its revenue guidance for the full year of 2026, and expects fourth-quarter revenue of $2.55 billion to US$2,245 billion and bill amounts of US$2,775 billion to US$2,925 million. Strong product revenue and bill growth indicate that there is still a strong demand for enterprise cybersecurity infrastructure upgrades.

Overall, Microsoft's latest service interruption has provided a short-term emotional catalyst for the cybersecurity sector, but the medium- to long-term performance of the industry will still depend on whether the security requirements brought about by AI can continue to be transformed into actual corporate orders, and whether leading manufacturers can further expand their market share in the trend of platform integration. For investors, the intensive release of financial reports over the next few weeks will be an important window for testing whether the sector's high valuations can be supported by performance.