Wall Street spent most of 2025 obsessing over AI. JPMorgan thinks 2026 belongs to something decidedly less sexy but far more profitable: cybersecurity. While generative AI companies wrestle with the awkward question of how to actually make money, security budgets remain locked in place, setting up Palo Alto Networks Inc. (PANW) and Zscaler Inc. (ZS) as clear winners.

Security Spending Isn't Optional Anymore

Here's what changed: cyber risk has climbed into the top three threats facing companies over the next year, according to PwC's CEO survey. It now ranks ahead of technological disruption and labor shortages, which tells you everything about how boardrooms are thinking about this stuff.

That elevation matters because cybersecurity spending isn't driven by optimism or hype. It's driven by necessity. Companies might debate the ROI on their AI experiments, but nobody questions whether they need to protect their networks. JPMorgan notes this creates real resilience in the sector, even as other tech budgets face scrutiny. Security remains a non-negotiable line item tied directly to operational and reputational risk.

The Numbers Back It Up

That resilience shows up clearly in JPMorgan's Rule of 40 and Rule of X analyses. From early 2024 through late 2025, cybersecurity companies improved their growth-plus-margin profiles while maintaining valuation premiums that other software sectors couldn't defend.

In a market environment where multiples got crushed for companies that couldn't translate growth into actual profits, the cyber leaders largely held their ground. That's not just narrative, it's performance.

Why These Two Names Stand Out

Within the broader cybersecurity space, JPMorgan specifically highlights Palo Alto Networks and Zscaler as particularly well-positioned. Palo Alto is viewed as a long-term share consolidator across SecOps, SASE, and cloud security, with free cash flow margins expected to trend toward 40% over time. That's the kind of margin profile that makes CFOs very happy.

Zscaler, meanwhile, is capitalizing on a structural shift away from legacy network architectures. The company is seeing accelerating growth, improving backlog trends, and rising sales productivity, all of which support further upside from here.

As we head into 2026, cybersecurity's investment case is refreshingly straightforward: it's growth that actually clears the quality bar, backed by spending that companies can't afford to cut.