Network Security & SASE

In fiscal 2027, the government will strengthen public-private efforts to investigate whether attackers have infiltrated or are lurking within systems, in order to protect critical infrastructure such as power and telecommunications from cyberattacks. It will build detection methods tailored to threat intelligence and share them with private operators. "Threat hunting," which seeks out threats lurking inside systems, is one of the means of active cyber defense under the relevant law that took effect on the same day, and based on specific threat intelligence, the National Cyber Operations Office will reproduce attacks in a virtual environment and build and verify detection methods that the private sector can use. The Ministry of Defense will also leverage the search capabilities cultivated in the Self-Defense Forces' information systems to provide direct support, including visiting critical infrastructure operators upon request, and the National Cyber Operations Office and the Ministry of Defense have included related expenses in their budget requests for fiscal 2027. Behind this is the concern that a shutdown of privately operated critical infrastructure could lead to a national crisis in a contingency, and U.S. authorities estimated in 2024 that a group believed to be backed by the Chinese government, "Volt Typhoon," had maintained access to parts of U.S. critical infrastructure for more than five years. On the other hand, accumulating and analyzing the logs needed for hunting requires manpower and cost, and NTT Data has been conducting threat hunting on its internal systems since 2024, with Yusuke Nakajima, who is in charge of the effort, pointing out that "to expand the activity, we need to show management the cost-effectiveness."

HENNGE, a company engaged in the cloud security business, announced on the 2nd that its change of market segment to the Prime Market has been approved by the Tokyo Stock Exchange. The change from the current Growth Market will take effect on the settlement dates for the new share issuance and secondary offering, October 20 to 22, which are being conducted to meet listing criteria such as net asset requirements. The new share issuance will be 1.1 million shares, with a secondary offering of 1.38 million shares by founder and president Kazuhiro Ogura and others, and an additional secondary offering via over-allotment is also planned. The maximum amount to be raised is 2.363 billion yen, which is planned to be allocated to the main service, advertising and promotion, and hiring.

Quantum Secure Encryption Corp. has appointed Joseph Hall as Chief Intelligence Officer, adding more than 20 years of frontline cybersecurity and threat intelligence experience to the post-quantum cybersecurity company. Hall has held senior roles including Director of Threat Intel R&D at Infoblox, Head of Security Services at Nile, Principal Security Consultant at Fortinet and Chief Information Security Officer at HEROIC Cybersecurity, with earlier security engineering roles at Dell SonicWall, Sophos, Symantec PGP, American Express and Solera Networks. He will work closely with QSE Chief Technology Officer Michael Massing, whose background includes leading Dell SonicWall's Unified Threat Management business unit and helping scale enterprise cybersecurity product lines to approximately $400 million in annual sales. The company also announced the grant of 350,000 stock options to its employees, exercisable at $0.50 per share for five years from the date of grant and subject to certain vesting requirements, plus 350,000 restricted share units that are each exercisable into a common share and expire three years from the date of grant.

Cisco Systems said enterprises are giving AI agents more control over network operations, citing a survey of 1,000 technology leaders conducted by Omdia for Cisco in which the average organization reported roughly 4,100 monitoring events a day. Cisco estimated that clearing the daily network alert backlog by hand would take about 100 specialists, and 86% of respondents favored a single integrated platform, giving the company an opening to sell networking, security and observability together. Shares slipped about 0.4% to $106.265 at 11.25am ET on September 29. That opening still has to turn into sales, with investors needing to see platform bookings, more customers adopting Splunk alongside Cisco products, and faster incident resolution. The chart places Cisco's $106.265 share price 41.93% above its $74.87 GF Value estimate.

Radware Ltd. introduced Radware Agent Trust Management, a new solution designed to help organizations participate more securely in the emerging AI agent economy by facilitating how trusted AI agents interact with their applications. The solution captures an agent's declared intent through active conversation, continuously assesses whether its actions remain consistent with that intent, and controls what agents are permitted to do, moving businesses beyond broad allow-or-block decisions. According to Radware's H1 Global Threat Analysis Report, 77% of organizations are actively deploying or implementing AI agents, yet only 17.2% report full visibility into the AI agents operating within their environments. Radware Agent Trust Management is available now as part of Radware Cloud Application Protection services, extending Radware's bot management capabilities to address the distinct visibility, trust assessment and governance requirements of AI agents. David Aviv, chief technology officer at Radware, said organizations need to be able to embrace this shift while maintaining visibility and control over agent activity.

CyberRatings.org and NSS Labs released the results of their 2026 Cloud Network Firewall evaluation, in which only four of nine tested products earned a Recommended rating. Each of the four Recommended products achieved Security Effectiveness of 99.7% or higher: Fortinet FortiGate Next-Generation Firewall, HPE Juniper Networking vSRX Next Generation Firewall, Palo Alto Networks VM-Series Next-Generation Firewall, and Versa Networks Next Generation Firewall. Check Point CloudGuard Network Security Next-Gen Firewall earned a Neutral rating despite posting the highest Security Effectiveness at 99.95%, because of its above-average price per Mbps. AWS Network Firewall and Microsoft Azure Firewall both received 0% for Security Effectiveness and were rated Caution, while Google Cloud Platform NGFW Enterprise at 77.45% and Cisco Secure Firewall Threat Defense Virtual at 66.10% also placed in Caution. The tests were run under identical conditions using the NSS Labs Cloud Network Firewall Test Methodology v4.1, with evasions tested through 5,004 attacks spanning 43 techniques across OSI Layers 3, 4, and 7.

Hillstone Networks announced that it has set September 29, 2026 as the grant date, awarding 7 million restricted shares to 122 incentive recipients at a grant price of 13.40 yuan per share. In the first half of 2026, Hillstone Networks achieved revenue of 451 million yuan and a net loss attributable to the parent company of 21.12 million yuan.

Zscaler has promoted Ross Tackett to Chief Revenue Officer, succeeding Mike Rich. Mike Rich will remain with the company as a strategic advisor to support the leadership transition in Zscaler's global sales organization. Tackett brings decades of enterprise sales leadership experience from major technology companies to the CRO role. The change puts Tackett in charge of global sales and partnerships as Zscaler pushes for larger multi-year deals and deeper wallet share, including newer AI security and Agentic SOC offerings sold in competition with Palo Alto Networks and CrowdStrike. The company's investment story rests on whether its AI-first, zero-trust security platform and heavy go-to-market spending can translate into durable, efficient expansion, with the article pointing to a $197 fair value for Zscaler.

Fastly, Inc. expanded its Fastly for AI portfolio with AI Runtime Control, AI Firewall, and new API Security tools, giving organizations real-time visibility and control over AI traffic across models, applications, and enterprise APIs on its global edge platform. By unifying AI governance, security, and routing at the edge, Fastly aims to let customers run increasingly complex AI and agent workloads without locking into a single model provider. The company's investment narrative projects $947.9 million in revenue and $76.8 million in earnings by 2029, with a fair value of $27.00, a 9% downside to its current price. Some of the most optimistic analysts were already modeling revenue near US$981,000,000 by 2029. The Comcast partnership remains relevant because it shows how Fastly's edge software can be embedded deeper into a major operator's network for latency-sensitive workloads, including AI inference.

Zscaler launched its Agentic SOC, an AI-first security operations platform that combines proprietary telemetry, a large decoy mesh network, and integrated zero trust controls with third-party tools to detect and contain threats at machine speed. The platform uses AI agents co-developed with Anthropic and OpenAI, trained on a decade of frontline SOC experience and powered by more than 750 billion daily zero trust transactions to automate complex threat investigation and response. The launch follows the June expansion of Zscaler's Zero Trust SASE with the ZAgent Framework and new browser, endpoint, and cloud controls, both moves deepening Zscaler's role as an integrated security and AI operations platform. Zscaler's narrative projects $5.1 billion revenue and $132.0 million earnings by 2029, yielding a $196.95 fair value, a 6% downside to its current price, while some of the lowest estimate analysts assume revenue of about US$5.2 billion and earnings near US$50 million by 2029 and worry that acquisitions and aggressive AI investment around Agentic SOC could keep margins subdued even if topline keeps growing.

Bernstein analyst Peter Weed raised his price target on Zscaler to $298 and maintained an Outperform rating on September 17, implying roughly 46% upside when the call was published, while downgrading Palo Alto Networks and several other cybersecurity names to Market Perform. Bernstein framed the split as a valuation call rather than a bet against AI security demand, noting Zscaler entered the call down about 11.5% in 2026 while many peers had rallied. Zscaler reported a 115% dollar-based net retention rate in fiscal Q1, and management later said that level had remained fairly stable for several quarters. Palo Alto's broad platform spans network, cloud and security operations, but Bernstein's downgrade reflects the price investors already pay for that strength, with integration costs, a larger share count and slowing growth comparisons raising the hurdle. Insider Monkey tracked 52 hedge funds holding Zscaler in Q2, up from 46 in Q1, while Palo Alto ownership edged up to 89 funds from 87, and Fisher Asset Management increased its PANW position 2,143% to about 5.8 million shares.

Aviatrix announced Harvest and Decrypt Protection, which it calls the first post-quantum protection that encrypts data and simultaneously governs what a compromised workload can reach, delivering crypto-agile encryption and Communication Governance as one policy in software on the network enterprises already run. The offering arrives a month before federal civilian agencies must file post-quantum migration plans on October 22, and ahead of the 2029 full quantum-readiness roadmaps published by Google and Microsoft; Amazon Web Services publishes no equivalent target. Harvest Protection comes with five free policies to start, with no trial clock and no purchase required, and is free to start for existing Aviatrix customers, with the first five policies and five nodes free with no license and no time limit. Aviatrix said its patented High-Performance Encryption engine removes the throughput trade-off that causes most enterprises to leave cloud transit unprotected, citing one Fortune 5 customer running 400 gigabits per second fully encrypted in production at line rate, and that key establishment on the control plane uses the ML-KEM standard today, with hybrid ML-KEM on the data plane a fast-follow release. The company is working with global systems integrators and security services providers and collaborating with Microsoft on the Quantum Safe program as the network traffic and Harvest Now, Decrypt Later containment solution. Aviatrix also cited deadlines including Executive Order 14412, which sets December 31, 2030, for post-quantum key establishment and December 31, 2031, for digital signatures on high-value assets, and said enterprises can begin with a free Containment Assessment that returns a provisional Blast Radius and harvest exposure read in about five minutes.

Zscaler's Security for AI bookings rose more than 50% sequentially in the fourth quarter of fiscal 2026, with AI Protect bookings crossing $100 million over the trailing 12 months. About 70% of Security for AI deals in the quarter also included Data Security, and the company introduced Zero Trust Exchange for Agents and Endpoint AI Security, which are expected to scale in the second half of fiscal 2027. Zscaler reported fourth-quarter revenues of $898.2 million, up 25% year over year, while annual recurring revenues rose 25% to $3.77 billion, though fiscal 2027 revenue guidance implies growth of about 17%. Rivals are expanding too: Palo Alto Networks' Prisma AIRS reached about $120 million in ARR within roughly a year of general availability and exceeded 800 customers, while CrowdStrike's AIDR ending ARR nearly tripled from the first quarter. ZS shares have plunged 12.3% year to date, and the stock carries a Zacks Rank #3 (Hold).

Cloudbrink introduced OnGuard technology that extends a single Cloudbrink security and connectivity policy across users, devices and machines, taking aim at complex multi-product enterprise security stacks. The expanded platform gives enterprises an alternative to deploying and managing separate Cisco products for secure access, internet security, AI security and remote connectivity, consolidating ZTNA, Internet Security, Secure Web Gateway and AI security into one offering. OnGuard allows policy enforcement to begin when a device itself comes online, even before a user logs in, and to continue independently of the user session, with features including instant OnGuard availability, admin authorization, admin session termination, centralized visibility and selective policy control. CEO Prakash Mana said a single Cloudbrink platform can eliminate a significant portion of the Cisco secure-access stack, arguing that Umbrella, AnyConnect, Secure Access and AI Defense still force enterprises to manage multiple technologies, policies and operating models. The expansion builds on existing deployments, including at one U.S. insurance company where Cloudbrink replaced an environment that included Cisco AnyConnect and Fortinet, moving 300 employees on the first day and more than 600 during the first week, after which remote-connectivity support calls "pretty much disappeared," according to its VP of IT.

Fortinet has opened a new company-owned Innovation Hub in New York City, a 40,000 square foot facility valued at US$60 million that expands its U.S. footprint. The site houses advanced cybersecurity training labs, executive briefing spaces, hands-on technology demonstration areas, and a dedicated Fortinet Cloud point of presence, along with energy-efficient infrastructure aligned with the group's ESG priorities. Fortinet said the hub concentrates its experts, training and a Fortinet Cloud PoP in a single venue, supporting its push toward more software, subscription and services revenue. The company added that the larger executive briefing and demo footprint in a financial hub gives it more surface area to pitch platform-wide deals rather than single products. Fortinet noted the expansion adds to its global data center and PoP footprint while helping its integrated Security Fabric story, though it cautioned that higher fixed costs only work if SASE, cloud and large enterprise wins scale fast enough to offset earlier margin pressure.

F5 is expanding deeper into application and AI security with new Distributed Cloud Bot Defense features and Workforce AI Security, tools designed to monitor devices, score risk in real time, and govern AI-driven activity. The launch comes as F5 shares have climbed 4.71% over one day and 10.59% over seven days, with a year-to-date share price return of 67.90% against a one-year total shareholder return of 33.10%. F5 last closed at $430.88, just below the most widely followed fair value estimate of $436.10, which uses an 8.81% discount rate, leaving only a thin valuation cushion. The stock trades at a P/E of 33.6x, above the US Communications sector at 33.2x and above an estimated fair ratio of 27.8x. Early deployments of F5's AI-focused offerings, including AI data delivery, AI gateway, and runtime security, along with partnerships with NVIDIA BlueField-3 and MinIO, are establishing new insertion points for the business, though the bullish narrative could appear stretched if hardware-heavy demand persists or hyperscalers keep more security and delivery in house.

Nokia Oyj is supplying 800G coherent pluggable optics to Telxius as the company upgrades the international terrestrial transport networks connecting its subsea cables, while ESpanix in Spain is deploying Nokia Deepfield Defender to power a new DDoS protection service for internet exchange customers. The two deployments are separate pieces of Nokia's broader telecom and security business rather than a single combined contract. Telxius plans to use Nokia optical technology to scale bandwidth and capacity on routes supporting its global subsea infrastructure. Nokia's profit margin stands at 3.4%, down from 5% a year earlier, leaving investors watching whether heavier AI and security workloads convert into higher quality earnings. The key marker over the next 12 to 24 months is the number of clearly disclosed commercial deals citing these 800G and Deepfield deployments as live, scaled services across Europe, the United States and Latin America.

Nokia has expanded its network security business in Spain by deploying its Deepfield Defender solution across the Madrid and Barcelona platforms of ESpanix, the country's largest Internet exchange point. The deployment extends Nokia's distributed denial-of-service protection technology to more than 200 national and international networks connected to ESpanix. Nokia's technology combines AI-powered network analytics with its Deepfield Secure Genome security intelligence to detect and mitigate DDoS attacks within seconds, delivering protection directly within network infrastructure so ESpanix can mitigate attacks without redirecting traffic to external scrubbing centers, keeping Spanish Internet traffic and security operations within the country. The move expands Nokia's existing relationship with ESpanix and demonstrates the scalability of its Deepfield portfolio across multiple networks through a single Internet exchange platform. Nokia faces competition from Ericsson, which is incorporating Zero Trust principles and AI-driven security into 5G and next-generation network operations, and from Cisco Systems, which is expanding its AI-powered cybersecurity portfolio across networks, cloud environments and applications.

SE Labs announced the first public evaluation under PIVOT, its advanced security testing programme, with Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos confirmed to take part. Results will be published in early 2027 and will include a comparative analysis of the participating products, detailed findings from the attack scenarios and SE Labs' inaugural public PIVOT Rankings. The evaluation arrives as several major vendors have stepped away from MITRE Engenuity ATT&CK Evaluations, reducing the number of leading products assessed through what had been one of the industry's most prominent common sources of technical evaluation data. PIVOT follows complete attack chains to show what happened during an attack, how far an attacker progressed, what defenders could see and understand, and how those outcomes compare across competing products, rather than stopping at evidence of what a product detected. Simon Edwards, CEO and founder of SE Labs, said the underlying evidence will be made available to Gartner and Forrester so their analysts can examine it and add their own independent interpretation.