Jefferies key takeaways from RSA event after meeting with Microsoft, CrowdStrike execs

 Jefferies highlighted key takeaways, including AI adoption, from the RSA cybersecurity conference, where analysts met executives from over 20 companies, including CrowdStrike (CRWD) and Microsoft (MSFT).

"We met 20+ cyber vendors at RSA (covered incl. CHKP, CRWD, MSFT, S, SAIL, TENB and ZS). Overall, sentiment at RSA was positive; publics/privates/experts see AI being implemented this year, but security lags AI adoption & more a '27 story. We see Identity as first to benefit from AI as Enterprises shift to Agentic workflows from LLM [large language model] model usage. SASE [Secure Access Service Edge] is poised to benefit as AI traffic grows (lots of runway left; but competition ramping) & Endpoint sounds healthy," said analysts led by Joseph Gallo.

Check Point Software Technologies (CHKP)

The analysts said they attended a meeting with Chief Product Officer Nataly Kremer, Chief Technology Officer Jonathan Zanger, and Kip Meintzer, head of Investor Relations, and had five key takeaways.

Firstly, the analysts said that Check Point's SASE offerings have closed some of the gap versus competitors (SaaS protection capabilities and unified firewall and SASE management pane), but some gaps remain, and SASE still needs to scale for very large enterprises (a goal for 2026).

Secondly, they said that agents should drive more traffic in private data centers and through firewalls, more Application Programming Interface, or API, calls and more workloads in public clouds and on the endpoint.

Thirdly, the analysts noted that cyber companies have the pricing power to charge per agent, and seat-based pricing is not at risk. Fourthly, they added that code scanning and vulnerability research are most at risk from LLMs. Lastly, the analysts noted that  Check Point's management emphasized that CEO Nadav Zafrir has reinvigorated the culture with new hires, more mergers and acquisitions, or M&A, and a renewed focus on innovation.

Microsoft (MSFT)

The analysts hosted a meeting with Alym Rayani, vice president of Security Integrated Marketing and go-to-market, or GTM, at Microsoft. The analysts said AI deployment is outpacing chief information security officers, or CISOs, who in some cases do not even know what AI is being used by their employees. Organizations tend to fall into one of three categories: having an AI program and responsibly adding security already; having AI and rushing to add security; and employees using shadow AI that the CISO is unaware of, the analysts added.

"This has ultimately led to a significant increase in board-level conversations centered around security. While our partner conversations have not seen a budget inflection, we believe it remains in the near future. The key takeaway is that visibility is the first step toward securing AI, and identity is the key to governing agents," said Gallo and his team.

CrowdStrike (CRWD) 

The analysts attended a meeting with Chief Accounting Officer Anurag Saha and Will Zelver in IR. Key takeaways:

The analysts said next-gen Security Information and Event Management, or SIEM, well-positioned competitively due to first-party data from Falcon and no ingest costs. 

The analysts noted that identity and privileged access controls (SGNL and Seraphic acquisitions) will be material growth drivers, but they see this as more of a fiscal year 2028 story.

In addition, Endpoint security is crucial to safeguard AI workloads, and AI detection and response, or AIDR, is seeing tremendous early interest, exceeding expectations, the analysts noted.

"Overall, commentary was extremely positive, and we remain highly confident in CRWD's ability to deliver vs. its FY27 ARR targets," Gallo and his team added.

Zscaler (ZS)

The analysts attended a meeting with CEO Jay Chaudhry, CFO Kevin Rubin, and Head of IR/Strategic Finance Kim Watkins.

Key takeaways, according to the analysts were: Zscaler remains confident in the trajectory of core SASE business (the company noted no change in competition, although the analysts said they are hearing lots of noise from privates); SecOps product likely to be released in May with benefit to growth more a fiscal year 2027 story; Zscaler's management focused on simplifying the story and helping investors better visualize the growth trajectory at analyst day this summer (the analysts view as a catalyst); and the company remains focused on expanding platform but needs to be in a logical area viewed as core competency.

SentinelOne (S)

The analysts attended a meeting with new CFO Sonalee Parekh, Saad Nazir, head of IR, and Mike Yang from IR.

The analysts highlighted that SentinelOne has room for margin leverage in gross margin, in Sales & Marketing, or S&M, through improved rep productivity, and automation in operating expenditure (margin expansion more backend loaded in FY27).

Gallo and his team added that guidance philosophy likely to be closer to the pin, they see this as largely unchanged versus the prior methodology. In addition, the analysts said that Prompt Security is seeing strong interest and should benefit from cross-selling, noting that there is no reason it cannot be a $100M business.

Lastly, the analysts said that agents make endpoint security more important and are driving better growth in the core endpoint business.

SailPoint (SAIL)

The analysts met SailPoint's CEO Mark McClain, CFO Brian Carolan, and Head of IR Scott Schmitz.

Gallo and his team's takeaways were: Firstly, SailPoint's Fortune 1,000 customers are deploying AI but at a measured pace. Secondly, the company's management expects about 10% of the $350M perpetual and term license installed base to convert this year (might see an increase in the rate of migration).

Thirdly, the competitive environment is stable, and  SailPoint is not seeing pressure from new entrants into identity/governance; and lastly, the Savvy acquisition is contributing nicely (makes onboarding new customers much easier), but it is still early days.

Tenable (TENB)

The analysts visited Tenable's booth with CFO Matt Brown and Head of IR Erin Karney and saw a demo of Hexa AI, the company's AI agent for exposure management, which will be generally accessible soon.

The analysts noted that the product certainly addresses a need, reducing hours of human labor. Notably, Hexa AI is only included in Tenable One, which is a 10% to 80% average selling price, or ASP, uplift from standalone Vulnerability Management, or VM.

"The roadmap is still a work in progress with regard to remediation, but TENB is moving that direction, and we think the sensors and remediation will drive the moat vs large LLMs. This will take time, but the company is hopeful for NRR acceleration (we view this as key for driving the stock performance)," said Gallo and his team.

https://www.msn.com/en-us/money/other/jefferies-notes-key-takeaways-from-rsa-event-after-meeting-with-microsoft-crowdstrike-execs/ar-AA1ZBYwo