Palo Alto Gets a KeyBanc Upgrade as a Microsoft Outage Lifts Cybersecurity Stocks

Cybersecurity stocks caught a bid on Friday from two directions at once. KeyBanc upgraded Palo Alto Networks (PANW), and a widespread Microsoft outage reminded corporate buyers what happens when too much rides on one vendor. In a market where the Nasdaq slid, security names climbed.

Start with the upgrade. As CNBC reported, KeyBanc raised Palo Alto to overweight from sector weight and set a $380 price target, implying nearly 18% upside from Thursday's close. Analyst Eric Heath's thesis is that security budgets are about to speed up.

"We are upgrading shares of PANW to Overweight as we expect security budgets to accelerate through 2027." — Eric Heath, Analyst, KeyBanc

Heath also called Palo Alto a leading beneficiary of the shift toward vendor consolidation, and said it is out-executing many of its cyber peers. That fits the company's platformization pitch: network security, security operations and identity bundled into one relationship instead of a dozen separate contracts.

The stock needed the lift. According to 24/7 Wall St., Palo Alto traded around $333 in morning action, up 3%, but it is still down 16% over the past month. The upgrade looks like an attempt to call a bottom in a name that had lagged its peers.

Then came the outage. Microsoft's Outlook and related services went down around 1 p.m. ET on Thursday, hitting hundreds of thousands of U.S. users, and the problems ran through the Asian business day and into Europe's morning. CNBC reported that Microsoft said at 4:14 a.m. ET Friday it was seeing early signs of stabilization, though service would be variable. The company said it was not aware of any malicious activity behind it.

Microsoft shares fell about 3% in premarket trading, then recovered somewhat. 24/7 Wall St. had the stock at $519.03, down 0.8%, in morning trading. A drop that modest suggests investors see the outage as a short-term problem for a company whose cloud and productivity businesses run deep in corporate America.

CrowdStrike (CRWD) was the cleanest beneficiary. It traded at $237.30, up 3%, and is now up 102% year to date. The logic is simple. Falcon runs across the major public clouds, including Azure, so buyers who just watched a single vendor stumble may start asking whether their security should sit outside it.

CrowdStrike also arrives with real momentum. On Aug. 26, it reported second-quarter fiscal 2027 revenue of $1.47 billion, up 25.8% from a year earlier, along with record net new annual recurring revenue of $332.8 million. CEO George Kurtz called it the best quarter in the company's history, and management raised full-year guidance.

The two stocks have not moved in step lately, which is the interesting part. CrowdStrike is up triple digits for the year while Palo Alto has slid for a month. Both sell the kind of independent platform that enterprises weigh after a Microsoft disruption, so the gap suggests investors have been pricing their execution differently.

The next test is close. Palo Alto reports first-quarter fiscal 2027 results on Nov. 18 after the close, according to earnings calendar data cited by 24/7 Wall St. A strong outlook could support the whole group, while a soft one would test Friday's rebound quickly.

There are reasons for caution. Outage-driven trades tend to fade once service is restored, and 24/7 Wall St. itself calls it an open question whether CrowdStrike keeps its gain after Microsoft fixes Outlook and Teams. An upgrade is also one analyst's view, not a change in Palo Alto's results.

For investors, the practical takeaway is to separate the two catalysts. The outage is a headline that may fade within days. The budget-acceleration thesis behind the KeyBanc call is slower-moving and gets its first real check at Palo Alto's Nov. 18 report. That date is the one to watch.

Bottom line: a Microsoft outage gave security stocks a quick pop. Palo Alto's earnings will show whether the rally has legs.