Sean Kenney: Artificial intelligence is changing cybersecurity from both directions. Enterprises are deploying more autonomous systems internally, while cyber criminals can use the same technology to move faster and at a greater scale to attack. Today, I'm joined by David Corn, a cyber analyst at MFS, and we'll discuss these trends and how it's impacting security spend. We'll also talk about why David believes network security and identity security are two areas of opportunity for long-term investors. So David, thanks for joining me.

David Corn: Thank you so much for having me.

Sean Kenney: AI is impacting and transforming and disrupting many industries. There's a lot of talk about agentic really from a positive perspective, the efficiencies and the productivity gains that agentic solutions will create, but it creates a bit of a different puzzle for enterprises from a cyber perspective. Can you talk a little bit about that?

David Corn: Yeah, absolutely. So I think, like I said, we hear a lot about the positive side of AI. Luckily in my seat, I get to learn about more of the scary stuff that goes on behind the scenes that enterprises are dealing with. And so I think AI is creating one of the more significant changes we're seeing in cybersecurity in quite some time. And so if you just look historically, we've had multiple waves of investment cycles of cyber. We've had the on-prem to the cloud transition. We saw an introduction of what's called zero trust security. Then we had work from home during post-COVID, and now we're having the introduction of AI and agentic solutions into enterprise environments.

And so the reason why this is essentially creating new challenges for enterprises, it's really twofold. So first, AI is making cyber attacks faster, but it's also making it less expensive for attackers to potentially infiltrate enterprises. So overall, what this is doing is increasing the amount, the volume of potentially new attacks, but also creating the risks are also increasing as well. The second piece of this as well is as agents get introduced into production environments within enterprises, not only are the risks potentially from external actors, it's also from internal actors, as these agents themselves now are a new security threat that need to be monitored and governed.

Sean Kenney: So let's unpack that internal/external piece for a minute. If we focus on the internal piece, one of the big topics of conversation in the news flow has been the Hugging Face incident, which is an example of an internal trusted agent that somewhat went rogue. But can you unpack the risk that internal agents are creating for enterprises?

David Corn: Yeah. So if you think about an internal agent and what it is, just think of it as very similar to a virtual identity or a non-human identity. So when you think about enterprise security today, traditionally the way it's worked is me and you, we have a login. We log into an application, we log into a database, we create a task and then we can log off and shut it off, and that's kind of the end of that. With an agent, they're constantly communicating with internal databases. They're constantly communicating with third-party cloud networks or third-party websites, for example.

And so they need to be essentially governed, very similar to the way that me and you and traditional humans are governed inside an enterprise. So they need a unique identity, they need unique access controls to different assets within a corporate network, and then they need also ability to be governed, to understand, okay, this agent should only have access to this specific asset for a specific amount of time, and then after that, that agent should be essentially disbanded or shut off. And then you need a way to essentially enforce that.

Sean Kenney: And so on the internal side, there's clearly this risk. Talk to me about the external side. I mean, obviously there's been cyber criminals for a very long time, but now they're deploying AI agents to accelerate their speed. What are cyber vendors doing to bolster the defenses against these more sophisticated attacks?

David Corn: Yeah. So essentially the way cyber vendors are responding today, it's very similar to what they have in the past using techniques such as red teaming, so using new AI tools to essentially try to hack themselves, understand their own vulnerabilities across their defense networks, and typically that's one of the best practices that these vendors are doing. And now through some of the new releases with Anthropic, for example, using the Mythos model, where now we can actually take that unique model and scan essentially and identify a mass amount of new vulnerabilities that were before previously undetected.

And so what this is allowing us to do is identify which areas need to be patched, new vulnerabilities that have been identified that haven't been done before, and then we can actually find those holes that are in our networks and now go ahead and prioritize and remediate.

Sean Kenney: Okay. I mentioned in the intro and we've talked about network security is one of the areas of opportunity that you see for long-term investors. And is the real advantage having a great security product, or is there compounding advantage to being able to look across the systems of these cyber vendors?

David Corn: Yeah. So I think there's actually, it's an interesting point. So one of the terms we're seeing kind of thrown around more broadly in this space today is platformization. And so for years in the cyber industry, we've heard talks about consolidation. Enterprises can use upwards of 100, 150 different vendors. In reality, they would like to bring that down to 15 to 20, to a more manageable number, because we don't have enough security analysts to essentially identify all the different scans and threats that are being identified.

And so with platformization, one of the benefits you're getting here is you can essentially consolidate different scans or different alerts from your endpoint, from your cloud, from your network, from your web browser, and essentially consolidate those behind one pane of glass into your security operations center, and then be able to identify threats more rapidly but also act and respond more rapidly.

And so that's the benefit of having one consolidated platform, is just the speed to identify and speed to remediate is a lot quicker versus having 10, 15, 20 different products and having to basically go to one alert, identify that, correlate that with other alerts to make sure it's a real threat, and then figure out how to respond.

Sean Kenney: So this platformization theme has been going on for a while. It sounds like this agentic era is accelerating that.

David Corn: Yes, absolutely.

Sean Kenney: Now, if you think about being a platform player, I'm assuming you're going to be in acquisition mode or in serious R&D mode, but more likely in acquisition mode. Is that right?

David Corn: Yeah, absolutely. I think we've seen a lot of that so far over the past couple years. And so one of the big acquisitions we've seen is Palo Alto acquired a company called CyberArk, and that got them into identity management or specifically privileged access management. And so from Palo Alto, they've kind of been at the forefront of this platformization push. And so they've built out unique individual pillars across endpoint, across cloud, across network, now identity, but also as well as security operations. So they have the most robust platform on the market today, and their pitch or their sell is essentially going to customers and saying, "We can consolidate your vendors. You have one throat to choke now. You have better data, better telemetry, and now you can respond quicker to threats."

Sean Kenney: How important is being that platform of choice? As you look at comparative advantages and moats, how important is being that acquirer of choice?

David Corn: It's definitely important to have a robust platform, but having a platform alone isn't the end-all, be-all. It's really how that platform acts together as one. If it's individually siloed products that are being stitched together, whether through APIs or other means, it's really not as effective because the data isn't sitting in one singular database. So you could have five or ten different products and call it a platform, but really it's just a bundle and it's unique products, unique databases, all not really communicating to each other. And in those situations, you really lose that advantage that we talked about earlier of having a robust, tightly-integrated security system or security offering.

And so that also opens the door to still best of breed has always been, and I think always will have a place in security, just given we always have continually evolving threats, so there's always the next threat that you have to be able to solve for and there's always going to be an up and coming VC startup firm that can move quicker with better technology. And then typically what happens, they'll get acquired into kind of a broader platform and the bigger players will use that as a form of external R&D.

Sean Kenney: Okay. And so if you're a specialist, a point solution, can you win in this market, or is it essentially you're destined to be acquired?

David Corn: Yeah. No, you can definitely still win as a point solution, but you really need to be able to prove to your customer and prove your value primarily around having a better threat detection environment, a better remediation solution, or you have to have a better R&D roadmap where it's like, "Okay, we may be a point product today, but here's our R&D roadmap. This is how we plan to build out more capability sets, and this is where we're going over the next three to five years. Join us on that journey." And so you really need to have a good messaging around it.

So there's definitely still always going to be an opportunity for point solutions. I think the attractiveness of a broader platform today, especially from a CISO suite, is budgets aren't unlimited. And so if you can basically go to one vendor and have them consolidate 10, 15, 20 legacy products, have a better security solution but also at a cheaper price, that's a very attractive proposition to many CISOs.

Sean Kenney: Knowing that network security companies are in what seems like a secular growth industry and there's a lot of really great companies in that industry, how do you evaluate the difference between a great company and a great industry from a great stock?

David Corn: Yeah. I think that's really the big question. So the things we like about cybersecurity companies holistically is it's a very sticky product once you're in because the switching costs are super high, primarily because you can go to a new vendor and if it's not a trusted vendor, someone you haven't worked with over 10, 15 years, there's always a risk of a breach and a hack. And so the switching costs are very high, and usually the main drivers of switching is if there is some sort of incident or a breach, that kind of a catalyst to bring in new vendors for an RFP process.

And so within network security or security as a whole, one of the things that separate a great stock from what we know already today is a great secular growing industry is really the expectations embedded in what that price is today. Yes, we all know that security budgets are going up. AI is driving an increase in TAM in its TAM expansion area, but is that being reflected in the multiples or the price we're paying today? And what does that look like on a risk-adjusted basis over the next five years?

Sean Kenney: Okay. We can talk a bit about how you work with the team to do that in more detail as we go along, but I want to shift a little bit to identity security. Can you spend a minute? We talked about it being an area that you think is an opportunity for long-term investors, but spend just a minute describing the identity security landscape.

David Corn: Yeah. So essentially, the thing that identity security does at a super high level, it kind of verifies who's logging in to any system, for example, and then it's continually governing what access or permissioning that individual or that machine may have once they're logged into an environment. So super high-level, think about it as we swipe into our building using our security badge. That's a form of identity security, but so take that and apply it to a virtual environment with software, and that's what identity is doing.

Sean Kenney: Okay. And I've heard you talk about three layers of identity security. Can you talk a little bit about that?

David Corn: Yeah, sure. So the first high level is identity access. So this is essentially knowing exactly which human, which agent or which machine is calling a system, and whether or not that person, that machine, that object can have permissioning to access that system.

The second piece of identity platforms or identity systems is authorization, so that's essentially deciding. I may be able to call a database, but do I have permissioning to actually access that database? And even if I have permission to access that database, one step further is do I have permission to overwrite or modify the underlying data within that database? So that's number two.

And then number three is just the governance layer on top. So think about this as essentially a layer that allows me or constantly evolves. As I change jobs, if I leave the company, it essentially will update my permissioning in my identity stack to be able to modify that. So if I leave, I don't still have access to the company's databases or things like that.

Sean Kenney: Okay. So access management, privileged access and governance, those three layers. In an agentic era, is there more strategic value for a company in one of those three, or are all three created equal?

David Corn: I think all three are created equal, but I think all three today are more attractive in an agentic world because of just how fast everything is moving, and you need the ability to not only ... today, with enterprises potentially deploying thousands of agents into their environments, a lot of times they don't even know how many agents are there. So you need to be able to first identify how many agents are operating in your environment, who's essentially in charge. Assign those agents to an individual to oversee and then give them permissioning. Do they have that same permissioning level as you and me? Do they have unique permissioning, is it constant, and being able to continually monitor that. So I think having just one layer today isn't necessarily as effective in an agentic world.

Sean Kenney: In the news flow, it feels like identity security is one of the main topics of conversation.

David Corn: Yes.

Sean Kenney: Why do you think that is?

David Corn: Well, at the end of the day, identity is becoming essentially the new control plane for all of security because of the agentic use cases. Each agent needs to be, like I said, needs to be authorized, continually monitored, and understanding not only what do they have access to, but also have runtime permissioning and runtime analysis to determine why they're completing a specific task. And if we can identify where an agent potentially may go rogue or may complete a task in a way that we don't find is appropriate, be able to essentially terminate that agent in real time.

Sean Kenney: So as you're evaluating companies, how do you know that a company is truly differentiated, if they're great at one of those three layers or do they need to invest in the other two layers? How do you differentiate between companies?

David Corn: So I think there's a couple different ways. I think the easiest way is to just speak with customers themselves, understand. Really go into the field, do kind of the boots on the ground type work and really understand, from a buyer of these products, what differentiates them. Oftentimes it's the breadth of the product, it's the capability set. It's the R&D roadmap, where are they going. Are they investing behind the products and going to where the customer needs them to? But also at times it's the implementations, the professional services help that goes along with that as well, for the customer to truly know they have a partner with them in their security journey.

So there's a lot of different ways and you can track this, and I think the best way still continues to be kind of the boots on the ground-type research, speaking with customers, speaking with vendors, speaking with implementators to really understand how they're evaluating the products.

Sean Kenney: You mentioned some signals like product breadth, for example, but are there core signals that you look at that give you confidence in a company?

David Corn: Yeah. So you can look at different metrics that companies will report around net revenue retention to understand that if a customer is buying $10 worth of product today, what does that look like next year. Are they going to 15 or are they going to five? And so understanding if a company's reporting kind of expanding net revenue retention, clearly customers are buying more product and expanding with that vendor, so that kind of gives more credence to the platform approach.

And you can also correlate that with overall module adoption. So a lot of times companies will report, "We have X amount of customers that are using five out of ten products or seven out of our ten products," and just constantly tracking how that's expanding over time. And so I think those are some of the easier ways you can track to make sure that a company is really differentiated, because if it's more of a point solution or a legacy product, you're going to see kind of lower rates of net revenue retention and expansion use cases. You're not going to see as broad adoption of different modules. And those are kind of the two clearest ways that we can look at it from the outside.

Sean Kenney: Okay. So you look at the KPIs that we mentioned, you validate that boots on the ground, talking to customers, talking to the company. How do you assess whether a product has a durable advantage, or in this era of platformization, that they can't just be replicated by a platform?

David Corn: Yeah, I think that's the question we're trying to ask ourselves and we're asking these companies every day. And I think it really boils down to, do they have a differentiated approach to providing a better security offering. And so is that a unique technology? Is that a unique go-to-market solution where they can get in front of more customers, and then because they have greater data, greater distribution, it makes the product potentially better?

And so when identifying a platform versus a point solution, like I said, you really just need to have a better form of data ingestion, better form of security offering, lower cost potentially, without sacrificing the overall effectiveness of the product. Those are kind of different ways where I think point solutions can still differentiate versus platform.

Sean Kenney: I would imagine, given the complexity of this mosaic you're putting together, there's the data that the company's reporting, there's the fact checks, talking to customers, but there's also likely value in working across an integrated platform with your peers. Is there an example you can point to, or how do you think about research and working together across the research platform?

David Corn: Yeah. So in cyber specifically, because it touches so many different layers of the tech stack, I often find myself working with our networking analysts, our cloud analysts, our infrastructure analysts, because each one of these different layers of the tech stack all have unique security environments and unique security needs that these companies are trying to solve. And so when we think about the MFS platform and the broader tech sector team, I've worked very closely with each of these different analysts themselves to understand what's evolving in their space, what are they seeing, what are they hearing from customers about unique threats from not just agentic security, but it could be any form of new vulnerability threat. And then how are the companies that I'm looking at, how are they reflecting that in their product roadmap and in their broader platform?

Sean Kenney: Okay. So maybe in the last few minutes here, as we look forward, there's clearly risks with agentic solutions. Cyber security companies are benefiting from that increased spend. How would you classify these increased revenue pools that are available to cyber companies?

David Corn: So I think the biggest opportunity for cyber companies is trying to move from a traditional SaaS, seat-based, headcount-based model into a form of consumption or outcome-based pricing, and this can kind of take multiple different paths depending on which area of the cyber landscape you play in. So for example, in network security, there's talks about trying to find ways to monetize the actual volume of agentic traffic going across that network. So essentially using it as a meter, almost like a toll booth, if you will, for agent traffic on corporate networks and then monetizing that.

Within the identity space, for example, it could be on a per agent basis. It could be on a permission basis or a per task basis that they're looking to monetize. So it's really not just going to be a traditional one agent, one dollar of revenue. They're looking for an outcome-based or a value-based pricing model, just given how broadly distributed agentic use cases could be across an enterprise.

Sean Kenney: And this trend of platformization across network and identity, I would imagine one of the biggest risks is the company's ability to integrate.

David Corn: Correct.

Sean Kenney: So you go out, you acquire a new VC-backed startup that has this great new solution. How do you think about assessing a company's ability to integrate new technologies across the platform?

David Corn: Yeah, so the integration piece is super critical, especially in the broader platformization context, because like I said, just having multiple products and bundling it and selling it isn't a true platform. They need to be tightly integrated, have similar databases be able to be operated from one user interface, one control plane of glass. And so to be able to evaluate that, it's really just trying to understand and speaking with those companies. Okay, what is the actual roadmap? What is the key milestones over the next three, six, nine, twelve months as you integrate this product?

And not just from a tech backend perspective or a tech stack perspective, but also from a customer integration perspective, which oftentimes I don't think is being addressed enough, because a lot of times these customers often, they didn't choose to do business with you originally, so they want to understand why. "Now that you acquired this company, this partner I was working with before, what are you going to do for me now? How are you going to meet my needs or my unique needs?" And so I think that piece needs to be also discussed or focused on as well.

Sean Kenney: How do you assess the revenue pools? So there's a new revenue pool that seemingly companies can go acquire and get access to. You mentioned this TAM expansion area going to the agentic era. How do you develop confidence in the duration of that revenue pool, and that it won't either get competed away or that it's actually durable into the future?

David Corn: Yeah, so I think that's a great question. And so I really think, when analyzing or trying to understand the durability of growth, the durability of these new TAMs or revenue pools, it really comes down to just trying to understand what does that threat environment look like and how are enterprise budgets going to respond. So at a high level, if we just think about, simplistically, does agentic introduction into enterprise networks create more or less risk, and is that level of risk more severe or less severe than it was before agentic use cases, and if the answer to that is yes, clearly more budget has to be allocated towards cyber. And so that's a net benefit for overall TAM expansion.

But then also taking that kind of a step further is within the cyber budget pool, which areas are net gainers and net losers? And then understanding from there, why. So that's the areas we talked about already. Identity, network security are two of the kind of higher-level or more well-positioned environments within security that should see net budget expansion, net budget share gain opportunities in an agentic world.

Sean Kenney: Okay. Last question. There's so much news flow, so much information coming at you, I'd imagine, as a cyber analyst. How do you stay current on all of it? Are you just reading the paper? I would imagine not, but how do you stay current, you and the team stay current on all these things and also look through the noise, what's the noise versus where are the actual investment opportunities?

David Corn: Yeah. So I think, like I say, the best way to filter out the noise is really to understand what's going on. What are the practitioners seeing? What are they discussing? So that's specific network engineering blogs or online forums, or going to specific cyber user conferences. So not an investment-related conference, going to cyber professional security analyst conferences and speaking with actual practitioners. What are they seeing? What are they hearing? How are they reacting? How are they responding to the evolving threat? What keeps them up at night? I think that type of information, that type of due diligence, is oftentimes significantly more valuable than reading a financial article about, high-level, what's happening in cybersecurity.

Sean Kenney: Yeah. Okay. Well, I'm going to attempt to summarize what we talked about. Maybe three core takeaways for our listeners, the first being clearly the agentic era is here. It's a huge topic of interest for most companies and they're implementing agents, and that is creating a bit of this super cycle for cyber companies and increased cyber spend. Is that right?

David Corn: Yeah, absolutely. I think agentic brings a whole different threat vector into corporate enterprises, and so it's important to remember that this isn't necessarily cannibalistic. This is TAM expansion area. It's a brand-new revenue opportunity for the cyber vendors.

Sean Kenney: And within cyber more broadly, the second takeaway would be, from your perspective, network security and identity security seem to be the two most compelling investment opportunities that you're seeing?

David Corn: Yeah, absolutely. I think that's correct.

Sean Kenney: And then maybe finally, we talked about the winners and losers, right? And while it could be a great company and a great industry, it doesn't necessarily make it a great stock, so selectivity will continue to matter. Understanding how companies are integrating new technologies into their platform and expanding their businesses will be critical.

David Corn: Correct. Yeah, absolutely. Like I said, we all understand or have a view that cyber clearly is a secular growth industry within the broader tech landscape. However, really where our job is today is trying to identify a great business or a great industry versus a great stock. And oftentimes you can find the best stock opportunities in potentially the underloved security companies, or maybe they're not the fastest growers, but they have a new product roadmap or a new product cycle or are making kind of a step function change from an operational perspective, and combining that with low expectations can drive better five-year stock returns versus kind of the high flyers or the better businesses.

Sean Kenney: All right. Well, David, thank you. You made a very complicated topic even interesting and understandable to me. So well done and thank you for that. And thank you for listening to All Angles. If you enjoyed this episode, subscribe so you don't miss any future episodes. And until next time, be sure to consider your investment decisions from all angles.

Distributed by: U.S. – MFS Institutional Advisors, Inc. ("MFSI"), MFS Investment Management and MFS Fund Distributors, Inc., Member SIPC; Latin America – MFS International Ltd.; Canada – MFS Investment Management Canada Limited.; Note to UK and Switzerland readers: Issued in the UK and Switzerland by MFS International (U.K.) Limited ("MIL UK"), a private limited company registered in England and Wales with the company number 03062718, and authorised and regulated in the conduct of investment business by the UK Financial Conduct Authority. MIL UK, an indirect subsidiary of MFS®, has its registered office at One Carter Lane, London, EC4V 5ER.;  Note to Europe (ex UK and Switzerland) readers: Issued in Europe by MFS Investment Management (Lux) S.à r.l. (MFS Lux) – authorized under Luxembourg law as a management company for Funds domiciled in Luxembourg and which both provide products and investment services to institutional investors and is registered office is at S.a r.l. 4 Rue Albert Borschette, Luxembourg L-1246. Tel: 352 2826 12800.  This material shall not be circulated or distributed to any person other than to professional investors (as permitted by local regulations) and should not be relied upon or distributed to persons where such reliance or distribution would be contrary to local regulation; Singapore – MFS International Singapore Pte. Ltd. (CRN 201228809M); Australia/New Zealand - MFS International Australia Pty Ltd ("MFS Australia") (ABN 68 607 579 537) holds an Australian financial services licence number 485343. MFS Australia is regulated by the Australian Securities and Investments Commission.; Hong Kong - MFS International (Hong Kong) Limited ("MIL HK"), a private limited company licensed and regulated by the Hong Kong Securities and Futures Commission (the "SFC"). MIL HK is approved to engage in dealing in securities and asset management regulated activities and may provide certain investment services to "professional investors" as defined in the Securities and Futures Ordinance ("SFO").; For Professional Investors in China – MFS Financial Management Consulting (Shanghai) Co., Ltd. 2801-12, 28th Floor, 100 Century Avenue, Shanghai World Financial Center, Shanghai Pilot Free Trade Zone, 200120, China, a Chinese limited liability company registered to provide financial management consulting services.; Japan - MFS Investment Management K.K., is registered as a Financial Instruments Business Operator, Kanto Local Finance Bureau (FIBO) No.312, a member of the Investment Trust Association, Japan and the Japan Investment Advisers Association. As fees to be borne by investors vary depending upon circumstances such as products, services, investment period and market conditions, the total amount nor the calculation methods cannot be disclosed in advance. All investments involve risks, including market fluctuation and investors may lose the principal amount invested. Investors should obtain and read the prospectus and/or document set forth in Article 37-3 of Financial Instruments and Exchange Act carefully before making the investments. For readers in Saudi Arabia, Kuwait, Oman, and UAE (excluding the DIFC and ADGM). In Qatar strictly for sophisticated investors and high net worth individuals only. In Bahrain, for sophisticated institutions only: The information contained in this document is intended strictly for professional investors. The information contained in this document, does not constitute and should not be construed as an offer of, invitation or proposal to make an offer for, recommendation to apply for or an opinion or guidance on a financial product, service and/or strategy. Whilst great care has been taken to ensure that the information contained in this document is accurate, no responsibility can be accepted for any errors, mistakes or omissions or for any action taken in reliance thereon. You may only reproduce, circulate and use this document (or any part of it) with the consent of MFS international U.K. Ltd ("MIL UK"). The information contained in this document is for information purposes only. It is not intended for and should not be distributed to, or relied upon by, members of the public. The information contained in this document, may contain statements that are not purely historical in nature but are “forward-looking statements”. These include, amongst other things, projections, forecasts or estimates of income. These forward-looking statements are based upon certain assumptions, some of which are described in other relevant documents or materials. If you do not understand the contents of this document, you should consult an authorised financial adviser. Please note that any materials sent by the issuer (MIL UK) have been sent electronically from offshore. South Africa - This document, and the information contained is not intended and does not constitute, a public offer of securities in South Africa and accordingly should not be construed as such. This document is not for general circulation to the public in South Africa. This document has not been approved by the Financial Sector Conduct Authority and neither MFS International (U.K.) Limited nor its funds are registered for public sale in South Africa.

69617.1