---
title: "Citi lifted CrowdStrike to $295 on the vendor's own AI-attack reporting; October 31 is the test"
description: "Citi and BNP Paribas lifted their CrowdStrike views this week on the company's own reporting of AI-driven attacks on South Korean banks. What settles the story is net new recurring revenue in the quarter ending October 31, 2026; the chief executive's scheduled share sale is noise."
publisher: "The Inference"
section: "Markets"
published: 2026-10-16T21:21:32.682Z
modified: 2026-10-16T21:21:32.682Z
canonical: https://theinference.org/article/citi-lifted-crowdstrike-to-295-on-the-vendor-s-own-ai-attack-reporting-october-31-is-the-test
language: en
keywords: "Cybersecurity, CrowdStrike, Analyst Ratings, AI Attacks, Insider Sales"
---

# Citi lifted CrowdStrike to $295 on the vendor's own AI-attack reporting; October 31 is the test

> Citi and BNP Paribas lifted their CrowdStrike views this week on the company's own reporting of AI-driven attacks on South Korean banks. What settles the story is net new recurring revenue in the quarter ending October 31, 2026; the chief executive's scheduled share sale is noise.

The best evidence that AI agents now carry out real attacks comes from the company paid to stop them, and this month Wall Street priced that evidence as fact [1][2]. [CrowdStrike](https://theinference.org/markets/companies/crowdstrike)'s [account of the attacks on South Korean banks](https://www.msn.com/en-ca/news/other/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks/ar-AA2dNhm9) is its own work product [3]. In the same week, chief executive [George Kurtz](https://theinference.org/markets/people/george-kurtz) sold $5.2 million of stock under a January trading plan [4], and the only independent test of the story arrives with the quarter closing October 31, 2026.

## The report hedged and the relay did not

CrowdStrike's October 7, 2026, report assessed, with moderate confidence, that one financially motivated operator ran the campaign against South Korean financial institutions, likely a Chinese speaker and possibly a 26-year-old in Guangdong province; it named no adversary [3].

The capability underneath is real. ARTEX, an open-source attack agent published on [GitHub](https://theinference.org/markets/companies/microsoft) this year, connects to commercial models including [Anthropic](https://theinference.org/markets/companies/anthropic)'s Claude and [DeepSeek](https://theinference.org/markets/companies/deepseek), and the suspect used it alongside Claude Code [3]. One person directing a pack of AI agents at a country's banks is an observed capability; who that person is, and whether he worked alone, is CrowdStrike's estimate.

Within days the finding had crossed social media as settled fact: "[CLAUDE EXPOSED A HACKER WHO HIT 7 BANKS IN SOUTH KOREA AT ONCE](https://x.com/Mikadzyki_NFT/status/2108932191128261021)" [5]. The post carries none of the report's hedges, and the count changed in the retelling: Reuters counts at least nine banks disclosed or reported by local media as targeted [3].

## The bull case rests on the vendor's own intel

On October 15, 2026 [Citi](https://theinference.org/markets/companies/citigroup) analyst Fatima Boolani raised her CrowdStrike target to $295 from $260, keeping a Buy rating, on [survey findings that AI deployments are driving more security spending](https://finance.yahoo.com/markets/stocks/articles/cybersecurity-stocks-retreat-record-highs-120216160.html) [1]. The stock is still up 113 percent this year [1]. BNP Paribas, the French bank, went further after talking to CrowdStrike's investor-relations team: [the long-term targets may be conservative](http://www.gmt8press.com/flash/detail/1542304), because nearly half of enterprise endpoint systems still run legacy tools [2].

Those targets include $10 billion of annual recurring revenue by fiscal 2030, and BNP has said the company may beat them [6]. It still carries a $180 price forecast, far below where the stock trades [6]. Both banks expect the same demand; they disagree about what the shares should cost.

*Chart: **Both banks see the demand; the targets sit $115 apart** Bar chart of three CrowdStrike price targets: Citi's raised target of $295, Citi's prior target of $260, and BNP Paribas's $180 price forecast.*

*CrowdStrike price targets in US dollars. Citi raised its target to $295 from $260 on October 15, 2026, keeping a Buy rating; BNP Paribas carries a $180 price forecast even while calling the company's long-term targets conservative. Sources: Yahoo Finance (StockTwits); Benzinga via MSN. [1][6]*

## The research is the pitch, and sometimes it checks out

Both notes lean on threat research CrowdStrike produces itself, which doubles as the case for buying its Falcon platform. That pipeline can still generate checkable results: on October 13, 2026 CrowdStrike [said its intelligence helped the FBI disrupt laptop farms](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/) used by the North Korea-linked FAMOUS CHOLLIMA operation to place fraudulent remote workers inside American companies [7].

*Chart: **Revenue growth has accelerated for five straight quarters** Line chart of CrowdStrike's year-over-year quarterly revenue growth from the quarter ended October 2023 to the quarter ended July 2026, falling from about 35 percent to a trough near 20 percent in early 2025, then rising five consecutive quarters to about 26 percent.*

*Year-over-year revenue growth by fiscal quarter, periods ended October 31, 2023, through July 31, 2026. Source: CrowdStrike SEC filings. [8]*

## The sale is noise and the quarter's number is the test

Kurtz's sale came to 20,000 shares across two days, under [a trading plan adopted on January 6, 2026](https://www.sec.gov/Archives/edgar/data/1535527/000177856426000185/0001778564-26-000185-index.htm), and he kept about 7.5 million shares [4]. The plan was set long before this month's reports. A scheduled sale that size is not a signal about the company's prospects.

The signal is the quarter now closing. CrowdStrike's last report [set a record with about $333 million of net new annual recurring revenue](https://pulse2.com/crowdstrike-falcon-flex-arr-doubles-to-2-29-billion-as-net-new-arr-jumps-51/), the bookings measure it reports each quarter, and management raised its full-year outlook afterward [9]. If AI-driven attacks are converting into security budgets, net new recurring revenue has to clear a bar management has already raised. [Fortinet](https://theinference.org/markets/companies/fortinet), a rival security vendor, gives the sector its first read on October 28 [10].

## The test is customer spending, not self-reported threats

The chain from cheap AI-driven attack to bigger security budgets is real, and it most likely runs where the bulls say it does. What is untested is the conversion, and net new recurring revenue in the quarter ending October 31, 2026, is the first reading that comes from customer spending rather than from CrowdStrike's own account of the threats.

## Takeaway

Citi's $295 target and BNP Paribas's view that the targets look conservative both lean on CrowdStrike's own reporting of AI-driven attacks; net new recurring revenue in the quarter ending October 31, 2026, is the first reading that comes from customer spending, and George Kurtz's scheduled share sale is noise.

## Sources

1. [Yahoo Finance (StockTwits), Cybersecurity Stocks Retreat From Record Highs: Citi Raises CRWD, PANW, ZS Targets On Improving Spending Momentum, 15 October 2026](https://finance.yahoo.com/markets/stocks/articles/cybersecurity-stocks-retreat-record-highs-120216160.html)
2. [GMT Eight (Zhito Finance), CrowdStrike aims for market share expansion; BNP Paribas says long-term growth target may be conservative, 16 October 2026](http://www.gmt8press.com/flash/detail/1542304)
3. [Reuters (via MSN), CrowdStrike says China-based suspect used AI tools in South Korean bank hacks, 8 October 2026](https://www.msn.com/en-ca/news/other/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks/ar-AA2dNhm9)
4. [US SEC Form 4, CrowdStrike Holdings, George Kurtz, filed 15 October 2026](https://www.sec.gov/Archives/edgar/data/1535527/000177856426000185/0001778564-26-000185-index.htm)
5. [X, @Mikadzyki_NFT post on CrowdStrike's South Korea report, 11 October 2026](https://x.com/Mikadzyki_NFT/status/2108932191128261021)
6. [Benzinga (via MSN), CrowdStrike hits record high, up 147% in 2026 as AI security demand booms, 6 October 2026](https://www.msn.com/en-us/technology/tech-companies/crowdstrike-hits-record-high-up-147-in-2026-as-ai-security-demand-booms/ar-AA2dGpN3)
7. [CrowdStrike blog, U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance, 13 October 2026](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/)
8. [CrowdStrike quarterly figures from its SEC filings, retrieved 16 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001535527)
9. [Pulse 2.0, CrowdStrike: Falcon Flex ARR Doubles To $2.29 Billion As Net New ARR Jumps 51%, 28 August 2026](https://pulse2.com/crowdstrike-falcon-flex-arr-doubles-to-2-29-billion-as-net-new-arr-jumps-51/)
10. [ad-hoc-news.de, Fortinet schedules October 28 results: what it means for Fortinet stock, 16 October 2026](https://www.ad-hoc-news.de/boerse/news/corporate-news/fortinet-schedules-october-28-results-what-it-means-for-fortinet-stock/70315633)


---

Citi lifted CrowdStrike to $295 on the vendor's own AI-attack reporting; October 31 is the test — The Inference. Canonical: https://theinference.org/article/citi-lifted-crowdstrike-to-295-on-the-vendor-s-own-ai-attack-reporting-october-31-is-the-test