These 5 cybersecurity stocks are being bought the most by investors. Which one is the best?
All five of the most-watched cybersecurity companies are riding the same wave. Research firm Gartner expects information security spending to rise to $244 billion this year, and for the first time it is starting to separately count money spent on protecting AI itself. Yet there are huge differences among them in growth, profitability, and price. CrowdStrike $CRWD is growing the fastest, with net new ARR jumping 51% quarter over quarter, and it trades at roughly 34 times annual revenue. Okta $OKTA costs a fraction of that, but is growing only around 11%. In between are Palo Alto Networks $PANW, which fell nearly 10% after beating estimates, Fortinet $FTNT with a 38% operating margin, and Zscaler $ZS, which declined after Thursday's results due to guidance of 17% growth. What you are buying at today's price for each one and what you are risking will determine which of the five is best for you.
Key points
CrowdStrike is growing the fastest of the five, but it also trades at roughly 34 times revenue, the highest multiple in the comparison.
Fortinet has the highest operating margin at around 38%, but part of its current growth is supported by the firewall replacement cycle.
Palo Alto Networks is growing fast, but some of the pace comes from acquisitions, while the stock fell nearly 10% after results due to margin concerns.
Zscaler is the cheapest on revenue, but management expects growth to slow to about 17% next year.
Okta is growing the slowest, around 11%, but its main investment thesis rests on the growing need to secure the identities of AI agents.
Security budgets are the hardest to cut. AI adds a second engine
When companies tighten IT budgets, security is usually the last item they cut. Attacks do not stop just because a decision was made to save money in a given year, and the cost of a single successful breach usually far exceeds the annual spending on defense. Gartner therefore estimates that global information security spending will rise to $244 billion this year, up 11.6% at constant currency, and reach $322 billion by 2029. Cybersecurity thus remains one of the few areas of IT where demand grows regardless of the economic mood.
AI is accelerating this growth from two sides. Generative and agentic models give attackers cheaper and faster tools, from automatically written malware to more convincing phishing. At the same time, every new AI application or agent expands the surface that a company must protect: prompts, models, API calls, and access permissions that did not exist before are added. More systems to protect and more capable attackers mean more work for security software, which affects all five companies.
A completely new category is also emerging: protection of AI itself. Gartner is counting it separately for the first time and estimates that the market will grow from $2.8 billion in 2026 to $4.8 billion a year later, a jump of 68.7%, and reach nearly $7.7 billion by 2028. This is not about security tools that use AI, but about protecting models, applications, and agents from new types of attacks. Moreover, by 2029, over half of successful attacks on AI agents are expected to exploit weak access permissions or prompt injection – exactly the territory Okta is betting on.
But for now, it is a fraction of the whole. Against $244 billion for all security, $2.8 billion for AI protection is a small item, so in the coming years the companies will be driven more by the overall wave and demand for classic products than by this one segment. Still, cloud security (around 29% per year) and the AI protection subcategory are growing the fastest. Each of the five companies is therefore trying to plant a flag in AI security with its own product, from Palo Alto's Prisma AIRS to identity for AI agents at Okta.
The same set of metrics decides for all five: revenue growth and contracted bookings growth (ARR, billings, or RPO depending on business type), gross and operating margins, free cash flow, management guidance, AI exposure, stock valuation, and finally the main catalyst and main risk. The differences in these numbers are so large that the same bet on cybersecurity can mean five completely different risk-reward profiles.