Safety First: These 5 Companies Are Making Serious Money From It
Cybersecurity spending is growing at a double-digit pace in 2026 and is among the most resilient items in corporate IT budgets. But the major vendors are benefiting from this demand very unevenly. One is accelerating growth to above 25%, while another is adding just 1%, and valuations range from roughly 4 times to 40 times revenue. The gap between a quality company and a quality investment is therefore wider than usual.
Key points
Cybersecurity spending is growing by around 12% a year, and the strongest vendors are growing faster at competitors’ expense.
The fastest growth in recurring revenue is often accompanied by high stock-based compensation, which reduces the true quality of free cash flow.
Acquisitions can significantly inflate reported growth; organic growth is sometimes half as high.
The strongest financial quality belongs to companies that combine growth with accounting profits and a declining share count.
Valuations vary extremely across the sector, and the cheapest stocks tend to be those with stagnant growth.
Why cybersecurity is an investment theme
Over the past ten years, cybersecurity has gone from an operating expense for IT departments to an item decided by corporate boards. For investors, what matters is that it is harder to cut this spending during a recession than marketing or new office software licenses. A data breach or system outage has immediate financial, regulatory, and reputational consequences for a company.
Structural demand drivers
Shift to the cloud: Enterprise applications and data have moved outside companies’ own data centers. Traditional “network perimeter” protection is no longer enough.
Remote access: Employees, suppliers, and customers connect from anywhere. Every device and every account is a potential entry point.
Identity as the perimeter: Attackers are increasingly gaining access not through technical vulnerabilities but through stolen credentials.
Regulation: The European NIS2 directive, U.S. SEC rules on incident reporting, and industry standards are raising the minimum level of security.
Artificial intelligence: In April 2026, Anthropic announced that its Claude Mythos Preview model had uncovered thousands of previously unknown vulnerabilities in major operating systems and browsers. Cybersecurity stocks initially fell and then rallied sharply. According to management, Palo Alto Networks recorded more than 1,200 customer inquiries over six weeks.
Tool consolidation: Large companies operate dozens of security products from different vendors. Efforts to simplify their systems favor vendors with a broad platform.
Market growth does not mean every vendor is growing
According to a Gartner analysis from February 2026, global spending on information security is expected to reach USD 244 billion in 2026, growing 11.6% at constant currencies. More recent quarterly forecast updates in June and September 2026 raised the estimate to USD 247.5 billion to USD 248.9 billion. Gartner’s figures include software, services, and network equipment, covering a broader market than any of the five vendors.
This leads to a key conclusion for investors. If the market is growing by around 12% and CrowdStrike $CRWD, Palo Alto Networks $PANW, and Fortinet $FTNT are growing by 25% to 34%, they must be taking share from someone. Check Point $CHKP, with revenue growth of 1% in Q2 2026, shows the other side of the same equation. A higher number of attacks therefore does not automatically mean all vendors will grow at the same rate. Customers are shifting, consolidating, and negotiating their budgets.
How the industry’s economics work
Four related but distinct markets
Area | What it protects | Typical model | Economics |
|---|---|---|---|
Endpoints | laptops, servers, cloud machines | subscription per device and module | high gross margins, low capital intensity |
Network security | traffic between networks, branch offices, data centers | hardware (firewall) + service subscriptions | lower hardware margins, replacement cycles |
Cloud security | cloud configuration and workloads | consumption-based subscription | fast growth, strong competition from cloud providers |
Identity management | logins, permissions, access | subscription per user | high stickiness, pressure from large platforms |
A firewall (a device that filters network traffic) is bought as a one-time purchase and replaced every few years, with subscriptions for updates and support added on. Endpoint and identity protection are paid for entirely through subscriptions. At Fortinet and Check Point, it is therefore important to distinguish one-time hardware sales from recurring services.
Consolidation as the main force
The most significant trend from 2024 to 2026 is the shift from buying the best product in every category to using a platform from one or two vendors. CrowdStrike sells this through its Falcon Flex licensing model, and Palo Alto Networks through so-called platformization. Consolidation winners are securing larger, longer contracts at the expense of smaller specialists, and some of their “growth” is actually budget shifting.
CrowdStrike
Business model
CrowdStrike sells the Falcon platform, built around a single lightweight software agent installed on endpoints. The agent sends telemetry to the cloud, where the company searches for signs of attacks. It builds on this foundation with additional modules: cloud and identity protection, security log management (SIEM), managed detection, and, more recently, AI application protection. Mid-sized and large companies and government agencies pay for subscriptions, which accounted for 95% of revenue in fiscal 2026 (ending Jan. 31, 2026).
The model’s economics depend on expansion: once the agent is deployed, each additional module requires minimal installation effort from the customer. As of July 31, 2026, 51% of customers used six or more modules, 35% used seven or more, and 26% used eight or more. The Falcon Flex model lets customers subscribe to a budget and draw on modules as needed.
Financial performance
Metric | FY2024 | FY2025 | FY2026 | FY2027 guidance |
|---|---|---|---|---|
Revenue (USD bn) | 3.06 | 3.95 | 4.81 | 5.99 to 6.01 |
Year-over-year growth | 36% | 29% | 22% | approx. 25% |
CrowdStrike’s fiscal year ends on January 31. FY2024 and FY2025 figures are from annual reports; FY2027 guidance is from the announcement dated Aug. 26, 2026.
In Q2 FY2027 (May to July 2026), CrowdStrike reported revenue of USD 1.47 billion (+26%), an adjusted operating margin of 25%, and free cash flow (FCF, cash from operations after capital expenditures) of USD 377 million, according to its official earnings release. Its GAAP operating result was a loss of USD 33 million, and net income was USD 5 million. Cash totaled USD 5.01 billion, compared with debt of USD 0.75 billion.
The gap between the accounting loss and adjusted profit is mainly due to stock-based compensation (SBC): USD 399 million in Q2, including related charges, or 27% of revenue. For the first half, FCF was USD 846 million and SBC was USD 675 million, according to the cash flow statement. After deducting SBC, roughly USD 171 million remains, or about 6% of revenue. The share count increased 3.2% year over year despite USD 176 million in buybacks.
Growth quality
ARR (annual recurring revenue, the annual value of active subscriptions) reached USD 5.84 billion, while new ARR added during the quarter was USD 333 million, a record and up 51% year over year. Management raised its full-year growth outlook for new ARR to 34%. The company reported record new ARR from new customers and higher gross and net retention, but did not disclose specific retention figures in the release.
Growth therefore comes from a combination of new customers, module expansion, and smaller acquisitions (USD 881 million in the first half). The figure of USD 2.29 billion in ARR “from accounts that migrated to Falcon Flex” should be read with caution: it is the total ARR of those customers, not revenue from the Flex model itself.
Competitive advantage and the 2024 incident
On July 19, 2024, a faulty Falcon agent update caused millions of Windows computers to crash. CrowdStrike subsequently offered compensation packages, which dampened ARR and revenue growth during FY2026. Two years later, the data point to a limited lasting impact: revenue growth accelerated for five consecutive quarters, new ARR is at a record, and retention is rising. The costs of the incident are still excluded from adjusted results, although in Q2 FY2027 they generated net proceeds of USD 14.5 million from insurance claims.
CrowdStrike’s advantage comes from its unified architecture, data from millions of devices, and the ability to sell additional modules without a new installation. Its main competitors are Microsoft $MSFT (Defender bundled with licenses) and Palo Alto Networks (Cortex).