In our July 14 edition of Morning Cents, we put together a quick primer on cybersecurity stocks. Today, we are taking a deeper dive and adding a few companies to the analysis.
- Cybersecurity stocks rallied in late August after a strong earnings report from Palo Alto Networks (PANW). Crowdstrike Holdings (CRWD) was added to the Nasdaq-100 index in the same week.
- Worldwide spending on information security and risk management technology and services is forecast to grow 12.4% to reach $150.4 billion in 2021, according to the latest forecast from Gartner, Inc
- In a Cybersecurity Market with Covid-19 Impact Analysis report by MarketsandMarkets, the global cybersecurity market size is projected to growth from $217.9 billion to $345.4 billion by 2026.
- The pandemic accelerated the shift to cloud services. Companies like Crowdstrike ($CRWD) and Zscaler ($ZS) got a big boost in 2020.
- In late August, the Biden Administration and private sector leaders announced ambitious initiatives to bolster national cybersecurity.
- On May 12, 2021, President Biden issued an Executive Order that modernizes Federal Government defenses and improves the security of technology.
There are many sub-sections of cybersecurity including on-premise versus cloud, enterprise versus government, and many different securities solutions. The image below shows some of the protections/solutions including:
- Firewalls: Filtering data going through and coming from a network based on security rules.
- Endpoint Security: Protecting multiple devices that can access a network – computers, laptops, phones, etc.
- Data governance: Deploying processes, roles, policies, standards, and metrics for data management.
- Identity and access management (IAM): Processes, policies, and tech that facilitates the management of electronic or digital identities.
- Vulnerability management: Identifying, evaluating, treating, and reporting security vulnerabilities in systems or software.
- Intrusion prevention systems (IPS): Network security that works to prevent identified threasts.
- Virtual private networks (VPN): An encrypted connection over the Internet from a device to a network.
- User behavior analytics (UBA): Detection that tracks a system’s users.
Understanding that is are multiple sub-sections of cybersecurity is important when analyzing this space. For example, Crowdstrike (CRWD) is focused on enterprise, cloud-based solutions versus McAfee Corp (MCFE) which is focused on end-users, not enterprise users. These companies have different industry dynamics and should be looked at through different lenses.
Another point of consideration is understanding the margins on cloud-based companies versus on-premise based solutions and the impact on margins. On-premise solutions may have higher gross margins because they don’t have hosting fees associated with the solutions. Cloud-based solutions have hosting fees built-in, but as a platform scales, the gross margins should theoretically increase.
Global X Cybersecurity ETF (BUG)
BUG seeks to invest in companies that stand to potentially benefit from the increased adoption of cybersecurity. It was created in late 2019 and has an expense ratio of 0.50%
- Top 5 Holdings (31 total)
- Zscaler (ZS)
- Fortinet (FTNT)
- Palo Alto Networks (PANW)
- Crowdstrike (CRWD)
- Rapid7 (RPD)
- YTD: +20.40% (versus +21.32% for QQQ)
- 1YR: + 48.79% (versus +34.47% for QQQ)
First Trust Nasdaq Cybersecurity ETF (CIBR)
CIBR seeks investment results that correspond generally to the price and yield (before fees and expenses) of an equity index called the Nasdaq CTA Cybersecurity Index. This ETF has been around since 2015 and has an expense ratio of 0.60%.
- Top 5 Holdings (39 total)
- Zscaler (ZS)
- Accenture (ACN)
- Crowdstrike (CRWD)
- Okta (OKTA)
- Ciscso (CSCO)
- YTD: +16.88% (versus +21.32% for QQQ)
- 1YR: + 46.66% (versus +34.47% for QQQ)
Major Players – Comparison
In the comparison sheet below, we included companies focused on mostly enterprise cybersecurity with a market cap of over $15 billion.
Crowdstrike (CRWD) is a provider of cloud-delivered solutions for endpoint and cloud workload protection. We recently covered CRWD Q2 earnings here. CRWD is trading at 33x forward sales and nearly 49% annual growth over the next two years.
Zscaler (ZS) is another cloud security platform that is designed on a zero-trust architecture to allow users and devices to safely access authorized applications and services in the cloud. ZS is expected to grow slower than Crowdstrike at 35% annually over the next two fiscal years and is trading at a higher valuation ~37x sales.
Fortinet (FTNT) is more of a legacy player in this space founded in 2000. It offers cybersecurity solutions to enterprises, government organizations, and small businesses. It also offers cloud security deployments. FTNT is trading ~13x forward sales but is also projected to grow much slower than the cloud-native stocks (16.4% CAGR).
Palo Alto Networks (PANW) is coming off of a great quarter revising guidance up. Since identifying PANW as the most interesting cybersecurity stock on our July 14 quick dive it has outperformed its peers, gaining nearly 25%. It’s currently trading around 8.5x forward sales and is still interesting.
Okta (OKTA) is most well-known for its identity cloud platform. We recapped its most recent earnings on Sept 2. Read more here! It’s trading at a discount to CRWD and ZS on a forward sales and gross profit basis and projected to grow ~43% annually over the next two years.
SentinelOne (S) delivers autonomous endpoint protection that prevents, detects, and responds to attacks across major vectors. S went public in June of this year and began trading at $46 per share (priced at $35 a share). At $62 per share, S is trading at 53x forward sales, but its projected to grow rapidly around 87% annually over the next two years.
Cloudflare (NET) delivers web infrastructure and web security. NET nearly matches SentinelOne’s forward sales multiple coming in at 50x forward sales. However, NET is projected to grow much slower around 32% over the next two years.
Check Point Software (CHKP) is an Israeli company that started in 1993 and it develops and markets products for IT security. This company is hardly comparable against the others on this list as it projects to grow 3% over the next couple of years. This company is more established and trades ~11x forward EBITDA.