Sector maturation, narrower paths to success in still fast-growing market

We present our annual analysis of publicly traded, enterprise-focused cybersecurity firm performance. We highlight that 2024 aggregate revenue grew 16.7%, substantially slower than 2023’s 21.9% growth and 2022’s 30.8% growth. Average 2024 revenue growth was 16.6%, better than initial guidance for 15.1% growth on average; initial 2025 growth guidance is 13.4% on average.

2024 was a rare year of across-the-board profitability for our cybersecurity group and a rare year of across-the-board profit-guidance beats. We think this indicates the sector has matured to a point where profitability and revenue growth are more or less equally important to investors: There is a strong positive correlation between the past year’s cybersecurity stock price changes and the sums of expected revenue growth rates and profit margins (the metrics used in the Rule of 40).

We continue to see a trend toward increased market capitalization concentration among the publicly traded cybersecurity companies. These large, established companies are well positioned to continue growing profitably, making it difficult for smaller competitors to challenge them in their core product areas.

However, innovative, cloud-native companies continue to outperform on growth, showing that technological differentiation and market focus remain powerful drivers of performance. Innovative, specialized companies targeting topical growth areas can profitably grow at above-average rates and be well rewarded in the capital markets.

How we looked at the market

This report presents our annual analysis of publicly traded, enterprise-focused cybersecurity firms’ performance.

To be included in this year’s analysis of stock performance, companies had to be listed on a U.S. exchange, have most-recent-year revenue greater than $100 million, derive the vast majority of their business from supplying cybersecurity solutions to businesses and government customers, and have been public for all of 2024. Relative to our most recent annual analysis in April 2024, we removed SecureWorks (SCWX) due to its acquisition by Thoma Bravo’s Sophos. We also removed Cisco Systems’ (CSCO) cybersecurity revenue, which only appeared in the revenue growth section, due to its acquisition of Splunk; we plan to add it back next year, as we’ll then have two years of comparable company revenue. We also plan to add recent IPO and former Thoma Bravo portfolio company SailPoint (SAIL).

Consistent with our focus on business-to-business companies, we again exclude consumer-focused cybersecurity companies such as Gen Digital (GEN), formerly known as Norton LifeLock. We perform our analysis at the end of the first quarter so that we can include reported full-year data (as opposed to estimates), including several companies whose fiscal year ends in January, and so we can consider company guidance for 2025.

2024 revenue growth slowed

We present revenue and revenue growth by company in Table 1 and conclude cybersecurity demand growth slowed in 2024 but that cybersecurity remains a fast-growing, dynamic market. Aggregate 2024 revenue for these companies grew 16.7% to $33.0 billion.

Select recent private placements (sorted by date of announcement, $ in millions)

Source: Company data, Capital IQ, First Analysis.
Notes: (1) Revenue and growth rates are based on CRWD’s, OKTA’s, and S’s reported revenue for their fiscal years ended January of 2021, 2022, 2023, and 2024. (2) Revenue and growth rates are based on ZS’s and PANW’s reported revenue for the four quarters through January (their fiscal Q2) in 2021, 2022, 2023, and 2024.

This is the second consecutive year of deceleration in aggregate revenue growth since the substantial revenue uplift in 2021 and 2022. The aggregate 2024 revenue growth rate declined by 5.1 points, the average by 3.2 points and the median by 7.4 points. The 2024 aggregate growth rate was more in line with the growth rates seen in 2018 through 2020 for the comparable public company set of companies that we analyzed in our reports at that time. We believe the broader cybersecurity industry is growing more slowly than this group of public companies, as we regularly see industry growth estimates in the high-single-digit and low-double-digit percentage ranges, fairly close to the growth rates for Check Point (CHKP), Radware (RDWR), and OneSpan (OSPN).

For the second year in a row, the cloud-focused companies, including Sentinel One (S), CrowdStrike (CRWD), Cloudflare (NET) and Zscaler (ZS) grew the fastest. All of these companies grew faster than 27% in 2024 and faster than 33% in 2023, underscoring their continued momentum despite the slight revenue deceleration. CyberArk (CYBR), the leading identity and access management company, led the broad group with 33.1% 2024 revenue growth. The larger companies in our analysis, particularly Palo Alto Networks (PANW) and Fortinet (FTNT), which have often outperformed the broad group, grew more in line with the group in 2024: 13.9% for Palo Alto and 12.3% for Fortinet. We believe this suggests the industry has entered a new, more mature phase, and we explore this dynamic in more depth below.

We acknowledge the limitations of using revenue growth as a proxy for demand. These include:

• A significant and growing number of companies in this analysis recognize most of their revenue from contracts already booked (i.e., from deferred revenue balances), making bookings or changes in short-term deferred revenue better indicators of current demand.
• As companies transition to more subscription sales, reported revenue is depressed relative to actual demand during the transition. For example, CyberArk has finished such a transition, having accelerated its revenue growth from levels under 10% in 2020 and 2021 to 17.7% in 2022, 27.1% in 2023 and 33.1% in 2024. In its fourth-quarter results, the company reported recurring revenue is now 93% of total revenue, up from 90% last year, and fourth-quarter subscription revenue grew 61.7% year-over-year. Varonis Systems (VRNS) is now going through a similar transition: It finished the fourth quarter with 53% of total company annualized recurring revenue (ARR) coming from subscription, up 30 points from 23% a year prior, and the company believes the transition can proceed even faster in 2025. Due to this ongoing transition, Varonis’ 2024 revenue increased only 10.4% (but this was an improvement from 2023).
• Our analysis includes acquired revenue. In most cases this year, acquired revenue did not materially affect growth rates, but there are instances where it causes some distortion. We try to call these out in our analysis.

Despite these limitations, we feel revenue metrics are among of the best ways to gauge industry health and growth. Other metrics, such as bookings, can become materially distorted due to changes in contract duration, lumpy big deals and many other factors.

Cybersecurity stocks appreciate in line with indexes, large market cap stocks continue to account for more of the total cap

The average stock price appreciation over the one-year period ended March 31 was 5% (10% median), only slightly below the Nasdaq’s 6% gain and the S&P 500’s 7% gain. Over the three years ended March 31, the average stock price gain for the group was far below the major index’s gains, while over five years, the group performed much better than those indexes. On a market-cap-weighted basis, the group’s performance beat or matched the indexes in all three periods, as shown in Table 2. We think the divergence between the straight average changes and the market-cap-weighted changes is notable and points to the increased importance of the larger-market-cap companies, as further discussed below. 

Eight of the 15 cybersecurity companies outperformed the Nasdaq in the one-year period. Fortinet led with its 41% one-year stock price increase and contributed the most of any company (7 points) to the group’s market-cap-weighted gain of 18%. CheckPoint, OneSpan and CyberArk followed closely, all with one-year stock gains of 27% or more. Last year, we noted OneSpan’s management change and January 2024 hiring of a new interim CEO. Over the one-year period ended March 31, the stock appreciated 31%, partly recovering from the previous year’s 33% decline. Despite the strong year, the company remains the second-worst performer in the group for five-year stock price change. Palo Alto, with the largest market cap in the group, gained 20% over the one-year period. Five stocks declined in the period, all by more than 10%: Varonis Systems, Sentinel One, Qualys (QLYS), Tenable (TENB), and Rapid7 (RPD). Sentinel One finished fiscal 2025 (January) with its first quarter of positive non-GAAP operating margin. The company delivered industry-leading revenue growth and continues to build operational leverage to support profitability. We will see if this shift can lead to improved stock price performance. All the other companies that saw their stock price decline reported revenue growth below the group’s average.

TABLE 2: Cybersecurity stock price and market cap analysis (market cap. in millions)

Source: Capital IQ, First Analysis.

Increased concentration of market cap of largest players

In the chart below, we analyze the concentration of the top three cybersecurity companies by market capitalization from each of our prior annual analyses. Prior to our 2022 report, the set of companies comprising the top three varied from year to year, but our 2022 report showed the beginning of a new trend—Palo Alto, Fortinet, and CrowdStrike have consistently held these positions. Further, these three companies account for an increasing proportion of total market capitalization. As of March 31, they accounted for 64.4% of the total market capitalization, significantly more than 50% in March 2022 and 38.9% for the three largest-market-cap companies in December 2019. Palo Alto, Fortinet, and CrowdStrike are beginning to dominate, and we believe it is an indication of the increased maturity of the cybersecurity market. We will continue to monitor this concentration going forward.

TABLE 3: Cybersecurity market capitalization concentration of top three constituents ($ in billions)

Source: First Analysis.
Notes: We did not publish an annual analysis for 2020 performance.

Initial guidance for 2024 was conservative, 2025 expectations suggest revenue growth will slow further

The revenue growth slowdown anticipated in 2024 guidance was less severe than anticipated. Initial fiscal-year guidance for 2024 was for 15.1% revenue growth on average (median 10.1%). This was 5.4 points below 2023’s 20.5% actual average growth on a fiscal-year basis, which in turn was 7.7 points below 2022’s 28.2%. 2024 actual average revenue growth on a fiscal-year basis came in at 17.2%, 2.1 points greater than initial guidance. Based on initial fiscal-year guidance for 2025 of 13.4% revenue growth on average (median 12.1%), these companies expect another year of materially slower growth. Should 2025 guidance be accurate, actual 2025 revenue, on a fiscal-year basis, will grow at less than half the rates seen in 2022 and will fall below the growth rates seen in the years leading up to the pandemic.

TABLE 4: 2024 revenue and EPS initial guidance compared to actual results (sorted by revenue difference, $ in millions except per-share data)*

Source: Company reports, Capital IQ, First Analysis.
Notes: For July and December year-end companies, we show fiscal 2024 figures; for January year ends, we show fiscal 2025 figures. For companies lacking initial revenue and/or EPS guidance, we show initial consensus estimates as of approximately one week after reported year-end results. EPS = earnings per share.

Revenue performance above guidance, earnings significantly outperform

We believe comparisons between 2024 guidance and actual results also show management teams heeded the stock market’s continued shift toward valuing profitability, albeit with growth still an important factor. We compare initial guidance to actual results (Table 4) for a few reasons. First, the comparison provides an indication of whether demand over the course of the year strengthened (with companies materially beating their initial revenue guidance) or weakened (companies falling short of initial guidance). Second, when we bring stock price into the analysis, we have historically been able to draw some conclusions about how investors perceive the relative importance of revenue growth versus profitability.

Actual 2024 revenue finished 2% above initial guidance on average. We find this performance, like 2022’s performance, relatively typical. By contrast, 2023 actual revenue fell short of guidance by 1% on average, which we believe reflected the weakening market, and 2021 actual revenue beat guidance by a very unusual 7% on average. 

While most companies reported actual 2024 revenue within a few percent of initial revenue guidance, there were a few outliers. CyberArk beat its guidance by 8.2%, and Zscaler beat by 5.4% (they posted similar beats in 2023). Over the one-year period ended March 31, CyberArk’s stock appreciated substantially, and the gains were near the top of the range, whereas Zscaler’s stock appreciated more in line with the average. On the other end, three companies slightly missed initial guidance: Palo Alto missed by 1.8%, Rapid7 by 0.9%, and CrowdStrike by 0.2%. Among those, only Rapid7’s stock declined (by 46%). Palo Alto’s stock appreciated by twice the group’s median stock appreciation, and CrowdStrike’s stock appreciation was consistent with the median. This contrasts with last year, when nine companies missed revenue guidance but still saw strong stock price appreciation.

All companies showcase positive non-GAAP earnings per share in 2024

In last year’s report, we noted the shift of investor sentiment to favor companies with high free cash flow and profitability over companies with spectacularly high growth rates if they came with high rates of investment in their businesses (i.e., high cash burn and operating losses). Last year’s analysis showed increased profitability corresponded to stock price appreciation. This year, all companies provided guidance for positive non-GAAP earnings per share (EPS), and all beat this initial guidance. Notably, CyberArk beat its initial indications by $1.31, reporting $3.03 in non-GAAP EPS. It’s unusual to see every company in the group be profitable, and it’s unusual to see every company beat its initial earnings guidance. To see both happen in one year is extraordinary. We do not recall another year of across-the-board profitability, nor do we recall another year of across-the-board earnings beats. For comparison with recent years, five companies forecasted non-GAAP loss per share in 2022, and two missed their targets, while two companies forecasted losses in 2023, and one missed its target.

This year, we also analyzed companies’ non-GAAP EBIT margin historical performance and 2025 guidance. For companies that did not provide EBIT guidance, we used EBITDA margin guidance, which provides a similar view of company profitability. For 2024, actual margins increased by 630 basis points on average, a notable jump that followed 2023’s even stronger 730 basis point average increase. Guidance for 2025 suggests margins will be flat, signaling management teams expect to sustain these solid profit margin gains.

Stock performance correlated with the Rule of 40

Usually, the cybersecurity group’s stock price changes strongly correlate with either revenue beats (most years we have been following the industry) or EPS beats. This year, neither metric strongly correlated. The correlation with revenue beats was only 0.32, and it was negative 0.20 for EPS beats. In 2020, the correlation between stock price change and revenue outperformance was 0.65, and in 2022, with data normalized for some unusual items, it was 0.5.

Our search for what other factors might have driven stock price changes over the one-year period ended March 31 led us to the Rule of 40. The Rule of 40 holds that a SaaS company’s revenue growth rate when added to its free cash flow margin should equal 40% or higher. In our analysis, we used EBITDA margin or non-GAAP EBIT margin, when available. (We removed Radware from the analysis because it did not provide guidance for EBIT or EBITDA in 2025.) We calculated a 0.62 correlation between stock price change and implied 2025 Rule of 40 guidance.

We plotted these values in Table 5. Nearly all the stocks that declined over the one-year period provided 2025 guidance, implying a Rule of 40 value below 40%. The exception was Qualys, which had the highest 2025 Rule of 40 guidance (49%) and saw its stock decline by 25%. The notable outlier on the stock appreciation side was OneSpan, whose 2025 guidance implied a Rule of 40 value well below 40% but whose stock appreciated 31%. We attribute this to positive investor sentiment about the company’s early 2024 management change.

The seven companies whose 2025 guidance implied a Rule of 40 value above 40% saw an average stock price increase of 16.5% (median 20.1%). This average was 12 points above the broader group’s average stock price increase, and the median was 10 points above the broader group’s median gain. This suggests investors now value balanced growth and profitability over either factor alone and underscores the importance of the Rule of 40 for valuations in the cybersecurity sector.

TABLE 5: Correlation of 2025 Rule of 40 guidance to one-year stock price change

Source: First Analysis.

Dynamics of a maturing market

The cybersecurity market continues to expand at a healthy pace, but the dynamics of growth and competition are evolving. As noted, revenue growth among publicly traded cybersecurity companies has continued to slow, and profit margins have increased significantly. We think this indicates the sector has matured to a point where profitability and revenue growth are more or less equally important to investors. The increasing concentration of market capitalization among the top three public companies is another sign of the sector’s increased maturity. These large, established companies—with broad customer bases and efficient distribution models—are well positioned to continue growing profitably, making it difficult for smaller competitors to challenge them in their core product areas.

However, success in cybersecurity is not limited to the largest players. Innovative, cloud-native companies continue to outperform on growth, demonstrating that technological differentiation and market focus remain powerful drivers of performance. Companies like SentinelOne, CrowdStrike, Cloudflare and Zscaler all posted revenue growth above 27% in 2024. Additionally, CyberArk continues to see increasing success with its leadership in identity security and access management. These trends highlight that innovative, specialized players targeting topical growth areas can profitably grow at above-average rates and be rewarded in the capital markets.  

Beyond the publicly traded cybersecurity companies analyzed in this report, the broader cybersecurity landscape also includes large technology companies with dedicated cybersecurity divisions as well as many private-equity-backed companies. Public technology giants like Microsoft (MSFT), Broadcom (AVGO), Google (GOOG) and Cisco continue to increase attention on cybersecurity initiatives and are focused on expanding their current product lines with additional cybersecurity tools and features, often through acquisition. Meanwhile, private equity firms, particularly Thoma Bravo, continue to build their cybersecurity portfolios with acquisitions of private and formerly public companies like Dark Trace, Ping Identity, ForgeRock, and SailPoint (which recently went public again). Some of these private equity firms’ aggregate cybersecurity holdings rival or exceed the leading public companies in employee count and revenue. However, because they generally operate their acquired companies separately, they aren’t viewed in the same leadership light as the large publicly traded cybersecurity companies. Additionally, private equity ownership sometimes prioritizes operational efficiency and profitability over aggressive innovation and market expansion, which can affect their long-term competitive positioning.

Concluding thoughts

As the cybersecurity market matures, success is becoming more selective, and not all companies will benefit equally. Smaller-cap, lower-growth cybersecurity companies face increasing challenges in sustaining momentum. Given all the companies we analyzed in this report generated non-GAAP earnings in 2024, profitability alone is no longer a differentiator—it is an expectation. Further, companies with slower growth trajectories may struggle to stand out as competition for enterprise spending intensifies. While opportunities remain for companies that can carve out niches through technological innovation or strategic positioning, particularly in emerging high-growth areas, those lacking strong, profitable growth or a clearly differentiated competitive advantage may find it increasingly difficult to thrive in an environment where scale or radical innovation are increasingly essential for success.