Growth continues to slow with more focus on profitability

We present our annual analysis of publicly traded, enterprise-focused cybersecurity firm performance. We highlight that 2023 aggregate revenue grew 18.4%, substantially slower than 2022’s 26.5% growth and 2021’s 24.3% growth. Average revenue growth was 16.4%, somewhat below 2023 initial guidance for 18.5% growth on average; initial 2024 growth guidance is only 13.5% on average.

We believe the revenue growth slowdown reflects cybersecurity companies heeding investors’ desire for more focus on profitability. From 2022 to 2023, EBIT/EBITDA margins increased on average by 730 basis points, and 2024 guidance implies margins will increase by another 320 basis points.

Should it continue for multiple years, we think investors may view a shift to slower sector growth, even if accompanied by greater profitability, as limiting the sector’s long-term potential. However, we don’t see anything in the threat environment to make us believe market growth will slow for an extended period, and we are hopeful that our public cybersecurity group will sustain double-digit revenue growth, perhaps above 2024 projected levels, for some time to come.

In the past we’ve noted a trend toward increased market capitalization concentration among the publicly traded cybersecurity companies that might portend a winner-takes-most market structure; however, given recent shifts and considering other evidence, we remain optimistic the market will continue to be open to many winners, including smaller companies.

How we looked at the market

This report presents our annual analysis of publicly traded, enterprise-focused cybersecurity firms’ performance.

To be included in this year’s analysis of stock performance, companies had to be listed on a U.S. exchange, have most-recent-year revenue greater than $100 million, derive the vast majority of their business from supplying cybersecurity solutions to businesses and government customers, and have been public for all of 2023. Relative to our most recent annual analysis in April 2023, we removed ForgeRock, which was acquired during the year. Our analysis includes Cisco Systems‘ (CSCO) separately reported cybersecurity revenue in the revenue growth section. Consistent with our focus on business-to-business companies, we again exclude consumer-focused cybersecurity companies such as Gen Digital (GEN), formerly known as Norton LifeLock. We perform our analysis at the end of the first quarter so that we can use reported full-year data (as opposed to estimates), including several companies whose fiscal year ends in January, and so we can consider company guidance for 2024.

2023 revenue growth slowed, consistent with initial 2023 guidance

We present revenue and revenue growth by company in Table 1 and conclude cybersecurity demand growth slowed in 2023 from a recent peak in 2022. Aggregate 2023 revenue for these companies grew 18.4% to $32.6 billion.

This is the first deceleration of aggregate revenue growth since the substantial revenue uplift from COVID-19 in 2021. The aggregate 2023 revenue growth rate declined by 8.0 points, the average by 12.4 points and the median by 9.3 points. The 2023 aggregate growth rate was more in line with the growth rates seen in 2018 through 2020 for the comparable set of public companies that were analyzed in our reports at that time. We believe the broader cybersecurity industry is growing more slowly than this group of public companies, as we regularly see industry growth estimates in the high-single-digit and low-double-digit percentage ranges, fairly close to the growth rates for Check Point (CHKP) and Cisco’s end-to-end security segment. We think the 11 companies in our analysis that grew revenue by 13% or more in 2023 are taking share from the rest of the industry, and we explore this dynamic in more depth below.

TABLE 1: Revenue and revenue growth 2021 to 2023 (sorted by 2023 growth, revenue in millions)

Source: Company data, Capital IQ, First Analysis.
Notes: (1) Revenue and growth rates are based on CRWD’s, OKTA’s, S’s and SCWX’s reported revenue for fiscal years ended January of 2020, 2021, 2022, and 2023. (2) Revenue and growth rates are based on CSCO’s, ZS’s and PANW’s reported revenue of the four quarters through January (fiscal Q2) in 2020, 2021, 2022, and 2023. *End-to-end security segment only.

We acknowledge the limitations of using revenue growth as a proxy for demand. These include:

• A significant and growing number of companies in this analysis recognize most of their revenue from contracts already booked (i.e., from deferred revenue balances), making bookings or changes in short-term deferred revenue better indicators of current demand.
• As companies transition to more subscription sales, reported revenue is depressed relative to actual demand during the transition. For example, CyberArk Software (CYBR) has finished such a transition, having accelerated its revenue growth from levels under 10% in 2020 and 2021 to 17.7% in 2022 and 27.1% in 2023. In its fourth-quarter results, the company reported recurring revenue is now 90% of total revenue and fourth-quarter subscription revenue grew 69.8% year-over-year. Varonis Systems (VRNS) is now going through a similar transition. The company’s subscription annualized recurring revenue (ARR) represents 23% of the company’s total ARR, buttressing expectations the transition can be completed by the end of 2026. Due to this ongoing transition, 2023 revenue increased only 5.4%.
• Revenue growth at some companies is affected by discrete factors unrelated to market demand for their solutions. For example, SecureWorks (SCWX) has intentionally exited some of its managed security service provider business over the past two years to focus on its higher-margin Taegis software, leading it to post one of only two revenue declines in 2023 and the only revenue decline in our 2022 analysis.
• Our analysis includes acquired revenue. In most cases this year, acquired revenue did not materially affect growth rates, but there are instances where it causes some distortion. We try to call these out in our analysis. For example, Okta’s (OKTA) 2021 revenue growth rate was skewed by its large mid-year acquisition of AuthO, and SentinelOne’s (S) growth rate was affected by its acquisition of Attivo Networks in May of 2022. Next year, we will account for the increased revenue Cisco generates from its acquisition of Splunk, which closed on March 18.

Nonetheless, we feel revenue is one of the best ways to gauge industry health and growth. Other metrics, such as bookings, can become materially distorted due to changes in contract duration, lumpy big deals and many other factors.

Guidance suggests revenue growth will slow further

2023’s growth slowdown was predicted in 2023 guidance. Initial guidance for 2023 revenue was for 18.5% growth on average (median 17.1%), a significant decline from 2022’s 28.8% actual average growth. 2023 actual average revenue growth came in at 16.4%, even slower than initial guidance. Based on initial guidance for 2024 of 13.5% revenue growth on average (median 10.0%), these companies expect another year of materially slower growth. Should 2024 guidance be accurate, actual 2024 revenue will grow at only about half the rates seen in 2022 and will fall below the growth rates we reported for the years leading up to COVID-19.

Cybersecurity stocks rebounded from 2022’s rough performance

In last year’s analysis, we noted that despite 2022’s accelerating revenue growth and companies generally beating guidance, stock performance was surprisingly dismal, with the average stock in our analysis losing 28% of its value and the median stock losing 37%, both much worse than the 12% to 17% declines seen in some of the major indexes. We attributed this to 2023 guidance, which implied a substantial slowdown in revenue growth, as noted above. Given guidance for even slower revenue growth in 2024, one might have expected 2023 to be another dismal year for cybersecurity stock performance. But it wasn’t. The average stock gained 39% (31% median gain) over the past year (period ended March 25) — in line with Nasdaq’s 39% gain and above the S&P 500’s 31% gain.

Seven of the 16 cybersecurity companies outperformed the Nasdaq. CrowdStrike (CRWD) led with its 147% one-year stock price increase and contributed the most of any company (32 points) to the group’s market-cap weighted gain of 66%. Palo Alto Networks (PANW), with the largest market cap in the group, gained 49%. Only SecureWorks and One Span (OSPN) declined by more than 10% over the period. SecureWorks continued its strategic wind-down of its managed security service business and its shift toward recurring SaaS revenue from its higher-margin Taegis product. One Span, after years of declining revenue or low-single-digit revenue growth, announced a management shakeup and named an interim CEO in January 2024. We will see if new leadership can alter the course of this perpetual underperformer (it is the worst three-year and second-worst five-year performer in the group on the basis of share price).

Profit margins continued to increase, and 2024 guidance suggests further expansion

Given the generally solid stock price performance in 2023 and despite the significant stock price declines in 2022, the group’s market-cap-weighted stock price performance is still above the major indexes in our three-year and five-year comparisons, as noted in the table. We think this reflects a perception that cybersecurity remains not just a fundamentally sound end market, but also a sector offering generous returns for investors despite slowing growth. We speculate this past year’s strong stock price performance was due to a few factors, the most important being improving sector profitability.

We noted last year the cybersecurity sector was not immune to the shift of investor sentiment to favor companies with high free cash flow and profitability over companies with spectacularly high growth rates if they came with high rates of investment in their businesses (i.e., high cash burn and operating losses). In fact, in 2022, the fastest-growing and high-flying cybersecurity companies were hit hardest in the public markets despite beating guidance by the widest margin. These were companies with a cloud orientation as their core value proposition. This included SentinelOne (S), Zscaler (ZS), CrowdStrike, Cloudflare (NET), and Okta (OKTA). We think there may have been some skepticism that these companies could show solid growth, albeit slower, if they focused on greater profitability.

If that was the case, skeptics were answered over the past year as companies increased profitability, providing support for 2023’s stock price appreciation. We analyzed companies’ historical reported non-GAAP EBIT margins as well as 2024’s guidance. For companies that did not provide EBIT guidance, we used EBITDA margins instead, as they offer a similar view into company profitability. From 2022 to 2023, these margins increased on average by 730 basis points, a significant jump. 2024 guidance implies margins will increase again, albeit by a smaller increment (320 basis points). We view this as evidence management teams believe the market will continue to reward companies with increasing, strong and healthy operating profit.

Cloud-centric players’ stocks hit the hardest in 2022, but appreciate the most in 2023

The fast-growing cloud centric companies that saw the worst stock price declines in 2022, including CrowdStrike, Zscaler, Cloudflare and SentinelOne, subsequently improved margins in 2023 and were among biggest gainers in 2023, as seen in Table 2. Varonis Systems and CyberArk were also among the top gainers because of both companies’ significant business model shifts. Varonis expects to complete its transition to subscription sales by 2026, and CyberArk has completed its transition and now reports subscription revenue is 90% of total revenue. Behemoth Palo Alto Networks follows closely behind in stock appreciation and continues to grow at a rapid rate for its size.

TABLE 2: Cybersecurity stock price and market cap analysis (market cap. in millions)

Source: First Analysis, Capital IQ.

Revenue performance in line with guidance, but earnings significantly outperform

We believe comparisons between 2023 guidance and actual results also show management teams have heeded the stock market’s shift toward valuing profitability over revenue growth. We compare initial guidance to actual results (Table 3) for a few reasons. First, the comparison provides an indication of whether demand over the course of the year strengthened (with companies beating their initial revenue guidance) or weakened (companies falling short of initial guidance). Second, when we bring stock price into the analysis, we have historically been able to make some assumptions about how investors perceive the relative importance of revenue growth versus profitability.

TABLE 3: 2023 revenue and EPS initial guidance compared to actual results
(sorted by revenue difference percentage, $ in millions except per-share data)*

Source: First Analysis, company reports, Capital IQ.
Notes: *For July and December year-end companies, we show fiscal 2023 figures; for January year ends, we show fiscal 2024 figures. For companies lacking initial revenue and/or EPS guidance, we show initial consensus estimates as of approximately one week after reported year-end results. EPS = earnings per share.

Actual 2023 revenue fell below initial guidance by 1% on average. This was a significant departure from previous years, when most companies beat, often by a wide margin. For example, in 2022, companies outperformed revenue guidance by 2% on average, and in 2021, they outperformed by 7% on average.

Most companies reported actual 2023 revenue within a few percent of initial revenue guidance, but there were a few outliers. Zscaler beat its guidance by 8.2%, and Okta beat by 4.6% (they posted similar beats in 2022). While both stocks appreciated substantially in 2023, the gains were not at the top of the range. On the other end, Radware (RDWR) missed initial revenue guidance by 13.3% and SecureWorks, by 6.2%. They also posted the only revenue declines in 2023. The fact they were also two of only three stocks in the group that declined in the year suggests materially missing revenue estimates still matters. But small misses, which historically were punished, were forgiven in 2023: Six other companies missed revenue guidance or comparable estimates (for a total of eight missing targets, much higher than 2022’s five and 2021’s two) and yet stocks appreciated broadly across the group. On the other hand, all but one company beat original EPS guidance, better than the tally of two that missed 2022 guidance and the four that missed in 2021. Missing EPS guidance was not very highly correlated with stock performance previously but seems to be more so now. More companies missing revenue guidance in 2023 and 2022 but fewer missing EPS guidance suggests companies think it’s more important to meet profit guidance and improve margins than it is to grow revenue.

Where will the market’s focus go?

Does the increased focus on profitability mean sector revenue growth will stay in low gear (perhaps settling in at the gross domestic product growth rate plus a few points)? Or can it find a middle ground, remaining a relatively high-growth sector but with a more balanced emphasis on profitability? We think investors will view a shift to slower sector growth, even if accompanied by greater profitability, as limiting the sector’s long-term potential for above-market returns and would view this negatively for the group. However, we don’t see anything in the threat environment to make us believe market growth will slow for an extended period, and we are hopeful our public cybersecurity group will sustain double-digit revenue growth, perhaps above 2024 projected levels, for some time to come.

Winner-take-all dynamics not accelerating in this market

Over the past few years, we observed increased sector market-cap concentration in some of the largest companies and specifically highlighted Palo Alto Networks and Fortinet (FTNT), which were posting above-average revenue growth and increasing profitability. Their market capitalization share of our public universe  grew from roughly a third in March 2021 to 47% in March 2023. It made us wonder whether this industry, like many technology and other sectors, would see a few winners dominate, taking a significant share of revenue and an even greater share of industry profits as they benefitted from scale and leaving others with few paths to generate strong returns other than finding profitable niches or being acquired by one of these leaders.

Both Palo Alto and Fortinet offer a broad array of security solutions and a platform strategy designed to allow customers to standardize on their solutions. We think Palo Alto’s CEO Nikesh Arora’s comments on its most recent earnings call (for its fiscal second quarter ending January 2024) were noteworthy in this regard. He said, “[we’re seeing] spending fatigue in cybersecurity. This is new. As adding incremental point products is not necessarily driving a better security outcome for [customers].” To garner additional market share and smooth implementation transitions for customers who may be reluctant to switch providers, Palo Alto is rolling out promotional pricing for customers who adopt its platform: For customers locked into contracts for competing products, Palo Alto will provide its products for free until those contracts expire. While Palo Alto stock plummeted following this announcement (and the stocks of many other cybersecurity stocks declined in sympathy), we believe Palo Alto is well positioned to execute this strategy given its scale and large cash reserves, and the announcement adds fuel to investor fears that big cap winners will take most of the market. 

We continue to think this is a dynamic worth watching, but we feel the evidence this year supports an expectation the market will remain open for many winners, including smaller companies. This has been a hallmark of this industry for more than 30 years and a reason investors in many companies have been well rewarded. This year’s data shows Palo Alto and CrowdStrike account for 47.3% of the total capitalization with CrowdStrike surging from 13.5% of the industry’s total market capitalization a year ago to 21.8% today while Fortinet’s market cap percentage declined from 21.5% to 14.4%. This marks a reversal of fortunes for Fortinet and suggests sector leadership remains dynamic. Furthermore, while both Palo Alto and Fortinet grew revenue faster than the average and median growth rates, the gap was small, and some other companies with more than $1 billion in revenue, such as Zscaler and Cloudflare, grew substantially faster, suggesting they are taking share from Palo Alto and Fortinet.

Additionally, diversified public technology companies that have large and growing cybersecurity divisions as well as cybersecurity companies owned by private equity investors are becoming more significant. For example, Broadcom (AVGO) is a multi-billion-revenue-dollar cybersecurity player via its Symantec enterprise security business and its other security assets. Microsoft (MSFT) has highlighted the significant scale of its security business in conference calls. Google (GOOG) added cybersecurity company Mandiant to its arsenal in 2022, and Cisco, which is already a major player, just completed its acquisition of Splunk. Private equity investor Thoma Bravo has amassed a considerable cybersecurity footprint through many acquisitions, including formerly public Sail Point, Ping Identity, and ForgeRock along with dozens of private companies. Taking all this into account, we do not see strong evidence cybersecurity will become a winner-take-most market in terms of revenue or profit, and we remain optimistic the market will continue offering investors opportunities with good potential to outperform the broad market.