{"id":15103,"date":"2022-02-19T17:05:07","date_gmt":"2022-02-19T17:05:07","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/19\/cybersecurity-stocks-caught-in-the-storm-while-private-firms-keep-rising\/"},"modified":"2022-02-19T17:05:07","modified_gmt":"2022-02-19T17:05:07","slug":"cybersecurity-stocks-caught-in-the-storm-while-private-firms-keep-rising","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/19\/cybersecurity-stocks-caught-in-the-storm-while-private-firms-keep-rising\/","title":{"rendered":"Cybersecurity stocks caught in the storm while private firms keep rising"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

The pandemic precipitated what is shaping up to be a\u00a0permanent shift<\/a>\u00a0in cybersecurity spending patterns.\u00a0As a direct result of hybrid work, chief information security officers have invested heavily in endpoint security, identity access management, cloud security and further hardening the network beyond headquarters.<\/p>\n

Moreover, the need to build security into applications from the start, rather than bolting on protection as an afterthought, has led to vastly heightened awareness around DevSecOps, which integrates software development, security and information technology operations.\u00a0Finally, attacking security as a data problem with automation and artificial intelligence is fueling new innovations in cybersecurity products and services and spawning well-funded, disruptive startups.<\/p>\n

In this Breaking Analysis, we present our quarterly findings on the security sector. We\u2019ll share the latest Enterprise Technology Research survey data, identify the companies with customer spending momentum and identify some of the market movers.<\/p>\n

What\u2019s the news in cybersecurity?<\/h3>\n

\"\"<\/p>\n

Nary a week goes by without more concerning news about cyberattacks. The latest focus in the headlines is\u00a0Russia\u2019s relentless attacks<\/a>\u00a0on critical infrastructure in the Ukraine \u2013 including banking and government websites \u2014 and weaponizing information to spread panic.<\/p>\n

The hacker group BlackByte put the\u00a0double whamm<\/a>y on the San Francisco 49ers, meaning they exfiltrated data\u00a0and<\/em>\u00a0encrypted the organization\u2019s files.<\/p>\n

Then there was the best Super Bowl ad last Sunday, the\u00a0Coinbase Global Inc.\u2019s floating QR code<\/a>. Millions of people rushed to scan the code and participate in the Coinbase BTC giveaway. This highlights yet another exposure, the willingness of individuals to click on unknown links and random QR codes. So many people read the code on their smartphones that it crashed Coinbase\u2019s website. What does that tell you?<\/p>\n

In other security news,\u00a0Securonix Inc. raised $1 billion<\/a>. This on top of Lacework Inc.\u2019s massive $1.3 billion raise last November. Both of these companies are attacking security with data, automation and APIs that can engage machine intelligence. In its announcement, Securonix specifically mentioned the momentum from MSSPs \u2013 managed security service providers \u2013 and that\u2019s a trend we see as increasingly gaining traction as customers are just drowning in security incidents without the staff to handle them.<\/p>\n

Peter McKay\u2019s company\u00a0Snyk Ltd. acquired Fugue Inc.<\/a>, a company focused on making sure security policies are consistent throughout the software development lifecycle. It\u2019s an example of developer-defined\u00a0security where policy can be checked at the dev, deployment and production phases of software development to ensure the same policies are in place at all stages, including monitoring at runtime. Fugue, according to Crunchbase, had raised $85 million to date.<\/p>\n

In other company news,\u00a0Cisco Systems Inc. was reported<\/a>\u00a0to be acquiring Splunk Inc. for not much more than Splunk is worth today and talks reportedly broke down. This would be a major move in security by Cisco and underscores the pressure in the market to consolidate. Cisco would get an extremely strong customer base and through efficiencies could improve Splunk\u2019s profitability. But it seems like the premium Cisco was willing to pay was not enough to entice the board to act \u2014 probably at least a few billion dollars shy of what it will take to get a deal done. We\u2019ll discuss this later in the post.<\/p>\n

Datadog Inc.\u00a0blew away earnings<\/a>\u00a0again and the stock rose 12%. It hass pulled back now thanks to Putin, but it\u2019s one of those companies disrupting Splunk. Datadog is less than half the size of Splunk in revenue, but its valuation is more than two-and-a-half times greater.<\/p>\n

Finally Elastic, another Splunk disruptor, settled its\u00a0trademark dispute with Amazon Web Services Inc.<\/a>\u00a0and there will be only one Elasticsearch in the marketplace now, removing confusion for customers and stress for Elastic.<\/p>\n

Recent market pullbacks don\u2019t diminish cyber\u2019s long-term performance<\/h3>\n

Let\u2019s take a high level look at how cyber companies have performed in the stock market over the past five years. The graph\u00a0below shows the performance of the CIBR ETF.\u00a0Note the March 2020 crosshairs signifying the start of the lockdown.<\/p>\n

\"\"<\/p>\n

The trajectory of cybersecurity stocks as shown by the orange and blue lines surely steepened post Mach of 2020. And it has been down with the market lately, but the runup as, you can see, was substantial, eclipsing the trajectory of the previous year, thanks to the spending dynamics we talked about at the open.<\/p>\n

Comparing the pandemic performance of SPLK, PANW, FTNT, OKTA, CRWD and ZS<\/h3>\n

The chart below shows data from six top companies we\u2019ve been following closely in the space since before the pandemic. The top two rows show the benchmark S&P 500 and Nasdaq prices.\u00a0The bottom rows list the specific stocks.<\/p>\n

The remaining columns track: 1) The index price or market cap of the company just before the pandemic; 2) The same data one year later; 3) The peak value during the pandemic; 4)\u00a0The current value; 5) Percentage change since pandemic peak; 6) The change from pre-pandemic prices in February 2020; 7)\u00a0The pre-pandemic revenue multiple (using a trailing-12-month revenue metric); 8) The revenue multiple in August 2020, when multiples were really high; 9) Today\u2019s TTM revenue multiple; and 10) Near-term growth rates based on recent quarterly guidance from managements.<\/p>\n

\"\"<\/p>\n

Lots of data, but what does it tell us? First, the S&P and the Nasdaq are well up from pre-pandemic levels. And they\u2019re off today roughly 9% and 15% respectively from their peaks during the pandemic.<\/p>\n

Now let\u2019s look at the companies by comparison.\u00a0Splunk<\/strong>\u00a0has been struggling. It definitely had a tailwind from the pandemic as all boats seemed to rise, but its execution has been lacking and it\u2019s now 30% off from pre-pandemic levels. And its multiple is compressing, so\u00a0perhaps Cisco thought it could pick the company up for a discount.<\/p>\n

Turning to\u00a0Palo Alto Networks Inc, <\/strong>we had reported on some of the challenges the company faced moving to a cloud-friendly model pre-pandemic and we said at the time we\u00a0fully\u00a0expected the company to rebound<\/a>\u00a0and that\u2019s exactly what happened. It rode the tailwinds of the last two years, is up over 100% from its pre-COVID levels and its revenue multiple is expanding thanks to its healthy growth rates and strong execution.<\/p>\n

Fortinet Inc.<\/strong>\u00a0had been doing well coming into the pandemic \u2013 in fact, we had said it was executing on a cloud strategy better than Palo Alto Networks at the time. So it didn\u2019t get as much pandemic momentum at first. But the company has been rewarded for executing well. And as you can see, with a 155% increase in valuation since just before the pandemic, it\u2019s going more than OK for Fortinet investors.<\/p>\n

Okta Inc.<\/strong>\u00a0is a name that we\u2019ve\u00a0followed closely<\/a>. The identity access management specialist rocketed post pandemic, but since its Auth0 acquisition the stock has pulled back. Investors are concerned about its guidance and profitability and several analysts have downgraded their price targets on Okta. Investors are also concerned with the tough comparisons year over year and the effects of the Auth0 ingestion.<\/p>\n

We still really like the company.\u00a0The Auth0 acquisition gives it a strong developer vector to complement Okta\u2019s enterprise focus. We think the company is going hard after market presence and is willing to sacrifice short-term profitability. We actually like that posture. It\u2019s very Frank Slootman-like. The question is: Does Okta have\u00a0inherent profitability, meaning could the company, if it so chose to do so, dial down its spending and show a healthy profit?<\/p>\n

We think yes. Okta is sticky. The company has a strong net revenue retention rate of around 120%. The company spends a lot on R&D \u2013\u00a0 well over 30% of its revenue\u00a0 \u2013 and a whopping 55%-plus on go-to-market. It\u2019s guiding a compound annual growth rate in revenue in the mid-30s over the mid- to long-term, and near-term should beat that benchmark handily.<\/p>\n

But you can see the red highlights on Okta, and even though it\u2019s up 59% from its pre-pandemic levels, it\u2019s far behind its peers shown on this chart \u2014 especially\u00a0CrowdStrike Holdings Inc.<\/strong>\u00a0and\u00a0Zscaler Inc.<\/strong>, which has outperformed all its peers in this chart. The latter is somewhat less impacted by the pullback in stocks as fears of inflation, interest rates and a Russian invasion escalate.\u00a0But these highfliers were bound to pull back. The question is: Can they maintain their category leadership? For the most part, we think, they can.<\/p>\n

Yes, the security market got more crowded<\/h3>\n

Below is one of our favorite XY view charts with Net Score or spending momentum on the Y axis and Market Share or pervasiveness in the data on the horizontal axis. The red line at 40% indicates highly elevated spending levels and the chart insert shows how the data is plotted by each company.<\/p>\n

\"\"<\/p>\n

Although the graph above is an eye chart, this shows only the companies ETR captures in its survey with more than 50 mentions. And there are many more out there which don\u2019t get reported in the ETR spending data. So the first takeaway is this crowded market and with the private funding of startups it\u2019s only getting more crowded.<\/p>\n

The second point to note is there are a lot of companies above the 40% mark and plenty with respectable Net Scores just below. Third, check out SentinelOne Inc., Elastic N.V., Tanium Inc., Datadog, Netskope Inc. and Darktrace PLC. Each has under 100 Ns but they\u2019re increasingly prominent in the survey and deserve attention \u2014 especially SentinelOne pos- IPO.<\/p>\n

Zooming out\u2026 the market is still really crowded<\/h3>\n

The chart below shows the same XY view but filters the data on companies with more than 100 mentions in the survey.<\/p>\n

\"\"<\/p>\n

The chart gets a bit cleaner but still pretty crowded. Auth0 leads everyone in Net Score. Okta is also up there, so that\u2019s a very positive sign for the acquisition, despite its high price tag. CrowdStrike, SailPoint Technologies Holdings Inc., CyberArk Software Ltd., Cloudflare Inc. and Zscaler all are right up there as well.<\/p>\n

Then the bigger companies come into focus. Palo Alto Networks is very impressive because it\u2019s well above the 40% mark and it has a large presence. Microsoft Corp. is just ubiquitous.<\/p>\n

The positions of Cisco and Splunk make an interesting combination.\u00a0Both have respectable Net Scores and presence in the data. Al Shugart was the founder and chief executive of Seagate Technologies Inc. and a brilliant Silicon Valley icon.\u00a0Asked if he\u2019d consider buying a specific company he said:<\/p>\n

\n

If you want to know if I\u2019m thinking about buying a company, ask yourself if it were free, would I take it? The answer isn\u2019t always yes, because acquisitions can be messy.<\/p>\n<\/blockquote>\n

In the case of Cisco and Splunk, we think the answer would be a definitive yes. It would expand Cisco\u2019s portfolio and make it the leader in security with an opportunity to bring greater operating leverage to Splunk. Cisco just has to pay more if it wants the asset.<\/p>\n

We asked\u00a0our ETR colleague Erik Bradley what he thought and he weighed in with this comment:<\/p>\n

\n

Splunk isn\u2019t growing the customer base, but it\u2019s sticky. Cisco could roll Splunk into its security suite and expand its portfolio. Splunk is a leader in the security information and event management space and Cisco really is missing that piece. Yes, it makes sense at a discount.<\/p>\n<\/blockquote>\n

Eight cyber firms on the move<\/h3>\n

Now we filter the data even more and look at some of the companies that have moved in the survey over the past year and a half. First we\u2019ll go back to July 2020. The chart below shows the same two-dimensional picture isolating Auth0, Okta, SailPoint, CrowdStrike, Zscaler, CyberArk, Fortinet and Cisco.<\/p>\n

\"\"<\/p>\n

Why are we highlighting these firms? Because they\u2019ve made some major moves to the right and some even up in since last July and that\u2019s what we show next.<\/p>\n

Expanded survey presence for Auth0, Okta, SailPoint, CrowdStrike, Zscaler,\u00a0 CyberArk, Fortinet and Cisco<\/h3>\n

Below is the data from the January 2022 survey. The arrow start points show the positions in July 2020 (from the previous chart). All these players have made major moves to the right. Why? Well, it\u2019s likely a combination of strong execution and the fact that security is on the radar of every CEO, chief information officer, CISO of course, business head, board directors\u2026 everyone. The market momentum, especially for the leaders, is tremendous.<\/p>\n

Auth0 has improved on its already high Net Score since the acquisition. Okta, for its part, is expanding its presence in the data set with solid spending momentum. With Auth0 that only improves. SailPoint is holding Net Score high while expanding its presence, as is Zscaler. CrowdStrike making moves up and to the right, and Fortinet is expanding while maintaining momentum. Cisco as well continues to be a trusted security player. Its notable decrease in momentum could, over time, be buoyed by an acquisition of Splunk.<\/p>\n

\"\"<\/p>\n\n

Four-star security firms in Q1 2022: Microsoft, Palo Alto Networks, CrowdStrike and Okta<\/strong><\/h3>\n

Let\u2019s take a look at what\u2019s become a bit of a tradition in Breaking Analysis, and look at the firms that have earned four stars.<\/p>\n

\"\"<\/p>\n

Four-star firms are leaders in the ETR survey data that demonstrate both a large presence and elevated spending momentum.\u00a0In this chart above we filter the firms (N>100) to isolate those companies with more than 100 responses. On the lefthand side, we sort by Net Score or spending velocity, and on the righthand side we sort by Shared Ns. We show the top 20 for each, and the red line shows the top 10 cutoff points.<\/p>\n

Companies that show up in the top 10 for both spending momentum and presence in the data set earn four stars. If they show up in one and make the top 20 in another, they get two stars, and we\u2019ve added one star as an honorable mention for those companies making the top 20 in both.<\/p>\n

Microsoft<\/strong>,\u00a0Palo Alto Networks<\/strong>,\u00a0CrowdStrike<\/strong>\u00a0and\u00a0Okta<\/strong>\u00a0make the four-star grade. Okta makes it even without Auth0, which has the No. 1 Net Score in this data set and 115 Shared N. So you can add that to Okta. The weighted average would pull Okta\u2019s Net Score to just above CyberArk to take 4th place and its Shared N would bump Okta up to 3rd on the list.<\/p>\n

Cisco,\u00a0Splunk,\u00a0Proofpoint\u00a0Inc., KnowB4 Inc., Zscaler and\u00a0CyberArk\u00a0get two stars and you can see the honorable mentions with one star.<\/p>\n

Now, thinking about a Cisco-Splunk combo, you\u2019d get an entity with a Net Score in the mid 20s \u2013 not too bad \u2013 and they\u2019d be No. 1 on the righthand side of this chart with the largest market presence in the survey, by far.<\/p>\n

Expectations for 2022 in cyber<\/h3>\n

\"\"<\/p>\n

The trends around hybrid work, cloud migration and the attacker escalation continue to drive cybersecurity momentum and will do so indefinitely.<\/p>\n

You\u2019re seeing private companies getting gobs of money which really speaks to the fact that there\u2019s no silver bullet in this market. It\u2019s complex, chaotic and cash rich.<\/p>\n

This idea of MSSPs on the rise will continue. About half the midsized and large organizations in the U.S. don\u2019t have a security operations center and outsourcing to one that can be tapped on a consumption basis \u2013 as a service \u2013 just makes sense.<\/p>\n

We see the momentum companies that we\u2019ve highlighted over the many quarters of Breaking Analysis episodes as forming a strong base in the market, going for share and footprint and focusing on growth. They have good balance sheets and strong management teams and we think they\u2019ll be the leading companies in the future. Zscaler, CrowdStrike, Okta, SentinelOne, CyberArk, SailPoint \u2013 over time joining the ranks of $1 billion cyber firms such as Palo Alto Networks, Fortinet \u2014 and Splunk if it doesn\u2019t get acquired.<\/p>\n

All that underscores the pressure for consolidation and M&A in the market. That is almost assured with the fragmentation of companies and so many well-funded new entrants fighting for escape velocity.<\/p>\n

Keep in touch<\/h3>\n

Thanks to Stephanie Chan who researched several topics for this episode, and to Alex Myerson on production. Alex handles the podcasts and media worklflows. And special thanks to Kristen Martin and Cheryl Knight, who help us keep our community informed and get the word out.<\/p>\n

Remember we publish each week on\u00a0Wikibon<\/a>\u00a0and\u00a0SiliconANGLE<\/a>. These episodes are all available as\u00a0podcasts wherever you listen<\/a>.<\/p>\n

Email\u00a0david.vellante@siliconangle.com<\/a>, DM\u00a0@dvellante on Twitter<\/a>\u00a0and comment on\u00a0our LinkedIn posts<\/a>.<\/p>\n

Also, check out this\u00a0ETR Tutorial we created<\/a>, which explains the spending methodology in more detail.\u00a0Note:\u00a0ETR<\/a>\u00a0is a separate company from Wikibon and SiliconANGLE.<\/i>\u00a0If you would like to cite or republish any of the company\u2019s data, or inquire about its services, please contact ETR at legal@etr.ai.<\/p>\n

Here\u2019s the full video analysis:<\/p>\n