Cyber Security Comparisons

Now that earnings are out for the major cyber security players, I figured I would go back and do a quick comparison of their results. As in the past, I am going to look at the three major cloud only players, ZS, CRWD, S as well as the integrated more traditional Firewalled systems and cloud systems player, PANW.

I started this because I am the tickerguide for PANW, and I thought it would be an interesting comparison since Palo Alto had seemed to be on the cheaper end of things compared to some of the newer, smaller companies. I recognize that the reason it is cheaper is because of both the overall growth rates and the perceived shift from firewalled systems and hardware to cloud based operations.
I am in no way trying to put together any definitive answers but thought the back to back numbers comparisons might be good. I have done this for almost two years now and the feedback I have always gotten is that everything is moving to the cloud and PANW is going to get run over by the cloud only players. It hasn’t really turned out that way so lets look at the numbers.

Lets start simple:

                               PANW         CRWD        ZS      S
Revenues Qtr ($M)             $1,551        $535       $318    $102
Revenue growth (%)             27%           58%        61%    124%
Non-GAAP Net Inc ($/sh)        2.39         0.36       0.25   -0.20
Free Cash Flow (FCF $M)       $485          136         76    -66.9
Adj FCF Margin                 33%          25%         24%    -66%

And to try to put the companies on an even basis, I also look at the Annual Recurring Revenue (ARR). For PANW, they separate out their cloud SAAS service by the name Next Gen Security (NGS).

ARR ($B)                      $1.89         $2.14      $1.27   0.44
ARR increase (%)               61%          59%         61%     122%

And Finally, lets compare on a Price / Sales basis… 

Recent Price                   $176        $176       $176        $28
diluted share count (M)        299          233        143        281
Market Cap (PRxSh ct, $B)     $52.6        41.0       25.2        7.9
Pr/ (qtr Sales x4)             8.5         19.2       19.8        18.0       

After you look through the tables a bit you can see many interesting comparisons and both similarities and differences between the four companies. At a high level, it is easy to see how PANW is a different animal. Much higher revenues, earnings and free cash flow along with obviously lower overall growth rates. But the interesting fact is that PANW is growing it’s cloud SAAS software at the same rate as both ZS and CRWD.

S is a bit of a different animal so let’s talk them first. They are growing like mad, but they are losing money very quickly and are much smaller than the other two cloud players. The price/sales is actually cheaper than ZS and CRWD so that makes them interesting to me, but certainly the more risky play. Can they keep growing fast enough and start to increase their margins so that they turn positive in cash flow before the eventual slow down happens? Who knows. For me, it is hard to turn down a 100% plus grower in an industry that is itself expanding rapidly. So I have a position, albeit small one compared to others.

Now let’s look at CRWD and ZS, these seem very similar to me. Similar growth rates, similar earnings and cash flow margins and similar Pr/sales ratio. ZS Sales are only about ? of CRWD, but that is matched by the market cap differences. These two seem pretty similar to me but I like the bigger company since this is a land and expand industry and CRWD’s lead seems beneficial. At the moment, I own quite a bit of CRWD, but do not own any ZS. Looking at this summary, it makes me think I should add some ZS but I have not done so yet.

Now lets look at PANW and compare it to CRWD. The challenge here is to separate out the firewalled portion versus the cloud. I don’t want to call it the hardware portion because that seems to be an unfair description. This is a both hardware and software business that is very sticky and in my opinion, may not be growing as fast but is not going away, and is making a lot of money. Okay, lets try to calculate some numbers.

PANW’s quarterly sales was $1.55B and it’s ARR SAAS portion was $1.89B. Since this is annualized, I have to divide by 4 to get a quarterly SAAS sales of $0.4725B. This is pretty similar but approximately 10% less than CRWD’s ARR. So that leaves $1.07B in the firewall business. In other words, if I theoretically break it into two companies, I get

                                  SAAS            	Firewalled
Quarterly Sales                       $.47B              $ 1.07B 

In an earlier post, someone has tried to do this comparison and gave PANW a significantly lower PR/Sales ratio on the SAAS portion because he believed the sales were lower and because he believed their growth was lower. In fact, Growth is equivalent (slightly higher!) and the price/ sales ratio for both ZS and CRWD are similar even though ZS is a smaller size.

So let’s value the SAAS business at slightly less PR/Sales than CRWD (and even less than ZS for that matter)

So Market Cap of SAAS portion = 1.89 x 19 = $35.9B

Since the entire company is being valued at $52.6B, that leave the Firewalled business at $16.7 Billion and a Pr/Sales ratio of 16.7 / (1.07x4) = 3.9.

Now is that a good price? Not sure, depends on the profitability and growth. Let’s take a shot at that. First growth:
The total growth was 27%, Since the SAAS portion was growing at 61%, that means that the remainder was growing at approximately :
Gr rate: (1.55 x 0.27) - (0.47 x 0.61 )) /1.07 =
( .4185 - .287 ) / 1.07 = 12% growth

And the margins on that sales now can be estimated. If I assume that PANW has the same FCF margins as CRWD, (this is probably low since the established business is better)…
So FCF due to Firewall business =
$485M - (470 x 0.25) = $368M and FCF margins are: 368/ 1.07 = 34.4%

Which is very nice. If I take an estimate on earnings by subtracting out CRWDs per share earnings and recalculating the PE ratio of just the firewalled company I get

$2.39 - (0.36x 1.89/2.14) = $2.07/share but the price per share for the Firewalled company would be:
$176 (1.07/1.55) = $121 and

PE= 2.07/ $121. = 58…. Remember this is PE not PS…. a Big difference.

Not cheap but this is for a company growing in the teens with very large Free Cash Flow margin.

So the real question is whether the incumbent has an advantage in selling SAAS systems. I don’t know the answer. What I do know is that PANWs stock price is actually up from 12 months ago and is down only 15% or so from the high in November. CRWD is down substantially from a year ago and about 40% from its high in November.
If I would have done this analysis a year ago, the firewalled company was almost free.

So my take is if you want to reduce your risk in an incredibly strong and growing industry, PANW would be a good risk reduction. One thing is clear, the SAAS portion of PANW is no slouch when compared to CRWD and the fact that they are clearly making headway in that business should not be overlooked.

PANW Tickerguide and Long CRWD, PANW, and S.


Hi Randy - thanks for this an I admire your work in the cyber security space.

I guess another way to look at PANW is to benchmark its legacy business performance and valuation against some more traditional or legacy operators.

CyberArk is growing at 15-20% and has a P/S of ~10
Fortinet is growing at 30-35% and has a P/S of ~10
Check Point is growing at 5-10% and has a P/S of ~6

So is the 12% growth and 3.9 P/S of mature Palo Alto worth it? I don’t know. I personally rate Palo Alto in total higher than these benchmarks (from a technology and a business perspective) but rate Fortinet and CyberArk (in that order) higher than the legacy portion of Palo Alto. Check Point is the most mature and legacy positioned of the lot which still somehow produces amazing cash flow and profitability and that’s about it.

My concern with attributing any real value at all to the legacy Palo Alto however is not that it competes with other legacy operators but whether the very success of the new Cloud/SaaS Palo Alto in part cannibalises legacy Palo Alto in which case it feels a very terminal business.

Palo Alto will need to use the legacy business very smartly to give new Palo Alto a leg up but balance the entire portfolio for optimal gains, which in itself besides representing a great platform to sell from adds a massive complication in strategy and execution.

ZS and Crowdstrike don’t yet have to worry about legacy portfolios maturing and going to zero.

To an extent I’m reminded of my own industry - pharmaceuticals where unless you are looking at an emerging biotech with innovative launch assets only, or some amount of M&A, generally the tail winds of new launches is almost completely mitigated by the headwinds of the maturation of the post patent loss declines in the mature brands/established products part of the portfolio amounting to a zero sum game. (GSK’s share price for instance has never recovered to the 2002 levels it reached at the point of merger and has gone sideways for 20 years despite new launches in that period).

When the amalgamated total growth is gone it’s gone and new asset growth really cannot drive fresh value creation with legacy businesses still attached - which is why AbbVie separated from Abbott and Abbott itself has had to go find new growth in devices over pharmaceuticals.



Hi Ant, Thanks for the reply and discussion. It is hard for me to believe that the legacy business (the word itself is a little perjorative) is worth nothing but trying to evaluate it is difficult and goes to the heart of the question. If the world in 10 years still uses some firewalled systems as well as a majority of cloud based, it would seem that PANW has an advantage. If it is entirely eliminated then it doesn’t and the overall price for PANW may be high, even though the cloud based portion could still be a big winner… that is the major question and it is interesting to me that a year ago, the market seemed to think cloud was everything, now it is not quite saying that. In addition, the fact that the other traditional businesses you mentioned have pretty substantial values themselves kind of verifies that, at least to me…

One thing I must add. I messed up a couple aspects of my post and must correct. First, the earnings per share portion was done pre-split. PANW split 3-1 a few weeks back (after earnings release) so here is the corrected first table.

                               PANW      CRWD        ZS       S
Revenues Qtr ($M)             $1,551     $535       $318    $102
Revenue growth (%)             27%        58%        61%    124%
Non-GAAP Net Inc ($/sh)       $0.80      0.36       0.25    -0.20
Free Cash Flow (FCF $M)       $485        136        76     -66.9
Adj FCF Margin                 33%        25%        24%    -66%

This makes much more sense then the outsized earnings I shared in the first table. Second, I was bothered by the high PE of the legacy business and determined I really messed up that calculation. Without going through a lot of discussion, let me just say the PE ratio of the legacy business is roughly 28x earnings. A much more reasonable ratio for a 12-13% grower with very nice margins and free cash flow.

Anyway, the biggest message should be that this industry is very strong and if you don’t own anything in this sector I believe you are making a mistake.

PANW Tickerguide, Long PANW, CRWD, and ZS.


Sorry for continuing, but I screwed up the PE ratio enough that it changes the overall results. So here is an updated section on the calculated theoretical PE ratio of the firewalled company only…

If I take an estimate on earnings by using CRWDs per share earnings as an estimate of Cloud margins and recalculating the PE ratio of just the firewalled company I get

$0.80 - (0.36 x 233/299 x 1.89/2.14) = ($0.55 x 4) = $2.20/share but the price per share for the Firewalled only company would be:

$176 x (16.7/52.6) = $ 56 and then PE can be calculated as follows.

earnings over price = 2.2 / 56 or a 25 PE ratio. Remember this is PE not PS. This seems like a really reasonable price for a company growing revenues in the low teens and earnings growing much faster with accelerating margins (earnings growth was over 50% on the 27% overall revenue growth). This is not to mention the very nice free cash flow margins that are also growing. The free cash flow is so high they announced a stock buyback at almost a Billion dollars.

So yes, the firewalled portion of this company is not the normal stock for these boards, but the cloud portion definitely is and the overall risk profile for the company is certainly lower than the cloud only stocks…

Anyway, just some thoughts

PANW Tickerguide, and long CRWD, PANW, and S.


Hi Randy,

I appreciate you presenting all your work here, good stuff.

I’m wondering at what point do you need to include Cloudflare into these comparisons. Cloudflare had about 140k paying customers at the end of 2021. At Cloudflare’s Investor Day, they said that they had ‘greater than 10% attach rate for their Zero Trust solution, by my calculations that means at least 14,000 Zero Trust customers. In a Protocol article published in July, the company updated that metric to more than 15% or over 23,000 customers as subscribers of Zero Trust products. That represents a 64% increase in customers over a 7 month period.

My understanding is that with yesterdays release that Cloudflare’s CASB and DLP is now Generally Available, this is going get Gartner and Forrester to include Cloudflare in their rankings and therefore into a much improved position in how customers make their choices in which Zero Trust solution to go with.

Mathew Prince, CaeO/Founder of Cloudflare
“It’s more important than ever that CISOs have control over who can access specific applications or data. In the past 90 days, Cloudflare CASB has already helped early adopters detect more than five million instances of potential data oversharing and unapproved shadow IT, making sure these issues didn’t turn into incidents for those organizations,” said Matthew Prince, co-founder and CEO of Cloudflare. “Legacy solutions often require clunky point solutions that slow networks and employees down. However, because Cloudflare’s CASB and DLP services are built directly into our Zero Trust platform and are part of our global network, we are able to not only protect critical data and applications but also accelerate network traffic as well.”




Hi Jason, that’s a fair comment. Some of my past comparisons have included NET as well as OKTA, and I have had requests to add Fortinet as well. All fair discussion but OKTA (as some have pointed out) is in a different space, NET has much more going on than pure Cyber security, and Fortinet is mostly in the firewalled space so I left them all out. But truthfully, as I put more companies in the comparison it just seemed to cloud the discussion.

To be clear, I own a bunch of NET and some OKTA so I definitely am not against them either!

PANW Tickerguide, long CRWD, NET, PANW, S and OKTA.

1 Like