Quarterly Cyber Security Update Q1 2025

Investment Analysis Clubs Saul’s Investing Discussions
1

I posted this on the premium pages a couple days ago and thought I would add it here as well…

It’s time again for my scintillating quarterly update on cyber security stocks!! I am once again looking at PANW, S, CRWD, and ZS. As usual, I will center on the Cloud Cyber Security space as this is the most exciting in terms of growth and future potential and is the easiest to compare across the companies. Also, because PANW has a large traditional firewalled business, that is separated out for this post’s purposes (as I have always done). Clearly this assumption and how to account for it is open to debate and disagreement, but I just do the best I can. So be it.

I will also point out that there are other interesting companies that I could include but because I don’t want to make this too confusing nor compare apples to oranges, so I am not including Fortinent, Okta or others that it could be argued should be included. If the interest is there I can (or someone can offer to augment this with a follow on post!)

In the past I have kind of side stepped how to value the firewalled version of PANW versus Crowdstrike but with the run up in CRWD and PANW’s lessor performance the comparison has been kind of striking so I will attempt at a quick comparison by subtraction as you shall see, but that comes later….

With that out of the way, I first will repeat the last four quarter’s comparison of a couple of key aspects, cloud ARR (Annual Recurring Revenue) and said growth rate. The first is important to show overall size of the cloud portion of the business and the second to show how it is growing. Then I will share the most recent quarters results.

The first quarter, March 2024 quarter results

Company ARR ($M) % increase(yr/yr)
S………….…….762………………35%
PANW……… 3,790…………….47%
CRWD……….3,650…………….33%
ZS …………….2,212………….…32%

June/July 2024 results

Company ARR ($M) % increase(yr/yr)
S………….…….806…………….32%
PANW……… 4,220………….….43%
CRWD……….3,860…………….32%
ZS …………….2,372………….…30%

Sept/Oct 2024 results

Company ARR ($M) % increase(yr/yr)
S………….…….860………………29%
PANW……… 4,500………….….40%
CRWD……….4,020………………27%
ZS …………….2,512………….….26%

And the q4 20204 results

Company ARR ($M) % increase(yr/yr)
S………….…….920………………27%
PANW……… 4,800………….….37%
CRWD……….4,240………..……24%
ZS ………..….2,590………….….23%

And finally the most recent quarter for each:

Company ARR ($M) % increase(yr/yr)
S………….…….948………………24%
PANW…….… 5,100………….….34%
CRWD……….4,440………..……22%
ZS ………..….2,900………….….23%

Note: and yes, this time ZS actually reported their ARR. (I assume that is because I have been complaining that they are the only one that hasn’t! Ha ha)

Almost identical to last quarters commentary, is the total consistency of the industry. The growth rates are high but dropping for 3 of the 4 and ZS staying flat but only a few percent for each quarter which totally makes sense as the rule of large numbers takes over and more and more companies convert to the cloud and data centers. Looking at PANW specifically the last 5 quarters year over year growth rates were: 47 43 40 37 and 34. Amazingly consistent(and slowly dropping)

Also Similar to last quarter, I will say it seems like an interesting decision by PANW to announce changes in their sales efforts to offer freemium packages to entice customers to buy multiple products a couple quarters ago. As explained by PANW, the margins for customers with multiple products are much better. The fact that they are taking these actions when their results seem to be fine (and incredibly consistent!) is a good sign in my mind. You want a management that is looking forward, not reacting to the past. And now I can say, looking at the results (at least two qtr in) It hasn’t seemed to hurt the cloud based sales at all where they seem to be holding their own and really winning against the competition in terms of numbers. I am really starting to wonder why everyone keeps saying they aren’t the leaders here.

As far as economics of the company it is clear that they haven’t gotten any worse at all. Total revenue grew 15% (an increase as cloud based sales continue to grow in terms of the total), non-GAAP earnings grew to $0.80 from $0.66 and management maintained 2025 free cash flow margins 37.5 - 38%.

So there you have it. The consistent growth is becoming almost monotonous (almost!). And I really have a tough time seeing how the past prevailing theory that PANW is living off its firewalled business alone is valid. Its cloud based ARR is almost 15% bigger overall and their growth rate is still 50% bigger. I certainly don’t know what the future will bring but the combined bigger size and growth rates versus the other three is clear. The only advantage the others have is the pure play cloud business instead of a combined with the much slower firewalled business (which is a fair complaint).

So, as promised, let’s discuss market cap and valuation between CRWD and PANW.
As of today’s closing prices CRWD has a market cap of $115.4 B and PANW’s market cap is $131.4 B. Even if you assume that the two cloud cyber companies are equal in value (which seems a little crazy since PANW’s is 15% larger and growing at 50% greater growth rate), That means that the firewalled portion of PANW is being valued at roughly $16B. If I assume the firewalled cyber company has roughly $ 4 B+ in annual sales. ( 2.3B total quarterly sales minus ARR of $5.1B/4). That would mean that the Firewalled Cyber portion of the company is being valued at 4 times sales. Not only is the 4 times sales number pretty cheap, you could easily argue that PANW’s cloud based business should be valued at a substantial premium to CRWD strike based on their bigger size and significantly bigger growth rate. It isn’t hard to get to a valuation where the firewalled business comes for free!!

But truthfully, in the end, this industry is a little bit of an embarrassment of riches. All of these companies are doing great and seems to have a bright future because it is hard for me to imagine a world where this doesn’t continue to grow in importance over time. And if you look at the last 4 quarters for all of them, the growth is really amazingly consistent, event if it is on a very slow descent slope lower.

Me, I own shares in both CRWD and PANW and don’t plan on selling either anytime soon (I do own more of PANW but I am a fairly conservative investor).

What are your thoughts?
Randy
PANW Tickerguide and long PANW and CRWD

53 Likes
2

Thanks again Randy. I’m 100% sure ZS started to publish ARR % and $ totals as a result of your campaign for greater disclosure, well done.

Leaving the numbers and what they are telling us about the comparisons within this cohort to one side, I would say that there appears to be greater Saul like investing potential to be had in alternative cyber security players beyond these increasingly converging like for like multi module platform based cloud security operators.

In particular, I would suggest that CyberArk and Rubrik offer both specialisation diversity as well as higher growth rates that are growing significantly faster than these 4 core cloud security players.

Whilst their TAM maybe more specialised they are also operating in fast expanding sectors that would also benefit from AI tailwinds whether to do with machine or agent identity or data security.

Ant
PS I say this as a holder of ZS, Crowdstrike, SentinelOne from the above cohort, as well as a holder of a smaller stake in Rubrik and a starter position in CyberArk. I am likely to add to CyberArk in particular and potentially Rubrik opportunistically more than I am to the larger mature holdings I have from the Cloud platform side where if anything I am likely to trim on any mis-steps or significant further declines in their growth rates.

22 Likes
3

Highly agree w/ Ant that there are some interesting growth vectors in security right now across Data and Identity Protection, and these directions are propelled by AI usage exploding from here. The gorillas (CRWD, PANW, ZS) of XDR/SSEs are in these areas too, but as adjacencies to their core. (Both CyberArk and Rubrik are complementary to XDRs and SSEs.)

CyberArk

CyberArk is a rising competitor to Okta (and taking advantage of all of Okta’s stumbles). They started in PAM and moved into IAM and IGA. Their big growth vector from here is their focus on non-human identities, which are already starting to explode in this era of AI agents for automation of actions across data sources (databases, files, unstructured) and tools (APIs and orchestration).

CYBR Q126 (goosed a bit by Venafi acquire in Q4):

  • Revenue +43% (TTM 35%)
  • Sub Rev +60%
  • SaaS Rev +53%
  • ARR +50%
  • Sub ARR +66%
  • TTM op margin 16%, likely hitting GAAP pos op margin in FY26
  • TTM FCF 23%
  • Rule of 73, TTM Rule of 58

Rubrik

Rubrik is a backup and recovery platform that has veered heavily into Data Security, including a scanner (DSPM) looking to find data exposure points and tag sensitive data across enterprise data sources (databases, data lakes, etc). Like the XDR platforms did (CRWD, PANW, S) they are now moving into Identity Protection as an adjacent module, and Rubrik is also pushing the non-human identity messaging like CyberArk.

Unlike CYBR, it still has a ways to go on non-GAAP profitability (much less GAAP). But it just recently hit cash flow positive (in TTM FCF last Q) and is making big strides in profitability.

RBRK Q126:

  • Revenue +49%
  • ARR +38%
  • Cloud ARR +60%
  • cRPO +49%
  • op margin still negative, but +43pp improve to -7%, TTM rose +26pp to -14%
  • just hitting cash flow pos (3Qs now) , FCF TTM now 9%
  • also hitting pos in their preferred KPI (Sub ARR Contrib Margin), +18pp to 8%
  • Rule of 61, TTM Rule of 53

-muji

36 Likes
4

As indicated - I added to both Rubrik and CyberArk today with the proceeds from a top slicing of my Shopify holding.

Both seem high growth and macro resilient opportunities to me that exceed the current entry investment potential of the larger cloud platform players.

This takes Rubrik to a 2% position and CyberArk to 1%.

Ant

19 Likes