Cybersecurity Stocks: How to Evaluate Companies in the Growing Security Market
Five numbers do most of the work: annual recurring revenue growth split into organic and acquired, net revenue retention, the Rule of 40, free cash flow margin, and valuation against the sector median rather than against other security names. The first one is where most analysis fails, because headline ARR growth can be almost entirely acquisitions and very few write-ups separate the two. Benchmarks from 2026 filings are below so you can score any company against real comparables.
This is a framework for evaluating companies, not investment advice. Nothing here is a recommendation to buy or sell any security.
Key takeaways
- CrowdStrike ended FY2026 with $5.25 billion ARR growing 24%, a 78% gross margin, and free cash flow of $1.235 billion at a 25.7% margin.
- Palo Alto reported Next-Generation Security ARR of $6.33 billion growing 33% in Q2 FY2026, of which roughly $1.47 billion came from the CyberArk and Chronosphere acquisitions.
- Zscaler posted a Rule of 40 score of 78 on revenue of $788.1 million growing 26%, and its AI security pillar grew over 80%.
- Palo Alto’s net retention rate is 119%.
- The peer software median forward EV/Revenue is about 4.03x. CrowdStrike trades near 18.76x and Palo Alto near 11.27x.
- Okta grew revenue 12% to $742 million with remaining performance obligations of $4.3 billion, up 17%.
The five numbers, with benchmarks
| Metric | Weak | Solid | Excellent | 2026 example |
| ARR growth (organic) | Under 15% | 20-25% | Over 30% | CrowdStrike 24% |
| Net revenue retention | Under 105% | 110-120% | Over 125% | Palo Alto 119% |
| Rule of 40 | Under 30 | 40-50 | Over 60 | Zscaler 78 |
| FCF margin | Under 15% | 25-30% | Over 35% | Palo Alto 37.6% |
| EV/Revenue vs peers | — | — | — | Peer median 4.03x |
1. ARR growth, and the question nobody asks
Annual recurring revenue is the right top-line metric for security software, because these are subscription businesses and ARR strips out timing noise that distorts reported revenue.
The trap is that ARR growth says nothing about where the growth came from.
Work through the Palo Alto numbers as an exercise, because they show why this matters.
Next-Generation Security ARR reached $6.33 billion in Q2 FY2026, up 33% year over year. Approximately $1.47 billion of that came from the CyberArk and Chronosphere acquisitions.
Back out the prior year: $6.33 billion divided by 1.33 gives roughly $4.76 billion. Now remove the acquired ARR from the current figure: $6.33 billion minus $1.47 billion is $4.86 billion.
So the non-acquired base went from about $4.76 billion to about $4.86 billion. That is roughly 2%.
Two caveats before anyone draws a conclusion. The $1.47 billion of acquired ARR includes whatever those businesses grew after closing, so some of it is organic growth inside acquired entities. And acquisition close dates affect how much of a period each contributes. A precise organic figure needs the company’s own disclosure.
But the exercise is the point. A headline of 33% growth and an underlying rate somewhere far below it are very different investment cases, and the difference is not visible unless you do this arithmetic. Acquired growth costs capital, carries integration risk, and cannot be repeated indefinitely. Organic growth compounds.
Always ask what the organic number is. If a company does not disclose it clearly, that is itself informative.
Compare CrowdStrike, where FY2026 ARR of $5.25 billion grew 24% with net new ARR of $1.01 billion and no comparable large acquisition contribution. Q4 net new ARR of $330.7 million was up 47% year over year, which is acceleration in the hardest metric to fake.
2. Net revenue retention
The single best indicator of product quality in enterprise software.
Net revenue retention measures what an existing cohort of customers spends this year versus last year, including expansion, downgrades and churn, but excluding new customers.
Above 100% means existing customers spend more each year without the company selling to anyone new. That is the compounding engine.
Palo Alto reports 119%. That is solid. In security software, above 120% is strong and above 130% is exceptional.
What makes it the highest-signal metric: it cannot be bought. You can acquire your way to ARR growth and market share, but net retention only improves if customers voluntarily buy more from you. A falling net retention rate is usually the earliest visible sign that a product is losing ground, and it shows up well before revenue growth slows, because new customer acquisition masks it for several quarters.
Track the trend, not the level. A company at 115% and rising is in better shape than one at 125% and falling.
3. The Rule of 40
Revenue growth rate plus free cash flow margin. Above 40 is the threshold; the logic is that a software company should be either growing fast or generating cash, and the sum of the two measures the quality of the trade-off.
Computed from 2026 figures:
| Company | Revenue growth | FCF margin | Rule of 40 |
| Zscaler | 26% | — | 78 (reported) |
| Palo Alto | 14.9% | 37.6% | 52.5 |
| CrowdStrike | 21.7% | 25.7% | 47.4 |
Note how differently the three get there. Palo Alto scores highest of the two computed on cash generation with modest growth. CrowdStrike is more balanced. Zscaler’s 78 is exceptional and reflects both strong growth and strong cash conversion.
Also worth knowing: Zscaler is described as one of only five enterprise SaaS companies with over $3 billion in ARR still growing above 25%. Maintaining that growth rate at that scale is genuinely rare, because the base gets harder to grow every year.
The Rule of 40 is most useful for comparing companies at different stages. A young company at 45 made of 40% growth and 5% margin is a different proposition from a mature one at 45 made of 10% growth and 35% margin, and you should have a view on which you want.
Also read: Why Downloading Apps From Random Websites Is Riskier Than You Think
4. Free cash flow margin
Free cash flow is harder to manipulate than earnings, which makes it the more reliable measure of a subscription business.
Palo Alto generated $4.129 billion in FY2025 at a 37.6% margin, with projections toward roughly $5.052 billion by FY2027 at similar margins. It has also posted non-GAAP operating margins above 30% for three consecutive quarters.
CrowdStrike generated $1.235 billion in FY2026 at a 25.7% margin, with projections toward roughly $2.316 billion by FY2028 at around 32%.
That twelve-point margin gap is the clearest illustration of what scale maturity buys. Palo Alto is a larger, older business that has already made most of its investment; CrowdStrike is still spending to grow.
Gross margin adds a useful cross-check. CrowdStrike runs 78%, Palo Alto 73.5% on a trailing basis. The difference reflects business mix: pure cloud-delivered software carries higher gross margins than a portfolio that includes hardware and appliances. Neither number is wrong; they describe different companies.
5. Valuation against the right comparison
This is where security investing goes wrong most often, because the natural instinct is to compare security companies to each other, and the whole sector trades at a premium.
The peer software median forward EV/Revenue is about 4.03x.
| Company | NTM P/E | NTM EV/Revenue | NTM EV/EBITDA | Market cap / FCF |
| CrowdStrike | 93.19x | 18.76x | 63.72x | 64.70x |
| Palo Alto | 50.24x | 11.27x | 36.93x | 32.38x |
| Peer software median | — | 4.03x | — | — |
CrowdStrike at 18.76x sits at roughly 4.7 times the peer median. Palo Alto at 11.27x is about 2.8 times.
The 43-point gap in forward P/E between them is the number to interrogate, because forward two-year revenue growth for both is projected in a similar range, roughly 22% for CrowdStrike and 21% for Palo Alto.
Similar growth, very different multiples. The market is paying for something other than growth: gross margin quality, perceived durability of the platform, or the belief that CrowdStrike’s growth is more repeatable because less of it was acquired. Whether that premium is justified is the actual investment question, and it is a judgement rather than a calculation.
Analyst targets tell you where consensus sits, and consensus is not analysis. CrowdStrike’s mean target of $491.72 implies about 9% upside with 31 Buys, 11 Outperforms and 11 Holds across 51 analysts. Palo Alto’s $206.14 implies about 14% with 34 Buys, 11 Outperforms, 10 Holds and 1 Sell across 50.
The sector-specific risks
Things that apply to security companies specifically and are easy to underweight.
Platform consolidation. Enterprises are tired of managing forty security vendors and are consolidating onto fewer platforms. Palo Alto reports roughly 1,550 platformised customers, up 35%, and targets $15 billion in NGS ARR by 2030. This is excellent for the winners and existential for point-solution vendors. When evaluating a smaller company, the question is whether it becomes a platform, gets acquired into one, or gets squeezed out.
A single bad incident. A security vendor’s product failing publicly does damage no other software category faces. This is a real and non-diversifiable risk in the sector.
AI cuts both ways. It expands the attack surface, which drives budgets. Zscaler’s AI security pillar grew over 80% year over year and exceeded its full-year $400 million ARR target in the first quarter. It also enables new attacks, and it may eventually commoditise detection capabilities that currently justify premium pricing.
Agent identity is the emerging category. Okta reports over 100 customer discussions on Auth0 for AI Agents. As autonomous agents proliferate, something has to authenticate and authorise them. Whoever owns that becomes infrastructure. Watch which companies are positioning there now.
Budget cyclicality. Security spend is more resilient than most IT budgets and it is not immune. Okta’s 12% revenue growth against Zscaler’s 26% shows the range within one sector in the same period.
The checklist
- Split ARR growth into organic and acquired. Do the arithmetic yourself if the company does not.
- Find net revenue retention and check the trend over four quarters.
- Compute the Rule of 40 and note which component supplies it.
- Check free cash flow margin against the 25-35% range, and gross margin for business mix.
- Compare EV/Revenue to the roughly 4x peer software median, not to other security names.
- Read remaining performance obligations for forward visibility. Okta’s $4.3 billion, up 17%, is contracted future revenue.
- Ask whether the company is a platform, a platform component, or a point solution facing consolidation.
- Check whether any single customer, product or acquisition accounts for an outsized share of growth.
Run any security company through those eight steps and you will know more than most published write-ups tell you.
