Cybersecurity
Cybersecurity Strategy
Not investment advice. This page is for informational and educational purposes only. Sterling is not a registered investment advisor. Nothing here is a recommendation to buy, sell, or hold any security. Markets carry risk and you may lose money. Do your own research and consult a licensed professional before making any investment, securities purchase, or trading decision.
Thesis
Why this sector matters to investors right now. Structural, not market timing.
Enterprise cybersecurity in 2026 is a consolidation race, not a catalogue of point products. Palo Alto ended FY2025 with $5.58 billion of Next-Generation Security ARR (+32%) on $9.22 billion of revenue and then closed CyberArk on 11 February 2026 as a fourth platform pillar. CrowdStrike crossed $5.25 billion of ending ARR in FY2026 with $1.01 billion of net new ARR. Fortinet still prints firewall economics ($2.22 billion of product revenue, $7.55 billion of billings, 31% GAAP operating margin) while Unified SASE billings grew 40% in Q4 FY2025. Cisco Security did $8.232 billion in FY2026 after Splunk. The investable question is who owns the CISO budget versus who takes it as attach: Microsoft Entra and Defender (no disclosed segment), Google via Wiz (closed 11 March 2026, about $32 billion), and Cisco on the switching quote.
The second-order story is identity and data as control planes. Okta FY2026 revenue was $2.919 billion with $4.827 billion of RPO. SailPoint returned via re-IPO on 12 February 2025 (Q1 FY2026 ARR $925 million). Rubrik subscription ARR was $1.35 billion in Q3 FY2026. Varonis ARR was $745 million at year-end 2025, 86% SaaS. PE already took Proofpoint, Sophos, and KnowBe4. The remaining public tape is platforms, a handful of category leaders, consumer (Gen Digital FY2026 $5.0 billion), and hyperscaler attach.
Structural drivers
Forces that shape long-run demand and economics. Each driver is sourced.
- •Platformization is showing up in ARR, not just in slideware. Palo Alto NGS ARR $5.58 billion (+32%) and RPO $15.8 billion (+24%) in FY2025. CrowdStrike FY2026 ending ARR $5.25 billion with the first $1 billion net-new-ARR year. Source: Palo Alto FY2025 results; CrowdStrike FY2026 results.
- •Identity is being bought, not just built. Palo Alto closed CyberArk on 11 February 2026 ($45 cash plus 2.2005 PANW shares per CyberArk share) and named identity a core pillar. Source: Palo Alto 11 February 2026 PR.
- •SASE still compounds at the independent SSE name. Zscaler FY2025 ARR $3.015 billion, calculated billings $3.246 billion, RPO $5.8 billion. Fortinet Unified SASE Q4 billings +40%. Source: Zscaler FY2025 results; Fortinet FY2025 EX-99.1.
- •Hyperscalers are paying strategic prices for cloud security. Google closed Wiz on 11 March 2026 at about $32 billion, the largest deal in Google history. CNAPP is now attach inside Google Cloud. Source: deal close reporting; treat Wiz as Alphabet, not a roster row.
- •Cisco Security is a real P&L after Splunk. FY2026 security $8.232 billion (+2%), Q4 $2.226 billion (+14%). Source: Cisco FY2026 earnings.
- •Gartner free press-release TAM is still growing: infosec end-user spend $213 billion in 2025 and $240 billion in 2026 (29 July 2025 PR). Source: Gartner newsroom. Use the PR totals only.
- •Regulation keeps the buying cycle from going fully discretionary: SEC cyber incident 8-K rules, NIS2, FedRAMP, CMMC. Source: SEC, ENISA, FedRAMP, CMMC program pages.
Structural risks
Forces that could compress demand, change economics, or break the thesis.
- •Microsoft attach can reprice standalone IAM and XDR without Microsoft ever disclosing a security segment. Entra, Defender, Sentinel, and Purview sit on the Microsoft 365 and Azure bill. Source: Microsoft product portfolio; absence of a disclosed security line is itself the risk.
- •Google-Wiz and PANW-CyberArk raise the bar for what independent category leader means. A $32 billion CNAPP inside Google Cloud is not a public comparable. Source: deal PRs.
- •CrowdStrike July 2024 outage is the platform-concentration reminder: consolidating the SOC on one vendor creates operational and political risk that shows up in net-new ARR with a lag. Source: CrowdStrike incident reviews and subsequent FY2025/FY2026 ARR prints.
- •Fortinet SASE growth is a rate, not a dollar line, in the FY2025 PR. Do not treat Unified SASE +40% as a dollar SASE P&L. Source: Fortinet FY2025 EX-99.1.
- •PE already removed the mid-market comps (Proofpoint, Sophos, KnowBe4). Public multiples are the remaining platforms plus a short category-leader list. Source: historical take-private PRs; not profiled here.
- •Consumer (Gen Digital) is a different wallet. Mixing Norton ARR into an enterprise platform multiple is a category error. Source: Gen Digital FY2026 EX-99.1 ($5.0 billion; Cyber Safety $3.339 billion).
- •Fiscal calendars do not line up (PANW July, CRWD/OKTA/S January, FTNT/NET December, CSCO late July). YoY charts that ignore fiscal year-ends will lie. Source: issuer 10-K year-end conventions.
Competitive landscape
How to think about the players. Framing along axes (pure play vs diversified, incumbent vs challenger, etc). Not stock picking.
Four archetypes. (1) Platform consolidators: Palo Alto (Strata, Prisma, Cortex, CyberArk identity) and Cisco (security plus Splunk). Compare them on NGS ARR versus security-segment revenue, not on a blended multiple. (2) Category leaders: CrowdStrike and SentinelOne in XDR; Zscaler in SSE; Okta and SailPoint in identity; Fortinet and Check Point in firewall economics; Rubrik, Varonis, Tenable, Qualys in data and exposure; Cloudflare and Akamai and F5 as network-adjacent security. (3) Hyperscaler attach: Microsoft, Alphabet (Wiz, Mandiant), Amazon, IBM, Broadcom/Symantec, Oracle, ServiceNow, Palantir. Dual-homed; no disclosed cyber segment except Cisco, which is listed as a consolidator. (4) PE and private: Netskope, Snyk, Tanium, Cyera, Abnormal AI, Island, Armis, Arctic Wolf on the roster; Proofpoint, Sophos, KnowBe4 mentioned only on Consolidation. Consumer (Gen Digital) is a fifth wallet and should not be averaged into enterprise ARR.
Key metrics to watch
The operational and financial metrics that matter most in this sector. Each one names its source and update cadence.
| Metric | Source | Frequency | Why it matters |
|---|---|---|---|
| NGS ARR and RPO (PANW) | Palo Alto quarterly results | Quarterly | The cleanest public print of platformization. Total revenue still includes the firewall book. |
| Ending ARR and net new ARR (CRWD, S, ZS, RBRK, SAIL, VRNS) | Issuer earnings PRs | Quarterly | Land-and-expand. Net new ARR is the demand pulse; ending ARR is the installed base. |
| Cisco Security product-group revenue | Cisco earnings tables | Quarterly | Tells you whether Splunk plus legacy security is growing as attach or stalling. |
| Zscaler calculated billings and Fortinet Unified SASE growth | Zscaler and Fortinet earnings | Quarterly | SSE demand without a Gartner share table. |
| Okta RPO / cRPO | Okta earnings | Quarterly | Independent IAM backlog versus Entra attach. If cRPO decelerates while Microsoft ships identity in the suite, the standalone budget is shrinking. |
| Akamai security revenue | Akamai earnings | Quarterly | A CDN that actually discloses a security P&L. Guardicore plus API Security is the faster slice. |
| Major closed deals | Issuer 8-K and close PRs | Ad hoc | Wiz, CyberArk, and Splunk changed who is on the roster. The next close changes the map again. |
Catalysts and milestones
Known upcoming events that could move the sector. Dated where possible.
- •Palo Alto first full quarter with CyberArk inside NGS ARR and identity commentary after the 11 February 2026 close. Source: subsequent PANW 10-Q.
- •Google-Wiz integration disclosures (brand, multi-cloud commitment, ARR). Source: Alphabet earnings and Google Cloud remarks after 11 March 2026.
- •CrowdStrike FY2027 net new ARR versus the FY2026 $1.01 billion print. Source: CrowdStrike quarterly PRs.
- •Zscaler next billings print after FY2025 $3.246 billion. Source: Zscaler earnings.
- •Okta cRPO growth versus Entra attach commentary on Microsoft earnings. Source: Okta and Microsoft quarterly calls.
- •SailPoint FY2026 ARR print versus the $1.095 to $1.105 billion guide. Source: SailPoint earnings.
- •Any ServiceNow-Armis close 8-K. Armis stays private on this roster until then. Source: NOW 8-K.
What would change the view
Conditions or evidence that would invalidate the thesis or materially shift the risk picture.
- •Microsoft discloses a security segment above $20 billion with growth at or above Azure. Attach would be a measured P&L, not an inference.
- •Palo Alto NGS ARR decelerates below 20% for two consecutive quarters after CyberArk. Platformization would look like a mix shift, not a flywheel.
- •CrowdStrike net new ARR falls below $200 million in a quarter without a stated outage or accounting change. The $5 billion ARR base would be saturating.
- •Zscaler billings go negative year over year. Independent SSE would be losing to Prisma Access, FortiSASE, or Netskope.
- •Okta cRPO declines for two quarters. Entra attach would be showing up in the independent backlog.
- •Cisco Security declines year over year for two quarters. Splunk would be a revenue step-up, not a platform.
- •A second PE takeout of a remaining category leader (for example Tenable or Qualys). The public tape would get even more platform-heavy.
What we are not covering
Sub-areas, technologies, or companies we are deliberately excluding from the analysis, and why.
- •Consumer-only long tail and tiny DDoS names (Radware, A10, Netscout, Telos, OneSpan, BlackBerry).
- •Trend Micro (not on the US-listed roster we ship).
- •PE-owned Proofpoint, Sophos, KnowBe4 except as Consolidation mentions.
- •IT services (Accenture, Deloitte cyber practices).
- •Cyber insurance premiums (Insurance sector).
- •Paywalled Gartner Magic Quadrant positions and share tables.
- •Wiz as a standalone company (it is Alphabet).
- •CyberArk as a standalone company after 11 February 2026 (it is Palo Alto).
- •Kinetic / defense cyber programs (Defense sector). Palantir dual-homes only for the cyber-adjacent AI story.
- •Seat-based SaaS in general (Enterprise Software). CRM/ERP/ITSM stay there.
- •Frontier labs and AI cloud (AI Software). AI-SOC features of CRWD/PANW live here.
Sources
Primary sources cited in this analysis. Links open in a new tab.
- Palo Alto FY2025 resultsAccessed 2026-08-19
- Palo Alto 2025 NPS PDFAccessed 2026-08-19
- Palo Alto completes CyberArk (11 Feb 2026)Accessed 2026-08-19
- Google completes Wiz (11 Mar 2026)Accessed 2026-08-19
- CrowdStrike FY2026 resultsAccessed 2026-08-19
- CrowdStrike FY2025 resultsAccessed 2026-08-19
- Zscaler FY2025 resultsAccessed 2026-08-19
- Fortinet FY2025 EX-99.1Accessed 2026-08-19
- Cisco FY2026 earningsAccessed 2026-08-19
- Okta FY2026 resultsAccessed 2026-08-19
- SentinelOne Q3 FY2026Accessed 2026-08-19
- Rubrik Q3 FY2026Accessed 2026-08-19
- Check Point FY2025 6-KAccessed 2026-08-19
- SailPoint Q1 FY2026Accessed 2026-08-19
- Qualys FY2025 EX-99.1Accessed 2026-08-19
- Varonis FY2025 resultsAccessed 2026-08-19
- Tenable FY2025 resultsAccessed 2026-08-19
- Akamai FY2025 resultsAccessed 2026-08-19
- F5 FY2025 resultsAccessed 2026-08-19
- Gen Digital FY2026 EX-99.1Accessed 2026-08-19
- Cloudflare FY2025 EX-99.1Accessed 2026-08-19
- Gartner infosec spend PR (29 Jul 2025)Accessed 2026-08-19
- SEC cybersecurity incident disclosure rulesAccessed 2026-08-19
- CISAAccessed 2026-08-19
- ENISA NIS2Accessed 2026-08-19
- FedRAMPAccessed 2026-08-19
Audit trail
Record of the last review and what changed. Required on every refresh.
Last reviewed: 2026-08-19
Change log
- 2026-08-19Initial publication. Thesis and metrics sourced from Palo Alto FY2025 results, CrowdStrike FY2026 results, Cisco FY2026 earnings, Zscaler FY2025 results, Fortinet FY2025 EX-99.1, Okta FY2026 results, Gartner 29 July 2025 infosec PR, and the CyberArk and Wiz close PRs.
Unresolved questions
- •Microsoft security revenue as a disclosed segment. Do not invent a $20B figure without an issuer line.
- •Wiz ARR at close from an Alphabet or Wiz primary. Secondary ~$1B ARR is not charted.
- •Fortinet Unified SASE billings in dollars, not only the +40% Q4 rate.
- •Cloudflare security mix. Company revenue is charted; a GAAP security line is not disclosed.
- •ServiceNow-Armis close 8-K, if and when.
- •Palo Alto NGS ARR with CyberArk in the first post-close quarter.
- •Cisco Security organic versus Splunk split, if disclosed again.
