This year has led to a split landscape for cybersecurity stocks, with two of cybersecurity leaders up more than 20% YTD while others are negative YTD. In the past, we’ve discussed the resiliency of the cybersecurity trend being that it’s one of the highest costs that enterprises face at 12% of IT budgets on average. The cost of cybercrime continues to rise, and is estimated to reach $10.3 trillion by 2025 and $13.8 trillion by 2028. AI and automation are playing an increasingly large role in the industry, with 560,000 new pieces of malware detected every day. Software systems cannot keep up with this, and AI is already assisting human teams in identifying which threats require more analysis.
Despite the strength of the trend, we are seeing mixed results across cybersecurity leaders. Palo Alto cut its billings and revenue forecast in a shift to a “platformization” approach. Zscaler fell despite beating on the top and bottom line as it pointed to a rather sharp deceleration in calculated billings. In contrast, CrowdStrike rose nearly 11% after it beat estimates with another record in net new ARR, and guided fiscal Q1 marginally ahead of consensus. Adding to CrowdStrike’s strength, Fortinet has rallied double-digits year-to-date despite signaling that growth is slowing, with revenue and billings set to decelerate sharply this year.
However, if we zoom out, it’s quite clear what the strongest cybersecurity stock has been with CrowdStrike’s 1-year returns of 162% well ahead of its peers. The analysis below looks at why some are starting the year exceptionally strong, while others are not in the leading cloud vertical of cybersecurity.
Fortinet: Growth Is Slowing
Although Fortinet reported solid improvement in operating income and EPS for fiscal 2024, revenue growth and billings growth is slowing considerably. Revenue increased 10.2% YoY to $1.42 billion in the quarter, a 570 bp deceleration from 16% growth in Q4. Fortinet had initially guided for billings to decline YoY to $1.63 billion at midpoint, but it handily beat its guide as it reported 8.5% growth with billings of $1.89 billion. This was a 280 bps acceleration from 5.7% billings growth in Q3, but a far cry from the 30% range seen through 2021 and 2022, with growth decelerating swiftly through 2023.
Q4’s billings were driven by signing 13 deals above >$10M generating $232M in billings (up 177% YoY). However, the Q4 beat was short lived with Q1’s guide pointing to a (5%) YoY decline in billings to $1.43 billion at the midpoint. Growth is expected to be minimal for the full year, with Fortinet pointing to $6.4 billion to $6.6 billion in billings, or growth of 0% to 3%.
This would represent a significant slowdown in billings growth over the past two years, from 33.8% in 2022 to 14.4% in 2023 to the low-single digit range for 2024. Revenue growth is decelerating rather rapidly as a result, with Fortinet’s $5.76 billion guide for the full year pointing to growth in the high single digit range from $5.31 billion in 2023. Consensus estimates were at $5.94 billion for 11.9% growth, but that has since been revised lower to $5.79 billion for 9.1% growth.
Product revenue has declined for two consecutive quarters, in part due to tough comps in late 2022. Management explained that product revenue “will continue to be impacted by project and product digestion in 2024,” though the “selling environment should improve in the second half of 2024 and into 2025.”
Services revenue growth has slowed to under 25%, the lowest level since early 2022. Given services’ share at nearly 66% of revenue in Q4, a prolonged deceleration would bode negatively for revenue growth moving forward. There were positives emerging in SecOps, which grew 44%, and SSE element of SASE, which management added also witnessed more than 40% growth in the quarter.
Palo Alto: Billings and Revenue Forecasts Cut in Platformization Approach
Palo Alto shares plunged over (28%) after its fiscal Q2 earnings report when management cut its billings and revenue forecast for the full year. We had informed our readers in the analysis “The Strongest Cybersecurity Stocks in Q3” in December following Palo Alto’s weak billings in Q1 that this was “amplifying concerns that revenue and billings growth is decelerating.”
Palo Alto also unveiled a stronger push for “platformization” among its three platforms to drive vendor consolidation, saying that it intends to make “significant additional investments” in this strategy as it will be “a major area of focus for us as we move forward.”
Revenue in fiscal Q2 increased 19% YoY to $1.98 billion, a 1 percentage point deceleration from 20% in Q1. Palo Alto cut its full year revenue guide by $0.2 billion to $7.95 billion to $8.0 billion, for growth of 15% to 16% YoY, and also cut its billings forecast by ~5%. Palo Alto is now seeing billings at $10.1 to $10.2 billion, for growth of 10% to 11% YoY, down from its prior view for $10.7 to $10.8 billion due to impacts in its federal government business. This implies a further deceleration over the next two quarters, potentially to revenue growth in the low teens.
However, next-gen offerings continued to see strong demand and growth: networking security SASE ARR increased more than 50% YoY for the fifth consecutive quarter, while Next-Gen Security (NGS) ARR rose 50% YoY to $3.49 billion. Palo Alto also saw the highest number of deals signed for XSIAM (Extended security intelligence and automation management) in the quarter.
Palo Alto is taking a more aggressive approach to “platformizing” its offerings as customer LTV increases exponentially per platform added. It sees the near-term headwinds to revenue and billings growth as merely a blip in its long-term target to reach $15 billion in NGS ARR by 2030, up from its guided $3.95 to $4 billion in 2024. Revenue growth is expected to remain pressured through FY24 and begin inflecting higher through the end of FY25 (12 to 18 months), as the headwinds of this approach begin to fade.
While this exponential increase in customer long-term value alone can support this strategy shift, peer Fortinet also highlighted other positives around this approach: “Consolidation allows security solutions to share data and communicate with each other, reducing complexity, improving security effectiveness, easing the need for skilled labor, and lowering the total cost of ownership. Consolidation drove our SecOps business to 44% growth, with strong growth from EDR, SIEM, email security, and NDR.”
Zscaler: Calculated Billings to Decline Sequentially
Zscaler beat on the top and bottom line, and marginally boosted its full year revenue and calculated billings forecast. Despite the beat and raise, Zscaler guided for a (7%) sequential decline in calculated billings for Q3, suggesting further deceleration in this key metric to the low-20% range.
Revenue increased 35% YoY to $525 million, a slight deceleration from 40% growth in Q1; Zscaler guided for 28% YoY growth in Q3 to $535 million at midpoint. As a result, Zscaler marginally boosted its full year revenue outlook to $2.118 to $2.122 billion, up approximately 1% from its prior view for $2.09 to $2.10 billion.
Zscaler tightened its billings growth outlook to $2.55 to $2.57 billion, at the upper end of its prior forecast for $2.52 to $2.56 billion. This correlates to 25% to 26% YoY growth. We had said in December following Q1’s release that the fact Zscaler “did not raise its full-year billings outlook as it tends to do” suggested that ‘billings growth will decelerate through the remainder of the fiscal year.” This is currently what is playing out – calculated billings increased 34% in Q1, decelerating to 27% in Q2. Q3’s forecast for a (7%) QoQ decline implies calculated billings of $584 million, or a further deceleration to just 21% growth.
GAAP profitability remains elusive, unlike peers CrowdStrike and Palo Alto, who have both recorded quarters with GAAP operating and net profitability. Zscaler has been making inroads on the GAAP profitability front, with GAAP operating margin just above (9%) and GAAP net margin at (6.7%) for the past two quarters. However, until Zscaler can meaningfully reduce operating expenses, currently at approximately 87% of revenues, GAAP profitability will continue to remain elusive should growth decelerate.
Interestingly, Zscaler commented that it believes it is “still operating in a challenging macroenvironment and customers continue to scrutinize large deals,” and that its 2024 outlook balances its “business optimism with ongoing macroeconomic uncertainties and sales leadership changes.”
CrowdStrike: Shares Fly With Record Net New ARR, Robust RPO, Margin Strength
CrowdStrike reported a new record for net new ARR in Q4, far surpassing the record it set in the previous quarter, as GAAP margins continued to strengthen. For FY25, CrowdStrike’s guide was marginally above consensus, yet the market is clearly pleased with this continued expansion in operating and net margins. The turnaround on net new ARR is notable, yet the turnaround on GAAP profitability is what is most impressive compared to its cloud peers, especially considering the far majority of cloud stocks are years away from GAAP profitability (if they ever get there). We covered the earnings report in-depth for our premium members here.
Net new ARR accelerated significantly in the quarter to 27% growth, which is a 14-point acceleration from 13% growth in Q3. This is up from 2% growth for net new ARR in the year ago quarter. The turnaround in this particular key metric is notable, especially compared to other cloud stocks whose key metrics are decelerating. ARR increased 34% to $3.44 billion, which was down 1 percent from 35% growth last quarter.
CrowdStrike’s management stated that the company continues “to aggressively invest in our innovation engine and flank the company to achieve its vision of reaching $10 billion in ARR over the next 5 to 7 years.” That would imply about 200% growth in 5-7 years. The growth of deals with total value exceeding $1 million accelerated to “over 30%” this quarter for 250 customers.
Margins strengthened across the board – driven by four quarters of GAAP gross margin at 75% and GAAP subscription margin at 78%, both up from the prior year. To further illustrate CrowdStrike’s margin expansion, GAAP operating income was $30 million this quarter compared to (-$61.5) million in the year ago quarter. This is up from $3.2 million last quarter. For the full year, CrowdStrike nearly broke even from operations, reporting just a ($2 million) loss from operations, or a (0%) margin, an 800 bp improvement from FY23. CrowdStrike also reported its first full year with GAAP net profitability, reporting a 2.9% net margin, compared to an (8.2%) margin in FY23.
CrowdStrike echoed Zscaler with its macro commentary, saying that it believes the “current macro environment remains stable and consistent with prior quarters,” as it expects “continued deal scrutiny throughout this coming year.” Management added that its fiscal Q1 and FY25 guidance “assumes a consistent, challenging macro backdrop.”
Conclusion
The 1-year performance across cybersecurity leaders is quite variable, ranging from an impressive 161% to a mere 17%. This makes it well worth our time to monitor the metrics driving performance in this sector. Billings growth will be important to continue to track, as some hints of weakness last quarter spilled over into reduced forecasts from Palo Alto and Fortinet. Revenue deceleration will also be a key metric to watch given the decelerations guided from Palo Alto and Fortinet. Most importantly, these key metrics can provide clues as to which companies will be strongest moving into the rest of 2024 and beyond.
If you own Cybersecurity stocks or are looking to own these stocks, consider joining us for our next broad market webinar. Every Thursday at 4:30 pm Eastern, the I/O Fund team holds a webinar for premium members to discuss how to navigate the broad market, manage risk, as well as revealing our various long-term game plans regarding stock entries and exits. We offer trade alerts plus an automated hedging signal. The I/O Fund team is one of the only audited portfolios available to individual investors. Learn more here.
The I/O Fund conducts research and draws conclusions for the company’s portfolio. We then share that information with our readers and offer real-time trade notifications. This is not a guarantee of a stock’s performance and it is not financial advice. Please consult your personal financial advisor before buying any stock in the companies mentioned in this analysis. Beth Kindig and the I/O Fund own shares in CRWD at the time of writing and may own stocks pictured in the charts.
If you would like notifications when my new articles are published, please hit the button below to “Follow” me.
