The Cybersecurity Map: Every Stock That Matters, and Why

Special report - July 17, 2026 (ET). Brought to you by SignalDeck.live.

Why cybersecurity, why now

Cybersecurity just became the market’s quiet leadership group. CIBR, the First Trust NASDAQ Cybersecurity ETF, the cleanest one-ticket proxy for the sector, closed around $91.89 on July 17, 2026, near the top of its 52-week range ($60.07–$95.96), with a YTD total return of ~30.6%. That makes it the strongest cohort in the market by relative strength right now, and notably, the group closed green on a day semiconductors got smoked. When a sector stops trading as an appendage of the AI-chip complex and starts leading on its own, that’s worth understanding.

Here’s the core thesis, and it’s the reason this sector deserves a full map rather than a passing mention: cybersecurity is a rare “non-binary” AI trade. Almost every other AI investment forces you to pick a winner, a chipmaker, a model lab, a cloud, a country. Cyber doesn’t care who wins. It wins on AI diffusion itself, because AI simultaneously arms the attackers and upgrades the defenders. Whichever model, lab, or geography prevails, that AI gets weaponized by criminals and must be defended against by enterprises. It’s a self-reinforcing demand loop that’s agnostic to the outcome of the AI race.

The threat data makes this concrete: AI-generated phishing now achieves a 54% click-through rate versus 12% for manually written phishing, AI made the oldest attack in the book 4.5x more effective. 76% of malware observed is now AI-polymorphic, meaning it rewrites its own code to evade detection. And the machines themselves are exploding in number: non-human identities, service accounts, API keys, and now AI agents, outnumber human identities 144-to-1 inside enterprises, up from 92:1 in early 2024, and only 15% of organizations are confident they can prevent an attack through one. Average breakout time (how fast an attacker moves laterally after the first foothold) is down to 29 minutes on average, with a record of 27 seconds, humans can’t respond at that speed, which is exactly why every vendor is racing to ship AI defenders. The spend follows: global information-security spending is estimated around $244B in 2026, headed toward ~$322B by 2029 (roughly 10% annual growth, with some estimates higher).

How the industry divides, the sub-sector map

Cybersecurity isn’t one market; it’s roughly eight. Here’s the map, in plain English:

• Endpoint / EDR / XDR, software agents on every laptop and server that detect and stop attacks in real time (“EDR” = endpoint detection & response; “XDR” extends it across the whole environment). Leaders: CrowdStrike, SentinelOne, Microsoft Defender, PANW Cortex.

• Network security / Firewalls / SASE, the walls and checkpoints of the network. SASE (“Secure Access Service Edge”) fuses networking and security into one cloud-delivered service. Leaders: Palo Alto, Fortinet, Cisco, Zscaler, Cloudflare.

• Cloud security / Zero-Trust / SSE, securing cloud apps and enforcing “never trust, always verify” access. SSE (“Security Service Edge”) is the security-only half of SASE. Leaders: Zscaler, PANW Prisma, Wiz (now Google), CrowdStrike.

• Identity & Access (IAM + PAM), who (or what) are you, and what are you allowed to touch? IAM manages all logins; PAM (“privileged access management”) vaults the keys-to-the-kingdom admin credentials. Leaders: Okta, Microsoft Entra, SailPoint, Ping; CyberArk (now PANW), Delinea.

• Data security / DSPM / Cyber-resilience, finding, classifying, and protecting sensitive data (“DSPM” = data security posture management), plus tamper-proof backup so ransomware can’t destroy your last good copy. Leaders: Varonis, Cyera, Wiz, Microsoft Purview; Rubrik, Veeam, Cohesity, Dell.

• Edge / CDN / Web-app & DDoS, the global delivery layer of the internet, plus shields against website attacks (WAF = web application firewall; DDoS = flooding a site offline). Leaders: Cloudflare, Akamai, Fastly.

• Exposure / Vulnerability management, continuously scanning everything you own for unpatched weaknesses before attackers find them. Leaders: Tenable, Qualys, Rapid7.

• SIEM / SOC, the security nerve center: the SOC (security operations center) is the team; SIEM is the giant log-analysis system they work in. Leaders: Microsoft Sentinel, Splunk (Cisco), CrowdStrike NG-SIEM, PANW Cortex XSIAM.

The single most important industry dynamic is platformization. Enterprises accumulated 45–75 separate point security tools by 2022; they are now aggressively consolidating onto one or two platform vendors. The evidence: Palo Alto’s “platformized” customers show 120% net retention and spend 5–10x more. This consolidation is being executed through the biggest M&A wave in the sector’s history, 2025 cyber deal value rose roughly 270% year over year across 400+ deals, and 2026 delivered the landmarks: Google–Wiz at $32B (closed March 11, 2026, the largest acquisition in Google’s history), Palo Alto–CyberArk at roughly $21–25B depending on how the stock component is valued (closed February 11, 2026), CrowdStrike–SGNL at $740M (January 2026), and Cisco–Astrix (announced May 2026, targeting non-human identity). The winners of this wave are the platform incumbents with the balance sheets to buy: Palo Alto, CrowdStrike, Cisco, Microsoft, and Google-via-Wiz. Palo Alto, Fortinet, and Cisco together already hold 52% of the SASE/network market.

The scoreboard

All figures from company-reported quarters as noted. Market caps approximate, mid-July 2026; caps for the supporting cast weren’t in scope of this research. “AI tailwind” rates how directly the AI-diffusion thesis flows into the business.

• CRWD, Endpoint/XDR · rev +26% (Q1 FY27) · ARR $5.51B +24%, NRR 115% · 34% FCF margin · ~$210.6B cap · AI: Strong

• PANW, Network/Platform · rev +31% headline / +14% organic (Q3 FY26) · organic NGS ARR +28% to $6.5B · 38.5% TTM adj FCF margin · ~$288B cap · AI: Strong

• ZS, Zero-Trust/SSE · rev +25% (Q3 FY26) · ARR $3.53B +25% (~21% organic) · 23% op margin, 16% FCF · ~$22.5B cap · AI: Strong

• NET, Edge/CDN + SASE · rev +34% (Q1 2026) · NRR 118%, RPO +36% · 11.4% op margin, 13% FCF · ~$86–98B cap · AI: Strong

• OKTA, Identity (IAM) · rev +11% (Q1 FY27) · NRR 107%, cRPO +12% · 25% op margin, 35% FCF · ~$26B cap · AI: Strong

• RBRK, Data/Resilience · rev +39% (Q1 FY27) · sub ARR $1.57B +32%, NRR ~120% · thin positive op, FCF $74M · ~$18B cap · AI: Strong

• FSLY, Edge/CDN · rev +20% (Q1 2026) · NRR 113%, security rev +32% · 11% op margin, FCF ~breakeven · ~$3.0B cap · AI: Neutral

• NTSK, SSE/SASE · rev +28% (Q1 FY27) · ARR $845M +29%, NRR 113% · −14% op margin, −28% FCF · ~$5.55B cap · AI: Strong

• S, Endpoint/XDR · rev +21% (Q1 FY27) · net-new ARR +55% · newly profitable (~10% op guide) · AI: Neutral

• FTNT, Network/Firewall · rev +20% (Q1 2026) · product rev +41% · 36% op margin, $1.01B qtr FCF · AI: Strong

• CHKP, Network/Firewall · rev +5% (Q1 2026) · subscription $323M · high margin, EPS +13% · AI: Neutral

• TENB, Exposure/Vuln · rev +9.6% (Q1 2026) · FY26 guide ~7.4% · 23.6% op, 33.8% uFCF · AI: Neutral

• QLYS, Vuln/Cloud · rev +10% (Q1 2026) · FY26 guide $721–727M · best-in-class margins · AI: Neutral

• VRNS, Data/DSPM · rev +27% (Q1 2026) · SaaS ARR +69% (+29% ex-conversions) · GAAP loss, in transition · AI: Strong

• CYBR, Identity/PAM · acquired by PANW, closed Feb 2026, no longer tradeable · final ARR $1.44B +23% · AI: Strong (inside PANW)

The companies

Endpoint / XDR

CRWD, CrowdStrike

What they do: CrowdStrike’s Falcon platform starts with a single lightweight software agent installed on every laptop, server, and cloud workload, and that one agent unlocks 30+ security modules by license: endpoint protection, identity threat detection, cloud security (CNAPP, “cloud-native application protection platform,” an all-in-one cloud-security suite), exposure management, and a next-generation SIEM built on LogScale. Charlotte AI is its agentic SOC analyst, an AI that triages and investigates alerts autonomously, with an AgentWorks partner ecosystem spanning AWS, NVIDIA, Anthropic, OpenAI, and Salesforce.

The moat: The single-agent architecture is the whole trick. Once the agent is deployed everywhere, adding a new security module is a licensing keystroke, not a new deployment, which makes leaving painful and expanding easy. The numbers prove it: 97% gross retention, 115% net revenue retention (Q4 FY26). NRR above 100% means existing customers spend more every year even before new logos.

The financials (Q1 FY2027, quarter ended April 30, 2026, reported June 3): Revenue $1.39B, +26% YoY, and accelerating, from ~20% → 21% → 23% → 26% over the past four quarters. ARR $5.51B (+24%) with a record $255.8M in net-new ARR. Non-GAAP operating margin ~23.4%; free-cash-flow margin a fat 34% ($468.5M). FY27 ARR guided to $6.53–6.56B. Market cap ~$210.6B, roughly 30–32x forward ARR, which is rich by any historical standard.

The AI angle: Double-sided. Falcon secures AI workloads and AI identities, and CrowdStrike is building the AI that runs the SOC itself (Charlotte). If security operations become agentic, CrowdStrike wants to own the agent layer.

Verdict: The clearest single-product-to-platform success story in software, and re-accelerating growth at $5.5B ARR scale is genuinely rare. Priced for flawless execution, with the July 2024 outage as a reputational tail risk.

S, SentinelOne (supporting cast)

The scrappy #2 in AI-native endpoint. Its Singularity platform and Purple AI analyst undercut CrowdStrike on price, and Q1 FY27 showed the strategy working: revenue $277M +21% (accelerating), record net-new ARR of $44M (+55%), and its first real profitability (non-GAAP EPS $0.04; FY27 guided to ~10% op margin on ~20% growth). A must-know challenger, not a fringe player, but a challenger in the shadow of a giant.

Network & Platform

PANW, Palo Alto Networks

What they do: The sector’s mega-consolidator. Strata firewalls (its incumbent base), Prisma Cloud (CNAPP), Cortex XSIAM (a full SIEM replacement, already ~470 customers above $1M ARR), Cortex AgentiX for governing AI agents, and, decisively, the 2026 acquisitions of CyberArk (the leader in privileged access management, closed February 11) and Chronosphere (observability). If you owned CyberArk stock, you now effectively own Palo Alto: CYBR was delisted and reports inside PANW.

The moat: Platformization itself. Palo Alto bundles aggressively across its huge firewall installed base, platformized customers show 120% net retention with single-digit churn, and it simply buys its way into every adjacency it doesn’t lead.

The financials (Q3 FY2026, quarter ended April 30, 2026): Revenue $3.0B, +31% YoY headline, but $388M of that came from CyberArk and Chronosphere; organic revenue was $2.61B, +14% YoY. Next-Gen Security ARR $8.1B, +60% headline, but +28% organic to $6.5B once you strip the $1.6B acquired. RPO (remaining performance obligations, contracted future revenue) $18.4B, +36%. Profitability is elite: FY26 op-margin guide 28.9–29.2%, TTM adjusted FCF margin 38.5%. Market cap ~$288B; forward P/E ~90x (GAAP P/E is noisy at 173–342x due to acquisition amortization); PEG ~6.

The AI angle: Precision AI across the platform, Cortex AgentiX to govern customers’ AI agents, and, the real prize, CyberArk’s machine-identity franchise, acquired precisely because AI agents are exploding the number of privileged non-human identities.

Verdict: The “Salesforce of security” bet: the biggest platform, the biggest balance sheet, the boldest M&A. The honest caveat: headline growth of 31%/60% is inflated by acquisitions, the real organic trend is 14% revenue / 28% NGS ARR, and the market could someday reprice toward the organic rate.

FTNT, Fortinet (supporting cast)

The most profitable operator in security. Fortinet designs its own custom ASIC chips for its firewalls, a durable hardware cost/performance edge no software rival can match, layered with a full Security Fabric (SASE, endpoint, SOC). Q1 2026: revenue $1.85B +20%, product revenue +41%, record 36% non-GAAP op margin, record $1.01B quarterly FCF, EPS +41%. Its “Secure AI Data Center” product line gives it one of the most direct AI-infrastructure links in the group. Top-3 network security by scale; the sector’s cash machine.

CHKP, Check Point (supporting cast)

The legacy Israeli firewall leader, mid-transition to subscriptions with a GTM restructuring dragging on hardware. Q1 2026: revenue $668.4M, just +5% (a slight miss), though security subscriptions grew to $323.2M and non-GAAP EPS of $2.50 beat, +13%, on famously high margins. Its Infinity AI Copilot makes it an AI follower, not a leader. Must-know for scale and history, but it’s the growth laggard of the group, a value/margin story.

Zero-Trust / SSE-SASE

ZS, Zscaler

What they do: Zscaler pioneered cloud-delivered zero-trust: instead of connecting users to a corporate network and trusting everything inside it, every user connects through Zscaler’s Zero Trust Exchange, which brokers access to specific apps, internet, private applications, isolated browsing, inspecting hundreds of billions of transactions daily. Recent acquisitions: Red Canary (MDR, managed detection and response, i.e., outsourced SOC) and SPLX (AI-application security).

The moat: Scale and switching cost. Once an enterprise has ripped out its legacy perimeter (VPNs, on-prem proxies) and routed all traffic through Zscaler, going back is a major surgery. The “Zero Trust Everywhere” cohort, customers all-in on the architecture, grew from 130 to 550+ in a year.

The financials (Q3 FY2026, quarter ended April 30, 2026, reported May 26): Revenue $850.5M, +25% YoY. ARR $3.525B, +25%, though Red Canary contributes $127M of that, so organic ARR is roughly +21% and organic net-new ARR closer to +14%. RPO ~$6.5B, +30%. Record 23% non-GAAP op margin; FCF $136M (16% margin). Notably, Zscaler doesn’t disclose NRR (analysts estimate ~114–115%). Market cap ~$22.5B; P/S ~6.55x, compressed relative to its growth and margins.

The AI angle: Two-pronged: it polices how enterprises use AI (an estimated ~$400M of ARR tied to shadow-AI discovery and data-loss prevention around AI apps), and it’s building an AI-SOC ambition via Red Canary and SPLX.

Verdict: The cleanest pure-play on enterprises dismantling the legacy network perimeter, now with real operating leverage. The bear case isn’t the product, it’s crowding: Palo Alto, Netskope, Cato, and Cisco all want this market. Watch the organic net-new ARR deceleration and the NRR non-disclosure.

NTSK, Netskope

What they do: Zscaler’s closest head-to-head competitor in SSE/SASE. Netskope One bundles secure web gateway, CASB (“cloud access security broker”, visibility and control over SaaS app usage), ZTNA (zero-trust network access), cloud DLP/DSPM, and SD-WAN. Its SkopeAI / AI Gateway inspects the data employees paste into ChatGPT, Copilot, and Gemini with 3,000+ data classifiers. IPO’d on Nasdaq September 18, 2025, fully public, fiscal year ends January 31.

The moat: Genuine category leadership, a Gartner/Forrester SSE/SASE leader with the deepest CASB/DLP heritage in the space, and 113% NRR. The weakness: console complexity, and it’s fighting two better-capitalized giants (Zscaler and Palo Alto) plus Cloudflare.

The financials (Q1 FY2027, ended April 30, 2026, reported June 3): Revenue $201.6M, +28% YoY; ARR $845M, +29%; RPO >$1.2B, +33%; 1,600 customers above $100K ARR (+23%). But the profitability picture is rough: non-GAAP op margin −14% (improved from −18%), GAAP net loss $116.5M, and FCF swung from +$17.5M a year ago to −$57.2M (−28% margin). FY27 guide: revenue $879–883M (~24–25% growth), op margin −9.5 to −10%, FCF margin +2–4%. Market cap ~$5.55B (forward P/S ~6.3x), trading near $13.74 against a $27.99 52-week high.

The AI angle: Arguably the most directly monetizable enterprise-AI-security use case in the whole sector: governing what sensitive data flows into generative-AI apps (more than a third of sensitive data going into GenAI is regulated data).

Verdict: A first-tier, category-leading SSE/SASE franchise at real scale with a credible AI story, but deeply unprofitable, with a fresh FCF reversal, squeezed between Zscaler’s scale and Palo Alto’s breadth. High beta on execution.

Edge / CDN + Web-App Security

NET, Cloudflare

What they do: Cloudflare runs a massive global edge network that sits in front of roughly 20%+ of web traffic, delivering three businesses at once: Application Services (CDN, content delivery network, i.e., the global caching layer that makes websites fast, plus WAF, DDoS protection, bot management), Cloudflare One (its SASE/zero-trust suite, where it competes directly with Zscaler and Netskope), and a Developer Platform (Workers, R2, D1) that now extends to Workers AI (running AI inference at the edge) and AI Gateway. Note the dual classification: we place Cloudflare in Edge/CDN because the network is the asset, but it is a genuine SASE competitor too.

The moat: The network itself. Sitting in front of a fifth of the web creates a data and performance moat nobody can replicate quickly, plus one of the strongest developer-adoption motions in infrastructure software.

The financials (Q1 2026, quarter ended March 31, reported May 7): Revenue $639.8M, +34% YoY, its fastest growth in years, and accelerating. NRR 118%; RPO $2.543B, +36%. But margins are thin for the peer group: non-GAAP op margin 11.4%, FCF $84.1M (13%). Q2 guided to $664–665M (~30%). Market cap ~$86–98B, P/S of roughly 34–41x, the richest multiple in this report by a wide margin.

The AI angle: The boldest repositioning in the sector. AI crawlers were 52% of Cloudflare’s request traffic in June 2026; it launched Pay Per Crawl (a toll booth using HTTP 402, minimum $0.01/page) and will default-block AI crawlers on ad-supported pages from September 15, 2026. It also cut ~20% of its workforce (1,100+ people, $140–150M in charges) to restructure “agentic-AI-first.” One sell-side shop (Scotiabank, PT raised $225→$300) calls it “default infrastructure for AI apps.”

Verdict: The most ambitious story here, from CDN to “the toll road AI agents must pass through.” The stock already prices in a lot of that future at ~35–40x sales on an 11% margin, and the shares fell >20% on the abrupt reorg despite a beat. The margin expansion now has to actually show up.

FSLY, Fastly

What they do: The other edge company: CDN plus Compute@Edge (WebAssembly-based edge computing), and a real security business via the Signal Sciences acquisition, its “Next-Gen WAF,” DDoS, bot management, and Content Guard, which blocks AI scrapers.

The moat: Honestly, weak on the core business. Fastly is a distant third in CDN (~11% share versus Cloudflare’s ~61% and Akamai), in a commoditized market. The security attach is real but it’s a bolt-on, not a fortress.

The financials (Q1 2026, ended March 31, reported May 6): A genuine turnaround print: record revenue $173M, +20% YoY; non-GAAP op margin swung to +11% from −4%; NRR 113%; FCF turned positive at $4.1M. Security revenue +32% (now 20% of total); Edge Compute ~+67%. But Q2 guidance of $170–176M (~16% at midpoint) disappointed. FY26 guide: $700–720M revenue, $40–50M FCF. Market cap ~$3.0B; ~4.2x forward sales, the cheapest name in this report.

The AI angle: Real but small-dollar: AI Accelerator GPU edge nodes for sub-50ms inference, and Content Guard riding the same block-the-AI-scrapers wave as Cloudflare.

Verdict: A profitable-ish turnaround with a legitimate edge-AI angle, priced like the second-tier player it is. Risks are structural: top-10 customers are 34% of revenue, a history of single-customer shocks (TikTok, 2020), and that soft Q2 guide.

Identity & Access

OKTA, Okta

What they do: Okta is the neutral broker of identity, the login layer for the enterprise. Workforce Identity Cloud (employee logins), Customer Identity Cloud (Auth0, for your app’s users), privileged access, identity governance, and, new as of April 30, 2026, “Okta for AI Agents,” which treats AI agents as first-class identities to be provisioned, governed, and revoked like employees.

The moat: Neutrality plus integrations. Okta works across AWS, Azure, GCP, and every SaaS app, 7,000+ integrations in the Okta Integration Network, which is exactly what Microsoft, its biggest threat, can’t credibly offer.

The financials (Q1 FY2027, ended April 30, 2026, reported May 28): The growth/profit trade in one print: revenue $765M, +11% YoY (subscription $750M, +11%); RPO $4.719B +16%, cRPO +12%; net retention slipped a point to 107%. But profitability is excellent: non-GAAP op income $191M (25% margin) and FCF $271M, a 35% FCF margin. FY27 guided to $3.185–3.205B, just 9–10% growth. Market cap ~$26B; ~8.9x trailing sales, ~39x forward earnings.

The AI angle: Structurally the best thing to happen to Okta since single sign-on: someone has to govern the exploding population of non-human identities. Okta’s own data: 88% of organizations report AI-agent-related incidents, yet only 22% treat agents as first-class identities. That gap is the product roadmap.

Verdict: The closest thing to a neutral identity utility, now a cash-flow story with a genuine second act in agentic identity. The risk is blunt and unavoidable: Microsoft bundles Entra ID effectively for free, which caps Okta’s pricing power and explains the deceleration to low-double-digit growth.

CYBR, CyberArk (no longer tradeable, now part of PANW)

The privileged-access leader, the company that vaults the admin credentials attackers most want, and the emerging machine-identity franchise. Final independent numbers (FY2025): total ARR $1.44B +23%, subscription ARR $1.267B +30%, Q4 revenue $372.7M +19%. Palo Alto’s acquisition closed February 11, 2026 (~$45 cash + 2.2005 PANW shares per share; ~$21–25B total depending on how the stock is valued); CYBR is delisted. Its significance now: it’s the strongest validation that machine/non-human identity is the sector’s premier AI thesis, you just have to own PANW to own it.

Data Security & Cyber-Resilience

RBRK, Rubrik

What they do: Rubrik reframed the boring backup business as cyber-resilience: Rubrik Security Cloud does backup and recovery with built-in ransomware detection, and its backups are immutable, they cannot be altered or deleted, even by an attacker with admin credentials, which makes them the last line of defense when everything else fails. On top: Sonar (DSPM), Turbo Threat Hunting, Cloud Vault, and, the interesting one, Annapurna (expanded June 2026), which catalogs a company’s unstructured backup data and serves it to AI pipelines.

The moat: Immutability plus a resilience-first brand in a category (backup) where rivals grew up as storage vendors. Retention metrics are elite for the size: subscription NRR ~120%, 2,946 customers above $100K ARR (+24%), Cloud ARR now 89% of subscription ARR and growing 43%.

The financials (Q1 FY2027, ended April 30, 2026, reported June 4): The fastest grower in this report: revenue $387.1M, +39% YoY; subscription revenue $374.2M, +41%; subscription ARR $1.57B, +32%; Cloud ARR $1.39B, +43%. Revenue growth running ahead of ARR growth is a bullish sequencing signal. Profitability is young but real: non-GAAP op income $24.6M (thin), FCF $74M (up from $33M). Market cap ~$18B (volatile, $13–18B range); P/S compressed to ~7.6x.

The AI angle: A clever double-dip: the immutable-backup/DSPM layer protects AI training and RAG data, while Annapurna resells that same backup corpus as an AI-ready data catalog. Rubrik effectively sells the same data twice, once as protection, once as fuel.

Verdict: The fastest-growing cyber-resilience name with the sector’s most creative AI-data angle. Counterweights: still sub-$400M quarterly revenue, thin profitability, and a fragmented category (Veeam, Cohesity, Commvault) with commoditization risk.

VRNS, Varonis (supporting cast)

The purest DSPM play: Varonis maps who can and who does access every piece of sensitive data, the deepest identity-times-data-times-behavior telemetry in the category, and is mid-flight in an on-prem-to-SaaS transition. Q1 2026: revenue $173.1M +27% (highest growth of the supporting tier); SaaS ARR $683.2M +69% headline, +29% to $522.6M excluding conversions; still GAAP-unprofitable. Its Atlas product (GA March 2026) governs AI-agent data access, the most direct “AI agents are touching your data” thesis in the group (“83% use AI, only 13% have visibility”). Higher risk, higher directness.

Exposure / Vulnerability Management

TENB, Tenable (supporting cast)

The vulnerability-scanning standard: Nessus is the de facto scanner with the largest install base, now rebundled as Tenable One “exposure management” across IT, cloud, OT, and AI assets. Q1 2026: revenue $262.1M, +9.6% (beat); non-GAAP EPS $0.47 (+30.6%); 23.6% op margin; record unlevered FCF of $88.6M (33.8% margin), but FY26 guided to just ~7.4% growth. Its Hexa AI agentic layer and a May 2026 Anthropic partnership (Claude for vulnerability prioritization) keep it relevant. Mature, cash-generative, no longer a momentum story.

QLYS, Qualys (supporting cast)

Tenable’s cloud-native rival in vulnerability management and compliance, and the group’s capital-efficiency champion. Q1 2026: revenue $175.6M +10%, non-GAAP EPS $1.95 (beat), FY26 guided $721–727M, with best-in-class margins. TotalAI treats models, LLMs, and MCP servers themselves as attack surface (mapped to OWASP-LLM and MITRE ATLAS), with FedRAMP Moderate landed May 2026. Second-tier in scale, first-tier in profitability.

My take, the tiers

This is the opinionated part. Ranked for a long-term AI-diffusion thesis, quality of franchise, directness of AI linkage, and what you’re paying for growth. Confidence: moderate, the fundamentals data here is solid and current, but tier boundaries are judgment calls, and this sector re-rates fast. No price paths, per house discipline, this is about business quality and positioning, not where any ticker trades next.

• Franchise / core holdings, CRWD, PANW, FTNT. CRWD: re-accelerating growth at $5.5B ARR with a 34% FCF margin is the best fundamental profile in software security, you pay dearly (30–32x forward ARR) for the privilege. PANW: the consolidation winner with elite cash flow, as long as you underwrite the organic 14%/28% trend, not the M&A-inflated headline. FTNT: 36% op margins, $1B quarterly FCF, and the most direct AI-datacenter product, the compounder hiding inside a “hardware” label.

• Underappreciated compounder, ZS. 25% growth, record 23% op margins, a real moat, at ~6.55x sales, the clearest disconnect between franchise quality and multiple in this report. The crowding risk and organic net-new decel are why it’s cheap; the platform economics are why that looks overdone.

• High-growth, higher-risk, RBRK, NET, VRNS, NTSK. RBRK: fastest grower, cleverest AI-data angle, compressed to ~7.6x sales, the best risk/reward in the tier if the category doesn’t commoditize. NET: a genuinely great asset that is, at ~35–40x sales on an 11% margin, the most fully-priced story here, the AI-toll-road thesis is real, but you’re paying as if it’s already won. VRNS: the most direct AI-agents-and-data thesis, still GAAP-unprofitable mid-transition. NTSK: first-tier product, second-tier finances, the FCF swing to −$57M is the number to watch before anything else.

• Profitable compounders / value, OKTA, TENB, QLYS. OKTA: a 35% FCF-margin identity utility with the sector’s best structural tailwind (non-human identity) fighting the sector’s worst structural headwind (free Microsoft bundling), the tension defines the stock. TENB and QLYS: mature, high-margin cash generators in a necessary-but-unexciting category; own them for durability, not for the AI thesis.

• Niche / second-tier, S, FSLY. S: a genuinely improving challenger (+55% net-new ARR, newly profitable) that still lives in CrowdStrike’s shadow. FSLY: cheap (~4.2x sales) and turning profitable, but a distant third in a commoditized market with 34% top-10 customer concentration.

• Structurally challenged, CHKP. +5% growth in a sector growing 10%+ means share loss by definition; great margins fund the transition, but Infinity AI Copilot is a follower’s product.

Where the AI-infrastructure linkage is strongest: two sub-sectors stand clearly above the rest. Identity / non-human identity (Okta, PANW-via-CyberArk, the Cisco–Astrix deal), the 144:1 NHI ratio and the fact that only 15% of orgs can defend it is the most quantifiable gap in enterprise security. And network/datacenter security (Fortinet, PANW), AI datacenters create new east-west traffic patterns and make GPUs themselves an attack surface (firmware poisoning, model-weight theft). DSPM (Varonis, Rubrik) is real but indirect, it protects the training data, one step removed. Edge (Cloudflare, Fastly) is directionally logical for the AI-agent economy but has the thinnest hard evidence today.

Bottom line

Cybersecurity is the one AI trade that doesn’t require you to pick the AI winner: whichever model, lab, or nation prevails, that AI will be weaponized by attackers and must be defended against by every enterprise on earth, a demand loop that compounds regardless of the outcome. The sector’s market leadership in 2026 (CIBR +30.6% YTD, green while semis sold off) suggests the market is starting to price that in, and the $75B+ M&A wave says the industry’s giants already have. The differentiation for investors is no longer “is cyber a good theme”, it’s which sub-sectors (identity and datacenter security first) and which balance sheets (platform consolidators and cash-rich compounders) convert the theme into durable economics.

📊 Read this on SignalDeck.live.

Not financial advice. For informational and educational purposes only. Do your own research.