Cloud Security Storms Wall Street

Three cybersecurity stocks soared on record earnings this week, revealing the scale of the “work from anywhere” trend and giving a clear message about where cloud-based security solutions are headed.

CrowdStrike (CRWD), Okta (OKTA), and Zscaler (ZS) were among the stocks to hit record highs after each firm reported quarterly results on December 2 that delighted investors, as noted in the table below:

All three showed quarterly revenue growth in double digits. All three beat Wall Street estimates by wide margins. Alll three have provided optimistic future guidance. And all three have shown continuous success over the last twelve months, as illustrated in their stock price history below:

Clearly, these successes reveal a lot about the state of cloud security and the kinds of technologies meeting current demand. Let’s take a closer look.

Why CRWD, OKTA, and ZS Are Killing It

Generally, all three companies cited so far have a few things in common: They provide cloud-native security solutions that don’t require backhaul to a central data center for security. They work within existing networks. And they eliminate traditional and often costlier layers of security required in the data center.

CrowdStrike, founded in 2011 and based in Sunnyvale, Calif., specializes in cloud-based endpoint threat prevention. Since going public in 2019, the firm has enjoyed increasing sales, which kicked into high gear during the COVID-19 pandemic. Analysts credit CrowdStrike for having a totally cloud-based solution and for its ability to run via a simple endpoint agent, along with ingenious artificial intelligence (AI) algorithms that identify threats. In a note this week, J.P. Morgan financial analyst Sterling Auty and colleagues summarized these features and described the reason for their success:

“This architecture is significantly different from the competition which either started on premise and is shifting to the cloud or is narrowly focused on endpoint protection (EPP) as the core, or suffers from running multiple agents while also trying to move to the cloud and broaden the solution portfolio (Symantec).”

Okta, founded in 2009 and based in San Francisco, offers zero trust network access (ZTNA) and identity and access management (IAM) products that are cloud native. Being able to manage these aspects of security without resorting to network or data center hardware makes Okta a prime candidate for securing the network edge and supporting a work-from-anywhere policy.

Zscaler, founded in 2008 and based in San Jose, Calif., secures network endpoints without requiring hardware in products generally categorized as secure web gateways (SWG). Its products include Zscaler Private Access (ZPA) is a cloud-based service that secures enterprise network applications for remote use. Another service, Zscaler Internet Access (ZIA), offers a secure gateway to the Internet. Together, both eliminate the need to backhaul remote access requests to the central data center for protection and the need to set up virtual private networks (VPNs) via dedicated hardware.

In another note to clients this week, J.P. Morgan analsyts described Zscaler’s success as follows:

“Zscaler has been the first mover with its ZIA for MPLS replacement and ZPA for remote access… [H]aving the ability to connect securely from any location creates a level of flexibility that is much needed in the current pandemic environment, and we believe that will continue to be the case even after a vaccine, as many companies have committed to more flexible working arrangements.”

Looking Ahead

Companies in the cloud-native cybersecurity space can expect to see sustained success, thanks to the accelerated shift to remote work generated by recent macro events. But they will have to work for it. CrowdStrike, Okta, and Zscaler are competing with other startups for customers and employee talent. Also looming are the shadows of large, established players such as Fortinet (FTNT), Palo Alto Networks (PANW), and Cisco (CSCO), which, however hobbled by their own age and culture, have resources to expand their cybersecurity offerings in the cloud, often through acquisitions.

M&A is going to be tough in this space, because these newer cloud-based companies have reached such large valuations. One concern in the investment community is that these stocks have approached bubble-like valuations. Many of them trade at extreme price/sales metrics: For example, Crowdstrike now trades at a 53 price/sales (P/S) ratio; Okta trades at P/S of 44, and Zscaler trades at 56 times projected sales. In another example, Crowdstrike has an annual revenue run rate of about $1 billion and has a market capitalization of $35 billion. Hewlett-Packard Enterprise (HPE) has annual sales of $27 billion and a market cap of only $15 billion.

Could getting acquired be in the cards for smaller players? Given the pace valuations of the newbies, that’s could be less likely the more successful — and expensive — they become. Still, we’re living in an age of big tech transactions. Much is possible.