Exploring Profitability in the Cybersecurity Market

Only around half the companies in the public cybersecurity market are profitable based on the net income figure disclosed in their latest set of financial results. In many industries this could be cause for concern, however, in the case of cybersecurity we would argue this reflects more positive market dynamics, where companies exercise financial prudence by sacrificing short term profitability for longer term growth. In this note we explore the growth of the sector, discuss why cybersecurity companies in many cases elect to have lower earnings and highlight why current valuations present an opportunity following somewhat of a disconnect this year between fundamentals growth and performance.

Strong Growth in the Cybersecurity Sector

The first cybersecurity indices emerged in the early 2010s, recognising the growing importance of cybersecurity as a critical sector within the broader technology industry and aiming to capture this secular growth. Yet over a decade later, cybersecurity as an industry continues its trajectory of rapid growth. This is driven primarily by increasing digitalisation and the rising frequency of cyberattacks.

Source: Bloomberg, December 2024.

• Market Size and Projections: In 2023, the global cybersecurity market was valued at approximately USD 250 billion. It is projected to grow at a compound annual growth rate (CAGR) of 12.3%, reaching around USD 657 billion by 2030.¹
• Rising Cybercrime Costs: The global cost of cybercrime is expected to surge from USD 9.22 trillion in 2024 to USD 13.82 trillion by 2028, underscoring the escalating threat landscape.²
• Increased Corporate Spending: Organisations worldwide are allocating a growing portion of their IT budgets to cybersecurity, with expenditures expected to reach USD 298.5 billion by 2028, up from USD 190.4 billion in 2023.³
• Employment Growth: The demand for cybersecurity professionals has surged, with an estimated 3.5 million unfilled cybersecurity positions globally in 2023, reflecting the critical need for skilled experts in this field.⁴

The growth of the industry is mirrored by the top line revenue growth of cybersecurity companies. Excluding Q2 2023 companies, on aggregate, have announced double digit annualised revenue growth in each quarterly earnings season. Revenue growth also has a strong track record of surpassing Wall Street estimates, usually we see over 70% of our companies growing revenues beyond consensus analyst estimates. This evidences that the sector is not just growing, it is growing more quickly than projections.

It is precisely why we argue that cybersecurity is the ‘consumer staples’ of technology, as its growth remains unperturbed by market developments that have impacted other sectors over the past year such as the Fed’s rate hiking campaign, supply chain issues and geopolitical tensions.

Source: Bloomberg, December 2024. In the current (Q3 2024) earnings season, 24 of the 27 companies in our index have reported earnings. Market data based on the constituents of the Foxberry Tematica Research Cybersecurity & Data Privacy USD PR Index.

Why Cybersecurity Companies Elect to Have Lower Earnings

The cybersecurity industry prioritises growth over short-term profitability, reinvesting heavily in research and development (“R&D”), talent acquisition, and market expansion. This investment positions cybersecurity companies to capture greater market share and achieve scale, which can lead to significant future profitability.

• Innovative Business Models: Emerging cybersecurity firms often operate on innovative, subscription-based models that take time to generate substantial profits. These models build recurring revenue streams, creating more sustainable long-term income, even if the initial years are lean.
• Market Leadership Aspirations: Cybersecurity companies can only establish themselves as industry leaders by developing cutting-edge solutions. A lack of profitability is often the result of aggressive spending on technology development, partnerships, and customer acquisition, all of which are key strategies to dominate a competitive market.
• Sector Characteristics: Cybersecurity requires staying ahead of constantly evolving threats. Firms invest in continual product updates and innovation, making profitability a secondary goal compared to ensuring relevance and resilience in a fast-paced environment.

Case Study: Okta

Okta is a great example of an unprofitable company that prioritises long-term growth and market leadership over near-term profitability. The cloud-based identity and access management company reported its Q3 fiscal 2025 financial results on December 3, 2024, showcasing a 14% year-over-year revenue increase to $665 million and adjusted earnings per share of $0.67, both surpassing analyst expectations. It also disclosed a GAAP operating loss of $16 million.

The reason for this loss is that Okta has been investing heavily in research and development and expanding its product offerings. For example, in its latest results it invested approximately 24% of its top line revenue to research and development, which follows the trend over the last 2 years during which it has averaged an allocation of around 28%. In fact, it’s clear to see that had the R&D allocation not been as high, the company more than likely would have made an operating profit.

R&D Costs Are High but Operating Losses Are Declining

Source: Bloomberg, 06 December 2024.

The effectiveness of this R&D strategy has enabled Okta to maintain its leadership in the identity and access management market, even as it faces increasing competition from companies like Microsoft. This strong market position has also enabled Okta to lower its operating income, which whilst still negative has been gradually decreasing over time.

Wall Street Underestimates Earnings Growth

Wall Street consistently underestimates the growth in earnings of the industry. In the table below, we can see the earnings surprise data for cybersecurity companies in the ongoing Q3 2024 earnings season. Overall, over 90% of the companies have grown earnings this quarter and 78% have exceeded analyst expectations.

Q3 2024 Reporting Season – Cybersecurity

Source: Bloomberg, 06 December 2024.

In many cases, earnings results are notably higher than analyst estimates, as indicated in the surprise column below.

Source: Bloomberg, 06 December 2024. Market data based on the constituents of the Foxberry Tematica Research Cybersecurity & Data Privacy USD PR Index.

Cybersecurity is a Mature Market which is Positive for Earnings

The increase in large-cap companies within the cybersecurity industry, from around a third in March 2020 to just over half today, is a positive sign as it reflects the sector’s maturity and resilience. This, of course, is positive for earnings growth, allowing large-cap companies access to capital markets, economies of scale, and resilience to macroeconomic pressures.

Larger market capitalisations indicate that these companies have successfully scaled their operations, established strong customer bases, and gained investor confidence. This growth enhances their ability to invest in advanced technologies, expand globally, and withstand economic fluctuations, making them more stable and reliable players in an increasingly critical industry. It also signals broader market recognition of cybersecurity’s long-term importance in the digital economy.

Valuations Remain Constructive

Despite strong performance since the US election result, valuations look attractive on a historical and relative basis, with the current leading P/E ratio of the cybersecurity market (28.49x, 06 December 2024) sitting more than one standard deviation below its historical mean.

This year has seen strong revenue and earnings growth in each earnings season, yet cybersecurity performance until the start of the fourth quarter remained flat, and one could argue was becoming increasingly disconnected from fundamentals growth. We are now beginning to see performance gaining traction, yet valuations remain attractive, suggesting now is a compelling entry point into a sector that has been overlooked and underappreciated this year.

Source: ARK Invest Europe, 06 December 2024. Market data based on the constituents of the Foxberry Tematica Research Cybersecurity & Data Privacy USD PR Index.

Conclusion: Profitability in Cybersecurity is not Inherently Negative

The market often values cybersecurity firms based on revenue growth, customer acquisition, and product pipeline rather than near-term profits. A low level of profitability signals that investors are willing to fund innovation and trust in the long-term scalability of these companies. This is why we believe the strong secular growth, attractive valuations currently on offer and declining losses with many of the companies in the sector, presents a compelling investment case for an investment in cybersecurity today.