The scoreboard
Benchmarks, Q3 (Jun 30 → Sep 30) / YTD (Dec 31 → Sep 30)
- SCMI (Signals Cybersecurity Market Index): +20.8% / +52.9%¹
- CIBR (cybersecurity ETF): +14.7% / +44.3%
- Nasdaq-100 (QQQ): +0.5% / +20.4%
- S&P 500: +2.0% / +11.8%
¹ SCMI YTD runs from Jan 2, the index’s first print.
The 17 SCMI companies, sorted by Q3 return
| Company | Q3 | YTD | EV/Sales (Sep 30, est.)² | Revenue growth, latest qtr | Next earnings |
|---|---|---|---|---|---|
| Okta | +53.3% | +141.8% | 11.3x | +10.6% | ~Dec 1 |
| Rapid7 | +50.9% | −19.6% | 1.3x | −1.5% | Nov 4 |
| Cloudflare | +41.6% | +76.2% | 48.8x | +35.9% | Nov 5 |
| Zscaler | +41.3% | −11.3% | 9.2x | +24.9%³ | ~Nov 24 |
| SentinelOne | +40.0% | +58.4% | 7.0x | +20.6% | not announced |
| CrowdStrike | +38.8% | +125.9% | 49.4x | +25.8% | ~Dec 1 |
| Qualys | +36.2% | +40.9% | 8.6x | +11.0% | ~Nov 3 |
| Palo Alto Networks | +16.5% | +115.7% | 28.3x | +34.5%⁴ | ~Nov 18 |
| Fortinet | +16.4% | +125.1% | 17.2x | +25.6% | Oct 28 |
| Varonis | +13.1% | +44.7% | 7.5x | +18.3% | Nov 3 (results only, no call) |
| VeriSign | +12.1% | +16.1% | 15.6x | +6.0% | Oct 22 |
| F5 | +7.0% | +74.4% | 7.3x | +10.9% | Oct 27 |
| Tenable | −1.3% | +54.7% | 4.0x | +8.6% | Oct 28 |
| Check Point | −2.3% | −30.8% | 4.0x | +1.3% | Nov 2 |
| Radware | −3.4% | +23.7% | 3.2x | +10.9% | Oct 28 |
| Akamai | −10.0% | +21.9% | 4.6x | +5.4% | Nov 5 |
| Gen Digital | −11.5% | −19.0% | 4.1x | +6.3% | Oct 28 |
² Estimated: enterprise value divided by the last 12 months of revenue, at Sep 30 share prices. ³ Includes the Red Canary acquisition; excluding it, Zscaler’s fiscal-year revenue grew 20%. ⁴ Includes CyberArk; no organic figure disclosed. “~” = estimated date.
Q3 deals (selected)
| Deal | Value | Status |
|---|---|---|
| Accenture / Dragos (+ runZero, NetRise) | ~$3.2B EV for Dragos (~$4.2B combined) | Closed in Q3 (announced June) |
| Visa / BioCatch | $2.4B cash | Pending |
| Cyera / Oasis Security | ~$1B | Completed Sep 3 |
| Munich Re / At-Bay | $575M EV | Pending |
| Okta / Permiso | just under $200M (reported) | Closed Aug 26 |
Deals since the quarter
Proofpoint agreed on Oct 15 to buy Varonis for $49.75 a share in cash, about $6.3B. Closing is expected in the first half of 2027, subject to approvals. IonQ agreed on Oct 12 to buy Elisity for up to $1.3B in stock.
Largest private rounds
Cyera $400M (>$12B), Island $400M ($6.4B), Upwind $300M ($3.8B), Exein $270M ($1.7B), Saviynt $255M, Horizon3.ai $250M ($2B+). The 11 largest rounds totaled ~$2.85B.
The read
Cyber beat the market, but the Q3 ranking is misleading
My cyber index gained 20.8% in Q3. The S&P 500 gained 2% and the Nasdaq-100 half a percent. Over the first nine months of the year, the index was up 52.9%.
But the Q3 ranking doesn’t show who is winning this year. Two of the quarter’s top four, Rapid7 (+51%) and Zscaler (+41%), were still down for the year at the end of September, by 20% and 11%. Both lost a lot in the first half: Rapid7 fell 47% and Zscaler 37%. At the same time, two of the year’s biggest winners, Palo Alto and Fortinet, gained only 16–17% in Q3, less than my index. Since January, they were up 116% and 125%.
Growth explains the losers, not the winners
Slow growth was punished. Check Point grew 1% last quarter and was down 31% for the year by the end of September. Rapid7’s revenue shrank. For the companies growing fast, growth alone explains little. CrowdStrike, Fortinet and Zscaler all grew about 25% last quarter. At the end of September, investors valued them at about 49x, 17x and 9x revenue. Similar growth, very different prices.
Two other things explain more. The first is the outlook. CrowdStrike raised its outlook and expects to add 34% more new recurring revenue this year than last. Fortinet raised its guidance too, but to 19% for the full year, and most of its recent growth came from hardware: product sales, mostly firewalls, grew 52%. Zscaler grew 25% last quarter including the Red Canary acquisition. Without it, full-year growth was 20%, and it expects about 19% this quarter.
The second is profit. Last quarter, Fortinet kept 38 cents of every dollar of revenue as adjusted operating profit. Zscaler kept 24 cents. That’s why Fortinet was worth almost twice as much as Zscaler per dollar of revenue. In my view, investors pay for growth that lasts and for growth that makes money. CrowdStrike has the first. Fortinet has the second. Zscaler still has to prove both.
Okta is the extreme case. Revenue grew 11%, but by the end of September the stock was up 142% for the year. In my view, the market is paying for Okta’s position in identity. Every AI agent a company deploys needs an identity, and Okta wants to be the company that manages it. It bought Permiso in Q3 for that reason.
Fortinet and Check Point are the clearest contrast. They sell to the same firewall buyers. One grew 26% and more than doubled. The other grew 1% and lost almost a third. I think customers are buying from fewer firewall vendors, and the market rewards the vendor they choose.
Who’s buying? Not only security companies
The largest deal announced in Q3 and the largest one completed both came from outside security:
Visa (payments): $2.4B for BioCatch
Accenture (consulting): ~$3.2B for Dragos, completed in Q3
Munich Re (insurance): $575M for At-Bay
IonQ (quantum computing): up to $1.3B for Elisity, two weeks after the quarter
These companies already own the customer relationship, and their customers expect security as part of the service. Security vendors now compete with them for the same startups.
The biggest deal since the quarter ended came from a security company, though. Proofpoint, owned by Thoma Bravo, agreed to buy Varonis for about $6.3B in cash. Proofpoint is best known for email security. Varonis controls who and what can access company data, including AI agents. In my view, controlling data is becoming a core part of AI security, and private equity is willing to pay for it. Outside buyers are coming in, but security companies are still buying too.
Since the quarter closed
Three weeks into Q4, the ranking has reversed. Through the Oct 21 close: Zscaler +16.0%, Tenable +11.8%, Check Point +11.7%, Rapid7 +10.6%. Akamai −15.1%, Palo Alto −12.6%, Cloudflare −11.5%, CrowdStrike −9.6%. My index is up 1.3% over the same period, and Zscaler is now positive for the year.
Is money rotating from the winners to the laggards? My guess is that investors started betting AI security demand lifts the whole sector, not only the leaders. In my view, a rebound without growth doesn’t last. The earnings reports over the next two weeks will show which way it goes.
What I’m watching in Q4
- Fortinet (Oct 28) and F5 (Oct 27), this year’s hardware winners: how long will the upgrade cycle last? If it continues into 2027, in my view Fortinet at 17x revenue will look cheap.
- Rapid7 (Nov 4) and Zscaler (~Nov 24): is the rebound backed by growth?
- Okta (~Dec 1): the stock more than doubled on 11% growth. Will growth pick up?
- Check Point (Nov 2), one of the best performers since the quarter ended: will growth return?
- Varonis (Nov 3): results without an earnings call, and the first look at what Proofpoint is buying.
The question I’m raising for Q4: is this rotation the start of a trend, or just one good quarter?
Disclaimer: Market commentary, not investment advice.
