2 Cybersecurity Stocks You Can Buy and Hold for the Next Decade

There's been a lot of discussions recently in the U.S. about a recession. Some assert that we may already be in one, while others ponder whether one might be on the horizon. As a net buyer of stocks, I try not to let recession fears alter my investment strategy. That said, for those who are looking for investments that may hold up better in uncertain economic times, I think the cybersecurity sector is a great place to start.

Cybersecurity has become a standard for businesses of any size. While tough economic conditions can force many businesses to make expense cuts to keep going, there are some expenses that cannot be compromised. Considering the importance of protecting against cyber attacks, leading operators in this space have effectively become recession-resistant, if not recession-proof.

Let's take a closer look at two companies that are leaders in this space and why they have risen to the top of my cybersecurity shopping list.

1. CrowdStrike

Since becoming a public company in June of 2019, the story of CrowdStrike (CRWD 1.70%) has been consistent, impressive growth in almost every metric. Of particular interest is its customer growth, as well as how much customers spend once on board.

On the customer acquisition front, the most recently reported quarter (Q2 of fiscal 2023, which ended July 31) saw continued subscription customer count increases. The quarter ended with 19,686 customers, good for a 51% year-over-year increase. More impressive is that this is the sixth consecutive quarter of customer growth exceeding 50%.

Once customers are on board, they tend to stay. CrowdStrike has a goal of keeping its dollar-based net retention rate above 120%. Essentially, this means customers are spending an average of 20% more each year than the previous year. In the last quarter, this metric was 123.9%, and you'd have to go back to the fourth quarter of 2018 for the last time this metric dipped below the 120% benchmark.

Customers tend to spend more because CrowdStrike is offering so many different products, called modules, that customers can add to their operations as necessary. You'll notice that over time so many customers have added additional modules that the company has shifted what gets reported because the benchmark investors care about keeps rising.

Data source: CrowdStrike.

All this customer growth has resulted in impressive top-line numbers for CrowdStrike. In fiscal 2023, Q3 revenue was $535 million, an increase of 58% over the prior year's quarter. While the company is not yet profitable on a GAAP (generally accepted accounting principles) basis, it is cash flow positive. Over the trailing 12 months, CrowdStrike has generated $543 million in free cash flow. This has provided the company with the capital it needs to continue to grow and gain market share.

2. Fortinet

Despite being a public company for almost a decade longer than CrowdStrike, Fortinet (FTNT 0.12%) is a cybersecurity company that flies under the radar, even as it continues to generate impressive results. It has a slightly smaller market cap Than CrowdStrike, but Fortinet generated more revenue and free cash flow over the trailing 12 months. Fortinet is also profitable. In fact, Fortinet has posted a profit and positive free cash flow every year since its 2009 IPO. 

One focus for Fortinet has been expanding into larger enterprise companies. The number of deals valued at more than $1 million grew from 198 in 2019 to 350 in 2021. Customers receiving annual billings of more than $1 million increased 93% over that same time frame. Large enterprise customers now account for 40% of all customers.

These larger customer contracts have helped Fortinet achieve impressive revenue and billings growth. For all of 2022, the company is forecasting approximately $4.4 billion in revenue and $5.6 billion in billings. These results would represent increases of 31% and 34%, respectively, over 2021.

Looking further into the future, Fortinet expects to see revenue of $8 billion and billings of $10 billion by 2025. Even if the company falls short of that number, it's clear management sees several years of strong growth ahead.

Why should investors buy both of these companies?

The cybersecurity total addressable market is forecast to be greater than $199 billion by 2026. Considering the size of this opportunity, there can be many winners in this space. 

CrowdStrike is clearly proving to be a sticky platform that leads to more spending by its customers. Fortinet is forecasting impressive revenue and billings growth for the next several years. Together, these companies make a nice pair to get some cybersecurity exposure in a diversified portfolio.