One of the most prolific industries over the last few years is cybersecurity. Several companies in the cyber landscape became household names during the early days of the COVID-19 pandemic as corporations were forced to ratchet up security measures.
While big tech leaders such as Microsoft and Alphabet offer cybersecurity services within their respective product portfolios, neither company focuses solely on this industry. Rather, names such as CrowdStrike (CRWD 2.03%) and Zscaler (ZS 1.28%) should be on your radar if you are looking to invest in best-in-breed cybersecurity stocks.
With this said, I understand that investing $10,000 into individual stocks can seem intimidating (assuming you even have that kind of money to spare). After all, there are plenty of less-volatile investment vehicles such as mutual funds or exchange-traded funds (ETFs) that focus on industry sectors such as cybersecurity. However, both CrowdStrike and Zscaler in particular are separating from the competition and giving Big Tech a legitimate run for its money.
If you have the capital available, I believe that an investment in both CrowdStrike and Zscaler will provide industry-beating returns and prove to be a worthwhile investment in the long-run.
1. CrowdStrike sticks out among the crowd
Cybersecurity is a broad term and can mean many different things. CrowdStrike's bread and butter is endpoint security. Work-issued devices such as mobile phones or laptops are considered endpoints. The company also offers additional services, referred to as modules, for cloud security, threat intelligence, identity management, IT operations, and others.
On the surface, it is easy to dismiss CrowdStrike as just another pandemic stock. However, a closer analysis of the company's financials and key performance indicators (KPIs) paint a different picture.
CrowdStrike is considered a software-as-a-service (SaaS) business. While traditional financial statement analysis is important, SaaS businesses tend to highlight a number of non-GAAP (adjusted) KPIs, such as annual recurring revenue (ARR) and net dollar retention. SaaS companies often generate revenue from two sources: software licenses (subscriptions) and professional services (ad-hoc work).
Software subscriptions tend to carry higher margins compared to non-recurring professional services, and so investors usually assess recurring revenue with more scrutiny. With that said, ARR and software license revenue on financial statements are usually slightly different figures based on GAAP revenue recognition policies.
For its first quarter for the fiscal year 2024, ended April 30, CrowdStrike reported ending ARR of $2.7 billion, up 42% year over year. One of the key drivers behind this growth are module adoption rates among its customers. In its Q1 results, CrowdStrike reported that 62% of its customers use five or more modules, while 40% use six or more and 23% use seven or more.
By selling more modules to existing customers, CrowdStrike becomes inherently engrained into the customer's ecosystem. This dynamic is not entirely surprising when looking at CrowdStrike's net dollar retention. Net dollar retention is a ratio that measures recurring revenue net of churn. Ideally, the ratio is above 100%, as that would imply the business is outselling any churn it experiences. Per CrowdStrike's Q1 investor presentation, net dollar retention has been above 120% for each of the last 10 quarters.
Given these impressive metrics, investors should not be surprised to learn that CrowdStrike was ranked far above longtime cybersecurity leaders such as Cisco Systems, Palo Alto Networks, and Fortinet in Gartner's coveted Magic Quadrant report for endpoint security platforms which was released earlier this year.
Image source: Getty Images.
2. Zscaler: Big risk or big compliment?
Zscaler specializes in a segment of cybersecurity referred to as a zero-trust platform. At its core, zero-trust architecture is a strategy that IT departments implement as part of robust systems controls. Effectively, anyone at a company, regardless of who they are, needs to be verified when logging into applications, devices, etc.
As corporations invest more heavily in digital transformation, it is obvious that zero-trust security will be an integral component. Zscaler has benefited from these tailwinds and it shows in its financials. Zscaler reported revenue of $419 million in its third quarter of fiscal year 2023 (ended April 30) report. That was up 46% year over year and well above its guidance of $396 million to $398 million. Moreover, Zscaler boasts net dollar retention over 125%.
While the results above are encouraging, investors should know that Microsoft recently announced that it is releasing its own zero-trust application. Needless to say, Zscaler stock nosedived on the news. While this decline could have served as an opportunity to buy the dip, it was short-lived. As of the time of this article, Zscaler stock is up 16% since it craterd on the Microsoft news.
Another reason why investors should not give too much weight to Microsoft's new product suite is that Zscaler has been competing with large enterprises for quite some time. Like its cohort above, Zscaler competes with industry behemoths including Cisco, Palo Alto Networks, and Fortinet. Yet despite the threat of larger competitors, Zscaler has managed to generate impressive top-line growth and customer retention rates, implying strong satisfaction with its products.
Investors should not worry that Microsoft and other large tech companies will take market share away from Zscaler. Rather, according to Grandview Research, the market size for zero trust security applications was estimated to be roughly $25 billion in 2022, and expected to grow at a near 17% compound annual growth rate (CAGR) between 2023 to 2030. Another way of thinking about this is that the market for zero-trust applications, and cybersecurity as a whole, is simply getting bigger, making it possible for more competitors to enter the space.
Each of these cybersecurity stocks have attractive valuations
Zscaler has yet to reach consistent profitability, so the price-to-earnings (P/E) ratio is not a useful valuation method. As of the time of this article, Zscaler trades for a price-to-sales (P/S) ratio of 14 times. To put this into context, Zscaler traded at a P/S of 22 a year ago, in July 2022. It's clear that despite impressive top-line growth fueled by strong customer retention, investors are not placing as much of a premium on Zscaler stock. Moreover, despite a generous 45% year-to-date return on the stock, Zscaler is still down nearly 56% from all-time highs in November 2021.
Similarly, CrowdStrike is not yet generating meaningful enough profits to use P/E as a benchmark against other industry cohorts. However, investors should know that for the quarter ended April 30, the company was GAAP profitable for the first time in company history. Of note, CrowdStrike did not hire as aggessively during the first quarter, thereby deflating the company's expense profile. Management made it clear that hiring will uptick throughout 2023, and therefore sustained profitability is still part of the longer-term picture.
As of the time of this article, CrowdStrike trades at a P/S of 15, which is significantly lower than where it was trading a year ago. Last July CrowdStrike stock was trading at nearly 26 times sales. Similar to its cohort above, CrowdStrike stock is up 57% year to date but still down nearly 43% from its highs in November 2021.
Both Zscaler and CrowdStrike have demonstrated that competing with big tech is in the cards. Despite some moves by Microsoft, Zscaler stock has proven that it can hang with the likes of large tech conglomerates, and at this valuation, the stock looks hard to pass up. Moreover, CrowdStrike is clearly an undisputed leader in end-point cybersecurity and has proven that it can parlay into other aspects of the industry as well.
While CrowdStrike's first quarter profits are not necessarily an indicator of future positive net income, I view this milestone and discplined approach to expense management as a major positive that should not be overlooked. For this reason, my suggestion would be to allocate more of the proposed $10,000 investment to CrowdStrike in particular. For example, investing 70% into CrowdStrike and the remaining 30% into Zscaler could be a good starting point. No matter what you may choose, a prudent investment strategy would be to dollar-cost average into each stock over time, and assess future earnings reports to ensure the growth story is still intact.
