The cybersecurity industry is one of the bigger megatrends in today's technology-driven world, with data platform Statista projecting cybersecurity sales to grow by 10% through 2028.
Two companies perfectly positioned to benefit from this boom are cloud-based security platforms CrowdStrike Holdings (CRWD 2.03%) and Qualys (QLYS 0.36%). Whether safeguarding from threats through the cloud, preventing identity attacks from compromised credentials, or looking for vulnerabilities across their clients' operations, these companies have quickly become indispensable.
Better than that, they are more than just a great suite of products -- they're great stocks. Here's what sets them apart from their peers and makes them magnificent cybersecurity stocks to hold for a decade or more.
CrowdStrike's flywheel effect and growth potential look unstoppable
CrowdStrike and its Falcon platform generate trillions of signals each week on a threat graph, maintaining one of the most impressive data moats on the stock market. The company's early adoption of artificial intelligence (AI) before it became the hot topic it is today gives it a competitive advantage. The stock is up 56% this year.
With over 10 years of data to train its AI and machine learning models, the company built a lead over its peers that won't soon be overcome. And as it adds each new customer, more data is driven through CrowdStrike's AI and machine learning models, creating a flywheel effect that makes its services more valuable to existing and potential customers.
This flywheel effect makes CrowdStrike a promising investment, with revenue growth of 37% in the second quarter of 2024. Analysts expect sales to increase by 39% in the upcoming year, so this growth shows no signs of letting up.
Consider the company's notably high growth in four areas:
- International: With 31% of revenue at the end of fiscal year 2023, international sales continued to outpace overall revenue growth, jumping 43% in the last quarter.
- Cloud security: New annual recurring revenue (ARR) grew by more than 70% quarter over quarter, with CrowdStrike noting that instances of cloud exploitation by attackers grew by 95% over the last 12 months.
- Identity protection: Growing ARR by 194% compared to last year, these modules are poised to continue their blistering growth, as 62% of all intrusions over the previous year were identity-based attacks, the company reports.
- LogScale: Its nascent observability offering -- which lets clients collect, store, and analyze logs from information technology (IT) systems -- saw its ARR more than triple, creating a burgeoning new vertical for the company.
Despite the company's lofty price-to-sales (P/S) ratio of 15, its valuation is relatively cheap compared to its historical averages. While a valuation this high should usually be passed on, CrowdStrike's expanding flywheel effect, international ambitions, and promising new product lines make it a perfect dollar-cost averaging candidate to hold for at least a decade.
Despite its size, Qualys brings outsize profitability
At only about one-eighth the size of CrowdStrike, Qualys carved out a highly profitable niche, delivering IT, security, and compliance solutions to its clients through its cloud-based platform. The two companies' offerings overlap in only a tiny area, and Qualys' claim to fame is its Vulnerability Management, Detection, and Response (VMDR) cloud app.
This VMDR app enables companies to automatically discover and inventory their IT assets, hardware, and software, allowing them to classify what items are considered crucial. From there, Qualys continuously monitors these assets for vulnerabilities, fixing exploitable issues while tracking and reducing its client's cyberthreats. In overly simple terms, VMDR is like the code readers that mechanics use to provide diagnostics on a car, but for a company's IT assets instead.
VMDR is used by 52% of Qualys's clients, making it the key differentiator from its peers' offerings. To illustrate this, consider that over 53% of the Fortune Global 500 uses Qualys, despite CrowdStrike and Palo Alto Networks having slimmed-down versions of VMDR.
And Qualys is taking a page out of CrowdStrike's playbook, acquiring Blue Hexagon and its AI and machine learning platform in late 2022. This new technology will be integrated into its VMDR app (as well as the rest of its business), allowing it to more successfully detect unusual behavior or suspicious activities on a network. Having already indexed over 13 trillion data points, Blue Hexagon's AI and ML platform could bring immense value.
With analysts expecting "only" 15% sales growth in the upcoming year, Qualys has been the slowest grower of its closest peers.
QLYS revenue (TTM) data by YCharts; TTM = trailing 12 months.
However, its outsize net profit margin makes it a truly one-of-a-kind offering in the cybersecurity industry. The stock is up 36% this year.
QLYS profit margin data by YCharts.
Aided by this profitability, the company lowered its share count by 6% over the last three years, further juicing shareholder returns.
This steady profitability commands a premium valuation, and the stock trades at a forward price-to-earnings ratio of 33. However, thanks to its market-leading VMDR offering, which should only grow stronger with Blue Hexagon's addition, Qualys makes for a perfect dollar-cost averaging pick to add to on dips and hold for at least a decade.
