Tuesday dawned dark for both cybersecurity and software-as-a-service (SaaS) companies, and as of 10 a.m. ET, shares of Palo Alto Networks (PANW +0.98%), Microsoft (MSFT +1.62%), and Cloudflare (NET +6.25%) remain down 1.5%, 2.1%, and 4.7%, respectively.
While the situation surrounding each company has its specifics (Cloudflare for instance reported strong earnings last week, Palo Alto is getting ready to report its earnings next week, and Microsoft is preparing an update on its Xbox business on Thursday), hackers appear to be the common reason behind today's declines.
NYSE: NET
Key Data Points
Who's getting hacked this time?
The Hacker News reported this morning on a couple of recent high-profile hacking incidents involving two of the companies on this list. In the first, Russian (allegedly) state-sponsored hacker group Midnight Blizzard has been blamed for using "a password spray strategy" to break in to the OAuth app to read the emails of some Microsoft senior staff and employees. Microsoft itself described this particular hack attack as beginning in November 2023.
The second incident likewise appears to have taken place in November, with Cloudflare being similarly attacked by an (unidentified) state actor. This incident harkens back to the 2023 Okta breach, utilizing credentials that were stolen and not changed since then. Hackers apparently went looking for Okta's internal reports of bugs in its own systems, presumably researching vulnerabilities that it could use to make further attacks on Atlassian.
The common theme behind all these attacks, argues Hacker News, seems to be that certain "nation-state actors [are] targeting SaaS service providers" for purposes of "espionage and intelligence gathering."
Why are Palo Alto Networks, Microsoft, and Cloudflare stocks going down?
So why are Palo Alto Networks, Microsoft, and Cloudflare stocks -- all companies involved in cybersecurity -- getting stung if the hackers' ultimate target is actually providers of other SaaS services? Well, not to put too fine a point on it, but the hackers seem to be finding vulnerabilities in the defenses raised by the cybersecurity companies, and winning, if not the war, then at least isolated battles. That could shake investor confidence in the cybersecurity companies' effectiveness, and their value as investments.
The flip side of this argument, however, is that high-profile hacking incidents still do highlight the need for good cybersecurity -- and for cybersecurity stocks. The answer to the problem of cybersecurity efforts sometimes failing certainly cannot be "well, let's just get rid of all our cybersecurity."
To the contrary, just this morning two separate investment banks raised their price targets on Palo Alto Networks shares ahead of next week's earnings report. One of these firms, Stifel, predicted that "ongoing secular tailwinds" will deliver "a strong Q2 for Palo ... and at least a reaffirmed guide," according to a report on The Fly this morning. Jefferies seconded the emotion, predicting that Palo Alto will report better-than-expected sales, and that annual recurring revenue will grow 50% year over year. More than just a (great) number, if that turns out to be correct, it would imply that even more customers are making cybersecurity spending an ongoing line item of their operating costs -- and that's exactly what you would expect to happen in an environment of continued and increasing hacking attempts.
While I admit to having some concerns about valuations in this sector, the fact that cybersecurity remains a growth industry cannot be denied.
