Cybersecurity stocks: who sells what, and how much of it is AI
The firewall, endpoint, zero trust, identity, and data security companies, graded by how much of each business is security and sorted by what they actually sell.
Updated · newest price in the table below
The companies
Network security and firewalls
One of the oldest parts of the industry and the largest group of security specialists on this page by revenue. Firewalls are partly a hardware business, which gives this group a refresh cycle the pure software names do not have.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| PANW | Palo Alto Networks, Inc. Growth rates from fiscal 2026 onward include CyberArk, which closed on February 11, 2026, and Chronosphere, which closed on January 29, 2026. Palo Alto's annual report says the two together added $930 million of revenue in fiscal 2026, and its quarterly earnings releases give, at most, a combined figure for the two, never CyberArk's alone. Read reported growth as partly acquired. | Direct | The largest pure security company on this page and the furthest along in selling security as a platform: firewalls, the Prisma Access cloud service, the Cortex security operations suite, and identity through Idira, the platform built from CyberArk. Subscriptions and support were 80% of fiscal 2026 revenue. | $395.70 | -1.49% | $323.7B | Nov 19, 2026 | 17 |
| FTNT | Fortinet, Inc. Fortinet does not report a company-wide annual recurring revenue figure, so it cannot be compared with the subscription names on that measure. Product sales were about 38% of revenue in the quarter ended June 30, 2026. | Direct | Builds FortiGate firewalls on FortiASIC security chips that the company designs itself, and runs the same FortiOS software across firewalls, SD-WAN, and its FortiSASE cloud service. One of the most profitable large pure-play security companies on a GAAP basis. | $179.78 | -2.82% | $131.9B | Oct 28, 2026 | 5 |
| CHKP | Check Point Software Technologi | Direct | One of the original firewall vendors, founded in Israel in 1993, and now selling firewalls, cloud security, and email security under its Infinity platform. | $156.80 | -1.90% | $16.0B | Nov 2, 2026 | 2 |
Endpoint and security operations
Software installed on every laptop, server, and cloud workload, connected to a cloud platform that analysts use to investigate. This group sells almost entirely by subscription.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| CRWD | CrowdStrike Holdings, Inc. | Direct | Installs one Falcon sensor on each device and sells additional modules that run on it without another sensor, 32 of them as of January 31, 2026, and 33 when its annual report was filed in March 2026. Subscriptions were 95% of revenue in the quarter ended July 31, 2026. | $265.35 | -1.00% | $271.7B | Dec 1, 2026 | 18 |
| S | SentinelOne, Inc. | Direct | SentinelOne's agent runs AI models on the device itself to detect and stop threats, and is priced per agent. The least profitable of the endpoint names, with $292 million of revenue and a negative 31% GAAP operating margin in the quarter ended July 31, 2026. | $25.52 | -0.51% | $8.9B | - | 7 |
| RPD | Rapid7, Inc. | Direct | Rapid7 sells vulnerability management and managed detection and response, and maintains Metasploit, the open-source penetration testing framework. | $17.48 | -0.68% | $1.2B | Nov 4, 2026 | 2 |
Cloud access and zero trust
Instead of protecting the network's perimeter, these companies route users through their own cloud and connect them only to the applications they are allowed to reach.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| ZS | Zscaler, Inc. Growth after August 1, 2025, includes Red Canary. Excluding the acquisition, ARR grew 20% in the year to July 31, 2026, against 25% reported. | Direct | Zscaler's Zero Trust Exchange connects users, devices, and AI agents directly to applications without putting them on the corporate network, through a cloud the company says spans more than 200 data centers. | $258.25 | -0.73% | $42.1B | Nov 24, 2026 | 9 |
| NET | Cloudflare, Inc. | Significant | Cloudflare sells security, performance, and developer services from one global network, and many of its products are security products. It does not report security revenue separately, which is why it is graded Significant rather than Direct. | $320.43 | -2.25% | $114.1B | Nov 5, 2026 | 6 |
Identity
If an attacker signs in with a real password, a firewall does not stop them. Identity companies sell the sign-in and the rules about who can reach what.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| OKTA | Okta, Inc. | Direct | An independent identity provider, selling sign-in and access management for employees and, through Auth0, for the customer-facing apps its clients build. | $222.21 | -1.71% | $38.8B | Dec 1, 2026 | 3 |
| SAIL | SailPoint, Inc. | Direct | SailPoint sells identity governance, deciding which people and machines should have access to which systems, rather than the sign-in itself. It returned to public markets in February 2025 after Thoma Bravo took it private in 2022. | $22.20 | -0.85% | $12.7B | - | 1 |
Data and exposure
Two halves of the same question: where the weaknesses are, and what an attacker could reach through them.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| TENB | Tenable Holdings, Inc. | Direct | Tenable makes the Nessus vulnerability scanner and sells exposure management, which extends vulnerability scanning across an organization's whole attack surface and ranks weaknesses by risk. | $48.23 | -0.86% | $5.3B | Oct 28, 2026 | 1 |
| QLYS | Qualys, Inc. | Direct | Qualys sells cloud-based vulnerability management and compliance scanning from a platform it operates, collecting data through sensors and agents placed in customer environments. | $224.60 | -1.45% | $7.8B | Nov 9, 2026 | 1 |
| VRNS | Varonis Systems, Inc. | Direct | Varonis protects the data itself, mapping who can reach sensitive files and flagging unusual access, and is moving its remaining self-hosted customers to SaaS, with its self-hosted business reaching end of life on December 31, 2026. | $48.99 | -0.24% | $5.6B | Nov 3, 2026 | 2 |
Application delivery and DDoS
Companies that sit in front of websites and applications, keeping them fast and keeping attack traffic out. For several of them security is one product line next to performance.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| RDWR | Radware Ltd. | Significant | Radware sells DDoS protection and application security, as appliances and as a cloud service, alongside its Alteon application delivery controllers. It does not report how its revenue splits between the two, so it is graded Significant. | $35.34 | -0.45% | $1.5B | Oct 28, 2026 | 2 |
| AKAM | Akamai Technologies, Inc. Graded Direct because security is now the majority of revenue, but the rest is still content delivery and a cloud computing business, so Akamai is not a pure play. | Direct | A content delivery network since 1999, now selling security products, including web application, API, and DDoS protection, that have become its largest revenue category, about 55% of revenue in the quarter ended June 30, 2026. | $98.08 | -1.52% | $14.1B | Nov 5, 2026 | 2 |
| FFIV | F5, Inc. | Significant | F5 is best known for its BIG-IP application delivery and security products, and sells web application firewalls, API protection, and bot defense alongside them. F5 does not report how much of its revenue is security, and the company is not a pure security vendor. | $368.60 | -19.76% | $20.9B | Jan 26, 2027 | 1 |
| ATEN | A10 Networks, Inc. | Significant | A10 Networks sells application delivery products alongside DDoS protection, with service providers accounting for 60% of 2025 revenue and enterprises the rest. | $26.27 | -2.36% | $1.9B | Nov 5, 2026 | 1 |
| NTCT | NetScout Systems, Inc. | Significant | NetScout sells two product lines, service assurance, which is network performance monitoring, and cybersecurity, which includes its Arbor DDoS protection products and was 36% of revenue in the year ended March 31, 2026. | $39.53 | -2.38% | $2.9B | Nov 5, 2026 | 1 |
Consumer
The only part of the industry that sells to households rather than security teams.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| GEN | Gen Digital Inc. | Direct | Gen Digital owns Norton, Avast, and LifeLock, and took its current name after NortonLifeLock merged with Avast in 2022. The 2025 purchase of MoneyLion added a consumer finance business that is not security. | $24.11 | -0.56% | $14.4B | Oct 28, 2026 | 1 |
Diversified technology
Two large sellers of security products are not security companies. They belong on the page because leaving them off would misstate who the pure plays compete with.
| Ticker | Company | Exposure | Why it is here | Price | Day | Market cap | Next earnings | Our coverage |
|---|---|---|---|---|---|---|---|---|
| MSFT | Microsoft Corporation | Indirect | Sells Defender, Entra identity, and Sentinel security operations, often bundled into licenses customers already pay for. Microsoft said in January 2023 that its security business had passed $20 billion of annual revenue, about a tenth of the company's revenue at the time. | $527.89 | -0.65% | $3.92T | Oct 28, 2026 | 132 |
| CSCO | Cisco Systems, Inc. | Indirect | Sells firewalls and network security alongside its networking business, and added Splunk's security operations software when the roughly $28 billion acquisition closed in March 2024. | $109.74 | -1.47% | $432.7B | Nov 12, 2026 | 9 |
Exposure grades are our own judgment, defined in the methodology below. Market cap is unavailable from our quote source for a small number of symbols and is left blank rather than estimated. “Our coverage” is the number of articles we have published on that company.
Cybersecurity is not one market. A firewall company sells hardware that sits in a data center, an endpoint company sells a software sensor installed on every laptop and server, a zero trust company sells a cloud service that sits between users and the applications they open, and an identity company sells the sign-in itself. They compete at the edges and are increasingly sold as platforms, but they grow, price, and report differently, which is why a list of cybersecurity stocks is only useful once it says which kind each one is.
Five security leaders compared
Palo Alto Networks, Fortinet, CrowdStrike, Zscaler, and Cloudflare, with each one's most recent quarter reported by September 2026. Fortinet and Cloudflare's quarters ended June 30, 2026, and the others ended July 31, 2026. This is not a revenue ranking: Gen Digital and Akamai each reported more revenue than Zscaler, and F5 and Okta more than Cloudflare, though Gen Digital's revenue includes the MoneyLion consumer finance business, and about 45% of Akamai's revenue is not security.
| Company | How to buy it | Position in the market |
|---|---|---|
| Palo Alto Networks | US (PANW) | $3.41 billion of revenue, up 34%, including CyberArk. The largest pure-play security company on this page. |
| Fortinet | US (FTNT) | $2.05 billion, up 26%, with a 34% GAAP operating margin, the widest of these five. The only one of the five whose growth that quarter came mostly from product sales. |
| CrowdStrike | US (CRWD) | $1.47 billion, up 26%, and a record $332.8 million of net new annual recurring revenue. The largest endpoint pure play on this page, still reporting a small GAAP operating loss. |
| Zscaler | US (ZS) | $898.2 million, up 25%, including Red Canary. The largest zero trust pure play on this page, though free cash flow fell to $60.8 million that quarter as spending on equipment and internal-use software nearly tripled. |
| Cloudflare | US (NET) | $696.1 million, up 36%, the fastest growth of the group. Graded Significant rather than Direct because Cloudflare does not split security from the rest of its network revenue. |
What drives this group
The variables that decide whether these companies have a good year. Mechanisms rather than forecasts.
1. Platform consolidation
Large customers are buying more security products from fewer vendors, and the biggest companies are buying smaller ones to fill gaps.
Why it matters: Acquisitions are one reason the leaders' growth is hard to read. Palo Alto's CyberArk purchase and Zscaler's Red Canary deal both flow through reported growth. Palo Alto reports only combined figures for CyberArk and Chronosphere, including $930 million of revenue in fiscal 2026, and Zscaler discloses Red Canary's ARR but not its revenue.
2. AI on both sides
AI models can now find and exploit software flaws, and companies deploying AI agents need those agents secured like any other user.
Why it matters: Vendors now cite it often in their sales pitches and earnings calls. Anthropic said the first partners given access to its restricted Claude Mythos Preview model found more than 10,000 high- or critical-severity flaws, and CrowdStrike and Palo Alto Networks were among them. But none of the six earnings releases we reviewed reports AI security revenue separately, so the theme shows up in management commentary well before it can be checked in the numbers.
3. Recurring revenue definitions
Most of the subscription companies report annual recurring revenue, and each defines it differently.
Why it matters: ARR is one of the main numbers investors watch for these stocks, and it is not comparable across companies. Palo Alto's Next-Generation Security ARR excludes hardware and some older products, Fortinet reports no company-wide figure, and acquisitions move the figure without organic growth. Comparing two ARR growth rates without reading the definitions is comparing two different measurements.
4. The firewall refresh cycle
Hardware firewalls are physical appliances that customers replace every several years, and they buy in waves.
Why it matters: It gives the network security names a cycle the software names do not have. When a refresh wave arrives, product revenue can grow far faster than the company, as Fortinet's did in the quarter ended June 30, 2026, at 52% against 26% overall. When it passes, the same line slows regardless of demand for security.
5. Breaches and outages
A large public attack raises demand for the category that would have stopped it, and a vendor's own failure can do the opposite.
Why it matters: That makes demand lumpy. The risk runs both ways: in July 2024 a faulty CrowdStrike software update crashed millions of Windows computers worldwide, and an incident at a vendor whose product sits on every device can hit many of its customers at once.
Recent SEC filings
| Filed | Ticker | Form | Company |
|---|---|---|---|
| Oct 28, 2026 | RDWR | 4 | RADWARE LTD — PRIMARY DOCUMENT |
| Oct 28, 2026 | RDWR | 4 | RADWARE LTD — PRIMARY DOCUMENT |
| Oct 28, 2026 | RDWR | 4 | RADWARE LTD — PRIMARY DOCUMENT |
| Oct 28, 2026 | RDWR | 144 | RADWARE LTD |
| Oct 28, 2026 | RDWR | 144 | RADWARE LTD |
| Oct 27, 2026 | PANW | ARS | Palo Alto Networks Inc — ANNUAL REPORT TO SECURITY HOLDERS |
| Oct 27, 2026 | PANW | DEFA14A | Palo Alto Networks Inc — DEFINITIVE ADDITIONAL PROXY SOLICITING MATERIALS |
| Oct 27, 2026 | PANW | DEF 14A | Palo Alto Networks Inc — DEFINITIVE PROXY STATEMENT |
| Oct 27, 2026 | CRWD | 4 | CrowdStrike Holdings, Inc. |
| Oct 27, 2026 | ZS | SCHEDULE 13G/A | Zscaler, Inc. |
| Oct 27, 2026 | ZS | 4 | Zscaler, Inc. — FORM 4 |
| Oct 27, 2026 | SAIL | 144 | SailPoint, Inc. |
Our recent coverage
- Palo Alto Networks (PANW) CEO Arora gets $147 million upfront in stock-linked deal, with settlement due in 2029 Oct 14, 2026
- CrowdStrike (CRWD) finds Claude Code and DeepSeek use in Korean bank attacks Oct 9, 2026
- Palo Alto Networks (PANW) CFO sells $10.8 million in stock, more than seven times his previous largest sale Sep 28, 2026
- Marvell (MRVL), Microsoft, and Oracle are writing an open standard to build key security into data center servers Oct 13, 2026
- Amazon (AMZN) saw a PHP2Shell attack attempt four days before disclosure. Governments took websites offline to install the fix. Oct 22, 2026
- The Magnificent Seven are moving less in step. Their correlation fell to a 13-year low. Oct 28, 2026
- Vertiv (VRT) beats Q3 estimates and raises its 2026 outlook as orders more than double Oct 28, 2026
- Who owns Anthropic? What its IPO filing shows about the founders, Amazon, and Google Oct 27, 2026
How the group traded
Unweighted average of the 21 constituents that returned a quote in the most recent session. This is a read on how the group traded, not an index and not a tracked return series.
How this list is built
The newest layer is AI security: products meant to protect AI models and agents, and products that use AI to find attacks. Every large vendor now sells something in that category. None of the six companies whose latest earnings releases we reviewed, Palo Alto Networks, CrowdStrike, Fortinet, Zscaler, SentinelOne, and Cloudflare, reports it as a separate line, so on this page AI is a reason a company appears in the drivers and the coverage, not a grade.
A company is on this page when it sells security products to businesses or consumers and is listed in the US. We place each one in the role its own annual report describes as its core business, then grade how much of the company that role represents.
- Network security and firewalls: companies selling firewalls, as hardware or software, and the platforms built around them.
- Endpoint and security operations: companies selling sensors on devices and the tools security teams use to investigate and respond.
- Cloud access and zero trust: companies inspecting traffic in their own cloud between users and applications.
- Identity: companies selling sign-in, access management, and identity governance.
- Data and exposure: companies that find vulnerabilities or map who can reach sensitive data.
- Application delivery and DDoS: companies protecting websites and applications from attack traffic, often alongside performance products.
- Consumer: companies selling security software to households rather than enterprises.
Exposure grades
- Direct. The theme is a primary revenue driver. A change in it changes this company's year.
- Significant. Named by the company as a real driver, but a minority of revenue.
- Indirect. Benefits from the theme inside a diversified business. Do not read it as a pure play.
What is deliberately not here
- CyberArk is no longer listed. Palo Alto Networks completed its purchase on February 11, 2026, so identity exposure that used to sit in CYBR now sits inside PANW.
- VeriSign is excluded despite the name. It runs the .com and .net registries, and its revenue comes from domain names, not security products.
- Private companies and recent listings we do not yet track are left out until they are, so every name on this page links to a company page with live data.
- Diversified technology companies appear only at an Indirect grade. Security is a large business at Microsoft and Cisco, but security is a minority of revenue at both.
Prices, market caps and earnings dates come from our market data provider and refresh through the trading day. Filings come straight from SEC EDGAR. Membership and exposure grades are reviewed by us as companies change what they disclose, and changes are recorded in the page history.
Use this data
Our figures are free to reuse in articles, newsletters, and research with attribution and a link back to this page. How every number is computed: methodology. Current table as a file: download CSV.
Suggested citation: AIStockWire, “Cybersecurity stocks,” aistockwire.com/sectors/cybersecurity. Questions about the data: support@aistockwire.com.
Related: Cybersecurity stocks compared: CRWD, PANW, ZS, S, and FTNT · AI security stocks and early model access · Cybersecurity consolidation · CrowdStrike (CRWD) company page
Frequently asked questions
What are cybersecurity stocks?
Cybersecurity stocks are listed companies that sell security products, and they fall into distinct groups: firewall and network security vendors such as Palo Alto Networks and Fortinet, endpoint vendors such as CrowdStrike and SentinelOne, zero trust access companies such as Zscaler, identity companies such as Okta and SailPoint, and smaller groups for vulnerability management, DDoS protection, and consumer software. They grow, price, and report differently, so the category is only a starting point.
Which cybersecurity stocks are pure plays?
Most of the names on this page are graded Direct because security is all or most of their business, including Palo Alto Networks, Fortinet, CrowdStrike, Zscaler, SentinelOne, Check Point, Okta, SailPoint, Tenable, Qualys, Varonis, and Rapid7. Gen Digital and Akamai are also graded Direct, but each has a business outside security: MoneyLion's consumer finance products at Gen Digital, and content delivery and cloud computing, about 45% of revenue, at Akamai. Cloudflare, F5, Radware, A10 Networks, and NetScout sell security alongside performance or networking products and are graded Significant. Microsoft and Cisco are large security sellers inside much larger companies.
Do AI security products show up in revenue yet?
Not as a separate number. Every large vendor now sells products to protect AI models and agents, and several credit AI demand on their earnings calls, but none of the earnings releases we reviewed for the quarters ended June and July 2026 breaks out AI security revenue, bookings, or customer counts. The ARR figures the companies report cover their broader platforms.
Why is Palo Alto Networks' growth hard to compare?
Because it includes an acquisition. Palo Alto completed its $21.1 billion purchase of CyberArk on February 11, 2026, and its reported growth since then includes CyberArk's revenue. Palo Alto's annual report says CyberArk and Chronosphere together added $930 million of revenue in fiscal 2026, but its quarterly earnings releases give, at most, a combined figure for the two, never CyberArk's alone. Zscaler has the same issue on a smaller scale with Red Canary, which it bought on August 1, 2025, although Zscaler does disclose that Red Canary contributed $141 million of ARR, and that ARR grew 20% excluding it.
Which cybersecurity company is the most profitable?
Among the largest security-focused companies on this page, Fortinet and Gen Digital. Fortinet's GAAP operating margin was 34% in the quarter ended June 30, 2026, and Gen Digital's was 33% in the quarter ended July 3, 2026, though 37% of Gen Digital's revenue in that quarter came from its identity, reputation, and financial products, including MoneyLion. Qualys, a much smaller company, also reported a 34% GAAP operating margin in the quarter ended June 30, 2026. Palo Alto Networks earned about 5%, and CrowdStrike, Zscaler, SentinelOne, and Cloudflare reported GAAP operating losses. Several of the loss-making companies report profits on an adjusted basis that excludes stock-based compensation.
Are Cloudflare and Akamai cybersecurity stocks?
Akamai mostly is, and Cloudflare partly. Both run global networks that make websites faster and protect them from attacks. Akamai started as a content delivery network, and Cloudflare started as a security service for websites. Akamai reports security as its own revenue category, now its largest at about 55% of revenue, so it is graded Direct here. Cloudflare does not report security revenue separately, so its security share cannot be measured, and it is graded Significant.
Published for information only. Nothing here is investment advice or a recommendation to buy or sell any security, and membership of this list is not an endorsement of any company on it.