In an increasingly dangerous digital world, cybersecurity firms are more indispensable than ever.
Amid a growing number of cybersecurity threats, the shift to cloud storage, and the artificial intelligence boom, we expect the cybersecurity industry to outgrow overall IT spending and match software industry growth.
In particular, we believe firms offering solutions in newer areas of cybersecurity will spearhead growth for the coming years.
Over the next five years, we believe the security market is going to see marked growth in areas such as identity, infrastructure, application, and data. While traditional bastions of security spending such as network, services, and consumer are also slated for growth, we believe even within these end markets, the drivers of growth will be cloud-native security solutions.
Here, we outline our expectations for the cybersecurity industry and the companies that are best positioned to succeed amid this environment.
3 Key Themes for the Cybersecurity Industry
Our outlook for the cybersecurity industry is centered on three key industry themes:
- Cybersecurity is a structurally advanced industry. We project cybersecurity spending to increase at a 12% compound annual growth rate over the next five years, which is faster than the expected overall IT spending growth of 9% and in line with our overall software industry expectations. We see three key structural tailwinds benefiting cybersecurity: increased cloud adoption leading to more security needs; an increase in the number, sophistication, and costs of attacks; and increased federal spending and regulations focused on security.
- The largest security firms will grow the most. We expect cybersecurity clients to consolidate their spending toward platform vendors that offer a wide array of cybersecurity solutions. We believe toolkit burden, as customers need to manage a host of different solutions, will drive this change. The largest companies are also more able to develop new tools or pursue bolt-on mergers and acquisitions to fill product gaps, further encouraging consolidation. We expect that the largest firms will take share and outgrow the overall industry.
- AI increases the threat potential and ability to innovate. Artificial intelligence opens up another potent threat vector for hackers. The AI security market is small right now, but we expect rapid growth as the use of AI applications proliferates. AI will also allow security firms to innovate and create new solutions, driving additional revenue growth. We size the AI security opportunity at $15 billion to $18 billion by 2028, increasing the estimated market size by over 5%. We also see AI enabling internal efficiency gains, supporting margin improvements.
Outlook: Growth of the Cybersecurity Industry
As firms secure their businesses against nefarious activity in a cloud-first world, we believe that newer, more nascent areas such as cloud, endpoint, and data are all projected to grow meaningfully. Meanwhile, traditional security end markets such as security services, consumer, and network are projected to expand at a slower pace.
As the broader cybersecurity market grows, we expect the companies under our coverage to drive operating leverage throughout their businesses and expand profitability. This ability to tone down sales and research spending as a percentage of revenue is particularly evident in moaty cybersecurity companies that enjoy higher customer switching costs and thus are able to decelerate some operating expenses without risking customer churn. For our no-moat cohort, we expect adjusted margins to remain roughly flat over the next five years.
That said, we don’t believe that industry growth will be distributed equally. Cybersecurity is an incredibly fragmented market. While there are both macro and industry-specific reasons for the level of fragmentation in the space, we don’t see this as a permanent state. We hold the view that buyers are increasingly interested in consolidating their security spending on a smaller group of security vendors. We expect enterprises will buy a larger number of tools from fewer vendors, thereby making platform vendors the long-term winners. We expect this trend will be long term in nature, playing out over the next decade-plus.
We also believe that AI will be a new demand driver for the industry. AI will cause an increase in the number and sophistication of cyberattacks as attacks become more automated, personalized, and scalable. As the attack frequency and intensity increase, so will demand for cybersecurity solutions. AI-driven attacks will also likely cause new types of attacks and strategies, which will demand innovation within cybersecurity.
Our Top Picks for Investing in the Cybersecurity Space
Morningstar covers 14 cybersecurity companies with market capitalizations ranging from $2 billion to nearly $115 billion. Because of the fast-paced nature of the industry and the constant threat of disruption, Morningstar Uncertainty ratings are typically High or Very High for cybersecurity firms.
Only two companies under our coverage merit a wide moat, largely because of their more complete platforms of security solutions that insulate their businesses from future disruption. They are:
Palo Alto Networks
- Morningstar Rating: 3 stars
- Moat Rating: Wide
- Fair Value Estimate: $210
- Price/Fair Value Estimate (as of Feb. 25, 2025): 0.91
We believe that Palo Alto Networks stands to materially benefit from secular tailwinds across its three key end markets as cloud migrations, shifts to zero-trust security, and expanded automation in cybersecurity increase the firm’s proposition to its clients.
We are encouraged by Palo Alto’s ability to sell more of its solutions to its customers. The firm’s success in cross-selling existing/new customers its three security platforms spanning network, cloud, and security operations is evidence of vendor consolidation—a trend that we see as likely to continue. As Palo Alto up/cross-sells its customers more solutions, we also see the entrenchment in its clients’ ecosystems increasing, driving retention rates and customer lifetime values higher.
Fortinet
- Morningstar Rating: 3 stars
- Moat Rating: Wide
- Fair Value Estimate: $108
- Price/Fair Value Estimate (as of Feb. 25, 2025): 1.01
In our view, the firm’s established customer switching costs, buttressed by its increasingly potent network effect, will allow Fortinet to continuously gain and expand its number of clients and has already enabled it to build a wide economic moat around its business.
While Fortinet’s build-versus-buy mentality has allowed it to expand its footprint in network security, we expect the firm to engage in inorganic methods to bolster its offerings in high-growth verticals such as security operations. In the long run, we expect these verticals to be key portions of an enterprise’s security spending, which Fortinet can tap into.
This article was compiled by Emelia Fredlick.
The author or authors do not own shares in any securities mentioned in this article. Find out about Morningstar's editorial policies.
