5 Undervalued Cybersecurity Stocks

Heightened geopolitical tensions, high-profile ransomware attacks, and the growth of working from home have all reinforced the need for a multifaceted approach to cybersecurity protection. For long-term investors, the bear market is providing opportunities to pick up some of these names at their most attractive valuations in years.

Cybersecurity Stocks at Sizable Discounts

Early in 2022, many of the more established cybersecurity stocks not only held up in face of the broad market downdraft but also outperformed following the Russian invasion of Ukraine. However, more recently we have seen the cybersecurity stocks get pulled down with the rest of the technology sector. Of the five cybersecurity companies we cover, each is now trading at a significant margin of safety from our intrinsic valuation and is rated with either a Morningstar Rating of 4 or 5 stars.

Considering how well these stocks had held up prior to the recent selloff into bear-market territory, we think many portfolio managers had switched to selling what they could as opposed to what they wanted to. In our view, this has provided investors with an opportunity to invest in a high-growth industry whose clients will be unwilling to cut back on their services even in periods of economic uncertainty and/or high inflation.

We also think that several of the less-established cybersecurity companies that have sold off this year because of idiosyncratic issues are now trading at some of the lowest valuations across our entire equity coverage list. For example, Okta OKTA and Zscaler ZS are both down well over 50% for the year to date; however, we think the market is being overly pessimistic on the long-term prospects for both companies.

The cybersecurity industry has long experienced a high number of small, tuck-in acquisitions as larger companies looked to add new technology and products. However, it has also recently seen a large acquisition as Mandiant agreed to be bought out by Alphabet GOOGL in March. We would not be surprised to see additional larger acquisitions occur, especially if valuations were to fall to lower levels from here.

Cybersecurity Industry at a Glance

We estimate that cybersecurity is a $150 billion industry and forecast that it will grow at a 12% compound annual growth rate over the next five years. Spending on cybersecurity can easily double over this time frame as cybercrime is a high-severity issue in which the cost of protecting against it is only a small percentage of the cost of incurring it.

For example, ransomware attacks have been accelerating at an alarming rate and have become a driving force for companies to ramp up spending on cybersecurity. Cybersecurity Ventures estimates that there were $20 billion of ransomware damages in 2021 and those damages could grow to $265 billion in 2031. It is estimated that a ransomware attack occurs every 11 seconds, and that frequency is expected to increase to an attack every two seconds by 2031.

Cybersecurity: Rapidly Evolving, but 3 Durable Trends

Cybersecurity covers the full range of IT activities from identity verification and access to endpoint data distribution from both public and private networks across the entire internet. Cybersecurity is a rapidly evolving industry that must quickly adapt to the changing nature of networks and information technology. For example, the rapid adoption of widespread remote work exposed security gaps for organizations; these gaps had to be quickly closed. Attackers are constantly evolving and developing new ways to penetrate networks and systems, and companies need to stay in the forefront of security technology to thwart these attacks.

Within this rapidly evolving field, we have concentrated on three durable trends:

• Security platforms need to reduce security complexity and lower tool count.
• The hybrid of private networks and public cloud requires security products that support both legacy needs and new technology.
• The rapid increase in alerts and attacks requiring remediation will require an increasing amount of automation.

Economic Moats in Cybersecurity:

We find that across our coverage, most cybersecurity companies have already built an economic moat. In this sector, we see that long-term, durable competitive advantages have largely been built upon customer switching costs and the network effect.

Switching costs are the costs felt by a user when moving to another supplier. As cybersecurity becomes an increasingly essential part of operations and embedded in networks, we find that it becomes harder for companies to easily and efficiently change vendors.

The network effect occurs when the value of a company’s service increases for both new and existing users as more people use the service. Cybersecurity solutions become more effective as more organizations adopt their products, which then draws in more customers.

We give Fortinet FTNT and Palo Alto PANW Morningstar Economic Moat Ratings of wide and CrowdStrike CRWD, Okta OKTA, and Zscaler ZS narrow ratings.

Company Takeaways

CrowdStrike CRWD Morningstar Rating: 4 Stars

CrowdStrike provides endpoint detection and response, which constantly updates security software measures via crowdsourcing. In addition, CrowdStrike also has a leading incident response and remediation service that in turn leads to new client sales of products and services. With a dearth of cybersecurity talent available in the marketplace, organizations are finding CrowdStrike’s managed services to be a solution to stay ahead of threats. We forecast that revenue will grow by over 30% per year over the next few years, much faster than the overall industry.

Fortinet FTNT Morningstar Rating: 4 Stars

In our view, Fortinet’s high performance-to-price security offerings place the company in a position to remain a top network security vendor and gain market share. As such, Fortinet has a massive install base and is in the process of moving upstream to large enterprise and government accounts. Further, we think Fortinet is at the forefront of the convergence between security and networking technologies. Lastly, Fortinet has balanced its strong revenue growth and margins with a clean balance sheet.

Okta OKTA Morningstar Rating: 5 Stars

Okta is the most undervalued cybersecurity stock, and in fact, even after recently lowering our fair value to $193 to account for a more conservative stance on our long-term profitability assumptions, the stock remains one of more undervalued stocks across our coverage. The company is a leader in identity and access management. Once new clients are brought in using its identity products, the company is then able to cross-sell its other products to gain additional share of its client’s cybersecurity spending wallet.

However, Okta’s stock has been under enormous pressure over the past year. There are two main catalysts for the negative valuation. First, Okta experienced a customer breech in January 2022 and will need time to regain customer and market trust. Second, Okta ramped up capital-expenditure spending, which has pressured free cash flow, which, in today’s market environment, has been a significant negative in investors’ minds.

Palo Alto Networks PANW Morningstar Rating: 4 Stars

Palo Alto provides a platform-based approach for network security, cloud security, and security operations that allows clients to consolidate many of their needs to one provider. In our view, it is strongly positioned to be a leader in the burgeoning extended detection and response market, which requires a massive install base and ability to detect/resolve anomalies with premier threat intelligence. In addition, we think Palo Alto’s automation services & cloud security products are well positioned as these services are still in the earlier stages of adoption. After several highly acquisitive years, we now think the company is entering the expand part of a “land & expand” strategy, which in turn should drive higher margin growth.

Zscaler ZS Morningstar Rating: 4 Stars

Zscaler’s stock surged during the pandemic; as its products provide a secure gateway for VPNs and cloud workload security, the company benefited from the rapid growth in the work-from-home environment. We rated Zscaler with only 1 star as recently as last September, but now we think the stock has dropped too far to the downside, and our rating has moved to 4 stars. Zscaler’s cybersecurity solutions are sold through service providers, but the company has been moving to smaller enterprise customers by ramping up its salesforce—we think this provides a longer runway for high growth. In our projections, we forecast top-line growth of 40%-plus over the next few years.