A Few Cybersecurity Stocks Soared in 2022, But Most Stumbled

The four-headed monster of rising inflation, interest rate hikes, supply chain shortages and the ongoing Russia-Ukraine war took its toll on security vendors, and there was a median stock price drop of 40% among the 32 publicly traded firms that derive much of their revenue from cybersecurity. That’s far steeper than the 20%, 13% and 9% drops recorded by the S&P, Nasdaq and Dow Jones, respectively.

Established companies with a long track record on the public markets, a broad technology portfolio and a clear path to profitability fared the best as investors embraced more conservative stock bets in 2022. Conversely, the IPO darlings of recent years with best of breed capabilities in a specific technology area and high double-digit or triple-digit growth saw their fortunes shift as profitability took center stage.

Below is a look at how each of the publicly traded cybersecurity vendors fared in 2022 with a deep dive into some of the more interesting case studies (see: Stock Sell-Off: Cloudflare, Rapid7, SentinelOne Hardest-Hit).

Two in the Black

The most profitable company in cybersecurity was the most heavily rewarded by Wall Street in 2022. Check Point was the only security vendor to boost its stock price without being sold to a private equity firm thanks to a whopping $527 million of net income through September. Check Point expects to see its best sales growth in many years, fueled by a double-digit boost in product and in security subscriptions (see: Check Point CEO Gil Shwed on Why Prevention Beats Detection).

Investors breathed a sigh of relief when Vista Equity Partners agreed to buy KnowBe4 for $4.6 billion in October just 18 months after the security awareness training vendor went public. Even though KnowBe4 recorded $11.2 million of profit through September and expects to grow sales by 35% in 2022, the firm’s stock price had fallen by more than 25% last year before Vista revealed its interest in buying KnowBe4.

Avoiding a Heavy Blow

ForgeRock fared better than most of its peers thanks to Thoma Bravo agreeing to buy the identity player for $2.3 billion in October. ForgeRock’s stock had fallen nearly 43% in 2022 prior to Thoma Bravo’s offer due to longer sales cycles forcing the company to lower its revenue projections. The Justice Department is probing the Thoma Bravo-ForgeRock deal due to Thoma’s earlier buys of SailPoint and Ping Identity.

Trend Micro’s breadth and scale has allowed the firm to deliver profitable growth despite the economic headwinds. Sales surged by 16.5% and net income jumped to $217.6 million through September. Trend Micro is one of only two companies to be recognized by Gartner as a leader in both EDR and XDR, and the firm plans to pursue more opportunities in the U.S. government and critical infrastructure markets.

Gen Digital was formed from the $8.6 billion merger of consumer cyber protection behemoths NortonLifeLock and Avast, and it offers expertise across security, privacy and identity. The $3.5 billion firm has 500 million total users and plans to pursue $280 million of cost synergies, half of which will come via adopting shared best practices, cutting duplicate roles and getting down to less than 4,000 workers.

Palo Alto Networks wasn’t able to swim against the economic current despite being the world’s largest and most valuable pure-play cybersecurity vendor. The company made waves in May with its pledge to achieve GAAP profitability in the near future and in November with its $250 million buy of application security startup Cider Security, but investors remain wary of CFO scrutiny and prolonged sales cycles.

Akamai’s security business grew by 18% through September thanks to an aggressive approach to M&A, which included buying microsegmentation firm Guardicore for $600 million and IoT security firm Inverse for $17.1 million. The intelligent edge platform provider has been subject to a number of deal rumors. StreetInsider reported in October that it had held talks with a private equity firm about a takeover.

Fortinet’s consistent delivery of profitable growth was rewarded handsomely by Wall Street in 2020 and 2021, and investors sent the company’s stock up 28% and 119%, respectively, during that time. But when Fortinet in November 2022 delivered a revenue and billings forecast that fell short of investor expectations, Wall Street reacted swiftly, sending the security vendor’s stock down 14% the next day (see: Ken Xie on Why Fortinet Is Leaning Into SD-WAN, OT Security).

Middle of the Pack

Investors were crushed by Darktrace’s decision to halt acquisition talks with Thoma Bravo after the two sides failed to agree on terms and the firm’s stock went down 36% in response. Darktrace went public in April 2021 at a $2.05 billion valuation but failed to gain much traction with investors despite turning a profit for the first time in history and increasing sales by nearly 46% in the fiscal year ended June 30.

CrowdStrike slashed its sales forecast in late November due to a longer buying cycle for small businesses and delayed subscription start dates for large enterprises, which caused the company’s stock to tumble. The company found deals with SMB clients took 11% longer to close in the quarter ended Oct. 31, and expects net new ARR to drop by 10% through the first half of 2023 due to more scrutiny around budgets.

The only cybersecurity company to go public in 2022 faces an uphill battle as investors shift their money to safer havens in more established companies. External threat intelligence vendor ZeroFox entered the Nasdaq Stock Exchange in August by merging with a publicly traded SPAC at a $1.4 billion valuation. But recent months haven’t been kind to the company, and ZeroFox’s profitability fell far below expectations (see: James Foster on Taking ZeroFox Public in Hard Economic Times).

Falling the Farthest

Zscaler was one of the hottest stocks in cybersecurity during 2020 and 2021. Investors sent the company’s stock up 264% and 42%, respectively, during that timeframe. But analysts cut their ratings on Zscaler over the summer amid fears of a longer sales cycle and decelerating growth. Delays have been fueled by clients buying the company’s SWG, private access and digital experience products as a bundle.

Okta’s stock nose-dived in late summer after the company admitted it had struggled to integrate its salesforce with that of customer identity giant Auth0, resulting in increased employee attrition and confusion around the joint product portfolio. The vendor’s stock recovered slightly after efforts to reposition its customer identity offering bore fruit, and sales reps increased the number of deals closed around the Auth0 tool.

SentinelOne was the apple of Wall Street’s eye in 2021 when investors sought growth at all costs. The company notched the largest cybersecurity IPO of all time thanks to sales growth above 100% even though SentinelOne’s net loss exceeded its annual revenue. But as investors prioritized profitability in 2022, the firm turned to cost management and unlocked operational and execution efficiencies.

IronNet experienced a dramatic fall from grace in 2022, months after the company, led by Gen. Keith Alexander, went public at a $1.2 billion valuation. IronNet laid off half its workers in June and September, sent co-CEO William Welch packing and is probing allegations that company executives misled investors over growth projections. IronNet on Dec. 16 said it lacked the funds to pay its bills through the month.