If you looked at venture capital investment trends in the cybersecurity market, you’d be excused for thinking that the sector was struggling.
Crunchbase data indicates that cybersecurity startups raised $1.9 billion in the third quarter, across 153 deals. The amount was better than the $1.7 billion startups in the sector raised in Q2 2023, but deal count declined from 181 deals.
The Exchange explores startups, markets and money.
Read it every morning on TechCrunch+ or get The Exchange newsletter every Saturday.
But Crunchbase goes on to note that with third-quarter cybersecurity venture funding down 30% compared to the year-ago period, investment in the category could fall to its lowest level since 2019. Other sources are also tracking a decline in cyber venture investment this year.
That’s not a huge surprise since venture capital investment has largely been in retreat in 2023 compared to the past several years, but given public cybersecurity companies’ performance these days, we’re a little bit puzzled at just how tepid venture investment in this space is.
It makes sense that fintech as a sector is suffering, since those companies’ growth rates have come down, and the startups that benefited from pandemic-driven tailwinds have since seen their valuations slashed.
PayPal’s revenue, for example, rose 8% in the third quarter, and the company’s price/sales multiple has collapsed in recent years (price/sales is the grown-up version of a startup revenue multiple). Observe:
Startups building fintech products will struggle to earn a double-digit revenue multiple when they go public. Less venture capital activity makes sense here, because you simply don’t get as much future market cap for each dollar of revenue that fintech startups generate.
Observe a similar chart, but featuring cybersecurity companies:
Here, we see a similar compression of price-sales multiples, but the ending ratios are different. Apart from Okta, whose shares are currently being hammered due to a security breach, leading cybersecurity companies are trading at double-digit multiples today. That’s far more attractive than what fintech can manage.
Hence our confusion: If cybersecurity companies are worth so much more per dollar of revenue, why aren’t venture investors rushing to invest in the sector? After all, so far this year, Palo Alto Networks’ share price has almost doubled, Zscaler is enjoying a 76% gain this year, and CrowdStrike is up about 106%. That’s one hell of a recovery.
To see if we are missing something critical, The Exchange dug into Zscaler’s and CrowdStrike’s quarterly results this week, and compared what we found with Microsoft and Palo Alto Networks’ results.
TL;DR: Cybersecurity looks hot as heck, and companies in the space are growing like weeds compared to other parts of tech.
Here’s what we’re seeing:
- Microsoft: It’s hard to dig too deeply into Microsoft earnings data given the scale of the company’s aggregate performance. But Microsoft did say that it is seeing “high demand for Security Copilot, the industry’s first and most advanced generative AI product,” and that its security information and event management (SIEM) service, Microsoft Sentinel, recently reached an annual run-rate revenue of $1 billion.
- Palo Alto Networks: The company’s stock took a hit in the wake of its Q3 results, but recovered quickly. It seems that despite beating expectations for revenue in the quarter, Palo Alto’s forward billings guidance worried some investors about its future growth. The company’s CEO later clarified that a sales process change tweaked its forward billings number. After posting Q1 2024 revenue growth of 20%, the company projected 18% to 19% growth for its full fiscal year.
- Zscaler: Like Palo Alto Networks, Zscaler saw its share price dip after it reported results, only to recover in following sessions. Zscaler reported revenue of $497 million, 40% better than a year earlier, helped by dollar-based net retention of 120%. The company even reported a Rule of 40 score of 85, using free cash flow for the profit portion of that metric. It also increased its full-year forecast and said it expects Q2 2024 revenue to land between $472 million and $474 million.
- CrowdStrike:Revenue at CrowdStrike increased 35% to $786 million year-on-year, while ARR rose 35% to $3.15 billion from a year earlier. The company said it recorded net-new ARR of $223 million, which is pretty good. It also touted “96% year-over-year growth in operating income and record operating margin; record net income, which more than doubled year over year; record GAAP profitability for the third consecutive quarter; and record free cash flow.” Again, that’s pretty darn good.
Lots of revenue growth across the board? Yep. Solid earnings multiples compared to other tech sectors? Check. And yet, cybersecurity venture capital investment remains lackluster.
Perhaps venture capital investment rates lag market performance more than we thought? Or has late-stage investing declined so much that no technology subsector can really post impressive investment numbers? I’m not sure, but I would wager that next year, we’ll see cybersecurity venture investment post a solid recovery.