Cybersecurity
Cybersecurity software is the protection layer across endpoints, networks, identity, cloud and applications - the largest and fastest-growing horizontal software category over the past five years. The category breaks into endpoint security (EDR/XDR), identity and access management (IAM and PAM), cloud security (CNAPP/CWPP), network security and SASE/SSE, SIEM and SOC platforms, application security, fraud prevention and email/anti-phishing. CrowdStrike, Palo Alto Networks, Fortinet and Microsoft Security define the platform tier; Wiz's acquisition by Google ($32B in 2025) and Splunk's acquisition by Cisco ($28B in 2024) anchor recent strategic consolidation.
It spans endpoint security and XDR, identity and access management, cloud security, network security and SASE/SSE, SIEM and security operations, application and developer security, vulnerability and exposure management, and data security and cyber resilience.
Revenue comes from per-endpoint and per-user SaaS subscriptions paid by enterprises, multi-product platform deals offering bundled pricing across security categories, hyperscaler-bundled security inside Microsoft and AWS commitments, MSSP and managed-service revenue, and a growing tier of usage-based pricing on data security and SIEM ingestion.
Cybersecurity is part of Software.
$215B
Global market size
144
Public companies
Key VC investors
Key strategic buyers
How cybersecurity companies monetize?
Cybersecurity software companies monetize through per-endpoint SaaS, per-user identity subscriptions and platform bundles across endpoint, cloud and identity products.
Per-endpoint SaaS
Annual per-endpoint subscriptions for EDR/XDR. Standard for CrowdStrike, SentinelOne and Microsoft Defender.
Per-user / per-identity
Per-user or per-identity subscriptions for IAM, PAM and SaaS security. Used by Okta, CyberArk and SailPoint.
Platform bundles
Multi-product bundles offering meaningful discount versus per-product pricing. CrowdStrike Falcon Complete, Palo Alto Cortex and Microsoft Security E5 anchor the model.
Per-asset / per-scan
Per-asset or per-scan pricing on vulnerability and exposure management, CNAPP and TPRM. Tenable, Qualys and Rubrik use variants.
SIEM ingestion-based
Per-GB or per-event ingestion pricing on SIEM and log management. Splunk (Cisco), Elastic, Datadog and Microsoft Sentinel compete; this pricing has driven significant customer pushback in recent years.
MSSP and managed services
Managed security service revenue from monitoring, threat hunting and incident response. CrowdStrike Falcon Complete and Arctic Wolf lead the segment.
Cybersecurity valuations in May 2026
Public cybersecurity comps trade at 4.1x EV/Revenue. Median revenue multiple across cybersecurity M&A deals was 3.2x in the last 12 months. Median revenue multiple across cybersecurity VC rounds was 20x in the last 12 months.
4.1x
Median EV/Revenue as of May 2026 for public cybersecurity companies
4.4x
IBM is the highest valued public cybersecurity company based on EV/Revenue (excluding outliers)
3.2x
Median EV/Revenue across cybersecurity M&A deals in the last 12 months
20x
Median EV/Revenue across cybersecurity VC rounds in the last 12 months
Cybersecurity market segments
Cybersecurity software spans endpoint security and XDR, identity and access management, cloud security, network security and SASE, SIEM and security operations and data security.
Endpoint security & XDR
EDR, XDR, EPP and managed endpoint security. CrowdStrike leads modern endpoint; Microsoft Defender XDR bundled with E5; SentinelOne competes; Sophos, Cybereason, Bitdefender and Trend Micro serve adjacent segments.
Identity & access management (IAM/PAM)
Software managing user access, authentication and privileged access. Okta and Microsoft Entra anchor IAM; CyberArk, Delinea, BeyondTrust and One Identity (Quest) lead PAM; SailPoint serves identity governance.
Cloud security (CNAPP)
Cloud-native application protection platforms. Wiz (Google), Palo Alto Prisma Cloud, Microsoft Defender for Cloud and Lacework lead the category; Orca Security and Sysdig compete at the venture-backed tier.
Network security & SASE/SSE
Network firewalls and Secure Access Service Edge platforms. Palo Alto Networks, Fortinet, Check Point and Cisco lead the firewall tier; Zscaler, Netskope, Cato Networks and Versa lead modern SASE.
SIEM & security operations
Log management, SIEM, XDR and security analytics. Splunk (Cisco), Microsoft Sentinel, Datadog Cloud SIEM and Elastic Security lead; Devo and Sumo Logic compete in specific segments.
Application & developer security
Software securing applications and the development pipeline. Snyk, Wiz (DevOps), GitHub Advanced Security and Veracode lead; Semgrep, Checkmarx and Black Duck (Synopsys) compete.
Vulnerability & exposure management
Software finding, prioritising and remediating vulnerabilities. Tenable, Qualys and Rapid7 lead independent vendors; CrowdStrike Falcon Exposure Management and Wiz Vulnerability compete from broader platforms.
Data security & cyber resilience
Data security posture management (DSPM), DLP, data security platforms and backup/recovery for cyber resilience. Rubrik leads data security platforms (NYSE: RBRK); Cohesity, Commvault and Veeam serve cyber-resilient backup; Cyera and BigID lead DSPM.
Fractional CFO, financial modelling and deal advice for cybersecurity companies
See how Flow helps cybersecurity founders.
We speak founders' language and have great operational understanding of cybersecurity businesses.
Book an intro call - we'll look under the hood and recommend concrete next steps.
Fractional CFO
For founders who want to improve their FP&A functions, build an investor-ready financial model, and prepare for the next VC round.
Capital raising
For bootstrapped and already-VC-backed entrepreneurs who are looking to raise late stage venture or growth capital.
M&A
For category-leading technology companies who are exploring exit alternatives with either financial or strategic acquirers.
Key cybersecurity KPIs to track
ARR, ACV, endpoints protected, net revenue retention, module attach, gross margin and customer count are the metrics investors and operators track in cybersecurity software.
| KPI | Definition |
|---|---|
| ARR | Recurring SaaS revenue. The dominant headline metric across cybersecurity. |
| ACV | Enterprise platform deals (CrowdStrike Falcon Complete, Palo Alto Cortex) reach $500K-$10M+; SMB sits at $5K-$50K. |
| Endpoints / users protected | Devices, users or assets covered by the platform. The standard scale metric for endpoint and identity vendors. |
| Net revenue retention | Expansion via additional modules, asset growth and pricing actions. Healthy NRR at 115-130% for platform-led leaders. |
| Module attach | Average products per customer. Higher attach correlates with retention and is the principal value driver for CrowdStrike Falcon and Palo Alto Cortex. |
| Gross margin | Pure-software cybersecurity SaaS at 75-85%; SIEM and ingestion-heavy products lower (60-75%) due to data storage costs. |
| Customer count | Enterprise logo count. Mix between Fortune 500, mid-market and SMB materially affects revenue quality. |
Main cybersecurity players globally
The most active cybersecurity software companies and category leaders globally.
| Company | HQ | Overview |
|---|---|---|
CrowdStrike crowdstrike.com |  Austin | Cloud-native endpoint security and XDR platform (NASDAQ: CRWD). The platform-led security story; the July 2024 global outage was a major operational event but did not materially reset the long-term growth trajectory. |
Palo Alto Networks paloaltonetworks.com | Santa Clara | Largest pure-play cybersecurity vendor (NASDAQ: PANW). Three-platform strategy: Strata (network), Prisma (cloud) and Cortex (security operations). Aggressive M&A continues. |
Fortinet fortinet.com | Sunnyvale | Firewall and network security leader (NASDAQ: FTNT). FortiASIC custom silicon and broad SASE positioning underpin the franchise. |
SentinelOne sentinelone.com | Mountain View | Cloud-native endpoint security and XDR (NYSE: S). The principal challenger to CrowdStrike in next-gen endpoint. |
Okta okta.com | San Francisco | Identity and access management leader (NASDAQ: OKTA). Workforce identity and customer identity (Auth0) anchor the franchise; struggled with 2022-23 breach disclosures. |
CyberArk cyberark.com |  Petah Tikva | Privileged access management leader (NASDAQ: CYBR). Strong moat in enterprise PAM; identity security expansion. |
Wiz wiz.io | New York | Cloud-native application protection platform. Acquired by Google in March 2025 for $32B - the largest pure-cyber acquisition on record. |
Zscaler zscaler.com | San Jose | Cloud-native SASE/SSE platform (NASDAQ: ZS). Strong zero-trust positioning; mid-cycle in expanding from web security into broader SASE. |
Splunk (Cisco) splunk.com | San Francisco | Largest SIEM and log analytics platform. Acquired by Cisco in March 2024 for $28B; integrating into Cisco's security and observability portfolio. |
Rubrik rubrik.com | Palo Alto | Data security and cyber resilience (NYSE: RBRK). IPO'd in April 2024; positioned as data security platform leader. |
CFO-as-a-service without the overhead
Fractional CFO services priced for startups - senior operator, no permanent headcount.
Key cybersecurity market trends
Platform consolidation, identity at the centre and AI in security operations are reshaping cybersecurity software right now.
Platform consolidation
CrowdStrike, Palo Alto Networks and SentinelOne consolidating capabilities across endpoint, cloud, identity and SIEM into platform bundles. Standalone-product vendors increasingly challenged in tier-1 deals.
Identity at the centre
Okta, CyberArk and Microsoft Entra anchored identity as the new security perimeter. Identity-driven breaches (SolarWinds, Okta and Microsoft mid-2024) have driven structural identity-security spend.
SASE/SSE convergence
Cato Networks, Netskope, Zscaler and Palo Alto Prisma competing for the SASE/SSE category. The combination of SD-WAN, ZTNA, CASB, SWG and FWaaS is the principal network-security architecture shift.
CNAPP and cloud-native security
Wiz (Google), Orca Security and Sysdig leading CNAPP; Palo Alto Prisma Cloud and Microsoft Defender for Cloud bundling. The category has consolidated rapidly through M&A and platform bundling.
CrowdStrike outage and consolidation reckoning
The 19 July 2024 global outage (affecting roughly 8.5M Windows devices) renewed scrutiny on platform concentration and update governance. Did not materially reset CrowdStrike's competitive position long-term but accelerated diligence on vendor concentration risk.
AI in security operations
LLM-powered SOC copilots, autonomous detection and response and AI-driven threat hunting. CrowdStrike Charlotte AI, Palo Alto Cortex XSIAM and Microsoft Security Copilot lead; standalone challengers (Dropzone AI and Prophet Security) attacking the agent productivity layer.
Similar verticals to cybersecurity
Explore niches like automotive software, education software, energy & utilities software and financial services software.
Explore other sectors
We know tech inside & out.
We live and breath tech - true understanding of how startups operate is fundamental at what we do.
Recent insights across cybersecurity and beyond
Talk to us
Schedule a call to get a health check on your business and see how we could help.
Fractional CFO
- Fractional CFO for Software
- Fractional CFO for AI & ML
- Fractional CFO for Fintech
- Fractional CFO for Consumer internet
- Fractional CFO for Digital media
- Fractional CFO for E-commerce & marketplaces
- Fractional CFO for Consumer products
- Fractional CFO for Mobility
- Fractional CFO for Digital health
- Fractional CFO for Industrial technology
- Fractional CFO for Digital infrastructure
- Fractional CFO for IT services
Stages
Countries
- UK Fractional CFO
- Ireland Fractional CFO
- France Fractional CFO
- Germany Fractional CFO
- Spain Fractional CFO
- Portugal Fractional CFO
- Italy Fractional CFO
- Netherlands Fractional CFO
- Belgium Fractional CFO
- Switzerland Fractional CFO
- Austria Fractional CFO
- Denmark Fractional CFO
- Sweden Fractional CFO
- Norway Fractional CFO
- Finland Fractional CFO
- Poland Fractional CFO
- Estonia Fractional CFO
- US Fractional CFO
- Canada Fractional CFO
- Mexico Fractional CFO
- Brazil Fractional CFO
- UAE Fractional CFO
- Australia Fractional CFO
Cities
- London Fractional CFO
- Dublin Fractional CFO
- Paris Fractional CFO
- Berlin Fractional CFO
- Madrid Fractional CFO
- Lisbon Fractional CFO
- Milan Fractional CFO
- Amsterdam Fractional CFO
- Brussels Fractional CFO
- Zurich Fractional CFO
- Vienna Fractional CFO
- Copenhagen Fractional CFO
- Stockholm Fractional CFO
- Oslo Fractional CFO
- Helsinki Fractional CFO
- Warsaw Fractional CFO
- Tallinn Fractional CFO
- New York Fractional CFO
- Toronto Fractional CFO
- Mexico City Fractional CFO
- São Paulo Fractional CFO
- Dubai Fractional CFO
- Sydney Fractional CFO