Cybercrime Buoys Security Software in Bear Market

Companies that make security software have turned out to be a relative bright spot in this year’s stock market meltdown, favored by both traders and firms looking to make acquisitions.

The critical nature of security -- especially given high-profile hacks -- means companies and governments are unlikely to skimp on spending for it, even as the threat of a recession weighs on technology budgets. And the long-term need for protection has made takeover targets of companies including Mandiant Inc. and KnowBe4 Inc.

“Within enterprise budgets, security is the last area businesses will cut, so growth should continue even if we see a recession,” said Ivana Delevska, chief investment officer at Spear Invest. “This constant underpinning of demand makes security a very attractive space, which is why people are getting in even though there’s so much uncertainty everywhere else.” 

Palo Alto Networks Inc., CyberArk Software Ltd., and Check Point Software Technologies Ltd. are among notable outperformers in the sector this year. An index of cybersecurity stocks is down 22% in 2022 including dividends, a narrower drop than the 33% slump in a broader software index. The Nasdaq 100 Index is down 31%.

The cybersecurity index fell 1% on Wednesday. The Nasdaq 100 Index was down 0.1%.

Morgan Stanley’s quarterly survey of corporate technology executives underlines the group’s resiliency. Near-term demand for software is waning, even as it is expected to remain the fastest-growing sector for enterprise spending, the survey shows. However, the executives said security was a top priority, as well as among the most defensive areas for enterprises.

“Security demand remains strong and budgets continue to grow much faster than overall IT,” wrote analyst Hamza Fodderwala, who said customer and channel checks point to durable demand trends over the remainder of 2022. He sees Palo Alto Networks and Crowdstrike Holdings Inc. as the most likely beneficiaries.

Stocks in the group are cheaper than software overall. The security index trades at 26 times estimated earnings and 1.3 times sales. For the broader software index, the multiples are 28 and 5.7, respectively.

Software has also emerged as a favorite place for M&A activity this year, with security’s lower valuations making it especially attractive.

Among notable deals, Alphabet Inc. recently closed its $5.4 billion purchase of Mandiant and Vista Equity Partners agreed to buy KnowBe4 for about $4.6 billion on an equity value basis. Private equity firm Thoma Bravo announced three multi-billion-dollar security acquisitions in the past six months: ForgeRock, Ping Identity, and SailPoint Technologies.

“It’s tough to call an end to this trend, because the cheaper valuations will continue to make these companies attractive to buyers,” said Ryan Issakainen, senior vice president of First Trust Portfolios.

“What’s different about security compared with the rest of software is that the business model is still really strong. While we’re expecting a slowdown in economic growth, cyber criminals operate in a growth industry that’s not tied to the cycle.”