This Monday, we heard experiences of a wide-scale cyber assault that focused twelve or extra of America’s main airports. This comes only a month after Uber and Take-Two Interactive reported main breaches and Twitter’s former Head of Safety testified in entrance of Congress on the social media website’s lax safety infrastructure. If it appears like all you’re listening to about within the information is the specter of cyber assaults, it’s since you are.

What you gained’t hear on the information is the true actuality and scale of the cyber assault trade, as a result of the common assault isn’t a wide-scale breach of a public firm or a headline-grabbing menace to main infrastructure. The common assault is likely to be a fast in-and-out job in your native insurance coverage workplace or faculty and even dentist. These kind of assaults aren’t attractive, however they’re environment friendly, and hackers are taking dwelling billions. 

With the proliferation of high-end safety software program, one would assume that this is able to negate the menace considerably. Sadly, that is removed from the reality. Companies are extra uncovered than ever: 41% of executives don’t assume their safety initiatives have saved up with digital transformation; solely 50% of SMBs have a cybersecurity plan in place; solely 43% of corporations really feel financially ready to face a cyber assault in 2022. 

That is all set within the background of a heightened-threat surroundings, with extra superior and well-funded hackers now on the forefront of clandestine know-how. Optimistic Applied sciences experiences that cybercriminals can now penetrate 93percentof firm networks, whereas the variety of weekly assaults in 2021 grew 50% year-over-year. 

The demand for cybersecurity merchandise is apparent and well-represented within the inventory market, but I nonetheless imagine the size of adoption continues to be in its infancy. For that purpose, right this moment we’re having a look at one of many stalwarts of the trade: Palo Alto Networks. 

The corporate describes itself as ‘The Zero Belief Community Safety Platform that secures a world the place any person can work anyplace—with out restrictions. Doesn’t sound just like the worst line of enterprise to be in proper now, does it? 

It is without doubt one of the market leaders in community safety, which calls for about 20-25% of safety budgets. Its community safety structure is constructed from software program and {hardware} firewalls. This thrilling new structure known as SASE, or safe entry service edge, which has been a rising pattern within the trade and is seen as a approach of delivering zero-trust networks for cloud-based applied sciences. A SASE structure identifies customers and units, applies policy-based safety, and delivers safe entry to the suitable utility or information. This strategy permits organizations to use safe entry irrespective of the place their customers, purposes, or units are positioned. 

It’s rising quick. The variety of clients who spent over $1 million on SASE in 2019 was 27; by the tip of 2022, this determine had grown to 210. The truth is, SASE clients grew 51% in its fiscal 2022, which ended on July 31, 2022, to over 3,500. 

However that’s not all Palo Alto does, it’s additionally a market chief in cloud safety. Its Prisma platform secures all processes that run on the cloud, whereas Cortex, the newest of Palo Alto’s platforms, is geared towards safety operations and consists of endpoint safety and automatic safety responses. This final one is a comparatively latest improvement and appears to be encroaching on CrowdStrike’s territory in endpoint safety, however because it stands it contributes a a lot smaller piece of general income. 

Money is King

Numbers-wise, we’re in actually good condition. The corporate is rising income at 29% year-over-year, taking in $5.5 billion in its fiscal 2022. It simply turned a web revenue on a GAAP foundation, which isn’t a lot to shout about for a $47 billion firm till you notice that it paid out $1 billion in stock-based compensation this 12 months. It has additionally promised to develop margins, ship 25% income progress, and obtain GAAP profitability for its fiscal 2023.

What’s actually attractive about this enterprise, although, is the amount of money it generates. On an adjusted foundation, it had a 31% free-cash-flow margin final 12 months, which is available in at about $1.7 billion. For 2023, that is anticipated to broaden to 34%, which might imply free money circulation of about $2.4 billion. 

That’s a piggy financial institution Scrooge McDuck can be happy with, however what’s administration doing with all of its money? 

We’ve seen numerous strategic acquisitions over the previous few years, through which Palo Alto is bolting on performance by shopping for up smaller rivals. This does two issues: it supplies a chance to upsell current clients with a broader product providing, and it additionally negates the chance of disruption from extra nimble, one-product specialists. The cybersecurity area is a really consolidative trade. This bodes effectively for a big firm like Palo Alto with boatloads of money circulation and permits it to proceed to exert its dominance. 

Land and Broaden

Just like CrowdStrike, which operates in a separate space of safety, Palo Alto advantages from the rising demand from Chief Data Safety Officers (CISO) to consolidate their operations. Vendor fatigue is a really actual subject inside the trade and having to supply coaching and employees for numerous totally different methods has change into inefficient. It’s estimated that enormous enterprises preserve between 60 and 80 separate safety options. In bundling community safety, cloud safety, and safety operations, Palo Alto can distinguish itself from the pack. The great thing about bundling additionally enormously reduces buyer acquisition prices, as it will possibly nab a buyer with one product (land) after which upsell them on different choices at little further price (broaden). 

This additionally insulates itself from the specter of one-product rivals. Just like how Groups eclipsed Slack, clients are more likely to tack on yet another product than need to arrange a brand new vendor on their system. 

The CEO Nikesh Arora could be very fashionable, with a 93% approval ranking on Glassdoor. He has overseen a lot of the corporate’s acquisition technique in his time on the helm since 2018. Curiously, he was really the president of Softbank from 2014 to 2016. 

Dangers to investing in Palo Alto Networks

Rivals-wise, the community safety area is populated with extra old-school gamers like Checkpoint Software program and Cisco. There may be additionally the not too long ago launched personal entity of Trellix, made up of a merger between McAfee and Hearth Eye. Palo Alto’s next-generation firewalls have been unseating these trade incumbents for the final 15 years, and it reveals no indicators of slowing down.

Curiously, a latest interview with CrowdStrike CEO George Kurtz noticed him double down on the corporate’s lack of curiosity in coming into the community safety market. Whereas each corporations’ platform strategy means they’re increasing capabilities a lot that there’s sure to be a crossover — as evidenced by Palo Alto’s safety operations platform — for probably the most half, we are going to doubtless see their core competencies stay separate. 

By way of the broader macro surroundings, perhaps it’s not the perfect time to be pitching a inventory with a excessive worth/gross sales ratio that has simply turned a revenue for the primary time in 4 years, however I might push again on {that a} bit. In a latest Inventory of the Month article, I spoke about how cybersecurity goes to fare so much higher than the remainder of tech in an financial downturn, and whereas barely worthwhile on a GAAP foundation, the corporate is definitely extremely worthwhile for those who negate the non-cash expense of stock-based compensation. 

I don’t love the stock-based compensation being that top, however I see it as a mandatory evil. Expertise is at a premium within the trade proper now because of a scarcity of staff, if that is what it has to do to draw and retain the correct employees, so be it. It does dilute shareholder worth however the firm additionally has a buyback plan for the subsequent 12 months that negates this considerably.

All in all, Palo Alto Networks has all the correct property to change into a long-term compounder over the subsequent decade. I’m a giant believer that cybersecurity will likely be a uncommon brilliant spot all through this financial downturn, and its enviable place on the head of the community safety market will make sure that it will likely be one of many winners.