What happened
Investor sentiment turned sour on cybersecurity stocks in April as Cloudflare (NET +1.01%) dropped 23.7%, Zscaler (ZS +1.90%) fell 22.9%, Okta (OKTA 0.08%) tumbled 20.5%, and CrowdStrike (CRWD +0.68%) lost 12.5%, according to S&P Global Market Intelligence. Growing recession concerns weighed on growth stocks in general, and cybersecurity stocks took some damage following discouraging forward-looking commentary from multiple industry leaders.
So what
Cybersecurity investors were already jittery coming into April after Zscaler's quarterly-earnings report in March. Despite beating Wall Street's expectations, the stock dropped significantly due to a weak outlook for sales and earnings. When fear lingers around growth stocks, it doesn't take much to send them tumbling.
CrowdStrike kicked off April with its analyst day in which company management discussed new product developments, strategic initiatives, and its outlook for the next few years. Wall Street left that presentation unimpressed with the endpoint-security leader's growth and profitability forecasts over the next three years. All four of these cybersecurity stocks dropped after CrowdStrike's analyst day, even though there wasn't any noteworthy news about the other three.
Image source: Getty Images.
These fears were corroborated later in the month by Cloudflare's quarterly-earnings report. While the company fared well relative to analyst estimates, management's guidance on growth created serious concerns. Cloudflare took the biggest beating after that announcement, but its peers were dragged lower as well.
There's still plenty to like about the cybersecurity stocks, and their results have been strong relative to expectations. However, investors are becoming more sensitive to competitive pressures and macroeconomic conditions that are threatening operating results. Elongating sales cycles and slowing growth rates are worrisome signals, and they're forcing the market to embrace a more cautious approach.
High interest rates discourage risk in capital markets, which has weighed on growth stocks with expensive valuations. Slowing global economic activity and recession fears have also exerted downward pressure on cybersecurity stocks. Cloudflare, Zscaler, Okta, and CrowdStrike all had relatively aggressive valuations coming into April. They were all above 50 times price-to-free-cash-flow, and Cloudflare was trading at nearly 20 times price-to-sales.
OKTA, ZS, NET, CRWD Price to Free Cash Flow data by YCharts.
Those aren't outrageously high ratios, but they are fairly high values that assume significant growth and cash flows in future years. When investors revise their economic outlook lower, these sorts of stocks are vulnerable even if the most recent news wasn't catastrophic.
It's fair to assume that medium-term results in the cybersecurity industry won't live up to the lofty expectations of the most aggressive analysts. These lean times can also separate the pretenders from the ultimate long-term winners in the industry, so fringe competitors could be jeopardized over the next couple of years. It's reasonable to attach more conservative valuations as the perceived risk profiles of these stocks change, and that's exactly what happened in April
Now what
Despite the doubt cast on the medium-term prospects for leaders in the cybersecurity industry, their long-term narrative remains largely intact. Businesses across the spectrum of sizes and sectors rely on the transfer of data to conduct daily operations. Employees, customers, vendors, and other stakeholders need to access enterprise networks, often in huge volumes.
The number of access points for malicious parties continues to proliferate, and the methods employed to access sensitive data are constantly evolving. Zscaler recently reported a 50% year-over-year increase in phishing attacks, so these problems are only growing. Enterprises that don't invest sufficient resources in cybersecurity functions are likely to lose credibility or be held financially liable for incursions. These factors should create steady and growing demand for services that prevent, detect, or combat security issues.
It's impossible to know exactly which cybersecurity stocks will have separated themselves in five to ten years, but it's likely that the industry as a whole will generate returns. Investors who are specifically bullish on Okta, Zscaler, Crowdstrike, or Cloudflare can now buy shares at a discount to last month's price. Volatility will probably remain a factor over the next 12 to 18 months, but the long-term opportunity is still there.
