Cyber security vendors: who is paid when incidents rise

Cyber security vendors sell subscriptions to software that runs continuously inside a customer's environment: an agent on every endpoint, an inspection layer in front of every network request, a set of detections updated daily. The customer is not buying a product so much as renting a capability, and the contract renews annually. That structure is the reason the sector is analysed through annual recurring revenue rather than through revenue - ARR is the run rate of what is already committed, and it moves before reported revenue does.

The competitive logic follows from the agent. Once a vendor's software is on every machine in an organisation, adding a second product to the same agent is cheap for the customer and enormously profitable for the vendor. This is why the leaders keep expanding into adjacent categories and why net retention - what existing customers spend this year against last - is watched as closely as new customer counts.

Scale is now considerable and still compounding. CrowdStrike has reported annual recurring revenue of roughly 5.25 billion dollars growing near 24 per cent, Zscaler sits above three billion with growth above 25 per cent, and SentinelOne crossed 1.06 billion, up about 23 per cent. Growth at that rate at that size is rare outside this sector, and it is what the valuations are paying for.

Security spending is defended in downturns in a way that most enterprise software is not. The reason is not that executives value it more highly - it is that cutting it requires someone to sign their name to the decision, and the asymmetry of that signature is obvious to everyone in the room. A cut that saves a modest sum and precedes an incident ends a career; the same cut that precedes nothing saves a modest sum.

The demand driver underneath is regulatory as much as technical. Disclosure rules now require listed companies to describe their risk management and board oversight annually, and European directives impose reporting duties with hard deadlines on a wide population of firms. Compliance obligations convert security from a judgement call into a documented process, and documented processes get funded.

The newer driver is that the attack surface itself is growing along a new axis. As organisations deploy AI systems with access to internal data and the ability to act, both the defensive and the offensive sides acquire capabilities they did not have, and the security budget acquires a line item that did not exist. Whether that becomes a durable category or an expensive detour is the live argument in the sector, and it is priced as though the answer is already known.

The market divides into layers, and the layers have very different economics. Endpoint sits closest to the machine and has the strongest lock-in, because replacing an agent on every device in a company is a project rather than a purchase. Network and access layers sit in front of the traffic and are stickier still once the routing depends on them. Identity is the layer attackers actually target, and the one most organisations under-fund relative to its importance.

Consolidation runs through all of it. Buyers who spent a decade assembling best-of-breed tools are now trying to reduce vendor count, which favours the platforms and squeezes single-product companies from both sides - the platform bundles the feature away, and the buyer wants fewer contracts anyway. That dynamic drives the acquisition activity that keeps reshaping the sector.

For anyone valuing these companies, the layer matters more than the logo. A vendor whose product is a feature of someone else's platform has a growth rate with an expiry date, however good the technology is. A vendor that owns the agent has a distribution channel for everything it builds next.