Microsoft Announces New Cybersecurity Products, but Are Small Security Software Stocks Really in Trouble?

Cybersecurity is a secular growth trend. With the world going digital, protecting data and systems is more important than ever before. Estimates point toward global cybersecurity software spending increasing at an average high-single-digit-percentage pace over the next five years, approaching or exceeding $300 billion a year.

Mighty Microsoft (MSFT -0.56%) is already the largest cybersecurity company around as measured by revenue, and it has its sights set on gobbling up more of this fast-growing market. It recently announced new cloud-based security products that seem likely to threaten top cloud security pure-play names like Palo Alto Networks (PANW -0.70%), CrowdStrike Holdings (CRWD -0.69%)and zscaler (ZS 0.93%). Are these smaller stocks in trouble?

Is Microsoft ready to rain on the cybersecurity market’s parade?

There are a lot of cybersecurity software pure-play stocks out there, but Microsoft reigns supreme. Earlier this year, CEO Satya Nadella said that cybersecurity revenue surpassed $20 billion in 2022. It takes the top seven largest cybersecurity companies’ revenue combined to reach Microsoft’s scale.

Microsoft’s secret to success isn’t simply size, though, nor is it superior security offerings. On the contrary, right before announcing its new suite of products, Microsoft admitted that China-based hackers had breached the Microsoft Outlook email accounts of some 25 organizations, including two agencies of the US government. Oh, the irony.

At any rate, Microsoft’s secret sauce is unrivaled software distribution. To this day, some three-quarters of all PCs worldwide use Windows. Then there’s cloud infrastructure. Microsoft Azure and other cloud services are in second place behind Amazons‘s AWS. Suffice to say Microsoft has billions of users it can market to with sales nudges across all software product types — cybersecurity included.

That’s why cybersecurity investors had a brief panic attack when the software juggernaut announced a suite of secure service edge (SSE) tools. Specifically, Microsoft is releasing a secure web gateway for access to the internet and apps, especially Microsoft 365 apps. This type of product competes with services from Palo Alto Networks and Zscaler. And in a shot at identity management company OctMicrosoft announced Entra Private Access.

How can cyber companies strike back?

It’s clear that Microsoft is trying to build a full suite that covers everything from traditional endpoint antivirus to application-level security to a modern zero-trust architecture for the cloud. There’s no shortage of vulnerabilities that can be exploited in today’s digital world, and a myriad of small companies are constantly popping up to secure cracks in organizations’ security.

However, as top pure-plays like Palo Alto Networks and CrowdStrike have been talking about for the last few years, a myriad of different vendors may keep a business protected, but it makes for a complicated and more expensive security network. “Vendor consolidation” toward companies that can provide broad-based and advanced security has been the trend.

Microsoft mentioned the rising tide of attacks, but its small competitors love to point out vulnerabilities in the software giant’s offerings. By continuing to craft better products and in turn also expanding their own toolset, they should be able to keep pace with Microsoft’s gargantuan size and consolidate market share to themselves over time.

What’s the better buy?

As much advantage as Microsoft has in distributing new software, it hasn’t slowed down companies like Palo Alto Networks or CrowdStrike. In fact, even as many software outfits have begun reporting slowing sales this year (Microsoft included), cybersecurity pure-plays have kept growing at a rapid pace.

And given their faster growth, their valuations look like the more enticing buys to me. After all, if you’re going to pay a premium price, it might as well be for a company exhibiting rapid growth and fast-expanding profit margins.

Data by YCharts.

Thus, with Microsoft trading at a whopping 45 times trailing 12-month free cash flow, faster-growing Palo Alto Networks (29 times free cash flow), CrowdStrike (47 times free cash flow), and other top cybersecurity names still look like better buys to me. Microsoft may be able to pick up some new customers with its expanding product portfolio, but I think the more sophisticated services from its smaller peers will outperform over the long term.