Largest Cyber Stocks Feast in 2025, as Smaller Stocks Famish

•
January 2, 2026    

The chasm between the cyber “haves” and cyber “have nots” widened in 2025, with most large security companies recording stock price gains while smaller companies logged losses.

See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective

Of the 11 public cyber vendors with valuations exceeding $14.9 billion, stock prices rose for nine companies in 2025, with Gen Digital down marginally and only Fortinet recording a meaningful stock price drop. But it was a very different story for the 12 security vendors with valuations between $1.1 and $14.9 billion, with all 12 experiencing market cap decline in 2025, with a median stock price drop of 14.8%.

The eight public cyber vendors with valuations below $1.1 billion were a mixed bag in 2025, with one recording a large stock price gain, two experiencing small gains, and five incurring large stock price losses.

The gap in stock performance between large and small security vendors becomes even more apparent when 2024 is factored into the equation. Of the eight companies whose stock price grew in both 2024 and 2025, seven are worth at least $14.98 billion, with Radware being the lone exception. And for the nine companies whose stock price fell in both 2024 and 2025, are all worth less than $12.55 billion (see: A Mixed Bag for Cybersecurity Stocks in 2024 as Paths Differ).

Investors increasingly see each security technology category as winner-take-all. Cloudflare, CrowdStrike, Rubrik, Zscaler all enjoyed double-digit stock price gains in the web application firewall, endpoint security, data protection, and secure access service edge spaces, respectively, while direct rivals Akamai, SentinelOne, Commvault and Netskope all experienced stock prices declines by at least 8.6% in 2025.

At the same time, investors are reluctant to double down on any player in legacy cyber categories, with Palo Alto Networks and Check Point Software recording small gains in network security while Fortinet’s stock price dropped sharply. All three incumbents in the vulnerability management market – Qualys, Rapid7 and Tenable – recorded stock price drops for the second year in a row amid sectoral challenges.

In total, 12 companies that derive much of their revenue from cybersecurity recorded stock price gains in 2025, while 19 recorded drops in their stock price, with a median stock price drop of 7.7%. That’s markedly worse than last year, when the median cyber stock saw a 14.5% increase in price and 16 of the then 28 publicly traded security companies recorded gains in price.

Below is a look at how each of the publicly traded cybersecurity vendors fared in 2025, with a deep dive into some of the more interesting case studies.

Best of the Bunch

Cloudflare in July start blocking unauthorized AI crawlers from accessing ad-supported content by default, which was driven by concern from publishers about content theft by AI companies. The San Francisco-based cloud connectivity company is balancing the need for open access by allowing customers to opt in for AI indexing of non-commercial content such as product documentation (see: Why Cloudflare Blocked Unauthorized AI Access to Web Content).

CrowdStrike made a pair of acquisitions in late summer, scooping up Silicon Valley-based AI security startup Pangea for $260 million in September to secure enterprise AI users and developer workflows at scale. Twenty days earlier, the company bought Madrid-based telemetry pipeline management startup Onum for $290 million to transform how third-party data is ingested into CrowdStrike’s SIEM platform (see: CrowdStrike Buys Pangea for $260M to Guard Enterprise AI Use).

CyberArk agreed in July to an acquisition by Palo Alto Networks for $25 billion, with shareholders getting $45.00 in cash and 2.2 shares of Palo Alto stock. CyberArk’s capabilities will be deeply integrated into the Palo Alto’s Strata and Cortex platforms, leveraging AI to deliver identity-aware security and real-time response across the entire enterprise. The acquisition is expected to close in early 2026 (see: It’s Official: Palo Alto Networks to Buy CyberArk for $25B).

Zscaler in August purchased Denver-based managed detection and response stalwart Red Canary for $651.4 million to combine zero trust architecture with threat detection, response and automation. Then in October, Zscaler bought New York-based AI security startup SPLX for $40.6 million to bring red-teaming and continuous testing capabilities to private, custom-built AI applications (see: Zscaler Purchases SPLX to Strengthen GenAI Model Protection).

Rubrik in July acquired San Francisco-based startup Predibase for $109.1 million to help enterprises transition from proof-of-concept AI projects to scalable, production-ready applications that maintain trust, security and efficiency. The company’s identity recovery business has hit $20 million in annual recurring revenue, and 40% of the new identity customers were working with Rubrik for the first time (see: Rubrik to Purchase Predibase to Power Generative AI Growth).

Okta in September purchased New York-based privileged access management startup Axiom Security for $54 million to better protect databases, Kubernetes and just-in-time access. The San Francisco-based company in February executed its third round of layoffs in three years, cutting 180 employees – or 3% of its workforce – to reallocate resources toward priorities to drive growth (see: Okta to Purchase Axiom Security to Bolster Privileged Access).

Treading Water

Palo Alto Networks announced a trio of acquisitions in 2025, agreeing in November to buy observability platform Chronosphere for $3.35 billion. The company in July announced the biggest deal in its 21-year history, bursting into identity security with its $25 billion proposed buy of PAM provider CyberArk. Also in July, Palo Alto Networks completed its $634.5 million acquisition of AI security startup Protect AI (see: Nikesh Arora: Why Palo Alto Is Making a $25B Bet on Identity).

F5 in September bought Dublin-based AI security startup CalypsoAI for $145.2 million to secure modern application environments in the context of emerging artificial intelligence workloads. The company in June purchased San Francisco-based threat management startup Fletch to bring agentic AI into the company’s application delivery and security platform (see: F5 Targets AI Model Misuse With Proposed CalypsoAI Purchase).

Check Point Software in September bought San Francisco-based AI security startup Lakera to provide end-to-end protection for AI usage and applications. The company in May agreed to buy Tel Aviv, Israel-based threat exposure startup Veriti to address siloed security tools and automate cross-tool communication and remediation (see: Check Point Adds AI Application Defense With Lakera Purchase).

San Francisco-based private equity firm Francisco Partners agreed in October to purchase Jamf for $2.2 billion to provide greater financial flexibility to accelerate growth and expand through innovation and M&A. The company in July executed its second round of layoffs in two years, cutting 6.4% of its workforce to reduce operating costs and improve operating margins (see: Francisco Partners to Buy Apple Security Firm Jamf for $2.2B).

Netskope raised $908.2 million in its Nasdaq initial public offering in September, with the firm’s stock priced at $19 share and receiving a $7.3 billion valuation. The IPO could level the playing field by offering Netskope the same visibility and credibility as SASE rivals Palo Alto Networks and Zscaler, opening the door with customers, partners and prospects who may not have previously known the company (see: Netskope CEO: Going Public Fuels AI Security, Partner Growth).

Falling Behind

SailPoint raised $1.38 billion in its Nasdaq initial public offering in February, opening trading at $23 per share and receiving a $12.8 billion valuation. The identity governance provider’s SaaS products offer more features than SailPoint’s legacy software product, particularly in orchestration and customization, with the added advantage of multi-tenancy and configurability through the Atlas platform (see: SailPoint’s Public Return Highlights SaaS Growth Strategy).

Pension funds in Oklahoma and Rhode Island accused Fortinet in October of misleading investors by touting in late 2024 a major firewall refresh cycle for a quarter of its install base, predicting it would yield more than $400 million. Once it became apparent in August 2025 the firewall revenue cycle wouldn’t have a material impact on revenue, Fortinet’s stock price dropped by more than 22% (see: Fortinet Accused of Securities Fraud Over Firewall Forecasts).

Reuters said in February that Advent International, Bain Capital, EQT AB and KKR had expressed interest in recent weeks in taking Japanese vendor Trend Micro private. The company’s endpoint security unit is growing more slowly than any of the seven market share leaders, IDC found, while Trend’s 11.3% growth rate in the cloud-native application protection platform space lags the 31.5% market growth rate (see: Why Private Equity Is Now Kicking the Tires on Trend Micro).

Varonis in October cut 5% of its workforce and watched its stock price nosedive after disclosing a sharp drop in renewal rates for its on-premises subscription business. The underperformance of the federal vertical caused a notable headwind for Miami-based Varonis despite its accounting for just 5% of annual recurring revenue, prompting the company to downsize its federal team and revisit its strategy (see: Varonis Lays Off 5% of Staff, Stock Plunges as Renewals Drop).

SentinelOne in September purchased Silicon Valley-based data pipeline startup Observo AI for $225 million to help customers decouple data ingestion from SIEM platforms. Earlier that same month, the company bought AI security startup Prompt Security for $133.6 million to secure AI in runtime, prevent AI-related data leakage and protect intelligent agents (see: SentinelOne Buys Observo AI for $225M to Fuel Data Ingestion).

Tenable in June purchased Tel Aviv, Israel-based AI security startup Apex Security for $47.8 million to help monitor and control AI usage within enterprises. The company in February bought Tel Aviv-based exposure management startup Vulcan Cyber for $148.5 million to more effectively integrate telemetry data from third-party security products (see: Tenable Bolsters AI Controls With Apex Security Acquisition).

Rapid7 in March struck a truce with Jana Partners, agreeing to hand the activist investor three board seats in exchange for widespread cooperation until early 2026. The deal added former Forescout CEO Wael Mohamed, former Imperva and Gigamon CFO Michael Burns, and Jana Director of Research Kevin Galligan to Rapid7’s board. In exchange, Jana will keep its ownership stake below 15% until this month (see: Rapid7 Gets Truce With Activist Investor, Adds 3 Board Seats).