This article was originally published on Forbes on Mar 25, 2020,10:18am EDT

Cybersecurity stocks were on a roller coaster ride in 2019 months before the coronavirus took hold. Last year saw exhilarating highs and sudden drops in stocks such as Crowdstrike and Zscaler with both losing nearly fifty percent of their market cap from August to October.

These companies post solid revenue growth yet their bottom lines reveal evidence of stiff competition in the very crowded cybersecurity sector.

YCHARTS

Crowded Cybersecurity Space

In 2004, the global cybersecurity market was worth a mere $3.5 billion and grew nearly 35-fold to $120 billion by 2017. As of 2018, there were up to 200 vendors competing in each layer of cybersecurity. Primary stakeholders, such as chief information security officers (CISOs), use as many as 80 security vendors across their teams.

According to Cybersecurity Ventures, global spending on cybersecurity will exceed $1 trillion cumulatively over the five-year period of 2017 to 2021. (The 80-plus vendor per CISO certainly doesn’t hurt).

Where there is 35-fold growth, startups are sure to follow. This growth helps companies out of the IPO gate while sustaining long-term can become challenging in crowded markets.

The recent RSA conference in San Francisco, one of the last to be held before the coronavirus took hold, was a reminder of cybersecurity being a peak saturation with over thirty-six thousand attendees and hundreds of exhibitors – all for a market that is roughly equal to 1/8thof Apple’s market cap (or Google, Amazon and Microsoft’s).

Solid Top Line Growth, High SG&A Costs

In Crowdstrike’s recent earnings report last week, the company reported a fourth-quarter loss of $28.4 million, or 14 cents a share, with an adjusted loss of 2 cents a share when considering stock-based compensation and amortization of acquired assets. Revenue was up an impressive 90% in the fourth quarter at $152.1 million compared to $80.5 million in the year ago quarter. This was well above the forecast of $135.9 million to $138.6 million.

There is no question that Crowdstrike’s top line is investable. Meanwhile, the bottom line may face headwinds. SG&A expenses eat at the company’s operating expenses. Sales and Marketing last year required fifty-five percent of revenue, or $266.6 million of the $481.41 in revenue. Total SG&A expenses were at $355 million, or 73% of total revenue.

Historically, Crowdstrike spent 91% SG&A to revenue in the quarter ending October 2018 and 72% in the quarter ending October 2019.

Fierce competition in a rather small addressable market was one reason I cautioned against buying Crowdstrike at the IPO. The market size for endpoint security was at $6.4 billion in 2018 and will grow to $13.2 billion by 2022, according to Statista. 

Compare this to Crowdstrike’s market cap of $11 billion today with a peak market cap of $21 billion in August of 2019. In the S-1 filing, Crowdstrike states the addressable market is $24.6 billion and will reach $29.2 billion, yet this includes modules for categories that cannot stand alone.  

Zscaler Inc (NASDAQ: ZS) released its second-quarter fiscal year 2020 results on February 20, 2020. Revenue grew 36% year-over-year, which is slower than the CAGR of 56% from the fiscal year 2016 to the fiscal year 2019. The company’s full-year revenue guidance of $414-417 million, which suggests a year-over-year growth of 37% at the mid-point. This was slightly better than the median analyst estimate of $410.85 million.

Zscaler’s report also shows evidence of a crowded sector that requires outsized sales and marketing expenses of $61 million per quarter, or 61% of revenue, and total SG&A at 90% of revenue.

Cybersecurity Consolidation on the Way

Crowded markets typically evolve into consolidation as startups with more advanced R&D are acquired by larger companies who need to move quickly to protect their moat. Consolidation in the cybersecurity space will make it more challenging for nimble security vendors to compete, especially because large-cap companies with moats can offer a more intrinsic approach to problems.

VMWare’s acquisition of Carbon Black in October of 2019 for $2.1 billion is an example of consolidation. Financial analysts were cautious of the acquisition, stating, “What remains to be seen is whether VMware backed the right horse in this race.” The comment refers to the very crowded space of endpoint security, where Crowdstrike, Cylance, Symantec, McAfee, Sophos, Palo Alto Networks, and FireEye all offer endpoint protection and compete.

VMware’s moat lies in its access to 70 million virtual machines and over half a million customers, which can help Carbon Black scale very quickly. After acquiring endpoint security company Carbon Black, the combined entity is now able to offer a more complete service rather than requiring CISOs to pile up on separate tools for various endpoints.

Sign up for I/O Fund's free newsletter with gains of up to 403% - Click here

Following the acquisition, VMware reports a new revenue line item in its earnings reports titled “subscription and SaaS revenue” in which Carbon Black’s revenues will partly contribute. This segment reported revenues of $556 million, an increase of 52% year-over-year and faster than the group’s revenue of $3.07 billion, which grew 11% year-over-year for the 4Q of fiscal year 2020.

Akamai is similar to VMWare in that they are expanding from their core products to compete in cybersecurity. Akamai is traditionally a content-delivery network and website-acceleration company. With this level of access to the edge, where most security hacks occur, Akamai has found itself in a serendipitous position to offer competitive security products, such as protection from distributed denial of service (DDoS) and website-application security. 

One of the main value propositions Akamai offers is to simply reduce vendor bloat, as the company consolidates content delivery network (CDN) needs with the adjoining website security. Notably, Akamai’s SG&A expenses are 33% of total revenue with sales and marketing at 18% of revenue.

Coronavirus Selloff Will Require Conviction

Splunk and CyberArk had reclaimed 52-week highs in February prior the coronavirus selloff. Despite having a healthy competitive lead in their respective domain, both companies could not stave off the indiscriminate selling.

Founded in 2003 with a public listing in 2012, Splunk is one of the original big data platform companies that came of age at time when big data software had a long runway. The company has since expanded to security to leverage their data software as a way to troubleshoot and scan for breaches.

Splunk Inc announced its 4Q fiscal year 2020 results on March 4, 2020 with total revenues growth of 27% year-over-year to $791 million. Software revenues grew 33% y-o-y to $617 million with average recurring revenue (ARR) up 54% year-over-year.

According to Gartner’s magic quadrant, CyberArk is the leader in privileged access management. The company listed on the public markets over five years ago, posted 90% revenue growth in 2015, and has since stabilized to a consistent 20% revenue growth. CyberArk released its 4Q and full-year 2019 results on February 12, 2020. Revenue for the 4Q rose 19% year-over-year to $129.7 million with the full-year revenue growth of 26% year-over-year to $433.9 million.

Conclusion:

The coronavirus selloff will level the playing field for cybersecurity stocks. Investors will need to evaluate if their investments can overcome the risk that too much supply inherently brings to a marketplace. Expect to see smaller vendors repeatedly challenged by large players who have millions of customers. The word “moat” is popular in the financial industry, but it’s never been more important than in a crowded field such as cybersecurity.