Cybersecurity’s AI Arms Race Is Heating Up
How CrowdStrike, Zscaler, Cloudflare stack up against one another.
At The Pragmatic Optimist, we help investors navigate the evolving AI innovation landscape, identify rock-solid businesses with strong growth trajectories and operational grit, and make long-term investments in the space with a high probability of success.
Become a paid subscriber today
«The 2-minute version»
The market is just waking up to the fact that the first wave of AI wasn’t the main event. Foundation models, flashy demos, chatbots, etc.—that was the easy part. The second wave is here now, and it’s infinitely harder to secure the copious volumes of data being generated because it’s autonomous.
Well, that explains why: The cybersecurity complex has been significantly outperforming the broader market indices, with stock prices of companies like CrowdStrike, Zscaler, and Cloudflare through the roof since the beginning of the year.
Welcome to Agentic AI: In the latest Advancing AI event, AMD’s CEO, Lisa Su, said that AI inference is at an inflection point, as enterprises are about to unleash millions of autonomous agents that will act on their behalf for various business tasks. What this means is that each new AI agent instance could be a new attack surface, requiring every AI agent-generated action to be inspected, validated, and governed.
Framing the cybersecurity market size: With industry analysts pointing to the overall cybersecurity market growing at a CAGR of 13% to $425B by 2030, we are witnessing tremendous vendor consolidation, especially as companies like CrowdStrike, Zscaler, and Cloudflare expand their platform capabilities while forging strategic partnerships to offer their customers a fully integrated cybersecurity platform with solutions across Edge, Network, and Security Operations.
It’s all about growing enterprise adoption: With CrowdStrike and Zscaler offering flexible pricing options, they are seeing a growing adoption of modules on their respective platforms, with larger deal sizes than ever before. In the meantime, all three companies, including Cloudflare, are projected to grow their revenues in the 20%+ range over the next five years while unlocking operating leverage.
Will the rally continue? While Cloudflare is trading at the highest forward EV/EBITDA ratio, it is also projected to grow its revenues at the fastest rate compared to the other two. Meanwhile, both CrowdStrike and Zscaler are expected to have superior margins compared to Cloudflare over the next four to five years. Which begs the question, which one of them is the best positioned at the moment to continue delivering upside? Read on to find out.
We have added updated price targets and respective ratings on CrowdStrike, Zscaler and Cloudflare on our AI Stock Rec Tracker that all premium members have access to.
🎥Let’s Set The Stage
Two weeks ago, we sent out a survey asking our readers for feedback on how to further improve our publication that helps you better navigate the AI landscape and unlock alpha-generating investment opportunities.
Out of all the responses, one of the most popular ones (by far) was to include cybersecurity, defense tech, and quantum computing in our coverage (yes, in that order).
You asked, and we listened.
As a result, we present to you our first cybersecurity research post on The Pragmatic Optimist, where we will outline a 101 understanding of the industry landscape and delve into three fast-growing companies like CrowdStrike CRWD 0.00%↑, Zscaler ZS 0.00%↑, and Cloudflare NET 0.00%↑, how they fit in, along with a valuation exercise for each of the stocks mentioned.
Year-to-date, the above cybersecurity companies have significantly outperformed the broader market indices as well as the overall Magnificent 7 complex, as can be seen below.
That is because the market is waking up to the fact that the first wave of AI wasn’t the main event. Foundation models, flashy demos, chatbots, etc.—that was the easy part. The second wave is here now, and it’s infinitely harder to secure the copious volumes of data being generated because it’s autonomous.
Welcome to the age of Agentic AI, where we are about to see an explosion of enterprises unleashing millions of autonomous agents that will act on their behalf for tasks that include querying data, transacting, making decisions, writing code, connecting across networks, and more.
In fact, at the latest Advancing AI event, AMD’s AMD 0.00%↑ CEO, Lisa Su, said that AI inference is at an inflection point, set to drive AMD’s total addressable market (TAM) for its AI products beyond $500B by 2028. What she also added was that as agentic AI activity increases, all those agents will be accessing high-performance GPUs, thus translating to an equivalent of billions of new virtual users that are about to be added to the global compute infrastructure.
What this means is that each new AI agent instance could be a new attack surface, requiring every AI agent-generated action to be inspected, validated, and governed.
The scale of this problem is staggering, as CrowdStrike’s CEO George Kurtz put it so eloquently (with a hint of urgency) below.
“At their core, every AI agent represents a unique superhuman identity, necessitating visibility, control, and protection for every single agent. These autonomous AI agents increasingly have access to multiple internal and external data stores, applications, and machines, automating business processes and workflows at scale. Simply put, AI agents dramatically increase the size, severity, and speed of the enterprise attack surface. Size, more agents everywhere, severity, everything is connected faster than it can be contained. Speed, autonomous agents move at machine speed. This is the new attack surface, and it's an adversary's paradise.”
With cybersecurity now the stickiest and most protected budget line of the IT department in the AI era, industry experts point to the cybersecurity market reaching a TAM of $425B by 2030, representing a CAGR (compounded annual growth rate) of 12.63%.
But there will be winners and laggards as organizations consolidate their cybersecurity spending across select vendors that offer fully integrated solutions instead of point ones.
What we at The Pragmatic Optimist will deliver are our insights and price targets across companies in the cybersecurity landscape that will allow us to identify the ones that will lead and avoid the ones that may fall behind.
(P.S. To those who have filled out the survey, we thank you very much. If you haven’t yet, we will be truly grateful if you can take two to three minutes out of your calendar to give us actionable feedback. We will keep the survey open until the end of the month and present our content and feature plan based on user feedback at the beginning of July.)
Framing the market size for CrowdStrike, Zscaler, and Cloudflare in the Cybersecurity Landscape
Before we begin, let’s first start at the very basics.
At its core, cybersecurity is about protecting an individual’s or company’s resources (data, digital assets, and physical assets) from cyber threats.
Those threats can include malware (software threats), ransomware (malware that locks/encrypts data), DDoS attacks (overwhelming a system), phishing (sending emails/messages to trick users), among others, which can be introduced through devices, software, physical infrastructure, or user accounts.
The goal of cybersecurity is to prevent those attacks from occurring (prevention), find when those attacks do occur (detection), and remediate those threats once they’re known (response). This needs to be done across the tech stack, from devices to networks to cloud environments to physical infrastructure, creating a multibillion-dollar market.