Cybersecurity Stocks: What Is Inside the Cybersecurity Theme

The theme applies a two-part test. First, does the majority of revenue come from protecting digital systems, meaning endpoint, network, cloud, identity, or application security? Second, is it delivered largely through recurring subscription software rather than through one-off projects or contracted people?

Both halves do real work. The majority requirement is what keeps the largest technology companies out, even though several of them run enormous security businesses. The subscription software requirement is what keeps out the consulting and government services firms that sell security expertise by the hour. Drop either half and the theme stops describing a coherent set of businesses: without the first it fills with conglomerates, without the second it mixes software economics with services economics and the constituents stop behaving alike for any comparable reason.

The second structural choice is that the theme spans layers of the attack surface rather than picking one. That is not an aesthetic preference. Two security holdings that both defend the endpoint are one bet dressed as two, while a perimeter vendor and an access vendor are genuinely exposed to different outcomes, because the architectural argument between them is unresolved. For the general idea, see thematic investing.

The oldest layer of security defends the boundary between a company's network and everything outside it, historically with firewalls sitting in a rack at the edge of a building. That model did not disappear when work moved to the cloud, it moved: the boundary is now the point where traffic enters an application rather than a campus, and the equipment defending it is increasingly a global network run by the vendor. This layer is where the theme's oldest revenue and its newest architecture sit side by side, which is exactly why two very different companies represent it.

How this layer relates to the rest. Everything above depends on this layer only in the sense that traffic has to reach an application before anything else matters. What makes it interesting inside the theme is that it is the layer under the most pressure: the perimeter's budget is the pot that the endpoint and access vendors are trying to win, so strength here is often weakness somewhere else in the roster.

If an attacker gets past the network, the next place to catch them is on the machine itself. This layer puts software directly on laptops, servers, and cloud workloads, watches behaviour rather than matching known signatures, and reports back to a cloud brain that correlates what it sees across every customer. It became the centre of gravity in modern security for a structural reason: the agent is already installed everywhere, which makes it the cheapest place from which to sell the next product. That is the mechanism behind most of the consolidation described further down this page.

How this layer relates to the rest. This layer is the theme's expansion engine. It does not sit neatly above the network layer so much as reach across it, because a vendor with an agent on every machine can add cloud posture, identity protection, and security operations without asking the customer to deploy anything new. It is also the layer where two of the theme's constituents compete most directly with each other.

When applications live in someone else's data centre and staff work from anywhere, the only boundary left is the decision about who is allowed to reach what. This layer answers that question continuously: verifying the user and the device, then brokering a connection to one specific application rather than admitting anyone to the network as a whole. It is the layer that grew fastest as the network perimeter dissolved, and it is also the layer most exposed to being absorbed, because every platform vendor wants access control to be a feature of their suite rather than someone else's product.

How this layer relates to the rest. This layer is where the theme's competitive tension is sharpest. Its zero-trust access sits directly on top of the traffic the network layer used to own, so growth here often comes out of the perimeter budget, and the platform layer below is selling a competing version of the same capability inside a bundle. Note also what the theme does not hold: there is no standalone identity-management specialist in the roster, which is a deliberate call explained in the exclusions.

The last layer is not a part of the attack surface at all. It is a commercial strategy: sell the customer network security, cloud security, and security operations as one integrated suite, on one contract, and displace the point products in each category. Security buyers have real reasons to want this, because dozens of separate tools are expensive to run and leave gaps between them, and a vendor that can land one product and expand into ten captures a growing share of a budget it already sits inside. This layer exists in the theme to represent the consolidation trend directly rather than only through its effects on everyone else.

How this layer relates to the rest. This layer is in tension with all three above it by design. It competes with the network layer in firewalls, with the endpoint layer in workload protection and security operations, and with the access layer in zero-trust connectivity. Holding it alongside the others is not stacking complements, it is holding both the consolidator and the specialists it is trying to consolidate, which is a coherent position only if you understand that is what you are doing.

In most themes the layers form a chain: one supplies the next, and weakness at the bottom eventually shows up at the top. Cybersecurity does not work that way, and pretending it does is the most common mistake in reading a roster like this. The layers here are competing for the same budget.

The reason is platform consolidation. A large organisation historically ran dozens of separate security products, which was expensive to operate and left gaps between tools that no one owned. The response has been to buy more capabilities from fewer vendors, and that changes the competitive geometry completely. A vendor already installed on every laptop can sell cloud workload protection without a new deployment. A vendor already inspecting every packet can add access control. A vendor already selling the firewall can bundle the endpoint agent into the renewal. Expansion sideways into a neighbouring layer is cheaper than winning a new customer, so every layer is being entered from the layers next to it.

The practical consequence for this roster is worth stating plainly. CrowdStrike and SentinelOne are not complements, they are direct competitors for the same endpoint deals. Palo Alto Networks competes with Fortinet in firewalls, with both endpoint names in workload protection and security operations, and with Zscaler in secure access. Fortinet and Zscaler represent opposite answers to the question of whether security belongs in an appliance or in a cloud network. Only Cloudflare sits somewhat outside the fight, because a meaningful part of its business is performance and delivery rather than protection.

That is a coherent position, but it is a specific one. Holding all six is a bet that security spending keeps growing and that you would rather own the argument than pick its winner. It is not the same thing as owning six companies that need each other to succeed, and a theme that looks diversified because it holds six tickers can still behave like one bet on high-growth security software when sentiment turns. Understanding which of those two you are holding is more useful than any ranking of the six.

A membership test is only credible if it excludes things. These are the names people most often expect to find here, and the specific reason each one does not qualify.

• Microsoft. It runs one of the largest security businesses in the world and is the single biggest competitive threat to several constituents, because it can bundle endpoint and identity protection into agreements customers already sign. It still fails the test, which asks for the majority of revenue to come from protecting digital systems. Security is a large line inside a far larger company, so it appears in the cloud computing theme instead.
• Okta. The marquee identity and access management specialist, and the one exclusion here that is about roster construction rather than a failed test. The theme expresses the identity layer through the access and platform vendors that are absorbing it, which is the same consolidation logic the rest of the roster rests on. That is a debatable call, not a disqualification, and Okta is covered in the companion roundup.
• Cisco. A serious security vendor with a large portfolio assembled over years of acquisitions, but the majority of its revenue comes from networking hardware and infrastructure. The test asks what most of the money comes from, not whether the company sells security, and by that reading Cisco is a networking company with a security division.
• Broadcom and similar acquirers of security assets. Enterprise security products can end up owned by semiconductor and infrastructure-software conglomerates, where they are run for cash inside a much larger portfolio. The revenue-majority test excludes them for the same reason it excludes Microsoft, and the exposure you would actually be buying is the parent company's capital allocation rather than the security market.
• Cyber consulting and government services firms. They deliver real security work, but they deliver it as contracted people rather than as recurring subscription software, which is the second half of the theme's criteria. Their economics are billable hours and contract awards, so they do not behave like the software names beside them even when the underlying demand driver is identical.

The Microsoft case is the one worth dwelling on, because the exclusion is technically correct and strategically uncomfortable at the same time. It fails a revenue-majority test cleanly and belongs in the cloud computing theme, where its exposure is the thesis rather than a division. But the consolidation pressure described above does not only come from inside this roster. It also comes from a vendor that can add security to a contract the customer was going to sign anyway, and no pure-play theme can hold that risk directly. Naming it is more useful than pretending the roster is complete.

The same six names, grouped by the layer of the attack surface they occupy rather than ranked, so the shape of the theme is visible at a glance.

Of the 6, five are security-first businesses and one, Cloudflare, sells security on top of infrastructure built for performance and delivery. Two of them, CrowdStrike and SentinelOne, sit in the same layer on purpose.

The passive route is a fund, and it answers a different question. Dedicated cybersecurity funds exist in the broader market, though the proxies attached to this theme are the broad technology funds VGT and XLK, where the largest security names appear at small weights inside a much wider technology sector. That is real exposure, but it is diluted: most of what you own is not security, and the weights are set by an index rather than by you.

A theme inverts the trade. You know exactly which six names you own, which layer each one represents, and which two of them are competing with each other, and you accept that six names is a narrower roster than a fund holds. Neither is automatically better. The fund is the simpler instrument and spreads a competitive shock across more holdings, the theme is the more deliberate one and lets you decide how much of the appliance-versus-cloud argument you want to own. Plenty of people hold a broad fund as a core with a small thematic tilt beside it.

A list of six names is an input, not a portfolio. What turns one into the other is structure: which layers you want exposure to, what weight each name carries, and whether the concentration you end up with was chosen or inherited.

• Decide the layer mix first, then the names. How much of the roster sits in the consolidated platform versus in the specialists changes the character of the position far more than swapping one endpoint vendor for another.
• Know where you are holding both sides of a fight. Owning CrowdStrike and SentinelOne together is exposure to the endpoint contest rather than diversification within it, and the same is true of Fortinet beside Zscaler. That can be deliberate, but it should be deliberate.
• Set target weights that sum to 100. Equal weighting across six names is a choice, and so is tilting toward the platform vendors. Both are defensible. Not deciding is what leaves you concentrated by accident after one name runs.
• Frame it against the S&P 500. A narrow thematic position should be judged against a broad benchmark, because the extra concentration has to be buying you something.
• Expect the roster to correlate. These are premium-multiple software companies with a shared customer budget, so they can fall together even when their competitive positions are diverging.

This is what Walnut is built for. You describe the thesis, the AI assistant proposes constituents and weights you can edit, the portfolio tracks as one performance line against the S&P 500, and you place trades you approve yourself at your own broker. Walnut is informational and does not tell you which stocks to buy.

For the companion view of which security names are most widely held and discussed, including the identity specialist this theme leaves out, see best cybersecurity stocks. For the wider category these subscription economics come from, see best software stocks.

The cybersecurity theme is six companies across four layers of the attack surface. Fortinet defends the perimeter from an appliance with its own silicon, Cloudflare defends it from a global edge network it already operates. CrowdStrike and SentinelOne fight over the agent on the machine. Zscaler represents the access layer that replaced the perimeter. Palo Alto Networks represents the commercial strategy of absorbing all three into one contract.

Read as a flat list of six security stocks, the theme looks like a spread across a durable spending category. Read as four layers being consolidated into fewer platforms, it is a position on an unresolved competitive fight in which some of the constituents win at each other's expense. The second reading is the accurate one, and it is the one worth deciding about. Nothing here is a recommendation, and Walnut is not an investment adviser.