3 Cybersecurity Stocks You Can Buy and Hold for the Next Decade

Yes, high-growth stocks could keep falling if interest rates rise a lot, but over the long term, the recent sell-off could offer a compelling long-term entry point in cutting-edge tech stocks -- especially if inflation calms down later this year.

One category near certain to grow by leaps and bounds this decade is cybersecurity. As cyber criminals develop more sophisticated tools and corporate data infrastructure expands and evolves, companies large and small will need to invest in the most advanced cyber technologies.

Investors looking into the sector today should focus on established leaders with leading technology, good growth, and improving profitability. The following three names fit the bill.

Palo Alto Networks

First up is Palo Alto Networks (NASDAQ:PANW). The reason to like Palo Alto is that it's perhaps the best of the legacy hardware-based firewall companies that has successfully pivoted to software and the cloud.

Three years ago, Gartner ranked Palo Alto as a category leader in just one category of cybersecurity: network firewalls. Fast-forward to today, and Palo Alto is a leader in seven categories, including enterprise firewalls, endpoints, security orchestration and automation, zero trust access, and vulnerability management. That's thanks to robust internal investments, and about $2.5 billion worth of acquisitions in just the past three years.

With these new products comes an expanding total addressable market projected to grow at a 14% annualized growth rate from 2021 through 2024, reaching $110 billion in two years' time. That's versus just $4.56 billion in revenue for Palo Alto over the past 12 months.

Now that the company has transformed its portfolio, margins are rising once again after a couple years of compression. Management expects free cash flow margins to expand 1%-1.5% annually on top of 22% annualized billings growth through 2024. That should yield $6 billion in free cash flow over the next three years versus just a $47.5 billion market cap today. Some of that will go to more tuck-in acquisitions and debt paydown, but the company will also continue to repurchase shares in larger size.

CrowdStrike

Founded in 2011 and going public in mid-2019, CrowdStrike (NASDAQ:CRWD) is an example of a cloud-native company able to disrupt some legacy players by starting with a "clean sheet" of paper and building a new model.

CrowdStrike's model uses cloud-based aggregation and AI engines to consistently improve its centralized Threat Graph as it gains more data and customers. That network effect should improve the quality of its Falcon Agent over time, which should lead to more customers, in a virtuous circle.

While Palo Alto originated as a leader in network firewalls, CrowdStrike is best-in-class in endpoint security, where it has already outpaced legacy vendors.

Also like Palo Alto, CrowdStrike has been acquiring other companies and developing new modules for customers, expanding its offerings into a complete platform. CrowdStrike sees its total addressable market growing from $25 billion from its IPO to $67 billion in 2024, and to $116 billion in 2025 if it executes on its new product roadmap.

Also positive for the current environment, CrowdStrike is showing signs of margin expansion as it grows. Gross margins have expanded from 57% to 76% between 2018 and 2021, and adjusted (non-GAAP) operating margins have gone from -100% to a positive 7% in that time, expanding to 13% through the first three quarters of fiscal 2022.While CrowdStrike is still unprofitable on a GAAP basis due to stock-based compensation, it is free cash flow positive, and investment in growth is paying off, with its annualized revenue run-rate up 67% last quarter.As CrowdStrike scales further, expect margins to continue to improve.

Splunk

Finally, IT management company Splunk (NASDAQ:SPLK) isn't solely a cybersecurity company. Rather, Splunk connects its market-leading security event and information management (SIEM) offering with IT systems performance management and software observability. Its platform can collect data from any electronic device and assess the health and security of that device, while processing vast reams of data.Splunk also allows third-party software developers to extend its platform for specific use cases through its Splunkbase app store, where there are about 2,000 apps that use Splunk's data, including some for cybersecurity.

What makes Splunk a compelling long-term play is that it counts 92 of the Fortune 100 as customers, thanks to its ability to process massive amounts of data. Being embedded in the largest, most complicated IT systems likely makes Splunk a very sticky product.

And yet, one can buy Splunk for a very low price today, at just over seven times trailing sales. That's likely because Splunk is going through a multi-year journey from an on-premise, perpetual license company to a cloud-first subscription model. In addition, the company is without a full-time CEO at the moment, as CEO Doug Merritt resigned in November after six years. However, the company has been hiring from leading cloud companies as it completes its transition, and I expect the board will select the right person for the job in time.

The cloud transition caused Splunk's revenue to decline last year, but that was due to the differences in accounting for perpetual licenses and cloud subscriptions. However, as the company gets through its transition, Splunk's revenue growth, which accelerated to 19% last quarter, should eventually track closer to its annualized revenue run-rate, a metric that adjusts for the accounting vagaries and grew at 37% -- nearly double the pace of reported revenue. Oh, and a 130% cloud net retention rate is a very competitive number, showing satisfied customers are using more and more of Splunk's products each year. These non-GAAP metrics make Splunk deserving of a higher multiple.