Valuations across cybersecurity and networking equipment are now too spread out to trade as one "sector." The real question isn't whether to buy cybersecurity, but which segment to buy.
In 2026, the AI security narrative pushed PANW、CRWD、Cloudflare to – x EV/Sales, while Zscaler、SentinelOne stalled at – x. On actual YoY revenue from each company's latest report, Zscaler grew 、CrowdStrike ——differ by just 0.4 percentage points, yet the valuation is x vs. x.
Range 12 US-listed companies (10 cybersecurity + 2 networking equipment), 8 private-market names, and the four mega-deals closed in 2026. Currency USD. Financial basis Revenue YoY is the actual figure for the latest reported quarter vs. the same fiscal quarter a year earlier, not analyst estimates.
Each one maps to a segment of the dispersion band above, ranked by what I see as risk-adjusted attractiveness. The China call appears separately in Part 2, because its drivers, accounting basis, and data sources all differ and it shouldn't be compared with the US in one table.
In 2025, the industry announced 426 M&A deals with disclosed value of USD 92.5bn (YoY +82%); through Q3 2026, 336 deals have already been recorded with disclosed value of USD 15.4bn. Google's acquisition of Wiz paid 32 x. Meanwhile in public markets, SentinelOne ( EV/S, actual growth ）、Netskope（）、Rubrik（, actual growth ) are below the multiples strategic buyers have paid in recent deals. Buyers can afford them, and the targets are cheap: Rubrik deserves a separate look: growth-adjusted , alongside the similarly cheap SentinelOne (), but growing nearly twice as fast.This is the only segment of the sector with a clear re-rating path.
S · RBRK · NTSKZS latest reported revenue YoY , CRWD is ——differ by just 0.4 percentage points, yet the valuation is vs , a difference of x. Okta jumped 29% in a single day in August on the narrative that "each employee will generate about 90 AI identities," but actual revenue YoY was only , second-lowest in the group; the narrative has yet to turn into revenue. ZS is "growth delivered, valuation lagging"; OKTA is "narrative first, growth unproven." The risks differ, and I'm only confident about the former.
ZS OKTACrowdStrike 155×、Cloudflare 203× forward PE, against actual revenue YoY of and . The growth is real, but not enough to justify this multiple. At current valuations, even five years of flawless execution would only take it back to the sector's historical highs.Palo Alto belongs in this tier too: its reported Includes CyberArk consolidation; organic growth excluding it is about +18%, with growth-adjusted multiples ranging from Back to — on par with CrowdStrike. That's not a reason to short, but it is a valuation risk — especially after both stocks just hit all-time highs in August.
CRWD NET PANW (organic)In Q1 2026, NVIDIA, with 21.5% share and +193% growth rate topped data center Ethernet switching for the first time; the latest Q2 data shows Nvidia's share falling to 20.4%(+181%), Arista about 18.7% still ranks second. Arista has still raised its full-year guidance to about 126 ×100M USD (+40%), with an AI Fabrics target of USD 3.5bn.One more correction here:Cisco's latest earnings report showed revenue growth rebounding YoY to (just +9.7% last quarter), Arista is ; growth-adjusted, Arista is , Cisco at ——This time it's Cisco's turn to be cheaper than Arista. The earlier call to trim ANET and add CSCO has actually held up on valuation grounds. Share being materially eroded by Nvidia remains the one bearish argument left for Arista, while 's absolute multiple leaves no room for this. Cisco's value is no longer just 21× the downside protection from forward PE, and with growth accelerating, the valuation itself is more favorable too.
ANET · CSCO · CorrectedThe x-axis is revenue YoY from each company's latest report (not analyst estimates); the y-axis is EV/Sales (log). If pricing were rational, all points would fall along an upward-sloping band. In reality, Zscaler 、CrowdStrike : the two are growing at almost identical rates, yet trade at vs . This isn't a growth gap; it's a narrative gap.
| Company | Segment | Mkt cap | TTM revenue | EV/Sales | Forward PE | Revenue YoY | Gross margin | Growth-adj. multiple |
|---|
All four mega-deals so far in 2026 have closed. This isn't late-cycle bargain-hunting — it's platform vendors filling the capability gaps customers demand for a one-stop shop in the AI era: CyberArk for identity, Wiz for cloud security, Armis for OT/IoT assets. The implication is direct: any public target with differentiated technology trading at 6-12x is within range.
| Company | Sector | Valuation | Status |
|---|---|---|---|
| Cyera | AI data security / DSPM | 12.0 | 2026-09: Secured additional $400M in Series G funding, again led by Goldman Sachs, valuation held at $12bn |
| Cato Networks | SASE | 4.8 | Investment banks hired; 2026 IPO window candidate |
| Snyk | DevSecOps / AppSec | 4.5 | Nominal USD 7.4bn, marked down to USD 4–5bn in secondaries; IPO or sale |
| Island | Enterprise browser | 6.4 | 2026-09 raised USD 400M in Series F, valuation up to USD 6.4bn |
| Illumio | Zero-trust microsegmentation | 2.9 | Large US federal contracts boosted backlog |
| Saviynt | Identity governance (IGA) | 3.0 | USD 700M Series B, largest single round in the past 12 months |
| NinjaOne | Endpoint management | 12.3 | Added a $400M Series C in 2026-06, raising its valuation to $12.3bn |
| Abnormal Security | Email / behavioral AI security | 5.1 | S-1 filed 2026-05, valued at USD 5.1bn, not yet priced |
Range 15 listed companies (12 cybersecurity + 3 networking equipment). Currency CNY; market cap and PS as of 2026-10-29 close. Financial basis H1 2026 cumulative, Not directly comparable with the US-market basis in Part 1。
China's cybersecurity drivers (Xinchuang IT localization, MLPS compliance, government and SOE budgets) barely overlap with those in the US (AI attack surface, platform consolidation), so China is kept out of the dispersion band above and analyzed on its own.
Median H1 2026 revenue growth across 12 A-share listed cybersecurity companies is only , ranging from Topsec's to Sangfor's . Over the same period, 9 companies improved profit YoY, but the improvement came from cost cuts rather than demand growth, and that path has a ceiling. The only company to deliver both strong revenue growth and a return to profit was Sangfor: revenue 39.98 ×100M CNY, , net profit attrib. 2.31 ×100M CNY (vs. a loss of CNY 228M a year earlier). And on valuation, A-share cybersecurity isn't cheap: DPtech PS with growth, compared with Zscaler's with 20%+ growth.
Holds only for SangforXinchuang, data security compliance (DSL/PIPL), and critical infrastructure protection are real sources of demand, but across the interim reports of 12 A-share cybersecurity companies, median revenue growth is only +1.2%. What's really happening is something else: 9 companies improved profit YoY while revenue barely grew. That's a recovery driven by cost cuts, not demand-driven growth.
| Company | Mkt cap (100M CNY) | PS TTM | H1 revenue | YoY | Net profit attrib. | Prior-year period | Recurring net profit | Gross margin |
|---|
In the same quarter, growth in A-share networking equipment was on a completely different scale: Unisplendour (New H3C) revenue 635 ×100M CNY, , and net profit attributable doubled from CNY 1.041bn to 21.67 ×100M CNY; Star-Net Ruijie . This matches the US pattern exactly, with Arista and Cisco strong and cybersecurity mixed: AI capex is flowing to network infrastructure, not security budgets, which fits the "17x gap" in the final section of this memo.
But don't copy the multiples directly: Unisplendour's 0.65× PS looks extremely cheap, but gross margin is only (Arista: 63%). It runs a hardware and distribution model, so it isn't directly comparable with US networking equipment. ZTE's revenue rose 9.0%, yet net profit attributable fell from CNY 5.058bn to 27.53 ×100M CNY, nearly halved, the red flag in this group.
Range A structural fact jointly confirmed across the US and China, and the constraint it places on the conclusions of the first two sections.
Gartner forecasts 2026 information security spending of USD 247.5bn, up 13.6%, with the "AI-enhanced security" market growing from USD 49bn in 2026 to USD 204bn in 2030. But the same forecast contains another number: Enterprises spend 17x more on AI tools than on "securing AI"; agentic AI adoption is outpacing governance by 8x.
The valuation in the 26–42x range fully prices in this gap closing. It could close — by the end of 2026, 40% of enterprise applications will embed task-based AI agents, and the attack surface is real. But it might not close either: security budgets remain a rounding error within total AI capex, and the gap gets filled by governance processes rather than new product purchases.
Financial results in both China and the US point to the latter.On the US side, Arista revenue YoY 、Cloudflare , faster than any pure-play security vendor; on the A-share side, Unisplendour , Star-Net Ruijie , while median revenue growth for the 12 cybersecurity companies is only . Two accounting standards, two sets of demand drivers, two currencies, one conclusion: Money is flowing into network infrastructure, not security budgets.
That's why the cheaper half clusters in the 6–12x range.Names there can make money without this gap closing; the 40x segment can't.