Everyone's throwing opinions at you — some say AI has blown the attack surface wide open, others call it fake growth. The real question isn't whether cybersecurity is worth watching, but which segment is expensive. network_pulse puts 12 U.S. stocks, 14 A-shares, and 8 private-market names on the same ruler: valuation by EV/Sales (enterprise value divided by revenue), growth measured only by actual reported year-over-year. The sector's median valuation keeps climbing, to 12.0×; the gap between the cheap and expensive segments is about 8×, and the gap between CrowdStrike and Zscaler is about 4.2× — the two still rise together, and the growth gap hasn't narrowed to match. China's A-share Q3 earnings season has wrapped up: Venustech swung to a net profit with revenue up 12.2%; Qi An Xin's net loss widened 89% with revenue down 20.2% — product companies have already turned the corner, while integration-service companies are still sliding.
SentinelOne's growth is +20.6%, EV/Sales 7.4×, and its growth-adjusted multiple 0.36 is the lowest in the field — the only genuinely cheap name in this segment. Rubrik's growth of +37.9% is the fastest, but its implied EV/Sales already exceeds the top of the 6–12× range, and its growth-adjusted multiple of 0.43 is only slightly below Zscaler's 0.44 (Zscaler's 11.1× is also at the ceiling) — what's being bought here is a growth premium. Industry-wide M&A in 2025 totaled 426 deals worth $92.5B (+82%), and Google paid 32x ARR for Wiz — this is still the only segment with a path to re-rating.
Zscaler's revenue grew +25.4% year-over-year, CrowdStrike +25.8% — a gap of 0.4pp, with a valuation gap of about 4.2×. CrowdStrike's EV/Sales keeps climbing, to 46.7×, with its growth-adjusted multiple up to 1.81; Zscaler is rising too, to 11.1× and 0.44 — the two are rising together, and the growth gap hasn't narrowed to match, which shows this is a sentiment-driven rally, not a change in fundamentals. Okta has been hyped on its "AI identity" narrative, but its actual year-over-year revenue growth is only +10.6%, the lowest in the group, with a growth-adjusted multiple of 1.05 sitting between the other two — the price the market pays follows the story, not the growth number.
CrowdStrike trades at a forward PE of 155×, Cloudflare at 203×. Their growth rates — +25.8% and +35.9% — are real, but don't justify that multiple. Palo Alto should be moved out of this group: more than 40% of its reported growth rate of +31.1% comes from the CyberArk acquisition. Stripping that out, its organic growth is +18% — over half self-generated, not "mostly from acquisitions." Its adjusted multiple of 1.42 sits right between Cloudflare's 1.10 and CrowdStrike's 1.81, and part of that positioning is propped up by the acquisition, not held up by being cheap on its own. The only two that hold this range on organic growth alone are CrowdStrike (1.81) and Cloudflare (1.10) — CRWD remains the more expensive of the two, with greater downside risk. Both of their adjusted multiples have been climbing together, and the gap between them hasn't narrowed.
If pricing were rational, valuation would track growth. Put the two most comparable companies side by side — same space, same customer base, same reporting quarter — using actual year-over-year revenue from SEC filings rather than analyst estimates. Here's the math:
This isn't an opinion — both figures come from SEC filings; swapping in analyst estimates would flip the ranking, which is why the methodology is stated up front.
Gartner projects 2026 information security spending at $244.2B (+13.3%), with "AI-enhanced security" growing from $49B to $204B by 2030. But the same forecast contains another number: enterprises are spending 17× more on AI tools than on securing AI; agentic AI adoption is outpacing governance by 8×. The valuations in the 26–39× band are fully pricing in that this gap will close.
This gap may or may not close — security budgets have always been a small slice of overall AI spending, and closing the gap depends on management processes, not buying new products. On the US side, Arista's +37.7% and Cloudflare's +35.9% growth outpace dedicated security vendors like CrowdStrike, Zscaler, and Palo Alto; the only name growing faster than Arista is Rubrik (+37.9%), which, as noted above, is an M&A candidate rather than a counterexample. On the A-share side, Unisplendour grew +33.9% and Ruijie Networks +20.7%, while the median growth across 14 cybersecurity companies is only +1.2%. The conclusion holds on both sides of the Pacific: money is flowing into network infrastructure, not security budgets.
That's why the cheap half clusters in the 6–12× segment: companies there can turn a profit without waiting for that gap to close, while the 26–39× segment needs it to. On Oct 26, CISA added two PHP2Shell vulnerabilities (CVE-2026-109618/109619) to its "known exploited" list, and the Oct 29 patch deadline for federal agencies has already passed — money flowing into infrastructure doesn't mean more security, the risk has just moved elsewhere, and the security spending still has to happen. Fortinet grew revenue 20% and raised full-year guidance, yet its stock fell 21.8% over two days to $136.08; CrowdStrike dropped along with it over the same period, but its EV/Sales didn't fall and instead rose to 46.7× — this is sentiment spilling over from the chip-stock selloff, with the market focused on margins, not year-over-year numbers. The statutory deadline for A-share Q3 disclosures has passed, and Sangfor, Topsec, Qi An Xin, NSFOCUS, and Venustech have all filed their Q3 reports; whether growth can hold up valuations now has a split answer: some swung to profit, others saw losses widen.
This page is just a snapshot — the full map goes deeper. The full version includes the dispersion bands and adjusted-multiple ranking for all 12 US-listed names, four completed mega-deals, 8 private-market names with their valuation status, a name-by-name breakdown of the 14 A-share companies' interim reports, and a data-revisions note.
A-shares get a separate category because the drivers are completely different: this is a loss-narrowing trade, not a growth trade — the median 2026 interim-report revenue growth rate across 14 names has dropped to +1.2%, and the profit improvement is coming mainly from cost-cutting, not from selling more. Q3 reports are now fully filed, and results have split sharply: Venustech's net profit swung from a loss to a gain with revenue up 12.2%; Qi An Xin's net loss instead widened 89% with revenue down 20.2%; NSFOCUS's loss narrowed. With the statutory Q3 disclosure deadline now passed, the sharp stock declines of the past two days are a knock-on effect of the global chip-stock selloff, not a problem specific to the cybersecurity industry — what to watch next is whether the stocks start tracking earnings or keep tracking chip stocks. Sangfor is another exception: first-half revenue of RMB 4.00B, growth of +32.8%, with net profit staying positive — a combination no U.S.-listed peer matches; but its P/S (market cap divided by revenue) fell back to 5.7× along with the broader market, eating up most of the valuation-recovery gains from the previous few weeks.
The 6–12× segment doesn't need the story to come true; the 26–39× one does — that is the difference, not growth.
If the 6–12× tier sees no M&A for two consecutive quarters while the 26–39× tier's revenue growth actually accelerates — the "undervalued tier" loses its re-rating path, and the premium is justified.