Fortinet & Palo Alto: The Only Constant is Change

"There are only two types of companies: those that have been hacked and those that will be"

– John Chambers, former CEO Cisco Systems

Cybercrime.

The consequences are devastating.

As a CEO, you should think about it.

The frequency, severity and cost of cybercrime have been steadily increasing (chart 1). The reputational and business risks associated with a data breach for a company are not exactly flattering either. Not to mention the potential penalties that can be imposed by regulators.

The digital footprint of a typical organization has grown exponentially over the years, which has led to the creation of new avenues of attack that malicious actors can capitalize on. Just think about yourself. When you are online, whether for business or personal reasons, there are huge opportunities for cybercriminals to exploit. Remote work adds fuel to this fire.

However, if you look through our investment glasses, you will find a sub-sector with an attribute that we at arvy always look for in a "Good Story".

A structural tailwind.

Cybersecurity.

Chart 1: Cybercrime Expected To Skyrocket in Coming Years

Source: Statista Technology Market Outlook, National Cyber Security Organizations, FBI, IMF (As of November 2022)

Structural Tailwind

Structural tailwinds are one of the five attributes we look for in a "Good Story", along with a top-quality business model, high organic sales and earnings growth, an attractive free cash flow valuation and low debt levels.

Ask yourself: Why invest in struggling companies and fight the trend when we can opt for those with tailwinds?

Cybersecurity hits the mark here. The complexity and intensity of threats is constantly increasing. Let's not forget that your opponents are the smartest computer geeks in the world. At the same time, there is underinvestment in this area as we undergo a digital transformation and move to a cloud-first world. Therefore, it is not surprising that spending on security software is outpacing spending on other software and is top of mind for business leaders around the world.

Cybersecurity is becoming a necessity in the corporate landscape.

Two companies are outshining all others in this space.

Palo Alto and Fortinet.

Chart 2: The Expanse of Platform Vendors Is Hard to Match

Source: Morningstar, Company filings. Data as of November 2023

The Moat - Sustainable Competitive Advantage

Cybersecurity is known for its fast pace of development and fierce competition. As a result, it is difficult for a company to develop a wide economic moat - or a sustainable competitive advantage – in this ever-changing environment.

The only exceptions to this rule are large platform providers that offer a broad range of solutions in several end markets. Ticking those boxes are the two pure-plays Palo Alto & Fortinet with six end markets (chart 2).

Building on them, they create a top-quality business model by having not one, but two moats:

Switching costs: It is difficult for customers to switch to other providers of cyber security solutions, as these are widely used throughout the IT infrastructure and retraining is required.

Network effects: The value of a product or service grows as its user base expands , e.g. through a one-stop store solution. Due to their size, they can offer the full range, which always provides added value compared to the need for five individual providers to be assigned. This in turn attracts more customers and improves their threat detection capabilities, creating a reinforcing loop.

Now they both have a major but risky opportunity.

Chart 3: Key Industry Players and Revenue Market Share

Source: Morningstar, Gartner. Data as of November 2023

The Great Consolidation

The cybersecurity industry is highly fragmented (chart 3).

The 10 largest companies accounted for only 21% of the industry's total revenue in 2022. Palo Alto is the largest pure-play provider of cybersecurity solutions with 3.7% market share, putting it in second place behind Microsoft (4.2%).

Which is nothing!

It is estimated that organizations currently use 60-80 different security solutions but want to reduce this number to 15-20 key solutions. In this changing landscape, there is reason to believe that Palo Alto and Fortinet are at the forefront of becoming dominant players. They will displace weaker competitors or acquire new or more powerful technologies all while helping organizations consolidate their digital footprint and maintain a secure ecosystem.

The great consolidation.

This means a huge opportunity to gain market share in a rapidly growing market. However, this endeavor comes with high risks, be it strategic missteps, costly acquisitions or the rise of competition they cannot keep at bay.

There is only one thing we know for sure in the cyber security sector.

That the only constant is change.

Chart 4: Palo Alto & Fortinet over five years

Source: TradingView

arvy's takeaway: Where growth thrives, cybercrime also grows, just as the shadow follows the light. As a result, cybersecurity is becoming a strategic investment decision for investors and business leaders alike. Palo Alto and Fortinet stand out, building a moat through switching costs and network effects. Positioned for a potential industry consolidation, they navigate a fragmented landscape. Yet, amid this opportunity lies the ever-present challenge — the certainty of change. Adaptability is their constant ally.