From hedge fund favorites like CrowdStrike to a consumer market on track to nearly double by 2030, the security trade keeps finding fresh sources of demand.
Few corners of the market have held investor attention through 2026 as consistently as cybersecurity. Even after a sharp repricing of high-growth software names earlier in the year, money managers have kept rotating back into the group, drawn by a straightforward thesis: the cost of a breach keeps rising, and corporate security budgets are not where companies look to cut first. A Morgan Stanley survey of chief information officers found they expect security spending to outpace overall software spending by roughly 50 percent, a gap that helps explain why names like CrowdStrike (CRWD), Palo Alto Networks (PANW), Fortinet (FTNT) and Zscaler (ZS) still command valuations well above the broader market.
What draws less attention from institutional investors is how much of that demand now comes from ordinary people rather than IT departments. The global VPN market alone is on track to reach roughly $86 billion in 2026 and to nearly double to about $182 billion by 2030, expanding more than 20 percent a year, according to industry researchers. More than 1.75 billion people, close to one in three internet users, now route some of their traffic through a VPN, a figure that puts the category well past its old reputation as a tool for the technically inclined.
That shift carries a practical lesson for retail investors as well. Anyone who checks a brokerage balance from an airport lounge or logs into a banking app on hotel Wi-Fi is exposing login credentials on a network they do not control. Looking over a good free vpn option before traveling is one of the cheapest ways to lower that exposure, and the same security awareness pushing consumers toward these tools is part of the broader demand wave lifting the public companies named above.
The investment case keeps strengthening
The underlying thesis has, if anything, gotten firmer over the past year. The First Trust NASDAQ Cybersecurity ETF (CIBR) has gained roughly 15 percent, and the structural drivers behind the sector keep multiplying. The rise of AI-assisted attacks, in which automated systems probe for and exploit vulnerabilities at machine speed, has turned security from a discretionary line item into a board-level priority. Enterprise spending is accelerating rather than slowing.
Consolidation is reshaping the field in ways that reward scale. Palo Alto Networks has leaned into a platform strategy, bundling acquired capabilities into a single suite, while CrowdStrike has pushed into identity security to widen its addressable market. On the connectivity side, Cisco remains the largest single VPN provider with close to 18 percent of that market, followed by a mix of enterprise and consumer names including Palo Alto, Check Point, Fortinet and Nord Security, the company behind NordVPN. The breadth of that list is the point: demand is coming from corporate networks and household devices at the same time.
The risks investors are weighing
The catch is price. Valuations across the group entered 2026 at stretched levels, with CrowdStrike trading near 90 times forward earnings, Palo Alto around 55 times and Zscaler near 35 times, against roughly 21 times for the S&P 500. At those multiples, a single disappointing quarter from any market leader can trigger an outsized drawdown, which is exactly what played out during the growth-stock selloff in the first quarter of the year.
There is also a competitive overhang that pure-play vendors cannot easily price out. Microsoft has quietly built a security business worth an estimated $37 billion in annual revenue, larger than CrowdStrike, Palo Alto and Zscaler combined, and it bundles those features into enterprise agreements customers already pay for. For a company that licenses Microsoft 365 at the top tier, adding Defender and Sentinel costs almost nothing incremental, a dynamic that puts steady pressure on standalone providers.
The bottom line
The cybersecurity theme remains one of the more defensible growth stories in the market, supported by demand that runs from the data center down to the individual investor’s phone. But the sector trades at a premium for a reason, and position sizing and entry timing arguably matter more than picking a single winner. For investors who want exposure, dollar-cost averaging into the highest-quality names looks more prudent than committing all at once at current levels. The demand, on both the enterprise and consumer sides, appears structural. The valuations are the part that requires discipline.
