Loading story…
Large publicly traded cybersecurity companies experienced significant stock price gains in 2025, while smaller vendors generally saw declines in market capitalization. Of the 11 public cyber vendors with valuations exceeding $14.9 billion, nine recorded stock price increases, with only Fortinet and Gen Digital seeing marginal or meaningful drops. In contrast, all 12 vendors with valuations between $1.1 and $14.9 billion experienced a median stock price drop of 14.8%, and among vendors valued below $1.1 billion, most suffered large losses, with only a few exceptions.
This widening gap highlights a trend where investors increasingly view each security technology category as "winner-take-all," favoring established leaders such as Cloudflare, CrowdStrike, Rubrik, and Zscaler, which posted double-digit gains in their respective sectors. The divergence in stock performance became even more pronounced when considering results from both 2024 and 2025, with nearly all consistent gainers being large-cap companies, while persistent losers were predominantly smaller firms. This market dynamic underscores the growing challenges faced by smaller cybersecurity vendors in a consolidating industry landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In 2025, Palo Alto Networks agreed to acquire CyberArk for $25 billion, one of the year's most significant cybersecurity M&A deals. The transaction underscored the strategic importance of identity security and continued consolidation among top vendors.
Zscaler also purchased SPLX in 2025, continuing its acquisition-driven growth and strengthening its position in a market increasingly seen as favoring category leaders.
In 2025, Zscaler acquired Red Canary as part of its expansion strategy, one of several deals that helped reinforce investor preference for larger cybersecurity platforms.
SailPoint also completed an IPO in 2025, highlighting continued investor interest in selected cybersecurity firms despite weaker overall performance across the sector.
Netskope was among the cybersecurity companies that went public in 2025, marking a significant capital-markets event amid broader sector consolidation and uneven investor sentiment.
During 2025, Cloudflare took action to block unauthorized AI web crawlers, a notable product and policy move tied to the growing importance of AI-related security and internet infrastructure controls.
Across 2025, publicly traded cybersecurity vendors split into clear winners and losers, with 12 companies posting gains and 19 declining. Large platform vendors generally outperformed while many smaller and legacy firms, especially in vulnerability management and endpoint security, lost market value.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity threats in 2025 have evolved, with attackers increasingly targeting small and medium-sized businesses (SMBs) due to improved defenses and ransom resistance among larger enterprises. Research highlights that four in five SMBs have suffered recent data breaches, with attackers leveraging the relative lack of resources and security maturity in these organizations. Ransomware remains a significant threat, with 83% of successful attacks compromising identity infrastructure such as Active Directory, and most incidents occurring during periods of organizational distraction, such as holidays or major corporate events. The holiday shopping season also presents heightened risks, as cybercriminals exploit increased online transactions, new account creation, and gift card exchanges to target both consumers and retailers. Systemic risks are amplified by the widespread outsourcing of cybersecurity functions, where a single compromised vendor can cascade risk across hundreds of organizations, as seen in high-profile supply chain breaches. The looming threat of quantum computing is also prompting urgent calls for organizations to begin migrating to post-quantum cryptography, as nation-state actors are already harvesting encrypted data for future decryption. These trends underscore the need for proactive, resilient security strategies, robust identity infrastructure protection, and a forward-looking approach to cryptographic agility to address both current and emerging threats.
Jun 29, 2026
The cybersecurity industry is characterized by constant change, requiring professionals and organizations to adapt quickly to new threats, technologies, and business realities. One perspective emphasizes the importance of cultivating a proactive and resourceful mindset among cybersecurity practitioners. This approach, often described as the "Just Figure It Out" mentality, encourages individuals to leverage the vast array of information and tools now available, from advanced search engines to large language models, to solve problems efficiently and stay ahead of adversaries. Security teams are urged to continuously update their knowledge base, experiment with new tools, and remain agile in the face of evolving attacker tactics. The ability to rapidly acquire new skills and adapt to shifting circumstances is seen as a key driver of career and organizational success in cybersecurity. On the other hand, there is a growing debate about the effectiveness of traditional security investments, particularly in the context of venture capital and the broader technology market. Some industry voices argue that the security sector, while large and well-funded, rarely produces the kind of massive financial returns seen in other areas of technology. This has led to questions about whether continued investment in standalone security companies is the best approach, or if resources should instead be directed toward platforms that integrate security as a core use case. The rise of artificial intelligence is also reshaping the security landscape, introducing new risks and operational challenges while simultaneously offering opportunities for innovation. Investors and practitioners alike are re-evaluating the business models and strategies that will define the next era of cybersecurity. The discussion includes reflections on the capital-intensive nature of security startups, the limited number of billion-dollar exits, and the shifting priorities of private equity and venture capital firms. Both perspectives highlight the need for adaptability, whether in individual skill development or in organizational investment strategies. The convergence of technological advancement, market dynamics, and evolving threat models underscores the complexity of securing digital assets in the modern era. Security leaders are encouraged to foster a culture of continuous learning and to critically assess where and how they allocate resources. The debate reflects broader questions about the future of the cybersecurity industry and the most effective ways to achieve resilience and growth. Ultimately, success in cybersecurity may depend as much on mindset and strategic investment as on technical solutions. The industry must balance the need for innovation with the realities of market economics and the relentless pace of change. As new tools and platforms emerge, both individuals and organizations must remain vigilant and adaptable to maintain a robust security posture.
Jul 12, 2026
Major cybersecurity vendors and analysts released comprehensive reports and predictions summarizing the most significant trends, risks, and technological shifts observed in 2025. Cloudflare's annual Year in Review emphasized a dramatic increase in global internet traffic, the growing adoption of post-quantum encryption, and a surge in record-breaking DDoS attacks, reflecting both the opportunities and threats posed by rapid digital transformation. Trend Micro's Defenders Survey Report, based on responses from over 3,000 cybersecurity professionals worldwide, identified cloud and AI as key risk factors, underscoring the mounting pressures on security teams and the need for holistic risk management strategies. Industry thought leaders and security experts also provided forward-looking perspectives and practical guidance. Omdia analysts outlined five network security predictions for 2026, with a strong focus on the integration of AI and the evolution of zero trust architectures. Red Hat security experts advocated for the adoption of established frameworks like MITRE ATLAS and NIST to address the unique risks associated with AI systems, while Cato Networks' CISO shared actionable advice for cybersecurity professionals, emphasizing the importance of thinking like an attacker and fostering diverse skill sets. Collectively, these reports and expert insights offer a multifaceted view of the evolving cybersecurity landscape, highlighting both the challenges and the proactive measures organizations are taking to adapt.
Jun 29, 2026