What it holds
Cybersecurity Spend follows the money through the Cybersecurity bill of materials: the parts it takes to build it, and the companies that earn their revenue supplying them. Each company is read from its own reports, so a holding reflects what it actually sells into the theme, not what it says about it.
| Part | What it covers |
|---|---|
| Firewall subscriptions and virtual firewalls | ngfw security subscriptions, virtual cloud firewalls, intrusion prevention software, firewall policy management |
| Secure Access Service Edge / Security Service Edge | secure web gateway, casb, ztna, firewall as a service, sase platforms |
| Web application, API, DDoS and bot protection | web application firewall waap, api security, ddos mitigation, bot management |
| Email and messaging security | email security gateways, cloud email security, collaboration messaging security |
| OT/IoT security and network access control | ot ICs security, iot device security, network access control |
| Endpoint protection and EDR | endpoint protection platforms, edr xdr endpoint, mobile threat defense |
| Access management | workforce access management, mfa authentication software, customer iam |
| Privileged access, identity governance and machine identity | privileged access management, identity governance administration, identity threat detection, pki certificate lifecycle |
| Cloud and workload security | data center security software, cnapp cspm, cloud workload protection, container kubernetes security |
| Data security and privacy | data loss prevention, dspm, encryption key management software, database security, data privacy management |
| Application security | application security testing, software composition analysis, software supply chain security, runtime app protection |
| SIEM, SOAR and security analytics | siem platforms, soar automation, ueba security analytics, security data lake |
| Threat intelligence and digital risk protection | threat intelligence platforms, digital risk protection |
| Exposure and vulnerability management | vulnerability management, attack surface management, breach attack simulation |
| Security GRC and awareness training | security grc software, security awareness training, third party risk ratings |
| Managed security services and MDR | managed security services, managed detection response, managed soc |
| Security consulting, integration and incident response | security consulting, security integration services, penetration testing services, incident response forensics |
| Network security appliances | firewall appliances, utm appliances, cross domain data diodes, appliance support maintenance |
| Hardware security modules and authenticators | hardware security modules, authentication tokens smart cards |
| Security silicon | fpgas, DPU SmartNIC, ethernet switch silicon, embedded mpus dsp, security network processors, secure element ICs |
| Security distribution and resale | security value added distribution, security reselling var |
How it breaks down
- United States79%
- China21%
- Mega cap (over $200bn)9%
- Large cap ($10bn to $200bn)35%
- Mid cap ($2bn to $10bn)27%
- Small cap (under $2bn)29%
Shares of the strategy as of the data date.
Largest companies
| Company | Listing | Market value |
|---|---|---|
| Varonis Systems | VRNS.XNAS | $6 billion |
| DBAPPSecurity | 688023.SHG | $753 million |
| Qi An Xin Technology Group | 688561.SHG | $3 billion |
| Telos | TLS.XNAS | $441 million |
| Climb Global Solutions | CLMB.XNAS | $618 million |
| Check Point Software Technologies | CHKP.XNAS | $16 billion |
| OneSpan | OSPN.XNAS | $740 million |
| Qualys | QLYS.XNAS | $8 billion |
| Fortinet | FTNT.XNAS | $128 billion |
| Palo Alto Networks | PANW.XNAS | $323 billion |
| CrowdStrike Holdings | CRWD.XNAS | $273 billion |
| Rapid7 | RPD.XNAS | $1 billion |
| SailPoint | SAIL.XNAS | $13 billion |
| Netskope | NTSK.XNAS | $11 billion |
| SentinelOne | S.XNYS | $9 billion |
Questions
- What is Cybersecurity Spend?
- Everything enterprises and governments spend to secure their systems: network, endpoint, identity, cloud, data, security operations, services and hardware.
- What does Cybersecurity Spend hold?
- Listed companies that earn their revenue from the parts it takes to build Cybersecurity: Firewall subscriptions and virtual firewalls, Secure Access Service Edge / Security Service Edge, Web application, API, DDoS and bot protection, Email and messaging security, OT/IoT security and network access control, Endpoint protection and EDR. 26 companies as of 2026-10-28.
- What is not in Cybersecurity Spend?
- XDR: Endpoint protection and EDR when priced per endpoint agent, SIEM, SOAR and security analytics when priced by data ingest, not the other; classify by vendor's primary price metric Reseller and distributor margin: Security distribution and resale, not the product bucket; product buckets are weighted at vendor net sell-in price Managed operation fees: Managed security services and MDR, not product buckets; separable licences stay in product bucket
Sources
Every part of the bill of materials is researched from published industry sources, and every company from its own annual reports and exchange data. Nothing is estimated that cannot be sourced.
Industry research: expertinsights.com/security-operations/siem-market-overview- · softwarestrategiesblog.com/2026/04/01/top-10-fastest-growing · delloro.com/news/ai-ready-sase-branch-architectures-push-2q- · delloro.com/news/network-security-climbs-12-percent-to-6-2-b · delloro.com/news/single-vendor-sase-platforms-propel-revenue · fortunebusinessinsights.com/email-security-market-106607 · gartner.com/en/newsroom/press-releases/2025-07-29-gartner-fo · kuppingercole.com/press-release/market-sizing-siem
What it is not
Where an item could belong to two parts, these rules decide which owns it; items outside every part are not counted.
- XDR: Endpoint protection and EDR when priced per endpoint agent, SIEM, SOAR and security analytics when priced by data ingest, not the other; classify by vendor's primary price metric
- Reseller and distributor margin: Security distribution and resale, not the product bucket; product buckets are weighted at vendor net sell-in price
- Managed operation fees: Managed security services and MDR, not product buckets; separable licences stay in product bucket
- Installation and deployment labour: Security consulting, integration and incident response, not the product bucket or Security distribution and resale, unless included in vendor product price
- Vendor-hosted firewall-as-a-service: Secure Access Service Edge / Security Service Edge, not Firewall subscriptions and virtual firewalls; customer-deployed virtual firewalls in VPCs: Firewall subscriptions and virtual firewalls, not Cloud and workload security; datacenter microsegmentation: Cloud and workload security
- Threat intelligence: Threat intelligence and digital risk protection only when sold as a separate SKU, Firewall subscriptions and virtual firewalls or Endpoint protection and EDR when bundled in subscription
- Appliance hardware support and maintenance: Network security appliances, not Firewall subscriptions and virtual firewalls; security service subscriptions: Firewall subscriptions and virtual firewalls, not Network security appliances
- ITDR: Privileged access, identity governance and machine identity, not Endpoint protection and EDR or SIEM, SOAR and security analytics
- Cloud HSM appliance and dedicated HSM: Hardware security modules and authenticators; software or SaaS key management: Data security and privacy, not Hardware security modules and authenticators
- Human-led PTaaS: Security consulting, integration and incident response, not Exposure and vulnerability management or Managed security services and MDR; automated BAS and scanning platforms: Exposure and vulnerability management
- Recurring government SOC contracts: Managed security services and MDR, not Security consulting, integration and incident response; time-bound programs: Security consulting, integration and incident response
- Runtime API protection and discovery: Web application, API, DDoS and bot protection, not Application security; pre-production API testing: Application security
- Content DLP policy on email: Data security and privacy, not Email and messaging security; threat and phishing filtering: Email and messaging security
- ZTNA: Secure Access Service Edge / Security Service Edge, not OT/IoT security and network access control or Access management; on-premises NAC and device posture: OT/IoT security and network access control
Not investment advice. Figures are dated and sourced; ThematIQ does not estimate figures it cannot source.