A month after the SolarWinds hack was first reported, there are quite a few signs suggesting 2021 will be a banner year for security tech spending.
A slew of sell-side analyst reports have arrived over the last few weeks reporting that the SolarWinds hack, which stemmed from thousands of corporate and government users of SolarWinds infrastructure management software downloading malware-infected updates, is sparking an uptick in IT security spending interest and activity. A few examples:
- Following talks with CIOs and CISOs in the wake of the SolarWinds hack, Wedbush's Dan Ives forecast cybersecurity spending, which has generally been growing at a high-single digit rate in recent years, would grow around 20% in 2021.
- In his earnings season preview for enterprise software firms, Mizuho's Gregg Moskowitz forecast the SolarWinds hack will "elevate C-level/Board conversations and trigger additional [security] spend from governments and organizations in 2021." He added that Mizuho has already heard of a couple of major security deals being fast-tracked.
- D.A. Davidson's Andrew Nowinski upgraded Fortinet (FTNT) and CyberArk (CYBR) to Buy on Tuesday, while citing positive Q4 reseller checks. In CyberArk's case, Nowinski said the SolarWinds hack was a contributor to inflecting demand.
In addition, Tufin Software (TUFN) , a provider of software for managing network security policies, recently hiked its Q4 guidance. And execs at security software firms such as CrowdStrike (CRWD) and Okta (OKTA) have brought up how the SolarWinds hack has sparked greater awareness at major enterprises about the need to adopt zero-trust security architectures and protect a wide variety of attack surfaces.
Of course, 2020 was already a pretty strong year for many security tech firms. In particular, providers of cloud-based security software and services that help secure remote devices and/or provide remote workers with secure access to corporate apps and data (think names such as CrowdStrike, Okta and Cloudflare (NET) ) often did quite well for themselves, and were richly rewarded by markets along the way.
On the other hand, security tech firms whose sales depended heavily on on-premise deployments of their products often saw their shares underperform. And with some of these companies likely to see demand boosts in the wake of the SolarWinds hack, that might create an opportunity or two.
CyberArk, whose software helps protect and manage privileged corporate accounts, is one such name. Splunk (SPLK) , whose software (among other things) allows IT security teams to comb through mountains of log data to uncover signs of a breach, might be another beneficiary.
FireEye (FEYE) , which is well-known for its incident response/forensics services (and uncovered the SolarWinds hack while probing the hacking of its own infrastructure), is another clear beneficiary whose multiples (in spite of a recent surge) aren't all that high.
Ives recently made a case for Telos (TLS) , a security software firm that went public in November and gets over 90% of its revenue from federal clients, as a company likely to get a sales boost from the SolarWinds hack. "With Homeland Security, DOJ, and a number of other key government agencies impacted by this nation state attack (Russia likely the source), we believe the Biden team clearly recognizes cyber espionage, cyber terrorism, and other malicious actors pose a dark threat to the underlying US IT infrastructure," he wrote.
Ultimately, however, there should be quite a few companies that get a tailwind here. The way things are looking right now, the hack isn't simply going to make companies and government agencies more keen on deploying certain security offerings, but stands to turn security spending in general into a greater priority for many senior decision-makers.
