Cybersecurity underwent a structural transformation in 2024. What began the year as a sector still recovering from the 2022–2023 valuation reset ended it as one of technology's strongest performers - driven by three converging forces: an escalating volume and sophistication of cyberattacks, the rapid adoption of AI by both attackers and defenders, and a decisive shift in enterprise purchasing toward consolidated, platform-based security spending. The ten stocks below represent the sector's best performers year-to-date through November 8, 2024, ranked in ascending order by total return and accompanied by hedge fund ownership data as an additional lens on institutional conviction.
Why 2024 Was a Breakout Year for Cybersecurity
The cybersecurity sector entered 2024 with momentum but also with scars. CrowdStrike's faulty software update in July triggered one of the largest IT outages in history, temporarily wiping nearly 44% from its share price and raising questions about concentration risk in security platforms. Yet by November, CRWD had substantially recovered - a testament to the depth of enterprise dependency on best-in-class security tools and the difficulty of switching away from deeply embedded platforms. The incident underscored a paradox at the heart of cybersecurity investing: even a company that causes a global outage can retain customers because the switching costs and integration complexity of replacing a platform like Falcon are simply too high for most organisations to absorb.
Beyond CrowdStrike, three broader themes drove sector outperformance. First, AI-driven threat escalation: the World Economic Forum's Global Cybersecurity Outlook report warned that AI would push cyber incidents and data breaches to record levels, with breaches already up 72% year-over-year before 2024 began. Second, platform consolidation: enterprises rationalising security vendor counts favoured comprehensive platform providers - Palo Alto's Precision AI platformisation strategy and Fortinet's unified threat management approach - over point-solution specialists. Third, government and defence spending: with geopolitical tensions elevated globally, government cybersecurity contracts tied to zero trust architectures, AI-augmented threat detection, and critical infrastructure protection grew significantly, directly benefiting Leidos, General Dynamics, and CyberArk.
AI as Both Threat and Defence
AI is reshaping cybersecurity from both sides simultaneously. Attackers use large language models to generate convincing phishing content, automate vulnerability scanning, and accelerate exploit development. Defenders deploy AI for anomaly detection, automated threat hunting, and reducing mean-time-to-respond. The global AI-cybersecurity market grew from $15 billion in 2021 and is tracking toward $135 billion by 2030.
Platform Consolidation Wave
CFOs under pressure are rationalising security vendors. Palo Alto Networks pioneered this trend with its "platformisation" strategy - acquiring IBM's QRadar SaaS assets in 2024 to consolidate customers onto Cortex XSIAM. Smaller single-product companies face growing pressure as buyers prefer fewer, deeper vendor relationships with comprehensive platforms that reduce integration complexity and vendor management overhead.
Zero Trust Federal Mandates
The US federal government's mandate for agencies to adopt zero trust security frameworks by 2024 created a substantial spending cycle that benefited contractors with security clearances and existing agency relationships. Leidos, General Dynamics IT, and CyberArk - for privileged access management - were direct beneficiaries of this mandate-driven spending surge across defence and civilian agencies.
SMB Security Gap
A Microsoft Security survey found fewer than one-third of small and mid-sized businesses handle cybersecurity internally - most rely on consultants or managed service providers. This creates a large addressable market for cloud-native security platforms that reduce the expertise barrier. Cloudflare's Zero Trust and SASE offerings and Varonis' data security platform specifically target organisations that lack in-house security teams.
The Rankings: YTD Performance Through November 8, 2024
Best Performing Cybersecurity Stocks - Year-to-Date Return & Hedge Fund Holders
YTD performance as of November 8, 2024. Hedge fund holder count from Q3 2024 13F filings. Source: Insider Monkey / cybersecurity ETF holdings analysis.
| Rank | Company | Ticker | YTD Return | HF Holders | Primary Cybersecurity Segment |
|---|---|---|---|---|---|
| 1 | Leidos Holdings | NYSE: LDOS | 38 | Government IT / Zero Trust / Defence Cyber | |
| 2 | Broadcom | NASDAQ: AVGO | 130 | Symantec Enterprise / AI Semiconductor | |
| 3 | Fortinet | NASDAQ: FTNT | 42 | Network Firewall / Unified Threat Management | |
| 4 | CyberArk Software | NASDAQ: CYBR | 55 | Identity Security / Privileged Access Mgmt | |
| 5 | Palo Alto Networks | NYSE: PANW | 66 | AI Security Platform / SASE / XDR | |
| 6 | CrowdStrike | NASDAQ: CRWD | 69 | Endpoint Protection / Falcon AI Platform | |
| 7 | Juniper Networks | NYSE: JNPR | 45 | Network Security / AI Networking | |
| 8 | General Dynamics | NYSE: GD | 48 | Defence Cyber / Encryption / Government IT | |
| 9 | Varonis Systems | NASDAQ: VRNS | 36 | Data Security / User Behaviour Analytics | |
| 10 | Cloudflare | NYSE: NET | 39 | Zero Trust / SASE / Edge Security |
YTD performance as of November 8, 2024. Hedge fund data from Q3 2024 13F filings. Source: Insider Monkey analysis of cybersecurity ETF holdings.
Stock-by-Stock: What Drove Each Company's Performance
Leidos Holdings - The Surprise Leader
Leidos is not typically the first name that comes to mind in a cybersecurity conversation - most investors associate the sector with Silicon Valley pure-plays. But this Reston, Virginia-based firm is a comprehensive cybersecurity provider to the US government, and 2024 proved to be its year. Its portfolio spans offensive and defensive cyber operations, zero trust architecture implementation, quantum cryptography, and the proprietary PACKIT™ (Proven, Analytic-Centric Kill Chain Implementation and Transformation) framework. Its work with the Department of Defense and Department of Homeland Security requires the highest security clearances and the most demanding performance standards.
The fundamental driver of the 83.72% return was exceptional execution in a favourable government spending environment. Leidos delivered its sixth consecutive quarter of growth in Q3 2024, with quarterly revenue of $4.19 billion (up 7% year-over-year), a record adjusted EBITDA margin of 14.2%, and a 44% increase in adjusted diluted EPS. Its total backlog reached $37.7 billion, providing extraordinary revenue visibility. Full-year 2024 guidance was raised to $16.35–$16.45 billion.
Broadcom - AI Powerhouse With a Cybersecurity Layer
Broadcom's presence in a cybersecurity ranking may surprise investors who primarily associate it with semiconductors, networking chips, and the 2023 VMware acquisition. But Broadcom owns the Symantec Enterprise Cloud platform - one of the most comprehensive enterprise security suites available - alongside solutions covering payment security, mainframe security, network security, endpoint protection, and identity management. Its 130 hedge fund holders make it by far the most institutionally owned name on this list, reflecting its status as a diversified technology conglomerate with enormous free cash flow generation.
The 69.19% return in 2024 was primarily driven by Broadcom's AI semiconductor business: its custom AI accelerator chips and ethernet networking solutions for hyperscaler data centers generated $12 billion in AI revenue for fiscal 2024. In Q3 2024, Broadcom reported $13.1 billion in revenue - a 47% year-over-year increase - driven by strong AI revenue, VMware bookings, and solid non-AI semiconductor performance. Looking to Q4 2024, the company projected AI revenue rising 10% sequentially to $3.5 billion. Bank of America reaffirmed a Buy rating on November 5, citing AI computing and networking leadership alongside strong free cash flow generation.
Fortinet - Firewall Cycle Recovery Delivers 59% Return
Fortinet protects over 700,000 organisations worldwide - more than any other cybersecurity company - spanning enterprises, service providers, and government agencies. It holds the global market share leadership position in network security firewalls by units shipped, alongside intrusion prevention systems, unified threat management, and the AI-powered FortiAI suite. FortiAI for FortiNDR Cloud assists threat hunters by analysing and correlating complex detections; FortiAI for Lacework FortiCNAPP provides AI-powered alert context and remediation guidance to security operations teams.
Fortinet's 59.29% return reflected the resolution of the sector's most discussed concern: the firewall product replacement cycle. After elevated channel inventory following the post-pandemic buying surge, Q3 2024 results showed a significant billings beat with accelerating bookings growth - confirming the firewall cycle had turned positive. Adjusted Q3 EPS of $0.63 beat the $0.52 consensus; revenue of $1.51 billion exceeded forecasts by $30 million with 13% year-over-year growth. Service revenue - the higher-quality recurring component - grew 19.1% year-over-year to $1.03 billion. Full-year 2024 guidance was raised to $5.86–$5.92 billion.
CyberArk Software - Identity Security at the Frontier
CyberArk is the global leader in identity security - the discipline of controlling which human users, machines, and automated processes can access which systems and data. This is not a peripheral concern: the vast majority of significant data breaches involve compromised credentials or improper access privileges. CyberArk's privileged access management (PAM) platform secures the highest-value access points: administrator accounts, service accounts, cloud infrastructure credentials, and developer pipelines across financial services, energy, retail, healthcare, and government customers.
In early October 2024, CyberArk completed its acquisition of Venafi - the leader in machine identity management - expanding its total addressable market by $10 billion to approximately $60 billion. Machine identity is one of the fastest-growing and least-understood challenges in enterprise security: as organisations deploy more microservices, containers, and AI agents, the number of machine identities requiring management has exploded. Q2 2024 showed 28% revenue growth to $224.7 million and a 50% increase in Annual Recurring Revenue to $868 million. Oppenheimer, Scotiabank (Sector Outperform, $340 target), and Baird (Outperform, $315 target) all maintained positive ratings.
Palo Alto Networks - The Platformisation Play
Palo Alto Networks is one of the world's largest cybersecurity companies and the most prominent advocate for vendor consolidation in enterprise security. Its "platformisation" strategy - encouraging customers to standardise on Palo Alto's integrated suite across network security, cloud security, and security operations - is a bold bet that the economics of vendor consolidation will overcome the inertia of existing deployments. In 2024, that strategy gained tangible traction. In September, PANW completed the acquisition of IBM's QRadar SaaS assets, migrating IBM's SIEM customer base to Cortex XSIAM - its AI-powered security operations platform using Precision AI to automate threat detection and response at machine speed.
Oppenheimer raised its price target from $410 to $450 on October 22, maintaining an Outperform rating, citing Palo Alto's steady execution and the success of its platformisation strategy as key factors in its growth prospects. The company was tracking to meet Q1 FY2025 revenue guidance of $2.10–$2.13 billion, with the consensus at $2.121 billion. Palo Alto had already told the market that 2024 was proving to be a landmark year in the utilisation of AI in cybersecurity - and it predicted the best was yet to come.
CrowdStrike - Remarkable Recovery After the July Outage
CrowdStrike's 2024 is a case study in the resilience of deeply embedded enterprise software. In July, a faulty content update to its Falcon sensor caused approximately 8.5 million Windows devices to display the Blue Screen of Death - shutting down airlines, hospitals, banks, and broadcasters in one of the most disruptive IT incidents in history. CRWD's share price fell nearly 44% within two weeks, bottoming in early August. By November, the stock had recovered substantially - delivering 33.67% year-to-date despite the crash. The recovery reflects the extraordinary switching costs of a deeply integrated security platform and the company's transparent, accountable response, including flexible commercial terms for affected customers.
CrowdStrike's AI-native Falcon platform continued driving adoption despite the outage: Falcon ARR growth reached 80% year-over-year in Q2 FY2025, and Q2 results showed 32% year-over-year revenue growth alongside an operating profit compared to a loss the prior year. Net income per share rose to $0.19 from $0.03 a year earlier. Management targets $10 billion in annual recurring revenue by the end of fiscal 2029. By November, 34 Wall Street analysts rated the stock a Buy - with only six neutral ratings - reflecting restored institutional conviction in CrowdStrike's long-term competitive position.
Juniper Networks - AI Networking Demand & Acquisition Premium
Juniper Networks is a global leader in networking technology whose cybersecurity portfolio includes enterprise firewalls, malware protection, anti-malware software, and data center service gateways. Its Connected Security framework embeds threat intelligence across the entire network fabric - from end-user devices through switches and routers to the cloud - rather than deploying security as a separate overlay. The 32.62% year-to-date gain was supported by its pending acquisition by Hewlett Packard Enterprise - announced in January 2024 at $14 billion - which provided a floor under the share price while the deal navigated regulatory approval.
Operationally, Q3 2024 results were driven by recovering enterprise demand in cloud and AI networking. Adjusted EPS of $0.48 beat the $0.45 estimate; revenue of $1.33 billion exceeded the $1.27 billion forecast. CEO Rami Rahim noted that total product orders grew nearly 60% year-over-year during the quarter - a significant re-acceleration from the inventory digestion cycle that had weighed on networking hardware vendors through much of 2023. A quarterly dividend of $0.22 per share was declared.
General Dynamics - Defence Cyber at Scale
General Dynamics' Information Technology (GDIT) division is one of the largest cybersecurity providers to the US government - providing hardware security products including Type 1 encryption devices for classified communications alongside a full range of SaaS security solutions, zero trust implementation services, and AI/ML-enhanced threat analytics. In September 2024, GDIT acquired Iron EagleX - a specialised AI/ML, cybersecurity, and cloud services provider focused on Special Operations Forces and the intelligence community - broadening its advanced technology capabilities for the most sensitive defence missions.
General Dynamics' Q3 2024 results showed 10.4% revenue growth to $11.67 billion, driven by 22% Aerospace growth and 20% Marine Systems growth. Year-to-date revenue reached $34.4 billion with net income of $2.63 billion. The total backlog grew to $92.6 billion alongside a record estimated contract value of $137.6 billion - providing exceptional multi-year revenue visibility that distinguishes defence cyber companies from commercial software peers when investors are assessing earnings durability.
Varonis Systems - Data Security in the SaaS Transition
Varonis specialises in a frequently underappreciated corner of enterprise cybersecurity: the governance and security of unstructured data - the emails, documents, spreadsheets, and files that represent most sensitive corporate information but are typically far less well-protected than structured databases. Its platform uses User and Entity Behaviour Analytics (UEBA) to establish baselines of normal data access patterns and flag anomalous activity indicating insider threats, compromised credentials, or ransomware staging. The company is headquartered in New York with R&D operations in Herzliya, Israel.
Varonis delivered a strong Q3 2024 earnings report: Net New Annual Recurring Revenue exceeded estimates by approximately $5 million, and overall ARR grew 18% year-over-year (13% excluding SaaS conversions from perpetual license customers). Growth was driven by customer conversions, new enterprise logo acquisitions, expansion of its Managed Detection and Response (MDDR) service, and early contributions from GenAI and Microsoft Copilot security products. Full-year FY2025 ARR growth was guided at 17–18% year-over-year. DA Davidson raised its price target to $50 (from $47) while maintaining a Neutral rating.
Cloudflare - Zero Trust & SASE at the Global Edge
Cloudflare operates one of the world's largest and most interconnected global networks - spanning more than 300 cities and handling a significant share of internet traffic - making it a foundational infrastructure provider for both cybersecurity and AI inference at the edge. Its security portfolio includes Zero Trust Network Access, Secure Web Gateway, Cloud Email Security, API security, DDoS protection, and its Cloudflare One SASE platform. In May 2024, Cloudflare acquired BastionZero to enhance Cloudflare One with secure infrastructure access, providing a VPN replacement covering both applications and infrastructure resources. The company also acquired GPUs to enable customers to deploy AI models - including generative AI - directly at the edge of its network, positioning Cloudflare as a security-plus-inference layer for the AI era.
The 15.00% year-to-date return - the list's lowest but still a meaningful outperformer - reflected strong operational metrics alongside some macro uncertainty. Revenue grew 30% year-over-year in Q2 2024, with customers spending over $100,000 annually growing to 67% of total revenue from 62% in Q1 2023. CEO Matthew Prince's comments about geopolitical uncertainty affecting buying behaviour in certain international markets created near-term caution, but underlying demand metrics remained robust. Citi maintained a Neutral rating with a $90 price target following Cloudflare's October product announcements, citing positive SASE momentum but a current valuation already reflecting considerable optimism.
What 2024 Revealed About Cybersecurity's Structural Shift
The ten stocks on this list are not simply beneficiaries of a threat-driven spending cycle. They are evidence of a sector reorganising itself around a new architectural logic. For most of the 2010s, cybersecurity buyers assembled stacks of specialised point products - one vendor for endpoint, another for network, another for identity, another for cloud. The proliferation worked until the complexity became the vulnerability: too many consoles, too many alert streams, too many handoff points between products that were never designed to talk to each other. What 2024 confirmed is that the enterprise buyer has absorbed this lesson and is acting on it. The winners of this ranking - CrowdStrike, Palo Alto Networks, Fortinet, CyberArk - are all platform providers. The pattern is not coincidental.
The CrowdStrike July outage is the most instructive data point in the entire year. A single software update from a security vendor simultaneously crashed 8.5 million Windows machines worldwide - the largest IT outage in history. By conventional logic, this should have been an extinction-level customer retention event. Instead, CrowdStrike finished the year up 33.67%. The explanation is switching costs, and they proved to be far more durable than the market initially credited. Ripping out Falcon and replacing it across a large enterprise requires months of migration work, retraining, procurement cycles, and reintegration with adjacent tools. For most organisations, that operational disruption carries more risk than staying with a vendor that caused a recoverable incident. The outage did not weaken the platform thesis - it stress-tested it in live conditions and the thesis held.
The leading indicator to watch for the sector's next leg is not revenue growth or hedge fund ownership - it is which companies are building AI-native security tools that generate their own threat intelligence rather than relying on curated signature databases. Legacy security architecture is reactive: a signature is written after a threat is observed. The structural edge belongs to platforms that use machine learning across hundreds of millions of endpoints to identify novel attack patterns before they are widely documented. CrowdStrike's Charlotte AI and Palo Alto's Precision AI are early examples of this approach, and both companies are investing disproportionately in this capability. The gap between vendors that can do this and those that cannot will define sector leadership through the end of the decade - and it is not a gap that can be closed by a smaller point-solution competitor simply adding an "AI" label to its marketing materials.
What Hedge Fund Ownership Reveals - and the Investor Framework
The correlation between hedge fund ownership and returns on this list is deliberately inverted from what many investors might expect. Broadcom, with by far the most holders (130), delivered the second-best return. Leidos, the top performer, had only 38 hedge fund holders. This divergence has a clear explanation: Broadcom is a high-conviction, widely-understood large-cap technology holding that most sophisticated investors already own for AI exposure. Leidos is a defence contractor that the majority of technology-focused hedge funds have never modelled as a cybersecurity investment. Its outperformance is partly attributable to this under-ownership - as results consistently exceeded expectations, the institutional ownership base was forced to grow, creating sustained buying pressure throughout the year. The pattern suggests that alpha in cybersecurity comes from identifying companies whose security capabilities are underappreciated relative to their primary sector classification.
Investment Framework: Assessing Cybersecurity Stocks Beyond the Headlines
- Annual Recurring Revenue (ARR) and Net Revenue Retention (NRR): The most important metrics for cybersecurity software companies. High NRR (above 120%) indicates customers are expanding their spending - a strong signal of product-market fit and platform stickiness. CyberArk's 50% ARR growth and Varonis' steady ARR expansion are both indicators of healthy business momentum deserving premium valuations
- Platform vs. point solution: The consolidation trend strongly favours integrated platform providers. Palo Alto Networks and CrowdStrike, offering multi-product platforms covering endpoint, cloud, and security operations, are better positioned to win and retain large enterprise contracts than point-solution specialists, even if individual modules are not best-of-breed on every single dimension
- Government exposure as a stability differentiator: Leidos and General Dynamics demonstrate that government cybersecurity contracts - multi-year, large backlogs, zero trust mandates, national security priority - offer superior earnings stability compared to commercial software cycles. Defence cyber companies typically trade at lower multiples than commercial pure-plays despite comparable or superior revenue visibility
- The identity security megatrend: CyberArk's 2024 performance reflects the growing recognition that identity security is the foundational layer of modern cybersecurity. As organisations expand cloud footprints and deploy AI agents, automated workloads, and IoT devices, both human and machine identity management needs will grow dramatically through the end of this decade
- AI as a structural growth amplifier: Every company on this list is investing in AI-augmented security capabilities. The distinction that matters for investors is whether AI is improving defensible competitive moats (Fortinet's FortiAI threat detection, CrowdStrike's Falcon AI-native platform) versus serving primarily as a marketing narrative. Companies that can demonstrate AI driving measurable improvements in threat detection rates, false positive reduction, or analyst productivity are building structural long-term advantages
- Geopolitical tailwind durability: The elevated global threat environment - driven by state-sponsored cyber operations from Russia, China, North Korea, and Iran - is not cyclical. It is a structural feature of the current geopolitical landscape that will sustain defence and government cybersecurity budgets even if discretionary IT spending faces pressure in a weaker economic environment
Key Takeaways
- Leidos Holdings (+83.72%) was the best-performing cybersecurity stock of 2024 - a defence and government IT contractor whose zero trust, quantum cryptography, and offensive/defensive cyber capabilities made it a primary beneficiary of federal security mandates, with six consecutive quarters of growth and a record 14.2% adjusted EBITDA margin in Q3
- Broadcom (+69.19%) ranked second primarily on AI semiconductor strength - $12 billion in AI revenue for fiscal 2024 - illustrating that many large-cap "cybersecurity" stocks derive the majority of their value from adjacent technology businesses
- Fortinet (+59.29%) delivered the third-best performance as its long-anticipated firewall product replacement cycle finally turned positive in Q3 2024, with billings materially beating estimates and product orders growing nearly 60% year-over-year
- CrowdStrike (+33.67%) achieved a positive year-to-date return despite its stock falling nearly 44% following the July 2024 global IT outage - demonstrating exceptional customer retention and switching cost dynamics
- CyberArk (+36.31%) was the standout identity security performer, with its Venafi acquisition adding $10 billion of addressable market in machine identity management
- $10.5 trillion in annual cyberattack damages projected by 2025 makes cybersecurity spending one of the few IT budget categories that remains genuinely non-discretionary even during economic downturns
- AI-driven cybersecurity market projected to reach $135 billion by 2030 (from $15 billion in 2021) - with AI simultaneously increasing attack sophistication and defence capability
- Platform consolidation is the most important structural purchasing trend: enterprises rationalising vendor counts are directing more security budgets toward comprehensive platforms at the expense of single-product specialists
- Under-owned outperformance: The best-performing stock (Leidos, 38 HF holders) was among the least institutionally owned - suggesting that identifying under-owned companies whose cybersecurity capabilities are underappreciated is a productive source of alpha
- Non-discretionary demand floor: All ten stocks share one characteristic - their security offerings address threats that are non-discretionary to defend against, creating a baseline demand floor most technology subsectors cannot claim
Sources: Insider Monkey analysis of cybersecurity ETF holdings ranked by YTD performance as of November 8, 2024; Q3 2024 13F hedge fund filings; Company earnings releases Q3 2024; Acumen Research & Consulting - AI Cybersecurity Market Report; McKinsey Global Institute - Cybersecurity Economics (2024).