DBAPPSecurity Valuation Multiples

Palo Alto Networks is a platform-based cybersecurity vendor with product offerings covering network security, cloud security, and security operations. The California-based firm has more than 80,000 enterprise customers across the world, including more than three fourths of the Global 2000.

CrowdStrike is a cloud-native cybersecurity company specializing in security verticals such as endpoint, cloud workload, identity, and security operations. CrowdStrike's primary offering is its Falcon platform, which provides enterprises with a unified view to detect and respond to security threats across their IT infrastructure. The Austin, Texas-based firm was founded in 2011 and went public in 2019.

IBM (International Business Machines) is an American technology company headquartered in Armonk, New York, and operating in more than 175 countries. It sells hybrid-cloud and AI software, including Red Hat and the watsonx portfolio, IT consulting services, and infrastructure hardware such as IBM Z mainframes. Its customers are mainly large enterprises and governments, and it earns revenue from software subscriptions and licences, consulting and managed-services contracts, and hardware sales and financing. In 2025 IBM reported revenue of $67.5 billion, up 8%, with software up 11%, consulting up 2% and infrastructure up 12%, and free cash flow of $14.7 billion. The company was founded in 1911 as the Computing-Tabulating-Recording Company and renamed International Business Machines in 1924; it dominated mainframe computing with the System/360 and launched the IBM Personal Computer in 1981 before selling its PC division to Lenovo in 2005. More recently it bought Red Hat for $34 billion in 2019, spun off its managed infrastructure services unit as Kyndryl in 2021, and in December 2025 agreed to acquire data-streaming company Confluent for about $11 billion. Arvind Krishna is chairman and chief executive.

Fortinet is a Sunnyvale, California-based cybersecurity and networking company founded in 2000 by Ken and Michael Xie. Its FortiGate appliances and FortiOS software combine firewall, secure networking and threat-protection functions, while the broader Security Fabric portfolio covers secure access service edge, security operations, cloud security, endpoint protection, email security and identity controls. Fortinet serves enterprises, service providers, government agencies and smaller organizations through distributors, resellers, managed-security providers and direct relationships. It earns revenue from hardware product sales and recurring subscriptions for security services, support and cloud-delivered software. The company is publicly traded on Nasdaq and operates globally. Fortinet has expanded its platform through internal development and acquisitions spanning wireless networking, monitoring, endpoint detection, cloud protection and data-loss prevention. Its acquisitions are integrated into the Fortinet product architecture and sold through the company's existing channel and service infrastructure.

Cloudflare is a software company based in San Francisco, California, that offers security and web performance offerings by utilizing a distributed, serverless content delivery network, or CDN. The firm’s edge computing platform, Workers, leverages this network by providing clients the ability to deploy and execute code without maintaining servers.

Okta is a cloud-native security company that focuses on identity and access management. The San Francisco-based firm went public in 2017 and focuses on two key client stakeholder groups: workforces and customers. Okta’s workforce offerings enable a company’s employees to securely access its cloud-based and on-premises resources. The firm’s customer offerings allow its clients’ customers to securely access the client’s applications.

Zscaler is a publicly listed cloud security software company founded in 2007 and headquartered in California. Its Zero Trust Exchange is a cloud-native platform that securely connects users, devices, applications and workloads without placing them on a traditional corporate network. The company sells subscription access to services for internet access security, private application access, data protection, cloud workload protection and digital experience monitoring. Zscaler primarily serves enterprises and public-sector organizations that are modernizing networks and moving applications and data to cloud environments. Its platform processes hundreds of billions of transactions per day and the company reports more than 11,000 customers, including over 40% of the Forbes Global 2000. Zscaler went public on Nasdaq under the ticker ZS in 2018. The business earns recurring software-as-a-service subscription and support revenue from organizations using its security cloud.

F5 is a market leader in the application delivery controller market. The company sells products for security, application performance, and automation. Its three customer verticals are enterprises, service providers, and government entities. Revenue is evenly split between its services business and products business with revenue trending toward products due to software adoption. The Seattle-based firm was incorporated in 1996, and went public in 1999.

Rubrik is a cloud and data-security software company that protects enterprise information from cyberattacks and operational disruption. It serves large businesses and public-sector organizations managing data across cloud and on-premises systems and earns revenue through recurring software subscriptions and associated support. Its operating model combines backup, recovery, data governance and ransomware-resilience software delivered through a cloud platform. Founded in 2014, it is headquartered in Palo Alto, USA. The company was venture-backed during APFC’s investment period and completed an initial public offering in 2024. For investors, the business provides exposure to cybersecurity, cloud data management and recurring enterprise software demand, with performance depending on sector demand, execution and the company’s capital structure.

CACI International Inc is an information solutions and services provider, offering information solutions and services to its customers. The company's primary customers are agencies and departments of the U.S. government, which account for the vast majority of the firm's revenue. It provides information solutions and services supporting national security missions and government modernization for intelligence, defense, and federal civilian customers. Some of the services provided by the company are functional software development, data, and business analysis, IT operations support, naval architecture, and life cycle support intelligence among others. The company's operating segments are; Domestic operations and International operations. It derives key revenue from the Domestic segment.

Check Point Software Technologies is a pure-play cybersecurity vendor. The company offers solutions for network, endpoint, cloud, and mobile security in addition to security management. Check Point, a software specialist, sells to enterprises, businesses, and consumers. Around 50% of revenue is generated in Europe, the Middle East, and Africa, 40% from the Americas, and 10% from the Asia-Pacific region. The firm, based in Tel Aviv, Israel, was founded in 1993 and has about 5,000 employees.

Gen is a cybersecurity pure-play that offers security, identity protection, and privacy solutions to individual consumers. The firm's cyber safety offerings, via brands such as Norton, Avast, and LifeLock, have long maintained their positions as some of the most recognizable consumer-focused security and identity-protection products.

SailPoint Inc delivers solutions to enable comprehensive identity security for the enterprise. The company does this by unifying identity data across systems and identity types, including employee identities, non-employee identities, and machine identities. The SaaS and customer-hosted offerings of the company leverage intelligent analytics to give organizations critical visibility into which identities currently have access to which resources, which identities should have access to those resources, and how that access is being used. Its solutions enable organizations to establish, control, and automate policies that help them define and maintain a robust security posture and achieve regulatory compliance.

360 Security Technology Inc is engaged in the research and development of Internet security technology, design, development, and promotion of Internet security products, as well as commercial services such as Internet advertising and services based on Internet security products, Internet value-added services, and smart hardware services. The company operates through two segments. The Internet and Smart Hardware Business segment covers Internet commercialization, such as advertising and services, value-added Internet businesses like AI products and game distribution, and smart hardware, including cameras, video doorbells, driving recorders, and children’s smartwatches. The Security Business segment focuses on digital security operations.

SentinelOne is a cloud-based cybersecurity company specializing in endpoint protection. SentinelOne’s primary offering is its Singularity platform that offers a single pane of glass for an enterprise to detect and respond to security threats attacking its IT infrastructure. The California-based firm was founded in 2013 and went public in 2021.

Netskope is a cybersecurity software company providing cloud-delivered secure access and data protection. It serves enterprises and public agencies securing users, applications and data across distributed networks and earns revenue through recurring subscriptions to its security cloud. Its operating model combines secure web gateway, cloud access security, zero-trust access and data-loss prevention delivered through a global network. Founded in 2012, it is headquartered in Santa Clara, USA. The company has remained privately held while raising successive institutional growth rounds. For investors, the business provides exposure to cloud security, network transformation and recurring enterprise software demand, with performance depending on sector demand, execution and the company’s capital structure. Netskope serves B2B and B2G customers through activities spanning Cybersecurity, Network Management and Cloud Infrastructure.

Qualys is a cloud security and compliance solutions provider that helps businesses identify and manage their security risks and compliance requirements. The California-based company has more than 10,000 customers worldwide, the majority of which are small- and medium-size businesses. Qualys was founded in 1999 and went public in 2012.

CommVault Systems Inc provides cyber resiliency solutions designed to help the enterprise protect, secure, and recover its data, applications, and identity systems in a world of increasing cyber threats and attacks. Its offerings provide cyber resilience, including data protection, cyber recovery, data security, and governance, aiming to enable customers to continue business. The company delivers its solutions through Commvault Cloud, a cloud native platform that unifies data security, cyber recovery and identity resilience across on-premises, hybrid, multi-cloud, and software-as-a-service environments. It sells its offerings through subscription-based arrangements, including SaaS and term-based subscriptions, and also offers perpetual licenses, customer support, and professional services.

Trend Micro Inc provides antivirus and other security products that protect the flow of information on PCs, file servers, e-mail servers, and the Internet gateway. The company operates through four geographic segments: Japan, North America, Europe, and Asia-Pacific.

Varonis Systems is a cybersecurity vendor focused on data privacy and security. The firm is currently undergoing a cloud transition as it weans its on-premises customers over to its cloud products that are delivered as software-as-a-service. The New York-based firm was founded in 2005 and went public in 2014.

BlackBerry, once known for being the world’s largest smartphone manufacturer, is now exclusively a software provider with a stated goal of end-to-end secure communications for enterprises. The firm provides endpoint management and other secure communications software to enterprises, specializing in regulated industries like government and financial institutions. BlackBerry also has a sizable embedded software business primarily serving the automotive market, with some exposure to the industrial market.

Glory View Technology Co Ltd is engaged in providing smart city solutions, including smart medical care, smart education, smart community, smart buildings, smart government affairs, and smart parks in the three areas of smart people's livelihood, urban comprehensive management, and smart parks.

Clear Secure Inc is an identity company making experiences safer and easier digitally and physically. It is involved in creating a frictionless travel experience while enhancing security. Its secure identity platform uses biometrics to automate the identity verification process through lanes in airports, helping to make the travel experience safe and easy. The Company's operations are mainly focused on growing and maintaining its secure identity network across multiple offerings in both aviation and non-aviation channels.

Founded in 2002, Tenable is a cybersecurity company that began providing vulnerability management solutions under its Nessus software. In recent years, Tenable has expanded its portfolio to provide a broader range of exposure management modules. Solutions include cloud security and compliance, active directory management, operational technology security and advanced vulnerability analytics. The Maryland-based company went public in 2018.

Qi An Xin Technology Group Inc provides a new generation of enterprise-level network security products and services to government and corporate customers.

NetScout Systems Inc is a provider of service assurance and cybersecurity solutions to enterprise and government networks. It bases its solutions on proprietary adaptive service intelligence technology, which helps customers monitor and identify performance issues and provides insight into network-based security threats. These solutions also deliver real-time and historical information, which provides insight to restore service and understand the quality of user experience. The company derives revenue from the sale of network management tools and security solutions. Its geographical regions include USA, which derives maximum revenue, Europe, Asia, and Rest of the World.

AvePoint Inc provides customizable solutions to optimize SaaS operations, enable secure collaboration, and accelerate digital transformation across technologies and industries. Its Confidence Platform delivers a comprehensive set of cloud-based solutions enabling IT operations, development operations, and cybersecurity professionals to monitor and secure the digital workplace using SaaS tools.

Cellebrite DI Ltd is an Israeli digital intelligence company that provides tools for federal, state, and local law enforcement as well as enterprise companies and service providers to collect, review, analyze, and manage digital data. Some of its products include Cellebrite UFED, Cellebrite Physical Analyzer, Cellebrite UFED Cloud, Cellebrite Frontliner, Cellebrite Responder, Cellebrite Premium, and Cellebrite Seeker.

Venustech Group Inc is a provider of network security products, trusted security management platform, as well as specialized security services and solutions in China.

A10 Networks Inc is a provider of secure application and network infrastructure solutions for enterprises and service providers across on-premises, hybrid cloud, and distributed environments. The company's offerings include application delivery and traffic management, distributed denial-of-service (DDoS) protection, application and API security, and centralized management. It serves customers across multiple industries, including telecommunications, technology, financial services, public sector, industrial, retail, gaming, and education. The majority of the company's revenue is derived from the sale of secure networking and cybersecurity solutions and related maintenance and support services.

CETC Cyberspace Security Technology Co Ltd is a China-based company that offers security-related products and services. It provides professional and autonomous network information security solutions, products, and services. It offers password products, network security products, and security information systems. The group is committed to building a life-cycle security solution from chip to system for a party and government users.

Secunet Security Networks AG is an IT and telecommunications security provider. It offers public-sector clients and private-sector companies a comprehensive portfolio of products and consulting services for the protection of data, infrastructures, and digital identities as well as for information transmission, storage, and processing. Its services include consulting on IT security, software development, development, integration, operations, maintenance, and support of products. The company operates through two divisions, Public Sector, and Business Sector. The company generates maximum revenue from Public Sector.

Progress Software Corp provides software operate in one operating segment: software products for the development, deployment, and management of responsible, AI-powered applications and digital experiences. The following are products: Chef, Corticon, Data Direct, Developer Tools, Flowmon, Kemp LoadMaster, MarkLogic, MOVEit, OpenEdge, Semaphore, ShareFile, Sitefinity, WhatsUp Gold. Geographical regions include the United States, Canada, EMEA, Latin America, and Asia Pacific.

CloudWalk Technology Co Ltd is engaged in the provision of efficient human-machine collaborative operating systems and industry solutions. It is a man-machine coordination platform, that provides users with cross-scene, cross-industry and personalized AI services, in the hope of building a more harmonious and warmer intelligent future.

Hangzhou DPtech Technologies Co Ltd focuses on network security and application delivery products and solutions. The security and application delivery products portfolio includes Application Firewall, IPS, Bandwidth Management, Deep Packet Inspection, Web Application Firewall, Anti-DDoS, Appliction Delivery and others.

Radware Ltd provides cyber security and application delivery solutions. The company provides solutions for cloud, on-premises, and software-defined data centers (SDDC). The solutions of the company secure the digital experience by providing infrastructure, application, and network protection and availability services to enterprises globally. The business segments of the company are Radware’s Core Business and The Hawks’ Business. The company derives maximum revenue from Radware’s Core Business. It generates the majority of its revenue from the United States.

Red Violet Inc is a software and services company. It specializes in data analysis, providing cloud-based, mission-critical information solutions to enterprises in a variety of industries. Through its CORE data fusion platform, it provides mission-critical information about individuals, businesses and assets.

Eastcompeace Technology Co Ltd is a provider of smart card and system solution. The firm provides secure qualified products and services including scratch card, contactless card, dual interface card, citizen card, transportation card, social security card, SIMePay, terminal, device management system, mobile payment system, smart tracking system, banking card perso solution, one card solution, and overall solutions. It caters its services to telecommunications, banking and payment, government and public sectors. The company is based in China with a presence in Singapore, Bangladesh, India, and Russia.

Nsfocus Technologies Group Co Ltd is a China based internet and application security company. It offers enterprise-level network security solutions and services. The products offered by the company are Anti-DDoS system, Cloud DDoS protection service, Threat intelligence subscription service, Web application firewall, and Web vulnerability scanning system. In addition, it also offers solutions such as cloud DDoS defenses, on-premises DDoS defenses, Hybrid DDoS defenses, global threat intelligence, among others. The company has a business presence in China and other international countries.

Riskified Ltd has built a next-generation eCommerce risk management platform that allows online merchants to create trusted relationships with their consumers. It generates revenue by granting merchants access to its eCommerce risk management platform and reviewing and approving eCommerce transactions for legitimacy. Its merchants include some of the ecommerce brands including Wayfair, Lastminute.com, SHEIN, and Macy’s. Its merchants operate in a variety of verticals, including Payments, Money Transfer & Crypto, Tickets & Travel, Electronics, Home, Fashion & Luxury Goods, General Retail and Food. The company derived maximum revenue from Israel.

Yubico AB is a leader in setting standards for secure access to computers, mobile devices, servers, browsers, and internet accounts. Yubico is a creator and core contributor to the FIDO2, WebAuthn, and FIDO Universal 2nd Factor (U2F) open authentication standards, and is a pioneer in delivering modern, hardware-based passkey authentication security at scale to customers in over 160 countries. The company is a cybersecurity company and the inventor of the YubiKey, which offers the gold standard for phishing-resistant multi-factor authentication (MFA).

BeiJing Certificate Authority Co Ltd is a leading information security solution provider in China. The main business is electronic certification services, electronic certification products and manageable information security services.

Asiainfo Security Technologies Co Ltd is a leader in China's network security software field, and a network security company that knows the Internet and the cloud in the industry.

Founded in 2000, Rapid7 is a cybersecurity company that began providing vulnerability management solutions. It has, however, expanded its portfolio to provide extended detection and response; security information and event management; cloud security, threat intelligence, and application security; and security orchestration, automation, and response. The Boston-based company went public in 2015.

Mitek Systems Inc is engaged in the development, sale, and service of proprietary software solutions related to mobile imaging. The firm is a software development company with expertise in artificial intelligence, and machine learning. It serves more than 7,900 financial services organizations, financial technology (fintech) brands, telecommunications companies, and marketplace brands across the globe. The company's Mobile Deposit solution is used by consumers for mobile check deposits. The company's Mobile Verify verifies a user's identity online, enabling organizations to build safer digital communities, whereas CheckReader enables financial institutions to automatically extract data from a check image received across any deposit channel - branch, ATM, RDC, and mobile.

CANCOM SE is a hybrid IT service provider. The group's range of IT solutions includes consulting, implementation, services and the operation of IT systems. As a hybrid IT integrator and service provider, the company delivers a range of services and solutions that includes business solutions and managed services such as cloud computing, analytics, enterprise mobility, IT security, hosting or as-a-service offerings. In geographical terms, the company operates in Germany, Austria as well as Switzerland, Romania and Belgium.

Sansec Technology Co Ltd is engaged in innovation of cryptographic technology and R&D, sales and service of cryptographic products and provides cryptographic products and solutions for the internet information security. The company’s products portfolio includes PCIe HSM, Cloud HSM, General purpose HSM, Financial HSM, and Cryptographic Software System. HSMs provide the integrated cryptographic functions for different application scenarios, including financial HSMs, general purpose HSMs, cloud HSMs, KMS and other HSMs. Cryptographic systems include key management system, cryptographic service platform, identity authentication system, cryptographic middleware, etc.

OneSpan Inc is a provider of information technology security solutions for banking and financial services and application security markets. Its solutions secure and manage access to digital assets and protect online transactions, via mobile devices and in-person. Authentication and anti-fraud solutions are the organization's primary product offerings and include multifactor authentication and virtual private network access capabilities. The company derives revenues from hardware and license fees, maintenance and support fees, and subscription fees. A large majority of the firm's revenue is generated in Europe, the Middle East, and Africa, and the rest in the United States and Asia-Pacific region.