Something clicked for cybersecurity in 2024. The sector limped into January still nursing wounds from the 2022-2023 valuation reset, and by November it was one of the strongest corners of tech. Three forces converged to make that happen: cyberattacks got nastier and more frequent, AI started reshaping both sides of the security equation, and enterprise buyers finally committed to consolidating their sprawling vendor stacks onto fewer, bigger platforms. The ten stocks ranked below are the sector's top performers year-to-date through November 8, 2024. I've included hedge fund ownership data alongside each name - not because institutional headcount is destiny, but because it reveals where conviction is building and where the market is still catching up.
Why 2024 Was a Breakout Year for Cybersecurity
The sector came into 2024 carrying momentum and scars in roughly equal measure. Then July happened. CrowdStrike pushed a faulty software update that triggered one of the largest IT outages in history - airlines grounded, hospitals scrambling, banks offline - and the stock cratered nearly 44% in two weeks. That should have been catastrophic for investor confidence in platform-dependent security. But by November, CRWD had substantially recovered. Why? Because ripping out Falcon and replacing it across a Fortune 500 enterprise takes months of migration work, retraining, procurement approvals, and reintegration with dozens of adjacent tools. The switching costs are brutal. And that paradox sits right at the heart of cybersecurity investing: a company can cause a global outage and still keep its customers, because the alternative is worse.
Beyond the CrowdStrike drama, three bigger themes powered the sector. AI-driven threat escalation was the first - the World Economic Forum's Global Cybersecurity Outlook report warned that AI would push cyber incidents and data breaches to record levels, with breaches already up 72% year-over-year before 2024 even started. Second came platform consolidation. Enterprises rationalising their vendor counts kept funnelling budgets toward comprehensive platform providers like Palo Alto (with its Precision AI platformisation strategy) and Fortinet (unified threat management), squeezing out point-solution specialists. And third, government and defence spending. Geopolitical tensions weren't calming down anytime soon, so contracts tied to zero trust architectures, AI-augmented threat detection, and critical infrastructure protection grew significantly - a direct tailwind for Leidos, General Dynamics, and CyberArk.
AI as Both Threat and Defence
AI is reshaping cybersecurity from both sides at once - and that's what makes this so tricky. Attackers use large language models to craft convincing phishing content, automate vulnerability scanning, and speed up exploit development. Defenders fire back with AI for anomaly detection, automated threat hunting, and slashing mean-time-to-respond. The global AI-cybersecurity market grew from $15 billion in 2021 and is tracking toward $135 billion by 2030. An arms race, basically.
Platform Consolidation Wave
CFOs are tired of writing checks to fifteen different security vendors. Palo Alto Networks leaned into this hard with its "platformisation" strategy - scooping up IBM's QRadar SaaS assets in 2024 to consolidate customers onto Cortex XSIAM. Smaller single-product companies are feeling the squeeze. Buyers want fewer, deeper vendor relationships with platforms that cut integration headaches and vendor management overhead. The days of best-of-breed point solutions getting easy renewals? Fading fast.
Zero Trust Federal Mandates
Washington told every federal agency to adopt zero trust security frameworks by 2024. That is not a suggestion you ignore. The mandate created a massive spending cycle, and the contractors with existing clearances and agency relationships were first in line. Leidos, General Dynamics IT, and CyberArk (for privileged access management) all rode the wave across defence and civilian agencies.
SMB Security Gap
Here's a stat that should worry you: a Microsoft Security survey found fewer than one-third of small and mid-sized businesses handle cybersecurity internally. Most outsource it to consultants or managed service providers. That is an enormous addressable market for cloud-native security platforms that lower the expertise barrier. Cloudflare's Zero Trust and SASE offerings and Varonis' data security platform are built precisely for organisations without dedicated security teams.
The Rankings: YTD Performance Through November 8, 2024
Best Performing Cybersecurity Stocks - Year-to-Date Return & Hedge Fund Holders
YTD performance as of November 8, 2024. Hedge fund holder count from Q3 2024 13F filings. Source: Insider Monkey / cybersecurity ETF holdings analysis.
| Rank | Company | Ticker | YTD Return | HF Holders | Primary Cybersecurity Segment |
|---|---|---|---|---|---|
| 1 | Leidos Holdings | NYSE: LDOS | 38 | Government IT / Zero Trust / Defence Cyber | |
| 2 | Broadcom | NASDAQ: AVGO | 130 | Symantec Enterprise / AI Semiconductor | |
| 3 | Fortinet | NASDAQ: FTNT | 42 | Network Firewall / Unified Threat Management | |
| 4 | CyberArk Software | NASDAQ: CYBR | 55 | Identity Security / Privileged Access Mgmt | |
| 5 | Palo Alto Networks | NYSE: PANW | 66 | AI Security Platform / SASE / XDR | |
| 6 | CrowdStrike | NASDAQ: CRWD | 69 | Endpoint Protection / Falcon AI Platform | |
| 7 | Juniper Networks | NYSE: JNPR | 45 | Network Security / AI Networking | |
| 8 | General Dynamics | NYSE: GD | 48 | Defence Cyber / Encryption / Government IT | |
| 9 | Varonis Systems | NASDAQ: VRNS | 36 | Data Security / User Behaviour Analytics | |
| 10 | Cloudflare | NYSE: NET | 39 | Zero Trust / SASE / Edge Security |
YTD performance as of November 8, 2024. Hedge fund data from Q3 2024 13F filings. Source: Insider Monkey analysis of cybersecurity ETF holdings.
Stock-by-Stock: What Drove Each Company's Performance
Leidos Holdings - The Surprise Leader
Nobody talks about Leidos at cybersecurity conferences. Most investors hear "cyber" and think CrowdStrike, Palo Alto, maybe Fortinet. Not a Reston, Virginia defence contractor. But this firm is a comprehensive cybersecurity provider to the US government, and 2024 was its year in a way few predicted. The portfolio spans offensive and defensive cyber operations, zero trust architecture implementation, quantum cryptography, and the proprietary PACKIT framework (Proven, Analytic-Centric Kill Chain Implementation and Transformation). Its work with the Department of Defense and Department of Homeland Security demands the highest security clearances and the most exacting performance standards. That is a moat most Silicon Valley companies cannot replicate.
So what drove an 83.72% return? Execution. Relentless, quarter-after-quarter execution in a government spending environment that kept accelerating. Leidos posted its sixth consecutive quarter of growth in Q3 2024 - quarterly revenue hit $4.19 billion (up 7% year-over-year), adjusted EBITDA margin reached a record 14.2%, and adjusted diluted EPS jumped 44%. The total backlog swelled to $37.7 billion, which gives you extraordinary revenue visibility stretching years out. Full-year 2024 guidance was raised to $16.35-$16.45 billion.
Broadcom - AI Powerhouse With a Cybersecurity Layer
Broadcom on a cybersecurity list? I get the raised eyebrows. Most people think semiconductors, networking chips, and the 2023 VMware acquisition. But Broadcom owns the Symantec Enterprise Cloud platform - one of the most comprehensive enterprise security suites you can buy - plus solutions covering payment security, mainframe security, network security, endpoint protection, and identity management. With 130 hedge fund holders, it is by far the most institutionally owned name here. That reflects its status as a diversified technology conglomerate throwing off enormous free cash flow, not just a security play.
The honest truth about the 69.19% return: it was mostly the AI semiconductor business doing the heavy lifting. Custom AI accelerator chips and ethernet networking solutions for hyperscaler data centers generated $12 billion in AI revenue for fiscal 2024. In Q3, Broadcom posted $13.1 billion in revenue - a 47% year-over-year increase - on strong AI revenue, VMware bookings, and solid non-AI semiconductor performance. Q4 projections had AI revenue climbing another 10% sequentially to $3.5 billion. Bank of America reaffirmed a Buy on November 5, pointing to AI computing and networking leadership alongside strong free cash flow generation.
Fortinet - Firewall Cycle Recovery Delivers 59% Return
Over 700,000 organisations trust Fortinet with their security. That's more than any other cybersecurity company on the planet - enterprises, service providers, government agencies, the works. Fortinet holds global market share leadership in network security firewalls by units shipped, and the product breadth goes deep: intrusion prevention systems, unified threat management, and the AI-powered FortiAI suite. FortiAI for FortiNDR Cloud helps threat hunters analyse and correlate complex detections; FortiAI for Lacework FortiCNAPP delivers AI-powered alert context and remediation guidance to security operations teams. It's a sprawling portfolio, and customers keep buying more of it.
The 59.29% return came down to one thing: the firewall replacement cycle finally turned. This had been the sector's most debated concern for over a year. After elevated channel inventory from the post-pandemic buying surge, everyone wanted to know - when does the refresh start? Q3 2024 answered that question definitively. Billings came in well above estimates with accelerating bookings growth. Adjusted Q3 EPS of $0.63 crushed the $0.52 consensus; revenue of $1.51 billion beat forecasts by $30 million on 13% year-over-year growth. Service revenue (the higher-quality recurring piece) grew 19.1% year-over-year to $1.03 billion. Full-year 2024 guidance was bumped up to $5.86-$5.92 billion.
CyberArk Software - Identity Security at the Frontier
CyberArk is the global leader in identity security - the discipline of controlling which human users, machines, and automated processes can access which systems and data. This is not a peripheral concern: the vast majority of significant data breaches involve compromised credentials or improper access privileges. CyberArk's privileged access management (PAM) platform secures the highest-value access points: administrator accounts, service accounts, cloud infrastructure credentials, and developer pipelines across financial services, energy, retail, healthcare, and government customers.
In early October 2024, CyberArk completed its acquisition of Venafi - the leader in machine identity management - expanding its total addressable market by $10 billion to approximately $60 billion. Machine identity is one of the fastest-growing and least-understood challenges in enterprise security: as organisations deploy more microservices, containers, and AI agents, the number of machine identities requiring management has exploded. Q2 2024 showed 28% revenue growth to $224.7 million and a 50% increase in Annual Recurring Revenue to $868 million. Oppenheimer, Scotiabank (Sector Outperform, $340 target), and Baird (Outperform, $315 target) all maintained positive ratings.
Palo Alto Networks - The Platformisation Play
Palo Alto Networks is one of the world's largest cybersecurity companies and the most prominent advocate for vendor consolidation in enterprise security. Its "platformisation" strategy - encouraging customers to standardise on Palo Alto's integrated suite across network security, cloud security, and security operations - is a bold bet that the economics of vendor consolidation will overcome the inertia of existing deployments. In 2024, that strategy gained tangible traction. In September, PANW completed the acquisition of IBM's QRadar SaaS assets, migrating IBM's SIEM customer base to Cortex XSIAM - its AI-powered security operations platform using Precision AI to automate threat detection and response at machine speed.
Oppenheimer raised its price target from $410 to $450 on October 22, maintaining an Outperform rating, citing Palo Alto's steady execution and the success of its platformisation strategy as key factors in its growth prospects. The company was tracking to meet Q1 FY2025 revenue guidance of $2.10–$2.13 billion, with the consensus at $2.121 billion. Palo Alto had already told the market that 2024 was proving to be a landmark year in the utilisation of AI in cybersecurity - and it predicted the best was yet to come.
CrowdStrike - Remarkable Recovery After the July Outage
CrowdStrike's 2024 is a case study in the resilience of deeply embedded enterprise software. In July, a faulty content update to its Falcon sensor caused approximately 8.5 million Windows devices to display the Blue Screen of Death - shutting down airlines, hospitals, banks, and broadcasters in one of the most disruptive IT incidents in history. CRWD's share price fell nearly 44% within two weeks, bottoming in early August. By November, the stock had recovered substantially - delivering 33.67% year-to-date despite the crash. The recovery reflects the extraordinary switching costs of a deeply integrated security platform and the company's transparent, accountable response, including flexible commercial terms for affected customers.
CrowdStrike's AI-native Falcon platform continued driving adoption despite the outage: Falcon ARR growth reached 80% year-over-year in Q2 FY2025, and Q2 results showed 32% year-over-year revenue growth alongside an operating profit compared to a loss the prior year. Net income per share rose to $0.19 from $0.03 a year earlier. Management targets $10 billion in annual recurring revenue by the end of fiscal 2029. By November, 34 Wall Street analysts rated the stock a Buy - with only six neutral ratings - reflecting restored institutional conviction in CrowdStrike's long-term competitive position.
Juniper Networks - AI Networking Demand & Acquisition Premium
Juniper Networks is a global leader in networking technology whose cybersecurity portfolio includes enterprise firewalls, malware protection, anti-malware software, and data center service gateways. Its Connected Security framework embeds threat intelligence across the entire network fabric - from end-user devices through switches and routers to the cloud - rather than deploying security as a separate overlay. The 32.62% year-to-date gain was supported by its pending acquisition by Hewlett Packard Enterprise - announced in January 2024 at $14 billion - which provided a floor under the share price while the deal navigated regulatory approval.
Operationally, Q3 2024 results were driven by recovering enterprise demand in cloud and AI networking. Adjusted EPS of $0.48 beat the $0.45 estimate; revenue of $1.33 billion exceeded the $1.27 billion forecast. CEO Rami Rahim noted that total product orders grew nearly 60% year-over-year during the quarter - a significant re-acceleration from the inventory digestion cycle that had weighed on networking hardware vendors through much of 2023. A quarterly dividend of $0.22 per share was declared.
General Dynamics - Defence Cyber at Scale
General Dynamics' Information Technology (GDIT) division is one of the largest cybersecurity providers to the US government - providing hardware security products including Type 1 encryption devices for classified communications alongside a full range of SaaS security solutions, zero trust implementation services, and AI/ML-enhanced threat analytics. In September 2024, GDIT acquired Iron EagleX - a specialised AI/ML, cybersecurity, and cloud services provider focused on Special Operations Forces and the intelligence community - broadening its advanced technology capabilities for the most sensitive defence missions.
General Dynamics' Q3 2024 results showed 10.4% revenue growth to $11.67 billion, driven by 22% Aerospace growth and 20% Marine Systems growth. Year-to-date revenue reached $34.4 billion with net income of $2.63 billion. The total backlog grew to $92.6 billion alongside a record estimated contract value of $137.6 billion - providing exceptional multi-year revenue visibility that distinguishes defence cyber companies from commercial software peers when investors are assessing earnings durability.
Varonis Systems - Data Security in the SaaS Transition
Varonis specialises in a frequently underappreciated corner of enterprise cybersecurity: the governance and security of unstructured data - the emails, documents, spreadsheets, and files that represent most sensitive corporate information but are typically far less well-protected than structured databases. Its platform uses User and Entity Behaviour Analytics (UEBA) to establish baselines of normal data access patterns and flag anomalous activity indicating insider threats, compromised credentials, or ransomware staging. The company is headquartered in New York with R&D operations in Herzliya, Israel.
Varonis delivered a strong Q3 2024 earnings report: Net New Annual Recurring Revenue exceeded estimates by approximately $5 million, and overall ARR grew 18% year-over-year (13% excluding SaaS conversions from perpetual license customers). Growth was driven by customer conversions, new enterprise logo acquisitions, expansion of its Managed Detection and Response (MDDR) service, and early contributions from GenAI and Microsoft Copilot security products. Full-year FY2025 ARR growth was guided at 17–18% year-over-year. DA Davidson raised its price target to $50 (from $47) while maintaining a Neutral rating.
Cloudflare - Zero Trust & SASE at the Global Edge
Cloudflare operates one of the world's largest and most interconnected global networks - spanning more than 300 cities and handling a significant share of internet traffic - making it a foundational infrastructure provider for both cybersecurity and AI inference at the edge. Its security portfolio includes Zero Trust Network Access, Secure Web Gateway, Cloud Email Security, API security, DDoS protection, and its Cloudflare One SASE platform. In May 2024, Cloudflare acquired BastionZero to enhance Cloudflare One with secure infrastructure access, providing a VPN replacement covering both applications and infrastructure resources. The company also acquired GPUs to enable customers to deploy AI models - including generative AI - directly at the edge of its network, positioning Cloudflare as a security-plus-inference layer for the AI era.
The 15.00% year-to-date return - the list's lowest but still a meaningful outperformer - reflected strong operational metrics alongside some macro uncertainty. Revenue grew 30% year-over-year in Q2 2024, with customers spending over $100,000 annually growing to 67% of total revenue from 62% in Q1 2023. CEO Matthew Prince's comments about geopolitical uncertainty affecting buying behaviour in certain international markets created near-term caution, but underlying demand metrics remained robust. Citi maintained a Neutral rating with a $90 price target following Cloudflare's October product announcements, citing positive SASE momentum but a current valuation already reflecting considerable optimism.
What 2024 Revealed About Cybersecurity's Structural Shift
The ten stocks on this list are not simply beneficiaries of a threat-driven spending cycle. They are evidence of a sector reorganising itself around a new architectural logic. For most of the 2010s, cybersecurity buyers assembled stacks of specialised point products - one vendor for endpoint, another for network, another for identity, another for cloud. The proliferation worked until the complexity became the vulnerability: too many consoles, too many alert streams, too many handoff points between products that were never designed to talk to each other. What 2024 confirmed is that the enterprise buyer has absorbed this lesson and is acting on it. The winners of this ranking - CrowdStrike, Palo Alto Networks, Fortinet, CyberArk - are all platform providers. The pattern is not coincidental.
The CrowdStrike July outage is the most instructive data point in the entire year. A single software update from a security vendor simultaneously crashed 8.5 million Windows machines worldwide - the largest IT outage in history. By conventional logic, this should have been an extinction-level customer retention event. Instead, CrowdStrike finished the year up 33.67%. The explanation is switching costs, and they proved to be far more durable than the market initially credited. Ripping out Falcon and replacing it across a large enterprise requires months of migration work, retraining, procurement cycles, and reintegration with adjacent tools. For most organisations, that operational disruption carries more risk than staying with a vendor that caused a recoverable incident. The outage did not weaken the platform thesis - it stress-tested it in live conditions and the thesis held.
The leading indicator to watch for the sector's next leg is not revenue growth or hedge fund ownership - it is which companies are building AI-native security tools that generate their own threat intelligence rather than relying on curated signature databases. Legacy security architecture is reactive: a signature is written after a threat is observed. The structural edge belongs to platforms that use machine learning across hundreds of millions of endpoints to identify novel attack patterns before they are widely documented. CrowdStrike's Charlotte AI and Palo Alto's Precision AI are early examples of this approach, and both companies are investing disproportionately in this capability. The gap between vendors that can do this and those that cannot will define sector leadership through the end of the decade - and it is not a gap that can be closed by a smaller point-solution competitor simply adding an "AI" label to its marketing materials.
What Hedge Fund Ownership Reveals - and the Investor Framework
The correlation between hedge fund ownership and returns on this list is deliberately inverted from what many investors might expect. Broadcom, with by far the most holders (130), delivered the second-best return. Leidos, the top performer, had only 38 hedge fund holders. This divergence has a clear explanation: Broadcom is a high-conviction, widely-understood large-cap technology holding that most sophisticated investors already own for AI exposure. Leidos is a defence contractor that the majority of technology-focused hedge funds have never modelled as a cybersecurity investment. Its outperformance is partly attributable to this under-ownership - as results consistently exceeded expectations, the institutional ownership base was forced to grow, creating sustained buying pressure throughout the year. The pattern suggests that alpha in cybersecurity comes from identifying companies whose security capabilities are underappreciated relative to their primary sector classification.
Investment Framework: Assessing Cybersecurity Stocks Beyond the Headlines
- Annual Recurring Revenue (ARR) and Net Revenue Retention (NRR): The most important metrics for cybersecurity software companies. High NRR (above 120%) indicates customers are expanding their spending - a strong signal of product-market fit and platform stickiness. CyberArk's 50% ARR growth and Varonis' steady ARR expansion are both indicators of healthy business momentum deserving premium valuations
- Platform vs. point solution: The consolidation trend strongly favours integrated platform providers. Palo Alto Networks and CrowdStrike, offering multi-product platforms covering endpoint, cloud, and security operations, are better positioned to win and retain large enterprise contracts than point-solution specialists, even if individual modules are not best-of-breed on every single dimension
- Government exposure as a stability differentiator: Leidos and General Dynamics demonstrate that government cybersecurity contracts - multi-year, large backlogs, zero trust mandates, national security priority - offer superior earnings stability compared to commercial software cycles. Defence cyber companies typically trade at lower multiples than commercial pure-plays despite comparable or superior revenue visibility
- The identity security megatrend: CyberArk's 2024 performance reflects the growing recognition that identity security is the foundational layer of modern cybersecurity. As organisations expand cloud footprints and deploy AI agents, automated workloads, and IoT devices, both human and machine identity management needs will grow dramatically through the end of this decade
- AI as a structural growth amplifier: Every company on this list is investing in AI-augmented security capabilities. The distinction that matters for investors is whether AI is improving defensible competitive moats (Fortinet's FortiAI threat detection, CrowdStrike's Falcon AI-native platform) versus serving primarily as a marketing narrative. Companies that can demonstrate AI driving measurable improvements in threat detection rates, false positive reduction, or analyst productivity are building structural long-term advantages
- Geopolitical tailwind durability: The elevated global threat environment - driven by state-sponsored cyber operations from Russia, China, North Korea, and Iran - is not cyclical. It is a structural feature of the current geopolitical landscape that will sustain defence and government cybersecurity budgets even if discretionary IT spending faces pressure in a weaker economic environment
Key Takeaways
- Leidos Holdings (+83.72%) was the best-performing cybersecurity stock of 2024 - a defence and government IT contractor whose zero trust, quantum cryptography, and offensive/defensive cyber capabilities made it a primary beneficiary of federal security mandates, with six consecutive quarters of growth and a record 14.2% adjusted EBITDA margin in Q3
- Broadcom (+69.19%) ranked second primarily on AI semiconductor strength - $12 billion in AI revenue for fiscal 2024 - illustrating that many large-cap "cybersecurity" stocks derive the majority of their value from adjacent technology businesses
- Fortinet (+59.29%) delivered the third-best performance as its long-anticipated firewall product replacement cycle finally turned positive in Q3 2024, with billings materially beating estimates and product orders growing nearly 60% year-over-year
- CrowdStrike (+33.67%) achieved a positive year-to-date return despite its stock falling nearly 44% following the July 2024 global IT outage - demonstrating exceptional customer retention and switching cost dynamics
- CyberArk (+36.31%) was the standout identity security performer, with its Venafi acquisition adding $10 billion of addressable market in machine identity management
- $10.5 trillion in annual cyberattack damages projected by 2025 makes cybersecurity spending one of the few IT budget categories that remains genuinely non-discretionary even during economic downturns
- AI-driven cybersecurity market projected to reach $135 billion by 2030 (from $15 billion in 2021) - with AI simultaneously increasing attack sophistication and defence capability
- Platform consolidation is the most important structural purchasing trend: enterprises rationalising vendor counts are directing more security budgets toward comprehensive platforms at the expense of single-product specialists
- Under-owned outperformance: The best-performing stock (Leidos, 38 HF holders) was among the least institutionally owned - suggesting that identifying under-owned companies whose cybersecurity capabilities are underappreciated is a productive source of alpha
- Non-discretionary demand floor: All ten stocks share one characteristic - their security offerings address threats that are non-discretionary to defend against, creating a baseline demand floor most technology subsectors cannot claim
Sources: Insider Monkey analysis of cybersecurity ETF holdings ranked by YTD performance as of November 8, 2024; Q3 2024 13F hedge fund filings; Company earnings releases Q3 2024; Acumen Research & Consulting - AI Cybersecurity Market Report; McKinsey Global Institute - Cybersecurity Economics (2024).