Short answer
By revenue in their latest annual reports, the top cybersecurity companies are Palo Alto Networks ($11.48 billion, year to July 2026), Fortinet ($6.80 billion, 2025), Gen Digital ($5.00 billion, year to April 2026), CrowdStrike ($4.81 billion, year to January 2026) and Zscaler ($3.35 billion, year to July 2026). Cisco's security products ($8.23 billion) would rank second if Cisco reported them as a separate company.
- Palo Alto Networks, Fortinet and CrowdStrike took 50% of the $46.5 billion of revenue the 16 companies reported.
- Rubrik grew fastest, up 48.5% to $1.32 billion; Rapid7 grew slowest, up 1.9%.
- Palo Alto's headcount rose from 16,068 to 21,921 in a year, including about 4,223 people from its CyberArk acquisition.
- Check Point, ranked first on its own 'top cybersecurity companies' page, is seventh by revenue at $2.73 billion.
On this page
This list is for people who sell to cybersecurity vendors (cloud and data providers, threat intelligence and testing services, recruiters, marketing and event agencies, channel partners) and for buyers who want to know which security companies are biggest before shortlisting. It ranks 16 security companies by revenue from their latest 10-K or 20-F, shows the security businesses inside larger companies, and explains how the list was built and where the buying happens.
The 16 largest cybersecurity companies by revenue
| Rank | Company | Headquarters | Main focus | Revenue | Fiscal year ended | Change | Employees |
|---|---|---|---|---|---|---|---|
| 1 | Palo Alto Networks | Santa Clara, CA | network, cloud and security operations platforms | $11.48B | 31 Jul 2026 | +24.5% | 21,921 |
| 2 | Fortinet | Sunnyvale, CA | firewalls and secure networking | $6.80B | 31 Dec 2025 | +14.2% | 15,109 |
| 3 | Gen Digital | Tempe, AZ | consumer security (Norton, Avast) and identity | $5.00B | 3 Apr 2026 | +27.1% | about 3,900 team members |
| 4 | CrowdStrike | Austin, TX | endpoint and cloud security | $4.81B | 31 Jan 2026 | +21.7% | 10,698 (full-time) |
| 5 | Zscaler | Santa Clara, CA | cloud security (zero trust access) | $3.35B | 31 Jul 2026 | +25.4% | over 8,700 |
| 6 | Okta | San Francisco, CA | identity and access management | $2.92B | 31 Jan 2026 | +11.8% | 6,366 |
| 7 | Check Point Software | Tel Aviv, Israel | firewalls, cloud and email security | $2.73B | 31 Dec 2025 | +6.3% | 6,825 |
| 8 | Cloudflare | San Francisco, CA | network security and performance | $2.17B | 31 Dec 2025 | +29.8% | 5,156 (full-time) |
| 9 | Rubrik | Palo Alto, CA | data security and backup | $1.32B | 31 Jan 2026 | +48.5% | about 3,797 (full-time) |
| 10 | SailPoint | Austin, TX | identity governance | $1.07B | 31 Jan 2026 | +24.4% | 3,229 |
| 11 | SentinelOne | Mountain View, CA | endpoint and AI security operations | $1.00B | 31 Jan 2026 | +21.9% | over 2,900 (full-time) |
| 12 | Tenable | Columbia, MD | exposure and vulnerability management | $999.4M | 31 Dec 2025 | +11.0% | 1,995 |
| 13 | Rapid7 | Boston, MA | security operations and vulnerability management | $859.8M | 31 Dec 2025 | +1.9% | 2,613 (full-time) |
| 14 | Netskope | Santa Clara, CA | cloud security (secure access service edge) | $709.0M | 31 Jan 2026 | +31.7% | 3,281 |
| 15 | Qualys | Foster City, CA | vulnerability management and compliance | $669.1M | 31 Dec 2025 | +10.1% | 2,625 (full-time) |
| 16 | Varonis Systems | Miami, FL | data security | $623.5M | 31 Dec 2025 | +13.2% | 2,658 (employees and contractors) |
Revenue is total revenue as reported in each company's latest Form 10-K, or Form 20-F for Check Point, filed by 30 October 2026. The change compares with the prior year in the same filing. Employees are as each filing states them, at fiscal year-end. Headquarters are the business addresses on file with the SEC.
Three rows need a note:
- Palo Alto Networks bought CyberArk during its 2026 fiscal year. Its 10-K says headcount rose from 16,068 to 21,921, including about 4,223 people from CyberArk, so part of its growth is acquired. CyberArk, which had filed its own 20-F for 2024, no longer reports separately.
- Gen Digital is more than security. Its $5.00 billion splits into $3.34 billion from its Cyber Safety Platform and $1.66 billion from Trust-Based Solutions, which includes identity protection and MoneyLion's financial wellness products.
- Cloudflare and Rubrik sit on the edge of the category: Cloudflare sells network performance as well as security, and Rubrik started in backup. Both describe security as their core today, so they're in.
Security inside larger companies
Some of the biggest security businesses belong to companies that do much more. Only two report a security figure in their 10-K:
| Company | Security revenue | Period | Share of company revenue |
|---|---|---|---|
| Cisco (security products) | $8.23B (+2%) | year to 25 Jul 2026 | 13% of $63.3B |
| Akamai (security solutions) | $2.24B (+10%) | 2025 | 53% of $4.21B |
Microsoft, IBM and Broadcom (which owns Symantec's enterprise business) sell large security portfolios but don't report a separate security revenue figure in their 10-Ks, so any number you see for them is a company statement outside the filing or an estimate.
How we built the list
- Who counts. Companies that describe security as their main business and file annual reports with the SEC. That keeps in Israeli-based Check Point (which files a 20-F) and leaves out vendors that don't publish results.
- What's counted. Total revenue as reported, including acquisitions from the date they closed.
- Which year. The latest fiscal year filed by 30 October 2026. Fiscal years end in January (CrowdStrike, Okta, SentinelOne, Rubrik, SailPoint, Netskope), April (Gen Digital), July (Palo Alto, Zscaler) or December, so the rows cover periods up to seven months apart.
- What's left out. Private companies that don't publish revenue, and vendors listed outside the US that we didn't check, such as Trend Micro in Tokyo.
What the top results get wrong. The top Google result is Check Point's own page, which ranks Check Point first without saying how; by revenue it's seventh. Fortune's list ranks by market value checked on 31 January 2025, so Microsoft, Broadcom, Cisco and IBM lead because of businesses that have nothing to do with security. StationX gives revenue without years or sources: Palo Alto Networks at $7.52 billion and Zscaler at $455.0 million, against $11.48 billion and $3.35 billion in their latest 10-Ks, and it still lists VMware as a separate company. eSecurity Planet's list is in "no particular order", scored by its editors, and says advertiser compensation may affect placement.
What the list is good for if you sell B2B
Group them by what they buy. This is general guidance, not taken from any one company's policies:
| Segment | Companies | What they buy from outside |
|---|---|---|
| Platform vendors | Palo Alto Networks, Fortinet, Check Point, Cisco | Hardware components and contract manufacturing, cloud capacity, channel and partner programs, events |
| Cloud-delivered security | CrowdStrike, Zscaler, Netskope, Cloudflare, Okta | Cloud infrastructure, data centers and bandwidth, threat intelligence, developer and testing tools |
| Specialists | Tenable, Rapid7, Qualys, Varonis, SailPoint, SentinelOne, Rubrik | Marketing and demand generation, sales tools, recruiting for security engineers |
| Consumer security | Gen Digital | Digital advertising, retail and telecom partnerships, payments |
Follow the headcount to the budget. Check Point's 20-F breaks down its people: 3,066 employees and subcontractors in sales and marketing, 1,168 in technical services and 2,154 in research and development. Those are separate budget owners. Fast hiring is a buying signal too: Palo Alto added nearly 6,000 people in a year, and new teams need tools, training and space. Our guide to buying signals covers how to spot them, and the right code for a security firm is covered in the NAICS code for cyber security.
Expect a security review of your product. Security companies are strict buyers of anything that touches their data or code. Have your security documentation and any independent audit report ready before the first call; at volume, finding the right owner at each vendor is the slow part, and Bebop researches each account and finds the people.
Worked example
Illustrative example. Labwise (labwise.example) sells hosted demo labs for sales engineers and support staff at $150 per user per month. Its seller sizes Check Point from the 20-F:
- Technical services team: 1,168 employees and subcontractors. Full deployment: 1,168 x $150 x 12 = about $2.1 million a year.
- First deal: one regional support team of 60: 60 x $150 x 12 = $108,000 a year, within a support director's budget.
The seller targets the regional director of technical services, offers a 30-day pilot on one product line, and uses the full-team figure only to show what a rollout is worth.
Next step: see how the largest software companies compare in the largest software companies list.
Sources
- Palo Alto Networks, Inc. Form 10-K for the fiscal year ended July 31, 2026, Palo Alto Networks (SEC EDGAR), 10 September 2026
- Fortinet, Inc. Form 10-K for the year ended December 31, 2025, Fortinet (SEC EDGAR), 25 February 2026
- Gen Digital Inc. Form 10-K for the fiscal year ended April 3, 2026, Gen Digital (SEC EDGAR), 21 May 2026
- CrowdStrike Holdings, Inc. Form 10-K for the fiscal year ended January 31, 2026, CrowdStrike (SEC EDGAR), 5 March 2026
- Zscaler, Inc. Form 10-K for the fiscal year ended July 31, 2026, Zscaler (SEC EDGAR), 3 September 2026
- Okta, Inc. Form 10-K for the fiscal year ended January 31, 2026, Okta (SEC EDGAR), 5 March 2026
- Check Point Software Technologies Ltd. Form 20-F for the year ended December 31, 2025, Check Point Software (SEC EDGAR), 31 March 2026
- Cloudflare, Inc. Form 10-K for the year ended December 31, 2025, Cloudflare (SEC EDGAR), 26 February 2026
- Rubrik, Inc. Form 10-K for the fiscal year ended January 31, 2026, Rubrik (SEC EDGAR), 19 March 2026
- SailPoint, Inc. Form 10-K for the fiscal year ended January 31, 2026, SailPoint (SEC EDGAR), 19 March 2026
- SentinelOne, Inc. Form 10-K for the fiscal year ended January 31, 2026, SentinelOne (SEC EDGAR), 19 March 2026
- Tenable Holdings, Inc. Form 10-K for the year ended December 31, 2025, Tenable (SEC EDGAR), 27 February 2026
- Rapid7, Inc. Form 10-K for the year ended December 31, 2025, Rapid7 (SEC EDGAR), 19 February 2026
- Netskope, Inc. Form 10-K for the fiscal year ended January 31, 2026, Netskope (SEC EDGAR), 31 March 2026
- Qualys, Inc. Form 10-K for the year ended December 31, 2025, Qualys (SEC EDGAR), 20 February 2026
- Varonis Systems, Inc. Form 10-K for the year ended December 31, 2025, Varonis Systems (SEC EDGAR), 4 February 2026
- Cisco Systems, Inc. Form 10-K for the fiscal year ended July 25, 2026, Cisco Systems (SEC EDGAR), 2 September 2026
- Akamai Technologies, Inc. Form 10-K for the year ended December 31, 2025, Akamai Technologies (SEC EDGAR), 20 February 2026
- CyberArk Software Ltd. Form 20-F for the year ended December 31, 2024, CyberArk Software (SEC EDGAR), 12 March 2025
Written by the Bebop team at Blackpearl Group. Published .
Questions people ask
What is the largest cybersecurity company in the world?
Among companies whose main business is security, Palo Alto Networks, with $11.48 billion of revenue in its year to 31 July 2026, according to its 10-K. That includes CyberArk, which it acquired during the year. Fortinet is second with $6.80 billion for 2025. Cisco's security products brought in $8.23 billion, but Cisco is a networking company and security is 13% of its revenue.
What are the top 10 cybersecurity companies?
By revenue in their latest annual filings: Palo Alto Networks ($11.48 billion), Fortinet ($6.80 billion), Gen Digital ($5.00 billion), CrowdStrike ($4.81 billion), Zscaler ($3.35 billion), Okta ($2.92 billion), Check Point ($2.73 billion), Cloudflare ($2.17 billion), Rubrik ($1.32 billion) and SailPoint ($1.07 billion). Fiscal years differ: Palo Alto's and Zscaler's ended in July 2026, Fortinet's in December 2025.
Which cybersecurity company is growing fastest?
Among the 16 largest, Rubrik grew fastest in its latest year, with revenue up 48.5% to $1.32 billion in the year to January 2026. Netskope grew 31.7%, Cloudflare 29.8% and Gen Digital 27.1%, although Gen's growth includes an acquisition. Palo Alto Networks grew 24.5%, partly because of CyberArk. Rapid7 grew slowest, at 1.9%.
Is Microsoft the biggest cybersecurity company?
Microsoft sells one of the largest security portfolios, but its 10-K doesn't report a separate security revenue figure, so it can't be ranked on the same basis as security companies. Lists that put Microsoft first usually rank by market value, which reflects all of Microsoft's businesses. Cisco is the only large diversified company here that reports security revenue: $8.23 billion in its year to July 2026.
How many people work at the big cybersecurity companies?
Palo Alto Networks had 21,921 employees at the end of its 2026 fiscal year, Fortinet 15,109 at the end of 2025 and CrowdStrike 10,698 full-time employees at 31 January 2026. Zscaler had over 8,700, Check Point 6,825 and Okta 6,366. Most of the smaller vendors on the list employ between 2,000 and 4,000 people.