Security Software – Large Cap / Mid & Small Cap Comp Sheet

This J.P. Morgan North America Equity Research comp sheet (data as of October 23, 2026) compares valuation multiples across security software companies, segmented into large cap (>$20bn market cap), mid cap ($3bn-$20bn) and small cap (<$3bn). Aggregate CY27E/CY28E EV/Sales averages are 6.4x/5.5x, with large caps at 10.8x/9.0x, mid caps at 5.2x/4.5x and small caps at 2.3x/2.1x. The universe is expected to grow revenue roughly 14% with 76% gross margins, 13%/19% FCF margins and stock-based compensation at about 12% of revenue. The report also splits the universe into Security & Analytics and Vertical software, and adopts the "Rule of X" framework (2.0x growth multiplier) over the "Rule of 40," arguing it better explains the market's bias toward growth, alongside a comparison of interest rates versus multiples. JPM rates Crowdstrike, Palo Alto Networks, Zscaler, Okta and IBM Overweight, Check Point Neutral, and Fortinet, C3.ai and Rapid7 Underweight. The coverage basket trades at 9.1x YTD