The market backdrop
On August 27, OpenAI published an open letter signed by more than 100 technology companies, banks, insurers and security vendors warning that AI-enabled cyberattacks could scale within months.
The letter argued that agents can operate continuously, broaden access to specialized attack skills, and expand companies’ attack surfaces as they deploy agents internally.
I treated the letter as market context, not a stock call. Software security has been one of the stronger groups in the market this year, and I wanted a quick view of where valuations stood after the run-up.
The build
I built a comp set with Scout, Daloopa’s AI assistant for building and updating financial models in Excel. The table compared six tickers: PANW, OKTA, CRWD, RBRK, NET, and FTNT.
Scout pulled reported line items into the sheet as filed actuals, from 2023 through the latest reported quarter, and aligned four different fiscal calendars to calendar quarters. Palo Alto ends its fiscal year in July, while Okta, CrowdStrike, and Rubrik end in January, so the calendar alignment alone removed a meaningful amount of manual work.
The workbook includes 1,028 cells hyperlinked to source filings. Click any number and it opens the corresponding disclosure in Daloopa’s viewer. The detail tab includes share counts, cash, debt, revenue, GAAP operating income, D&A, an EBITDA build, the stock-based compensation bridge to adjusted EBITDA, diluted EPS, cash flow from operations, capex, and free cash flow.
A checks section ties each EBITDA build to its components, verifies that annual columns sum from four reported quarters, and runs a formula error scan. From there, I added my own 2026 and 2027 estimates into the estimate columns, and the summary tab calculated forward multiples off spot prices.
In other words: actuals from filings, estimates from me, and the audit trail in the sheet.
The comp table
Valuation, from the summary tab. Dollars in millions, multiples on calendar fiscal years.
| Company | Market Cap ($M)¹ | EV ($M)¹ | EV/Rev 2025² | EV/Rev 2026E³ | EV/Rev 2027E³ | EV/FCF 2025² | EV/FCF 2027E³ |
|---|---|---|---|---|---|---|---|
| PANW | 308,385 | 307,373 | 31.1x | 26.9x | 19.6x | 88.6x | 59.5x |
| OKTA | 30,934 | 30,171 | 10.3x | 9.4x | 8.5x | 34.5x | 28.1x |
| CRWD | 235,006 | 230,738 | 48.0x | 39.2x | 31.0x | 176.1x | 91.7x |
| RBRK | 21,589 | 22,291 | 16.9x | 12.8x | 11.1x | 88.0x | 52.4x |
| NET | 108,072 | 109,678 | 50.6x | 37.7x | 29.1x | 381.5x | 196.2x |
| FTNT | 128,743 | 126,308 | 18.6x | 15.7x | 14.5x | 56.7x | 39.1x |
| Median | 118,408 | 117,993 | 24.8x | 21.3x | 17.1x | 88.3x | 55.9x |
Growth figures use filing data structured by Daloopa and pulled into the model with Scout.
| Company | Rev Growth 2024 | Rev Growth 2025 | Rev CAGR 2023-25 | FCF Growth 2025 | FCF CAGR 2023-25 |
|---|---|---|---|---|---|
| PANW | 13.9% | 15.4% | 14.6% | 11.9% | 14.8% |
| OKTA | 15.3% | 11.8% | 13.6% | 17.9% | 31.8% |
| CRWD | 29.4% | 21.7% | 25.5% | 16.3% | 15.1% |
| RBRK | 41.2% | 48.5% | 44.8% | NM⁴ | NM⁴ |
| NET | 28.8% | 29.8% | 29.3% | 47.1% | 43.3% |
| FTNT | 12.3% | 14.2% | 13.2% | 18.4% | 13.4% |
| Median | 22.1% | 18.6% | 20.1% | 17.9%⁴ | 15.1%⁴ |
What the data shows
The group trades at a wide range of multiples, and the dispersion largely follows growth expectations. Trailing EV/revenue runs from 10.3x at Okta to 50.6x at Cloudflare, against a sector median of 24.8x.
Cloudflare has the highest revenue multiple in the set. Calendar Q2 2026 revenue of $696.1M grew 36% year over year, while the stock trades at 381.5x trailing free cash flow. On my 2027 estimates, the multiple is still 196.2x.
Rubrik is the outlier in the other direction. It grew calendar 2025 revenue 48.5%, the fastest in the set, and trades at 16.9x trailing revenue. CrowdStrike sits between the two, with calendar Q2 2026 revenue of $1,470.9M up 25.8% and a 48x trailing revenue multiple.
On profitability, the set splits cleanly. Fortinet posted calendar 2025 GAAP operating income of $2,084.7M, a 30.7% margin, and screens lower than most of the group on cash flow multiples. Palo Alto is the largest cash flow generator in the set, with calendar 2025 operating cash flow of $3,716M and free cash flow of $3,469.8M.
CrowdStrike, Rubrik, and Cloudflare all reported GAAP operating losses for the year, which is why the P/E column in the workbook shows NM and the market relies more heavily on revenue and free cash flow multiples for those names.
Why the sourcing matters
Every actual in the two tables above traces to a filed disclosure in one click. The trailing multiples link to the most recent source component behind each calculation, and the footnotes explain the derivation.
That is the practical reason to build comps this way. When a sheet feeds published work or investment research, the difference between an auditable number and a copied number matters. Scout keeps the audit trail in the cells, so the manual work shifts toward estimates, assumptions, and interpretation.
- Market cap and enterprise value are spot values computed from manually entered share prices with diluted share counts, cash and total debt from Daloopa actuals. Share prices carry no source IDs and are described here rather than hyperlinked.
- 2025 figures are calendar year aggregates of Daloopa quarterly actuals. Each trailing multiple links to the source ID of the most recent component in the calculation, the calendar Q4 2025 revenue print for EV/Revenue and the calendar 2025 operating cash flow disclosure for EV/FCF.
- 2026E and 2027E columns use my forward estimates entered into the workbook’s estimate columns. They are not Daloopa data and carry no source links.
- Rubrik’s 2025 free cash flow growth is not meaningful off a small 2024 base and is excluded from the FCF median.
This is research commentary, not investment advice.
