The "Earnings Paradox" in Cybersecurity: Performance Exceeds Expectations, But Stock Prices Fall — Is Overvaluation the Culprit or the Market Sending a Warning Signal?

In the first week of June 2026, the cybersecurity sector experienced an "earnings shock" worth a deep dive. On June 3-4, four core cybersecurity companies — CrowdStrike (CRWD) , Palo Alto Networks (PANW) , SentinelOne (S) , and Rubrik (RBRK) — successively released their earnings reports. Although all four delivered results that met or exceeded market expectations on key operational metrics, the secondary market’s response showed a rare pattern of collective negative feedback: CrowdStrike plunged about 10% after hours, Palo Alto Networks dropped 5.6% in regular trading, SentinelOne had already fallen roughly 16.8%, and even Rubrik faced downward pressure after announcing better-than-expected results.

The market’s interpretation was strikingly uniform — the issue wasn’t that earnings were "bad," but that expectations were "too high." But beneath this lies the core challenge facing the entire cybersecurity sector in 2026: When high valuations collide with slowing growth guidance, how should investors reassess the investment logic of this track?

CrowdStrike: Revenue Beats Estimates but Full-Year Guidance "Misses Expectations"

CrowdStrike released its FY2027 Q1 earnings on June 3 after the market close. On the core data front: Revenue reached $1.39 billion, up 25.6% year-over-year, exceeding analyst expectations of $1.36 billion; EPS came in at $1.10, compared to $0.73 in the same period last year. By any conventional standard, this was a solid earnings report.

But the issue lay in the guidance. The company’s Q2 revenue guidance of $1.43 billion to $1.44 billion was essentially in line with analysts’ expectations of $1.43 billion; adjusted EPS guidance of $1.16 to $1.17 also just met the market consensus. Compared to the previous quarter, the implied Q2 revenue growth rate was around 19%, showing a clear marginal deceleration. For a stock that had accumulated significant gains since its last earnings release, "in line with expectations" often means it falls short of the market’s implied high-growth pricing.

On the same day, Broadcom also released its earnings — revenue of $22.19 billion, up 48% year-over-year, with AI semiconductor revenue hitting a record $10.8 billion — yet its stock dropped over 5% after hours. The synchrony between CRWD and Broadcom in "earnings beat + market sell-off" reflects a common vulnerability in high-valuation tech stocks: When performance delivery no longer provides directional upside surprises, the massive gains previously accumulated become a source of selling pressure.

Palo Alto Networks: Strongest Fundamentals, But Caught in "Peer Drag"

Palo Alto Networks posted the strongest fundamental performance this earnings season. Its Q3 fiscal revenue reached $3 billion, up 31% year-over-year, exceeding market expectations of $2.94 billion; adjusted EPS was $0.85, beating analyst projections of $0.79. Even more noteworthy were its forward-looking indicators: Remaining Performance Obligations (RPO) hit $18.4 billion, up 36% year-over-year; current RPO (cRPO) stood at $8.3 billion, up 34% year-over-year. The company further raised its full-year revenue guidance to $11.415 billion to $11.425 billion, representing approximately 24% growth.

However, PANW shares fell 5.6% in regular trading following the earnings release, and then continued to weaken for three consecutive sessions under pressure from CRWD’s after-hours plunge. This phenomenon reveals an important truth: Within high-valuation sectors, expectation management has overtaken individual performance itself as the core variable determining short-term stock price movements. Even when a company delivers a "beat" on its fundamental results, investors tend to adopt a "sell first, ask questions later" defensive posture when the entire sector faces a narrative of slowing growth.

SentinelOne and Rubrik: Growth Differentiation Amid Scale Disparities

SentinelOne is the smallest of the four companies. Its Q1 revenue reached $277 million, up 21% year-over-year, slightly below analyst expectations of $277.43 million; adjusted EPS was $0.04, exceeding market expectations of $0.02. ARR hit $1.163 billion, up 23% year-over-year, with net new ARR reaching $44 million, up 55% year-over-year. Non-endpoint product revenue as a percentage of total approached 50% for the first time, reflecting progress in product portfolio diversification. Following the earnings release, the stock fell about 16.8%, indicating that the market’s disappointment with its revenue growth overshadowed positive signals on profitability and net new ARR.

Rubrik posted the fastest year-over-year growth among the four companies. Revenue reached $387.07 million, up 39% year-over-year, exceeding market expectations by 5.71%; adjusted EPS turned profitable at $0.16, compared to a loss in the same period last year. Subscription ARR hit $1.57 billion, up 32% year-over-year. The company also raised its full-year adjusted EPS guidance to $0.25-$0.35, well above analyst expectations of $0.17. Rubrik focuses on the data security and cyber recovery track, holding a unique structural position in the "data as a core asset" trend. With a subscription rate exceeding 95%, its valuation-anchored growth expectations are more grounded compared to peers.

Valuation Comparison of the Four Companies: Reassessing Value from P/S and P/S/G Perspectives

For secondary market investors, fundamental data represents only half of the "truth"; the other half is price. Below is an overview of key valuation metrics for each company as of early June 2026:

Data Sources: Public Market Data and Industry Analysis

In valuation analysis, P/S/G (Price-to-Sales / Revenue Growth Ratio) offers a more comprehensive framework than P/S alone. CrowdStrike’s forward P/S of ~24x, corresponding to an expected FY2026 revenue growth rate of approximately 20-22%, yields a P/S/G of about 1.1-1.2 — the richest valuation among the four. This largely explains why a slowdown in its growth guidance triggered more severe valuation corrections. Palo Alto Networks’ forward P/S of ~15x, corresponding to full-year revenue growth of ~24%, yields a P/S/G of around 0.63. Given its massive scale and continued multi-product expansion, this metric sits in a relatively reasonable range. SentinelOne’s forward P/S of ~6-7x, corresponding to expected revenue growth of ~18-20%, yields a P/S/G of about 0.35-0.38. However, the risk of not yet being profitable introduces ongoing valuation uncertainty. Rubrik’s forward P/S of ~5-6x, corresponding to actual growth of 39%, yields a P/S/G as low as about 0.13-0.15, presenting a rare "growth premium discount" feature when weighing growth versus value. However, this discount partially reflects market uncertainty premium due to Rubrik’s shorter operating history and lack of a complete performance cycle.

Mid-to-Long Term Trends and Narrative Evolution in Cybersecurity

This valuation divergence is no short-term phenomenon — it marks the sector’s transition from a "broad rally phase" to a "selection phase." In 2026, the structural trends in cybersecurity continue: Enterprise cybersecurity budget growth continues to outpace overall IT budget growth, and AI-driven security is emerging as a new growth engine. The global security software market is expected to accelerate to approximately 16% growth in 2026, reaching about $114 billion.

However, the market’s definition of "high growth" is shifting. As the entire industry converges from growth rates above 30% to lower levels, previously accepted valuation premiums will face stress tests. For CrowdStrike, the ecological expansion capability of its Falcon platform remains key to maintaining valuation, but slowing growth guidance reduces the margin for error in short-term judgment. For PANW, platform integration (including acquisitions like CyberArk) and an early-mover position in AI security keep it favorably positioned in the race for scale. UBS also noted in its January 2026 cybersecurity industry outlook that CrowdStrike and Palo Alto Networks are well-positioned in the core theme of AI-enabled security and identity security.

SentinelOne and Rubrik offer differentiated paths: The former, with AI-driven EDR at its core, is evolving toward a broader XDR platform; the latter has established a first-mover advantage in the high-barrier data security niche. Its positioning in ransomware recovery and data sovereignty compliance could serve as the next-phase growth catalyst.

Gate Launches Stock Trading: A New Channel for Investing in Cybersecurity

Against the backdrop of cybersecurity sector valuation reassessment and increasing divergence among individual stocks, investor demand for convenient, low-cost access to this track is rising. On June 1, 2026, Gate officially launched real U.S. stock spot trading services , allowing users to directly trade over 10,000 stocks and ETFs on major markets like NASDAQ and NYSE using USDT within the platform. Coverage includes core cybersecurity stocks like CrowdStrike (CRWD), Palo Alto Networks (PANW), SentinelOne (S), and Rubrik (RBRK), as well as various ETFs tracking the tech sector or cybersecurity industry, providing investors a one-click sector allocation option.

Gate stock trading’s core advantages manifest in three dimensions:

Zero Holding Cost. Unlike margin interest charged by traditional U.S. brokers or funding rates and overnight fees on certain crypto platform CFD products, Gate stock spot trading imposes no holding costs whatsoever — a significant cost advantage for investors planning long-term positions.

Direct USDT Trading, Eliminating Fiat Friction. Users can buy and sell U.S. stocks directly with USDT. This design compresses the conversion cost between crypto asset holdings and global stock exposure to a minimum, delivering a user experience closer to the natural flow of spot crypto trading.

Real Dividends Automatically Credited, Full Corporate Action Coverage. Gate stock trading connects with compliant brokers holding U.S. Broker-Dealer licenses and clearing qualifications. Real market access ensures that corporate actions such as dividends, stock splits, and reverse splits are automatically synchronized and processed, fully protecting investor rights. Additionally, the platform supports fractional share trading with a minimum of 0.01 shares, significantly lowering the entry threshold for individual stock investing.

How to Trade Cybersecurity Stocks on Gate: Update the Gate App to version 8.21.5 or above, complete basic platform identity verification, and then transfer USDT from your spot account or funding account to the separate stock account (fee-free, real-time crediting). After the transfer, select your target stock for trading during U.S. Eastern trading hours (9:30 AM-4:00 PM), supporting both market orders and limit orders. Crypto assets and stock assets within the account are managed in parallel within the same system — no cross-platform operations required.

Conclusion

The results of this earnings season send a clear signal: The cybersecurity track is transitioning from the "broad rally phase" of 2024-2025 to the "valuation selection phase" of 2026. As the industry’s overall growth rate gradually converges from above 30% to the 20% range, individual stocks’ differentiated competitive moats, customer stickiness, and platform penetration capabilities will become the core variables determining valuation premium allocation.

Based on the latest earnings reports from the four companies, Palo Alto Networks leads in scale and growth sustainability, though its valuation is already relatively full. CrowdStrike, after its pullback, offers a more attractive entry price point, but close monitoring is needed to see whether growth rates stabilize and recover in the second half of the year. SentinelOne remains in a transformation verification phase, with a risk-return profile leaning more toward growth-oriented allocation. Rubrik stands out with its differentiated track and impressive growth trajectory, still retaining some room on the valuation front.

For investors, this window of valuation divergence precisely offers opportunities for stock selection. And Gate’s U.S. stock trading function, with zero holding costs and direct USDT settlement, reduces traditional cross-border frictions, enabling more users to flexibly participate in this round of reassessment of cybersecurity investment logic.