Worldwide end-user spending on information security is still climbing. Gartner projects the market at about $240 billion in 2026, up 12.5% from $213 billion in 2025. Inside that total, security software is the fastest-growing slice — and that is where platform vendors are converting budgets into multi-year contracts.
For a 50-plus investor, the durable story is not a single stock print. It is whether enterprises keep consolidating point tools onto fewer platforms, and whether those platforms keep turning that consolidation into recurring revenue and cash flow.
- Gartner (July 29, 2025): worldwide information-security end-user spending rises from $213 billion in 2025 to about $240 billion in 2026 (+12.5%); security software is the fastest-growing segment, from $105.9 billion in 2025 to $121.2 billion in 2026.
- CrowdStrike (fiscal 2026 ended Jan. 31, 2026): ending annual recurring revenue reached $5.25 billion, up 24%, on a record $1.01 billion of net new ARR; free cash flow was $1.24 billion.
- Palo Alto Networks (fiscal 2026 ended July 31, 2026): Next-Generation Security ARR reached $9.10 billion, up 63%, while remaining performance obligations hit $21.2 billion, up 34%.
Software is where the growth is concentrating
Gartner’s July 2025 snapshot breaks the market into three buckets. Security software moves from roughly $95.0 billion in 2024 to $105.9 billion in 2025 and $121.2 billion in 2026. Security services grow from $77.1 billion to $83.8 billion to $92.8 billion. Network security rises from $21.3 billion to $23.3 billion to $25.8 billion.
The firm ties the software lead to cloud migration — cloud security posture management and cloud access security brokers sit at the center — plus rising threats, regulatory pressure, and broader use of AI by both defenders and attackers. Established security budgets keep rolling. New discretionary projects can pause in a cautious climate. The multi-year spend curve still points up.
Platforms turn spend into contracted ARR
CrowdStrike’s fiscal 2026 results show what platform depth looks like in dollars. Ending ARR hit $5.25 billion, the company said it was the fastest pure-play cybersecurity software firm to clear that mark. Net new ARR for the year was a record $1.01 billion, up 25%. Fourth-quarter net new ARR alone was about $331 million, up 47%. Full-year revenue was $4.81 billion, up 22%, with subscription revenue at $4.56 billion, up 21%. Free cash flow reached $1.24 billion, or about 26% of revenue.
Usage and attach matter as much as the top-line ARR print. Falcon Flex accounts ended at $1.69 billion of ARR, up more than 120% year over year. Module adoption stood at 50% of customers on six or more modules, 34% on seven or more, and 24% on eight or more. Management guided fiscal 2027 ARR to roughly $6.47 billion to $6.52 billion, implying about 23% to 24% growth. That is a multi-quarter contract and expansion story, not a one-day tape move.
Palo Alto Networks’ fiscal 2026 close, filed with the SEC for the year ended July 31, 2026, shows the same consolidation pattern at larger scale. Next-Generation Security ARR finished the fourth quarter at $9.10 billion, up 63%. Management said the company added nearly $1 billion of net new NGS ARR in that single quarter. Remaining performance obligations reached $21.2 billion, up 34%. Full-year revenue was $11.48 billion, up from $9.22 billion — about 24% growth. Adjusted free cash flow margin for the year was 38.4%.
The company’s fiscal 2027 outlook keeps the multi-year frame in view: NGS ARR of about $11.08 billion to $11.18 billion (22% to 23% growth), RPO of about $25.2 billion to $25.4 billion, and revenue of about $14.1 billion to $14.2 billion. Management still points to a longer-term $20 billion NGS ARR target by fiscal 2030. Those are backlog and platformization metrics investors can track across quarters.
What the numbers imply — and what they do not
High ARR growth and rising RPO do not erase competition, integration risk after large acquisitions, or the fact that customers can optimize consumption-based usage. CrowdStrike’s own disclosures still reference costs tied to the July 2024 sensor incident. Palo Alto’s GAAP results can swing with acquisition accounting and fair-value items even when non-GAAP operating income and cash flow look strong.
The investor question is simpler than the noise. Who is capturing a durable share of the software slice as enterprises reduce tool sprawl? Who is converting that share into contracted ARR, multi-year RPO, and free cash flow that survives a cautious IT budget cycle?
What to watch
Watch three multi-quarter markers. First, whether Gartner’s software segment keeps outgrowing services and network security through 2026–2027 updates. Second, whether CrowdStrike’s net new ARR and module attach stay in the mid-teens-to-twenties growth band as it scales past $5 billion ARR. Third, whether Palo Alto’s NGS ARR and RPO growth decelerate only gradually from the fiscal 2026 spike as platformization matures toward the fiscal 2030 target.
Security software is pulling ahead inside a still-expanding market. Platforms that lock that spend into multi-year contracts are the lane for patient capital — not every cybersecurity headline, and not every same-day percentage move.
