Direct Answer
140 SEC filers are classified under the Standard Industrial Classification code that describes the application security industry, and their latest annual reports show $630.2 billion of combined revenue and a median operating margin of -5.5%. Investors should still evaluate its revenue model, industry-specific KPIs, valuation framework and the risks that can change the group's economics.
Industry Overview
Application security companies sell tools that find and prevent vulnerabilities in software during development and in production. Revenue is subscription-based and follows software development activity and compliance needs. The first numbers to compare across companies here are annual recurring revenue, net retention and customer count.
Key Industry Metrics
- Annual recurring revenue: Annualized subscription value for scanning and protection tools. It follows development activity and compliance needs, and growth shows how many code bases and applications are covered.
- Net retention: Spending from existing customers versus a year earlier. Above 100% shows customers adding applications, teams or modules, while drops suggest consolidation into broader platforms.
- Customer count: The number of organizations paying for tools. Growth shows reach, but a handful of large accounts can dominate, so read count together with average contract size.
- Gross margin: Revenue left after hosting and support. Software that scans code is largely digital, so margins are usually high, and cloud-delivered testing adds some hosting costs.
- Bookings growth: The value of new contracts signed in a period. It leads revenue, but long sales cycles make timing lumpy, so compare with prior years rather than adjacent quarters.
Primary Macro Drivers
- Software supply chain risk: A rise in attacks through open-source packages and build systems pushes firms to scan and verify code, supporting annual recurring revenue and customer count.
- Cloud-native development: Applications built from containers and services create more code and settings to check, expanding the number of apps and developers covered.
- Regulation: Rules requiring secure development and software bills of materials add mandatory spending, supporting renewals and larger deals.
- Security budgets: Security spending as a share of IT drives how much goes to code and application tools, shown in bookings growth and customer count.
Major Risks
- Platform consolidation: Customers prefer fewer vendors, so broader platforms can absorb point tools; watch net retention, customer growth and module attach.
- Competition from large vendors: Large vendors package code scanning into other products at low incremental cost, pressuring pricing and win rates; watch discounting and net retention.
- Budget cuts: Companies trimming budgets pause new tools or cut seats, slowing bookings; watch bookings growth and billings.
- Long sales cycles: Reviews by security, legal and engineering teams stretch deals over many months, delaying revenue; watch billings against revenue and delayed-deal commentary.
Industry Characteristics
| Characteristic | Profile |
|---|---|
| Cyclicality | Mixed |
| Capital Intensity | Low |
| Regulatory Intensity | Low |
| Industry Maturity | Growth |
| Geographic Importance | U.S. / Global |
Application Security Filers in the SEC Record
140 companies with annual reports in the dataset are classified by the SEC in the Standard Industrial Classification code 7372. Their latest fiscal years end between 2024 and 2026, and together they reported $630.2 billion of revenue. Median revenue growth over the prior year was 13.5%. Median operating margin was -5.5% and median net margin -2.3%. Median total liabilities were 44% of total assets, and 65 of 140 reported a profit in their latest year.
| Company | Revenue | Growth | Operating margin | Net margin | Year |
|---|---|---|---|---|---|
| Microsoft Corp | $281.7 billion | 14.9% | 45.6% | 36.1% | FY 2025 |
| Oracle Corp | $67.4 billion | 17.3% | 30.6% | 25.2% | FY 2026 |
| Salesforce, Inc. | $41.5 billion | 9.6% | 20.1% | 18.0% | FY 2026 |
| Block, Inc. | $24.2 billion | 0.3% | 7.1% | 5.4% | FY 2025 |
| Adobe Inc. | $23.8 billion | 10.5% | 36.6% | 30.0% | FY 2025 |
| Intuit Inc. | $18.8 billion | 15.6% | 26.1% | 20.5% | FY 2025 |
| Servicenow, Inc. | $13.3 billion | 20.9% | 13.7% | 13.2% | FY 2025 |
| Shopify Inc. | $11.6 billion | 30.1% | 12.7% | 10.7% | FY 2025 |
The 8 largest of 140 by revenue. Source: each company's own annual report as filed with the SEC (XBRL data), figures in U.S. dollars. A company's SIC code reflects its main business as the SEC records it, so it can differ from how an index provider or analyst classifies the company, and a diversified group appears under only one code.
Where to Go Next
The Application Security guide describes how the industry earns money, what to measure and what can go wrong. To see how it compares, read the neighbouring industries in the same sector, then apply the same checks to a specific company.
More in Information Technology
- Information Technology sector overview
- Application Software
- Analytics Software
- Artificial Intelligence Software
- Analog Semiconductors
- Augmented & Virtual Reality Hardware
- AI Software Platforms
- Automotive Semiconductors
- AI Servers
Put it to work
Frequently Asked Questions
What are the main KPIs for the Application Security industry?
Key performance indicators for the Application Security industry include: Annual recurring revenue, Net retention, Customer count, Gross margin, Bookings growth. Which matter most depends on the company's model, so compare them across several companies rather than relying on one.
How cyclical is the Application Security industry?
The Application Security industry exhibits mixed cyclicality characteristics. Some segments move with the broader economy while others maintain more stable demand, making stock selection within the group particularly important.
What are the biggest risks in the Application Security industry?
The primary risks for Application Security companies include: Platform consolidation, Competition from large vendors, Budget cuts, Long sales cycles. Investors should assess each company's exposure to these factors and its track record of navigating them.