Direct Answer
140 SEC filers are classified under the Standard Industrial Classification code that describes the zero trust security industry, and their latest annual reports show $630.2 billion of combined revenue and a median operating margin of -5.5%. Investors should still evaluate its revenue model, industry-specific KPIs, valuation framework and the risks that can change the group's economics.
Industry Overview
Zero trust security companies sell cloud-delivered services that verify users and devices and give access to specific applications rather than whole networks. They are replacing legacy VPN and firewall approaches and are subscription-based. The first numbers to compare across companies here are annual recurring revenue, net retention and customers over a spend threshold.
Key Industry Metrics
- Annual recurring revenue: Annualized value of subscriptions for cloud-delivered access services. It shows how much revenue repeats, and growth reflects replacement of VPN and firewall approaches.
- Net retention: Spending from existing customers versus a year earlier. Above 100% shows customers adding users, locations and services, and declines show consolidation or reductions in staff.
- Customers over a spend threshold: Accounts paying above a stated annual amount. It shows larger enterprise rollouts, but each company chooses its own cutoff, so compare one company over time.
- Gross margin: Revenue left after cloud capacity, bandwidth and support. Services that sit in the traffic path need global infrastructure, so margin shows how efficiently it is run.
- Free cash flow: Cash from operations after capital spending. Annual upfront billing lifts cash ahead of revenue, so it shows how much growth converts into cash.
Primary Macro Drivers
- Remote and hybrid work: Staff working outside the office need access that does not depend on a corporate network, driving demand for cloud-delivered access and annual recurring revenue.
- Cloud and software-as-a-service adoption: As more applications are hosted by others, companies need to control access directly instead of through the network, expanding the market.
- Regulation and breach risk: Rules and breach costs push buyers to limit access to what is needed, supporting bookings and renewals.
- Legacy VPN replacement: Companies retiring older remote-access and firewall setups buy cloud-delivered replacements, creating a conversion pool for subscriptions.
Major Risks
- Competition from large security platforms: Large security platforms offer similar access services within broader contracts, pressuring win rates and price; watch net retention and customer growth.
- Pricing pressure: Rivals and negotiating buyers push prices down at renewal, narrowing gross margin; watch revenue per customer and customers over a spend threshold.
- Slow enterprise decisions: Replacing network architecture is a big project that goes through long reviews, delaying revenue; watch billings against revenue and delayed-deal commentary.
- Architecture shifts: New models of access or consolidation of tools can shift spend among vendors; watch net retention, customer growth and platform adoption.
Industry Characteristics
| Characteristic | Profile |
|---|---|
| Cyclicality | Mixed |
| Capital Intensity | Low |
| Regulatory Intensity | Low |
| Industry Maturity | Growth |
| Geographic Importance | U.S. / Global |
Zero Trust Security Filers in the SEC Record
140 companies with annual reports in the dataset are classified by the SEC in the Standard Industrial Classification code 7372. Their latest fiscal years end between 2024 and 2026, and together they reported $630.2 billion of revenue. Median revenue growth over the prior year was 13.5%. Median operating margin was -5.5% and median net margin -2.3%. Median total liabilities were 44% of total assets, and 65 of 140 reported a profit in their latest year.
| Company | Revenue | Growth | Operating margin | Net margin | Year |
|---|---|---|---|---|---|
| Microsoft Corp | $281.7 billion | 14.9% | 45.6% | 36.1% | FY 2025 |
| Oracle Corp | $67.4 billion | 17.3% | 30.6% | 25.2% | FY 2026 |
| Salesforce, Inc. | $41.5 billion | 9.6% | 20.1% | 18.0% | FY 2026 |
| Block, Inc. | $24.2 billion | 0.3% | 7.1% | 5.4% | FY 2025 |
| Adobe Inc. | $23.8 billion | 10.5% | 36.6% | 30.0% | FY 2025 |
| Intuit Inc. | $18.8 billion | 15.6% | 26.1% | 20.5% | FY 2025 |
| Servicenow, Inc. | $13.3 billion | 20.9% | 13.7% | 13.2% | FY 2025 |
| Shopify Inc. | $11.6 billion | 30.1% | 12.7% | 10.7% | FY 2025 |
The 8 largest of 140 by revenue. Source: each company's own annual report as filed with the SEC (XBRL data), figures in U.S. dollars. A company's SIC code reflects its main business as the SEC records it, so it can differ from how an index provider or analyst classifies the company, and a diversified group appears under only one code.
Where to Go Next
The Zero Trust Security guide describes how the industry earns money, what to measure and what can go wrong. To see how it compares, read the neighbouring industries in the same sector, then apply the same checks to a specific company.
More in Information Technology
- Information Technology sector overview
- Advanced Packaging & Chiplets
- Wireless Network Equipment
- AI Agent Platforms
- Wearables
- AI Application Software
- Wafer Fabrication Equipment
- AI Data Lifecycle Services
- Vertical Market Software
Put it to work
Frequently Asked Questions
What are the main KPIs for the Zero Trust Security industry?
Key performance indicators for the Zero Trust Security industry include: Annual recurring revenue, Net retention, Customers over a spend threshold, Gross margin, Free cash flow. Which matter most depends on the company's model, so compare them across several companies rather than relying on one.
How cyclical is the Zero Trust Security industry?
The Zero Trust Security industry exhibits mixed cyclicality characteristics. Some segments move with the broader economy while others maintain more stable demand, making stock selection within the group particularly important.
What are the biggest risks in the Zero Trust Security industry?
The primary risks for Zero Trust Security companies include: Competition from large security platforms, Pricing pressure, Slow enterprise decisions, Architecture shifts. Investors should assess each company's exposure to these factors and its track record of navigating them.