Industry overview

Small-cap cybersecurity stocks are drawing attention because the whole sector has shown real strength. Here, small-cap means security software companies valued at under $10 billion, small enough that a few years of steady execution could multiply the share price. The author first presented the theme on Masters in Trading LIVE on Sept. 15, and the sector is up 10% to 15% since then. What stood out was not just the gain but how it happened: cyber stocks rallied when the Nasdaq fell, and rallied again when it bounced, the kind of relative strength that shows where money is flowing.

The demand case starts with AI. Attacks now scale like software, and every board meeting asks what the company is doing about security; the answer is always to spend more. A company can trim almost any budget except the one that keeps it online. Gartner expects worldwide information security spending to reach $247.5 billion in 2026, up 12.7% in constant currency, and forecasts spending climbing from $192.9 billion in 2024 to $372.8 billion by 2030, roughly double. Securing AI itself is one of the fastest-growing pieces: Gartner sizes it at about $3 billion in 2026 and $16 billion by 2030, as companies pour money into AI tools, models, agents and copilots that all need protecting.

The author’s favorite name overall is Rubrik Inc. (RBRK). Most security companies try to stop the breach; Rubrik assumes some attacks will get through and gets paid on recovery. When defense fails, Rubrik cleans it up. He shared Rubrik with Stansberry Alliance members at a live conference in Las Vegas when it traded around $112; when he went live on Oct. 26, it was near $135, while most of the other stocks shared at that event were down and the Nasdaq had been getting hit. Rubrik has grown past the small-cap cutoff, with a market value of roughly $28 billion, so it is not on the list below.

Market values below are approximate, as of late October 2026. For each name, the author lays out what has to go right for a 5x move over the next three to five years. That is a scenario with conditions attached, not a forecast.

Rapid7 Inc. (RPD) is a higher-beta turnaround with the most torque if the market rerates it. At about $1.1 billion in market value, it generated roughly $145 million in trailing free cash flow, a free cash flow yield of about 13% based on its price late in the Oct. 26 session. The author first started talking about RPD when it traded around $12. The weakness is the top line: second-quarter revenue slipped 1.5% from a year earlier, though the company beat earnings estimates and raised its profit outlook. For a 5x move, revenue has to stop shrinking, margins need to expand, and the market has to stop pricing Rapid7 like a melting ice cube. RPD is one of the author’s two favorite small caps on this list, and also the riskiest.

Qualys Inc. (QLYS) runs cloud vulnerability scanning and has one of the best cash margins in software, earning an A for free cash flow on the author’s report card. Its free cash flow margin is about 45%, on a market value near $7.9 billion. What has to go right: growth keeps climbing toward the high teens while Qualys holds that cash margin. If it does, 5x is not a stretch, and Qualys likely becomes a steady compounder. QLYS and RPD are the two favorite small caps, with Rubrik still the top pick overall.

Tenable Holdings Inc. (TENB) sells exposure management, finding what is exploitable before threat actors do. Its market value is about $5.2 billion. For a 5x move, growth has to reaccelerate into the mid-teens as AI floods the world with new vulnerabilities.

Commvault Systems Inc. (CVLT) plays cyber resilience and recovery, the same lane as Rubrik, at about a quarter of the size (roughly $7 billion), and the stock is still below its 2025 highs. What has to go right: software-as-a-service annual recurring revenue keeps pulling growth higher, and the market starts pricing Commvault more like Rubrik.

SentinelOne Inc. (S) is the direct challenger to CrowdStrike Holdings Inc. (CRWD) and the cheapest of the sector leaders on sales. Its market value is about $8.9 billion, and it is getting close to its 2025 highs. What has to go right: SentinelOne keeps growing around 20% a year for five years and turns thin cash flow into CrowdStrike-like margins. A takeover is the wild card that could deliver a 5x-plus return faster.

For investors who find small caps too volatile, the large-cap pure plays are CrowdStrike, Palo Alto Networks Inc. (PANW), Fortinet Inc. (FTNT) and Zscaler Inc. (ZS). They are steadier, but they probably will not deliver a 5x return in three to five years. For a basket approach, the First Trust NASDAQ Cybersecurity ETF (CIBR), Amplify Cybersecurity ETF (HACK) and Global X Cybersecurity ETF (BUG) all give sector exposure.

Most of these companies report in the next few weeks: Rapid7 reports Nov. 4 and Qualys reports Nov. 9, both after the close. When the numbers come out, the author suggests checking them against the thesis. Is revenue growing? Are margins expanding? If yes, great. If not, that is a red flag and a reason to de-risk. A suggested shortcut is to drop the earnings release into ChatGPT or Claude and ask those two questions directly.

The author’s trading advice is to expect pullbacks and use them: these names will pull back, and that is when investors need to believe in the story rather than getting scared out of a position. He would rather build a position in tranches than go all in at once, so a pullback becomes a chance to add. If an investor owns upside calls and gets a big move, taking some money off the table is fine, and they can get back in on the next dip. For options, these are longer-term plays, so he would look 12 to 24 months out.

To sum up: cybersecurity is the budget nobody can cut, and the stocks are acting like it. Rubrik is the top pick, and Rapid7 and Qualys lead the small-cap list. Earnings will show whether each thesis is on track. The author has been tracking cybersecurity on Masters in Trading LIVE for a couple of months and will keep following these names as earnings come in; the free show airs at 11 a.m. ET.

Industry overview based on InvestorPlace

What it means for investors

The appeal here is the combination of a durable spending tailwind and small-cap torque. Gartner’s path from $192.9 billion in 2024 to $372.8 billion by 2030 gives the whole sector a growing market to sell into, and the relative strength since Sept. 15 suggests the market has noticed. But a 5x return is a scenario, not a forecast, and each name has to earn it: Rapid7 is the highest-risk, highest-reward pick, since it needs revenue to stop shrinking and a rerating from a roughly 13% free cash flow yield; Qualys is the quality compounder, with a 45% free cash flow margin that can do the heavy lifting if growth reaches the high teens; SentinelOne carries a takeover wild card on top of a 20% growth target. The practical checkpoints are the earnings reports on Nov. 4 for Rapid7 and Nov. 9 for Qualys, judged on the author’s two questions about revenue growth and margin expansion. Investors who want the theme without single-stock risk can use the CIBR, HACK or BUG ETFs, or the steadier large caps, accepting that a 5x outcome is unlikely there. Either way, small-cap positions should be sized for volatility, built in tranches, and held with a 12-to-24-month horizon if options are involved.

What it means for employees

For employees, the spending boom is good news for hiring: security budgets that cannot be cut mean steady demand for engineers, analysts and sales staff at companies like Qualys, Tenable, Commvault and SentinelOne, and for the recovery specialists Rubrik employs. But the same AI trend driving demand is also raising the pressure on security teams everywhere, since attacks now scale like software and defenders are expected to keep up around the clock. At turnaround names such as Rapid7, the push for margin expansion can also mean cost discipline and restructuring pressure, so job security there depends on the same revenue recovery the stock thesis requires.

What it means for customers

For customers, meaning the businesses buying this software, security is becoming a non-negotiable cost: worldwide spending is forecast to rise 12.7% in 2026 to $247.5 billion, so buyers should expect higher prices and more vendors pitching AI-protection tools. The upside is real protection in a world where AI is arming attackers, and recovery-focused products like Rubrik’s and Commvault’s mean less downtime when a breach does happen. For everyday consumers, the benefit is indirect but tangible: fewer successful attacks on the companies holding their data, though some of the higher security spending will eventually show up in the prices of the services they use.

This article is for educational purposes only and is not investment advice.

Note: Investment calculations and projections are for illustrative purposes only. Market conditions change frequently. Consult a qualified financial advisor before making investment decisions.