Better Buy: FireEye Inc. or CyberArk Software Ltd?

Cybersecurity is a rapidly growing market, due in part to the rise of increasingly sophisticated data breaches worldwide. The Identity Theft Resource Center reports that the number of personal records exposed in data breaches doubled last year to nearly 178 million, and research firm Markets and Markets expects the global cybersecurity market to grow from $106 billion in 2015 to $170 billion by 2020.

However, many cybersecurity stocks have declined over the past year due to concerns about sluggish enterprise spending, lofty valuations, and competition from bigger IT companies. Two such companies caught in that sell-off are FireEye and CyberArk .

Image source: Getty Images.

FireEye has lost nearly 70% of its value over the past 12 months, and currently trades at a 20% discount to its IPO price. CyberArk has held up better with a 16% decline, and remains well above its IPO price. Let's take a closer look at both companies and see which is the better long-term play on the cybersecurity market.

What do FireEye and CyberArk do?

FireEye specializes in threat prevention solutions that monitor the perimeter of a network for external threats. This market is a large one, and includes next-gen firewall provider Palo Alto Networks, networking giant Cisco'ssecurity solutions, and similar solutions from bigger IT companies. To widen its moat, FireEye has been pivoting away from its on-site and cloud-based appliances to FaaS (FireEye as a Service), a cloud subscription platform which would reduce its dependence on slower-growth product revenue.

CyberArk specializes in privileged account management (PAM), which protects networks from internal threats like disgruntled employees. If CyberArk's software detects an internal breach, it locks down the affected computer and cuts it off from the rest of the network. CyberArk dominates this market, which is a much smaller market than the threat prevention one. Its only meaningful competitor is CA Technologies, which IDC calls a "major player" in the PAM market, while CyberArk remains the"market leader."

Both FireEye and CyberArk are considered "best in breed" players in their respective fields. FireEye was the first cybersecurity firm to be certified by theU.S. Department of Homeland Security, and CyberArk was recently certified by theU.S. Department of Defense. FireEye serves over 4,000 customers worldwide, including more than 650 of the Forbes Global 2000. CyberArk has over 2,600 customers worldwide, which include 40% of the Fortune 100 companies and 17 of the 20 biggest banks in the world.

How fast are FireEye and CyberArk growing?

FireEye and CyberArk are both known for posting double-digit sales growth, but FireEye has posted slower sales growth than CyberArk in its two most recent quarters.

Q1 2015

Q2 2015

Q3 2015

Q4 2015

Q1 2016

FireEye

69%

56%

45%

29%

34%

CyberArk

89%

70%

43%

42%

YOY revenue growth. Data source: Quarterly reports.

Some of that slowdown can be attributed to FireEye's larger size (FireEye generated over three times as much revenue as CyberArk last quarter), but it can also be attributed to rising competition in the threat prevention market, and a higher mix of recurring product subscriptions, which must be recognized over a longer period of time.

CyberArk faces less competition, so its revenue growth has remained fairly steady. It trades at 8.5 times sales, which is much higher than FireEye's P/S ratio of 4, but that multiple also indicates that investors expect CyberArk's sales to grow at a faster rate than FireEye's.

Profits and cash flow

FireEye isn't profitable on either a non-GAAP or GAAP basis, and its losses have been widening due to higher expenses and its planned acquisitions of threat prevention peers iSIGHT andInvotas. FireEye also finished last quarter with a negative operating cash flow of $22.5 million, compared to negative $3.2 million a year ago, and its cash position fell 56% sequentially to $175 million.

Those are all bad signs for current investors, since FireEye has already relied on secondary and convertible debt offerings to raise cash over the past two years. FireEye has also gone through some big executive changes over the past year -- CFO Michael Sheridan resigned last July, and CEO Dave DeWalt stepped down earlier this year.

CyberArk is profitable by both non-GAAP and GAAP metrics, a rare combination among cybersecurity companies. The company's GAAP net income rose 2% annually to $4.3 million last quarter, giving it earnings of $0.12 per share. Its cash and marketable securities position also improved nearly 7% sequentially to $254 million, indicating that it won't need to rely on secondary offerings anytime soon. The company also hasn't lost as many major executives as FireEye.

The verdict

FireEye is less appealing than CyberArk for five simple reasons -- its sales growth is slower, it's less profitable, it's burning through cash more quickly, it faces more competition, and its future looks cloudier due to recent executive departures. Therefore, investors who want to dip their toes into the cybersecurity market should consider buying CyberArk instead of FireEye.

The article Better Buy: FireEye Inc. or CyberArk Software Ltd? originally appeared on Fool.com.

Leo Sun owns shares of Cisco Systems and CyberArk Software. The Motley Fool owns shares of and recommends FireEye. The Motley Fool recommends Cisco Systems, CyberArk Software, and Palo Alto Networks. Try any of our Foolish newsletter services free for 30 days. We Fools may not all hold the same opinions, but we all believe that considering a diverse range of insights makes us better investors. The Motley Fool has a disclosure policy.