In most software, "good enough" wins. In security it's a catastrophe that changes everything.

Cybersecurity is the one software category where the customer cannot afford the cheap-and-cheerful option, because the cost of failure isn’t inconvenience — it’s a breach. “Good enough” security is how you end up on the front page. That single fact rewires the economics: buyers resist bundling, tolerate premium pricing, and cling to what works. It’s why security houses some of the best pricing power in all of software — and it’s fueled by fear, the most durable demand driver there is.

But that same fear cuts back through two hidden costs. First, security companies pay abnormally high stock-based comp — the talent is scarce and fought over. CrowdStrike’s SBC ran ~$1.1B, roughly 23% of revenue, which both dilutes shareholders and heavily flatters free cash flow (recall Chapter 7: its ~$1.31B reported FCF shrinks toward ~$210M once you stress-test for SBC). Second is tail risk: the self-inflicted incident. When a security vendor’s own product fails, it doesn’t just hit a quarter — it attacks the core product, which is trust.

Which is exactly where the category’s most valuable lesson lives. After CrowdStrike’s 2024 global outage — enormous, with compensation and litigation and a stock plunge — it still grew to ~$4.8B. That’s consistent with a moat that held under extreme pressure (deep embedding in security operations, the pain of ripping out endpoint protection) — though aggregate revenue alone can’t prove retention; you’d verify that with renewal, NRR/DBNRR, and bookings data. If the moat is genuinely deep, a panic crash on a self-inflicted incident can be the rare chance to test-and-buy a quality company; if it’s shallow, the same crash is the start of a long decline. Telling those two apart is the highest-return judgment in security investing.

This is what makes security such a rich field for the “good company, bad stock” lens. The moat and the pricing power are genuinely there — but so is a fear-driven tendency to price the best names for perfection, and a tail risk (the self-inflicted incident) that no model fully captures. The winners here are underwritten net of SBC and with room left for a bad day; the losers are bought at a perfect price, right before trust is tested.

Okta shows the other arc: after its own trust setback, it’s turned GAAP-profitable (~$765M quarterly revenue, ~$74M net) while peers still post losses — a “turnaround candidate” whose thesis rests not on a growth story but on trust repair plus profit discipline. Meanwhile the field consolidates: Palo Alto (~$3B/quarter) and CrowdStrike push toward platforms. In security, price power is real — but so is the fear on both sides of the trade.

This is Chapter 11 of “Compounding in the Cloud.”