Listen to the audio version of this article (generated by AI).

Small-cap cybersecurity stocks are on my radar because the whole sector has been showing real strength. By small-cap here, I mean security software companies valued at under $10 billion, small enough that a few years of steady execution could multiply the share price.

On Sept. 15, I shared my first cybersecurity presentation on Masters in Trading LIVE. The sector is up 10% to 15% since then. The gains caught my attention less than the way they happened. When the Nasdaq got hit, cyber stocks rallied. When the Nasdaq bounced, they rallied again. That kind of relative strength tells you where the money is going.

Below are five cybersecurity stocks under $10 billion that I’m following, plus the larger name that remains my favorite in the whole space.

Why Cybersecurity Stocks Keep Getting Bought

AI is arming the attackers. Attacks now scale like software, and every board meeting asks the same question: what are we doing about security? Right now the answer is always to spend more. A company can trim almost any budget, except the one that keeps it online.

The forecasts back that up. Gartner expects worldwide information security spending to reach $247.5 billion in 2026, up 12.7% in constant currency. Its latest forecast has spending climbing from $192.9 billion in 2024 to $372.8 billion by 2030, roughly double.

Securing AI itself is one of the fastest-growing pieces. Gartner sizes it at about $3 billion in 2026 and $16 billion by 2030. Companies are pouring money into AI tools, models, agents and copilots, and every one of them needs protecting.

My Favorite Cybersecurity Stock: Rubrik

Rubrik Inc. (RBRK) is still my absolute favorite name in cybersecurity. Most security companies try to stop the breach. Rubrik assumes some attacks will get through, and it gets paid on recovery. When defense fails, Rubrik cleans it up.

I shared Rubrik with Stansberry Alliance members at a live conference in Las Vegas when it traded around $112. When I went live on Oct. 26, it was near $135. Most of the other stocks shared at that event were down, and the Nasdaq had been getting hit.

Rubrik has grown past my small-cap cutoff, with a market value of roughly $28 billion. That’s why it isn’t on the list below. If you want the after-the-breach angle in a smaller package, keep reading.

5 Small-Cap Cybersecurity Stocks Under $10 Billion

Market values below are approximate, as of late October 2026. For each name, I lay out what has to go right for a 5x move over the next three to five years. That is a scenario with conditions attached, not a forecast.

Rapid7 Stock: The Cheapest Cash on the List

Rapid7 Inc. (RPD) is a higher-beta turnaround with the most torque if the market rerates it. At about $1.1 billion in market value, it generated roughly $145 million in trailing free cash flow, a free cash flow yield of about 13% based on its price late in the Oct. 26 session. When I first started talking about RPD, it traded around $12.

The weakness is the top line. Second-quarter revenue slipped 1.5% from a year earlier, though the company beat earnings estimates and raised its profit outlook.

What has to go right: revenue stops shrinking, margins expand, and the market stops pricing Rapid7 like a melting ice cube. RPD is one of my two favorite small caps on this list, and also the riskiest.

Qualys Stock: The Best Cash Machine

Qualys Inc. (QLYS) runs cloud vulnerability scanning and has one of the best cash margins in software. It earned an A for free cash flow on my report card. Its free cash flow margin is about 45%, on a market value near $7.9 billion.

What has to go right: growth keeps climbing toward the high teens while Qualys holds that cash margin. If it does, 5x isn’t a stretch, and Qualys likely becomes a steady compounder. QLYS and RPD are my two favorite small caps, with Rubrik still my top pick overall.

Tenable Stock: Finding the Holes First

Tenable Holdings Inc. (TENB) sells exposure management. It finds what’s exploitable before threat actors do. Its market value is about $5.2 billion.

What has to go right: growth reaccelerates into the mid-teens as AI floods the world with new vulnerabilities.

Commvault Stock: Rubrik’s Lane at a Fraction of the Size

Commvault Systems Inc. (CVLT) plays cyber resilience and recovery, the same lane as Rubrik, at about a quarter of the size (roughly $7 billion). The stock is still below its 2025 highs.

What has to go right: software-as-a-service annual recurring revenue keeps pulling growth higher, and the market starts pricing Commvault more like Rubrik.

SentinelOne Stock: The CrowdStrike Challenger

SentinelOne Inc. (S) is the direct challenger to CrowdStrike Holdings Inc. (CRWD) and the cheapest of the sector leaders on sales. Its market value is about $8.9 billion, and it’s getting close to its 2025 highs.

What has to go right: SentinelOne keeps growing around 20% a year for five years and turns thin cash flow into CrowdStrike-like margins. A takeover is the wild card that could deliver a 5x-plus return faster.

Other Ways to Invest in Cybersecurity Stocks

If small caps are too volatile for you, the large-cap pure plays are CrowdStrike Holdings Inc., Palo Alto Networks Inc. (PANW), Fortinet Inc. (FTNT) and Zscaler Inc. (ZS). They’re steadier, but they probably won’t get you a 5x return in three to five years. For a basket approach, the First Trust NASDAQ Cybersecurity ETF (CIBR), Amplify Cybersecurity ETF (HACK) and Global X Cybersecurity ETF (BUG) all give you sector exposure.

How to Trade Cybersecurity Stocks Around Earnings

Most of these companies report in the next few weeks. Rapid7 reports Nov. 4 and Qualys reports Nov. 9, both after the close. When the numbers come out, check them against the thesis. Is revenue growing? Are margins expanding? If yes, great. If not, that’s a red flag and a reason to de-risk.

A simple trick: drop the earnings release into ChatGPT or Claude and ask those two questions directly.

These names will pull back. When they do, that’s when you need to believe in the story. Don’t get scared out of a position just because it got volatile. I’d rather build a position in tranches than go all in at once, so a pullback becomes a chance to add. If you own upside calls and get a big move, taking some money off the table is fine. You can get back in on the next dip. If you use options, these are longer-term plays, so I’d look 12 to 24 months out.

Small-Cap Cybersecurity Stocks: Frequently Asked Questions

What are small-cap cybersecurity stocks? They are shares of publicly traded security companies with smaller market values. In this list, that means under $10 billion. Examples include Rapid7 (RPD), Qualys (QLYS), Tenable (TENB), Commvault (CVLT) and SentinelOne (S).

Why are cybersecurity stocks rising in 2026? AI-driven attacks are pushing companies to spend more on defense, and security budgets are hard to cut. Gartner forecasts worldwide security spending of $247.5 billion in 2026, up 12.7% in constant currency.

What is the best cybersecurity stock to buy now? My favorite overall is Rubrik (RBRK), the after-the-breach recovery play. Under $10 billion, I like Rapid7 (RPD) and Qualys (QLYS) best. Always size small-cap positions for volatility.

The Bottom Line

Cybersecurity is the budget nobody can cut, and the stocks are acting like it. Rubrik is my top pick, and Rapid7 and Qualys lead my small-cap list. Let earnings tell you whether each thesis is on track.

I’ve been tracking cybersecurity on Masters in Trading LIVE for a couple of months, and I’ll keep following these names as earnings come in. Join me at 11 a.m. ET for the free show, where I break down sectors like this one and take your questions live. Sign up free here.

This article is for educational purposes only and is not investment advice.