Check Point Software

Check Point's second-quarter numbers were in line with FactSet consensus; however, third-quarter guidance was below. Shares fell 8% on July 30. 

Why it matters: Product revenue declined 14%, and a similar decline is expected in the third quarter. While subscription revenue accelerated modestly to 11.6%, a slight deceleration is expected next quarter. This means a record fourth quarter will be needed to meet guidance. Growth in forward-looking measures remained weak. Calculated billings, current calculated billings, and remaining performance obligation were 0%, 2%, and 7%, respectively. On the bright side, emerging technologies (Secure Access Service Edge, email security, external risk management) are growing very fast with over 40% annual recurring revenue growth in the quarter. However, this remains a small part of the business.

The bottom line: We're maintaining our $201 fair value estimate for narrow-moat Check Point, assuming product revenue headwinds will be contained to 2026. Shares look undervalued. Check Point is transforming its go-to-market function this year. This quarter, it announced plans to hire hundreds of additional salespeople. With tangible proof that changes are working still several quarters away, the market is likely bearish on long-term growth.

Coming up: 2026 guidance was maintained for revenue of $2,77 billion-$2.85 billion and Non-GAAP EPS of $10.05-$10.85. Third quarter guidance is for revenue of $655 million-$685 million, subscription revenue of $332 million-$343 million, and non-GAAP EPS of $2.43-$2.53.

Our fair value estimate for Check Point is $201, based on a discounted cash flow model. Our fair value estimate implies a 2026 enterprise value/sales multiple of 6 times and a P/E ratio of 20 times.

We expect midterm revenue growth to be in the high-single digits before fading to midsingle digits in the latter part of our explicit forecast. The majority of Check Point’s revenue base is related to network security/firewalls, a market we expect to grow at a mid- to high-single-digit rate over the medium term. However, we think Check Point’s network security growth will be moderately lower than the market given its relative underinvestment in sales and marketing versus its key network security peers. We think Check Point’s newer offerings like CloudGuard (cloud security), Harmony (endpoint/email), and Horizon (security operations center) should continue to grow at double-digit rates for the next several years. Furthermore, we believe Check Point’s Infinity cybersecurity platform offering should support overall growth for the company, given customers' desire to consolidate cybersecurity products around established vendors like Check Point.

We expect operating margins to compress over the next few years, but to remain at a high level (around 40% on a non-GAAP basis) as the company increases investment in R&D and sales and marketing to support new products and combat aggressive spending by its key competitors. In the longer term, we see margins rising again as newer products mature and benefit from operating leverage, plus higher-margin subscription-based products will account for a larger proportion of the revenue mix.

We assign Check Point a Morningstar Economic Moat Rating of narrow, based on switching costs. Historically, it generated high margins and correspondingly high returns on invested capital, but both have declined as the company moves away from its core firewall business and increases R&D and sales and marketing spending to capture new verticals and compete with Palo Alto Networks and Fortinet. We are confident Check Point can keep ROIC above its cost of capital for at least 10 years, supporting the narrow moat rating. We withhold a wide moat rating because the company has steadily lost market share in the critical firewall business, and the shift to the cloud adds long-term uncertainty. Firewall appliances should remain central to enterprise cybersecurity in the near to midterm, but the long term is less certain because, in theory, firewalls aren't needed in the cloud. Check Point's strategy of offering a holistic cybersecurity platform may offset this risk by deepening customer touchpoints, but it's too early to call it a clear success over a 20-year horizon.

The company doesn't segment its business but has three major product families. Quantum network security covers firewalls that secure data center environments; a firewall monitors incoming and outgoing traffic and acts as a barrier between a private network and the public internet. CloudGuard offers similar protection for cloud environments. Harmony secures end-user environments including PCs, mobile devices, email, and browsing. All products connect through the Infinity consolidated security architecture.

Most of Check Point's revenue comes from firewall products plus related maintenance and software updates, so we see this as the foundation of its moat. The firewall market is fairly consolidated, with the top four vendors, Palo Alto Networks, Fortinet, Cisco, and Check Point, holding more than half the market. Palo Alto leads the industry while the other three are closely clustered.

Switching firewall vendors is relatively easy for small firms but becomes a multiyear process for large enterprises. Since about 50% of Check Point's revenue comes from enterprise clients, we think its firewall business carries high switching costs.

Cybersecurity is mission critical for any company, and firewall security sits at the core of any cyber defense plan. Firewalls act as the first line of defense, blocking much malicious traffic before it reaches the network perimeter. Their importance is evident in spending: firewalls typically account for 20%-25% of a firm's cybersecurity budget. Firewalls have also gained more touchpoints over time as they've evolved to include advanced protections, allowing security teams to add subscription-based features instead of buying separate external tools. These more capable products are now often referred to as next-generation firewalls.

Cybersecurity has become even more critical in recent years. The shift to cloud computing and remote work accelerated during the pandemic, expanding the attack surface for hackers. Public concern about data privacy has also grown as high-profile breaches make headlines more often, prompting regulators to significantly raise fines. For instance, in 2019, the UK Information Commissioner's Office proposed fines of $230 million for IAG and $124 million for Marriott under the GDPR, which allows penalties of up to 4% of revenue; before GDPR, the UK's maximum breach fine was only GBP 500,000. This dynamic pushes firms toward trusted vendors rather than the lowest price. It's also hard to pin a breach on a specific vendor, because a company's defenses are usually spread across 40-75 separate vendors, and proving fault would require showing which layer failed and that every solution was up to date with best practices. While clear-cut failures can be traced, this ambiguity generally keeps firms loyal to their existing trusted vendors.

Firewall appliances have a fairly long refresh cycle of four to seven years and typically come with multiyear support and update contracts. Security teams build deep familiarity with a given vendor's appliances, software, and support, and that familiarity makes switching vendors feel riskier over time. Changing providers also requires extensive testing, often running old and new firewalls in parallel, and any issues during the transition can force a firm back to its legacy setup or even cause it to abandon the switch altogether.

A firewall works by following rules that decide what traffic may pass in and out of the network. As companies grow, these rule sets multiply and grow more complex, and some large enterprises end up with more than a million rules. These rules generally cannot be ported cleanly to a different vendor. Some vendors claim otherwise, but this rarely works well in practice. So a company considering a switch must weigh the risk of essentially rebuilding rules developed over decades, a risk firms are rarely willing to take just to cut costs. As a result, retention rates run high. Check Point doesn't disclose its customer retention rate, but our understanding is that it typically exceeds 90%, a strong figure.

Check Point’s emerging technologies (Harmony SASE, Harmony Email, and External Risk Management) are growing at very high rates.

The company’s move into cloud- and mobile-based user security offers significant growth opportunities to complement its network security portfolio.

Increasing subscription-based sales and increasing recurring revenue enhance the predictability of Check Point’s cash flow.

Other leading cybersecurity vendors are also offering consolidated security platforms, which may ultimately lead to lower pricing.

Check Point has lost market share in its core firewall business due to significantly lower investment in sales and marketing compared with its key competitors.

Public cloud vendors offer security solutions for their cloud-based products. These firms are much larger and could encroach on Check Point’s customer base by developing on-premises and mobile security.