With cyberattacks and AI crime on the rise, these small caps are poised to benefit

In 2025, cybersecurity remains one of the most dynamic areas of high tech. Insight Partners estimates that the market for data and network security solutions will almost double between 2024 and 2031 to reach $552.4 billion. Growth in the sector is being driven by increasing cyberattacks, more stringent data-processing requirements, the shift to cloud services, and the rapid adoption of AI.

The number and scale of cyberattacks continue to rise sharply. In 2024, the number of successful penetrations of corporate networks increased 75%. Phishing remains one of the most common scenarios, with 57% of companies experiencing attempts to siphon data on a weekly or even daily basis. The average global loss from data breaches in 2025 reached $4.44 million, down only slightly from the record $4.88 million in 2024. Criminals are using increasingly sophisticated tools, including AI. IBM estimates that in 2025, AI technologies will be used in 16% of cyberattacks.

One of the biggest challenges for the industry remains the skills shortage. According to recent estimates, the world is short of about 4.8 million cybersecurity experts to meet current demand. Combined with escalating threats, increased regulation, and the introduction of new technologies, this is contributing to sustained double-digit growth in global security spending over the coming years.

Despite the broader rebound, the shares of many small cap companies in the cybersecurity sector have lagged the broad market.

Analyst Aldiyar Anuarbekov has calculated for Oninvest an Equal Weight Cybersecurity Small Caps Index that includes 34 names. For this year, the index has risen only 8% versus a 16% gain for the S&P 500 and 9% growth for the Russell 2000. Meanwhile, Anuarbekov's Market Cap Cybersecurity Small Caps Index declined 12%, underscoring the sector’s underperformance versus the Russell 2000 as well.

Amid expensive borrowing and investors’ more cautious attitude toward risk, large and profitable companies remain favored. Many small caps with long sales cycles, high expenses, and negative free cash flow continue to underperform. Year to date, only 13 out of 34 companies included in the index are in positive territory.

Allot

Allot is an Israeli developer of network security and traffic optimization solutions. The company has bet on the security-as-a-service (SECaaS) subscription cloud model for telecom operators, and this strategy has begun to pay off.

Allot reported quarterly revenue growth of 9% to $24.10 million for the second quarter of 2025, while annual recurring revenue from its SECaaS subscription model increased 73% year over year. The substantial influx of subscribers allowed the firm to notch an operating profit for the first time in a long time, with adjusted operating income of $1.2 million. The management raised its guidance for the full year and expects profitable growth, with revenue of $98-102 million in 2025.

Recent large contracts add to the company’s attractiveness. Allot already provides malicious traffic filtering for Verizon mobile subscribers, and in the summer it won a multimillion-dollar tender from one of the largest telecom operators in Europe (client undisclosed). The cloud solutions segment for telecom operators could become an important acceleration point for Allot. Its shares have risen 62% since the start of 2025. The consensus rating on the stock is “buy,” with a target price of $13.50 per share, which implies upside of about 40% from the closing price on November 25.

Mobilicom 

Mobilicom is a small company from Israel with a market capitalization of $27.98 million but with large ambitions. It develops cybersecurity solutions for drones and robotics. Mobilicom was the first on the market to create a comprehensive secured autonomous platform to protect AI-powered autonomous drones, the type of systems that are now attracting increased attention from defense agencies.

Mobilicom’s revenue in the third quarter increased 63% quarter over quarter to $0.98 million, with 84% of quarterly sales coming from the U.S. market, where the U.S. Department of Defense (War) introduced new stringent cybersecurity requirements for unmanned systems at the end of September. The company has already received additional orders from key customers in the U.S., Europe, and Asia and has a confirmed order book of almost $0.90 million through the end of 2025. Mobilicom has $16.40 million in cash on its balance sheet and no debt. Its stock has increased nearly 60% since the beginning of the year. The consensus rating is “buy,” and the target price of $11.50 per share implies that the shares could almost double.

Secunet 

Secunet Security Networks is a provider of cybersecurity solutions in Germany. The company focuses on products for government IT infrastructure, from encrypted workstations to the protection of critical systems.

In the first nine months of 2025, Secunet’s revenue increased 11.8% year over year to EUR284.8 million ($330.4 million). Operating profit (EBIT) increased 41.3% to EUR24.9 million ($28.9 million) versus EUR17.6 million in 2024. EBITDA increased 31.7% to reach EUR39.20 million. New orders rose 6.7% year over year to EUR313.9 million. The management reiterated its guidance, expecting revenue of around EUR425 million for the full-year 2025, and noted that profitability should exceed initial expectations, reaching the upper end of the forecast range.

Since the beginning of the year, Secunet shares have gained about 50%. The $1.1 billion market capitalization is backed by strong cash flow and dividends, which makes Secunet one of Europe’s leaders in the sector and a rare example of the combination of growth and profitability in cybersecurity.

The cybersecurity sector has entered a phase of stable demand but remains sensitive to general economic conditions and interest rates, JPMorgan said in a report published in November and seen by Oninvest. At present, interest rates most strongly influence market multiples, often more than industry factors. Even though the Fed has cut rates by 50 basis points in 2025, the further trajectory of monetary policy remains uncertain, leading to increased volatility in company valuations.

At the same time, there is a noticeable revival within the sector. According to JPMorgan, the average EV/sales ratio for the latest month increased by about 0.5, and demand for security solutions remains high amid the growing number of cyberattacks, the spread of AI threats, and the need to upgrade corporate infrastructure. The analysts also note that the market is increasingly favoring companies that can sustain rapid revenue growth. Growth rates continue to have a greater effect on valuation than profitability.

This material does not constitute investment advice.