The Platform Consolidation Trend
The defining strategic trend in security SaaS is platform consolidation. The average enterprise has 40–60 security point solutions from different vendors — each with its own console, integration requirements, and renewal cycle. Security teams are understaffed relative to the tool sprawl, creating both alert fatigue and integration gaps that attackers exploit.
CrowdStrike, Palo Alto Networks, and Microsoft Security each pursue the same strategy: land on one use case (endpoint, firewall, identity), prove efficacy, then expand across the security stack as the customer consolidates. Each module added increases switching cost and compresses the NRR expansion multiple further. A CISO who has moved 8 point solutions to CrowdStrike is not switching vendors — the migration cost would take 18 months.
This platform NRR dynamic parallels vertical SaaS — read the Vertical SaaS guide for comparison.
Security SaaS Metric Profile
NRR
115%–130%+Platform expansion is the NRR engine. CrowdStrike tracks customers by number of modules adopted — 5+ module customers show NRR above 130%. New module releases (cloud security, identity, data protection) create recurring expansion opportunities.
ARR Growth
20%–40% for mid-largeSecurity spend is non-discretionary: breaches are existential for public companies. Unlike marketing SaaS, security budgets have a structural floor. But the highest-growth years for platform leaders are behind them — growth normalizes as TAM penetration increases.
Gross Margin
72%–82%Threat intelligence feeds, SOC analysts, and incident response services blended into some security platforms compress margins below pure software. EDR-only vendors run higher margins than SIEM or MDR (managed detection and response) providers.
FCF Margin
15%–30%+ for mature platformsCrowdStrike and Fortinet have demonstrated that security platforms can achieve 25%+ FCF margins at scale. R&D is the largest cost — but it amortizes as the platform matures. Track the trajectory in the FCF margin guide.
Live Security SaaS Benchmarks
ARR Model: Endpoint Count vs Seat Count
Most security SaaS companies price on endpoints protected, not seats. A company with 10,000 employees might have 25,000 endpoints (laptops, servers, cloud workloads, IoT devices). As the company grows and cloud adoption increases, the endpoint count grows faster than headcount, creating passive NRR expansion without upsell.
Cloud security tools (Wiz, Orca, Lacework) extend this further: they price on cloud workloads scanned or data assets protected. Customers adopting multi-cloud strategies in AWS, Azure, and GCP simultaneously multiply their cloud security spend without adding a single employee. This is the infrastructure-model NRR dynamic applied to security — comparable to what infrastructure SaaS companies see with data platforms.
How to Read a Security 10-K
Security companies disclose module adoption data, ARR by product line (in some cases), and customer cohort data differently from horizontal SaaS. The key sections to look for:
- Subscription ARR vs professional services — implementation and incident response revenue has lower margins. The split tells you the true software economics.
- Module adoption metrics — CrowdStrike discloses "customers with 5+ modules," "6+ modules," etc. This is a proxy for NRR trajectory.
- Annual recurring revenue vs billings — security companies often have long multi-year contracts. Billings can exceed or undershoot revenue depending on renewal timing. See the deferred revenue guide.