Quick answer: The biggest US-listed cybersecurity specialists today include Palo Alto Networks, CrowdStrike and Fortinet, with Cisco a major security player through its networking business and its 2024 purchase of Splunk. Our original 2023 list of ten has changed a lot since then. Symantec’s enterprise arm now belongs to Broadcom, McAfee’s business security unit and FireEye’s products were merged into Trellix, Mandiant (once part of FireEye) is now part of Google, and two names on the list, Check Point and Trend Micro, are headquartered outside the US. The details for each company, with dated figures from their own filings, are below.
We first published this list in 2023. In October 2026 we checked each company against its latest annual results, its own announcements and official filings. Revenue figures are from each company’s most recent full financial year and are dated, because they change every quarter. The list is in its original order, which is not a ranking.
The ten companies at a glance
| Company | Headquarters | Main focus | Status and size (latest full year) |
|---|---|---|---|
| CrowdStrike | Austin, Texas | Endpoint and cloud security (Falcon platform) | Revenue $4.81 billion, fiscal year to 31 January 2026 |
| Palo Alto Networks | Santa Clara, California | Firewalls, cloud security, security operations, identity | Revenue about $11.5 billion, fiscal year to 31 July 2026 |
| Fortinet | Sunnyvale, California | FortiGate firewalls and network security | Revenue $6.80 billion in 2025 |
| Check Point Software Technologies | Tel Aviv, Israel | Firewalls, cloud and endpoint security | Revenue $2.725 billion in 2025 |
| Cisco Systems | San Jose, California | Networking and security, including Splunk | Bought Splunk in March 2024 |
| Symantec | (Part of Broadcom) | Enterprise endpoint and network security | Enterprise business sold to Broadcom in 2019 |
| McAfee | (Private company) | Consumer security | Taken private in 2022; enterprise unit now part of Trellix |
| FireEye | (Now Trellix and Google’s Mandiant) | Threat detection and incident response | Products became Trellix in 2022; Mandiant joined Google in 2022 |
| Trend Micro | Tokyo, Japan (US base in Irving, Texas) | Enterprise (TrendAI) and consumer security | Enterprise business renamed TrendAI in March 2026 |
| Rapid7 | Boston, Massachusetts | Vulnerability management, detection and response | Revenue $859.8 million in 2025 |
The companies in detail
1. CrowdStrike
CrowdStrike specialises in endpoint protection. Its Falcon platform uses cloud-based analysis and machine learning to detect and stop threats on laptops, servers and cloud workloads, and the company also sells threat intelligence and incident response services. For its fiscal year ended 31 January 2026, CrowdStrike reported total revenue of $4.81 billion and annual recurring revenue (ARR) of $5.25 billion, up 24% year on year.
CrowdStrike is also known for the global IT outage of July 2024, when a faulty Falcon update crashed Windows computers around the world. Microsoft estimated that 8.5 million Windows devices were affected, less than 1% of all Windows machines, but the impact was large because many of them ran critical services for big organisations.
2. Palo Alto Networks
Palo Alto Networks is known for its next-generation firewalls and now sells cloud security, security operations and secure access products as well. In February 2026 it completed its acquisition of CyberArk, adding identity security to its platform. For the fiscal year ended 31 July 2026, the company reported revenue of about $11.5 billion, up 24%, and next-generation security ARR of $9.10 billion. The original article said Palo Alto Networks served “more than 70 of the Fortune 100”; we could not confirm a current figure, so it has been removed.
3. Fortinet
Fortinet’s FortiGate firewalls are widely used to secure business networks, and its FortiClient software provides endpoint protection and VPN access. The company sells to enterprises, service providers and government agencies. Fortinet reported 2025 revenue of $6.80 billion, up about 14% from 2024, with services making up about two-thirds of the total.
4. Check Point Software Technologies
Check Point provides firewalls, cloud security and endpoint protection for businesses of all sizes. It is headquartered in Tel Aviv, Israel, and reports to US regulators as a foreign company listed in the US, so it is not strictly an American company despite its large US customer base. Check Point reported 2025 revenue of $2.725 billion, up 6%.
5. Cisco Systems
Cisco is mainly a networking company, but security is a large part of its business, from firewalls and VPNs to threat intelligence through its Talos research group. In March 2024 Cisco completed its acquisition of Splunk, a security analytics and observability company, for about $28 billion in equity value. That made Cisco a major supplier of security information and event management (SIEM) software.
6. Symantec (now part of Broadcom)
Symantec no longer exists as an independent company. In November 2019, chipmaker Broadcom bought Symantec’s enterprise security business for $10.7 billion, and Symantec’s endpoint and network security products are now sold by Broadcom. The remaining consumer business renamed itself NortonLifeLock. In 2022 NortonLifeLock merged with Avast and became Gen Digital, which owns brands such as Norton, Avast, AVG and Avira.
7. McAfee
McAfee has also split in two. In 2021, McAfee sold its enterprise security business to the private equity firm Symphony Technology Group (STG) for $4.0 billion. STG combined it with FireEye’s product business to form Trellix in January 2022, and spun off McAfee’s cloud security unit as Skyhigh Security. The remaining consumer company, McAfee, was taken private by an investor group led by Advent International and Permira in a deal completed on 1 March 2022, valued at over $14 billion. McAfee today focuses on antivirus and identity protection for consumers.
8. FireEye (now Trellix and Mandiant)
FireEye was known for advanced threat detection and incident response. In 2021 it sold its products business and the FireEye name to STG for $1.2 billion; those products became part of Trellix. The remaining company took the name of its incident response arm, Mandiant, and Google completed its acquisition of Mandiant on 12 September 2022 for about $5.4 billion. Mandiant now operates within Google Cloud and kept its brand.
9. Trend Micro
Trend Micro was founded in 1988 and is listed on the Tokyo Stock Exchange, so it is a Japanese company rather than an American one. Its US headquarters is in Irving, Texas. In March 2026 it renamed its enterprise business TrendAI, which says it serves 575,000 enterprise customers. Its consumer antivirus products are still sold under the Trend Micro name; see our Trend Micro antivirus review.
10. Rapid7
Rapid7 sells vulnerability management, application security and detection and response tools, including SIEM, mostly from the cloud. It reported 2025 revenue of $859.8 million, up 2%, and annual recurring revenue of about $840 million, roughly the same as a year earlier, from 11,674 customers. The original article said Rapid7 had been a Gartner Magic Quadrant leader for SIEM “for several years in a row”; we could not confirm its current position, so that claim has been removed.
What is cybersecurity and why does it matter?
Cybersecurity is the practice of protecting computer systems, networks and data from unauthorised access, theft and damage. Common attacks include phishing, malware, ransomware and denial-of-service attacks, which flood a service with traffic until it fails.
It matters for three main reasons:
- Protecting sensitive data: personal details such as identity numbers and card numbers, as well as business secrets and intellectual property.
- Keeping organisations running: attacks can cause downtime, lost revenue and costly recovery. The 2024 CrowdStrike outage, which was not an attack, also showed how much depends on security software working correctly.
- Protecting critical infrastructure: power grids, transport and hospitals run on connected systems, and attacks on them can affect public safety.
For practical steps, see our guides on improving cybersecurity as your business grows and on using online security services to protect customer identity. Many of these vendors also sell security for cloud platforms, covered in our list of cloud computing companies in the USA.
How to compare cybersecurity vendors
- Match the vendor to the problem. Endpoint protection, firewalls, identity security and SIEM are different products, and few companies lead in all of them.
- Look for independent evidence. Independent test reports and analyst evaluations are more useful than vendor marketing. Check the date of any report.
- Check ownership and stability. As this list shows, security brands are often sold, merged or renamed. Ask what happens to support and pricing after a change of owner.
- Plan for failure. The 2024 outage showed the value of staged updates and tested recovery plans, whichever vendor you choose.
Frequently asked questions
What is the largest cybersecurity company in the USA?
Among companies that focus mainly on security, Palo Alto Networks reported the highest revenue of those listed here, at about $11.5 billion for its fiscal year to July 2026. Cisco and Microsoft are much larger overall, but security is only part of their business.
Does Symantec still exist?
As a brand, yes: Broadcom sells Symantec enterprise security products. As an independent company, no. Its consumer business became NortonLifeLock and is now part of Gen Digital.
What happened to FireEye?
FireEye’s products and name were sold in 2021 and became part of Trellix in 2022. Its Mandiant incident response business was bought by Google in September 2022.
Is Check Point an American company?
No. Check Point is headquartered in Tel Aviv, Israel, although it sells widely in the US.
What caused the 2024 CrowdStrike outage?
A faulty software update to CrowdStrike’s Falcon sensor caused Windows computers to crash. It was not a cyberattack. Microsoft estimated that 8.5 million Windows devices were affected.
Checked in October 2026 against each company’s latest annual results announcements and SEC filings, Microsoft’s July 2024 statement on the CrowdStrike outage, and the companies’ own announcements on the Splunk, CyberArk, Mandiant, McAfee, Symantec and TrendAI transactions.
