Investment Focus: Cybersecurity stocks amid rising digital threats

Cybercrime is big business. Its cost is estimated at $6.4 trillion, up 69% year-on-year, and is expected to reach $15.6 trillion by 2029.[1] In the UK in the past 12 months, the NHS has been targeted, alongside CVS Group, IMI, London Transport and some of the major banks. Across the world, companies, governments and critical infrastructure have all fallen victim to cyberattacks.

The growing cost of cybercrime

The latest report from CyberArk found that 93% of organisations suffered two or more identity-related breaches in the last 12 months.[2] These breaches cost organisations a lot of money. The average cost of a data breach worldwide is around $4.35 million, but that varies depending on the region, organisation size, and industry.

In sectors such as healthcare, the cost of a breach tends to be higher, averaging $10.1m.[3] In 2024, US healthcare insurance giant UnitedHealth took an $872m hit to its profit from the Change Healthcare hack.[4]

AI: Accelerating both threats and solutions

The advent of AI has accelerated the problem. British insurer Beazley and e-commerce group eBay recently warned about a rise in sophisticated phishing scams, with criminals using AI analysis to raid online profiles.[5] Artificial intelligence can digest lots of personal data quickly, using it to develop sophisticated scams. The US Cybersecurity and Infrastructure Security Agency says that around 90% of successful attacks start with a phishing email.

Companies, governments and agencies are willing to pay significant amounts to protect themselves. In 2024, the average IT security budget rose by 5.7%.[6] Cyber resilience remains a top spending priority for many organisations, and in 2021, US President Joe Biden identified cybercrime as a "core national security challenge".[7] In the interim, the US government alone has identified more than 4,900 ransomware attacks, with at least $3.1 billion paid out in ransoms.[8] It makes financial sense to put robust cybersecurity solutions in place.

Multi-layered defense: How modern cybersecurity works

As hackers have become more sophisticated, cybersecurity solutions have had to become multi-layered with organisations needing multiple defences.

There are a range of ways that cybercriminals target organisations. For example, companies can see their computers infected with malware, and then controlled for criminal purposes. Ransomware is malware that encrypts data and systems so that they can no longer be accessed. These are then only released again upon payment of a ransom. Denial of service (DoS) attacks are also commonplace. These are directed against web servers in order to overload them and thereby disrupt website access.

Equally, cyber-criminals keep improving, finding new targets and more sophisticated ways to attack those targets. Firewalls, for example, need to be in place, but won’t be enough by themselves. Companies that are employing AI solutions will need to adapt their cybersecurity to ensure this is not another point of vulnerability.

Today, there is a significant ecosystem emerging in managing cybersecurity risks. This incorporates perimeter security, such as: firewalls; network security, which protects network integrity; endpoint security, which protects devices such as laptops; application security, which protects data within apps; and data security, which protects digital data. Cybersecurity companies will usually specialise in specific areas.

Market size and growth projections

The overall cybersecurity market is valued at around $190bn and is growing at approximately 9.5% per year.[9]

Cybercrime is a vast problem. Those companies with the right solutions are in a powerful position as governments, organisations and individuals look for ways to address the problem.

Sponsored message

Baillie Gifford Managed Fund – a patient approach to growth

For over three decades, the Baillie Gifford Managed Fund has aimed to keep it simple in a complex investment world. Made up of equities, bonds and cash, it’s a straightforward way to invest when seeking long-term capital growth.

Capital at risk.

Find out more.

Top cybersecurity companies for investors to watch

There are plenty of listed cybersecurity companies to choose from. Eight out of the top 10 companies are US-listed - Palo Alto Networks, Crowdstrike, Fortinet, Cloudflare, Zscaler, Okta, Leidos, and Gen Digital.[10] The remaining two in the top 10 are listed in Israel – Check Point Software and CyberArk. There are no European companies in the top 20 and just one Japanese company (Trend Micro). Softcat, from the UK, sneaks in at number 21.

Regional differences: US dominance and global opportunities

The largest cybersecurity companies may be in the US, but that doesn’t mean there aren’t interesting opportunities elsewhere in the world. Persistent Systems in India, for example, has been a significant success story, and there are smaller cybersecurity providers across the world. These may start getting more attention following the recent rout of the US market, and because national governments may decide that it is more important to have home-grown security than to trust other countries with the protection of vital infrastructure.

Investment options: Direct stocks vs ETFs

For those investors who prefer a collective approach, there are a range of cybersecurity ETFs. WisdomTree, Invesco, and First Trust all offer cybersecurity ETFs. There is a surprising range of performance outcomes for investors, with L&G Cybersecurity ETF up 19.5% over one year, and IQ EQ Cybersecurity ETF up 12.9%.

Cybersecurity will often be a significant portion of broader technology funds. Mike Seidenberg, manager of the popular Allianz Technology Trust, for example, continues to hold a number of cybersecurity companies:

The essential nature of cybersecurity to the advance of technology lends an element of stability to revenues, helping to offset the intrinsically volatile market nature of many technology stocks. Rapid changes in technology and high market expectations can lead to significant fluctuations in stock prices even for the very largest companies in a technology investment trust. The share-price performance of cybersecurity-focused businesses, by contrast, should prove much more stable,” he says.[12]

Mike SeidenbergManager, Allianz Technology Trust

The problem for many broader technology funds is that cybersecurity companies can be crowded out by the mega-caps. At a market capitalisation of $119bn, PaloAlto Networks is a minnow compared to, say, Apple, at $3.3 trillion, or Nvidia, at $2.8 trillion.

If investors want meaningful exposure to the cybersecurity trend, they need to make sure cybersecurity companies are a significant holding within a technology portfolio.

Performance analysis: cybersecurity vs broader tech sector

The performance of the cybersecurity sector has been astonishing, but it has not outperformed the wider technology sector. See below the comparative performance of MSCI World, MSCI Tech, and MSCI Cybersecurity. Both indices, however, are significantly outperforming MSCI World.

On a more granular level, the iShares Global Technology ETF is up 153.1% over the past five years.[12] It and similar technology funds have undoubtedly been propelled by the performance of the mega-caps.

The iShares Global Technology ETF has 19.4% in Apple and another 15.5% in Nvidia.[13] Around 62% of the market capitalisation is in the top 10 stocks, so it is vulnerable to the type of sell-off that has been seen in recent weeks. The ETF is down 12.2% over the past three months.[12]

In contrast, the iShares Cybersecurity and Technology ETF is up ‘just’ 103.7% over five years, but has proven less vulnerable during the sell-off, down by just 8.1%. It is a similar picture for the L&G Cyber Security UCITS ETF, the five year figure is 96%, but the three month figure is down just 7%.[14]

The cybersecurity funds also have far less concentration in individual holdings. For the L&G ETF, for example, the top holding is Cloudflare, at 6.7% of the portfolio. The top 10 holdings are only 57% of the total. The iShares Cybersecurity and Tech ETF has a similar profile, with just 5.4% in its top holding (Okta).[15]

Conclusion: Strategic positioning in your portfolio

Investments in cybersecurity will always be high growth, higher risk options and should be seen as an option to turbo-charge your portfolio, rather than a core holding.

While cybersecurity has a long-term tailwind of growth, the world of cybercrime is constantly changing and tomorrow’s solution may not be the same as today’s. That said, companies with the right solutions to growing problems, such as AI-based cybercrime, can grow very quickly.

---

[1] Statista, March 2025

[2] Cyberark, Identity Security Threat Landscape 2024 Report

[3] Statista

[4] ETBFSI

[5] Financial Times

[6] Statusta, December 2024

[7] Spectrum News, August 2021

[8] Financial Times

[9] Markets and Markets, January 2024

[10] Google, March 2025

[12] Trustnet, iShares Global Technology ETF

[13] iShares Global Tech ETF

[14] Trustnet, L&G Cyber Security ETF

[15] iShares Cybersecurity and Tech ETF