Imagine going for a night out in a busy pub, and when the time comes to use the loo, you leave your phone and wallet on the table unguarded. You wouldn’t. Yet your online data is, in theory, just as exposed.

Don’t panic, fortunately, most of your information is secured by the clever digital locks and latches of cybersecurity, be that your personal banking details, your Facebook identity, or your Amazon shopping account. Yet the rapid increase in data means none of us can afford to be complacent. And this is good news for cybersecurity firms, which, at a time of volatility in tech firms, is arguably more defensively positioned.

According to current estimates, around 147 zettabytes of new data was created globally last year, and that’s projected to increase to 181 zettabytes in 2025.

To put that into context, the Utah Data Centre, owned by the US National Security Agency, is the world’s fourth largest data centre and stores an estimated 4.5 exabytes of data (the three larger ones in China, Nevada and India don’t provide data storage information). In other words, you would need 32,667 Utah data centres to store all of last year’s newly created data. Let that sink in.

‘As the world creates more data and accesses networks in more ways, cybercriminals find new vulnerabilities to exploit,’ says James Ferraioli, investment strategist, at Morgan Stanley Wealth Management. And as the volume of cyber-attacks increases, so does the cost of fixing them, as the table from data provider Statista shows.

ADAPTING TO THE MODERN WORLD

As The Jam once sang, ‘This is the modern world…’ and it is one where all of our most sensitive information is constantly at risk of being stolen or manipulated by cybercriminals or political actors. A world where businesses face the threat of significant losses due to data breaches, and governments struggle to protect their critical infrastructure.

For example, in 2017, credit data provider Equifax (EFX:NYSE) was hacked and the data of 146 million US customers compromised. The episode ultimately cost the company $1.5 billion. Another well-documented incident involved the IT provider SolarWinds (SWI:NYSE), resulting in massive data theft from US government agencies and large US companies. The organisations involved reportedly spent billions of dollars to remedy the data breach, which US officials linked to Russian intelligence services.

‘These threats underscore the critical nature of robust cybersecurity measures and have underpinned a surge in IT spending on cyber security’, says Schroders investment manager Josh Barber. ‘Forecasts suggest that global spending was set to reach $240 billion in 2024, and could exceed $400 billion by 2030, a near 10% annual growth rate.’

WHAT AI MEANS FOR CYBERSECURITY – CROWDSTRIKE’S TAKE

Generative AI has potential for use in numerous fields not likely identified or popularized in mainstream public discourse. AI’s continuous development will undoubtedly increase the potency of its potential misuse – particularly within the scope of information operations and especially for less digitally literate audiences. The degree to which popular generative AI tools can be used maliciously will likely adapt over time as companies, tool owners and governments respond to new developments and perceived misuse.

Source: CrowdStrike, Global Threat Report 2024

In the financial sector, entities such as financial regulators, investment banks, and commercial banks are often the targets of cybercriminals who aim to steal and manipulate sensitive financial data for their benefit. Healthcare providers and health insurance companies also rely on cybersecurity to safeguard the digital services they offer, like telehealth, fitness tracking devices, and electronic health records.

This is the reality that makes cybersecurity crucial to safeguarding our lives, and those of future generations. It also makes the cybersecurity space one of the most expansive, robust and, theoretically, reliable growth themes around, one that investors with a reasonable time horizon ahead of them, cannot afford to ignore.

In theory, investing in cybersecurity stocks isn’t complicated. Most of the world’s top specialists are US listed and accessible across most investment platforms. Yes, you’ll have to complete a W-8BEN form online to avoid any tax on income demanded of all overseas investors in US markets, but the process is simple enough.

THREE STOCK PICKS

PALO ALTO NETWORKS (PANW:NASDAQ) 

Price: $187.37

Palo Alto Networks has historically focused on securing data transfer and storage across cloud networks. It now aims to provide a much broader range of cybersecurity services to customers and become their key provider.

As it stands, most mid to large-sized businesses have multiple cybersecurity specialists, partly to derisk single supplier factors. However, this can make it more difficult to manage security across large organisations, creating a strong incentive for companies to reduce the number of vendors they work with.

This approach is starting to become very popular, with an estimated 1,000-plus of Palo Alto Network’s top 5,000 customers now exclusively using the company for their cyber security needs, according to Allianz Technology Trust (ATT).

This has led to the highest free cash flow margin the company has ever seen, which will allow for more R&D, acquisitions and shareholder returns.

FORTINET (FTNT:NASDAQ) 

Price: $104.72

Fortinet is another prominent cybersecurity provider, best known for its firewalls, and one of Terry Smith’s selections for Fundsmith Equity (B41YBW7).

Firewalls act as filters to ensure that only legitimate data is allowed into a company’s systems and prevent hacks. Fortinet has also been increasing its foothold in higher margin, cloud-based solutions, which now represent a substantial chunk of its revenue. This push into cloud solutions should also make the business less cyclical, with annualised recurring revenues growing 96% in its latest quarter to 31 December 2024.

Fortinet is known for offering the best value products and services in the cyber market, meaning it has significant room to increase pricing over the next few years. We believe that Fortinet will continue to grow at a faster rate than the overall market.

Crowdstrike (CRWD:NASDAQ) 

Price: $420.51

Captured all the wrong sort of headlines last summer when a missed buggy security update was rolled out, causing what some called the world’s biggest IT outage, with banks, hospitals, and airports going ‘dark’. 

The share price damage proved short lived as it turned out.

This is because CrowdStrike offers a compelling continuous-monitoring cybersecurity proposition. A visit to the cinema is a decent analogy. While some firewall providers do what ushers do, check your ticket then let you pass, CrowdStrike continues to watch you inside the auditorium, and if malicious or odd behaviour is detected, the platform can act quickly and isolate the threat, so it doesn’t spread. Revenue and earnings are seen growing above 20% on average over the next three years, twice that of the overall cybersecurity market.

AN ALTERNATIVE WAY TO INVEST

Of course, buying individual stocks requires a lot of legwork, something that won’t suit may investors, which makes a cybersecurity themed ETF an attractive option. There are plenty of options, nine according to website JustETF operated by well-known providers like L&G, iShares, FirstTrust and Wisdomtree, plus others.  

Backing the wider theme through a low-cost ETF makes sense for several reasons, and we believe the L&G Cyber Security ETF (ISPY) is probably the best of the bunch and ticks many of the right boxes for investors.

For a start, it’s the biggest, with more than £2.2 billion of assets managed, while it has also consistently been the among the best performing – it has returned 26.8% over the past year. Top holdings (35 in total) include all three of the above mentioned companies, while lesser known companies like cloud-based web security specialist Cloudflare (NET:NYSE), identity management tools firm CyberArk (CYBR:NASDAQ), plus sizable stakes in more generic plays on the sector angle, such as Broadcom (AVGO:NASDAQ), Cisco Systems (CSCO:NASDAQ), and UK listed reseller Softcat (SCT) by physically replicating the ISE Cyber Security UCITS index.

Companies in the broader investment universe are only eligible if they meet size requirements and have a three-month average daily traded value of at least $1 million. The underlying index applies a modified equal weight methodology where company weights are relative to the size of their respective sector and their liquidity versus peers within each sector.

Constituents are also screened against Legal & General Investment Management’s Future World Protection List, which flags companies that violate the United Nations Global Compact. The latter is a pact to encourage businesses around the world to adopt sustainable and socially responsible policies.

Disclaimer: Steven Frazer has a personal holding in Fundsmith Equity referenced in this article.

‹ Previous2025-02-13Next ›