Why demand keeps growing
Every organisation that stores data or runs systems online needs protection, and the number of attacks keeps rising. Security is one of the last things a company cuts from its budget, because the cost of a serious breach is so high.
Most vendors charge a yearly subscription. Once a product is installed across a business it is disruptive to replace, so customers tend to renew.
Growth is already priced in
Because the growth is well known, cybersecurity shares often trade at high prices compared with their current sales and profits. That means a company can report good results and still see its share price fall if growth slows even slightly.
Competition and consolidation
Customers increasingly prefer to buy several security tools from one supplier. The largest vendors are expanding into each other's areas, and large technology companies include security features in their own products. Smaller specialists can be squeezed or acquired.
When security companies fail
A security vendor's own mistake can affect thousands of customers at once. In July 2024 a faulty software update from one large vendor disrupted computers around the world. Events like that can hit a company's share price and reputation quickly.
The main areas of cybersecurity
Device (endpoint) security
Protect laptops, phones and servers from attack.
For example: CrowdStrike, SentinelOne
Network security
Guard the connections between an organisation and the internet.
For example: Palo Alto Networks, Fortinet, Check Point
Identity and access
Control who can log in to what.
For example: Okta, SailPoint
Cloud security
Protect data and applications that run in the cloud.
For example: Zscaler, Cloudflare
Companies are listed to show what each category means. They are not recommendations, and the list is not complete.
Three ways to invest
There is no single right route. Many people combine them, and plenty decide a broad global fund is all they need.
- 1
Buy individual shares
Pick one or more cybersecurity companies and buy their shares through a broker or investing app.
- Good for
- Simple to understand. You own exactly what you chose.
- Watch out for
- If you only hold a few companies, one bad result can do real damage. Picking winners is hard, even for professionals.
- 2
Buy a ready-made fund
A fund (often an ETF) holds dozens of companies in one purchase. Examples include the First Trust NASDAQ Cybersecurity ETF (CIBR) in the US and the L&G Cyber Security UCITS ETF in the UK and Europe.
- Good for
- Instant spread across many companies, with very little effort.
- Watch out for
- You get what the fund provider chose, including companies you may not want. Themed funds usually charge more than broad trackers, so check the yearly fee and the top ten holdings. Which funds you can buy depends on where you live.
- 3
Build your own portfolio
Choose your own mix of companies and how much of each, then buy them through your broker. This is what Arithmos helps with: describe the mix in a sentence and it builds and tests one for you to consider.
- Good for
- You decide exactly what is in and what is out, and you can see the reason for every company.
- Watch out for
- More to look after than a fund. Buying many separate shares can cost more in dealing fees, and a tested result is a simulation, not a promise.
The risks
- Valuation. High prices relative to profits leave little room for disappointment.
- Competition. Large vendors and big technology companies are expanding across the market.
- Operational failures. A breach or faulty update at a vendor can damage trust quickly.
- Profitability. Some companies spend heavily on growth and are not consistently profitable.
- Concentration. A few large vendors make up a big share of most cybersecurity funds.
Try it yourself
The quickest way to understand a portfolio is to look at one. Here is how to turn this guide into something you can inspect.
- 1
Start from the idea
The button below opens the builder with this guide's idea already typed in. Change any part of it: the number of companies, the countries, the limit per company.
- 2
Read the reason for every company
You get a list of companies, how much of each, and a plain-English reason for each pick. If one looks wrong to you, you can ask for it to be changed.
- 3
Look at the bad years, not just the good ones
The portfolio is replayed against real past prices. Check the biggest fall along the way, and ask yourself whether you could have sat through it.
- 4
Decide for yourself
If you want to act on it, you buy the shares yourself through your own broker. Arithmos never holds your money or places trades.
“Companies whose main business is cybersecurity software. 15 companies, bigger ones get a bigger share, no company over 10%.”
Browsing portfolios other people have published is free. See pricing for what building your own includes. A tested result is a simulation using past prices. It is not a forecast and not a recommendation.
Common questions
Are cybersecurity stocks defensive?
Demand for security is resilient, but the shares are not defensive in the usual sense. They tend to be priced for growth and can fall sharply when markets turn against technology shares.
What is the difference between a cybersecurity fund and a general technology fund?
A technology fund is usually dominated by the largest technology companies. A cybersecurity fund holds companies whose main business is security, which are often smaller and more specialised.
Do big technology companies count as cybersecurity investments?
Several large technology companies sell security products, but security is a small part of their overall business. Their shares are driven mostly by other things.
