The cybersecurity stocks to buy as the sector booms

The consultancy McKinsey estimates that $150bn was spent on cybersecurity in 2021, says Omar Moufti, product strategist for thematic and sector exchange-traded funds (ETFs) at BlackRock. And with other projections putting the global cost of cybercrime “in the trillions of dollars per year”, the sector is clearly set to become far bigger.

Cybersecurity is becoming a big issue for consumers 

The main reason cybersecurity has become a key trend is “the rapidly growing reliance on digital technologies and the internet”, says Moufti. 

Throw in the advent of gangs of cybercriminals, many implicitly or explicitly supported by various rogue states such as Russia and North Korea, and it’s not surprising that there has been “a large increase in the frequency of cyberattacks”. 

At the same time, “consumers are becoming more aware of the value of their personal data and the risks associated with online activities, such as data breaches and cyberattacks”, says Moufti. 

Surveys suggest that “84% of consumers say they want more control over how their data is being used while more than 90% of consumers in the US are calling for a more proactive approach by companies” to protect data.

Steve Wreford, portfolio manager of the Global Thematic Focus Fund at Lazard Asset Management, believes that the sophistication and variety of cyberthreats now emerging means that investing in companies that provide a single cybersecurity product might not the only, or even the best, way to benefit from booming demand. 

While many of these companies may “seem exciting as they enter the market”, they may not necessarily “represent the most compelling opportunities”. This is because “there always seems to be a new problem or technological shift around the corner that can make their current offerings obsolete”. Instead, the real winners might be those “who can sell multiple cybersecurity-related products and services” to the growing number of companies who want to save time and money by subcontracting their defence against digital threats to someone with experience and resources, says Wotton.

The cybersecurity stocks to buy

If you want to invest in a broad range of cybersecurity companies, then you should consider an exchange-traded fund (ETF) such as the iShares Digital Security UCITS ETF (LSE: LOCK). It invests in more than 100 outfits involved in digital security.

 The three largest holdings are cloud-computing company Nutanix, networking group Arista Networks and software giant Oracle. The ETF has a trailing price/earnings (p/e) ratio of 24.7 and a total expense ratio (TER) of 0.4%. 

A more concentrated alternative is the L&G Cyber Security UCITS ETF (LSE: ISPY). This has only 49 holdings, with the largest being BlackBerry, now a cybersecurity specialist, and its peers Cloudflare and Paolo Alto Networks. This ETF has a slightly higher TER of 0.69%. 

One cybersecurity firm that is a major holding in both ETFs is Paolo Alto Networks (Nasdaq: PANW). Operating around the world, it provides a range of cybersecurity services, including software and consulting. It is investing heavily in next-generation security technology, incorporating both artificial intelligence and zero-trust principles, and is planning to launch several pieces of software this year. The fact that it trades at 41 times 2024 earnings is reasonable given that it has more than doubled sales over the past four years and is expected to keep growing at an annual 25%-30% over the next few years. 

Another company with a good reputation is Fortinet (Nasdaq: FTNT), which provides cybersecurity and cryptographic services to more than 635,000 clients. While its cybersecurity offerings cover everything from networks to mobile devices, Fortinet’s main product is FortiGate, a firewall that prevents hackers breaking into a network. 

Not only have sales more than doubled over the past three years, but they are also expected to keep growing by around 25% a year. Both operating margins and the return on capital, a key gauge of profitability, remain strong. Fortinet trades on a 2024 p/e of 36. 

Akamai Technologies (Nasdaq: AKAM) provides cloud-computing services, running a network of servers in order to rent out the capacity to firms. While it is not a specialist cybersecurity company, it has invested heavily in this area, buying a range of operators in recent years, including Guardicore, which specialises in zero-trust security, and mobile-security provider Asavie. Akamai’s sales are growing by 8% a year and it trades on a 2024 p/e of just 12. 

A British leader in cybersecurity

One of the most renowned British cybersecurity companies is Darktrace (LSE: DARK). 

Gresham House’s Ken Wotton is impressed by its “cutting-edge” technology that uses AI to preempt potential threats by detecting unusual behaviour from within customers’ networks and devices. It has already amassed several prominent companies as clients, including insurer and asset manager Allianz, manufacturing company Airbus and parcel-delivery firm DPD. 

While it trades at 46 times 2024 earnings, this is justified by the fact that its revenue is expanding by around 30% a year.

Another interesting option that Wotton likes is NCC Group (LSE: NCC), which provides security, escrow and business continuity services. He is particularly impressed by the fact that NCC not only sells cybersecurity software, but also provides “well-trained consultants” to help firms spot and mitigate threats from hackers. 

NCC has more than 14,000 customers in 135 countries and its revenue is growing at a solid rate of around 8% a year, with healthy profit margins and a return on capital of just under 10% a year. Yet it is on just 13.3 times 2024 earnings and yields 3.6%.