Cybersecurity stocks: why now might be the time to buy

The dust is finally settling on the cyberattack that downed Marks & Spencer’s online store for more than six weeks this spring. The ransomware attack, carried out by a hacker group calling itself Dragonforce, wiped £300 million off M&S’s 2025-2026 profits, according to the company’s results announced in May. Throughout the spring, usually the key season for clothes shopping revenues ahead of the summer, customers were unable to complete orders.

M&S is far from alone in falling victim to a high-profile cyberattack. Cryptocurrency exchange Coinbase’s share price fell 5% on 15 May as news emerged that cyber criminals had bribed members of its support staff into handing over customer information, costing the business $400 million. A data breach at the UK’s Ministry of Justice on 19 May exposed sensitive personal information of legal-aid claimants dating back to 2010. As of June 2025, some British Library services are still unavailable following the October 2023 cyberattack, which could cost it as much as £7 million.

Data on the proliferation of cyberattacks makes sobering reading. Microsoft estimates that an astonishing 600 million take place every day, and according to the Identity Theft Resource Center, 3,158 of these were successful in compromising data in the US in 2024. That figure is up almost 320% from 2018’s equivalent of 754. The costs of falling victim are rising, too – IBM estimates the average data breach cost $4.9 million last year, 10% more than the year before.

Start your trial of MoneyWeek today

Get unparalleled financial insight, analysis and expert opinion you can profit from.

Start your trial

Sign up for MoneyWeek’s free twice-daily newsletter.

Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.

Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.

Sign up

There is a geopolitical aspect to the rise in cyberattacks. As conflict and tension escalate around the globe, some governments are increasingly turning to cyber warfare. Iran has previously launched successful cyberattacks against Saudi Arabia’s state-owned oil firm Saudi Aramco, and Israeli missile-defence systems. The US Department of Homeland Security has warned that “pro-Iranian hacktivists are likely” to target US networks.

The threat seemingly extends to US allies. Prime minister Keir Starmer told a Nato summit on 25 June that Iranian and Russian actors were carrying out cyberattacks “on a regular basis” and that the UK needed to be prepared to resist them. It is, perhaps, no coincidence that the government’s minister of state for investment, Poppy Gustafsson, has a background in cybersecurity, having co-founded the Cambridge-based cybersecurity firm Darktrace.

AI: cyber’s double-edged sword

Darktrace was noteworthy in many respects for being one of the first cybersecurity companies to put artificial intelligence (AI) at the heart of its product. That trend is now well underway, with most of the leading cybersecurity products available on the market today incorporating AI. That, however, is a double-edged sword.

“AI has created a new era of cybercrime, lowering the barrier to entry for attackers,” says David Spillane, systems engineering director at cybersecurity firm Fortinet. “Individuals with little to no coding or hacking experience can now generate malicious code using AI, while experienced threat actors use it to execute new techniques.” By 2027, 17% of cyberattacks will involve generative AI, according to technology consultancy Gartner.

“In an ‘agentic world’ where, essentially, robots are attacking you rather than humans, you need to fight fire with fire and have robots fighting back with really innovative tools,” says Ben James, chair of Baillie Gifford’s US Growth Trust. Cybersecurity firms such as Fortinet and Cloudflare are incorporating AI into their systems to counter these emerging and constantly evolving threats. Some of these responses include “AI-powered threat hunting” and “hyper-automated incident response”, in Spillane’s words – in essence, automating the process of both identifying potential breaches and initiating responses to any that slip through the net.

AI, then, is both a headwind and a tailwind as far as the cybersecurity industry is concerned. In fact, for investors, the proliferation of threats only serves to increase demand for protection, which favours the most innovative providers.

AI is only the latest technology to have had this impact on cybersecurity. In many respects, AI is following where cloud computing led.

Cloud’s rise to prominence also marked a departure from a more secure world where data was stored on the premises to one where business-critical and often sensitive personal information is, theoretically, accessible by anyone in the world. At the same time, though, it offers a new form of response to the threats that cyber criminals pose to businesses and individuals.

In like vein, newer forms of computing are creating yet more opportunities. James argues that this forms a large part of Cloudflare’s competitive advantage. Its system is deployed using “edge computing”, which, unlike the cloud, distributes data storage globally.

“Rather than being something that you add to your computers and which slows everything down, Cloudflare wants to improve performance and provide enhanced services,” James explains. “They essentially build mini data centres near their customers, which makes things a lot faster, and then they’re able to bundle cybersecurity options together.”

Opportunities in cybersecurity investing

With the increased threat of cyberattacks, and the costs of falling victim to it rising, businesses are naturally increasing their spending on cybersecurity measures. According to Infosecurity Europe’s latest report, cybersecurity professionals expect budgets to increase by 31% on average in 2025. Of the 231 respondents to the report, 20% expect budgets to increase by 50% or more.

Last August, Gartner forecast that global cybersecurity spending would increase by more than 15% in 2025 to $212bn. More recently, Fortune Business Insights has forecast that the sector will be worth more than half a trillion dollars by 2032, implying annual growth of more than 14% through that period. Crucially, that investment isn’t going to fall in a recession or a war. If anything, the incentives for cyber criminals increase in either of those scenarios, and as such, so does the imperative for firms to spend on cybersecurity. “People will spend on cybersecurity whatever the macro [economic environment], and in fact potentially increase it,” says James, citing a cybersecurity CEO he is familiar with.

That could give cybersecurity stocks a defensive quality. While sitting firmly in the world of technology and, as such, growth, these businesses will hope to maintain their revenue streams even when markets go south. “When asked the question, ‘What part of your IT spend is most resilient?’ or ‘What part are you least likely to cut if there’s a downturn?’, cybersecurity figures very highly,” says Jeremy Gleeson, chief investment officer of global technology equity at Allianz Global Investors. “In a more challenging economic environment where companies are looking to rein in costs, I always say that a lot of technology spending is arguably discretionary. You can defer expenditure for a time when you’re feeling more certain about the world.

"Cybersecurity feels like it’s something you can’t [defer], unless you are willing to put your business at risk. You don’t want to be cutting the cybersecurity budget.”

How to invest in cybersecurity stocks

There is a counter-argument, as Gleeson explains. “If you take a step back and look at the equity market as a whole, defensive equities typically have a strong dividend profile. They might be lower growth, but they’re usually relied upon to be able to pay those dividends year in, year out.” That doesn’t apply to most cybersecurity stocks, largely because the industry is still too young to have a large number of dividend payers. Plenty of diversified big tech companies (Microsoft, IBM and the like) have cybersecurity arms, but in terms of specialists, none of the largest cybersecurity firms by market capitalisation (Palo Alto Networks, CrowdStrike and Fortinet) pay a dividend. “They’re investing for the future, rather than thinking about returning capital to shareholders,” says Gleeson.

They are also priced much more like growth stocks than value or defence stocks. Fortinet is the most reasonably-priced of those three, with both its forward and trailing price/earnings ratios sitting at around 42. This is still higher than most of the Magnificent Seven and the Nasdaq 100 average. But it pales in comparison with Palo Alto, which has a trailing p/e ratio of 117 and a forward p/e of 56, and in particular with CrowdStrike, which trades at 141 times forward earnings and more than 400 times trailing earnings.

Cloudflare isn’t yet profitable on a full-year basis, but is expected to become so in the coming year – it currently trades at more than 230 times projected earnings. All these companies have a lot of growing up to do before they can really be thought of as defensive plays. But growth-minded investors might well see an opportunity when these businesses start to look less like overpriced start-ups and more like reliable cash cows.

Innovation is key, and that comes at a price. Most cybersecurity firms derive revenue on a SaaS model (wherein customers enter into long-term contracts, generating annual recurring revenue or “ARR”), but they also have to invest substantially in research and development, which eats into their margins.

“As a cybersecurity company, you’re only as good as the last attack that you were able to prevent or block,” says Gleeson. CrowdStrike serves as a cautionary tale of how much rides on reputation for cyber firms – it gained notoriety last year when a routine software update caused a major global outage. Its shares fell roughly 49% from their peak in the aftermath, and while they have since recovered and climbed above their level prior to the outage, gains have lagged some of its competitors. With all these imperatives to spend, investors picking cybersecurity stocks should look for revenue growth rather than profit margins or dividend payouts. That underscores their status as growth stocks, for the time being.

A better bet might be to spread your bets across multiple opportunities rather than try to pick individual winners from what is still a nascent market. Various thematic ETFs target the sector, including the L&G Cyber Security ETF (LON: ISPY), the WisdomTree Cybersecurity ETF (LON: WCBR) and the Invesco Cybersecurity ETF (LON: ICBR). Gleeson manages the Allianz Global Hi-Tech Growth fund, which invests in cybersecurity stocks alongside the broader technology sector. As of 31 May, Palo Alto Networks is a top-ten holding, and the fund also holds cyber firms CyberArk and SailPoint.

There is also a dedicated Allianz Cyber Security fund, managed by Erik Swords, for investors that prefer a pure-play approach. Top holdings include Cloudflare, CrowdStrike and CyberArk. Alternatively, Baillie Gifford’s US Growth Trust (LON:USA) holds Cloudflare as its fourth-largest holding, as of 31 May, alongside other US growth stocks.

This article was first published in MoneyWeek's magazine. Enjoy exclusive early access to news, opinion and analysis from our team of financial experts with a MoneyWeek subscription.