Cybersecurity Stocks – Investing in fast-growing technology stocks and the fight against cybercrime

Cybersecurity stocks have outperformed the market for most of the last decade, and more so than ever over the last 24 months. In addition, the recent cyberattack on multiple US government departments has brought cybercrime and cybersecurity back into focus.

Security is an aspect of technology that no company can overlook, and investors shouldn’t overlook the sector either. In this post we highlight the types of cyber threats that exist, and the companies leading the fight against cybercrime.

• Why invest in cybersecurity stocks?
• Cybercrime threats and defences
• How and when to invest in cybersecurity stocks
• Top 10 cybersecurity stocks
• Cybersecurity ETFs

Why invest in cybersecurity stocks?

Unfortunately, cybercrime is a growth industry. The number of connected devices is increasing, as are the number of applications we interact with and the number of network connections. Each of these connections provides a potential entry point for criminals. As the digital economy grows, so too do the incentives for cyber criminals. In turn the sophistication of cyberattacks grows as well.

It doesn’t end with cybercrime either. In the future, cyberwarfare is far more likely than traditional forms of conflict. So, an increasing percentage of national defence budgets will be allocated to cybersecurity. Cybersecurity is not something companies can overlook or postpone either. The result is that global spending on cybersecurity is growing each year and will continue to grow indefinitely. The total revenue earned by cybersecurity companies around the world in 2020 will be close to $175 billion. That number is expected to grow to $250 billion in the next five years.

Cybercrime threats and defences

Cyber criminals attack networks, applications, and databases for several reasons. In some cases, they do so just to prove they can, or to create chaos. In other cases, they may use personal data to steal identities, commit fraud or to demand ransoms. Espionage, both between companies and governments, is also on the rise. And there are fears that in the future a cyberterrorism attack could have far reaching consequences.

Individual devices are at risk from viruses, malware, ransomware, and data theft. These can be protected using firewalls and anti-virus software – however, these applications need to be continually updated. For corporations, network security is crucial as the stakes are so much higher. Corporations need to take a multi-faceted approach to security, using a wide variety of cybersecurity products. In fact, there are at least 70 different types of security products. These are the most common and important types of security products:

• Network security products protect a network by controlling incoming and outgoing connections.
• Identity and access management software technologies are also used to control access to networks and applications.
• Antivirus and anti-malware tools identify and eliminate threats on devices and networks.
• Endpoint threat protection tools detect and prevent attacks from entering a network via devices connected to the network.
• DDoS protection tools protect applications and websites from distributed denial of service attacks.
• Intrusion detection and protection tools identify unauthorised access to networks.
• Data loss prevention (DLP) tools protect data from theft and loss due to system failure.

The range of threats and the responses are constantly evolving. For example, threats like phishing attacks, identity theft and unauthorised access often result from human behaviour rather than from system vulnerability. Artificial intelligence is being used increasingly to identify threats by detecting suspicious and unusual user behaviour.

How and when to invest in cybersecurity stocks

Most cybersecurity stocks are growth stocks, which means volatility should be expected from time to time. The best way to manage portfolio risk is by including asset classes like bonds, hedge funds, and real estate alongside your stock market investments. Effective asset allocation allows you to hold riskier stocks that generate higher returns over the long term. The cybersecurity industry is one industry where market timing is worth paying attention to.

Cybersecurity stocks tend to perform very well whenever there is a major cyberattack. A period of underperformance typically follows. It goes without saying that the time to buy cybersecurity stocks is during these periods of underperformance. As far as stock picking goes, the same principles that apply to most software growth stocks apply to internet security companies. In the short to medium term, revenue growth rates are the most important factor to watch.

When looking for long term investments, fundamental analysis should focus on products, market share and distribution. The eventual winners in the industry will be the companies that can both win and maintain market share. Those that provide a range of solutions are less likely to be eclipsed by new technologies in the future. A good indication of product market fit is a company that manages to both grow its user base and increase revenue from existing customers.

Apart from these guidelines, the same techniques that can be used to evaluate SaaS stocks can also be applied. Valuations are less important, but not something to ignore entirely. Over the course of 2020, valuations of cloud security platforms have become very stretched, as measured by most valuation metrics. This increases the risk of a correction. Momentum strategies are often a good way to play stocks trading on high valuations.

Top 10 cybersecurity stocks

As is the case with SaaS stocks, nearly all the public cybersecurity companies are based and listed in the US. Cybersecurity is an important aspect of any technology company, particularly America and China’s tech giants. In fact, security and privacy are regarded as competitive advantages for Apple and Microsoft. However, for these companies, security is a feature and not a source of revenue.

• Cloud security stocks
• Established cybersecurity stocks

Cloud security stocks

The cybersecurity market, like the rest of the software market, is currently in the midst of a cloud technology revolution. So, it is no surprise that the top cybersecurity stocks are currently all cloud security companies. These five companies are currently leading the industry:

• CrowdStrike Holdings (Nasdaq: CRWD) – CrowdStrike is one of the market leaders amongst cloud-based cybersecurity stocks. It is also the most valuable cybersecurity company in the world, with a market value of $40 billion. CrowdStrike’s Falcon platform helps companies with endpoint protection, threat intelligence and cyberattack response. Many of the world’s largest corporations, institutions and even government departments use these products to prevent major attacks from hackers and even from attacks by foreign governments. CrowdStrike has been brought in to investigate several high-profile cyber-attacks around the world. Revenue has grown at an average of 100% over the past three years, and annual sales are now close to $760 million. Like most rapidly growing cybersecurity companies, CrowdStrike is not yet profitable and is trading at a lofty price to sales ratio of 55.
• Cloudflare (NYSE: NET) – Cloudflare, which only held its IPO last year, has been the top performing cybersecurity stock in 2020. The stock is up a massive 379% year to date! Cloudflare actually operates in two areas: security and content distribution. However, the two product lines create opportunities for the company to cross sell its products to customers. Cloudflare’s cloud security solutions are used to secure public and private clouds, as well as on premise software and IoT devices. The company is expected to benefit when 5G networks result in more connected devices. Clients also use the content distribution network (CDN) product to manage content delivery for 27 million websites. Cloudflare is well positioned for the future, but trades on a price to sales multiple of 65 – the highest on this list. It could be treated as a momentum play, but long-term investors may want to wait for a correction.
• Zscaler (Nasdaq: ZS) – Zscaler provides cloud security solutions that help clients control access to local and external applications. ZS has been the second-best cybersecurity stock in terms of price performance this year, returning over 300% for investors. Besides security products, Zscaler also helps companies measure user experience and manage their digital infrastructure. ZS has grown revenue at more than 50% a year over the past five years. While growth has been strong, the operating loss has widened, and the stock could be vulnerable to a correction if market volatility increases.
• Okta Inc (Nasdaq: OKTA) – Okta provides cloud-based identity and access management systems. This is a classic infrastructure as a service company (IAAS) in that it offers developers a platform and tools to use when developing systems. Okta’s platform is in turn built on AWS. The company is a market leader in the access management space but does have a lot of competition. Okta has managed to grow revenue at an average of 40% year over year for the past five years, though growth has slowed in recent quarters. The stock is up 135% year to date, which has left it trading on at 45x sales.
• Proofpoint Inc (Nasdaq: PFPT) – Proofpoint’s solutions allow companies to protect and govern sensitive data. Proofpoint’s software is designed to defend data against a wide variety of threats. Products are offered via a security as a service platform. While data is Proofpoint’s focus, a number of other security services are also offered. The business model should allow the company to increase sales to existing customers over time. Proofpoint is also reasonably valued relative to its peers.

Established cybersecurity stocks

The more established cybersecurity stocks are growing revenue at more modest rates. However, they are also trading on more reasonable valuations. These are the five established companies that stand out:

• Palo Alto (Nasdaq: PANW) – Palo Alto Networks is one of the largest and oldest of the large cybersecurity stocks. Palo Alto, which was founded in 2005 has acquired 15 smaller rivals in the last five years. The result is one of the most diversified product portfolios in the industry. Palo Alto’s primary products include a firewall product that can be extended via the cloud, and Panorama, a network security control center. The company also offers a range of cloud storage and analysis products for customers who prioritize security. Annual revenue of $3.5 billion is far higher than other companies on this list, but growth is more modest at around 20% a year. The modest valuation and diversified product range make this one of the more defensive cybersecurity stocks.
• Fortinet Inc (Nasdaq: FTNT) – Fortinet is both established and one of the 5G cybersecurity stocks expected to benefit from the 5G revolution. Fortinet provides a range of security solutions including firewalls, antivirus software, and endpoint security. In particular, Fortinet’s endpoint security solution helps companies protect their networks from threats emanating from devices connected to the network. This has been especially relevant for employees doing remote work during the COVID-19 pandemic. When people work from home, network security can easily be compromised. Although growth is relatively modest, the company generates strong cash flows. Fortinet is well positioned for the future and is also more reasonably valued than similar stocks.
• NortonLifeLock (Nasdaq: NLOK) – NortonLifeLock was formerly part of Symantec which has been split into three companies over the past few years. The remaining company is focused on security for consumers rather than corporations. Products provide PCs, notebooks, and mobile devices with protection from common threats like ransomware. It also offers an identity theft product and various VPN products. While sales growth has been relatively slow, the company is very profitable with an operating margin of 29%. It is also reasonably valued, with a forward price multiple of 15.
• SailPoint Technologies Holdings (Nasdaq: SAIL) – SailPoint provides identity governance solutions to companies around the world. The solutions help clients manage digital identities and access rights for employees, partners, and customers. Their security platform is also available as a SaaS platform, so developers can build its features into applications. SailPoint has a relatively small market value of $5 billion but is already operationally profitable. Growth has been fairly modest, but the small size and SaaS model implies the stock has great potential going forward.
• Verisign (Nasdaq: VRSN) – Verisign has undergone some major changes since becoming a publicly traded company in 1999. It started out as a website authentication service, though that business unit was later sold. Verisign now manages registries for leading domains including the .com and .net domains. Verisign also provides DDoS threat mitigation and cyber threat reporting services. Verisign is an extremely profitable company with an operating margin of 65%. The company also generates over $700 million in operating cash flow which may give it an advantage if or when competitors find themselves in a tight spot.

Cybersecurity ETFs

Investing in individual technology companies will always entail a certain amount of speculation and risk. One way to reduce the risks of investing in individual stocks is by investing in exchange traded funds. The following US listed ETFs all hold between 28 and 60 cybersecurity and VPN stocks. They have all returned 60 to 90% over the past two years, well ahead of the S&P 500 index. All three funds charge 0.5 to 0.6% in annual fees.

• Global X Cybersecurity ETF (BUG)
• ETFMG Prime Cyber Security ETF (HACK)
• iShares Cybersecurity and Tech ETF (IHAK)

European investors can consider the L&G ISE Cybersecurity ETF (ISPY), a similar fund listed on several European exchanges.

Conclusion: Investing in cybersecurity stocks

Cybersecurity will be essential to the success of many of the companies riding the key investment megatrends of the next decade. So, it is unlikely that IoT, AI and 5G stocks, will perform well without cybersecurity stocks also performing well. This means the sector is another way to profit from all of these trends.

Several cloud security stocks are already well on their way to being multibagger stocks. However, as mentioned, the cloud stocks are trading on very high valuations and should be treated with caution until we see a correction, or until revenue catches up with the valuations.