Sektory a témata
How to Invest in Cybersecurity: ETFs, Companies, and Real Risks
Key takeaways
- Cybersecurity covers companies from network protection and endpoint security to cloud and application security.
- UCITS ETFs such as BUG (iShares Digital Security) or Xtrackers Cybersecurity offer diversified exposure.
- The sector has a structural tailwind: attacks grow with digitalization, and regulations (NIS2, DORA) force companies to invest.
- Valuations are historically stretched — the sector is not immune to broad-market corrections.
- US concentration is significant; European companies make up a smaller share of thematic indices.
Cybersecurity is one of the few themes where the structural tailwind looks less like a trend and more like a necessity — every wave of digitalization creates new attack surfaces, and regulators worldwide are forcing companies into mandatory security spending.
What the cybersecurity sector includes
- Network security: firewalls, IDS/IPS systems, perimeter protection,
- Endpoint security: antivirus and EDR platforms for devices,
- Cloud security: protecting data and applications in the cloud,
- Identity & access management: access control, zero trust architectures,
- Threat intelligence: companies delivering threat analysis and incident response.
How to invest through UCITS ETFs
Available UCITS ETFs include iShares Digital Security UCITS ETF (BUG) and Xtrackers Cybersecurity UCITS ETF, tracking indices such as iSTOXX FactSet Digital Security or Solactive Global Cyber Security. TER is around 0.35–0.50% — verify current values on justETF. Why the UCITS format protects European investors is explained in the article on Irish domicile.
Why cybersecurity is an attractive theme
Unlike pure speculation on AI or the metaverse, cybersecurity addresses a real and growing problem. The number of attacks is growing exponentially, and successful hacks cost companies billions. Regulators in both the EU and the US have imposed mandatory security infrastructure spending — providing stable demand even during recessions.
Risks that cannot be ignored
Valuations: Cybersecurity companies traditionally trade at a premium — the market pays for the growth story. Consolidation: Platformization (one vendor for everything) is changing market structure and could compress the margins of smaller specialists. Geographic concentration: Most index weights are in the US. How to measure risk is a good starting point.
Where cybersecurity belongs in a portfolio
As a satellite with a maximum 5–10% allocation for an investor with a 7+ year horizon. A more diversified alternative to betting on a single company. Build a solid core before adding thematic positions — how to build your first portfolio.
FAQ
Is cybersecurity a defensive or a growth theme?
Both. It has defensive characteristics (companies must invest in security even during a crisis) and growth characteristics (innovation, cloud migration). In practice, it behaves more like a growth stock — it responds to rate moves and market sentiment.
What is the difference between BUG and other cybersecurity ETFs?
BUG (iShares Digital Security) tracks the iSTOXX FactSet Digital Security index and has a broader scope, including companies on the borderline of data and security. Other ETFs like Xtrackers use different index methodologies. Always compare composition on justETF.
What risk does AI pose to cybersecurity companies?
AI is a weapon for both sides. Attackers use it for more sophisticated assaults; defenders implement it for faster detection. The net effect on the sector is more positive — the complexity of threats increases demand for solutions.