Investing in Cybersecurity in 2024

The war in Ukraine and the ongoing conflict between Israel and Hamas may be steering investor attention toward traditional defense stocks, but we believe their digital equivalents deserve some attention too.

This industry in the technology sector has been overshadowed recently by investors as they chase semiconductors and AI, but it’s incredibly important. These are the companies that prevent costly breaches impacting shareholder value.

According to IBM’s 2023 research, the average cost of a data breach in 2023 was $4.45 million, a 2.3% increase from 2022’s cost of $4.35 million. From 2020 onwards, the average cost of a data breach has increased 15.3% from $3.86 million.¹

With increased digitization and the Internet of Things (IoT), expect this figure to only grow. Right now, IBM notes that the U.S. suffers from the most expensive data breaches in the world at an estimated $9.48 million in 2023 alone.²

Here are some reasons why we believe cybersecurity should be on your radar, along with a thematic UCITS ETFs from LGIM that aim to capture this theme.

Why invest in cybersecurity companies?

The cybersecurity sector is currently experiencing significant consolidation and numerous accretive acquisitions. In 2024 alone, several high-profile deals have taken place, highlighting the industry's growth and strategic importance.

For instance, CyberArk agreed to buy Venafi from Thoma Bravo for $1.54 billion, CrowdStrike acquired Flow Security to expand its cloud security capabilities, Zscaler bought Avalor to add real-time AI-driven security insights and threat prevention, and Palo Alto Networks acquired Talonn for $550 million.³

Bessemer Venture Partners has identified two key traits in these acquisitions⁴:

1. Most acquired companies had between 10 and 50 customers and were primarily targeted for their teams and products.
2. The acquisition price for “product-only” companies has increased, with a median ranging from $200 million to $300 million over the past year.

Bessemer refers to this trend as "platformization," which involves integrating smaller, innovative firms into larger platforms to create comprehensive cybersecurity solutions.

Cybersecurity also continues to be a priority in IT budgets, with no signs of spending fatigue. More companies recognize the value of robust cybersecurity measures. IBM's 2023 Cost of a Data Breach Report⁵ found that companies with automatic or AI breach detection services had average data breach costs $1.76 million lower than those without.

This is particularly critical in industries like healthcare, where data breach costs were the highest in 2023, averaging $10.93 million.⁶ Critical infrastructure sectors, such as those affected by incidents like the Colonial Pipeline breach, averaged $5.04 million in data breach costs.⁷

The shift to cloud environments is accelerating the need for robust cybersecurity. IBM's report⁸ also found that 82% of breaches occurred in the cloud, with 39% spanning multiple cloud environments.

This is compounded by the generative AI arms race, which has seen incidents like a deepfake video call impersonating a CFO to prompt an HSBC employee to transfer $25 million.⁹ Cybersecurity companies are responding by increasing their R&D to address these sophisticated threats.

Cybersecurity ETF to watch

LGIM offers two ETFs that investors may wish to consider in the cybersecurity sector. The larger of the two, with approximately $2.32 billion in assets under management (AUM),¹⁰ is the L&G Cyber Security UCITS ETF (USPY).

For a total expense ratio (TER) of 0.69%, this ETF tracks the ISE Cyber Security UCITS Index, which sorts its 39 current holdings into two categories:

1. Infrastructure Providers: These companies supply hardware and software that secure access to files, websites, and networks.
2. Service Providers: These firms offer consulting and other value-added services.

The ETF also implements additional screens for size and liquidity. Subsector allocations are based on market value, and within each subsector, the holdings are equally weighted. Notable top holdings include:

• *Darktrace: A cybersecurity firm that uses AI to detect and respond to cyber threats in real-time.
• *Palo Alto Networks: A leader in advanced firewalls and cloud-based security solutions.
• *CrowdStrike: Known for its endpoint protection and threat intelligence.
• *Fortinet: Provides broad, integrated, and automated cybersecurity solutions.

Investing in the ETF aims to provide exposure to the growing cybersecurity sector, allowing investors to potentially benefit from the industry's expansion.

* For illustrative purposes only. Reference to a particular security is on a historic basis and does not mean that the security is currently held or will be held within an LGIM portfolio. The above information does not constitute a recommendation to buy or sell any security.

¹ Source: https://www.upguard.com/blog/cost-of-a-data-breach-2024

² Source: ibid.

³ Source: https://www.csoonline.com/article/1298623/top-cybersecurity-ma-deals-for-2024.html

⁴ Source: https://www.bvp.com/atlas/cybersecurity-trends-in-2024

⁵ Source: https://www.ibm.com/reports/data-breach

⁶ Ibid.

⁷ Ibid.

⁸ Ibid.

⁹ Source: https://arstechnica.com/information-technology/2024/02/deepfake-scammer-walks-off-with-25-million-in-first-of-its-kind-ai-heist/

¹⁰ Source: LGIM as at 17 July 2024.

For professional clients only. Capital at risk.

This is a marketing communication. Please refer to the prospectus of the fund and to the key investor information.

Key Risk Warnings

The value of investments and the income from them can go down as well as up and you may not get back the amount invested. Past performance is not a guide to future performance. The details contained here are for information purposes only and do not constitute investment advice or a recommendation or offer to buy or sell any security.  The information above is provided on a general basis and does not take into account any individual investor’s circumstances.  Any views expressed are those of LGIM as at the date of publication. Not for distribution to any person resident in any jurisdiction where such distribution would be contrary to local law or regulation. 

A summary in English of investor rights associated with an investment in the fund is available from www.lgim.com/investor_rights.

The risks associated with each fund or investment strategy are set out in the key investor information document and prospectus or investment management agreement (as applicable).  These documents should be reviewed before making any investment decisions. A copy of the English version of the prospectus and the key investor information document for each fund is available at https://fundcentres.lgim.com/ and may also be obtained from your Client Relationship Manager.

A decision may be taken at any time to terminate the arrangements made for the marketing of the fund in any EEA Member State in which it is currently marketed. In such circumstances, shareholders in the affected EEA Member State will be notified of this decision and will be provided with the opportunity to redeem their shareholding in the fund free of any charges or deductions for at least 30 working days from the date of such notification. Where required under national rules, the key investor information document will also be available in the local language of the relevant EEA Member State.

Information on sustainability-related aspects on the funds is available on https://fundcentres.lgim.com/ The decision to invest in the funds should take into account all the characteristics or objectives of the fund as described in its prospectus and in the key investor information document relating to the fund.

This financial promotion is issued by Legal & General Investment Management Ltd in the UK. Registered in England and Wales No. 02091894. Registered office: One Coleman Street, London EC2R 5AA. Authorised and regulated by the Financial Conduct Authority.

In the European Economic Area, this document is issued by LGIM Managers (Europe) Limited, authorised and regulated by the Central Bank of Ireland as a UCITS management company (pursuant to European Communities (Undertakings for Collective Investment in Transferable Securities) Regulations, 2011 (as amended) and as an alternative investment fund manager (pursuant to the European Union (Alternative Investment Fund Managers) Regulations 2013 (as amended). LGIM Managers (Europe) Limited’s registered office is at 70 Sir John Rogerson’s Quay, Dublin, 2, Ireland and it is registered with the Irish Companies Registration Office under company no. 609677.

LGIM Managers (Europe) Limited operates a branch network in the European Economic Area, which is subject to supervision by the Central Bank of Ireland. In Italy, the branch office of LGIM Managers (Europe) Limited is subject to limited supervision by the Commissione Nazionale per le società e la Borsa (“CONSOB”) and is registered with Banca d’Italia (no. 23978.0) with registered office at Piazza della Repubblica 3, 20121 - Milano (Companies’ Register no. MI - 2557936). In Sweden, the branch office of LGIM Managers (Europe) Limited is subject to limited supervision by the Swedish Financial Supervisory Authority (“SFSA”). In Germany, the branch office of LGIM Managers (Europe) Limited is subject to limited supervision by the German Federal Financial Supervisory Authority (“BaFin”). In the Netherlands, the branch office of LGIM Managers (Europe) Limited is subject to limited supervision by the Dutch Authority for the Financial Markets (“AFM“) and it is included in the register held by the AFM and registered with the trade register of the Chamber of Commerce under number 74481231. Details about the full extent of our relevant authorisations and permissions are available from us upon request.