Skip to main content

A deteriorating global economy means secular growth stories – stocks and companies benefiting from specific industrial themes and less dependent on overall economic activity – are becoming far more attractive to investors. Cybersecurity stocks, while not without risk, make up one of these promising investment themes.

In the past couple of years alone, high-profile hacks of Target Corp.'s credit-card network, a massive online theft of U.S. government worker information and a breach of Canada's intelligence agency, the Canadian Security Intelligence Service, highlight the dangers of what has been termed cyberterrorism. According to Merrill Lynch analyst Sarbjit Nahal, these well-documented cases are only the tip of the iceberg. "There are [80 to 90 million-plus] cybersecurity events per year, with close to 400 new threats every minute, and up to 70 per cent of attacks going undetected. All companies are being hit: finance and insurance is the most targeted sector … The average cost of cybercrimes for U.S. companies reached a record $12.7-million [U.S.] in 2014, with cybercrime costing the global economy up to $575-billion annually."

For sensitive government and corporate information, a major surge in network-related spending is a necessity. Mr. Nahal expects revenue for the cybersecurity industry to rise from 2015's $75-billion to $170-billion in the next five years – a gain of 233 per cent. Merrill Lynch identified 50 stocks with cybersecurity operations but in many cases, security is only a small part of the business. In the table below, there are 10 stocks with high sensitivity to network security spending from two technology subindustries that Mr. Nahal terms "cloud, data and threat intelligence," and "threat protection."

The problem with most of these stocks becomes obvious quickly – valuations. Trailing earnings growth and trailing price-to-earnings levels for Splunk Inc., for example, are near worthless after the company (in the cloud, data and threat intelligence category) made two acquisitions. The forward P/E, at almost 400 times estimated earnings, is alarming, but Splunk's stock has an average annual return of 22 per cent in the past three years, which suggests the shares might be well positioned.

The table is not meant as a "buy list" of stocks. This is clearly a high-risk sector at the early stages of its growth path and considerable fundamental research would be required before an investor should be comfortable adding any of them in their portfolio.

Even then, it should be kept to a small percentage of investment holdings.

A more diversified exchange-traded fund option is available for investors, the PureFunds ISE Cyber Security ETF (HACK-NYSE), which holds a number of the stocks in the table. Despite the added diversification, however, the ETF is still not for the faint of heart, as the portfolio's recent slide from $32 to $26 highlights.

The biggest winners are not yet clear, but it's difficult to imagine a future scenario where spending by both governments and corporations on network security doesn't surge further. Outsized investor returns should be available despite the considerable risks.

Selected cybersecurity stocks