Recession-weary investors have found a haven in information technology stocks with optimism surrounding cybersecurity in particular, but analysts warned that several risks might weigh on the sector.
The major cybersecurity exchange-traded funds tracked by S&P Global Market Intelligence have largely outperformed the broad market. Many analysts believe the sector is far from mature and demand will accelerate.
ETF Managers Trust - ETFMG Prime Cyber Security ETF for instance, stayed above the S&P 500 through the 2020 market crash, giving year-to-date returns of 13.6% as of market close July 21, compared to just 0.8% for the broad market index.
More general IT ETFs like Vanguard World Fund - Vanguard Information Technology ETF delivered 18.2% year-to-date July 21. The tech-heavy NASDAQ index has outperformed both ETFs, up 19.0%.
For the period between March 16 and July 21, 2019, cybersecurity investors were much more subdued despite plenty of growth forecasts for the sector. The Prime Cyber Security ETF grew only 3.4% in that four-month period while the Vanguard Information Technology ETF pitched 10.6% and the S&P 500 added 5.8%.
Amid the pandemic-driven stock market collapse and uneven recovery, both ETFs soared over 50% for the same four-month period, well outrunning the S&P 500's 37.3% recovery.
Still, cybersecurity ETFs underperformed broader technology indexes and ETFs year-to-date. Several analysts are beginning to question the enthusiasm among pandemic-era IT and cybersecurity investors.
"I have been surprised at how resilient the broader tech market has been," JMP Securities analyst Erik Suppiger said in an interview. "The underlying demand of cybersecurity and tech is still quite attractive, but I have my own concerns on the macroeconomic front. ... Broad GDP data is certainly not compelling," he said.
While cybersecurity ETFs seem to have fared better in the second quarter than initially expected, "we are seeing broad-based hesitation persist in spending on projects due to ongoing macro uncertainty and tightening general budgets," William Blair Research analyst Jonathan Ho said in a July 21 note.
Cybersecurity's 2020 underperformance compared to broader IT comes despite strong interest. The enterprise security market has been "the most active of all technology segments since 2016," said Scott Crawford, lead information security analyst at 451 Research, an offering of S&P Global Market Intelligence.
According to a June 451 Research survey, 66% of organizations are experiencing or have experienced an increased strain on IT resources as a result of the outbreak, and 31% are spending more on IT assets.
"The pandemic forces people to go to home environments. Anything that helps employees work from home instead of work at the office saw a sharp uptake in demand," Suppiger at JMP Securities said.
Endpoint protection company CrowdStrike Holdings Inc. is one of the flourishing "winners" that has thrived since the February crash, Morningstar Research analyst Mark Cash said. "They're eating Symantec's lunch,” he said, referring to legacy cybersecurity firm NortonLifeLock Inc.
NortonLifeLock was founded in 1982 under the name Symantec, where the much younger CrowdStrike was founded in 2011. Year-to-date, NortonLifeLock has seen shares drop by 21.9% as of July 21. CrowdStrike's stock value has grown by 254% during that same time period, and over its relatively short life its managed to build a market cap about $9 billion higher than that of NortonLifeLock.
Cash also pointed to Okta Inc. as well-positioned in the pandemic due to work-from-home policies coupled with the company's strong cash flow driven by its subscription model. Okta's market cap exploded by 119.9% from March 16 to July 21. The company provides a "zero trust" security product that protects access to remote data from a range of devices.
Fortinet Inc. is another cyber stock riding the work-from-home wave. Its share price went from $75 to $139 in 4 months.
Not every public cybersecurity company is above the curve. NortonLifeLock is an example, falling out of favor after it sold its enterprise security business in 2019. CyberArk Software Ltd. shares are clocking a near flat growth year to date, and Ho said the company's work-from-home products will take some time to be competitive.
The varied performance of individual companies makes cyber ETFs less secure than IT ETFs which lean on major players such as Netflix Inc., Alphabet Inc. and Amazon.com Inc., Cash said.
"Cyber is riskier — it's a younger, smaller market. But investors are embracing that now because there are threats always on the horizon," said Cash. He added that despite growth potential, the pandemic trends may have over-baked investor appetite for the sector. For many young cloud security companies, "I think there is irrational exuberance," he said.