Cybersecurity ETFs: Investing in Digital Security
Cyberattacks are a permanent, growing cost of doing business, which gives cybersecurity unusually durable demand. But the ETFs are concentrated, pricey and richly valued. Here's the honest picture.
Don't have time? Here's what you need to know:
- 1Cybersecurity has a structural tailwind: spending tends to rise with digitization and is rarely cut in downturns, giving the sector durable demand.
- 2Funds like HACK hold several dozen specialist firms, many mid-cap, with low overlap with the S&P 500 — genuinely additive but concentrated.
- 3These stocks often carry high valuations and the ETFs charge ~0.50-0.60%, so they can fall sharply when rates rise or growth slows.
- 4Cybersecurity is one of the more defensible thematic satellites, but it still belongs as a small position over a diversified core.
The Structural Case for Cybersecurity
Cybersecurity has an unusually durable demand story. As more of the economy moves online — cloud computing, remote work, connected devices, digital payments — the attack surface keeps expanding, and so does spending to defend it. Security is rarely the first budget a company cuts in a downturn, because the cost of a breach can dwarf the cost of protection. That gives the sector a structural tailwind less dependent on the economic cycle than, say, consumer discretionary spending.
The first and best-known fund in the space is HACK, the ETFMG Prime Cyber Security ETF, which holds a basket of firms that build firewalls, threat-detection software, identity tools and security services. A handful of other cybersecurity funds exist, but they all draw from the same relatively small universe of specialist companies.
What's Inside a Cybersecurity ETF
Cybersecurity is a narrow industry, so these funds hold a concentrated set of companies — typically several dozen specialist names rather than hundreds. The holdings span next-generation firewall makers, cloud-security and identity-management platforms, threat-intelligence providers and managed security services. Many are mid-cap software firms rather than the megacaps that dominate broad tech funds, which makes a cybersecurity ETF a genuinely different exposure than the S&P 500.
That distinctiveness is part of the appeal — you are buying something a broad index barely touches — but it also concentrates risk. With a limited number of holdings in one industry, the fund's fortunes ride on a small group of companies and on the continued growth of security budgets. It is a focused thematic bet, not a diversified one.
| Trait | Cybersecurity ETF (e.g. HACK) | Broad tech fund (XLK) |
|---|---|---|
| Number of holdings | Several dozen specialists | Dozens to ~100+, megacap-led |
| Cap profile | Mid-cap software heavy | Mega-cap dominated |
| Expense ratio | ~0.50-0.60% | ~0.09-0.10% |
| Overlap with S&P 500 | Low | High |
| Diversification | Concentrated, one industry | Broad technology |
Valuation, Fees and Concentration
A compelling story does not make a fund cheap. Cybersecurity software companies frequently trade at high valuation multiples because investors prize their fast, recurring subscription revenue — which means the sector is sensitive to rising interest rates and to any slowdown in growth, just as cloud and SaaS stocks are. Strong long-term demand and a steep drawdown can coexist, as the 2022 selloff in high-multiple software showed.
Cybersecurity ETFs also charge thematic-level fees, commonly around 0.50% to 0.60%, well above a broad tech fund. And their concentration means a stumble by a few key holdings hits the whole fund. None of this negates the structural case; it just means the sector should be sized like the concentrated, volatile bet it is.
Important: Strong demand for cybersecurity does not guarantee strong stock returns. These companies often carry rich valuations, so the ETFs can fall sharply when rates rise or growth slows — durable demand and a 40% drawdown are not contradictory.
Ready to invest? Open an IBKR account in 10 minutes and get free stock. $0 commissions on US ETFs • Fractional shares from $1 • 150+ global markets.
How to Position a Cybersecurity ETF
Because a cybersecurity ETF holds names a broad index largely ignores, it offers something genuinely additive — a tilt toward an industry with secular growth that you would otherwise have almost no exposure to. That makes it one of the more defensible thematic satellites, provided you keep it small relative to a diversified core.
A few percent of the equity portion of a portfolio is a reasonable cap for a conviction position. Size it so that a sharp drawdown in a volatile sector is an annoyance rather than a portfolio-defining event, decide that weight before you buy, and rebalance back to it rather than chasing the theme after a strong run.
Tip: Cybersecurity is one of the few themes with low overlap with the S&P 500, so it can genuinely add something new — but its concentration and valuation mean it still belongs in the small-satellite bucket, not the core.
Frequently Asked Questions
Is a cybersecurity ETF a good investment?
Cybersecurity has a durable demand story because security spending tends to rise with digitization and is rarely cut in downturns. But the ETFs are concentrated in a few dozen specialist companies, often richly valued, and charge fees around 0.50-0.60%. They suit investors who want a deliberate, small tilt to a secular-growth industry, held as a satellite alongside a diversified core.
What does the HACK ETF hold?
HACK, the first major cybersecurity ETF, holds a basket of specialist firms: next-generation firewall makers, cloud-security and identity-management platforms, threat-detection software providers and security services companies. Many are mid-cap software names rather than the megacaps in broad tech funds, which is why HACK offers exposure a standard index fund barely provides.
Does cybersecurity overlap with my tech fund?
Less than most tech themes. Cybersecurity ETFs are weighted toward mid-cap specialist firms, while broad tech and index funds are dominated by megacaps. That low overlap means a cybersecurity ETF can genuinely add new exposure — but it also concentrates your money in one narrow, volatile industry, so position size still matters.
Why are cybersecurity stocks volatile if demand is so steady?
Steady demand and steady stock prices are different things. Cybersecurity software firms often trade at high valuation multiples because investors pay up for recurring subscription revenue, which makes them sensitive to rising interest rates and growth scares. In the 2022 rate-driven selloff, high-multiple software stocks, including many security names, fell hard despite healthy underlying demand.
Further Reading
Free Tools
Alex Harrington
CFA Level II Candidate, Finance & Economics
Alex Harrington is an independent ETF researcher and personal finance writer with over 8 years of experience analyzing exchange-traded funds. A CFA Level II candidate with a background in economics, Alex has reviewed 800+ ETFs and helped thousands of beginners build their first investment portfolios through clear, jargon-free education.
This content is for educational purposes only and does not constitute financial advice. Past performance does not guarantee future results. Consult a licensed financial advisor before making investment decisions.