ZS - BUG: A High-Risk/Reward Cybersecurity ETF

2023-03-20 07:49:12 ET

Summary

• The Global X Cybersecurity ETF was mauled by the 2022 bear market and is down 25% over the last year - back to where it was in late 2020.
• However, that doesn't mean the companies held in the portfolio are struggling - they're not. In fact, they continue to grow like weeds with revenue typically up from 25-35% yoy.
• That's because governments, companies, and individuals are aware that they must protect their networks, computers, and infrastructure from rogue state actors and criminal gangs.
• The fact is this: in the 21st Century, cybersecurity is no longer optional. It's mandatory.

The Global X Cybersecurity ETF ( BUG ) invests in companies that will benefit from the increased adoption of cybersecurity technology by governments, businesses, and individual consumers. These cybersecurity providers typically operate highly-scalable software-as-a-service (or "SaaS") cloud-based platforms that prevent intrusion and cyber-attacks on systems, networks, applications, computers, and mobile devices. Many of the leading cybersecurity companies are growing revenue at an annualized rate of 25-35%, and continued to do so despite the challenging macroeconomic environment that have existed over the past year as a results of Putin's horrific invasion of Ukraine that broke the global food and energy supply-chains that supercharged inflation and led the Federal Reserves to rapidly and significantly increase interest rates.

Investment Thesis

Statista reports that the global cybersecurity market is expected to reach $173.50 billion this year and to grow at a CAGR 10.90% to a market value of $262.40 billion by 2027 (see graphic below). Perhaps even more surprising is that Statista also reported that the average Spend per Employee in the Cybersecurity market is projected to reach $8,200 in 2023. The U.S. is the largest market, with state actors like Russia, China, Iran, and North Korea all training their sites on their supposed "nemesis".

Given the above cybersecurity dynamics, and the fact that the leading companies in the cybersecurity sector are growing significantly faster than the estimated 10.9% CAGR cited above, let's take a look to see how the BUG ETF has positioned investors for success going forward.

Top-10 Holdings

The top-10 holdings in the BUG Cybersecurity ETF are shown below and were taken directly from the Global X BUG ETF webpage where you can find more detailed information on the portfolio and the fund:

The top-10 holdings equate to what I consider to be a relatively concentrated 61% of the only 23 company portfolio. And that is what an investor should want - concentration in the biggest, best, and fastest growing companies. In fact, I'd go so far as to say concentrating the entire portfolio in these top-10 stocks might not be a bad idea.

The #1 holding with a 7.8% weight is Fortinet ( FTNT ). Bucking the overall market, FTNT stock is basically flat over the past year, outperforming the S&P 500 by 11%+. Last month, Fortinet posted relatively strong Q4 results :

• Non-GAAP EPS of $0.44 was a $0.05 beats
• Revenue of $1.28 billion (+32.8% yoy) was $20 million light of consensus.

Fortinet CEO Ken Xie commented on the quarter:

Our market share gains are being driven by Fortinet's integrated and single platform approach to cybersecurity combined with FortiASIC technology, which lowers the management costs and the total cost of ownership for organizations. Given our cost-for-performance advantage, the convergence of security and networking, and the consolidation of products and vendors, we expect to continue our solid growth trajectory.

Forward guidance was also better than expected:

• Q1 revenue in the range of $1.180-$1.220 billion vs $1.18 billion consensus.
• FY23 revenue in the range of $5.370-$5.430 billion vs $5.35 billion consensus.

Perhaps more importantly, in Q4 FTNT generated $497.2 million in free cash flow (38.8% of revenue) and for the full-year FY22 the company generated a whopping $1.45 billion of free cash flow.

Palo Alto Networks ( PANW ) is the #2 holding in the BUG ETF with a 7.3% weight. Like Fortinet, PANW stock is also relatively flat over the past year despite continued strong financial growth. Palo Alto released Q2 FY23 results last month and they were both a top- and bottom-line beat :

• Revenue of $1.66 billion (+25.7% yoy) beat by $10 million.
• Non-GAAP EPS of $1.05 beat by $0.27.

Palo Alto said it expects an adjusted free cash flow margin in the range of 36.5% to 37.5% for FY23. That said, note that cash & cash equivalents have fallen by ~$750 million over the past two quarters. PANW runs a scalable SaaS-based cybersecurity platform and is confident enough to have raised its billings and NGS ARR (annual recurring revenue) guidance. As the slide below from the Q2 presentation shows, PANW continues to demonstrate a strong trajectory, especially with its Next-Gen Security ("NGS") ARR:

With a 7.3% weighting, Okta ( OKTA ) is the #3 holding. OKTA also reported very strong Q4 results with revenue of $510 million (+33.2% yoy) beating consensus estimates by $20.42 million. In late January, Oppenheimer raised OKTA from a HOLD to a BUY based on "generally happy customers" with 90% of Okta's customers rating their happiness level as either a 4/5 or 5/5. Oppenheimer analyst Adam Borg raised his per-share price target on OKTA from $60 to $90. The stock, which is down 48% over the past year, closed Friday at $83.83 and has a forward P/E = 110x.

The #7 holding is cybersecurity favorite and Austin, TX-based CrowdStrike ( CRWD ) with a 5.5% weight. Just like the previously discussed companies, CRWD continues to demonstrate a strong growth trajectory despite global macro-economic headwinds:

Zscaler ( ZS ) is the #9 holding with a 4.8% weight. ZS stock was very highly valued going into the 2022 bear-market and, as a result, is down a whopping 51% over the past year. Yet it still trades at 69x forward earnings - which is likely why Seeking Alpha current reports a 7.7% short-interest . But once again, earlier this month ZS reported very strong Q2 FY23 results (revenue of $387.6 million was +51.7% yoy) while cash and cash equivalents were +$174 million over the past 6-months.

The expense fee for the BUG ETF is 0.50%, and it should also be noted that BUG holds a global portfolio with ~70% allocated to the United States:

Performance

The graphic below displays BUG's performance since inception in October of 2019:

The following graphic shows the 3-year total returns of the BUG ETF versus some competing ETFs like the ETFMG Prime Cyber Security ETF ( HACK ), the iShares Cybersecurity and Tech ETF ( IHAK ), and the First Trust NASDAQ Cybersecurity ETF ( CIBR ):

As can be seen in the graphic, the BUG ETF has performed quite well as compared to its peers, but was outperformed by the CIBR ETF by 5%.

Risks

Investors in cybersecurity stocks suffered a brutal lesson in the 2022 bear-market as the sky-high valuation levels in the hyper-growth cybersecurity companies (and ETFs ...) came back down to Earth. However, note that the sector is still relatively highly-valued:

As can be seen, despite a 20% hair-cut in P/E levels yoy, the current P/E of 41.4x is twice that of the S&P 500 ( 20.9x ).

The upside is that - as shown in the earnings run-down discussed earlier - many of these companies are growing revenue from 25-35% annually with highly-scalable SaaS-based platforms that get much more profitable as the number of customers using it grow. That being the case, and all things considered equal (but acknowledging they never are ...), a company that grows at a 15% CAGR should double every year. Many of the leading cybersecurity companies are growing at twice that rate and are also solidly free cash flow positive.

Summary & Conclusions

I still like this group because I am very bullish on the long-term potential of the leading cybersecurity platforms that the BUG has invested in. I myself am a bit underwater in my personal BUG shares, and while I acknowledge that the ETF is down 16.5% since my initial BUY coverage on Seeking Alpha in April of 2021 (see BUG: The Best Performing Cybersecurity ETF ), under-performing the S&P 500 by 10%+, I haven't sold my shares because I want long-term exposure to the cybersecurity sector. Yet BUG is certainly a relatively high risk/reward ETF that has provided very little in the way of distributions over the years and that likely won't change any time soon.

In today's relatively fragile market environment with so many known and unknown risks, this ETF is obviously not for the average investor that cannot handle market volatility. However, for an investor looking to allocate some capital to the "growth" category, the cybersecurity sector fits the bill as the leading companies continue on very attractive growth trajectories in spite of the macro-economic headwinds. In addition, I expect to see a wave of increased consolidation in the sector moving forward.

Of course the other option, as opposed to diversified ETF like BUG, is to simply pick a few of the leading companies - say Palo Alto, CrowdStrike, and/or Zscaler - and directly invest in them. Your risk goes up, but so too does the potential for increased returns.

I'll end with a 3-year total returns of the BUG ETF versus the broad market averages as represented by the Vanguard S&P 500 ETF ( VOO ) and the Nasdaq-100 ( QQQ ) and note that BUG has beaten both:

For further details see: