FTNT - CIBR: Enterprises Are Not Prioritizing Cybersecurity

Summary

• As the world becomes more digital with more devices and deeper engagement with the internet via AR/VR, cybersecurity becomes more important.
• Cybercrime is a growing risk in a post-COVID world.
• Many enterprises are still deferring cybersecurity investment.
• Valuations are expensive; 26% premium to S&P 500.
• Technical analysis suggests a lack of a bullish trigger.

Introduction

With the rise of digital transformation, proliferation of IoT devices, and deeper internet engagement via new developments such as virtual/augmented reality, cybersecurity rises in importance to fend off the attempts of hackers. To play this view, I have my eye on the First Trust Nasdaq Cybersecurity ETF (CIBR).

My current stance on CIBR is neutral as I wait for more traction in enterprise adoption of cybersecurity solutions, more attractive valuations and bullish technicals.

CIBR ETF Exposure Mix

Sector Mix

81.3% of CIBR's exposure is geared towards software, IT Services and telecommunications equipment. SaaS trends in software make technology spending a running opex cost instead of a large one-time capex cost. This may be improving the consistency quality of revenues for the ETF.

Top 5 Holdings

CIBR's top 5 holdings include Broadcom ( AVGO ), Cisco ( CSCO ), Infosys ( INFY ), Fortinet ( FTNT ) and Palo Alto Networks ( PANW ).

The top 5 holdings make up 29.4% of the overall weight, which represents quite a well-diversified exposure. Moreover, there is no outsized weight in any stock. Together, these factors reduce the diversifiable risk in the portfolio. This makes the ETF a more effective tool to bet on the overall cybersecurity trend whilst limiting idiosyncratic risk associated with any specific company.

Long-Term Tailwinds But Delayed Adoption, High Valuations

I recognize powerful cybersecurity trend tailwinds, but adoption momentum and valuations suggest a neutral view:

1. Cybercrime is a growing risk in a post-COVID world
2. Many enterprises are still deferring cybersecurity investment
3. Valuations are expensive; 26% premium to S&P 500

Cybercrime is a growing risk in a post-COVID world

Since 2005, there has been a 15% CAGR in the instances of data compromises in the United States. The post-COVID digitalization trend has come with accelerated cyber risks. For instance, in 2021 and 2022 (expected), data breaches have had a step jump up compared to prior levels.

Post COVID, the average cost of data breaches worldwide has also risen at an accelerated pace of 6.2% CAGR.

The growing cybercrime risk, both at a frequency and impact level, increases the need for cybersecurity solutions, thus building up demand potential for companies in the CIBR ETF.

Many enterprises are still deferring cybersecurity investment

The data above is based on a survey of 3,602 business, technology and security executives.

Although the need for cybersecurity solutions is increasing, a large portion of companies are still deferring various categories of investment in cybersecurity technologies.

This may delay ramp-up of top-line growth for the overall CIBR ETF.

Valuations are expensive; 26% premium to S&P 500

On December 30 2022, CIBR was trading at a PE of 25.9x . On this date, CIBR's closing price was $38.71, implying an EPS of $1.26. Since then till 21 Jan 2023, there have been few quarterly results for the December quarter end. Hence, I believe it is a reasonable proxy to take the current CIBR price of $39.03 and assume the same level of earnings to arrive at a current PE. This comes out to be 26.1x.

For context, the S&P 500 ( SPY ) ( SPX ) is currently trading at a PE of 20.7x . Hence, CIBR is trading at a 26.4% premium to the S&P500. Given the macro-environment and the fact that the growth oriented nature of CIBR implies long-duration cash flows, which do worse in a rising rate environment, I deem CIBR to be too expensive.

Technical Analysis

If this is your first time reading a Hunting Alpha article using technical analysis, you may want to read this post , which explains how and why I read the charts the way I do, utilizing the principles of Flow, Location, and Trap

Relative Read of CIBR vs S&P 500

The relative chart of CIBR vs the S&P 500 shows the ratio price printing a reaction near the support zone. However, I do not see any no evidence of a false breakdown or a bearish trap yet. I would be more inclined to have an actionable bullish view if the highlighted expected price move plays out, as higher highs and higher lows would confirm a reversal in the incumbent downward trend.

Standalone Read of CIBR

A similar story applies to the chart of CIBR; price is showing some reactions at the support level, but there is no sign of a false breakout down to trap the sellers just yet. I would be more inclined to have a bullish view after this occurs.

Conclusion

There is no doubt that cybersecurity is a mega growth theme in modern times. However, experience has taught me that investing purely on mega growth themes can be a recipe for disaster. Near-term executions matter. Valuations matter. And I belong to the school of market philosophies that say timing also is possible and does matter.

Evidence suggests to me that despite growing cybersecurity risks, companies are not yet prioritizing cybersecurity trends. Unlike core digital transformation deals , which enterprises are deferring, surveys of security initiatives indicate that cybersecurity investments are being postponed. Based on this and high valuations, I believe CIBR is not yet a buy. Technical analysis also points towards a lack of a reliable buy trigger. Hence, my stance on CIBR is a 'hold'.

For further details see: