CIBR - CIBR ETF: Falling Short On Pure-Play Cybersecurity Exposure

Summary

• Cybersecurity is a secular growth industry that could grow 10x by 2030.
• The CIBR has 52% exposure to pure-play cybersecurity stocks.
• On a bottom-up analysis, the ETF has 22% EPS growth with a 42x PE and 1.6x PEG.
• The pure-play cybersecurity stocks have a better relative valuation at 1x PEG.

Summary

Cyber Security is a secular growth industry that, according to a McKinsey report, could increase by 10x to US$1.5 trillion by 2030. Thus, I looked at the largest ETF in the sector to gauge its potential and conducted a bottom-up analysis of its holdings. I found the First Trust Nasdaq CEA Cybersecurity ETF (CIBR) has about 52% of its holdings in pure Cybersecurity names such as Fortinet, Inc. (FTNT) and the rest in IT services and hardware.

CIBR looks attractive with EPS growth of 22% on a PE of 42x for 2023 and a PEG ratio of 1.6x (2022-2025). However, the pure cybersecurity stocks appear to be cheaper with a 1x PEG which begs the question, does this ETF provide the best selection to this sector? Since inception CIBR has underperformed the Nasdaq and many pure play stocks.

Holdings and Performance

The CIBR has 37 holdings with 52% in pure Cybersecurity stocks, followed by 22% in IT services and 15% in Hardware. The top 3 holdings Broadcom Inc. (AVGO), Infosys Limited (INFY) and Cisco Systems, Inc. (CSCO) derive a modest portion of revenue from cybersecurity and may not be ideal stocks for this fund. The ETF's allocation may be the reason behind the weak performance, it has underperformed the Nasdaq and pure cybersecurity stocks since its inception in July 2015.

Bottom-Up Analysis

To better gauge the ETFs potential I conducted a bottom-up analysis of 33 of the holdings representing 98% of the fund. Using consensus EPS estimates for 2022-2025 provided growth and relative valuation metrics that I then weighted to arrive at the portfolio average. Note that, when available, I used adjusted EPS, this usually adds back share-based compensation.

The analysis of the CIBR resulted in an attractive portfolio EPS growth of 22% in 2023 and 28% in 2024. However, the valuation is a bit rich at 42x PE with a PEG ratio of 1.6x. There are several large weighted stocks (Broadcom, Infosys and Cisco) with low growth and high valuation that impact the portfolio.

I then identified the pure play cybersecurity stocks (highlighted) and ran the same analysis. This group has greater EPS growth of 75% in 2023 but also a higher PE of 55x and PEG of 2.1x on an unweighted average. When adjusted for the current weights in the ETF the PEG falls substantially, suggesting that a more selective approach could result in lower valuations and greater returns but with higher volatility, in my view.

The PEG ratio is designed to compare a stock's PE vs its growth rate. In this analysis I took the average growth rate from 2022 to 2025 to provide a more longer-term valuation view. It is generally accepted that a ratio equal to 1x is fair value, higher maybe consider more expensive. This is a simple metric, a company's margins, cash flow, debt levels, execution track record along with other factors should also be used when selecting an individual stock.

Conclusion

The CIBR appears to fall short in providing exposure to cybersecurity sector with about 52% weight in pure cybersecurity companies. A bottom-up analysis of its holdings, using consensus estimates, found solid growth potential. However, the identified pure play cybersecurity names could provide better relative value long term.

For further details see: