CIBR - CIBR Is The Last To Go Positioned Secularly

Summary

• With markets still being a little too expensive as rates rise, you have to find rare areas where earnings growth is possible.
• Besides the technological angle, there's a regulatory angle to cybersecurity that investors might consider.
• The issue is that valuations are high considering where rates are going. It's a technical valuation problem.

The First Trust Nasdaq CEA Cybersecurity ETF ( CIBR ) is a way to get exposure to cybersecurity with a pretty narrow portfolio of US cybersecurity exposures. While we have a pretty negative view generally on markets, we do see some advantages in cybersecurity over other securities that you might buy in the market. Earnings growth in 'cybersec' is possible for several pretty high probability reasons. Nonetheless, equities as a whole need to adjust to the possibility that rates go substantially higher than they currently are. As such, we don't feel particularly compelled to move here.

Thinking About Cybersecurity Stocks

Right now, it is hard to justify the tall multiples that you still see in tech. The primary issue is that generally in equities, there is the issue that earnings growth may be difficult to achieve for a while, and if it isn't achieved there is a clear issue with valuations which have earnings yields that barely stay ahead of the rising reference rates. In fact, in tech, the earnings yields are often below 6% where we believe risk-free reference rates are going to have to go before the labor market loosens a bit and inflation comes down as per the Fed agenda. We think investors who are speculating that a market tantrum may change the Fed's mind are rather foolish and taking a very risky and binary bet, that is highly probably to move towards higher rates, likely longer term as the sources of the inflation are cost-push.

We think that when a recession comes that earnings growth, which is already peaking now, is going to be near impossible for the average company. So the only stocks that have a chance to justify their current valuations right now are those that can offer reliable earnings growth. Cybersec would be one of the segments that could accomplish this. We think there are several broad reasons for this:

1. Data protection regulation is becoming more severe. In Europe, GDPR laws are far-reaching and put very high standards on companies and if broken incur massive fines, even for small businesses. Those laws will become increasingly enforced as the efforts are stepped up by the EU. Even in the US which is relatively lax , sectors that have particularly high-security requirements are subjected to occasional fines that proper consulting and cybersec investing would avoid. Other geographies are also very serious about corporate data protection standards, including China but also some emerging markets . At any rate, the GDPR is extremely comprehensive and severe, so any company operating in Europe, or actually any company that manages data of European residents, has to consider GDPR, including meeting technical standards as covered by ISO and other standards associations.
2. Cybersec benefits from the fact that it is still relatively low in terms of overall IT budget penetration . In general, the feeling is that for something as vital, and indeed as beneficial as cybersecurity investments, is a relatively small part of the cost center.
3. Overall secular growth in data science helps cybersec as well, since smaller businesses, especially during COVID, have had to digitalize and as a result are now in possession of customer data or other data that needs to be kept from hackers. Since managing data will be an essential return lever for companies going forward, digitalization remains a force that supports cybersecurity investment.

Remarks on CIBR

CIBR's top holdings include the following.

With only 37 stocks in total, this is a good portion of their investments. A lot of these stocks are effectively cloud stocks, but those focusing specifically on security issues in cloud combination and migration. Other stocks are more dedicated cybersecurity solutions and consulting companies.

The ETF trades basically at NAV, so there's no comment there, but we have an issue with valuations. Using Seeking Alpha's Factor Grades , we get some useful information to get a clue on valuation. We use Palo Alto Networks ( PANW ) as the benchmark for the stocks in this ETF as it is a comprehensive and well-established cybersecurity business.

Using FCF margin as a broader figure to find the yield on a portfolio like this, we can apply it to the P/S ratio of 4.2x for the ETF to get an idea of valuation relative to rising rates. With an FCF margin at around 8%, the P/FCF ends up being 52x, which implies a 2% FCF yield.

Of course, the idea is that FCF can grow in cybersec and the FCF margin for the sector seems to be a little higher for cybersec than general IT. On a no-growth basis and adjusting for higher than average figures presented by PANW and some of the other cybersec players, the FCF yields don't get much better than 3%, at best 4%. Compared to current rates which are already at 4%, and are likely going to 6% on risk-free instruments, it's not fantastic. This is assuming no growth, of course. Downside is protected in cybersec in our opinion, certainly with respect to European data due to GDPR, and also because of recurring revenue. Growth is likely to also benefit from penetration effects, even if overall IT spend falls. On balance, the valuation isn't terrible, but perhaps 10% FCF growth forecasts on a 4% yield against the 6% for risk-free instruments that we might come to isn't really enough. It's not super compelling at the moment, given the direction of rates and markets.

For further details see: