🔐 Cybersecurity in 2025: Higher Stakes, Bigger Opportunity

Quote of the Week: “ There are only two types of companies in the world: those that have been breached and know it and those that have been breached and don’t know it.” – Ted Schlein

Last week, we covered DeepSeek’s R1 model, which has caused investors to reconsider their narratives around AI.

While it may not seem like it originally, this development is relevant to cybersecurity for several reasons:

• Cybersecurity is viewed as the more defensive industry within the broader tech sector. It’s hard to imagine cybersecurity being high up on the list when IT budgets get cut. So it wasn’t surprising to see cybersecurity stocks outperforming the tech sector over the last two weeks.
• OpenAI said there were indications that DeepSeek made unauthorized use of OpenAI’s data output . This might involve a breach of the T&Cs rather than actual IP theft - but it still raises the issue of protecting the billions of dollars that go into creating an LLM.
• DeepSeek’s open-source model and smartphone app have been downloaded by millions of people around the world. While open-source models provide more transparency than their closed-source counterparts, the apps built on top of those models are typically closed source and rely on sending user prompts to external servers for processing. Even if the app provider has no malicious intent, sensitive user data can be leaked due to compromised servers or vulnerabilities in the app itself.

With that in mind, it feels like a good time to discuss why the increasingly vulnerable and complicated digital landscape increases the opportunity for cybersecurity businesses. Plus, we’ll discuss ways to get exposure to this structural theme.

If you’d like to read a more general overview of the industry first, check out our previous post on the topic.

🎧 Would you prefer to listen to these insights? You can find the audio version on our Spotify, Apple Podcasts or YouTube!

What Happened in Markets this Week?

Here’s a quick summary of what’s been going on:

💸 Magnificent Seven’s Slowing Growth Threatens S&P 500 Rally ( Bloomberg )

• What’s our take?
• It's time the other 493 companies did some heavy lifting.
• The largest seven companies in the index have accounted for more than 50% of gains over the last two years, although their earnings growth has been falling since Q4 2023. That’s due to the high bar set in ‘23, and the increase in spending over the last 12 months.
• Rotation into other companies and sectors would be healthy for the market, and reduce the concentration risk. Donald Trump’s policy agenda is expected to also favor other sectors and companies with more local US exposure.

✂️ Vanguard’s Record Fee Cut Puts Rivals BlackRock, Invesco in Tough Spot ( Bloomberg )

• What’s our take?
• ETF fees are now a small rounding error.
• Before ETFs became the investment vehicle of choice, mutual fund management fees were typically 1.5% or more - sometimes a lot more. Now ETF providers are engaged in a price war, and Vanguard has cut its fees to an ‘asset-weighted expense ratio to just 0.07% across its $10 trillion under management’. Great news for investors, bad news for Vanguard’s competitors.
• The difference between a management fee of 1.5% or 0.25% makes a huge difference to returns over a 20-year period. Below 0.25%, fees matter, but there are lots of other things to consider, including the commission you’re paying to your broker to buy the ETF and the index being tracked.

🛢️ Saudi Aramco Boosts Oil Prices to Asia as Mideast Crude Soars ( Bloomberg )

• What’s our take?
• Crude prices around the world could diverge substantially.
• Asian demand for crude from the Middle East is rising due to new sanctions on Russian exports, while the US is trying to 'drive Iran’s oil exports to zero’.
• Meanwhile, oil inventories in the US rose unexpectedly, causing the price of West Texas crude to drop 2%.
• The different types of oil produced in different parts of the world have always traded at different prices, but arbitrage opportunities kept them somewhat correlated. If the market continues to ‘de-globalize’ there will be more divergence between prices in different regions, and more volatility if supply shocks occur.

🇩🇪 Tesla Sales Plunge 59% in Germany to Lowest Level in Years ( Yahoo )

• What’s our take?
• Tesla are quickly losing their footing in key EV markets.
• Tesla’s sales plunged 59% in Germany last month, marking their lowest monthly total since mid-2021, even though Germany’s overall EV market jumped 54%.
• Observers point to Elon Musk’s recent support of Germany’s far-right AfD party, deeply unpopular in a country sensitive about its past, as a contributing factor damaging Tesla’s reputation.
• The drop also extended to France (down 63%) and the UK (down 12%), Europe’s other major EV markets, suggesting Musk’s political stances and competitive pressures may be hitting Tesla’s wider regional sales.
• Beyond politics, Tesla faces additional difficulties. Production of its biggest seller, the Model Y, has slowed due to a change in production facility, inventory shortages, and intensifying competition from established automakers racing to meet tougher EU emission rules have all weighed on Tesla as it gets off to a slow start in 2025.

💡 ArkInvest releases its annual Big Ideas 2025 research report ( ArkInvest )

• What’s our take?
• Innovation drives progress, and exponential growth is hard to estimate.
• ArkInvest sees public blockchains, multiomics, AI, robotics, and energy storage as the key drivers of accelerated growth over the next decade.
• Their overarching message is that convergence among these platforms will compound innovation, unleashing profound economic shifts and market opportunities. 
• Their reports are always an interesting read, full of in-depth research in spaces that are on the cutting edge of innovation. It’s always hard to quantity things when the results could be exponential, so keep that in mind when reading the forecasts. For those who agree with the research and want exposure, they have thematic ETFs that invest according to their research. 

🏅 Gold Dealers Sell BOE Bullion at big discounts in Tariff Turmoil ( Bloomberg )

• What’s our take?
• Talks of tariffs have sparked a modern day gold rush.
• Gold stored at the Bank of England is suddenly trading at a rare discount to the broader London market, as traders scramble to get metal shipped and re-refined for delivery to the US before potential tariffs.
• Long queues have formed to withdraw gold from the BOE vault, which isn’t equipped for rapid handling on a commercial scale. This has made BOE bullion less attractive compared with gold held in private vaults.
• The rush to move gold to the US has driven up lease rates and even created “backwardation” in the market, an unusual phenomenon where near-term gold prices are higher than later-dated contracts.
• Trump’s threat of blanket tariffs, even though precious metals aren’t explicitly targeted yet, has put traders on edge and spurred them to secure gold that’s easy to ship.

🔐 Cybersecurity In 2025

Artificial intelligence and automation seem to be reaching a tipping point, moving from experimental, to wide scale deployment.

This is making the role of CISOs (chief information security officers) and cybersecurity providers as important as ever.

✨ Cyberattacks aren’t just expensive for companies. They can ruin a company’s reputation, and erode its competitive edge. They can also jeopardize a country’s communication networks, financial systems and national security.

Financial gain is still the primary reason for cyberattacks, but over 20% have broader goals.

With the wide scale deployment of AI and automation, the battlefield is getting increasingly complicated.

🤖 The Impact of AI and Automation on Cybersecurity

AI has been a weapon on both sides of the cybercrime battle for a while, but the rapid evolution of generative AI has increased the stakes for both sides:

• 🥸 Gen AI can be used in increasingly convincing phishing attacks by mimicking a person’s voice, speaking and writing style, and even using video.
• 🔢 In the world of AI, data is the most valuable commodity. Protecting it is crucial for any company hoping to leverage AI to build a competitive advantage. The same goes for the massive investments that go into AI models and applications.
• 🎯 AI can and is being used to rapidly find and exploit vulnerabilities.
• 🌪️ Speedy AI deployments can lead to oversights. The race to build and deploy AI tools to customers introduces new vulnerabilities for companies, and probably for individuals using those tools too.

At the same time, cybersecurity companies are using AI to detect vulnerabilities and weak points within organizations - which requires ongoing investment and planning.

A survey by Omdia in May 2024 showed that 72% of cybersecurity organizations surveyed were either implementing or trialling the technology in their business already.

As our world gets increasingly connected, there are security consequences that arise.

🌆 The Expanding Attack Surface

Every device and machine connected to the internet or a network is a potential entry point for cyberattacks.

This includes electric vehicles and, particularly, autonomous vehicles and robotaxis which are now becoming a reality.

Autonomous robots, machinery and equipment are another potential entry point for cyberattacks. As supply chains become more integrated, the consequences of access to one device increase.

⛓️ Third-party Risks And Single Points Of Failure

Companies and individuals use a growing list of apps daily.

Many of these apps also rely on others. That means a breach at one company can have far-reaching consequences.

Even if the attackers don’t manage to access other networks, critical systems can be offline for weeks or months. A ransomware attack on CDK Global in 2024, meant 15,000 car dealerships couldn’t process deals for two weeks.

The largest outage in history also occurred last year when CrowdStrike distributed a faulty update. This was a reminder of the potential risk of a single point of failure.

🌽 Harvest Now, Decrypt Later

Quantum computers have not reached the point where they can crack encrypted data, and it may be a while before they do. But, encrypted data stolen today could be decrypted if or when the technology reaches that stage.

In other words, encrypted data still needs to be stored and transmitted securely.

⚠️ Others Challenges Are Opportunities For Cybersecurity Businesses

AI, connected devices and third party software are increasing the potential for attacks. At the same time, companies are facing several other cybersecurity related challenges.

• 🌏 Geo-politics: The polarization of global alliance has increased the incentive for state sponsored cyberattacks. These attacks don’t only target national infrastructure, but key companies like telecom networks, utilities, and financial institutions.

• 🏛️ Regulations: Governments worldwide are implementing regulations to mitigate the risks that cyberattacks can have on a country. Companies have to demonstrate compliance and face serious fines for data breaches.

• 🧑‍💻 Skills shortage: Companies are struggling to find skilled cybersecurity professionals, and are often forced to outsource more than they might want to.

🔐 What Does All This Mean For Cybersecurity Companies?

What is a huge challenge for some, is a huge opportunity for others. Because of all these growing risks that need to be managed, cybersecurity stocks have a huge industry tailwind behind them.

Global cybersecurity spend is estimated to increase from about $245 billion in 2024 to $500 billion in 2030. That’s an annual growth rate of around 12.9%.

✨ The companies competing for that spend need to make sure they meet the ever-growing needs of companies and individuals in an increasingly connected and data-vulnerable world.

It seems there are 2 trends that are occurring within the cybersecurity industry’s offerings.

1️⃣ Platformization and unified solutions: In the past, companies added new solutions to their arsenal as new threats emerged. But cybersecurity has now become too complex to keep track of numerous applications. Plus, companies were hitting limitations when trying to integrate these various security tools.

✨ Companies are now looking for a centralized platform to manage security across entire organizations, which is well integrated, and generates the best possible ROI on their cybersecurity budget.

Companies like Palo Alto Networks and Fortinet have been aggressively adding to the solutions they offer, and unifying those solutions on a single platform.

Cisco Systems is also growing its portfolio of cybersecurity solutions which are integrated on its SecureX platform.

While companies aim to consolidate their cybersecurity solutions, several companies are highly regarded when it comes to specific threats:

• CrowdStrike is the leader in cloud security and AI powered real-time threat detection
• SentinelOne also uses AI to identify and mitigate threats.
• Zscaler is a leader in zero trust access control, which assumes no user can be trusted by default.
• Check Point Software offers solutions for securing software supply chains.
• Cloudflare is a leader in content delivery, and in securing edge computing.
• Synopsys provides tools to help companies identify and mitigate vulnerabilities in their code and third-party libraries.
• Okta and CyberArk are leading providers of identity and access management solutions.

Ultimately, there may be some consolidation amongst all the companies.

2️⃣ Services are just as important as products: The skill shortage means that many companies need help implementing and managing their cybersecurity solutions. But given the staff shortages, demand is outweighing supply.

Managed security services, consulting and support are currently growing faster than cybersecurity products.

💰 Investing in Cybersecurity Stocks

Cybersecurity stocks seem to be perpetually expensive, or at least priced for a lot of growth. Prices also spike whenever there’s a major cyberattack, but that’s definitely not the best time to be investing.

Here are a few things to consider when assessing these companies:

• 🏢 Size probably matters: Larger companies are just better resourced, which makes a difference in highly competitive markets. Customers probably feel more secure allocating budget to larger companies, particularly if they provide a range of services. Smaller companies may be able to carve out a niche - but the risks are likely to be higher.

• 💸 R&D spend is essential: For cybersecurity companies to stay ahead of the curve, they need to keep investing in research and development to stay ahead of the curve. Again, this is where size is an advantage.

• 🏰 Buy quality when the near term outlook is weak: Like many companies, cybersecurity companies have cycles as each new product is adopted, and then as demand matures. Expenses often turn out to be higher than anticipated, which causes margins to fall from time to time. Analysts are expecting exactly that to happen to Palo Alto Networks in the next year, thought it’s free cash flow is expected to do fine. These periods can provide opportunities to invest in well managed companies.

• 💵 Net dollar retention and gross margins: Gross margins and the ability to keep or increase revenue from each customer are an indication of a company’s competitive position.

💡 The Insight: The Cybersecurity Opportunity Is Broader Than You Think

Believe it or not, a massive amount of cybersecurity spend goes to companies that don’t necessarily specialize in cybersecurity.

Microsoft in particular is a leader in the industry, without it being the primary focus. The same applies to Alphabet and other large tech companies.

As mentioned, services makes up a big chunk of cybersecurity spend, too.

This is where IT services companies and consulting firms like IBM and Accenture come in. They don’t earn as much subscription revenue, but that can actually lead to them being overlooked.

Companies that supply networking equipment are also in a position to bundle security solutions with that hardware. We mentioned CISCO already, but Broadcom is another company with a substantial cybersecurity offering.

For other hardware and software companies, security is both a value add service and something essential. One of Apple’s best attributes is its reputation for security.

The same goes for any company handling customer data; the list is long, but Salesforce, Snowflake and UIPath are a few that come to mind. These companies won’t last long if they can’t protect data, and building a reputation for security is one way to build an edge.

So here’s some useful next steps:

1. Review the company report of stocks mentioned in this piece to see if you like the fundamentals, like CRWD.
2. Add any of those stocks that take your fancy to a “Cybersecurity” watchlist.
3. Read some of the narratives on those stocks to gain insights from the community.
4. Then, for any narrative you agree with, set it as your Fair Value on the right-hand side, above the valuator.

After you’ve done that, simply monitor that watchlist and keep an eye on your “ Weekly Portfolio Update ” email to see when stocks on that watchlist are trading above or below your Fair Value estimate.

Key Events During the Next Week

After a few eventful weeks of data releases and earnings, it’s a quieter week.

Tuesday

• 🇦🇺 Australia’s Westpac Confidence index will be published. The index has fallen in the past two months.

Wednesday

• 🇺🇸 US consumer inflation data will be published. CPI is expected to remain at 2.9%, while the core rate is forecast to fall from 3.2% to 3.1%.
• 🇺🇸 US Fed Chair Jerome Powell will be testifying before Congress.

Thursday

• 🇬🇧 UK preliminary GDP data will be published. Fourth quarter GDP is forecast to be 1% higher over 12-months, compared to 0.9% in the third quarter
• 🇺🇸 US producer price inflation is expected to be 0.3% over the last year, up from 0.2% in December.

Friday

• 🇪🇺 EU GDP data will be published. This is the second estimate for Q4 GDP growth. Economists expect the estimate to match the 0% first estimate.
• 🇺🇸 US retail sales are forecast to have increased 0.3% between December and January, down from 0.4% during the previous month.

Earnings season continues with companies from all sectors reporting. The big names include:

• Coca-Cola
• Cisco
• McDonald’s
• S&P Global
• Shopify
• Applied Materials
• Deere

Have feedback on this article? Concerned about the content? Get in touch with us directly. Alternatively, email editorial-team@simplywallst.com

Simply Wall St analyst Richard Bowman and Simply Wall St have no position in any of the companies mentioned. This article is general in nature. Any comments below from SWS employees are their opinions only, should not be taken as financial advice and may not represent the views of Simply Wall St. Unless otherwise advised, SWS employees providing commentary do not own a position in any company mentioned in the article or in their comments.We provide analysis based on historical data and analyst forecasts only using an unbiased methodology and our articles are not intended to be financial advice. It does not constitute a recommendation to buy or sell any stock and does not take account of your objectives, or your financial situation. We aim to bring you long-term focused analysis driven by fundamental data. Note that our analysis may not factor in the latest price-sensitive company announcements or qualitative material.