In this new, periodic AAII column, we are going to cover key metrics to look at by analyzing stocks and exchange-traded funds (ETFs) in different industries. For this first article, we focus on the high-growth cybersecurity industry.

The global cybersecurity industry is currently valued at around $185 billion. The industry is projected to reach $500 billion by 2030, registering a compound annual growth rate (CAGR) of 12.0% from 2022 to 2030.

Cybersecurity can be described as the collective methods, technologies and processes to help protect the confidentiality, integrity and availability of computer systems, networks and data against unauthorized access and damage by attackers. The main purpose of cybersecurity is to protect all organizational assets from both external and internal threats as well as from disruptions caused by natural disasters. Given the rapidly evolving landscape and the ever-increasing adoption of security software across various sectors—including finance, government, military, retail, hospitals, education and energy to name a few—more and more sensitive information is becoming digitized and accessible through wireless and wired digital communication networks and across the omnipresent internet.

Cybersecurity is one of the greatest challenges facing public and private enterprises. Recent incidents such as the SolarWinds and Microsoft Exchange hacks led President Biden to sign a cybersecurity-related executive order to modernize the nation’s computer defenses and protect federal government networks.

Although many, but not all, cybersecurity companies are still unprofitable, they have experienced rapid growth in revenues. This is expected to continue as cybersecurity is becoming an increasingly important aspect of businesses and governments.

Key Cybersecurity Stock Fundamentals

When evaluating cybersecurity companies as investments, the main areas of focus are growth, earnings per share (EPS) revisions, value and quality. Each of these areas can be evaluated using a series of metrics. Growth is arguably the most important area of focus when evaluating cybersecurity stocks. Some common metrics used to evaluate growth include, but are not limited to, quarterly year-over-year operating cash flow growth, five-year operating cash flow growth rate and quarterly year-over-year sales growth.

Although earnings are often used to assess growth, the AAII Stock Evaluator breaks earnings revisions into its own category. Earnings strength is commonly evaluated by tracking previous earnings surprises and positive or negative revisions to estimated earnings.

Despite rising revenues over the past year, it is still important to take the valuations of cybersecurity stocks into account. Useful ratios include the five-year

estimated price-earnings-to-earnings-growth (PEG) ratio and the price-earnings (P/E) ratio. When assessing the quality of a stock, return on assets (ROA) and return on invested capital (ROIC) are commonly used. The return on assets indicates how profitable a company is in relation to its total assets. The higher the return on assets, the more efficient and productive a company is at managing its balance sheet to generate profits.

How Did We Select Cybersecurity Stocks to Analyze?

The stocks we evaluated for this column are Fortinet Inc. (FTNT), A10 Networks Inc. (ATEN) and Qualys Inc. (QLYS). We selected these companies first by looking at the top 20 common holdings across the three largest cybersecurity ETFs—Global X Cybersecurity (BUG), First Trust Nasdaq Cybersecurity (CIBR) and ETFMG Prime Cyber Security (HACK)—as determined by their assets under management (AUM). From there, we used a composite score of the stocks’ individual A+ Investor Value, Growth, Estimate Revisions and Quality Scores.

Fortinet Inc. (FTNT)

Fortinet is a cybersecurity vendor that sells products, support and services to small and midsize businesses, enterprises and government entities. Its products include unified threat management appliances, firewalls, network security and its security platform, Security Fabric. Services revenue is primarily from FortiGuard security subscriptions and FortiCare technical support. At the end of 2021, products were 38% of revenue and services were 62% of sales. The California-based company realizes revenue across the globe.

Fortinet is a strong growth stock, as indicated by its A+ Investor Growth Grade of B. The company has a strong five-year operating cash flow growth rate of 34.1%. This is more than five times higher than the sector median of 6.2%. Fortinet’s quarterly operating cash flow growth year over year is strong as well at 25.4%. Quarterly sales growth year over year is more than double the sector median at 34.4%. Overall, Fortinet significantly outperforms the industry average when analyzing growth metrics.

Fortinet reported a positive earnings surprise for first-quarter 2022 of 18.2%, and in the prior quarter reported a positive earnings surprise of 7.2%. Over the last month, the consensus earnings estimate for the second quarter of 2022 has decreased from $1.109 to $1.085 per share due to five upward and 18 downward revisions. Over the last three months, the consensus earnings estimate for full-year 2022 has remained the same at $5.107 per share.

The stock has a Value Grade of F, although almost all of the 20 cybersecurity stocks considered had a grade of D or F for value. Fortinet has a PEG ratio of 0.9, which is below the industry median of 1.3. When considering the price-earnings ratio, the stock again appears to be expensive at 75.3.

The company performs strongly in terms of its return on assets and return on invested capital. Fortinet has a return on assets of 11.0% and a return on invested capital of 26.5%. The industry average return on assets and return on invested capital are –2.8% and 19.6%, respectively. The stock’s Quality Grade is A.

Figure 1 provides a summary of key fundamental characteristics for Fortinet. It is from AAII’s Stock Evaluator, which can be accessed by all AAII members. Simply type a stock ticker into the search box located near the top of most pages on AAII.com.

A10 Networks Inc. (ATEN)

A10 Networks provides secure application solutions and services that give intelligently connected companies the ability to continuously improve cyber protection and digital responsiveness across dynamic information technology and network infrastructures. Its portfolio consists of six secure application solutions. Key revenue is generated from the Americas, with the rest coming from Europe, the Middle East and Africa, plus the Asia Pacific region.

A10 Networks is also a strong growth stock, with an A+ Investor Growth Grade of B. Quarterly sales growth is about average at 14.4%. The company has a strong five-year operating cash flow growth rate of 21.7%, well above the sector median. A10 Networks’ quarterly year-over-year growth in operating cash flow is incredibly strong at 599.9%.

A10 Networks reported a positive earnings surprise for first-quarter 2022 of 23.8%; in the prior quarter, it reported a positive earnings surprise of 15.6%. Over the last month, the consensus earnings estimate for the second quarter of 2022 has remained the same at $0.159 per share despite two upward revisions. Over the last three months, the consensus earnings estimate for full-year 2022 has increased from $0.678 to $0.683 per share, based on two upward revisions.

The stock has a Value Grade of D, which is considered expensive. A10 Networks has a PEG ratio of 0.3, which is well below the industry median. The relatively low price-earnings ratio of 11.8 could indicate value; however, the price-to-book ratio of 5.88 is nearly double the industry median. The company has a very strong return on assets of 27.7% and a return on invested capital that is about average at 21.5%.

Qualys Inc. (QLYS)

Qualys is a provider of cloud-based security and compliance solutions to enterprises, government entities and small and medium-sized businesses. The firm’s solutions are delivered through its cloud platform and provide security intelligence by automating the life cycle of information technology (IT) asset discovery, security assessment and compliance management. Its solutions enable customers to collect and analyze large amounts of IT security data. The company’s cloud platform discovers and prioritizes vulnerabilities and recommends actions. The company derives revenue from subscriptions to its cloud-based solutions, typically on an annual basis. A large majority of the firm’s revenue is generated in the U.S.

Qualys continues the trend of strong growth stocks with an A+ Investor Growth Grade of B. The company has a strong five-year operating cash flow growth rate of 23.7%, nearly four times the industry median. Qualys’ quarterly operating cash flow growth is strong as well at 36.6% year over year. Quarterly sales growth is about average at 17.1%. While still a strong growth stock, Qualys doesn’t appear quite as robust as Fortinet or A10 Networks.

Qualys reported a positive earnings surprise for first-quarter 2022 of 11.7%. In the prior quarter, it reported a positive earnings surprise of 5.5%. Over the last month, the consensus earnings estimate for the second quarter of 2022 has increased from $0.711 per share to $0.793 per share based on 12 upward revisions. Over the last three months, the consensus earnings estimate for full-year 2022 has remained the same at $3.149 despite 11 upward revisions.

Qualys is an ultra-expensive value stock with an A+ Investor Value Grade of F. The stock’s PEG ratio is 1.8 and is above the industry median. Qualys’ price-earnings ratio is nearly twice the industry median at 52.0. The company performs strongly in terms of its return on assets (12.3%) and return on invested capital (35.6%). Overall, Qualys has a very strong Quality Grade of A.

Cybersecurity ETFs

ETFs are an option for investors who want exposure to cybersecurity stocks but are looking to diversify their holdings instead of investing in one or two stocks. ETFs also don’t have rear-end loads or other restrictions on selling like some sector- and industry-based mutual funds can have.

When looking at ETFs, there are a number of metrics to pay attention to. Size as measured by AUM is one, because if an ETF fails to attract enough interest, it may be shuttered. Expense ratios for industry-specific ETFs are often higher than they are for broad market funds but they should never be excessively high. The ETFs highlighted here—Global X Cybersecurity, First Trust Nasdaq Cybersecurity and ETFMG Prime Cyber Security—were selected based on their AUM (Table 1).

Global X Cybersecurity ETF (BUG)

Global X Cybersecurity was launched in 2019. The ETF seeks to provide investment results that correspond generally to the price and yield performance, before fees and expenses, of the Indxx Cybersecurity index. The fund invests at least 80% of its total assets in the securities of the underlying index, which can include American depositary receipts (ADRs)—stocks of foreign companies that trade on U.S. exchanges—and global depositary receipts (GDRs)—stocks of foreign companies that trade primarily on European exchanges. The underlying index is designed to provide exposure to exchange-listed companies that are positioned to benefit from the increased adoption of cybersecurity technology. The fund is non-diversified.

Global X Cybersecurity has total assets of $1.16 billion, making it the smallest ETF in the top three, but still sizable. It has an expense ratio of 0.50% which is below the category average of 0.56%. Being a relatively new ETF, it lacks a return track record for three years or longer. In its first full year, 2020, the ETF realized a 71.2% return, and the return in 2021 was 13.7%. But thus far in 2022, it is posting a negative return.

First Trust Nasdaq Cybersecurity ETF (CIBR)

First Trust Nasdaq Cybersecurity was launched in 2015. The fund tracks the Nasdaq CTA Cybersecurity index. The index includes securities of companies classified as cybersecurity companies by the Consumer Technology Association (CTA). The ETF is non-diversified.

First Trust Nasdaq Cybersecurity is the largest cybersecurity ETF we evaluated with AUM of $5.32 billion. The expense ratio of 0.60% is slightly higher than the category average but still low enough to warrant an A+ Investor Grade of C. It has realized a three-year annualized return of 17.3% and a five-year annualized return of 15.1%. This translates to an A+ Investor grade of C for both periods. The fund’s total returns were positive each year from 2018 through 2021, with 2020 being the high point at 50.4%. Through May 2022, it has had a total return of –19.1% for 2022.

ETFMG Prime Cyber Security ETF (HACK)

ETFMG Prime Cyber Security was launched in 2014. The fund’s primary benchmark is the Prime Cyber Defense NR USD index. This index tracks the performance of the exchange-listed stocks of companies across the globe that engage in providing cyber defense applications or services as a vital component of their overall business or provide hardware or software for cyber defense activities as a vital component of their overall business. The fund invests at least 80% of its total assets in the component securities of the index and in ADRs and GDRs based on the component securities in the index.

ETFMG Prime Cyber Security is the oldest of the three ETFs and has AUM of $1.68 billion. The expense ratio is the same as First Trust Nasdaq Cybersecurity at 0.60%. ETFMG Prime Cyber Security realized a three-year

annualized return of 8.6% and a five-year annualized return of 10.1%. These returns were ranked in the second-lowest quintile for the technology category, hence the A+ Investor grade of D for both periods. ETFMG Prime Cyber Security, like the two other ETFs, does not have a 10-year grade. Total returns each year followed a similar trend to that of First Trust Nasdaq Cybersecurity, peaking in 2020 with a return of 40.8%. Thus far in 2022, it has a total return of –22.2%.

Conclusion

The cybersecurity industry is growing rapidly and is expected to nearly triple in size by 2030. In the new digital age, it is becoming an ever-important aspect of both business and government. Investors desiring such companies have options, with a variety of cybersecurity stocks and ETFs to choose from. In doing so, investors should realize that they may have to “pay up” for growth through higher valuations in cybersecurity stocks and accept shorter return histories for cybersecurity ETFs. 

Related

Feature

The Individual Investor’s Guide to the Top ETFs 2022

Related

AAII How-To

Consider Earnings Estimate Surprises and Revisions

Related

Financial Statements

Valuation Ratios: The PEG Ratio