What’s the hype about cyber security stocks?

TL;DR

• The recent OCBC phishing scam and cyber-attacks during the Ukraine Crisis have put a spotlight on cyber-security companies.
• Global cybersecurity spending is expected to grow significantly as more individuals and organisations try to protect themselves from cyber attacks.
• Investors looking at cybersecurity companies should ensure that these firms have proven products with positive user feedback.
• Another key metric to track is annual recurring revenue, as the subscription revenue earned would demonstrate the strength of the company’s business model.

What happened?

Since the pandemic hit in 2020, companies have shifted their operations online as workers began to work-from-home. Data is mostly hosted on internal servers or cloud networks and accessed via physical devices (endpoints), which are vulnerable and susceptible to cyber-attacks. 

The Ukraine crisis brought cybersecurity into the spotlight when cyber-attacks were observed to increase over 800% 48 hours when the conflict first broke out. Ukraine was hit by a series of cyber-attacks which its government said were “on a completely different level”. This has highlighted one of the structural shifts that has emerged out of the Ukraine crisis.

Closer to home, the recent OCBC phishing scam saw S$8.5 million of funds being lost. According to authorities, victims received unsolicited SMSes claiming that there were issues with their banking accounts and were redirected to fake bank websites to key in their iBanking account login details. Many fell for the scam as the hacker was able to send the SMS via the usual OCBC SMS channel.

What does this mean?

With increasing digitalisation, cyber security has become more important today. Successful cyber attacks can lead to loss of data, stolen money, loss in consumers’ confidence and theft of intellectual property. 

According to a study by Cybersecurity Ventures, global cybercrime costs are expected to grow by 15% per annum for the period 2020-2025 and reach US$10.5 trillion annually by 2025. Mirroring this trend, global cybersecurity spending has also increased as companies search for ways to protect themselves from cyber attacks.

What should investors look out for?

To benefit from this trend, Beansprout will look for cyber security companies with proven track records and good user reviews, and have established business models driven by strong recurring revenue.

a) Look for companies with a good product

The core of every cybersecurity company is its product. A good product will generate healthy demand and a steady stream of revenue. In this regard, we should focus on companies which have products that are tested and proven. 

Revisit recent high-profile cyber attacks and search for cybersecurity companies which were successful in preventing the attacks. For example, in the wake of the 2019 Solarwinds hack, Crowdstrike and FireEye were the few companies who managed to identify and stop the cyberattacks. These incidents can be used as a signal about the quality of product the company offers. 

b) Analyse user feedback on the product

Gather second opinions on the product’s quality by browsing online forums for users’ feedback. Users who have used the product will be in the best position to highlight the pros and cons of the product. Beware of biased comments and paid advertisements!

Source: Gartner

c) Look for companies with high recurring revenue

A cybersecurity company earns its revenue based on a subscription-based model where each customer pays a yearly subscription fee, on top of any add-ons or upgrades they may purchase along the year. 

Annual Recurring Revenue (ARR) shows how much recurring revenue a company gets based on yearly subscriptions. It reflects on the level of customer’s demand and confidence in the company’s products. Companies that are worth investing into have typically high growth rates in ARR. While there is no “magic number” to look at, investors should expect a healthy upward trend in both ARR numbers. 

What would Beansprout do?

To summarize, cybersecurity companies could benefit from the trend towards increasing digitisation and focus on safeguarding data. Beansprout will look for cyber security companies with proven track records and good user reviews, and have established business models driven by strong recurring revenue.