Theme basket review: Cyber security consolidation at full speed Theme basket review: Cyber security consolidation at full speed Theme basket review: Cyber security consolidation at full speed

Theme basket review: Cyber security consolidation at full speed

Equities 5 minutes to read
Peter Garnry

Head of Equity Strategy

Summary:  Russia's decision to invade Ukraine has created tailwinds for cyber security stocks on top of those that were already structurally in place as the number of cyber-attacks have increased dramatically forcing companies and government to increase their cyber security defence. In our annual review of our basket we have replaced four stocks due to number of acquisitions as the industry consolidating fast these years.

Cyber security is rising on Russia’s invasion of Ukraine

Our cyber security theme basket is up 7.5% in February driven by a whopping 3.7% gain yesterday as investors are rotating into equities that provide upside or hedging capabilities in an inflationary environment with added geopolitical risks. The industry was already accelerating in terms of growth before the invasion of Ukraine with the median revenue growth in the basket being 20.2% y/y with the median operating margin at -6.7% over the past 12 months. This is still an industry that is growing fast and prioritizing growth over profitability.

Since the invasion of Ukraine companies and governments have increased their spending on cyber security to be prepared for any cyber-attack. According to this Forbes article, the number of Russian-sourced cyber-attacks increased 800% in the immediate 48 hours after the invasion started, and key government infrastructure in the US has been put on high alert.

NameMarket Cap (USD mn.)Sales growth (%)Operating margin (%)Diff to PT (%)5Y return %
Palo Alto Networks Inc58,52428.4-6.74.6410.1
Fortinet Inc55,40428.819.54.5837.7
Crowdstrike Holdings Inc44,76968.8-10.538.6NA
Zscaler Inc33,50160.4-31.436.5NA
Cloudflare Inc37,67552.3-19.533.6NA
Okta Inc28,44050.0-52.744.8NA
VeriSign Inc23,5454.965.318.2155.6
Splunk Inc18,75310.6-45.937.488.4
Check Point Software Technologies Ltd19,2404.941.9-6.146.1
NortonLifeLock Inc16,87210.441.5-5.583.8
F5 Inc12,19910.814.621.841.3
SentinelOne Inc11,077100.2-124.154.5NA
Avast PLC8,7575.441.9-12.2NA
Trend Micro Inc/Japan8,2889.422.9-0.255.3
CyberArk Software Ltd6,7658.3-15.619.2234.7
Rapid7 Inc6,00930.1-22.426.9600.9
Tenable Holdings Inc6,07722.9-7.719.7NA
Qualys Inc4,89113.321.311.6259.6
Varonis Systems Inc4,68833.3-25.335.4367.1
Sailpoint Technologies Holdings Inc3,88220.2-13.340.9NA
Venustech Group Inc3,58045.817.254.314.5
Darktrace PLC4,21441.3-13.776.9NA
CommVault Systems Inc2,8038.35.421.827.9
Radware Ltd1,58314.66.413.3120.2
F-Secure Oyj8957.37.513.561.5
Aggregate / median400,78420.2-6.721.8104.3
Source: Bloomberg and Saxo Group

The industry is undergoing a rapid consolidation with Proofpoint being acquired by the private equity firm Thoma Bravo last year and Microsoft recently going after Mandiant (formerly FireEye), and Avast is being acquired by NortonLifeLock. In addition, McAfee is being taking private by a group of investors. The industry is rapidly evolving technologically and in terms of complexity, and as a result we expect the consolidation to continue with the industry ending up being dominated by 4-5 companies sitting 80% of the combined revenue in the industry.

The stocks that have been removed due to acquisitions or otherwise are:

  • Mandiant (because we expect Microsoft’s acquisition to go through)
  • McAfee
  • Mimecast
  • SolarWinds (reviewed this company and it is not pure enough cyber security)

Avast is being kept in the portfolio for now but the acquisition by NortonLifeLock will most likely go through in April and at that point we will update the basket again.

The stocks we have added are:

  • SentinelOne
  • Darktrace
  • Radware
  • F-Secure

Darktrace and F-Secure increases the geographical exposure a bit away from an otherwise very US-centric basket.


The Saxo Bank Group entities each provide execution-only service and access to Analysis permitting a person to view and/or use content available on or via the website. This content is not intended to and does not change or expand on the execution-only service. Such access and use are at all times subject to (i) The Terms of Use; (ii) Full Disclaimer; (iii) The Risk Warning; (iv) the Rules of Engagement and (v) Notices applying to Saxo News & Research and/or its content in addition (where relevant) to the terms governing the use of hyperlinks on the website of a member of the Saxo Bank Group by which access to Saxo News & Research is gained. Such content is therefore provided as no more than information. In particular no advice is intended to be provided or to be relied on as provided nor endorsed by any Saxo Bank Group entity; nor is it to be construed as solicitation or an incentive provided to subscribe for or sell or purchase any financial instrument. All trading or investments you make must be pursuant to your own unprompted and informed self-directed decision. As such no Saxo Bank Group entity will have or be liable for any losses that you may sustain as a result of any investment decision made in reliance on information which is available on Saxo News & Research or as a result of the use of the Saxo News & Research. Orders given and trades effected are deemed intended to be given or effected for the account of the customer with the Saxo Bank Group entity operating in the jurisdiction in which the customer resides and/or with whom the customer opened and maintains his/her trading account. Saxo News & Research does not contain (and should not be construed as containing) financial, investment, tax or trading advice or advice of any sort offered, recommended or endorsed by Saxo Bank Group and should not be construed as a record of our trading prices, or as an offer, incentive or solicitation for the subscription, sale or purchase in any financial instrument. To the extent that any content is construed as investment research, you must note and accept that the content was not intended to and has not been prepared in accordance with legal requirements designed to promote the independence of investment research and as such, would be considered as a marketing communication under relevant laws.

Please read our disclaimers:
- Notification on Non-Independent Investment Research (
- Full disclaimer (

Saxo Markets
40 Bank Street, 26th floor
E14 5DA
United Kingdom

Contact Saxo

Select region

United Kingdom
United Kingdom

Trade Responsibly
All trading carries risk. To help you understand the risks involved we have put together a series of Key Information Documents (KIDs) highlighting the risks and rewards related to each product. Read more
Additional Key Information Documents are available in our trading platform.

Saxo Markets is a registered Trading Name of Saxo Capital Markets UK Ltd (‘SCML’). SCML is authorised and regulated by the Financial Conduct Authority, Firm Reference Number 551422. Registered address: 26th Floor, 40 Bank Street, Canary Wharf, London E14 5DA. Company number 7413871. Registered in England & Wales.

This website, including the information and materials contained in it, are not directed at, or intended for distribution to or use by, any person or entity who is a citizen or resident of or located in the United States, Belgium or any other jurisdiction where such distribution, publication, availability or use would be contrary to applicable law or regulation.

It is important that you understand that with investments, your capital is at risk. Past performance is not a guide to future performance. It is your responsibility to ensure that you make an informed decision about whether or not to invest with us. If you are still unsure if investing is right for you, please seek independent advice. Saxo Markets assumes no liability for any loss sustained from trading in accordance with a recommendation.

Apple, iPad and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Android is a trademark of Google Inc.

©   since 1992