A growing wave of cyberattacks is putting cybersecurity companies back in the spotlight, as artificial intelligence makes it easier for hackers to identify software vulnerabilities and launch increasingly sophisticated attacks.

The threat is becoming increasingly costly for businesses. In a November 5 report, Reuters highlighted a series of cyberattacks that disrupted businesses and critical infrastructure across Europe. Dutch grocery group Ahold Delhaize, for example, suffered more than €200 million in lost sales after a cyberattack forced it to take its websites and apps offline for a week.

The number of reported software vulnerabilities is also rising sharply. Nearly 37,000 security flaws were reported in the third quarter of 2026, roughly three times the level recorded a year earlier, according to Reuters.

The incidents underscore how cybersecurity is becoming a growing concern for companies operating in an increasingly digital economy. As businesses expand their use of cloud computing, AI and connected systems, protecting networks, customer information and critical infrastructure is becoming more important.

For investors, the trend is drawing attention to cybersecurity stocks, including CrowdStrike, Palo Alto Networks and Fortinet. Investors seeking broader exposure can also consider sector-focused exchange-traded funds (ETFs), such as the First Trust NASDAQ Cybersecurity ETF (CIBR), Amplify Cybersecurity ETF (HACK) and Global X Cybersecurity ETF (BUG).

AI Is Raising the Stakes for Cybersecurity

AI is changing the cybersecurity landscape in two ways: It is giving businesses new tools to defend against attacks, while also providing hackers with more sophisticated capabilities.

Cybercriminals can use AI to identify software weaknesses, automate reconnaissance and create more convincing phishing campaigns. At the same time, cybersecurity providers are incorporating AI into their platforms to detect unusual activity, analyze threats and respond to attacks more quickly.

The growing competition between attackers and defenders is creating additional pressure on corporate security budgets.

A Boston Consulting Group report published in August 2026 found that 83% of surveyed cybersecurity leaders were increasing their spending. Nearly nine in ten respondents said their organizations had experienced AI-enabled cyberattacks over the previous 12 months.

The broader market opportunity is also expanding. McKinsey estimates that the global market for cybersecurity products and services sold by external providers could grow from $223 billion in 2025 to $346 billion by 2029, according to Reuters.

However, stronger industry demand does not guarantee that every cybersecurity company will benefit equally. Competition is intense, and investors will need to pay attention to revenue growth, profitability and companies' ability to maintain a competitive advantage.

Three Cybersecurity ETFs to Watch

For investors interested in the sector, CIBR, HACK and BUG provide three different approaches to investing in cybersecurity companies. Their holdings overlap in several areas, but their portfolio construction and exposure to individual businesses vary.

First Trust Nasdaq Cybersecurity ETF (CIBR)

The First Trust Nasdaq Cybersecurity ETF (CIBR) is one of the largest cybersecurity-focused ETFs in the U.S. market. Launched in July 2015, it tracks the Nasdaq CTA Cybersecurity Index.

The fund invests in companies involved in cybersecurity technology and services, including network security, software protection, identity management and communications equipment.

CIBR had approximately $17.5 billion in assets and 49 holdings as of November 10, 2026, according to fund data. Its expense ratio is 0.58%.

As of November 9, its five largest holdings were:

CrowdStrike is known for its cloud-based endpoint protection and threat detection platform, while Palo Alto Networks provides network, cloud and security operations solutions. Fortinet specializes in network security and firewall products.

Cisco and Broadcom provide exposure to the broader networking and technology infrastructure that supports digital security.

The combination gives CIBR exposure to both specialized cybersecurity providers and larger technology companies. Its relatively broad portfolio may appeal to investors seeking exposure to different parts of the digital security industry.

Amplify Cybersecurity ETF (HACK)

The Amplify Cybersecurity ETF (HACK) was launched in November 2014 and is among the earliest ETFs dedicated to the cybersecurity industry.

HACK tracks the Nasdaq ISE Cyber Security Select Index, investing in companies providing cybersecurity hardware, software and services.

The fund had approximately $3.6 billion in assets and 26 holdings as of November 9, 2026. Its expense ratio is 0.60%.

Its largest holdings included:

HACK's portfolio includes several familiar cybersecurity providers, such as CrowdStrike, Palo Alto Networks, Zscaler and Okta. These companies focus on areas ranging from endpoint protection and cloud security to identity management.

One notable difference is its exposure to defense contractors General Dynamics and Northrop Grumman. Their inclusion gives HACK a broader security-related investment profile than a fund concentrated entirely on cybersecurity software companies.

This approach may appeal to investors seeking exposure to both digital security providers and companies involved in the wider defense and security industry.

Global X Cybersecurity ETF (BUG)

The Global X Cybersecurity ETF (BUG) offers a more focused approach to the cybersecurity industry.

Launched in October 2019, BUG tracks the Indxx Cybersecurity Index. Its methodology emphasizes companies whose principal business activities are closely related to cybersecurity.

Eligible companies must generate at least 50% of their revenue from cybersecurity-related activities, according to the index methodology.

BUG had approximately $2.3 billion in assets and 31 holdings as of November 10, 2026. Its expense ratio is 0.50%.

Its largest holdings included:

The portfolio provides exposure to several specialized cybersecurity businesses.

Okta focuses on identity and access management, helping organizations manage employee and customer access to digital systems. Qualys and Tenable specialize in vulnerability management and security assessment, while Zscaler focuses on cloud-based network security.

Rubrik provides data security and cyber resilience solutions, while Varonis specializes in data security and protection.

Compared with ETFs that include larger technology companies and defense contractors, BUG places greater emphasis on businesses directly involved in cybersecurity. This makes it a more concentrated way to gain exposure to the industry.

How Do CIBR, HACK and BUG Compare?

Although all three funds target the cybersecurity industry, their investment strategies differ.

Assets and holdings are based on the latest available data around November 9–10, 2026. Figures may change.

CIBR is the largest of the three funds and offers exposure to a relatively broad mix of cybersecurity and technology companies. HACK combines specialized security providers with selected defense contractors, while BUG uses a revenue-based screening approach to focus more heavily on cybersecurity businesses.

There is also considerable overlap among the three ETFs. CrowdStrike, Palo Alto Networks and Fortinet appear in all three portfolios. Investors holding multiple cybersecurity ETFs should therefore examine their combined exposure to individual stocks rather than assuming that owning several funds necessarily provides greater diversification.

What Could Hold Cybersecurity Stocks Back?

Despite the industry's long-term growth potential, cybersecurity stocks face several challenges.

Valuations remain important. Many cybersecurity companies are growth-oriented technology businesses. Their stock prices can be sensitive to interest rates, earnings expectations and broader market sentiment. Even if industry spending continues to increase, valuations could limit potential returns.

Competition is intensifying. Established technology companies, specialized cybersecurity providers and emerging AI-focused businesses are competing for corporate security budgets. Companies that fail to innovate or differentiate their products could lose market share.

AI could reshape the competitive landscape. While AI creates demand for new security solutions, it could also change how existing products are developed and delivered. Investors will need to watch which companies can successfully integrate AI into their platforms.

Sector concentration creates additional volatility. Cybersecurity ETFs are focused investments rather than broad-market funds. Their performance may be particularly sensitive to changes in technology stock valuations and investor appetite for growth companies.

The Bottom Line

The latest cyberattacks and rapid development of AI-powered threats are bringing renewed attention to the cybersecurity industry. As businesses and governments strengthen their digital defenses, cybersecurity providers could benefit from sustained demand for network protection, cloud security and data protection solutions.

For investors seeking exposure to the theme, CIBR, HACK and BUG offer three different approaches. CIBR provides a broader mix of technology and cybersecurity companies, HACK includes selected defense contractors, while BUG focuses more heavily on specialized cybersecurity businesses.

The industry's growth prospects are attracting attention, but investors should look beyond the headline market opportunity. Company valuations, profitability, competitive positioning and ETF portfolio concentration will all play important roles in determining long-term returns.