How to Invest in Cybersecurity

How does the cybersecurity industry make money?

Most modern cybersecurity companies make money through recurring subscriptions to cloud-delivered software, which is what makes the cybersecurity theme attractive to investors. Instead of selling a one-time appliance, vendors charge an annual or monthly fee per user, per device, or per workload protected, and they expand revenue as customers adopt more modules. CRWD bills for endpoint and cloud protection delivered from its cloud, ZS bills for secure access to applications, and PANW sells a mix of network security plus a growing cloud and security-operations subscription business.

This subscription model gives the cybersecurity theme high revenue visibility and strong retention, because ripping out a security platform is risky and disruptive for a customer. Net revenue retention above 100 percent, where existing customers spend more each year, is common among the leaders. That recurring, sticky economics is a core reason the cybersecurity theme behaves like high-quality software rather than cyclical hardware.

Why is cybersecurity spending so resilient?

Cybersecurity spending is resilient because organizations treat it as non-discretionary. A successful breach can cost a company far more than its entire security budget through downtime, ransom, regulatory fines, and lost trust, so security is one of the last line items cut in a downturn. That defensive characteristic is central to the cybersecurity theme: it tends to hold up better than other software categories when IT budgets tighten, because the cost of not spending is so high.

The threat environment also keeps growing, which sustains the cybersecurity theme. More cloud adoption, more remote work, more connected devices, and now AI-assisted attacks all expand the surface that has to be defended. FTNT protects networks and the expanding edge, NET secures and accelerates web traffic at the network layer, and S (SentinelOne) brings AI-driven endpoint detection. As attacks evolve, defenders have to keep investing, which is the structural demand engine underneath the cybersecurity theme.

What is cybersecurity platform consolidation?

For years, companies bought dozens of separate security point products from different vendors, which was expensive to manage and left gaps between tools. The dominant trend in the cybersecurity theme now is consolidation: customers prefer to buy many capabilities from one platform vendor that integrates them, simplifying operations and improving coverage. This favors the largest players in the cybersecurity theme that can offer a broad suite, and it lets them cross-sell new modules into their existing base.

CRWD has expanded from endpoint into cloud, identity, and security operations on a single platform; PANW has pursued a deliberate platformization strategy across network, cloud, and operations; and ZS anchors the secure-access layer. Consolidation is why scale matters so much in the cybersecurity theme: the vendors that can land one product and expand into ten capture a disproportionate share of a customer's growing security budget. Smaller point-product vendors like S and NET compete by leading in a specific category and expanding outward.

What gets a stock into the Cybersecurity theme?

Majority of revenue from protecting digital systems: endpoint, network, cloud, identity, or application security, delivered largely through recurring subscription software.

What stocks are in the Cybersecurity theme?

Every public name that fits the Cybersecurity thesis, with the rationale for inclusion. Click any ticker for the full stock guide. The basket above starts equal-weighted; you set your own target weights inside Walnut.

How to invest in Cybersecurity

There are a few ways to get exposure to the cybersecurity theme, and Walnut is not an investment adviser, so this is descriptive. The most concentrated path is buying individual stocks that fit the thesis: platform leaders like CRWD, PANW, and ZS, network and edge security through FTNT, AI-driven endpoint through S, and network-layer security through NET. Picking single names lets you weight the segments of cybersecurity you find most compelling, such as endpoint versus network versus cloud, at the cost of more research and concentration in a handful of premium-valued software names. The passive route is broad technology ETFs: VGT and XLK hold the largest cybersecurity names but at small weights inside the wider tech sector, so the security exposure is diluted. There is no pure-play cybersecurity ETF in Walnut's valid proxy set as of early 2026, though dedicated security ETFs exist in the broader market.

The alternative is building a dedicated cybersecurity basket in Walnut. You describe the thesis to Walnut's AI assistant, for instance cybersecurity spanning endpoint, network, cloud, and identity, and the assistant proposes constituents and starting weights drawn from names like CRWD, PANW, ZS, FTNT, S, and NET, with the rationale for each. You review every constituent and weight, adjust anything you want, and fund the basket through your own connected broker. You approve every order before it is placed; Walnut never trades for you. The cybersecurity basket then tracks as a single performance line you can compare against VGT or XLK.

Which ETFs cover Cybersecurity?

If you want the theme as a single ticker rather than as a basket, these are the ETFs people most commonly use. Each has trade-offs (concentration, expense ratio, sector overlap) covered in the individual ETF guides.

The bottom line on Cybersecurity

Cybersecurity is one of the more durable software themes because security budgets are treated as non-discretionary and recurring subscription revenue makes the leaders predictable. The platform-consolidation trend favors scale players like CRWD, PANW, and ZS over point products. It fits a portfolio as a satellite tilt or a quality software sleeve, and a focused basket of pure-play leaders expresses it far more cleanly than VGT or XLK, where security is a small slice of broad tech.

FAQ