Why cybersecurity could be one of the decade’s biggest investment themes

There are few among us who haven’t been hit at some point by a data breach.

If you think you haven’t, perhaps it’s time to pop your details into a monitoring company to see if your data is on the dark web or been affected by a breach in the past. You might have an unpleasant surprise on your hands.

As recently as July this year, around 900,000 current and former customers of Origin Energy had their data exposed. It’s not the only breach this year, and when you factor international companies, the impact grows further.

The technology for cybercrime is becoming increasingly sophisticated – hardly unexpected when you simply consider the rate of progress of AI tools, like Claude or ChatGPT. A side effect of this is the increasing rate of attacks and the need for companies and individuals to spend on data protection.

Cybersecurity is going nowhere, and if anything, companies are being forced to spend more even for basic protection due to changing sophistication and technology.

The size of the opportunity in cybersecurity

Once upon a time, we talked about viruses and bugs – today, the story has changed and is harder to contain.

Attacks are increasingly occurring via vulnerabilities in legitimate access paths to companies. Consider the power of an AI agent in generating mass data and how bad players might misuse that to access personal data.

While still some time off, quantum computing is likely to mean attacks can spread in an instant. This is before you consider the ongoing existence of spam emails, texts and phone calls to coax details out of individuals that can be used to hack accounts.

Crowdstrike’s 2026 Global Threat Report pointed to faster speeds in ‘break out’ – that’s after obtaining access where the hacker moves across data to other assets. The average pace was around 98 minutes back in 2021. In 2025, it was 29 minutes – with the fastest time actually 27 seconds! There’s also an 89% increase in attacked by AI-enabled adversaries and 35% of cloud-based incidents started with abuse of valid account details.

Having personal data hacked has a very real financial cost.

Morgan Stanley estimates that cybercrime cost US$10.5 trillion in 2025. As such, spending is needing to significantly jump to manage data protection over time.

Gartner projects that Australian spend in 2026 will jump 9.5% from 2025 to be more than A$7.5bn and that global spend will reach US$240bn.

Projections into the future vary, with Roots Analysis suggesting that a CAGR of 11.3% for the cybersecurity market between 2024-2035, with spending reaching US$697bn by 2035 and the composition of spend moving away from predominantly hardware in 2024 to a relatively even split between software and hardware, and a smaller portion directed to services.

Such is the urgent need for cybersecurity that you can even find structural government support globally.

Australia launched the 2023-2030 Australian Cyber Security Strategy with a commitment of spending A$586.9 million split across causes like support for small and medium businesses, consumer standards, threat sharing platforms, strengthening government security and infrastructure protections. 

Further to this, in April, Microsoft announced a collaboration with the Australian AI Safety Institute and plans to invest A$25 billion in AI infrastructure, security and skills in Australia.

The US released an updated strategy earlier this year, outlining plans for six new frameworks. The US is estimated to spend more than $25 billion on cybersecurity annually, while the European Union announced €1.3bn under its 2025-2027 DIGITAL programme to focus on cybersecurity, protect critical infrastructure and expand digital resilience.

Translating spend to profit

The growing spend is helping the bottom line for many major cybersecurity players.

For example, Crowdstrike has a subscription based model, with a range of add-ons and scaling optionality. It has seen its net new annual recurring revenue grow 47% year-over-year and reached a record US$331 million in the quarter ending 31 January 2026.

Or, in the last week, Palo Alto Networks signed a multi-year partnership with NTT Data that targets US$1bn in joint business by 2029 by combining Palo Alto Networks’ AI-powered cybersecurity platforms with NTT Data’s consulting, engineering and managed services.

On the flip side, there’s been casualties along the way. For every success story, there’s millions of start-ups in the dust.

Investors do need to remember a few caveats when it comes to profitability in this space.

1. These companies need to maintain significant R&D budgets to keep up with changing cybersecurity threats. Today’s innovation is tomorrow’s expectation in the base package.
2. There can be lower barriers to entry for businesses meaning more competition.
3. There has been a trend towards drawing services in-house rather than using external providers which can hit companies hard. An example of this is UK cybersecurity company Adarma, which lost a major client and then proceeded to experience downscaling in other clients and financial pressures. It eventually closed in 2025.

Companies with diversified service offerings can help reduce the risks of investing in this space.

How to invest in cybersecurity

When it comes to cybersecurity, you can consider pure-plays or invest in companies with cybersecurity as part of their overall offer.

Australian names tend to be in the small and micro-cap space,

The Australian space is quite small, with names like Senetas (ASX: SEN), ArchTIS (ASX: AR9), Prophecy International Holdings (ASX: PRO), FirstWave Cloud Technology (ASX: FCT), WhiteHawk (ASX: WHK) and AUCyber (ASX: CYBR).

Some of the big names in the cybersecurity space include Palo Alto Networks (NASDAQ: PANW), Crowdstrike (NASDAQ: CRWD), Fortinet (NASDAQ: FTNT), Zscaler (NASDAQ: ZS), Cloudflare (NYSE: NET), Check Point Software (NYSE: CHKP), CyberArk (NYSE: CYBR), SentinelOne (NYSE: S) and Tenable (NYSE: TENB).

As cybersecurity is an essential service, more and more big tech companies have incorporated it as part of their offers.

Some examples include:

• Microsoft (NYSE: MSFT) i.e. Microsoft Defender and Entra
• Google (NASDAQ: GOOGL) i.e. Google Cloud security and Mandiant
• Amazon Web Services (NASDAQ: AMZN) i.e. cloud security infrastructure, specialised security consultation and threat detection tools.
• Cisco (NASDAQ: CSCO) i.e. enterprise security division and threat intelligence via Cisco Talos.
• IBM (NASDAQ: IBM) i.e. IBM security, security software, threat intelligence and other security services.

Cybersecurity also sits under the defense industry and some big operators in this space offer tailored systems, such as BAE Systems, Booz Allen Hamilton and Leidos.

There are also pure-play ETFs available in Australia to access the cybersecurity theme:

• Betashares Global Cybersecurity ETF (ASX: HACK)
• Global X Cybersecurity ETF (ASX: BUGG) 

Protecting yourself from cybercrime

With all the discussion on the costs and opportunities in the cybersecurity space, don’t forget to take measures to protect your own data.

A few tips include:

• Update your password regularly and don’t reuse passwords. If you find it difficult meeting all the password criteria, using a password manager like 1Password or NordPass, can be helpful. Using a phrase rather than a word can add extra security.
• If you have the option to use multi-factor authentication, it adds a great option for extra protection.
• Spam emails are getting more sophisticated. Genuine emails from banks and financial service providers won’t have anything for you to click on, they’ll direct you to go to the website yourself and login.
• Text messages can also be deceptive because hackers can hide the number to look like it’s from a genuine provider. Don’t click on any links and if something seems strange, ring your financial provider directly on their public number to cross-check.
• Don’t pass out details to random callers. If it sounds legitimate and you are concerned, tell them you’ll call back – do not use the number they offer, check the official provider website and use that number to confirm.
• Keep any software you use and your phone systems up-to-date so that any new security patches are installed.
• Back up any important files to an external hard-drive so you still have copies if you are hacked.

You can check on haveibeenpwned.com to see if any of your accounts have been compromised – make sure to change the passwords on any accounts that have been.

Have you invested in cybersecurity? Let us know your approach to exposure in the comments.