Transcription
Kasey: Hey, everyone. Welcome back to Chip Stock investor. Today, we are finally going to discuss how to invest in cybersecurity stocks in 2024. We've been working on this for several months now, analyzing the cybersecurity industry and the companies within it. And we're ready to talk about it.
Cybersecurity stocks had an epic run in 2023. Cybersecurity spending was absolutely explosive during the pandemic when everyone was forced to use cloud computing.
Nick: Yeah, lots of new security challenges have come up because of technology like cloud computing as that continues to pick up steam, remote work, still very much happening around the world, and things are not getting easier for organizations now with new use cases like generative AI and machine learning. Generative AI in particular, really not simplifying the complexities of digital business, as now companies have to have yet another way to protect their data because employees can copy and paste sensitive information and plug it into a chatbot, for example. How do you prevent something like that from happening? So lots of complexities involved in cybersecurity propelling this industry higher. And Kasey, it's a really big need. There's some striking figures out there, regarding the number of people affected and the cost involved with cybercrime every year.
Kasey: One online publication, Comparitech, estimates that 88.5 million people worldwide are victims of cybercrime every year. And Cybersecurity Ventures, via its online publication, Cybercrime Magazine, estimates that cybercrime will cost the world $10.5 trillion by 2025, nearly 10 percent of total global gross domestic product.
Nick: You can probably see a new headline every day if you wanted to, about some new cyber attack. Some company that suffered a data leak or is facing a ransom to have some of its information returned to it. So it's not hard to figure out why cybersecurity services are on the rise. So tech researcher Gartner, in its recent update, estimates that cybersecurity spending could increase 14 percent year over year in 2024 and reach about $215 billion in global spend. That's just the cybersecurity services of this industry. What we're looking at here is something in the ballpark of $500 billion or half a trillion dollars in cybersecurity services and related hardware and related services to cybersecurity, within the next five years or so. This is a big growing market, a new secular growth trend as the world continues to develop new digital technology.
Kasey: And the reason we're putting this video together and our manual together is because there are many different types of cybersecurity companies. I know when I first started learning about cybersecurity, it all seemed like they were doing the same thing, but that is not at all what's going on. There's many different companies servicing many different parts of the cybersecurity industry. So the key to investing in these companies is understanding how they work, what type of system they're actually protecting, and how the company makes money. Let's talk about our new cybersecurity industry flowchart.
Nick: Yeah, so this is similar to our semiconductor industry flowchart. Although you'll notice it looks quite different. This is a very different type of industry. This is not a manufacturing industry like semiconductors are. The way we like to think of cybersecurity is trying to visualize what the actual infrastructure is, and how data and information is traveling on it, to understand what the cybersecurity service is actually protecting. So we put this flow, this circular, infrastructure together. This is, of course, a simplification of what the global IT industry actually looks like and how the ecosystem interacts with each other. But you can generally think of digital information as flowing in a circle.
So we'll start with the digital data and the software itself in the upper left-hand corner, and then flowing from that, we have physical locations like office buildings, factories, or some other type of centralized physical workplace with workers within it containing a server or some sort of closed network. Data centers connected to a company's private use network. Related to that, public data centers or cloud computing, shared computing infrastructure accessed via a public network connection, the Internet. Moving next from that, we have this very, very large and ever-growing regional public data center and cell towers. So we can call this edge networks, located close to the end user that continue to increase the performance of the internet itself. And then we have all the devices that connect to those edge networks. And then finally, we have the mobile users and frontline workers themselves, oftentimes the weakest link in any sort of digital system, as user error accounts for the vast majority of data breaches and cybercrime events. And then we complete the circle again. With those mobile users and frontline workers flowing back into the physical location as their work refeeds the cycle of digital information.
Maybe just to illustrate this and the way we think about this, imagine if a bit of digital information had a red shining beacon attached to it, and you could see it physically moving through all of this infrastructure. And then think about what do you need to do to protect that information from getting into the wrong hands? That's how we start to think about cybersecurity companies within this growing industry and what it is exactly that they do.
Kasey: To understand how complex the securing of systems and data is, let's talk about how things looked back before the internet and long before the commercialization of the internet or the cloud blew up the traditional castle and moat cybersecurity architecture. There were hard physical boundaries creating data silos or islands, and oftentimes before the invention of the microprocessor and the PC, these islands of digital data were the old computing mainframes themselves with boundaries around them being just paper and pencils in the office. But later, with the advent of communications networking, these islands or mainframes at first, and later office buildings, when PCs became popular, they could be controlled by simply using a physical device called a firewall around that physical location. And later, when the internet came to the home, antivirus software for PCs became a necessity. Internet use in the 1990s also began to necessitate policies governing movement of data beyond the office's perimeter. In other words, what happened at the office stayed at the office.
Nick: The internet really did kick off a massive sea change that we're still dealing with the repercussions of. The dawn of the cloud all of a sudden has really blown this up because now the internet is acting as a massive digital freeway for more than just simple information, but massively complex pieces of software and services are now being delivered via these large public networks. And so this has become the dawn of the zero trust era because employees can access critical information and critical business systems from just about anywhere. From home, from on the road, wherever. This concept of zero trust has become really important. You'll hear this talked about a lot from all the cybersecurity companies. It's not a specific technology per se, but the concept basically is that no login attempt can be trusted. Users need to be constantly verified, both inside and outside of an organization's network to make sure that they are in fact, who they are claiming to be and that they should actually have access to the information they're trying to get. So you can thank zero trust for all of those passwords you have to keep track of. Sometimes you may be asked to input a password and maybe even some two-factor authentication along with it, like a push notification to your smartphone, multiple times a day to verify who you are.
Kasey: It makes sense, doesn't it? When you look again at the industry flowchart, there's multiple ways an organization or an individual can be attacked. That just continues to expand. Now, all of this explains why cybersecurity is such a massive need and why so many organizations are underprepared for an inevitable attack. And as a result, our own estimate is a low to mid-teens percentage CAGR, compound annual growth rate, over the next 5 to 7 years in the cybersecurity industry. Let's talk about the estimated size of these general cybersecurity types.
Nick: So you can see here, networking security, those physical firewalls, protecting physical workspaces. Historically, the biggest segment of cybersecurity, still very much growing. But cloud security has exploded the last few years, quickly catching up to network security. Some of the other hot areas of this market are endpoint security and very closely related to that, identity and access management, which is designed to keep the workers themselves safe using the endpoints, the devices themselves. We'll talk about specific companies within each of these categories and correlate it to our cybersecurity industry flowchart. But one more item here, Kasey, before we talk about the specific categories and the companies within each of them, let's talk about risks for the cybersecurity industry and investing in it. Because this is a key consideration when you're considering investing in any stock, we have the different risks for the industry broken down into three general categories.
Kasey: The first risk is hyper competition. Because of the high growth of the cybersecurity industry and the profitability of these companies, it attracts a lot of competition. The leaders in cybersecurity can generate cash flow profit margins of 30-40%. A few examples of these: Checkpoint Software, Palo Alto Networks, Fortinet, Gen Digital, which is formerly Symantec, and Broadcom, all are players in this space that are generating large amounts of cash flow.
Nick: As a result, those high profit margins spawn lots of new upstart companies hoping to be the next multi-billion dollar industry leader. A lot of personal fortunes can be made. These small startups are a constant threat to the established players in the cybersecurity space. The second risk factor: rapid technological and tech trend changes. This has been especially so in the last decade because of the advent of mobile computing and the cloud, and again, that's not going away as new AI services pose new risks. It's easier than ever for employees to take private information and plug them into some sort of generative AI workflow. So as a result, remote work, a proliferation of devices connected to the internet or a private network, just increase the number of attack surfaces and obliterate the old castle and moat structure that was easier to keep safe. So that's created a lot of new winners in this market in recent years, but also a number of losers as well. Just one example: FireEye, which was a hot IPO stock back in 2014, started out doing very, very well, grabbed lots of investor attention, and then quickly fizzled out. The remnants of FireEye were sold off to private equity, and the Threat Intelligence and Incident Response Unit of FireEye, rebranded as Mandiant, was purchased by Alphabet's Google Cloud. This highlights a big threat that these companies have in, if they miss a technological shift or a trend, or if one of those startups or upstarts has a better technology available, it could spell trouble for the leaders in cybersecurity.
Kasey: The last risk is just how brilliant some of the people working in cybersecurity and maybe against cybersecurity can be. In the words of Palo Alto Networks CEO, Nikesh Arora, he states that cybersecurity is the most innovative industry. All of this exceptional talent can lead to very high stock-based compensation within an organization. If left unchecked, can lead to a serious problem if it excessively dilutes other non-employee shareholders. On the other side of the coin, equally talented individuals and organizations are also attracted to cybercrime. And so there is a lot of risk to these companies because cybercriminals are constantly innovating as well.
Nick: And of course, this has been highlighted increasingly in recent years. There's also this issue of state-sponsored cyber attacks as well. As there's lots of geopolitical and macro-economic jockeying taking place, to infiltrate digital systems, to learn government secrets. Suffice to say, this level of talent and government support and big money support of nefarious digital activity poses massive risk for cybersecurity companies. If holes in their own security stack are found, it can spell disaster for them and for their customers.
Kasey: We'll now discuss the different cybersecurity types out there and the companies that provide those services. Take a look at this chart of the publicly traded cybersecurity companies out there. We have them organized by market cap as of the end of February. These are all just publicly traded pure-play cybersecurity companies.
Nick: As you can see, some pretty large businesses at the top and as you work your way down the list, a very long tail of smaller businesses that are focused on more specific niches, more specific use cases within the cybersecurity market. Let's talk about what those are. And as we discuss this, we'll include these pure-play companies, as well as some of the more diversified companies that also participate in cybersecurity in some form or fashion.
If we go back to our cybersecurity industry flowchart, we should, of course, start with the data itself, software-level security or application security, app sec. So there's this growing need to put security directly into an application itself, by verifying that there are no security holes in the software or the computing system before it's put into use. And as these computing systems and the software built atop them grow in complexity, it's getting harder and harder to make sure that software is secure, both while it's being manufactured, while it's being coded, and then also after it's deployed. Usually these days in some sort of hybrid environment, both for private company use and perhaps also in the cloud as well.
The first companies that we'll mention here are, of course, two companies that you've maybe become familiar with from our semiconductor industry flowchart: Synopsys and Cadence Design Systems. Specifically though, let's briefly mention Synopsys, the electronic design automation leader.
Kasey: This company has semiconductor design software, but they have also acquired multiple application security companies over the years. In fact, about 10 percent of its revenue in 2023 came from that application security and software integrity group. Synopsys is exploring the possible sale of its security business as it works through the process of acquiring the software designer, Ansys.
Nick: That's right. And if they do offload that segment, that could shake up this portion of the cybersecurity market in 2024. So keep an eye on that. But this is really important because this system verification and software verification, it can help clear up a lot of issues right out the gate, right when a piece of software is deployed. If you've ever seen headlines about a zero-day exploit or zero-day malware or something like that, this is what companies like Synopsys and other app sec platforms are addressing: a flaw in the software, the firmware, or the hardware design itself.
Kasey: We'll just mention a few other leaders in software testing and verification: Palo Alto Networks, development security and operations management platforms like GitLab and GitHub, which is owned by Microsoft, JFrog, and also tools from Qualys and F5. ServiceNow is also offering a security operations platform for security teams as they manage their software development cycle.
Nick: So as for how these companies make money, it's common belief that they're just simply software as a service or SaaS, some sort of subscription model for oftentimes a cloud-based tool. But in reality, these are not simple monthly or even annual subscriptions to a cloud-based application security service, kind of like what we buy for consumer services. These contracts tend to be multi-year in nature and they'll cover use for many employees and oftentimes multiple types of services. And they can be deployed either in the cloud or on-premises or even on devices themselves. These companies tend to have very high profit margins and very sticky customer relationships. This is, in our opinion, a really great place to be invested within the greater software investment universe as a result.
Kasey: Let's now look at one of the oldest types of security: firewalls. Those control the security of a physical space like an office building, a factory, store, or a data center or some other centralized physical workplace with workers and equipment. These locations could contain traditional computing infrastructure like a mainframe and a closed network of PCs or an Internet of Things workplace with various devices connected by Wi-Fi. A firewall is a physical device set up with rules and algorithms, and it monitors data moving into and out of a network. Rules can be set up to block any information that's coming in that doesn't belong, or block any information trying to be extracted from a network, or filter out any other kind of unauthorized access. Just as the Internet of Things has pushed the boundaries of what needs to be protected, so firewalls need to be set up to monitor wireless traffic as well.
Nick: That's right. So you'll often hear a lot of companies talk about not just hardware-based firewalls, but now also software-based firewalls. And the big four in this old firewall market, both hardware and now software, are Palo Alto Networks, Fortinet, which is a standout, as far as we're concerned, because they also designed their own proprietary processors to operate their firewalls, Checkpoint Software, and of course, the old networking hardware giant Cisco, which has been disrupted to a pretty large extent by not so small anymore upstart called Arista Networks, which has made a foray into cybersecurity to compliment its networking devices as well.
Kasey: There's also many smaller players and some consolidation taking place. Private equity firm Thoma Bravo acquired Barracuda Networks back in 2017 and then in 2022, sold Barracuda to KKR. And then in early 2024, Hewlett Packard Enterprise said it would be acquiring firewall and networking company Juniper Networks. As firewalls are part of that physical layer of IT, revenue from the sale of these devices tends to be cyclical in nature. There's periods of multi-year growth, usually corresponding to some hardware upgrades, but then it can be followed by several years of decline. The best players in this market can maintain a high level of profitability throughout the entire cycle. Let's talk about private data centers connected to a company's private network.
Nick: So this is definitely similar to what we just talked about, Kasey. Because a private data center connected to a private network also needs to be protected by a firewall, either a hardware-based one or a software-based firewall that can be deployed in one place and then extended across a company's private network. But we mentioned this apart from the last category because oftentimes these data centers are still remote. They may not be located exactly on the same premises as, let's say, an office building full of workers. Maybe they're located some distance away, but it's connected by this private network infrastructure and thus requires some specific cybersecurity hardware and services to complement those traditional physical locations that we talked about that have really been blown up by the advent of data centers, both public and private.
Because we're talking about more private network stuff here, of course, the big four are still very much at play: Palo Alto Networks, Fortinet, Checkpoint Software, Cisco, and Arista Networks. We also have some smaller specialized players in the space like A10 Networks that feature prominently in firewalls and other networking equipment for private data centers. And then in addition to the hardware players themselves, we have this very large and growing ecosystem of data analytics software companies that often complement the hardware and private network itself. So we think it may be appropriate at this point, when talking about this segment, let's say the whole left third of the cybersecurity industry flow, to start talking about some of these software-based analytics businesses.
Kasey: Splunk is one of the original companies in this space. Cisco is in the process of acquiring that. Splunk was initially slow to adopt its software stack and customer pricing to the cloud until the last five years or so. There's also observability disruptor stocks like Datadog, Dynatrace, Elastic, Rapid7, and SolarWinds, and numerous private upstarts have expanded on this software type. There's many services that help a security team sort through all sorts of data. Private equity firms have taken note of these types of companies as well, and they are making some consolidation moves.
Nick: And in this context of specific software and data management, there are two unique publicly traded companies worth mentioning here that really stand out as well: Qualys and Tenable. Both offer vulnerability and threat management tools. This is software that scans all the devices that are connected to an organization's network, especially a private network, and checking for possible areas of weakness that could be exploited. This type of threat detection really complements well the firewalls and related systems to make sure a private network is secure from external intrusion. I think maybe just to help illustrate just how expansive cybersecurity is becoming, we have a lot of specialty data centers that are also on the rise. Owner-operators of their own private data centers and sprawling network infrastructures that are starting to package security services along with them. A great case in point is the digital payment space. So, for example, Visa, MasterCard, and Fiserv offer data security, fraud detection, and other software services like analytics to go along with these data center and private networks to give their financial partners better visibility into what's going on with their own operations and to help keep money safe. So I think, again, I think this just speaks to the extensive outlay of the cybersecurity market and how it is really starting to spread through every single sector of the economy, because private networks, private data centers are becoming pervasive. You need to have this stuff if you're a large business. And what goes along with all of that is cybersecurity services.
Kasey: Let's now move on to public data centers or shared compute infrastructure accessed via the internet and private networks. You can think of these cloud services: Amazon AWS, Microsoft Azure, Alphabet's Google Cloud, Oracle Cloud. All of these companies make up these public data centers.
Nick: And of course, when you have these big sprawling networks like this traveling via the internet, and high growth, lots of new traffic getting added to the public cloud every year. Of course, AWS, Azure, Google Cloud, Oracle Cloud are going to have some built-in cybersecurity services. And many of those compete with some of the data analytics and data and cloud observability providers that we mentioned just in the last segment. This cloud network is getting increasingly complex. Again, we've talked about AI already, but lots of new software types being trained, oftentimes in a public data center, then deployed again, either in the cloud or maybe moved back into a company's private network. But lots of new places for a cyber attack as a result of this. That being the case, again, these big cloud infrastructure companies investing heavily in cybersecurity and have a lot of business built in as a result. We should also mention here some of the key players that help build these big public cloud services: again, historically Cisco, the dominant player in that space, building itself, not just into a hardware provider, but also a hardware and software provider, thus that pending acquisition of Splunk that you already mentioned. And then also Arista Networks, which has been scooping up lots of market share and adding lots of cybersecurity services of its own and counts most of these cloud giants as customers.
Kasey: This leads us to the dawn of cloud-native cybersecurity providers. There's lots of platforms that have popped up in recent years that have grown alongside this massive cloud computing movement, and some of the biggest names are Palo Alto Networks and Fortinet. Palo Alto Networks is the leader in secure access, secure edge, or SASE, and Fortinet is making a move into this sector too. This term SASE was coined by Gartner, and it combines multiple technologies into a service that securely connects any user to public or private data center, apps, and data. You can think about it as an alternative route. Rather than taking the major freeway, a SASE service reroutes a user request via a custom-built road that can be secured and monitored. You'll hear these custom network locations called POPs, or Point of Presence, a small local data center where the SASE service resides closer to the end user. You may think of these modern cloud software subscription services as only software, but really, there's a lot of hardware network in operation behind the scenes.
Nick: Some other players in this space include the value stock option, Checkpoint Software, which has popped up at every point along our cybersecurity industry flow up to this point, and they play in this space as well. And then in the cloud-specific part of this market, we have Zscaler, which offers SSE, or secure service edge. Oftentimes you hear this referred to as a subset of SASE, but really what secure service edge is, it was designed and built to be for public cloud access. So it's lacking some of the technology purpose-built for network, private network computing. SSE specifically more for public cloud usage, but Zscaler growing very quickly along with the cloud and working on adapting its services to address all of a company's needs, not just the cloud-based portion of it, but also some of the traditional networking access as well. There are plenty of small specialists in this cloud security space. We have F5 Networks, an older hardware networking business that has adapted its services for the cloud software era. Some newer, smaller businesses like Darktrace and Varonis Systems. And of course, lots of privately owned startups that are trying to make headway and disrupt this market all the time.
Kasey: So these companies, similar to private network security, tend to get lumped into the software as a service market. However, these are highly complex services that combine hardware and software together. Customer contracts can be very sticky and tend to be multi-year service agreements and can be expanded to encompass the onboarding of more employees over time. So as a result, many of these businesses generate high levels of profitability as they mature. Let's move on to the smaller regional public data centers or edge networks and cell towers, as well as CDNs, or content delivery networks. All of these companies have helped build the internet the way we know it today.
Nick: Yes. These really stitched together the global fabric of the internet itself and host the websites and the apps and massive amounts of data residing on the internet. And they also help facilitate the fast-growing amount of public cloud traffic as well, as a lot of these more regional networks are helping facilitate local storage of data, which is a key tenant to security. You don't necessarily want all information housed in one big central location, if you don't need to have it available there. Perhaps you just need to have it in one specific location close to a specific network edge. You have a lot of cybersecurity getting built these mobile networks and the cell towers, used to connect all of this together. And of course, the old CDNs, or content delivery networks, playing very heavily in this market as well. It's a natural fit for them because they helped build the internet as we know it today.
Kasey: The leader in the CDN space is a company called Akamai, and it has a global network of data centers and networking that helps securely deliver content from the web. Customers pay to have their sites stored on data centers, and that content is then delivered when an internet user makes a request or clicks on a link. Content delivery is a basic front-line security need that quietly operates in the background, usually unbeknownst to us as internet users. As for those edge computing upstarts, basically just smaller regional data centers located close to the users. Cloudflare and Fastly picked up ample attention as fast-growing CDN providers during the pandemic. Besides those CDN services, Cloudflare in particular offers cybersecurity services like SASE and other cloud security services.
Nick: Yeah, there are lots of legacy CDNs in this part of the cybersecurity industry flow too. And many of them have old services built in like VPNs, or virtual private networks, which is an older technology that also reroutes traffic through a more secure network connection in one of these data centers. So you have a lot of these controlled by the likes of Verizon and AT&T and other telecoms located around the world, like Vodafone. And in addition to those legacy CDNs, most of the big tech companies, especially the tech communications and media giants, like Alphabet's Google, Meta, aka Facebook, Instagram, and WhatsApp, Amazon AWS, Comcast, also have extensive content and delivery networks as well with related security services built in. So a bit of a blurring of the lines here between IT communications and media companies in recent years. There are some smaller specialists as well. One that we'll make note of here is Radware, which offers software specifically to help protect against web-based attacks. There's a lot of overlap here with offerings from Cloudflare and the other older CDN players, but Radware, one of those specific cybersecurity peer plays that offers software, often packaged as some sort of service subscription to help fend off web attacks. Worth mentioning here. A little bit of misconception here with a lot of these businesses in edge networks, content delivery networks, and mobile internet-based services. These are usually not just simple software as a service agreements sold on a monthly or annual basis. These are usually multi-year contracts that combine some combination of hardware and software together into a comprehensive package. You cannot separate the hardware from the software whenever you're talking about the protection of infrastructure, like we are when we're talking about cybersecurity. The best players in this industry are going to be able to generate high levels of profitability regardless of where they may be in the economic or industry cycle.
Kasey: Let's move on to the mobile devices part of our cybersecurity industry chart. Endpoint security or cloud software-based security for mobile devices has been one of the hottest trends in cybersecurity, and the pandemic only accelerated those new endpoint needs. CrowdStrike has emerged as the leader. It has 20 percent of this large and growing market. It's estimated it passed up the old industry titan, Microsoft Defender and Intune, a couple of years ago, which was the leader owing to its ability to distribute cybersecurity to PCs, thanks to the 1.5 billion Windows PCs worldwide.
Nick: CrowdStrike's very fast success has garnered ample attention. So we've talked in the past about SentinelOne, which is one of those companies that appears might be at risk of fizzling out and maybe getting sold off to private equity at some point. There are some other companies as well that have tried to break into this endpoint security market: Trend Micro over in Japan, which we'll talk a bit more about here momentarily, BlackBerry, which acquired Cylance in 2019, of course, Broadcom, the big semiconductor company, via its acquisition of Symantec's enterprise business in 2019, and then VMware at the tail end of 2023, because VMware itself acquired Carbon Black, an endpoint cybersecurity provider, also back in 2019. So those are some of the top players in endpoint security. Lots of tech giants also getting into this as well. Have to mention the big three platforms: Palo Alto Networks, Fortinet, and Checkpoint Software, also involved in the endpoint security market as well. But at this point in time, CrowdStrike, far and away, the big leader. And working its way back towards the left-hand side of the cybersecurity industry flow by slowly introducing new modules and new cybersecurity services that go after some of the other cloud services and network services that the other companies specialize in.
Kasey: Nick, let's talk about how these companies make money. Are these companies simply software as a service providers?
Nick: So the further we head down the cybersecurity flow, the movement of information, the closer and closer we get to a more simple SaaS-based business, just a simple software subscription. Of course, that software needs to reside somewhere, and endpoint security does reside usually in the cloud or deployed in a private data center. So oftentimes this is just a simple subscription. It can be not so sticky of a service. Now, CrowdStrike has been combating this by again, progressively rolling out new services, more complex modules that address other big business needs besides just pure endpoint security. But as we move into these last couple sections of the cybersecurity industry flow, these services do become to be more and more software-based. You're not exactly purchasing some sort of hardware or hardware-based service with the software itself. And so some of the stickiness goes away. That said, because these are more pure software businesses, you can have incredibly high profit margins in this industry. So a bit of a trade-off here, maybe a little bit less sticky of a business, but higher profit margins. And that's why so many new endpoint security companies popped up the last few years: lower barriers to entry, promise of high profit margins, makes for a hypercompetitive segment of the cybersecurity industry.
Kasey: Time to talk about the weakest link, us, the mobile user and frontline workers, which cause the vast majority of data breaches and cybercrime events. We are long past the time when a simple antivirus residing on our computer can get the job done, especially when you're looking at it from an enterprise cybersecurity perspective. Antivirus leaders include Gen Digital's Norton, which merged with previously privately held Avast, and then Japan's Trend Micro, which also does some work in endpoint. There's also privately held companies Bitdefender, McAfee, Malwarebytes, and ESET. And of course, we have the biggest, Microsoft's built-in security with Windows. Nick, why don't we talk about what the difference is between endpoint and antivirus software?
Nick: The most basic way to explain this is antivirus software is for your use at home, your personal computer connected to the internet. Now, endpoint cybersecurity software is essentially a type of antivirus software for the end-user device, but there are some big differences, though. The biggest being endpoint software security usually resides in the cloud, giving the organization that has deployed it, giving their IT and security team, the ability to centrally manage a whole entire network of users, observe and monitor their activity, impose login and credential requirements when a user tries accessing an app or accessing data. And simple antivirus has no such centralized features. It generally resides on the PC itself. It can get updated via the internet, but that's a direct link from the user of the PC and the antivirus software provider.
Kasey: There's new tools being designed to work at the absolute edge of the network on the device itself, including identity management. This is designed to keep mobile users safe and it prevents this weakest link in any IT system. You can think about companies like Okta, CyberArk, lots of Microsoft products like PureView and Entra, OneSpan, and a recently IPO'd stock in the Stockholm exchange, Yubico. All are part of this identity management at the edge of the network.
Nick: Yeah, two of the biggest ones in this space are Okta and CyberArk, which offer both identity and access management. Two very, very related software types that help authenticate users in a system. Often asking for secondary credentials, like maybe via text message to a verified second user device, or a push notification on an app before allowing access to an app within an organization's system. Google Authenticator, another competing service in this identity and access management segment that many people use when accessing their cloud-based software services.
Kasey: Many of these companies envision a passwordless future for mobile users and frontline workers. Nick recently did an interview with Yubico regarding their YubiKeys, which have been around for quite some time. And they actually helped build the standard for this IAM market, identity and access management. A YubiKey is a physical device that acts as a user authentication when logging into a device. You can think of this maybe in a hospital system where a medical worker needs to log in multiple times to workstations throughout the day, like at computers in a patient's individual room. This IAM space has also been attracting some consolidation attention, especially from private equity firms. Thoma Bravo went wild and acquired a slew of identity management providers: SailPoint, Ping Identity, and ForgeRock. How do these companies make money?
Nick: Yeah, this helps explain why there has been some private equity attention here. Because there are a lot of companies that popped up. Big reason why is these tend to be very software-driven businesses. Historically, over the last five to 10 years, very little hardware implemented into these services. So the switching costs are very low for customers. The customer relationships, not so sticky, although the trade-off with that is you can get some very high profit margins because this is software-based business. So thus Thoma Bravo doing some consolidation of its own and buying those three companies in 2022 alone. That's some of the trade-off here with this end of the market: highly software-driven, high profit margins, but maybe not so sticky business.
Kasey: We'll just mention a few security crossover companies. It's really probably a separate topic, but a convergence of the real physical world and the digital world has created all kinds of new security and cybersecurity use cases for mobile end users and frontline workers. Some of these crossover security offerings include home security and home automation, like ADT or Alarm.com Holdings, Clear Secure. You may have noticed their kiosks at airport systems, and then IoT-based security and monitoring for vehicle fleets platform, Samsara, and Axon for law enforcement security systems. Now, with all these companies out there floating around in the cybersecurity market, Nick, it seems like it would be very difficult to pick just which companies you might want to invest in. So what is one option that you could do?
Nick: Yeah. A fantastic option here is picking an ETF. Now, we have been attracted to the big platform businesses: Palo Alto Networks, Fortinet, and to a growing extent CrowdStrike, which you can almost think of as a type of cybersecurity service compilation that encompasses large parts of the whole industry flow. So that's one option, but the other is just the ETFs themselves, which just create a basket of most of them, all of the businesses that we just discussed at all points in the data flow market. So we'll just rattle these off and you can find a little bit more information in the cybersecurity industry manual that accompanies this video. But the biggest is the First Trust NASDAQ Cybersecurity ETF. The second right behind it, result of merger and acquisition in the ETF market, is Amplify Cybersecurity ETF, formerly known as ETFMG Cybersecurity ETF. One of the newer ETF offerings is the Global X Cybersecurity Fund. We also have the iShares Cybersecurity and Tech ETF. And then finally, WisdomTree has its own cybersecurity fund as well, the newest ETF in our list.
Kasey: We'll just mention one more that is a favorite for us: Vanguard Information Technology ETF. It doesn't have an ETF solely focused on cybersecurity, but it's one of our oldest investments and favorite funds. It's a broad-based index of the U.S. computing technology sector, and it's full of cybersecurity stocks and other businesses involved in security in some form or fashion.
Nick: Let's wrap this video up, Kasey, and talk about cybersecurity as a long-term investment. You probably look at some of these cybersecurity businesses and notice stock prices can go through some wild swings up and down. So investing in a basket, no fewer than three to five of these stocks, or maybe just picking an ETF, we think is the way to go rather than picking and placing your bet on just one company being the overall winner. But as far as some of the trends propelling this industry forward, one is critical redundancy. Notice nearly all of these companies have multiple services or multiple modules, and they're constantly trying to expand those. That's an important competitive advantage as we discussed earlier, especially for the software-based businesses. But it's a critical aspect of modern security because if one element of your cybersecurity architecture fails, you need to have that backup plan. You need to have critical redundancy in place. So all of the major cybersecurity providers working hard at this.
Kasey: And then vendor consolidation. If you think you're getting subscription to death, so are businesses. If a single vendor can help with multiple needs in cybersecurity, it's a major advantage to that company.
Nick: Maybe me just one final note here in identifying the best cybersecurity stocks. Remember that the cloud-native companies that get a lot of attention do have a natural competitive advantage in the latest and greatest of software technology, but there is absolutely no way to cut hardware out of the mix. That's why you'll hear us on our channel here talk about the big so-called legacy cybersecurity companies, Palo Alto Networks and Fortinet in particular. They generate ample profit margins, have lots of financial resources to make updates to their services and stay relevant and competitive in the cloud era. This combination of hardware and software is going to be very essential in the cybersecurity industry.
Kasey: In follow-ups to this video, we will delve into specific parts of this industry flow for more in-depth analysis. We'll discuss company dynamics and how they make money, interactions with their peers and competitors, and competitive advantages, as well as financial valuations. So make sure you stay tuned for that. Thank you for watching or listening to our mega video analysis here of the cybersecurity industry and how to invest in cybersecurity stocks in 2024. This video hopefully has helped you be more confident when making investments into the cybersecurity industry. We've prepared a lovely manual for you to peruse with all of our visuals, and that will be available over on our Ko-fi shop page. And if you're a channel member here on YouTube or over on Ko-fi, you'll have that manual in our published manuals section of our Discord page. Make sure you have subscribed to the channel, hit us up with questions or comments.
Nick: Thanks all for joining us on our cybersecurity mega video. We'll be talking more about this industry, lots more, as 2024 progresses. So see you all again soon for that. And of course, more semiconductor and digital infrastructure investment analysis real soon. Take care, everyone.