Cybersecurity as an Asset Class

Why I Use the Phrase "Asset Class" Deliberately

I am aware that calling cybersecurity an asset class will irritate some readers. Cybersecurity is a sector, they will say, a subset of enterprise software, and dressing it in grander language is marketing.

I disagree, and the disagreement is substantive rather than semantic. What distinguishes an asset class from a sector, in my working definition, is that its demand is driven by a force largely independent of the economic cycle that governs everything else in the portfolio. Gold behaves as an asset class because monetary anxiety is not a function of gross domestic product growth. Infrastructure behaves as an asset class because contracted, inflation linked, regulated cash flows follow a different logic from corporate earnings.

Cybersecurity qualifies on the same basis. Its demand is set by adversary activity and regulatory obligation, and neither of those pauses when earnings disappoint. That is a genuinely different demand function from the rest of the technology complex, and it deserves to be treated as such in portfolio construction.

First, the Numbers, and Why They Contradict Each Other

I want to establish a discipline before making any argument, because this sector is unusually prone to inflated statistics.

Gartner's most current estimate, published in mid 2026, puts worldwide information security spending at approximately $248.9 billion, a figure the firm has revised upward three times during the year. Gartner projects 2026 growth at roughly 15.1 percent; IDC, using a broader definition, projects around 12.2 percent. Other research houses model the market at $271 billion or $302 billion for 2026, reaching anywhere from $411 billion by 2032 to $699 billion by 2034. Cybersecurity Ventures, applying the widest possible definition, has suggested global spending on products and services would exceed $520 billion annually by 2026.

The spread between $248 billion and $520 billion for the same year is not a rounding error. It is a definitional argument about whether to count insurance, compliance labour, internal staff cost and managed services. I use the Gartner figure as my anchor because it measures end user spending on identifiable security products and services, and because I would rather understate a market than build a thesis on the most generous interpretation available.

What is not in dispute is the trajectory. Global cybersecurity spending was approximately $120 billion in 2020 and crossed $150 billion by 2022. Five consecutive years of double digit growth is a rare thing in enterprise technology, and it is that consistency, more than any single year's number, that supports the asset class argument.

The Four Structural Drivers

I test every thematic allocation against a simple question: what forces would have to reverse for this thesis to fail? For cybersecurity, four drivers would each have to reverse independently, which is what gives me confidence.

1. Regulation Has Created a Demand Floor

This is the driver most investors underweight. The European Union's NIS2 directive and the Digital Operational Resilience Act, alongside United States Securities and Exchange Commission disclosure requirements, have moved cybersecurity spending from discretionary to statutory for large categories of organisation.

I want to be precise about why this matters financially. A discretionary budget line can be cut in a downturn. A statutory obligation, enforced by a regulator with penalty authority, cannot. Regulation has effectively converted a portion of the sector's revenue into something closer to a compliance tax, and compliance taxes are among the most reliable revenue streams in any economy.

2. The Talent Shortage Forces Spending Toward Vendors

There are approximately 4.8 million unfilled cybersecurity positions globally, according to ISC2. Organisations cannot hire their way out of the problem, so they buy their way out instead, through automation, managed detection and response, and outsourced security operations.

For an investor this is close to ideal. A structural labour shortage in a customer's own operations translates directly into vendor revenue with pricing power, because the alternative is not cheaper, it is simply unavailable.

3. Artificial Intelligence Expands Both the Threat and the Market

Attack tooling has become dramatically more capable, and defence has had to follow. McKinsey has estimated that artificial intelligence is expanding the total addressable market for cybersecurity providers toward $2 trillion. I treat that figure as directional rather than literal, but the mechanism is real: every new capability deployed by an enterprise creates a new surface that must be secured, and agentic systems with access to corporate data create categories of exposure that did not previously exist.

There is a related and underappreciated statistic. Roughly 15 percent of corporate cybersecurity spending now originates outside the chief information security officer's budget, and that non CISO spending is projected to grow at around 24 percent annually. Security is being embedded into product, engineering and operations budgets. That broadens the buyer base considerably.

4. The Physical Buildout Creates Physical Demand

The data centre construction wave discussed endlessly in AI commentary has a security consequence that is rarely mentioned. Spending by six major United States hyperscalers approached $400 billion in 2025, with global data centre investment projected in the trillions over five years. Every one of those facilities requires embedded security architecture across networks, physical access control and operational technology.

I find this driver useful precisely because it is mechanical. It does not depend on threat perception or executive priority. It scales with concrete and steel.

The Argument Against Myself

An honest case requires stating the counterargument properly, so let me do that.

Cybersecurity equities are not defensive in the way the word implies. These are high multiple growth software businesses, and in a broad risk off episode they will fall alongside the rest of technology. Their *revenue* is defensive. Their *share prices* are not. Investors who confuse the two will be disappointed at exactly the moment they expected protection. Cybersecurity stocks reached their highest levels in nearly a year during mid 2026, which tells you something about beta as well as fundamentals.

Spending is not the same as outcomes. One analysis estimates the world now spends roughly $7.42 in cybersecurity for every dollar of estimated disclosed breach exposure, up from $5.24 two years earlier. If that ratio keeps expanding without a corresponding fall in breach costs, boards will eventually ask harder questions about return on security investment. That is a medium term risk to growth rates.

Consolidation is a threat to the long tail. Palo Alto Networks announced a planned $25 billion acquisition of CyberArk, and Alphabet acquired Wiz in a transaction reported at around $32 billion. Platform consolidation is excellent for acquirers and for shareholders of acquired firms. It is difficult for the large population of subscale point solution vendors that a broad sector fund will inevitably hold.

The Public Sector Paradox

A tension worth watching closely: while private sector spending accelerates, public defensive capacity in the United States has contracted. The Cybersecurity and Infrastructure Security Agency's enacted fiscal 2026 budget landed at roughly $2.6 billion, below its prior baseline of around $3 billion, following workforce reductions of approximately one third. Meanwhile the overall United States federal cybersecurity budget has grown from about $18 billion in 2020 to over $25 billion in 2026, with the Department of Defense accounting for roughly $14.5 billion.

The pattern is a shift of defensive burden from civilian public agencies toward the private sector and toward defence. For an investor, that argues for exposure to commercial vendors and defence oriented security contractors, and for scepticism about theses that depend on expanding civilian government procurement.

How I Distinguish a Durable Security Business From a Feature

Because consolidation is the defining dynamic of this industry, the most important analytical task is separating businesses that will acquire from businesses that will be acquired, and both of those from businesses that will simply be absorbed into someone else's product roadmap without compensation.

I apply three tests.

Is it a control point or a capability? A control point sits in the path of something the enterprise must do: authenticating a user, inspecting traffic, governing access to data. A capability is a useful function that a larger platform can replicate. Identity has become the dominant control point of this cycle, which is precisely why it has commanded the largest transaction premiums.

Does removal cause an operational failure? The best security products cannot be uninstalled without something breaking. That is a considerably stronger commercial position than being valued for the incidents it prevents, because prevention is invisible and invisible value is the first thing questioned in a budget review.

Is renewal automatic or negotiated? Net revenue retention above 110 percent tells me customers are expanding within the product without being sold to again. Below 100 percent, no amount of market growth will save the investment case.

These questions are unglamorous, but they are the difference between owning the consolidator and owning the consolidated.

Where the Distortions Create Opportunity

Sector level spending is strikingly uneven, and the unevenness is investable.

Healthcare spends among the least on security relative to revenue, in the region of 0.3 to 0.5 percent, while suffering the highest breach costs per incident at approximately $7.42 million and the longest detection timelines, close to nine months. That gap between exposure and expenditure is unsustainable. Either regulation or a sufficiently severe incident will close it, and vendors positioned in healthcare security are positioned for that convergence.

Geographically, the United States remains the largest single market, projected at roughly $93 billion in 2026. But the Middle East and Africa region generated approximately $16.72 billion in 2025 and is projected at around $19.39 billion in 2026, with the Gulf Cooperation Council states alone at roughly $6.92 billion. For clients based in the Gulf and South Asia, regional security spending growth substantially exceeds the global average, and regional vendors and systems integrators are worth examining directly rather than only through global funds.

How I Take the Exposure

I generally structure cybersecurity exposure in three tiers.

The platform tier, receiving the largest weight. Consolidating vendors with broad product suites, identity being the current organising principle of the industry as passwordless authentication and zero trust architectures displace perimeter thinking. These businesses benefit from consolidation rather than being threatened by it.

The infrastructure tier. Security embedded in networking, cloud native application protection and operational technology. Less exciting, more contractually sticky, and directly levered to the physical buildout.

A deliberately small specialist tier. Emerging categories where I accept binary outcomes in exchange for asymmetry, sized accordingly and reviewed frequently.

For most globally diversified portfolios I regard 3 to 6 percent as a reasonable standing allocation, held through cycles rather than traded around headlines. I have watched too many investors buy this sector immediately after a widely reported breach, which is reliably the worst available entry point.

Passive vehicles have a role, particularly for investors who want the theme without single stock risk, but I repeat the warning I give on every thematic fund: read the holdings. Several cybersecurity indices carry significant weight in subscale vendors that consolidation will not treat kindly.

Closing Thought

I have come to think of cybersecurity spending as the modern equivalent of maritime insurance in the age of sail. It was never a source of adventure or glamour. Nobody wrote poems about underwriters. But trade could not function without it, the obligation to carry it was eventually written into law, and the businesses that provided it earned steady returns across centuries of political upheaval, precisely because the risk they covered never went away.

Digital commerce now sits in an analogous position. The threat is permanent, the obligation is increasingly statutory, and the buyers have no realistic option to abstain. That combination is rare in any market. In my judgement it justifies a permanent, deliberately sized place in a serious global portfolio, held not as a bet on technology but as a claim on an obligation that will not expire.