Cybersecurity spending is soaring. Here’s how investors can harness the sector’s growth

Across markets and business headlines, certain themes and sectors dominate. AI gets a lot of airtime, crypto creeps up news feeds, and big tech talk dominates. They’re all related, of course — but there’s a common foundation across those thematics that isn’t so often in the headlines. Cybersecurity is a cornerstone of them all, but most investors aren’t doing much about it.

Sitting at the cross-section of multiple industries means that cybersecurity usually gets covered in relation to one of these other digital sectors, typically when something has gone badly wrong. In May, it was crypto’s turn in the spotlight, when the bribery of company contractors at digital assets exchange Coinbase led to a data breach affecting 70,0000 customers. While the stolen data wasn’t enough to hack into Coinbase’s actual crypto vaults, it did enable cybercriminals to convince customers they were Coinbase agents and break into their individual funds. The cost of remediation for Coinbase is estimated to be anywhere from $180M to $400M.

While cyberattacks in the financial sector often grab headlines with the vast amounts stolen, virtually all industries are susceptible to cyberthreats. Applications of cybersecurity — or lack thereof — are visible in essential services such as healthcare, energy, or transportation, too. In these areas, disruptions to services can potentially endanger lives. Last year, a cyberattack on a British diagnostic services company used in a public hospital caused a delay in access to critical information, ultimately contributing (among other factors) to delays in care provision that led to one patient's death.

One step ahead

Cybercrime and hackers who perpetrate it are getting more sophisticated — but more often than we hear, they’re outpaced by innovation in the cybersecurity industry. With reliance on digital services and AI becoming more entrenched, securing the safety of users, businesses and governments is now part of the mandate for technological advancement. And while it may not enter the investor’s purview as frequently as the AI race or a big tech market rally, in 2025, the cybersecurity sector has quietly been making headway.

Layered demand for cybersecurity across individuals, governments and corporations is translating as robust and stable growth. Global cybersecurity revenue is expected to hit $203B in 2025; looking forward, Statista projects the market to grow by 7.6% (CAGR) to ~$271.9B by 2029.

Naturally, corporate giants will be expected to lead by example. Global IT budgets already sit at around $290B, and consumer-facing tech knows how costly data breaches can be both in monetary and reputational terms. EY estimates that banks will devote ~11% of their IT budgets to cybersecurity in 2025, and major supply-side players are strengthening their positions as institutions raise the bar. As of Q2 2025, planned acquisitions by Zscaler and Palo Alto Networks could see them each spend north of $600M on bolstering in-demand services like threat intelligence and AI security, respectively.

The impulse to innovate also has a governmental dimension. Recent releases from federal agencies have outlined threats that consistently evade detection, while an executive order signed in June also signaled an intent to strengthen the U.S. government’s cybersecurity preparedness in what some perceived as a realignment of federal cybersecurity priorities. That backdrop is good news for cybersecurity in many ways. As spending and TAM keep expanding, policy tailwinds are intensifying — and per intelligence from Nasdaq, cybersecurity companies’ performance has been overwhelmingly positive in recent months.

Tracking the sector 

Indeed, as the need for cybersecurity becomes more abundant, the investment case for cybersecurity is becoming more apparent. For that, Nasdaq cybersecurity indexes provide a useful tool for tracking the sector’s progress, revealing how momentum has shown up in the numbers. 

For instance, the Nasdaq CTA Cybersecurity™ Index (NQCYBR™) tracks a portfolio of 33 cybersecurity companies engaged in the technology and industrial sectors. And while past performance isn’t indicative of future results, NQCYBR’s historical track record is testament to the sector’s impressive growth. So far this year, the index has returned 15.37% YTD — over 1.5x the S&P 500’s 9.84% YTD return. A longer-term comparison of the two indexes’ performance establishes a similar pattern: 3-year annualized returns for NQCYBR sit at 19.51% compared to 17.77% for the S&P 500, and NQCYBR’s 5-year annualized return stands at 15.20%, eclipsing the S&P 500’s 13.04%.¹

Under the hood, fundamentals continue to justify the momentum in the cybersecurity space. Constituent companies in the more concentrated  Nasdaq ISE Cyber Security Select™ Index (HXRXL™), saw Q2 2025 revenue increase 11.7% year-over-year in aggregate to $66.3B, aided by scale players such as Broadcom and Cisco. In other words: earnings and cash‑flow are increasingly catching up with long‑running demand signals.

The defense play

Despite its centrality to the digital economy, most portfolios still under-allocate to cybersecurity.   Broad‑based strategies don’t provide much exposure since core indexes barely overlap with the cybersecurity space, leaving it out of many otherwise tech-weighted portfolios.

In practice, only eight HXRXL constituents appear in the S&P 500, together accounting for <4% of its weight. Meanwhile, 15 HXRXL holdings (roughly half the index by weight) are not in the S&P 500 at all. For investors with broad-based exposure, then, a targeted cybersecurity sleeve could be a practical complement to a traditional large‑cap tech allocation.

To that end, HXRXL has recently looked less like a high‑beta index and more like a resilient “digital utility” growth theme. Security spend is embedded across the entire IT stack and is comparatively durable through cycles — boards and regulators don’t turn cybersecurity off in a slowdown. Relative to many thematic tech indexes, that lower‑volatility profile can help diversify risk within a tech sleeve while still furthering the cause of innovation.

Cybersecurity also sits at the crossroads of the AI economy — on both the supply and demand sides. On the supply side, cybersecurity providers are integrating threat‑intelligence, identity, data‑loss prevention, and AI‑native security capabilities into the infrastructure that powers our digital lives. On the demand side, rapid AI adoption leaves organizations vulnerable to attack and intensifies compliance requirements, demanding more budget to secure data. For investors, that makes a cybersecurity allocation a natural and defensive complement to cloud/data positions — because all that data needs protecting.

Cybersecurity for everyday investors

While Nasdaq’s array of cybersecurity indexes provide key market intelligence, they’re also a good guide for thematic investments. You can’t invest directly in an index, but Nasdaq’s cybersecurity indexes like HXRXL and NQCYBR are tracked by a variety of ETFs usually accessed through your brokerage account. That approach gives you targeted exposure in the sector’s overall growth without the single‑stock concentration risk or expense that can come with building a portfolio of individual stocks.

Whether it is sector intelligence or a targeted investment, Nasdaq indexes are a mainstay in the toolkits of traders, analysts, and ETF investors alike. For more than five decades, Nasdaq has served as an innovative index provider and trusted partner to the global financial ecosystem, bringing transparent design, methodological rigor, and industry expertise to core market metrics. That’s the foundation that underpins the Nasdaq cybersecurity index family built to help investors track, understand, and access one of technology’s most durable growth engines.

Advertiser’s Disclosures

¹ YTD, 3-year and 5-year returns for NQCYBR and S&P 500 are as of 8/29/2025. Annualized index returns are calculated using the following annualization formula: [ [ending value of investment/beginning value of investment]^(1/number of years)]-1. Partial year returns use the holding period return formula: [ending value of investment/beginning value of investment]-1.

Past performance is not indicative of future results. Index performance is for illustrative purposes only and does not reflect any management fees, transaction costs or expenses. Indexes are unmanaged and one cannot invest directly in an index.

Nasdaq^®, Nasdaq CTA Cybersecurity™, NQCYBR™, Nasdaq ISE Cyber Security Select™, and HXRXL™, are registered and unregistered trademarks of Nasdaq, Inc. The information contained herein is provided for informational and educational purposes only, and nothing contained herein should be construed as investment advice, either on behalf of a particular security or an overall investment strategy. Neither Nasdaq, Inc. nor any of its affiliates makes any recommendation to buy or sell any security or any representation about the financial condition of any company. Statements regarding Nasdaq-listed companies or Nasdaq proprietary indexes are not guarantees of future performance. Actual results may differ materially from those expressed or implied. Past performance is not indicative of future results. Investors should undertake their own due diligence and carefully evaluate companies before investing. 

ADVICE FROM A SECURITIES PROFESSIONAL IS STRONGLY ADVISED.

© 2025. Nasdaq, Inc. All Rights Reserved.