Cybersecurity ETFs Face a Reckoning: Which 3 Will Weather the Downturn

• Global X Cybersecurity ETF (BUG) holds $864M in assets with 77% US exposure and top positions in Palo Alto Networks (11%), Akamai Technologies (7%), and Fortinet (7%), down 18% over the past year. First Trust NASDAQ Cybersecurity ETF (CIBR) is the largest cybersecurity ETF by assets and uses a liquidity-weighted index that includes diversified tech names like Cisco and Broadcom alongside pure-play security vendors, providing deeper liquidity for institutional trades. Themes Cybersecurity ETF (SPAM) is the newest fund with one of the lowest expense ratios in the category, up 13% over 12 months, though it carries wider bid-ask spreads due to smaller assets and fewer than 600 trading days of history.

• Rising attack surfaces from cloud migration, industrial systems, and remote work have made cybersecurity a non-discretionary budget item, causing corporate security spending to compound even during economic downturns, making thematic ETFs attractive vehicles for capturing that structural growth without betting on individual company winners.

• The analyst who called NVIDIA in 2010 just named his top 10 AI stocks. Get them here FREE.

Ransomware payouts, supply‑chain breaches, and state‑backed attacks have pushed cybersecurity spending into the category of must‑have corporate expenses rather than optional upgrades. For investors who want exposure to the security budgets that swell after every major breach, thematic ETFs offer a cleaner entry point than trying to pick winners in an industry where market share can shift overnight. This article breaks down three cybersecurity ETFs, what each one actually owns, how their approaches differ, and the tradeoffs that come with each strategy. It also highlights one popular ticker that often gets lumped into the group but doesn’t truly belong in the cybersecurity category.

Corporate IT budgets can tighten in a downturn, but security spending almost never does. The attack surface keeps widening as companies move more workloads to the cloud, industrial systems come online, and remote employees log in from home networks. That is why cybersecurity stocks often behave like long‑term growth stories even when the broader software sector cools. The ETFs below capture that theme in different ways: one is a globally diversified pure‑play, one is a newer low‑cost option, and one is the largest and most established fund in the space.

Global X Cybersecurity ETF (NASDAQ:BUG) tracks the Indxx Cybersecurity Index, a basket built around companies whose core revenue comes from selling security products or services. The fund holds roughly $864 million in net assets and leans heavily toward US-listed names, with 77% in the United States, a meaningful sleeve in Israel at 9%, and Japan at 8%.

The analyst who called NVIDIA in 2010 just named his top 10 stocks. Get them here FREE.

Holdings tilt toward cloud and endpoint security. Top positions include Palo Alto Networks at 11%, Akamai Technologies at 7%, and Fortinet at 7%. The Israeli allocation comes through Check Point and identity names like CyberArk, giving BUG coverage of a region that produces a disproportionate share of the world’s cybersecurity engineering talent.

Performance over the past year has been rough. BUG shares sit near $26, leaving the fund down about 14% year to date and roughly 18% over the past year. The concentration cuts both ways: with nearly 100% of the portfolio in technology stocks per the fund report, BUG moves tightly with cloud software sentiment. When high-multiple names derate, the fund derates with them.

Themes Cybersecurity ETF (NASDAQ:SPAM) is the newest of the three and was built around a low-fee structure. Themes ETFs has positioned the fund as a value alternative in a category where competitors historically charge well above 0.5%, and SPAM carries one of the lowest expense ratios among cybersecurity-focused funds.

The portfolio holds pure-play security names with meaningful overlap with BUG at the top and a broader reach underneath. The top ten positions account for about 53% of assets, anchored by Palo Alto Networks and Fortinet, and the fund spreads its allocation across adjacent sectors, including communication services and industrials, for companies whose security business is within a larger parent company.

Year-over-year performance has diverged sharply from BUG despite the shared top names. SPAM trades near $31, up about 13% over the past 12 months and roughly 2% year to date. The tradeoff is track record and scale. SPAM has fewer than 600 trading days of history and a smaller asset base than the established funds in the category, which tends to mean wider bid-ask spreads during volatile sessions.

First Trust NASDAQ Cybersecurity ETF (NASDAQ:CIBR) is the largest cybersecurity ETF by assets under management and the default choice for investors who want the most liquid vehicle in the category. CIBR tracks the Nasdaq CTA Cybersecurity Index, a modified liquidity-weighted index that caps individual position sizes to reduce the risk of single-stock concentration.

Where BUG and SPAM lean hard into pure-play security vendors, CIBR’s index rules pull in larger, more diversified technology companies that derive a meaningful share of revenue from security products. That produces a lower beta than a pure-play portfolio because names like Cisco and Broadcom sit alongside CrowdStrike and Palo Alto Networks. The cost of that profile: in a sharp rally driven by high-growth security software, CIBR will trail the smaller pure-plays because its large-cap weightings dilute the exposure.

Liquidity stands out as the distinguishing feature of CIBR. For institutions running options strategies or size trades, tighter spreads and deeper volume reduce execution cost in a way that matters more than a few basis points of expense ratio.

Global X FinTech ETF (NASDAQ:FINX) is sometimes grouped with cybersecurity funds because it shares Global X’s thematic branding and trades in the same digital transformation neighborhood. The fund holds payment processors, digital banks, and blockchain platforms, and its five-year return of -43 % reflects fintech’s post-2021 derating rather than anything specific to security spending. Reddit discussion captured on r/stockmarket recently centered on the question, “Fintech valuations have been reset hard, opportunity or value trap?, a debate with little connection to cybersecurity exposure. With shares near $26 and a beta of 1.84, FINX carries plenty of volatility, just not the kind tied to security spend.

BUG works for investors who want a concentrated, globally diversified pure‑play on cybersecurity and are comfortable with the sharper swings that come with a portfolio heavy on cloud‑focused names. SPAM is a better fit for investors who put low fees first and don’t mind a shorter track record or a smaller asset base. CIBR appeals to investors who want the deepest liquidity and a tilt toward larger, more established security vendors, even if that means giving up some upside during a pure‑play rally.

This analyst’s 2025 picks are up 106% on average. He just named his top 10 stocks to buy in 2026. Get them here FREE.