Link’s Favorite Long-Term Themes: Cybersecurity

The Growing Need for Cybersecurity

Cybercrimes costed governments and corporations over $8 trillion dollars in 2023; greater than Japan’s, Germany’s, and India’s annual gross domestic product.^[1] More importantly, the cost of a data breach is increasing. In 2024, the average data breach cost $4.9 million in recovery expenses, up 10% y/y, in part due to business disruptions and increased customer support. As more of the world moves online, storing and protecting data is going to be of utmost importance.

Chart 1: The Average Cost of a Data Breach is Up 26% Since 2018^[2]

Recent Cybercrimes Prove the Importance of Security

Protecting against cyber-attacks is one of the top priorities for CEOs, CTOs, and management teams. Over 70% of breached organizations have stated that the attack caused significant or very significant business disruptions.^[3] Satya Nadella, Microsoft’s (MSFT) CEO, mentioned on MSFT’s most recent earnings call that “we continue to prioritize security above all else.” Microsoft Defender for Cloud, MSFT’s cloud security platform, recently surpassed $1 billion in revenue as customers have increased demand for security solutions. Cybersecurity is one area companies must not lack spending as attacks seem to be hitting new highs every year.

CrowdStrike’s (CRWD) recent IT outage, not cyberattack, showed the scale to which an attack could impact the globe. CRWD released a faulty software update which is integrated with Microsoft Windows, ultimately causing some Windows computers to crash. Microsoft reported that 8.5 million Windows devices were affected, less than 1% of its global install base.^[4]

In total, the crash cost Fortune 500 companies over $5 billion in direct losses – not factoring in possible reputational damage. Airlines were some of the worst hit, especially Delta Airlines (DAL). The impact on DAL lasted five days with over 7,000 flights cancelled. The cancellations affected 1.3 million customers and cost the company over $500 million. 60% of DAL’s mission-critical applications rely on Windows and the company had to physically reset 40,000 servers.^[5] The healthcare and banking sectors were also hit hard, with losses estimated between $1.15 and $1.94 billion.^[6]

However, CRWD’s defective update was much more contained than previous attacks. In 2023, Johnson Controls (JCI) and MGM Resorts (MGM) experienced two of the worst cyberattacks in recent years. In September, JCI received a ransomware attack demanding $51 million for the return and safety of its data. JCI recorded a $23 million cyber incident cost in the quarter for IT recovery, an investigation, third-party expenditures, and more.

MGM faced a similar situation at the end of 2023 which cost the company $100 million in lost revenue. The hackers disrupted digital room keys, slot machines and websites, and even disabled online reservations. The hacking group used LinkedIn to impersonate an MGM Resorts employee, calling the MGM IT desk and extracting information to gain access to internal software and platforms.^[7] MGM’s Las Vegas segment was impacted the most, seeing its margins decrease by 200 basis points with an 8% decline in net revenue during the quarter. In response, the company stated they planned to invest $30 to $40 million in IT hardware and capital expenditures to enhance their cybersecurity infrastructure.

Chart 2: Cybercrimes Will not Be Slowing in Coming Years^[8]

How We Are Exposed to This Theme

Unlike last week’s discussion on Power Demand and Grid Infrastructure, fewer sectors are beneficiaries of an increased cybersecurity need across the economy. The companies with the greatest exposure to this theme would be the cyber companies themselves: CrowdStrike (CRWD), Palo Alto Networks (PANW), Fortinet (FTNT), and others. Mega-cap technology companies can be thought of as a second derivative play, as these companies have vast amounts of data, greatly emphasizing privacy, with a few even having cyber-security products that they sell in tandem with cloud packages.

CRWD is the number one player in the cyber industry with a strong management team. The stock fell as much as -41% from its highs, and we began a position earlier this quarter amid the selloff. We expect that its coming quarterly results will likely be below estimates, with management possibly lowering guidance. It is important to note that the IT outage was caused by a software bug, not negligence or an attack of any kind. We found confidence in their management team for how proactive they were in providing resolutions to clients. Transparency will go a long way towards supporting the business and brand longer-term.

Over the long term, CRWD is positioned to succeed in the cyber industry with a $100+ billion total addressable market in 2024, which is expected to hit $225 billion by 2028. CRWD boasts vast products and is the industry leader in endpoint detection with a strong next-gen software-as-a-service (SaaS) platform. They are pairing a strong endpoint detection product with identity protection, cloud workload protection, and are beginning to use AI in other areas of their business. We viewed the selloff as “quality on sale” and are looking to add in any further weakness.

Chart 3: CRWD’s Decline in Valuations in Late July Offered a Compelling Entry Point^[9]

Broadcom (AVGO) and International Business Machines (IBM) are the second way we are positioned for the growing cybersecurity market. AVGO’s recent acquisition of VMWare broadened AVGO’s reach, pushing the company into cloud computing and virtualization. VMWare’s main offering, a hypervisor, allows customers to run virtual desktops away from host computers. The company offers security products to properly store and protect cloud data. The work-from-home environment is becoming more mainstream, and VMWare supplies the services to make this possible and protect data along the way.

IBM Z is a combination of IBM’s mainframe computers and system software that provides an operating system, cloud computing, security, and more. Its latest iteration, z16, offers AI referencing capabilities and advanced cybersecurity protection. IBM recently partnered with PANW to advance WatsonX with AI-powered security solutions – IBM’s AI-integrated cloud software. IBM is improving security across its product offerings and is attentive to the increased need for cybersecurity across its customers.

Looking Ahead

Cybersecurity needs are not likely to slow in the coming years. Global cyberattacks increased 45% y/y in 2023 and U.S. ransomware attacks grew 102% y/y. The energy sector was hit especially hard, as ransomware attacks grew 527% in 2023.^[10] McKinsey projects that global cybersecurity could reach a total addressable market of $1.5 to $2 trillion, a 10x upside from the current market size.^[11] We see this theme as a growing trend across the economy and are positioned to gain from increased spending in data privacy and protection.

Chart 4: The Global Cybersecurity Market Has 10x Upside^[12]

Stephanie Link’s TV Schedule:

Sources

^[1] Source: Evolution Equity Partners. As of August 2024.

^[2] Source: JP Morgan. As of August 1, 2024.

^[3] Source: JP Morgan. As of August 1, 2024.

^[4] Source: Microsoft. As of July 20, 2024.

^[5] Source: Travel Weekly. As of August 16, 2024.

^[6] Source: CNN. As of July 24, 2024.

^[7] Source: University of Hawai’I – West O’Ahu. AS of October 24, 2023.

^[8] Source: Statista. As of February 22, 2024.

^[9] Source: FactSet. As of August 19, 2024.

^[10] Source: JP Morgan. As of August 1, 2024.

^[11] Source: McKinsey & Company. As of October 27, 2022.

^[12] Source: McKinsey & Company. As of October 27, 2022.

Disclosures:

Investment Solutions is a group comprised of investment professionals registered with Hightower Advisors, LLC, an SEC registered investment adviser. Some investment professionals may also be registered with Hightower Securities, LLC, member FINRA and SIPC. Advisory services are offered through Hightower Advisors, LLC. Securities are offered through Hightower Securities, LLC. This is not an offer to buy or sell securities. No investment process is free of risk, and there is no guarantee that the investment process or the investment opportunities referenced herein will be profitable. Past performance is neither indicative nor a guarantee of future results. The investment opportunities referenced herein may not be suitable for all investors. All data or other information referenced herein is from sources believed to be reliable. Any opinions, news, research, analyses, prices, or other data or information contained in this presentation is provided as general market commentary and does not constitute investment advice. Investment Solutions and Hightower Advisors, LLC or any of its affiliates make no representations or warranties express or implied as to the accuracy or completeness of the information or for statements or errors or omissions, or results obtained from the use of this information. Investment Solutions and Hightower Advisors, LLC assume no liability for any action made or taken in reliance on or relating in any way to this information. The information is provided as of the date referenced in the document. Such data and other information are subject to change without notice. This document was created for informational purposes only; the opinions expressed herein are solely those of the author(s) and do not represent those of Hightower Advisors, LLC, or any of its affiliates.