Traders cash in on soaring cyber stocks

Cybersecurity is all the rage on Wall Street.

Information-security spending is expected to more than double to $170 billion by 2020, and traders are rushing to capitalize on the boom. New cyber stocks are hitting the market on a regular basis, with every technical glitch and hack driving prices higher.

Just last week, an outage at the New York Stock Exchange — attributed to a software update that went awry — provided a boost to cyber stocks on the exchanges that remained online.

{mosads}”These days, every ‘glitch’ is a suspected cyberattack,” said Ray Rothrock, a Silicon Valley-based venture capitalist who backs a number of cybersecurity companies. “The cyber stock ups and downs are largely emotional. All the companies are all doing well financially, so it all depends on your speculation.”

For the last few years, it’s been nearly all ups, as hackers systematically broke into major retailers, banks, insurers and government agencies. In the first half of 2015, major cybersecurity firms have seen their stock skyrocket 30, 40, even 60 percent.

While analysts say the trend won’t abate any time soon, some investors are signaling a note of caution that buyers are blindly gobbling up any stock attached to the buzzy term, “cyber.”

“Most of the public companies today are selling solutions that are old and arguably obsolete, said David Cowan, a cyber-focused investor with Bessemer Venture Partners.

One of the firms whose stock has benefited from Wall Street’s cyber explosion is Proofpoint. The company’s stock has more than doubled over the last year, and has been creeping towards $70 per share in recent weeks.

“A lot of things have changed fairly radically in the last year in the security landscape which has, of course, led to a much bigger spotlight,” said Ryan Kalember, senior vice president of marketing at Proofpoint.

Following a rash of data breaches, Proofpoint’s services suddenly became in high demand, with executives seeking help with security basics like encrypting email, monitoring incoming messages and watching outgoing data.

“Many, many, many more [chief information security officer]-level conversions,” Kalember said. “Many more conversations with government agencies.”

“And,” he added, “it’s also of course reflected in the stock price.”

The firm is not alone. Nearly every major data breach in 2015 has translated to a stock surge for publicly traded security companies.

On June 5, the day after the government revealed the historic hack at the Office of Personnel Management, many high-profile cyber firms saw their share prices spike. Proofpoint jumped over 6 percent that day, one of its biggest single-day bumps of 2015.

Even cyber companies that haven’t yet hit the market are upping the goals for an initial public offering, or IPO.

In early July, Rapid7, a prominent Boston-based security firm, had to boost its IPO estimate by 38 percent due to high demand.

The company went public on Friday, pricing its stock at $16 a share, which still beat expectations, according to several reports. It immediately shot up over $26 a share, and finished at $25.25.

Traders are also bundling cyber stocks into what are called exchange-traded funds (ETF). An ETF can package dozens of companies, but trades as one stock.

The first cyber ETF, which goes by the symbol “HACK,” eclipsed $1 billion in assets within eight months of trading, a rarity on the markets. According to financial news site ETF Trends, roughly half of ETFs introduced each year fail to even reach $10 million in assets. In 2015, HACK is up nearly 20 percent, easily outpacing the overall market.

A second ETF, “CIBR,” hit the market in early July.

What has gone largely unnoticed by traders, experts say, is that each cyber company does something different.

Every time “something goes wrong,” Kalember said, “all of them seem to get a similar boost,” even if a company’s technology wouldn’t have actually helped prevent the latest attack.

That scares some analysts. Prices can only climb so high before tumbling.

“There are certainly companies in every part of the tech sector that have valuations that do not really strongly tie to their fundamentals,” Kalember said.

But Rothrock, who also is CEO of his own security firm, RedSeal, maintained that security companies are responding to “huge market problems.”

Each breach exposes another gaping hole in the country’s digital defenses.

“Cyber is not going away,” he said. 

But Rotchrock did warn that the sums public companies are paying to acquire even small private cyber firms are spiraling out of control, which could create a bubble.

Cowan believes it’s incumbent on increasingly massive public companies to use their vast “stock currency” to snap up “more relevant” technologies.

He pointed to a firm like FireEye, one of the hottest cyber stocks since it debuted in 2013. The company dropped $1 billion to buy Mandiant, a firm that made waves with its groundbreaking 2013 report tracing a wide swath of digital attacks on the U.S. to a 12-story building on the outskirts of Shanghai that housed China’s elite digital soldiers.

Without such acquisitions, “it will be another four to five years before the most effective solutions, the most effective startups even get to public offerings,” Cowan said.