For Both Growth and Defense Investment, Think Cybersecurity

In early 2024, an alarming new form of cybercrime emerged.

It involved scammers calling up a target and claiming to have kidnapped their child or other loved one. In the background, an AI-generated imitation of the loved one’s voice could be heard crying desperately for help.

In a variation of this deception, scammers are using the same technology to mimic the voices of senior corporate leaders to urge junior employees to complete fund transfers.

These are just two examples of how generative AI is already enabling sophisticated and highly personalized new frauds.

Beyond financial losses to individuals and enterprises, AI-empowered cyberattacks may also pose a threat to economic activity and international relations.

In its latest Global Risks Report, the World Economic Forum’s Global Risks Perception Survey ranks cyberattacks as the fifth most likely risk to present a material crisis on a global scale in 2024. (AI-generated misinformation was ranked second.)

“Cybersecurity threats are escalating and create the potential for an exogenous global shock,” says Steven Wieting, Citi Wealth’s Chief Investment Strategist and Chief Economist. “There have been threats to our satellite networks and state actors seeking to attack our infrastructure. Now, AI can enhance the hacking threat, creating a new arms race to protect our networks. Consumers, companies and governments have all turned to the cybersecurity industry to help them navigate a growing range of threats, which suggests a potential opportunity for investors. Cybersecurity shares may also act as a hedge against the risk of a global shock that could derail economic growth. These two factors augment cybersecurity investing’s appeal, despite some short-term headwinds facing the industry.”

Wieting notes that “A growth investment that may protect the investor from shocks is a pretty rare combination.”

While cybersecurity investments may help mitigate certain risks to portfolios, they also come with risks of their own. Individual companies may fail to innovate quickly enough, such that their products offer inadequate defenses against the latest cyber threats. Some firms have concentrated customer bases, which might constrain their pricing power. And if a cybersecurity firm itself falls victim to a cyberattack, the negative publicity could be damaging to its business. All these factors and more could harm the value of cybersecurity investments.

Attacks grow in cost and complexity 

Cybercriminals come in every shape and size, from basement-lurking loners to organized gangs and state-sponsored actors engaged in so-called hybrid warfare. As the attackers grow more sophisticated, so do the attacks. According to a 2023 report by Citi GPS and the University of Oxford, the number of cyberattacks has grown in recent years, as have their cost and complexity, as measured by the number of days required to recover from them.

The evolution of corporate technology has compounded the problem: The migration to the cloud and the adoption of remote systems to allow hybrid work have increased the attack surface for cybercriminals.

Companies are scrambling to respond to the quickly evolving cyber landscape, and to comply with increasingly stringent laws and regulations governing data protection and attack response. However, as Citi GPS notes, the cybersecurity industry faces a critical shortage of talent. With in-house expertise scarce, companies are looking to the cybersecurity industry to help them with threat reduction.

A major risk factor for business

Citi Wealth’s survey of chief technology officers at large US firms—highlighted in its Wealth Outlook 2024—indicates that cybersecurity continues to be a top IT budget priority. Total spending has more than doubled over the past decade, with most of the newer spending going to external vendors, spurring the growth of the industry.

Cybersecurity has been a “double-digit area of investment growth amid a slow-growing investment environment,” says Wieting. “Equipment and software investing have not been particularly robust in the last few years, but cybersecurity has been a standout area of strength in terms of growth.”

There is still room for the cybersecurity industry to grow. A 2022 analysis by McKinsey found that “currently available commercial solutions do not fully meet customer demands,” which implies that many companies are underinvesting in cybersecurity relative to their needs. As both threats and defensive measures proliferate, McKinsey estimates that the addressable global cybersecurity market could grow to $2 trillion.

Investing in a fragmented industry

Cybersecurity shares have had a good run over the past five years, with the NASDAQ CTA Cybersecurity Index well outperforming the S&P 500 index. But what about the next five years? Short-term, cybersecurity may lag, says Wieting. The industry is highly fragmented, and some proprietary solutions are subsumed by large networking companies. However, a wave of consolidation could help both companies seeking all-in-one cybersecurity solutions and investors seeking to profit from the growing demand.

Beyond their growth potential, cybersecurity stocks may also bring certain defensive qualities to a diversified asset allocation. In 2017, shares in cybersecurity-focused companies surged in the wake of the high-profile and costly WannaCry and NotPetya cyberattacks. Such holdings could potentially help cushion the blow to portfolios if a major cyberattack led to a general market downturn in the future.

Citi’s Wealth Outlook cites cybersecurity software as a “critical defensive investment.” Cybersecurity tends to be less cyclical than many other technology subsectors, such as gaming and hardware, notes Wieting. It may not be realistic to expect that cybersecurity stocks will soon replicate their recent stellar performance, but the growth potential for the industry remains strong.

Citi Private Bank—the unit of Citi’s wealth organization that serves ultra-high-net-worth individuals—helps clients build exposure to key trends. Insights from Wieting and his team guide the weightings of clients’ core and opportunistic portfolios, based on Citi Private Bank’s distinctive strategic asset allocation methodology. Citi Private Bank uses this methodology to develop a long-term plan that serves each client’s needs, while making tactical adjustments to this plan based on the outlook for the next 12 to 18 months.

Learn more about how Citi Private Bank can guide investment allocations for ultra-high-net-worth investors here.

INVESTMENT PRODUCTS: NOT FDIC INSURED · NOT CDIC INSURED · NOT GOVERNMENT INSURED · NO BANK GUARANTEE · MAY LOSE VALUE.

Views, opinions and estimates expressed herein may differ from the opinions expressed by other Citi businesses or affiliates. The information contained herein is not intended to be an exhaustive discussion of the concepts mentioned herein or tax or legal advice. Readers interested in the concepts should consult their tax, legal or other advisors. You can read our full disclaimer here.