Every major breach, ransomware incident or AI-powered threat seems to reinforce the same conclusion: security spending must rise, so cybersecurity shares must be good investments. That conclusion is too quick.
Gartner expects worldwide end-user spending on information security to reach $244 billion in 2026. Regulators are also treating cyber risk as a boardroom and investor issue. But an expanding market does not automatically create an attractive investment.
A good theme is not yet a good business. A good business is not yet a good buy.
Copy and save this somewhere so you remember it.
At ViA, I teach S.E.G.A. as a disciplined sequence for investing decisions: Search for good businesses, Evaluate their competitive advantage, management and financial strength, Gauge intrinsic value, then build an Asset Portfolio that protects you from one mistake. Cybersecurity belongs in the Search stage. It is a place to look, not a reason to buy.
The ViA Funnel turns a compelling headline into a company-specific answer. Start with your Circle of Competence: can you explain what the company sells and why a customer renews? Test its moat with SCAN: Switching costs, Cost advantage, Asset value and Network effect. Review management, then follow gross margin, free-cash-flow conversion, retention, debt and dilution. Finally, identify risks before you value the business.
Do not award a moat because a product uses AI or has an impressive dashboard. In cybersecurity, features can be copied. A real moat appears in renewals, pricing discipline, lower churn, efficient sales and the ability to expand within existing customers.
Revenue growth is useful, but it is not the finish line. A subscription company may report strong billings while spending too much to acquire each customer. Another can grow more slowly but retain customers, widen margins and convert more cash after reinvestment. The second business may be more valuable, even when it sounds less exciting.
Cybersecurity matters, but not every purchase is equally urgent. In a tighter budget cycle, customers may consolidate vendors, delay projects or choose cheaper tools. Watch for customer concentration, dependence on large platforms, high stock-based compensation, weak free cash flow, acquisitions that hide organic growth and valuations that leave no room for disappointment.
Never compare share price with share price. Compare price with intrinsic value. Use conservative assumptions for long-term growth, margin potential and the cash needed to keep the technology competitive. If everything must go right for your return to be acceptable, there is no margin of safety.
- What makes the revenue recurring? Look beyond the subscription label. Understand renewals, contract duration and the cost of switching.
- What makes the economics improve? Identify evidence for margin expansion and free-cash-flow conversion, not just a large addressable market.
- What can invalidate the thesis? Write down the risk before you buy.
A diversified, low-cost broad-market index fund remains a valid long-term path for investors who prefer broad exposure, regular contributions and less company-specific work. Individual-company analysis is an additional path for investors who want to understand businesses more deeply.
The cybersecurity theme may remain durable for years. Your investment result will still depend on the quality of the business and the price you pay.
Want to learn how we analyse durable businesses step by step? Join our upcoming webinar below!
