Cybersecurity ETFs: nearly all hold Palo Alto Networks and CrowdStrike

What are cybersecurity ETFs?

Cybersecurity companies sell the software, hardware and services that protect networks, devices, cloud systems and data from attack. The nine US-listed cybersecurity ETFs give investors a stake in these companies, and they lean on the same names. Palo Alto Networks, CrowdStrike and Okta each appear in eight of the nine funds. Fortinet, Zscaler and Varonis Systems each appear in seven. CIBR and HACK also hold broader technology companies, Cisco Systems and Broadcom, among their five largest positions.

All nine are built around an index, a rules-based list of stocks, rather than a manager's picks, but the indexes differ. CIBR tracks the Nasdaq CTA Cybersecurity Index, HACK the Nasdaq ISE Cyber Security Select Index and BUG the Indxx Cybersecurity Index. Some are concentrated: BUG keeps 59.73% of its money in its ten largest holdings. FITE follows the S&P Kensho Future Security Index and spreads across 79 holdings, with 16.49% in its top ten. IHAK's index includes companies from developed and emerging markets. One fund, ProShares' UCYB, uses leverage to aim for twice the daily return of CIBR's index. No fund in the group bets on falling prices.

Costs vary widely. The median expense ratio, the yearly fee taken as a share of assets, is 0.47%. Xtrackers' PSWD charges the least, 0.20%, and UCYB the most, 0.95%. The two largest funds sit above the median: CIBR charges 0.58% and HACK 0.60%.

Money is concentrated, too. The group held about $18.9 billion as of October 29, 2026, and 99.3% of it sat in the five largest funds: CIBR, HACK, BUG, IHAK and FITE. CIBR alone held about $13.8 billion, while the smallest, SPAM, held about $5.0 million.

Cybersecurity ETF holdings: the stocks most funds own

The stocks that show up most often among the largest positions of the 9 biggest cybersecurity ETFs with holdings reports, from their latest N-PORT filings.

Typical weight is the median share of each fund’s assets in the stock, among the funds that hold it in their 25 largest positions.

The largest cybersecurity ETFs, side by side

Swipe the table to see all 5 funds.

The largest ordinary funds by net assets (leveraged and inverse funds are listed further down). Holdings from each fund’s latest N-PORT report; returns include reinvested distributions, as of Nov 2, 2026.

Head to head

How much do the largest cybersecurity ETFs overlap?

Owning two funds that hold the same stocks adds little diversification. Overlap here is the share of assets two funds have in common: for each stock both own, the smaller of its two weights, added up.

From each fund’s full holdings in its latest N-PORT report.

How have cybersecurity ETFs performed?

The five largest ordinary funds: growth from the start of the range, distributions reinvested. The dashed gray line is the S&P 500 (SPY).

Best-performing cybersecurity ETFs over the past year

Funds with at least $25 million in net assets; leveraged and inverse funds left out. Past returns don’t predict future returns.

How cybersecurity ETFs did in past market crashes

Total return from the stock market’s peak to its low in each fall, distributions reinvested.

What drives cybersecurity ETFs?

Cybersecurity companies earn their money from businesses and governments that pay to protect networks, devices, cloud systems and data. Many sell software by subscription, which can make revenue steadier than one-off sales. Growth still depends on corporate technology budgets, the pace of new threats and high-profile breaches, rules that require organizations to guard data and report attacks, and price competition among vendors. Investors often value fast-growing software companies on profits expected far in the future. That makes their shares sensitive to interest rates, because higher rates shrink what those distant profits are worth.

In past sell-offs the funds have not moved as one. In the 2020 COVID crash, when the S&P 500 fell 33.7%, IHAK fell 25.3%, BUG 27.7%, HACK 29.3% and CIBR 29.5%, while FITE dropped further, 35.8%. The 2022 bear market went the other way. The S&P 500 fell 24.5%, but HACK lost 31.2%, CIBR 28.5%, BUG 27% and IHAK 26.8%. FITE, the most spread-out fund, fell 21.2%. None of these funds existed in the 2008 financial crisis, when the S&P 500 fell 55.2%.

Cybersecurity ETFs with the lowest expense ratios

Ordinary funds with at least $10 million in net assets. The median ordinary cybersecurity ETF charges 0.45% a year; leveraged and inverse funds usually charge more.

Do cybersecurity ETFs pay dividends?

7 of the 8 ordinary cybersecurity ETFs with a page here paid distributions over the last 12 months, with a median yield of 0.1%.

Distributions over the last 12 months divided by the price; funds with at least $25 million in net assets.

How to choose a cybersecurity ETF

• Fees run from 0.20% to 0.95%. PSWD charges 0.20% but held only about $8.9 million. Among larger funds, FITE and WCBR charge 0.45% and IHAK 0.47%, against 0.58% for CIBR and 0.60% for HACK. The 2x fund UCYB charges 0.95%.
• Concentrated or spread out. BUG puts 59.73% of its money in its ten largest holdings and CIBR 58.06%, so a few stocks drive results. FITE spreads across 79 holdings, with 16.49% in its top ten. IHAK sits between, at 45.07%.
• Different indexes, different stock lists. CIBR tracks the Nasdaq CTA Cybersecurity Index, HACK the Nasdaq ISE Cyber Security Select Index and WCBR the WisdomTree Team8 Cybersecurity Index. FITE's S&P Kensho Future Security Index casts wider, with Viasat and BlackBerry among its largest holdings.
• Global reach or mostly US names. IHAK is the only fund whose stated objective spells out companies from both developed and emerging markets. The largest positions in the other funds are mostly US-listed companies such as Palo Alto Networks, CrowdStrike and Fortinet.
• Fund size and track record. CIBR held about $13.8 billion, and HACK, launched in 2014, has the longest record. SPAM and PSWD, both launched in 2023, held about $5.0 million and $8.9 million. Very small funds can cost more to trade and sometimes close.
• UCYB is a 2x daily tool. UCYB aims for twice the daily move of CIBR's index, the Nasdaq CTA Cybersecurity Index. Because it resets daily, results over months can stray far from 2x, and its price swings have been far wider than CIBR's.

What are the risks of cybersecurity ETFs?

• A handful of stocks dominate. Palo Alto Networks and CrowdStrike sit in eight of the nine funds. In CIBR, the ten largest holdings make up 58.06% of assets, and Palo Alto alone 9.62%, so a stumble at one company moves the whole fund.
• Big swings, even in strong years. In the year to October 29, 2026, BUG gained 46.9% but fell as much as 35.1% along the way. WCBR's volatility, a gauge of how widely prices swing, reached 40.4%. Even FITE, the calmest, dropped 15.3%.
• Deeper falls than the market in 2022. In 2022's bear market, HACK fell 31.2% and CIBR 28.5%, against 24.5% for the S&P 500, though most fell less than the index in the 2020 crash. Growth stocks valued on distant profits tend to suffer when interest rates rise.
• UCYB's 2x leverage resets every day. UCYB targets twice the index's daily return, not its return over months. In choppy markets, daily resets can erode value even if the index ends flat. In the year to October 29, 2026, its deepest drop was 42.5%.
• Two funds can mean the same stocks. HACK and BUG share 65% of their assets, and BUG and IHAK 62.3%. Holding two of these funds can add less variety than the different names suggest.

Leveraged and inverse cybersecurity ETFs (2x)

These funds aim for a multiple, or the opposite, of one day’s return, and reset every day. Held for longer than a day, their results can drift far from that multiple, especially when prices swing. They are trading tools, not long-term holdings. Why leveraged ETFs decay →

List of all cybersecurity ETFs, by size

All 9 cybersecurity ETFs, compared →

More technology & innovation guides

Broad Technology39 ETFsSemiconductor36 ETFsCryptocurrency59 ETFsArtificial Intelligence29 ETFsInternet17 ETFsRobotics & Automation7 ETFsCloud Computing6 ETFsInternet Infrastructure4 ETFs