Cybersecurity: a strategic investment in a dangerous, uncertain world

[SINGAPORE] As digital transformation accelerates, the need for cybersecurity has become more critical than ever. The rise of cloud-based services, advanced technologies such as generative artificial intelligence (GenAI), and intensifying geopolitical tensions have all contributed to a more complex and dangerous threat environment.

Data from Check Point Research shows that the global average number of weekly cyberattacks per organisation has more than doubled from 818 in the second quarter of 2021 to 1,984 in Q2 2025. Data breaches have also become more costly, with the average cost climbing 26 per cent from US$3.9 million in 2020 to US$4.9 million in 2024.

As threats intensify, businesses and governments are stepping up their cybersecurity spending. According to Grand View Research, the global cybersecurity market is projected to grow from US$245.6 billion in 2024 to US$500.7 billion by 2030, at a compound annual growth rate (CAGR) of 12.6 per cent.

AI: threat and driver of cybersecurity demand

The rise of GenAI is reshaping both the threat landscape and the demand for modern security solutions. Cybercriminals are now using large language models to research targets, craft highly convincing phishing messages, and write malicious code. Even more alarmingly, AI tools can create realistic deepfakes of voices and videos, which are increasingly used to defraud businesses.

In Hong Kong last year, a financial worker at engineering firm Arup was deceived into transferring HK$200 million (S$32.8 million) to criminals during a video call populated entirely by deepfakes of senior executives.

The advent of agentic AI adds a new layer of complexity to the threat landscape. Autonomous and adaptive in nature, AI agents can be used by attackers to bypass traditional defences more easily and enable even less-skilled threat actors to carry out highly effective and large-scale campaigns.

As businesses themselves increasingly deploy AI agents to boost efficiency, they inadvertently introduce new security vulnerabilities. These agents can be manipulated through prompt injection attacks, where malicious prompts masquerade as legitimate commands, leading to the unintended disclosure of sensitive data or execution of harmful actions.

These evolving threats are driving greater demand for advanced cybersecurity solutions. Identity security tools are becoming essential for managing not only human but also machine identities. Additionally, new GenAI-specific protections are emerging, such as prompt-level visibility features that monitor and block policy-violating prompts in real time.

Meanwhile, the shortage of cybersecurity professionals is also fuelling demand for AI-powered automation tools that help analysts respond to threats faster and more effectively.

Despite the escalating threat landscape, AI adoption in cybersecurity remains limited. A Ponemon Institute survey found that nearly 70 per cent of organisations are either not using AI at all or are doing so only to a limited extent. This highlights a significant, untapped opportunity for vendors capable of delivering effective AI-driven security solutions.

Cybersecurity spending is resilient across economic cycles

Cybersecurity is mission-critical; that does not change even in an economic downturn. A Q2 Morgan Stanley survey of chief information officers found that security software is considered the area least likely to face budget cuts if macroeconomic conditions worsen.

This is unsurprising given that cyberthreats persist in any economic environment. Breaches can lead to massive financial losses, reputational damage, and the undermining of critical infrastructure and national security.

In a recent example, Microsoft accused hackers linked to the Chinese government of exploiting vulnerabilities in its SharePoint system to steal confidential data from hundreds of businesses and government agencies, including the US National Nuclear Security Administration.

Looking ahead, governments are expected to continue increasing their cybersecurity budgets, benefiting cybersecurity companies that government agencies outsource projects to. Furthermore, strict enforcement of cybersecurity regulations such as the European Union’s General Data Protection Regulation and Singapore’s Cybersecurity Act will compel businesses to invest more in security solutions to ensure compliance.

Meanwhile, long-term structural trends such as digitalisation, AI and cloud adoption, will continue to underpin demand for cybersecurity, even in a slowing or uncertain economy.

Scalable business model

Many cybersecurity firms operate on a subscription-based model, which provides predictable recurring revenue. Their business is also supported by high switching costs, as changing security vendors can be complex, disruptive and risky. This leads to high customer stickiness, with leading firms consistently reporting gross retention rates of more than 95 per cent, implying a customer lifespan of about 20 years.

Firms offering a broad range of solutions, such as CrowdStrike and Palo Alto Networks, can also upsell and cross-sell, leading to net retention rates above 110 per cent.

Finally, the software-based nature of the industry makes it less vulnerable to supply chain disruptions and tariffs.

Overall, the combination of high customer stickiness and innovative solutions allows these firms to build substantial annual recurring revenue and sustain robust growth.

Defensive growth

In conclusion, the cybersecurity industry presents a compelling investment case, offering a rare combination of growth and resilience. As digital transformation accelerates and threats grow more complex, demand for advanced protection will only rise.

We favour platform providers with diversified offerings. Their integrated solutions are well-positioned to capitalise on the trend of vendor consolidation, where businesses seek to streamline their security operations and reduce costs.

For investors who want to gain broad exposure to this fragmented industry without picking individual winners, a cybersecurity exchange-traded fund is a good option.

The writer is a research analyst with the research and portfolio management team of FSMOne Singapore, the B2C division of iFast Financial