Cybersecurity Acts: A New Era for Tackling Cybercrime

Last year, the FBI received the highest number of cyber complaints and total losses ever – almost 850,000 complaints totalling over $6.9bn in losses. Annual internet traffic is projected to grow another 50% over the 2020 level this year, reaching 4.8 zettabytes (that is 48,000,000,000,000,000,000,000 bytes!)¹

To put this in context, each minute 695,000 Instagram stories are shared, 200 million emails are sent, and $1.6m is spent online, globally.² Even though so much of our lives, and especially our work is spent online, this data is not secured. Ransomware attacks increased 151% in 2021 from the previous year.³ Uber, Morgan Stanley and American Airlines have all reported cybersecurity incidents in the last week alone.

Technology is evolving at lightning speed and companies have little choice but to keep pace when it comes to security. On average, every cyber breach costs a company $3.6m and a 3% drop in the stock price within six months.⁴ It is no wonder companies worldwide are on heightened alert. This has only increased in the wake of the Russia-Ukraine war, with reports of an 800% increase in cyberattacks in the build-up to the invasion,⁵ leading to more volatility and fears of cyber warfare. President Biden even warned that if the U.S. ended up in a “real shooting war” with a “major power” it could be the result of a significant cyberattack.

It makes sense that cybersecurity has been top of the agenda for the Biden administration, particularly after a sequence of high-profile attacks including on SolarWinds, the Colonial Pipeline company, and the meat processing company JBS, affecting global fuel and food supplies. New regulations by the federal governments demonstrate that cyber risk is seen not just as a business risk, but as a risk to the modern world.

We’ve broken down the new regulations below, outlining what the rules mean and the industries most impacted:



The new rules move beyond a carrot and stick approach, and essentially force companies into heightened visibility on cybersecurity disclosures: meaning they must inform the world about the cyberattacks they face. Before this, there were two approaches a company could take following a hack – to conceal it (i.e. quietly paying the ransom) or to make it public. The CISA and SEC rules take away the first option by making disclosure mandatory. Before these rules, estimates of reported cyber incidents ranged between 10%-25%, so understanding the scale of attacks taking place was almost impossible.

It is very likely that the number of reported cybersecurity attacks will rise tremendously with companies forced into transparency.

Although the incident disclosure rules have gained the most attention, what has been overlooked are the rules on the board’s role in cyber strategy. Currently, many companies do not have policies for board-level reporting on cybersecurity, and not all boards view cyber risk as part of the overall business strategy. The SEC rules are a game changer – meaning board-level cybersecurity is here to stay.

What does this mean for the cybersecurity industry? Well if companies were not already amping up their cybersecurity capabilities, then these regulations will almost certainly force them to. Gartner estimates that enterprises are likely to spend $172bn on cybersecurity in 2022 alone, with 81% of organisations increasing their cybersecurity budgets.⁶ Even as companies navigate the current macro uncertainty, there is likely a long list of cuts that can be made ahead of IT and related cybersecurity spending.

As thematic investors, our view to navigating the current volatility is to look for the most certain, convincing and essential revenue streams. Companies at the forefront of the cybersecurity industry are fast becoming the utilities of the digital age. The First Trust Nasdaq Cybersecurity UCITS ETF provides exposure to a well-diversified range of innovative companies that are well positioned to benefit from their involvement in cybersecurity, without having to pick the overall winners and losers.

Sources

1. Cisco
2. Weforum.org
3. SonicWall
4.World Economic Forum
5. Forbes
6. Nasdaq

Important Information

References to specific companies should not be construed as a recommendation to buy or sell shares or other financial instruments issued by those companies, and neither should they be assumed profitable. You should consider the fund’s investment objectives, risks, and charges and expenses carefully before investing.

This marketing communication is issued by First Trust Global Portfolios Limited (“FTGP”) of 8 Angel Court, London, EC2R 7HJ. FTGP is authorised and regulated by the UK Financial Conduct Authority (register no. 583261).

Nothing contained herein constitutes investment, legal, tax or other advice and it is not to be solely relied on in making an investment or other decision, nor does the document implicitly or explicitly recommend or suggest an investment strategy, reach conclusions in relation to an investment strategy for the reader, or provide any opinions as to the present or future value or price of any fund.