Cyber defense: protection in a digitalized world

The cyber security market has long been a robust and rapidly growing sector, projected to reach a volume of 563 billion US-Dollars by 2032 (Fortune Business Insights, 2025, Cybersecurity Market Analysis), driven by double-digit annual growth rates. There are numerous factors driving the strong demand for effective cyber protection measures. For example, the number of connected devices is expected to increase from 19,8 billion in 2025 to 32,2 billion by 2030, each of which represents a potential entry point for cyberattacks (Statista, 2025, Number of Internet of Things (IoT) connections worldwide).

Further vulnerabilities arise with the increased cloud adoption. As cloud-based applications and workflows continue to grow, they contribute to a more complex security landscape, expanding the range of potential entry points that organizations need to secure.

Artificial intelligence could lead to more frequent and more sophisticated cyberattacks as they become more automated, highly personalized, and easily scalable. According to McKinsey, there has been an astounding 1200%-surge in phishing attacks since the rise of generative AI in late 2022 (McKinsey&Company, 2025, “AI is the greatest threat—and defense—in cybersecurity today. Here’s why”). As the world becomes more digital, cyberwarfare is also gaining in importance, with nation-sponsored cyberattacks against Western entities on the rise (Morningstar, 2025, Industry Landscape: Cybersecurity).

Not only are there more types of threats, but the frequency of attacks and their costs are also increasing. Projected costs will reach USD 10.3 trillion by 2025 (Business Standard, 2024, Cybercrime costs to hit USD 10.5 trn by 2025: How insurance may save your biz) — 30 times greater than estimated losses from natural disasters and equivalent to 9,5 percent of global GDP. These threats target governments and critical infrastructure, such as water systems, with devastating consequences. As AI-driven attacks and cyber warfare intensify, the urgency to invest in robust cyber defense and security solutions has become a critical priority for safeguarding both economies and societies.

This is also confirmed by surveys conducted among companies by Flexera, which found that 77% of organizations (Flexera, 2025, State of the Cloud Report) ranked security as a top cloud challenge, the second highest behind cloud spending management (see chart 2). And cyber security continues to be one of the top IT spending areas in 2025, according to Flexera.   

While the term cyber security is often seen as the broader discipline encompassing all measures to protect digital assets, cyber defense specifically focuses on the active, proactive measures taken to defend against cyberattacks. In this report, however, we use the term cyber defense to refer to the military and government side of cyber security.

As already mentioned, in a digital world, cyber warfare has gained importance in recent years. According to Morningstar, the threat profile has evolved over the past 6 years towards state-sponsored cyber warfare (Morningstar, 2025, Industry Landscape: Cybersecurity). While the attacks are sponsored by state actors, the targets extend far beyond government infrastructure. Most attacks by nation states target civilian infrastructure, with companies being the largest target. In 2024, cyberattacks on critical infrastructure increased by 30%. One example was the cyberattack on American Water, the largest American water utility company, which supplies water to 14 million people across 14 states and to military bases (Committee on Homeland Security, 2024, Cyber Threat Snapshot' Highlighting Rising Threats to U.S. Networks & Critical Infrastructure). It becomes clear that today’s wars are fought with code – not just missiles. 

In the current geopolitical situation, governments are building up their defense capabilities. NATO is expected to spend USD 1.2 trillion more on defense by 2035. But these expenditures are not only used for missiles, because cyber defense spending has become a top priority. European nations are already prioritizing cyber defense. France and UK announced EUR 5 billion and GBP 1 billion for their cyber forces. This shift reflects the growing need to protect critical infrastructure and address state-level threats, positioning cyber defense as the next frontier in safeguarding our digital and physical worlds. Commitments have been made, but the deployment of capital is just beginning.

Investors who want to invest in this structural theme, should adopt a thematic investment approach and focus on six key subthemes: 

1. Cyber Defense & Space

   Firms that provide defense platforms for critical infrastructure (e.g. satellites) and frontier technology. An example would be Palantir, which offers software to support government agencies with intelligence and operational decision-making solutions.
   
   

2. Identity & Access

   Identity and access management manages and controls user access to an organization's digital resources. It ensures that the right individuals have the appropriate level of access to the right resources at the right time, preventing unauthorized access and potential security breaches. 
   
   

3. Network security

   Firms like Fortinet that are experts in securing networks and devices against hacking and malware.
   
   

4. Threat Intelligence

   One example is CrowdStrike, with its cloud-based endpoint security platform that uses AI-driven threat detection and response to prevent security breaches.
   
   

5. Cloud & Apps

   Companies like Cloudflare offer platforms that protect websites and apps from attacks.
   
   

6. Data Protection

   Firms that provide solutions for data privacy and resilience throughout the entire lifecycle. 
   
   

These subthemes are directly tied to the market’s growth drivers, such as increasing cyber threats, the rise of connected devices, and growing geopolitical tensions. The strategy aims to capitalize on both the established cybersecurity market and the emerging frontier of cyber defense. 

Cyber defense and security stand at a pivotal moment, driven by escalating threats and increasing global defense commitments. Cyber defense and security is not just an investment theme—it is essential for protecting the future.

The Index Strategy focuses on shares of high-conviction cyber defense & security companies. It follows a targeted thematic investment approach with a focus on companies that are associated with or derive a significant proportion of their revenue from cyber defense & space, identity & access, network security, threat intelligence, cloud & apps, and data protection. The selection is based on quantitative and fundamental factors such as earnings, momentum and profitability. Subsequently, at least 60% (15 core names) of the constituents are chosen by market capitalization, while the remaining 40% (10 high-conviction picks) are selected based on discretionary convictions of the index sponsor. The maximum weight for shares and other equities in the Index is limited to 10%. 

The Index Calculation Agent is advised by an Index Sponsor for the purpose of the composition of the Index. The Index Sponsor is Vontobel Asset Management AG.