Scoping Out Cybersecurity: BAE Systems, Avast, And Intercede

4th Jun '20 by Jack Brumby

36 comments 7462 reads

Risk in the market seems high at the moment - this rally is good for morale but it smacks of euphoria and relief. I’m not about to make short term forecasts, though.

Perhaps the positive momentum keeps going, economies recover quickly, and we all sail on to new all time highs - but I’m prepared for further volatility should that not come to pass.

In the short term who knows, but in the longer term you can be a little more clear-sighted. Investors that place themselves in markets with favourable long term growth trends allow structural growth characteristics to do more of the heavy lifting for them.

Following on from this look at IT value-added reseller Softcat, I’ve done some work on cybersecurity stocks. It’s one area that the world will need more of in the future - so finding well-run companies with good prospects in this sector makes sense.

Listed cybersecurity plays

I’ve constructed a 60-strong sample of listed cybersecurity firms. It includes FANGMAN giants Microsoft and Amazon but even when not weighting the set by market cap, the results show a clear US bias.

This is probably not a surprise to many, but the scale is sobering. In looking at UK opportunities, we narrow our options dramatically.

CLpUzCvhFYml8XDA2UMsthZYjo-eGzmugFrV9Q61-uVhreCf8OIhLAx9ORTGEMpDAdBHJPuPXpELjnEsOcd85GakM70Bhe_3TqyeNnlVDypxU07fG9m0uzsEEozdmzwuRXAi9w9f

If people want to see the names of the companies in the sample let me know. It’s a question of where to put them (perhaps in a comment?). For the sake of brevity, I haven’t included the list in this article. Some of the bigger names include, in order of market cap: Microsoft, Amazon, Cisco, and IBM, and in the UK: BAE and Avast.

The sample set has an aggregate market cap of a cool £2.8 trillion. Bear in mind though that Microsoft and Amazon alone account for more than three quarters of that market cap, with vast swathes of their business being unrelated to cybersecurity. It’s a tremendous range of market caps, from Microsoft’s titanic $1tn+ valuation right down to sub-$10m micro caps.

Putting those considerations to one side for now, the clear QM bias of the sample is striking.

Pz2X3uXoYxmOyzHL3OguzZeHk5KwEY4xw9-lfK6mJi_KzJHdnFFXJXqNSpJVFKDW0ZgDltHo7gyRK8obq5bjOfZBeIHjO627_CH7zNAGSoUE1bKXEcTKczdq4nxlo1CfEl24eFDN

Aggregating the data, the high QM factor profile becomes even clearer - nearly two-thirds of the sample are High Flyers, with not a single Contrarian or Turnaround stock in…

Unlock with Email

Unlock with Google

Already have an account?
Login here

MiserableJacktPotato

5th Jun '20

ComputaCenter worth a look. They don't just focus on CyberSecurity (neither do BaE), but that's likely a huge part of their workload.

andrea34

A good, detailed read, Jack. I've been put off Avast (LON:AVST) by director share sales. Someone mentioned Kape Technologies (LON:KAPE) which seem to be doing very well, though I'm put off by the huge majority holding in this company. Intercede (LON:IGP) look interesting... if the recovery story continues

Bear points:

Market moving away from smartcards to virtual smart cards.

All the major identity providers have secure multi factor authentication built into their products that work across most services using industry standards like SAML and FIDO.

Company is providing a tech that is niche

Berksbee

Hi Jack, very useful thanks - any chance you can add your view on Ncc (LON:NCC)? They've under-performed of late but they are much more of a pure play than BAe and look a safer investment than IGP.

An office next to Microsoft in Silicon Valley? So what? Microsoft's main HQ is Redmond in Washington, not California. It's a bit like saying a suspension manufacturer has a plus point because they have an office next to a Tesla dealership.

Simon Rowan

It wasn't particularly a plus point just that some body asked why would you want Avst when Microsoft provide the same thing. I'm not sure that is actually the case. I use avst for some things, I use Kape for privacy security. I dont use IGP yet. I can't think of a situation I would need to, but they all have a place .

Barnesian

Gb (LON:GBG) looks interesting. Results due w/c 29 June.

CheshireCat57

Bigclaw, your point is a reasonable one. What you also need to consider though is the complexity of the solutions that corporations are using to drive business efficiency and the complete dearth of people that know how to configure and manage those solutions as BAU.

In the interest of transparency I work for and hold stock in NCC Group...

Martin Allsop

6th Jun '20

I suspect that as Stockopedia subscribers our collective preference is usually to pick our own stocks! However when it comes to something like cyber security, where there are many unknowns about the future, I wonder whether it’s not better opting for a thematic etf or similar? What do folks think? I’ve only room for a couple of plays in a niche area such as this, and so wonder about the wisdom of trying to pick a winner....

timarr

However when it comes to something like cyber security, where there are many unknowns about the future, I wonder whether it’s not better opting for a thematic etf or similar?

Yes, that's the simplest approach. I hold £ISPY which has a decent selection of stocks in the sector.

Overall "cybersecurity" is a catch-all for some very different companies as even the small selection discussed by Jack shows. You have to look at each stock separately rather than just lumping them all together - I hold Ncc (LON:NCC) and Avast (LON:AVST) but you couldn't have two more different companies really. Same is true of Intercede (LON:IGP) - only it's even more esoteric and difficult to understand from the outside.

Overall the main drivers for growth in the sector are data protection regulation and an increase in remote working. Anything that doesn't address one of those two areas needs a lot of thought and analysis to figure out where growth is going to come from.

In terms of data protection consider the recent Easyjet data breach - apparently a "sophisticated attack", although as they're using email adddresses and passwords it certainly isn't a sophisticated defence - could attract an ICO fine of over £100 million. We're still waiting to see if the £160 million fine dished out to BA sticks - but frankly it's hard to see why it shouldn't.

That's the kind of financial pain that will make directors think very hard about their cybersecurity investments. Most companies should outsource because they really don't have the knowledge or skill to manage this stuff properly.

timarr

Bigclaw

Yes, that’s certainly true, a good point. I will be having a closer look at NCC as well.

Timarr, thanks for flagging up ISPY, I have had a look at their holdings just now. I will be buying. I think it answers the question of how best to get exposure to the sector. Cheers!

simoan

timarr,

Surprised to hear you hold Ncc (LON:NCC) - but perhaps that's more for the solid escrow business rather than any of the low quality cyber security bolt-ons made by the previously disgraced management team. I held this for a while many years ago for the escrow business and it was a nice investment, solid but boring, until completely ruined by management who had no idea how to do acquisitions. I don't like what I see from today's business with lots of lumpy revenue, low margin contract work. I studiously avoid such companies these days.

As someone that's worked in data security for the last 20 years, I couldn't agree more and make the point any better than chrisgb when he wrote:

1. Good security depends on good education. Users have to be discipline, e.g. checking out who actually sent a mail and not believing the From: name.

2. Over spec-ed Security often gets in the way of functionality, e.g. it won't let you see the data you need to see to do your job. You can't just slap on security.

The consequence of 1 and 2 is that there is no IT product that can magically solve your security problems. There is a great deal of thinking and analysis to do.

3. If you have an IT security product there is a good chance the operating system vendor and/or cloud vendors will implement a competitive product - and probably better, e.g. Microsoft Defender vs other virus checkers.

There's nothing you can do about the weakest link in any security system - human stupidity. I think there's an obvious attraction to private investors to try and find ways of playing themes like cyber security but IMHO there is no credible way to do so on the London markets. Even BAe only bought in that capability by acquiring Detica. And it's only competition authorities that stop Microsoft from wiping out the third party anti-virus industry overnight.

All the best, Si

Hi Si

I bought Ncc (LON:NCC) at the recent trough, which I thought offered a reasonable entry point for a business that, to my eye, is underperforming. A number of my clients use the escrow service and everyone's pretty happy, but I don't know anyone who uses any of the other services. There ought to be a decent business in here but if the management doesn't sort it out then I'd expect that someone else will.

I can trump your 20 years with 30, but you're absolutely right that human stupidity is an unstoppable force. Although it's not helped by the mass production of internet enabled domestic appliances that have no useful security at all. My favourite demonstration of recent years was someone using an iKettle to hack a home network and then to contiuously boil until it caught fire and burnt the house down. And then there were the internet enabled sex toys ... but perhaps the less said about those the better :-/

Bluesky Ventura

Hi Jack,

I really appreciate the article. The depth of the insight into this market space is excellent. I've also enjoyed your other articles. Please keep them coming.

BSV

We had to use the escrow service when working with Cisco 10 years ago at their behest. I was impressed how much it cost! Talk about money for old rope... No wonder we got so many follow up calls from their sales team in Manchester :-)

Although it's not helped by the mass production of internet enabled domestic appliances that have no useful security at all. My favourite demonstration of recent years was someone using an iKettle to hack a home network and then to contiuously boil until it caught fire and burnt the house down. And then there were the internet enabled sex toys ... but perhaps the less said about those the better :-/

Yes, I studiously avoid any appliances that connect to the internet for this reason, especially cars! You'll not be surprised to hear I don't own an Amazon Echo or similar too :) Owning these items falls into my "human stupidity" category.

DONOSULLIVAN

a fair review of the relevant companies and I will further research Avast with a view to purchase

7th Jun '20

thanks for your reply: very helpful

chrisgb

8th Jun '20

To answer your points.

1. I didn't make myself clear - I was talking about end users not about IT administrators and developers. Education is more than product education. It is essentially awareness - knowing to avoid the actions that let in the bad guys (e.g. clicking on links in emails) and following procedures like regular SW updates. The point is that without user discipline achieving good security is a real struggle. (Unfortunately often the least disciplined are senior managers.)

2. IT security is like security anywhere - you can make it more secure by putting in more barriers. Take data security. The more people who can see some information the more likely it is to be leaked. So for every piece of information you need to decide who can see it and who can't. This requires business analysis. Thus security is not something that can take place in a silo - it permeates everything. The reason for raising this point is that implementing security products is only one aspect of a much larger process, and frankly it is the business/security interface that usually goes wrong.

3. There is a market for niche security products. The problem as I see it is (a) because of reasons 1 and 2, its not easy sell and (b) if it is too successful the big boys will muscle in and take over your market.

From an investment angle, I can see there should be a number of successful but slowly growing companies. The problem I have is that I'm not sure which ones they are (I would guess Intercede (LON:IGP) has a chance). What I don't see is spectacular growth.

riosurfer

18th Jun '20

Avast (LON:AVST) : You state net income at £249m but don't Avast report in US$? Isn't net income $249 million? If so, your calculations are off - overvaluing the company by c.25%?

Scoping out cybersecurity: BAE Systems, Avast, and Intercede

Listed cybersecurity plays

Unlock the rest of this article with a 14 day trial

About the Author

Jack Brumby

36 comments

Unlock the metrics for all these stocks and more...

Unlock the metrics for all these stocks and more...