Artificial intelligence (AI) is still in its infancy, but it's already one of the most revolutionary technologies humanity has ever created. It has the potential to significantly increase economic productivity, help researchers develop new medicines and materials, or generate more accurate global weather forecasts in minutes, among many other things.
But AI can also be highly dangerous in the wrong hands. Bad actors are using it to stage sophisticated cyberattacks that could have devastating consequences. As a result, companies and organizations are turning more heavily to cybersecurity providers. Investors, in turn, have piled into cybersecurity stocks, fueling a whopping 42% return in the First Trust Nasdaq Cybersecurity ETF (CIBR +2.39%) so far in 2026.
The exchange-traded fund (ETF) is crushing the S&P 500 (^GSPC +1.00%) and Nasdaq-100 indexes, which are sitting on year-to-date gains of 11% and 16%, respectively. But here's why the recent rally in cybersecurity stocks could end with a crash.
Image source: Getty Images.
AI is a tailwind for the cybersecurity industry
The cybersecurity industry has historically been fairly fragmented because many of its top vendors once specialized in just one or two specific areas. Therefore, businesses had to buy products from multiple providers to achieve adequate protection. However, those diverse providers' products rarely worked well together, leaving holes in their clients' defenses.
That approach simply won't work in the modern era, because hackers can use AI to rapidly identify and exploit vulnerabilities. As a result, most cybersecurity vendors now develop holistic, all-in-one solutions that provide unified protection across an entire enterprise.
The First Trust Nasdaq Cybersecurity ETF holds 42 of the cybersecurity industry's leading stocks. But it's quite top-heavy, with its five largest positions accounting for 39.5% of the total value of its portfolio.
|
Stock |
First Trust ETF Portfolio Weighting |
|---|---|
|
1. Palo Alto Networks |
9.49% |
|
2. CrowdStrike |
9.40% |
|
3. Fortinet |
8.86% |
|
4. Cisco Systems |
6.37% |
|
5. Broadcom |
5.41% |
Data source: First Trust. Portfolio weightings as of Sept. 16, 2026.
Palo Alto Networks (PANW +2.82%) is the world's largest pure-play cybersecurity company by market capitalization. It offers more than 40 products to protect cloud networks, employee identities, endpoints, AI applications, and more. The company coined the term "platformization," which describes the way it encourages customers to consolidate their cybersecurity spending by ditching other vendors to exclusively use its products. As I highlighted earlier, this approach is essential to protect against the most advanced modern threats.
CrowdStrike (CRWD +4.19%) packages its products through an all-in-one platform called Falcon. Enterprises can choose from 33 different modules to build their ideal cybersecurity solution, and with the Flex subscription, they can set a fixed annual budget and change modules as their needs evolve. Falcon's simple cloud-based architecture caters to enterprises of all sizes, and it's proving very popular.
While many investors know Broadcom as a leading supplier of AI data center chips and components, it also owns cybersecurity powerhouse Symantec.
Other cybersecurity stocks in the First Trust ETF include Cloudflare, Okta, Zscaler, and SentinelOne.
Unsustainable valuations could spark a crash in this ETF
The First Trust Nasdaq Cybersecurity ETF has delivered a compound annual return of 16.1% since it launched in 2015, beating the S&P 500, which returned an average of 13.9% per year over the same period. So its outperformance so far in 2026 certainly isn't an outlier, but investors might want to tread with caution from here.
NASDAQ: CIBR
Key Data Points
Valuations matter in investing, and many of the cybersecurity industry's largest companies are trading at unsustainable levels. CrowdStrike, for example, had a price-to-sales (P/S) ratio of 46.8 as of Sept. 17, making it 7 times more expensive than the tech-centric Nasdaq-100 index, which had a P/S ratio of just 6.1.
CrowdStrike's revenue growth has consistently decelerated over the last few years, and Wall Street's average forecast for the company's next fiscal year suggests that even slower growth is ahead. Therefore, its sky-high P/S ratio is practically impossible to justify, suggesting that its stock is likely to suffer a sharp correction at some point.
CRWD PS Ratio data by YCharts.
Palo Alto is also trading at an elevated P/S ratio of 24.8, more than double its 10-year average of 10.5. The P/S ratios of Fortinet, Cisco, and Broadcom are also at significant premiums to their long-term averages.
The cybersecurity industry is packed with potential, especially with AI adoption expanding. But its largest participants will find it increasingly difficult to attract stock buyers at current levels, and any sustained corrections they might experience will almost definitely trigger a sharp decline in the First Trust ETF.
As a result, investors might want to wait for a pullback before parking money in the cybersecurity space.
