Note: This article was originally published in Motley Fool Rule Breakers on Dec. 9, 2015.
If you remember the infancy of the Internet, you probably remember the earliest forms of cyberattacks. At some point in time, you may have received an email from a Nigerian prince who urgently wanted to share a sudden windfall with you -- if only you would pay a small fee, or maybe give him your phone number and a few other personal details.
The Internet's first wave of hackers focused on phishing techniques like this to flush out your personal information. You would have to actually contact them in order for them to get it. Or maybe they would try to get you to download malware, in which case you could usually clean things up by buying virus protection software from McAfee or Symantec (SYMC 2.09%).
Unfortunately, the cybersecurity industry has gotten much more sophisticated since then. Individual scammers have yielded way to larger, state-sponsored cybercriminals. Emails requiring a reply have been replaced by advanced persistent threats, which continually attack at the perimeter in slight variations until one finally gets through. Eventually, even the best defenses can have their weaknesses exposed.
The threat actors today don't want to be noticed. They prefer to lurk in the shadows for extended periods of time, giving them unobstructed access to personal financial information, corporate intellectual property, or classified government secrets. According to Mandiant's incident response reports, the average attackers got to spend 205 days in breached environments last year before they were exposed. About 69% of the victims didn't even know they had been hacked and had to learn about the breach from an outside entity.
The bottom line is that cybersecurity has become significantly more important. It is estimated that the world spent $106 billion on cybersecurity last year -- which is expected to grow nearly 10% a year and reach $170 billion by 2020.
A technology paradigm shift
To keep up with the changing threat landscape, cybersecurity technology has evolved as well. Rather than offering prepackaged software through retailers, many vendors in the space are setting up cloud-based solutions, which give them a much more complete view of what's actually going on. Centrally hosted servers sift through hundreds of petabytes of Web traffic data each month, learning from previously known virus signatures to proactively detect other suspicious behavior in advance.
In addition to providing a continual flow of useful data, the cloud-based solutions are also allowing vendors to shift their business models. They're extending their relationships with customers and creating recurring subscriptions. These recurring revenue streams are highly profitable and less lumpy, which has attracted the attention of several Wall Street analysts.
One other major technology trend in the industry is the adoption of behavioral analytics. Many cyberattacks follow the same basic formula. This formula is becoming more recognizable, and protection against it is becoming more automated. Using a combination of predictive analytics, artificial intelligence, and tons of data, cybersecurity customers are improving their ability to sniff out the bad guys before it's too late. Refinements in behavioral analytics are also helping to minimize the number of false positives, which means corporate IT staffs won't waste so much time responding to alerts that were never threats in the first place.
How to invest in this industry
All right. So we've established that cybersecurity is a big deal and that technology is exponentially improving the level of protection. Let's next get to the question on everyone's mind: "How can we make money off this?"
The first way involves investing in larger, established vendors that have existing customer relationships already in place. Rule Breaker Check Point Software Technologies (CHKP 0.55%) boasts a customer count of more than 100,000 -- giving it ample opportunity to upsell customers to newer, updated products to keep up with the industry's changes. Check Point's decade-long relationships have rewarded the company with a 52% operating cash flow margin, which it has largely passed along to investors via share repurchases.
Palo Alto Networks (PANW 0.18%) is another Rule Breakers recommendation that should be on investors' radars. Palo Alto is another established vendor that has made a name for itself over the years in network firewalls. The company has significant upside in WildFire -- its next-generation firewall subscription that continually adapts to changing threat signatures. WildFire's customer count roughly doubled over the past year and has already reached 8,000.
Investments in Check Point or Palo Alto are bets on the industry's incumbents, which will leverage their large sales and marketing spend to make the pie bigger with existing customers. Many companies are looking to phase out smaller vendors that aren't differentiated enough to warrant a separate line item in their IT security budget. This trend plays in Check Point and Palo Alto's favor.
Of course, there is significantly more potential gain (and of course, potential risk) in finding those smaller vendors that are differentiated enough to dominate an important, specific niche. Recent recommendation CyberArk Software (CYBR +0.00%) has carved out a niche in privileged accounts, which protect an organization's highest-value digital assets. Imperva (NYSE: IMPV) is a company on our radar -- it's a leader in Web application firewalls, which serve as a suit of armor to protect against nasty DDOS attacks that can take down a website's operations.
Aside from the vendors themselves, cybersecurity is giving rise to several new industries as well. Cyberinsurance (which isn't even yet recognized by Microsoft's spell check) provides companies with risk mitigation in case a cyberattack actually does occur. Target has officially spent more than $300 million to fix the aftermath of its 2013 data breach. Good cyberinsurance underwriters effectively transfer the liability and potential costs of a breach from a company's balance sheet (i.e., cleaning up the mess on your own) to the income statement (paying annually for an insurance policy to protect you).
The threat of a large-scale cyberattack is ever-present, and no company wants to be the next to make the headlines. Boardroom directors with fiduciary responsibilities are increasingly looking to mitigate the risk. The U.S. writes about $2.5 billion of cybersecurity premiums today (which is a drop in the bucket of the $1 trillion-plus for other forms of insurance), but this is expected to triple to nearly $7.5 billion by 2020.
The Foolish bottom line
The Internet has given businesses an ability to instantly connect and transact with customers all across the globe. As the rise of e-commerce, online banking, and software-as-a-service has brought even more sensitive personal information to the Net, the need for cybersecurity has never been greater. We'll look to a few Rule Breakers to make the digital world quite a bit safer.
