Cheapest Cybersecurity ETF and Low Cost Cyber ETFs Ranked by Fee

The cheapest cybersecurity ETF is the Xtrackers Cybersecurity Select Equity ETF (PSWD) at 0.20% a year. It is also tiny, with $6.7 million in assets on October 12, 2026. Among the established funds, WisdomTree's WCBR charges 0.45%, iShares' IHAK 0.47% and Global X's BUG 0.50%. The two biggest cost the most: First Trust's CIBR charges 0.58% and Amplify's HACK 0.60%. Vanguard, Fidelity and Schwab do not sell a cybersecurity ETF.

The fee gap is small. The gap in what you get for the fee is not. We sorted every holding in the six funds by what the company mainly sells, and the share that is actually security vendors runs from 49.8% in CIBR to 93.7% in BUG. The rest is Cisco, Broadcom, Microsoft, Alphabet, defense contractors and, in one fund, data center owners. So below, every US-listed cybersecurity ETF is ranked twice: by expense ratio, and by what it costs for each $100 of real security vendor exposure.

Expense ratios come from each fund's summary prospectus. Holdings come from the issuers' daily files for October 12 and 13, 2026, except IHAK and WCBR, whose sites could not be read, so we used their latest SEC holdings filings for July 31 and June 30, 2026. We make index construction and backtesting software; we do not sell funds or give investment advice.

Cheapest cybersecurity ETFs ranked by expense ratio

Some lists put CIBR at 0.60% and HACK at 0.47%. Both are out of date or wrong: CIBR's fee was 0.58% as of February 2, 2026 on First Trust's own page, and HACK's January 2026 prospectus shows a 0.60% management fee with no other expenses.

Which cybersecurity ETF has the lowest expense ratio?

PSWD, at 0.20%, which is less than half of the next cheapest fund. It tracks the Solactive Cyber Security Focus Index, weighted by market value with a 4.5% cap at each rebalance, and held 49 stocks on October 12. Its largest positions were Zscaler 6.2%, Okta 6.1%, Rubrik 5.6%, CrowdStrike 5.4% and Palo Alto 5.0%. Zscaler sitting above the 4.5% cap shows how far weights drift between resets.

Two things to check before buying it. The fund is very small, so trading costs can wipe out the fee saving: DWS does not show a median spread on the fund page, and on a $6.7 million fund a wide spread on a large order is likely. And 13.3% of PSWD sat in companies that are not security businesses at all: CoreWeave, Nebius, and data center owners in Australia, China and Hong Kong. That is an AI data center bet riding inside a security fund. If you want that bet, our cheapest AI ETF ranking covers the funds built for it.

The cost per $100 of actual security vendors

Here is the ranking that changes the answer. Divide each fund's fee by the share of the fund in security software and services vendors (endpoint, firewall, cloud access, identity, vulnerability management, data security, cyber recovery and consumer security), and you get what each fund really charges for the part you came for.

BUG moves from fourth to second, and CIBR, the fund most people buy, comes last among the cyber funds. The reason is simple. 40.8% of CIBR was large tech and networking companies, led by Cisco at 7.7% and Broadcom at 7.1%, with Microsoft, Alphabet, IBM and Arista further down. You can own those through an S&P 500 fund for about 0.03%. Paying 0.58% on them is paying a theme fee for companies that are not the theme.

The bucket lines are our own judgment and a few names could move. We counted Cloudflare, Gen Digital, Rubrik and Commvault as security vendors, and Akamai, F5 and Datadog as large tech and networking. Moving all of them the other way changes the order a little, but BUG stays near the top and CIBR stays near the bottom.

Is there a Vanguard cybersecurity ETF?

No. Vanguard does not sell a cybersecurity ETF, and neither Fidelity nor Schwab sells one under its own name. The fund Vanguard investors usually get pointed to is the Information Technology ETF (VGT) at 0.09%. It is a fine, cheap tech fund, but security vendors were only 3.9% of it in Vanguard's August 31, 2026 holdings, against 11.5% in Microsoft alone. You would be buying a tech fund with a little cybersecurity in it. A Vanguard, Fidelity or Schwab account can still buy any of the six ETFs above, or the security stocks themselves, usually with no commission.

CIBR vs HACK

CIBR is the bigger and slightly cheaper fund: $18.7 billion against $3.6 billion, 0.58% against 0.60%, 45 stocks against 23. HACK is the more focused one, with 68.2% in security vendors against 49.8%, though its largest single holding was Broadcom at 6.4% and it held General Dynamics and Northrop Grumman at about 4% each. The two shared 21 companies and 57.7% of their weight. CIBR traded with a 0.06% median spread and HACK 0.13%. If you want security vendors and are choosing between these two, HACK gives you more of them per dollar of fee, $0.88 against $1.16.

CIBR vs BUG

This is the clearest choice in the group. BUG costs less, 0.50% against 0.58%, holds almost nothing but security vendors (93.7%), and had the same 0.06% median spread as CIBR on its October 12 page. CIBR offers more history (it launched in 2015, BUG in 2019) and far more assets. Their portfolios shared 20 companies but only 46% of their weight, so they behave differently. BUG's largest holding was Okta at 10.3%, while CIBR's top five included Cisco and Broadcom. If you already own an S&P 500 fund, BUG duplicates much less of it: the companies CIBR holds were 16.9% of SPY, against 1.1% for BUG.

What is the best low cost cybersecurity ETF?

For most buyers it is BUG. It is not the cheapest on the label, but it is the cheapest established fund per dollar of real security exposure, it trades tightly, and it does not double up on what an index fund already gives you. WCBR is close on cost per vendor dollar but much smaller, and it picks partly on revenue growth, which is why Datadog was its second largest holding in its June 30 filing. PSWD is the cheapest outright and the cheapest per vendor dollar, and it makes sense if you trade small amounts and check the spread first.

Old lists add one more trap. CyberArk still shows up in some of them, but it is no longer a stock you can buy: Palo Alto Networks completed the acquisition on February 11, 2026, paying $45 in cash plus 2.2005 Palo Alto shares for each CyberArk share. And some of the newest security spending, such as tools that block prompt injection in AI agents, goes to young companies that are still private, so no ETF holds them yet.

When is owning the stocks cheaper than a cybersecurity ETF?

Once the balance is large enough. Cybersecurity is one of the easiest themes to hold directly, because nearly every large vendor lists in the US. Only Trend Micro trades mainly in Tokyo, and Check Point and Radware, the Israeli names, list on Nasdaq. A basket of 12 to 20 vendors such as CrowdStrike, Palo Alto, Fortinet, Zscaler, Cloudflare, Okta, SentinelOne, Qualys, Tenable and Rubrik covers most of what BUG and WCBR hold, with no expense ratio. At 0.50%, BUG costs $250 a year on $50,000 and $500 on $100,000, every year, on a growing balance.

Holding the shares also lets you take tax losses one stock at a time. Security stocks swing hard on single quarters, so one vendor can fall 20% on a guidance cut while the rest hold. You can sell that one for a loss and keep the basket, which a fund does not let you do. Check the 30 day window with the wash sale calculator before you buy it back.

What you give up is the upkeep. You decide the weights, cap the leaders and rebalance them yourself. That is the part worth testing before you put money in. On our build your own cybersecurity stocks index page you can set the vendors and weights, backtest the basket against CIBR, BUG and the S&P 500 over real market history, and track it daily before you buy anything. If you are weighing this against other themes, the same fee-per-exposure method is applied to chip funds in our cheapest semiconductor ETF ranking.

How we built these numbers

Fees are from the summary prospectuses: PSWD October 1, 2026, HACK January 28, 2026, BUG April 1, 2026, IHAK November 28, 2025 and WCBR November 1, 2025 as supplemented September 30, 2026; CIBR's 0.58% is from First Trust's fund page as of February 2, 2026. Holdings are from First Trust, Global X, DWS and State Street files for October 12, 2026, Amplify's file for October 13, 2026, and SEC Form N-PORT filings for IHAK (July 31, 2026) and WCBR (June 30, 2026). Spreads are the 30 day medians each issuer publishes. Every holding was assigned to one group by its main business; the full list of judgment calls is in the sources note on the cybersecurity index page. Holdings and fees change, so confirm them on the fund page before you buy. Indexes is not affiliated with any fund issuer named here, and backtested results are hypothetical.