Cybersecurity ETF alternative to build your own cybersecurity stocks index and backtest it against CIBR and BUG
The biggest cybersecurity fund keeps 41% of its money in large tech companies you probably own already. Pick the endpoint, firewall, identity and data security vendors you actually want, set the weights, and see how the basket would have done next to the funds and the S&P 500. Then buy it at your own broker.
Pick 2 to 10 holdings. Stocks, ETFs and crypto mix in one index.
The backtest did not run just now. Tap Backtest it to try again.
Educational only · Never places a trade
In short
A cybersecurity ETF alternative is a basket of security stocks you weight yourself instead of taking a fund's rule. It matters because cybersecurity funds own very different things. On issuer holdings files dated October 12 and 13, 2026, Global X's BUG held 93.7% in security software and services vendors, Amplify's HACK held 68.2%, and First Trust's CIBR, the largest fund at $18.7 billion, held 49.8%, with Cisco, Broadcom, Microsoft and Alphabet making up 18.8% of it. Building your own cybersecurity stocks index means choosing that mix, backtesting it, and buying the stocks at a broker with no expense ratio.
Summed from each fund's published holdings and SEC filings
How much of each cybersecurity ETF is actually security vendors?
Every holding sorted by what the company mainly sells. Black is security vendors: endpoint, firewall, cloud access, identity, vulnerability, data security, cyber recovery and consumer security. Grey is large tech, networking and observability companies that have a security line. Green is defense contractors and government IT. The empty part of each bar is everything else, from IT consultants to data center owners.
Global X BUG
93.7% security
Almost all security vendors. Okta alone is 10.3%
WisdomTree WCBR
81.8% security
Picks by revenue growth, so Datadog is its second largest holding (June 30)
Amplify HACK
68.2% security
Broadcom is its largest position, and it holds General Dynamics and Northrop
Xtrackers PSWD
60% security
Cheapest at 0.20%, but CoreWeave, Nebius and data center owners fill 13% of it
iShares IHAK
59.8% security
Most global of the six, with 18% in shares listed outside the US (July 31)
First Trust CIBR
49.8% security
The biggest fund. Cisco, Broadcom, Microsoft and Alphabet are 18.8% of it
Start with CIBR, because it is where most of the money is. Its index splits companies into core and complementary names and caps the five largest at 8%, so on October 12 the top five were CrowdStrike 8.4%, Fortinet 8.4%, Palo Alto 7.8%, Cisco 7.7% and Broadcom 7.1%. Further down sit Microsoft, Alphabet, IBM, Arista, NetApp, Accenture and Infosys. Add it up and 40.8% of CIBR was large tech and networking companies, and another 9.3% was defense contractors, IT consultants and a few others. That is a defensible reading of who sells security. It is not the fund most people picture when they buy cybersecurity.
BUG went the other way. Its index is close to a list of pure security vendors, so only Akamai, A10 Networks and two tiny holdings fall outside that group, and Okta was its largest holding at 10.3%. HACK sits between them: 68.2% security vendors, but Broadcom was its single largest position at 6.4%, and it held General Dynamics and Northrop Grumman at about 4% each. WCBR picks by revenue growth as well as security focus, which is why Datadog, an observability company, was its second largest holding in its June 30 filing.
There is one more thing worth knowing if you already own an index fund. The companies CIBR holds were 16.9% of the S&P 500 fund SPY on October 12, almost all of it Microsoft, Alphabet, Broadcom and Cisco. The security vendors themselves were just 1.1% of SPY: Palo Alto, CrowdStrike, Fortinet and Gen Digital are in the index, while Zscaler, Cloudflare, Okta, SentinelOne and Check Point are not. So the vendors are the part of a cybersecurity fund that actually adds something to an S&P 500 holding.
From each issuer's fund page, holdings file and prospectus
Which cybersecurity ETF holds what, and how does each one pick its stocks?
| Fund | Expense ratio | Holdings | Assets | Rule | Largest positions |
|---|---|---|---|---|---|
| First Trust NASDAQ Cybersecurity (CIBR) | 0.58% | 45 | $18.7 billion | Nasdaq CTA Cybersecurity Index, modified market cap: five largest capped at 8%, other core names at 4%, complementary names at 2% | CrowdStrike 8.4%, Fortinet 8.4%, Palo Alto 7.8%, Cisco 7.7%, Broadcom 7.1% |
| Amplify Cybersecurity (HACK) | 0.60% | 23 | $3.6 billion | Nasdaq ISE Cyber Security Select Index, adjusted market cap, no stock above 15% | Broadcom 6.4%, CrowdStrike 5.9%, Cisco 5.9%, Palo Alto 5.7%, Cloudflare 5.4% |
| Global X Cybersecurity (BUG) | 0.50% | 30 | $2.2 billion | Indxx Cybersecurity Index, modified market cap with per-stock caps, reset twice a year | Okta 10.3%, CrowdStrike 7.9%, Fortinet 7.6%, Palo Alto 7.5%, Zscaler 5.8% |
| iShares Cybersecurity and Tech (IHAK) | 0.47% | 34 | $1.0 billion (July 31) | NYSE FactSet Global Cyber Security Index, market cap with a 4% cap | Qualys 5.0%, Palo Alto 4.9%, Varonis 4.6%, Okta 4.5%, SentinelOne 4.5% (July 31 filing) |
| WisdomTree Cybersecurity (WCBR) | 0.45% | 25 | $103 million (June 30) | WisdomTree Team8 Cybersecurity Index, weighted by growth and focus scores | CrowdStrike 7.7%, Datadog 6.9%, Palo Alto 6.8%, Tenable 6.1%, Fortinet 6.1% (June 30 filing) |
| Xtrackers Cybersecurity Select Equity (PSWD) | 0.20% | 49 | $6.7 million | Solactive Cyber Security Focus Index, market cap with a 4.5% cap at each rebalance | Zscaler 6.2%, Okta 6.1%, Rubrik 5.6%, CrowdStrike 5.4%, Palo Alto 5.0% |
Size matters for trading costs. CIBR and BUG both published a 0.06% median bid and ask spread and HACK 0.13%. PSWD is the cheapest cybersecurity ETF at 0.20%, less than half of anything else, but it held $6.7 million on October 12 and does not publish a spread on its page, so the fee saving can disappear in one large order. PSWD's 4.5% cap also lets names drift between rebalances: Zscaler was 6.2% of it. And 13% of PSWD sat in CoreWeave, Nebius and data center owners in Australia, China and Hong Kong, which is a data center bet riding inside a security fund.
The funds overlap less than their labels suggest. CIBR and IHAK shared 20 companies but only 34% of their weight. BUG and WCBR were the closest pair at about 76%, though their files are four months apart. CIBR and HACK, the two oldest, shared 57.7%. A fund you may still see on older lists, CyberArk, is no longer a stock you can buy: Palo Alto Networks completed its acquisition on February 11, 2026, paying $45 in cash and 2.2005 of its own shares for each CyberArk share. The same fund families appear on our AI stocks index builder, where the AI software overlap with these funds is easy to see.
// The universe, six groups
Which stocks belong in a cybersecurity stocks index?
Security vendors sell to different budgets. Endpoint and network security follow the number of devices and offices a company runs, identity follows headcount and cloud apps, vulnerability and data security follow audits and regulation, and cyber recovery follows ransomware. The share you give each group decides what your index actually rides on.
1
Endpoint and threat detection
2
Network, firewall and SASE
3
Identity and access
4
Vulnerability and data security
5
Backup and cyber recovery
6
Consumer security
Unlike robotics, cybersecurity is easy to build from US listings. Of the large vendors, only Trend Micro trades mainly in Tokyo, and the Israeli companies, Check Point and Radware, list on Nasdaq. That is why non-US shares were just 3.4% of CIBR and 4.1% of HACK. A US-listed cybersecurity index of 12 to 20 names covers almost everything the funds hold in this group, and every name gets its own tax lot.
Weighting is the decision that matters. By size, Palo Alto, CrowdStrike and Fortinet would take half the basket, so most people cap them or use an equal weight index across the vendors. If the chips under the networking gear are the bet you want, the semiconductor index builder handles Broadcom directly, and the government IT names HACK and IHAK hold sit more naturally on the defense stocks index builder.
From a view on security spending to a basket you can buy
How to build your own cybersecurity stocks index in four steps
1
Decide what counts
Security vendors only, or Cisco, Broadcom and the defense IT firms too? That one choice is the whole gap between BUG and CIBR.
2
Fill the groups
Search the catalog of US-listed stocks, add 12 to 20 names across endpoint, network, identity and data security, and set equal, size or your own weights.
3
Backtest against the funds
Run it against the S&P 500, and build a one-line index of CIBR or HACK to put a fund with ten years of history on the same chart.
4
Track it, then buy it
Follow the index daily against its benchmark, export the weights, and place the basket at your own broker when you are ready.
Cybersecurity has a long enough history to test properly. HACK dates from 2014 and CIBR from 2015, so a basket can be run through the 2020 crash, the 2021 software boom and the 2022 bear market, when high growth software fell far harder than the S&P 500. Several of today's vendors cannot: Rubrik, SailPoint and Netskope all listed in 2024 or 2025. Test the established vendors over the long window and the young ones over the short one, and look at the maximum drawdown next to the S&P 500 before the return. Backtests are hypothetical and past returns do not predict future ones. If you cap the leaders, test a quarterly reset with the custom index rebalancing tool.
Three ways to own cybersecurity stocks, compared honestly
Build your own cybersecurity index vs a cybersecurity ETF vs a basket broker
| Cybersecurity ETF | Fidelity Basket Portfolios | Indexes, then your broker | |
|---|---|---|---|
| Who decides what counts as cybersecurity | The fund's index | You | You, and you can test it first |
| Yearly cost | 0.20% to 0.60% of the balance | $4.99 a month flat | From $24 a month for the software, billed yearly, plus your broker's cost |
| History you can test | Since 2014 for HACK and 2015 for CIBR | None | As far back as your youngest stock goes |
| Overlap with an S&P 500 fund | Up to 16.9% of SPY for CIBR's companies | Whatever you pick | Whatever you pick, and you can see it |
| Per-stock tax losses | No | Yes, done by you | Yes, at your broker |
| Where it falls short | You take the fund's answer on Cisco, Broadcom and defense IT | No way to test a design before buying | You place and rebalance the trades yourself |
The ETF wins when you want one ticker and no upkeep. If that is the choice, measure the fee against what you are buying, not against the label. Per $100 of security vendor exposure, BUG cost $0.53 a year and WCBR $0.55, against $0.88 for HACK and $1.16 for CIBR, because half of CIBR is companies you can buy through a 0.03% index fund. PSWD is cheapest on that measure too, $0.33, if its size does not put you off. We rank every fund that way in cheapest cybersecurity ETF by expense ratio.
Building your own pays off on cost once the balance is large enough that a flat $288 a year for the software beats the fund fee, about $50,000 against CIBR and $58,000 against BUG, and whenever the mix you want is one no fund offers, such as identity and cloud security with no hardware makers. Owning the shares has a tax side too. Security stocks can fall hard on a single quarter: one vendor can drop 20% on a guidance cut while the rest of the group holds. That name can be sold for a tax loss while the rest of the basket stays in place, which a fund does not allow. Check the dates with the wash sale calculator before you buy the same stock back.
What Indexes does and does not do: it is index construction, backtesting and tracking software. It does not hold money, place trades or give investment advice. You design and test the cybersecurity stocks index here and hold it wherever you already invest.
Cybersecurity ETF questions
What people ask before they buy cybersecurity stocks
What is the best cybersecurity ETF?
If you want security vendors rather than big tech, Global X's BUG (0.50%) held the most: 93.7% of the fund in security software and services companies on October 12, 2026, led by Okta, CrowdStrike, Fortinet and Palo Alto. The largest fund, First Trust's CIBR (0.58%), held 49.8% in security vendors and 40.8% in Cisco, Broadcom, Microsoft, Alphabet and other large tech companies.
Does Vanguard have a cybersecurity ETF?
No. Vanguard sells no cybersecurity ETF, and neither do Fidelity or Schwab under their own names. The closest Vanguard fund is the Information Technology ETF (VGT) at 0.09%, but security vendors were only 3.9% of it in Vanguard's August 31, 2026 holdings. A Vanguard customer can buy CIBR, HACK or BUG, or buy the security stocks directly.
Which cybersecurity ETF has the lowest expense ratio?
Xtrackers' PSWD charges 0.20%, the lowest by a wide margin. Then come WisdomTree's WCBR at 0.45%, iShares' IHAK at 0.47%, Global X's BUG at 0.50%, First Trust's CIBR at 0.58% and Amplify's HACK at 0.60%. PSWD held only $6.7 million on October 12, 2026, so check the bid and ask spread before you put a large order in.
What is the difference between CIBR and HACK?
CIBR is much bigger, $18.7 billion against $3.6 billion, slightly cheaper at 0.58% against 0.60%, and holds 45 stocks against 23. HACK puts more into security vendors, 68.2% against 49.8%, and less into large tech. The two shared 21 companies and 57.7% of their weight. CIBR also holds Microsoft, Alphabet, IBM and Accenture, which HACK does not.
What is the difference between CIBR and BUG?
BUG is nearly a pure security vendor fund: 93.7% against CIBR's 49.8% on October 12, 2026. CIBR holds Cisco 7.7% and Broadcom 7.1% among its five largest names, while BUG's largest is Okta at 10.3%. BUG costs 0.50% against 0.58% for CIBR. They shared 20 companies and 46.0% of their weight, and both had a 0.06% median spread.
Is CrowdStrike in cybersecurity ETFs?
Yes, in all six. CrowdStrike was CIBR's largest holding at 8.4%, 5.9% of HACK, 7.9% of BUG, 5.4% of PSWD, 4.3% of IHAK in its July 31 filing and 7.7% of WCBR in its June 30 filing. The S&P 500 fund SPY held 0.40% of it. CyberArk, which still appears on older lists, is gone: Palo Alto Networks completed its acquisition on February 11, 2026.
Can I build my own cybersecurity ETF?
You can build the same exposure without a fund. Pick the security vendors you want, set the weights, backtest the basket against CIBR, BUG and the S&P 500, then buy the shares at your broker, where there is no expense ratio and each stock carries its own tax lot. Nearly all the large security vendors trade in the US, so the basket is easy to hold.
Sources
Holdings, fees and assets from each issuer's fund page and daily holdings file: ftportfolios.com (CIBR), globalxetfs.com (BUG), etf.dws.com (PSWD) and ssga.com (SPY) for October 12, 2026, and amplifyetfs.com (HACK) for October 13, 2026. The iShares and WisdomTree websites could not be read, so IHAK holdings are from its SEC Form N-PORT for July 31, 2026 and WCBR holdings from its N-PORT for June 30, 2026; their current assets and spreads are not shown. Expense ratios from each fund's summary prospectus. VGT holdings from Vanguard's published list for August 31, 2026. CyberArk's acquisition from Palo Alto Networks' Form 8-K exhibit of February 11, 2026. The groups are our own classification of each holding by its main business; some companies could reasonably sit in another group, most of all Cloudflare and Gen Digital (counted as security vendors), Rubrik and Commvault (counted as security vendors for cyber recovery, though backup is a large part of their business) and Akamai, Datadog and F5 (counted as large tech and networking although each sells security products). Holdings and fees change, so confirm them on the fund page before you buy. Indexes is not affiliated with any fund issuer or broker named here. We make index construction and backtesting software: we do not manage money, place trades or give investment advice, and backtested results are hypothetical.
Build the cybersecurity index you actually meant to buy
Choose the security vendors and the weights, backtest the basket against CIBR, BUG and the S&P 500, and track it every day. Then buy it wherever you invest.
Keep reading