How to profit from the rush to protect firms from M&S-style cyber attacks

Business Mayor

11-05-2025

Words such as 'cyber attack', 'malware' and 'automated phishing' used to sound futuristic. But once a threat stops us from buying Percy Pig sweets and comfy underwear, we know it has struck at the very heart of Middle England – and it is time for investors to sit up and take notice.
At the time of writing, M&S still isn't offering online shopping after a huge cyber hack, while the Co-op is struggling with stock issues and a customer-data breach. The hackers have cost these companies dear – Deutsche Bank puts the cost to M&S at £15 million a week – and experts warn many more companies are vulnerable to similar attacks.
'Cyber threats are growing in size and severity,' warns Mike Seidenberg, portfolio manager at Allianz Technology Trust, who says there were more than six billion malware attacks globally in 2023. 'Bad actors have increased their ambition, with critical infrastructure, government departments and crucial industries permanently at risk.'
For investors, cyber warfare represents both an opportunity and a threat. On the one hand, poorly prepared companies undergoing a cyber attack will hit their shareholders squarely in the pocket, with M&S stocks down more than 6 per cent in the past week.
However, investing in companies in the cyber security sector could allow you to benefit from a trend, with Cabinet minister Pat McFadden stating this week that the Government would 'turbo charge' the cyber security sector.
'Cyber security is not a luxury but an absolute necessity,' he says. If investment in the sector continues, investors may feel the same.
As the fall in M&S shares last week has shown, hackers can seriously damage your wealth.
A report from security experts Cisco suggests that only 4 per cent of businesses have reached what they call a 'mature' stage of readiness where they can withstand a cyber attack, with 70 per cent of companies either in the 'formative' or the 'beginner' stages of readiness. This suggests that many household names are as vulnerable as M&S and the Co-op.
However, Laith Khalaf, head of investment analyst at investment group AJ Bell, says it is difficult to predict where hackers may strike next, which makes it extremely difficult to protect your portfolio.
'Even companies which provide cyber security have found themselves the victims of attacks, such as CrowdStrike and FireEye,' he says. 'Probably the best and simplest tonic is to hold a diversified portfolio so that if a company sees its share price fall because of a cyber attack, it doesn't damage your wealth too badly.'
Khalaf adds that the share-price reaction to cyber attacks tends to be short-lived. Many companies have strong cyber security insurance policies, so if you buy firms where you believe the management makes good decisions about risk, chances are they will be protecting themselves.
However, it is always an area you could ask about at an annual general meeting if you are concerned or check the firm's risk factors' section of its annual report.
With governments and businesses spending more on cyber security, many experts believe now is the time to invest in those securing us all against the hackers.
'Investment capital is pouring into cyber security businesses alongside aerospace and defence firms,' says Jason Hollands, managing director at investment platform BestInvest.
The Cisco study also showed that more than nine in ten companies increased their budget for cyber security in the past two years.
Many of the biggest players in cyber security are either unlisted or listed in the US, but there are various ways you can invest.
For those who prefer to pick individual shares and are untroubled by the volatility that entails, there are some good options.
Tiny SysGroup, based in Manchester, is backed by Ken Wotton, manager of Baronsmead Venture Capital Trusts, who says that the business is 'well positioned for sustained growth'.
SysGroup supports small and medium-sized businesses with their cyber security. 'It assists in building robust cyber security systems spanning not only the core business but also its supply chains – a critical yet often overlooked area of vulnerability for many groups,' Wotton says.
SysGroup shares have been volatile – down 26 per cent in the past six months, up 10 per cent in the past month. At the other end of the scale in the UK, defence giant BAE has a cyber security division – although, as Khalaf at AJ Bell points out, it comprises less than 10 per cent of the business.
Lee Wild, head of equity strategy at Interactive Investor, says cybersecurity firm NCC stands out as one of the remaining UK players not to have gone private. It is down 25 per cent this year, but there's always the possibility that it will attract a suitor with a hefty premium at this level.
Read More BRP reorganizes Powersports and Marine segments as one business
There are also trusts and funds that allow you to take a mixed slice of the cyber security market.
Darius McDermott, managing director at FundCalibre, likes the HANetf Future of Defence ETF. This is 43 per cent invested in technology firms, most of which are cyber security specialists.
It launched in 2023, at just the right time for cyber security, and has seen its shares rise 46 per cent.
Other specialist ETFs in this area include the Legal & General Cyber Security ETF and iShares Digital Security ETF.
James Carthew, head of investment companies at QuotedData, recommends Polar Capital Technology, which invests in leading players such as CyberArk Software, Crowdstrike Holdings and Cloudflare. Polar Capital has had a torrid three months – down nearly 17 per cent following President Trump's tariff announcements, but has recovered somewhat in the last month.