This cybersecurity ETF was up 37% in May. Why we see more upside ahead

The earnings season across key cybersecurity leaders reinforces a consistent message: AI is structurally lifting security demand.

  • |
  • Published on 05 Jun 2026

This cybersecurity ETF was up 37% in May. Why we see more upside ahead | Open a FREE FSMOne account and manage all your investments conveniently in ONE place
Photo by Markus on Unsplash

The Global X Cybersecurity ETF (BUG) rose 37% in May as sentiment shifted decisively in favour of cybersecurity, with investors increasingly viewing the sector as a clear beneficiary of AI-driven disruption rather than a casualty of it.

Earnings across Fortinet, Zscaler, Palo Alto Networks, and CrowdStrike broadly exceeded expectations, reinforcing our core thesis, with management consistently highlighting AI as a key catalyst for stronger cybersecurity demand.

Post-earnings share price weakness was largely driven by profit-taking rather than any deterioration in underlying demand fundamentals.

Despite the sharp rally in May, valuations of the BUG ETF remain attractive; we reiterate our USD 57 target price, implying 58% upside as of 4 June 2026.

The Global X Cybersecurity ETF (NASDAQ:BUG) is up approximately 24% since our last update on May 8, and up 37% in May alone. Sentiment on cybersecurity stocks has begun to shift meaningfully, as investors recognise that frontier AI models like Anthropic's Claude Mythos are more likely to create incremental demand for security than to displace incumbent cyber leaders.

In this article, we review the most recent quarterly results of some of BUG's top holdings and highlight what management teams are saying about the direction of the industry.

Related article: Frontier AI meets cybersecurity: Disruption fears are creating a 96% upside opportunity

Figure 1: Cybersecurity stocks are making a comeback


Cybersecurity earnings roundup: AI tailwinds gain momentum

Fortinet

Fortinet's 6 May earnings report proved to be a catalyst moment for the entire sector. The stock surged 20% on the day, prompting a broad reassessment of cybersecurity names at a time when AI disruption fears had weighed heavily on valuations. Revenue jumped 20% year-over-year to USD 1.85 billion, comfortably exceeding consensus estimates of USD 1.74 billion. Product revenue was particularly strong, climbing 41% year-over-year to USD 645 million on strong enterprise demand for its firewall during an ongoing hardware refresh cycle.

The company also delivered its strongest billings growth in more than three years. Billings, which serve as a leading indicator of future revenue, increased 31% year-over-year to USD 2.09 billion. Growth was broad-based across its major business lines, with Secure Networking, Unified Secure Access Service Edge (SASE), and Security Operations expanding 32%, 31%, and 23% respectively. Adjusted earnings per share came in at USD 0.82, significantly ahead of consensus expectations of USD 0.62.

Management raised its fiscal 2026 outlook across key metrics, including revenue, billings, and adjusted earnings per share. During the earnings call, Chief Financial Officer Christiane Ohlgart highlighted that “AI is expanding the attack surface and increasing performance requirements, which is driving higher and more durable security spend across networking, SASE, and security operations.”

Table 1: Fortinet’s latest earnings

1QFY26

1QFY25

Beat/Miss vs Estimate

YoY change

Revenue

1,849.6

1,539.7

6.6%

20.1%

Net Income

534.5

433.4

33.8%

23.3%

Adjusted diluted earnings per Share

0.82

0.58

32.2%

41.4%

Source: Fortinet 1QFY26 Press Release, Bloomberg. Data as of 6 May 2026.

Figures are in USD millions except percentages and per share amounts. 

Zscaler

Zscaler delivered a solid operational beat in its fiscal third quarter, though a disappointing forward outlook overshadowed the headline numbers and sent the stock sharply lower. Revenue rose 25% year-over-year to USD 850.5 million, surpassing analyst expectations of USD 835 million. Annual recurring revenue (ARR) also increased 25% to USD 3.53 billion, while net new ARR grew 34% year-over-year to USD 166 million, reflecting continued demand for the company's cloud-native security platform.

Customer adoption of Zscaler's Zero Trust solutions remained robust, with the number of enterprises using its Zero Trust Everywhere platform exceeding 700, up from 550 in the previous quarter. Management struck an optimistic tone on the demand outlook, describing AI and frontier models as potentially the strongest growth tailwinds the company has ever experienced.

Adjusted earnings per share came in at USD 1.08, ahead of consensus estimates of USD 1.01. However, investors focused on the fiscal 2027 guidance, where management projected ARR growth of 16% to 17%, below consensus expectations of 19% to 20%. The company attributed the more cautious outlook to the departure of two sales leaders and a prudent approach to forecasting during the transition. As a result, shares fell 31.5% following the announcement, giving back a significant portion of the 41% rally recorded in May ahead of earnings.

Table 2: Zscaler’s latest earnings

3QFY26

3QFY25

Beat/Miss vs Estimate

YoY change

Revenue

850.5

678.0

1.8%

25.4%

Net Income

-13.9

-4.1

36.0%

-

Adjusted diluted earnings per Share

1.08

0.84

6.8%

28.6%

Source: Zscaler 3QFY26 Press Release, Bloomberg. Data as of 26 May 2026.

Figures are in USD millions except percentages and per share amounts. 

Palo Alto Networks

Palo Alto Networks reported fiscal third-quarter 2026 revenue of USD 3.0 billion, representing year-over-year growth of 31%. This included USD 388 million from its recently acquired CyberArk and Chronosphere businesses.

Like Fortinet, Palo Alto saw strong demand for next-generation firewalls as enterprises secured their data centre buildouts, with firewall bookings growing nearly 40% year-over-year. Next-Generation Security (NGS) ARR grew 60% to USD 8.1 billion, while remaining performance obligation (RPO), a measure of contracted future revenue, rose 36% year-over-year to USD 18.4 billion, reflecting deeper customer commitments driven by the company's platformisation strategy.

Although GAAP net income turned negative due to acquisition-related accounting charges and stock-based compensation expenses, adjusted earnings per share of USD 0.85 exceeded consensus estimates of USD 0.79. Management raised its fiscal 2026 outlook across revenue, NGS ARR, RPO, and earnings per share. CEO Nikesh Arora emphasised that recent advances in frontier AI models have significantly increased the urgency around cybersecurity and are reshaping the industry's long-term growth trajectory.

Despite the strong results, shares declined 5.6% following earnings, likely reflecting profit-taking after a substantial 57% rally in the weeks leading up to the announcement.

Table 3: Palo Alto Network’s latest earnings

3QFY26

3QFY25

Beat/Miss vs Estimate

YoY change

Revenue

3,002.0

2,289.0

2.0%

31.1%

Net Income

-177.0

262.1

4.9%

-

Adjusted diluted earnings per Share

0.85

0.80

7.3%

6.3%

Source: Palo Alto Networks 3QFY26 Press Release, Bloomberg. Data as of 2 June 2026.

Figures are in USD millions except percentages and per share amounts. 

CrowdStrike

CrowdStrike continued to demonstrate strong execution in its fiscal first quarter, reporting revenue of USD 1.39 billion, up 26% year-over-year and ahead of consensus expectations of USD 1.36 billion. Annual recurring revenue increased 24% to USD 5.51 billion, underscoring the continued expansion of its Falcon platform across enterprise customers.

One of the standout highlights was the rapid adoption of AI Detection and Response (AIDR), CrowdStrike's solution designed to combat threats generated by AI agents. ARR for the offering grew more than 250% sequentially, while the fiscal second-quarter pipeline exceeded USD 50 million. Platform consolidation trends also remained favourable, with 51% of subscription customers now using six or more Falcon modules, compared to 48% a year ago.

Adjusted earnings per share came in at USD 1.10, significantly above both the prior year's USD 0.73 and consensus expectations of USD 1.07. Supported by strong demand and favourable AI-related tailwinds, management raised guidance for revenue and other key metrics. Executives noted that cybersecurity is increasingly being viewed not simply as a risk management tool, but as a critical enabler of enterprise AI adoption following the emergence of advanced frontier models such as Mythos.

The company also announced a four-for-one stock split. Despite the strong results and raised guidance, shares fell 3.8% following earnings, likely reflecting profit-taking after a 64% gain during May.

Table 4: CrowdStrike’s latest earnings

1QFY27

1QFY26

Beat/Miss vs Estimate

YoY change

Revenue

1,385.6

1,103.4

1.7%

25.6%

Net Income

27.8

-104.3

-

-

Adjusted diluted earnings per Share

1.10

0.73

2.7%

50.7%

Source: CrowdStrike 1QFY27 Press Release, Bloomberg. Data as of 3 June 2026.

Figures are in USD millions except percentages and per share amounts. 


Secular tailwinds remain firmly intact, with further upside ahead

The latest earnings season reinforces our view that the cybersecurity industry's long-term growth story remains firmly intact. Most companies delivered results and guidance that exceeded expectations, with several post-earnings share price declines appearing to be driven more by profit-taking than any deterioration in business fundamentals.

More importantly, management teams across the sector consistently highlighted AI as a genuine incremental growth driver rather than a disruptive threat. As AI models become more capable and widely deployed, organisations face a larger attack surface, higher volumes of automated attacks, and increasingly sophisticated threat actors, all of which are translating into stronger demand for advanced cybersecurity solutions. At the same time, persistent threats against critical infrastructure continue to support elevated enterprise security budgets.

Within the sector, we continue to favour platform leaders such as CrowdStrike and Palo Alto Networks. Both companies are well positioned to benefit from ongoing vendor consolidation trends as enterprises seek to reduce complexity by adopting integrated security platforms. Their broad product portfolios spanning endpoint, cloud, identity, and security operations also make them more resilient to potential AI-driven disruption than narrowly focused competitors.

For investors seeking diversified exposure without the risks associated with individual stock selection, the Global X Cybersecurity ETF (NASDAQ:BUG) remains an attractive option. We maintain our target price of USD 57 for BUG, implying approximately 58% upside from its closing price on 4 June 2026.

Table 5: Projections for the Indxx Cybersecurity Index

IBUGT Index

2025

2026E

2027E

2028E

Earnings Per Share (EPS)

78.4

87.7

99.0

114.6

Earnings Growth YoY

17.8%

11.8%

12.9%

15.7%

PE Ratio (X)

27.0

29.0

25.7

22.2

Target Price for Index (based on a fair PE of 35X)

4,011

Upside Potential

57.9%

Target Price for ETF (USD)

57

Source: Bloomberg Finance L.P., iFAST estimates.

Data as of 4 June 2026

Figure 2: Share prices are driven by earnings growth in the long run

Declaration:

This research report was prepared with the assistance of artificial intelligence (AI) tools. iFAST Financial Pte Ltd does not rely exclusively on AI for content generation; the content of this report – including all investment theses, ratings, price targets and conclusions – has been independently reviewed and verified by the research analyst(s) to ensure accuracy and professional integrity.

For specific disclosure, at the time of publication of this report, IFPL (via its connected and associated entities) holds a NIL position in the abovementioned securities. The analyst who produced this report holds a position in Fortinet and Palo Alto Networks. 

All materials and contents found in this site are strictly for general circulation and informational purposes only and should not be considered as an offer, or solicitation, to deal in any of the funds or products found/identified in this site. While iFAST Financial Pte Ltd ("IFPL") has tried to provide accurate and timely information, there may be inadvertent delays, omissions, technical or factual inaccuracies and typographical errors. Any opinion or estimate contained in this report is made on a general basis and neither IFPL nor any of its servants or agents have given any consideration to nor have they or any of them made any investigation of the investment objective, financial situation or particular need of any user or reader, any specific person or group of persons. You should consider carefully if the products you are going to purchase are suitable for your investment objective, investment experience, risk tolerance and other personal circumstances. If you are uncertain about the suitability of the investment product, please seek advice from a financial adviser, before making a decision to purchase the investment product. Past performance is not indicative of future performance. The value of the investment products and the income from them may fall as well as rise. Opinions expressed herein are subject to change without notice. In respect of any matters arising from, or in connection with the said research analyses or research reports, recipients of the report are to contact IFPL at 10 Collyer Quay, #26-01 Ocean Financial Centre Building, Singapore 049315, or by telephone at +65 6557 2853. Where the report contains research analyses or research reports from a foreign research house and if the recipient of such research analyses or research reports is not an accredited investor, expert investor, institutional investor or an ex-accredited investor, IFPL accepts legal responsibility for the contents of such analyses or reports to such persons only to the extent as required by law. Please note that only certain security(ies) herein are available to all investors, while the rest are only available for certain persons to invest in, such as Accredited Investors (as defined in the Securities and Futures Act) or one who invests at least S$200,000 (or its equivalent currency) per transaction. To qualify as an Accredited Investor, one needs to submit a declaration form and certain relevant supporting documents, according to iFAST’s prevailing policies and procedures.

Please read our full disclaimers on the website at ( https://secure.fundsupermart.com/fsmone/policies/328125/investment-account-terms-&-conditions).

iFAST Financial Pte Ltd (IFPL) (registered address: 10 Collyer Quay #26-01 Ocean Financial Centre Singapore 049315, Telephone: 6557 2000) holds the Financial Advisers Licence issued by the Monetary Authority of Singapore ('MAS') to conduct regulated activities of advising on securities, marketing of collective investment schemes and arranging of any contract of insurance in respect of life policies, other than a contract of reinsurance and the Capital Markets Services Licence issued by the MAS to conduct regulated activities of dealing in securities and providing custodial services for securities. While IFPL has made every effort to ensure the independence of the report's contents, IFPL's nature of business is such that IFPL and its connected and associated entities together with their respective directors, officers and staff may be involved in providing dealing or investment-related services in the abovementioned securities, and have taken or may take positions in the securities mentioned in this report, and may also act as the principal for any buy or sell trades.

Ways to Invest with FSMOne
Why FSM
Don't have an account with us?
Open an account here
Need Financial Advice?
Make an appointment

We use cookies If you close this message or continue to use this site, you will consent to the use of Cookies, unless you choose to disable them. Click on our Privacy Policy to understand more.