Key Takeaways
- Cybersecurity stocks outperformed both semiconductors and broader software in May, driving the First Trust Nasdaq Cybersecurity ETF (CIBR) to fresh intraday highs.
- CIBR rose roughly 25% for the month, beating the iShares Semiconductor ETF (SOXX) and the iShares Expanded Tech‑Software Sector ETF (IGV).
- Semiconductors remain a powerful force, with SOXX up nearly 80% year‑to‑date despite a mid‑May pullback.
- The software sector lagged, posting only a 12% May gain and still down double‑digits for the year.
- CIBR’s holdings blend pure‑play security firms with networking, cloud, AI, and legacy infrastructure giants, reflecting the evolving nature of the cybersecurity trade.
- Individual leaders such as CrowdStrike, Palo Alto Networks, Fortinet, F5, Datadog, and Cisco each hit new intraday records, adding tens of billions in market value.
- Some names—Zscaler, Okta, Dynatrace, and Check Point—have lagged, highlighting uneven participation within the group.
- The technical level to monitor is CIBR’s former breakout zone near $78; holding above it would reinforce leadership, while a drop below could signal a failed rally.
Overview of May Market Dynamics
May saw a notable shift in the technology leadership hierarchy. While semiconductors have historically powered the bull market, cybersecurity stocks surged to the forefront, outpacing both chip makers and the broader software complex. This reversal was evident in price action, with cybersecurity‑focused ETFs achieving fresh highs while semiconductor ETFs struggled to maintain their earlier momentum. The shift underscores how investor sentiment can quickly reallocate capital within tech, favoring areas perceived as essential for digital resilience and growth.
Performance of Cybersecurity ETF (CIBR)
The First Trust Nasdaq Cybersecurity ETF (CIBR) was the standout performer, gaining about 25% during the month. This outpaced the iShares Semiconductor ETF (SOXX) and the iShares Expanded Tech‑Software Sector ETF (IGV), which posted more modest returns. CIBR also notched seven consecutive intraday record closes after clearing its October high, signaling strong buying interest and sustained upward pressure. The ETF’s rally reflects a broader conviction that cybersecurity is becoming a core pillar of tech investment.
Semiconductor Strength Persists
Despite the cybersecurity rally, semiconductors continued to play a vital role in the market’s advance. SOXX posted an impressive near‑80% gain year‑to‑date and was up more than 60% for the quarter, even after experiencing a modest pullback of just over 10% from its May 11 peak to its May 19 low. Buyers re‑entered the space quickly, demonstrating that the chip trade remains a significant source of momentum, even if it temporarily yielded the spotlight to security stocks.
Software Sector Lagging
The broader software sector, represented by IGV, failed to keep pace with cybersecurity’s surge. IGV rose roughly 12% in May and held its ground after the S&P 500 peaked on May 14, yet it remains down double‑digits for the year and is still about 20% below its closing high. This contrast highlights that while software benefits from secular trends, the immediate appetite for pure‑play security solutions has outstripped demand for general‑purpose enterprise applications.
Composition of CIBR and Broader Cybersecurity Definition
CIBR is not a pure‑play cybersecurity basket; its largest holdings include Cisco (CSCO), Alphabet (GOOGL), and Broadcom (AVGO), which bring networking, cloud, chip, and AI‑infrastructure exposure into the mix. This composition illustrates how the cybersecurity trade has evolved: it now encompasses software‑based threat detection, cloud‑security platforms, AI‑driven analytics, and traditional enterprise spending on network hardware. The blend captures the sector’s expansion beyond firewalls into a holistic digital‑risk‑management ecosystem.
Individual Stock Leaders
Underpinning the ETF’s strength, several constituent stocks achieved new intraday records. CrowdStrike (CRWD) led with eight consecutive record closes, while Palo Alto Networks (PANW), Fortinet (FTNT), F5 (FFIV), and Datadog (DDOG) also hit fresh highs on the same day. Cisco’s addition as a legacy‑networking heavyweight further reinforced the breakout narrative, showing that both pure‑play security firms and established infrastructure providers are benefiting from heightened demand for cyber resilience.
Market Value Additions
The rally translated into tangible gains in market capitalization. CrowdStrike, Palo Alto Networks, Datadog, Fortinet, and Cisco each added tens of billions of dollars in market value throughout May. This influx of capital underscores the scale of investor enthusiasm and the perceived durability of the cybersecurity growth story, as companies that provide essential protection tools saw their valuations rise sharply amid heightened threat landscapes and increased enterprise spending on security.
Lagging Stocks and Challenges
Not every cybersecurity name participated equally in the advance. Zscaler (ZS) and Okta (OKTA) showed rebounds but remained well below their historical peaks, while Dynatrace (DT) lagged behind the broader group’s rebound. Check Point (CHKP) continued to wrestle with a long‑standing resistance level reminiscent of its dot‑com‑era ceiling. These disparities suggest that while the sector enjoys strong tailwinds, individual companies face varying execution challenges, valuation concerns, or competitive pressures that temper their upside.
Technical Level to Watch
A critical technical juncture for CIBR lies around its former breakout zone near $78. Maintaining prices above this level would reinforce the notion that cybersecurity has secured a leadership position within tech, potentially paving the way for further gains. Conversely, a decisive move below $78 could cast doubt on the sustainability of the rally, framing the recent advance as another temporary tech breakout that failed to establish a durable new trend. Traders and investors will likely monitor this threshold closely for clues about the sector’s next directional move.
Conclusion and Outlook
May’s market action highlighted a temporary but powerful shift toward cybersecurity as the leading edge of tech leadership, even as semiconductors continued to underpin the broader bull market. The strength of CIBR, bolstered by both pure‑play security firms and diversified technology giants, reflects an evolving investment thesis that blends software, cloud, AI, and traditional infrastructure. While some names lagged, the overall group added substantial market value and displayed technical resilience. Whether this momentum sustains will hinge on holding key support levels, continued enterprise spending on security, and the ability of cybersecurity companies to translate heightened demand into consistent earnings growth. As always, investors should remain vigilant to valuation stretches and sector‑specific risks, but the current environment suggests cybersecurity will remain a focal point in the tech narrative for the foreseeable future.
Jared Blikre is the global markets and data editor for Yahoo Finance. Follow him on X at @SPYJared or email him at [email protected].