Best Cybersecurity ETFs 2026: CIBR, BUG, HACK

Search for the best cybersecurity ETFs of 2026 and you get lists of four funds: CIBR, HACK, BUG and IHAK. The funds share a theme in their names. What they own differs more than those lists suggest. One comparison page we quote below gives each fund an expense ratio and a size band and names a few typical top holdings for CIBR, with no weights and no filing date for the figures.

So we read the full book of each fund from its latest N-PORT report, the holdings filing every fund sends the SEC. Before ranking anything we removed the lines that are not stocks, because in one of the four funds the largest line is cash collateral from securities lending. Then we grouped the stocks that are not security specialists, matched the books against each other on ISIN, and added fees from the prospectus and flows from the same N-PORT reports.

Every number below comes from the StockFit API, mainly /api/fund/holdings, pulled on October 30, 2026, and each fund links to the SEC filing behind it. The four reports end on different dates, so each figure carries its period end. This is data about what the funds hold, not investment advice.

Best cybersecurity ETFs compared by what they hold

The short answer, one row per fund:

Two of the four funds carry large weights in companies that are not security specialists. Cisco and Broadcom are 14.47% of CIBR and 11.80% of HACK at June 30, 2026, and HACK adds 9.23% in General Dynamics and Northrop Grumman. BUG and IHAK hold none of those four companies. BUG has the most concentrated book, with its ten largest stocks at 62.57% of net assets on August 31, 2026. IHAK is the flattest, at 45.07% on July 31, 2026, once its 8.94% collateral line is set aside.

Read the table as profiles, not a ranking. The best cybersecurity ETF for one portfolio is the one whose book matches what that portfolio is meant to own, and a fund that matches can still be wrong for other reasons.

Why cybersecurity ETF rankings disagree

The pages that rank for this search quote numbers that drift apart, and the reasons are mostly mechanical. Three of them come up again and again.

Different dates

N-PORT holdings become public about 60 days after each quarter ends. These four were filed 52 to 59 days after their period ends, and the funds do not share a calendar: CIBR and HACK report for June 30, 2026, IHAK for July 31, 2026, and BUG for August 31, 2026, a filing that reached EDGAR only on October 29, 2026. A fact sheet, an issuer's daily file and a quarterly filing can all be correct and still disagree, because they describe different days. Our guide to how often ETF holdings update covers the timing in detail.

Stale fees

A comparison page at conceptticker.com lists CIBR's expense ratio as “0.60%”. CIBR's latest N-1A fee table, filed 2026-01-28, says 0.58%. The filings show the path: 0.60% in 2023, 0.59% in 2024, 0.59% in 2025, 0.58% in 2026. The page is marked last modified June 12, 2026, more than four months after that N-1A, yet its figure is the one from CIBR's 2023 filings. A dated page is not the same as a dated figure.

Holdings counts that are not stock counts

A fund's row count in N-PORT includes collateral, money market funds, currencies and futures. HACK reports 25 rows and holds 23 stocks. IHAK reports 48 rows and holds 35 stocks; the other 13 are two BlackRock cash funds, 10 currency balances and one futures contract. When two pages quote different holdings counts for the same fund, check which one counted rows.

CIBR vs HACK vs BUG vs IHAK, fund by fund

Largest first, each from its own latest filing:

A fifth fund often shows up in these comparisons. WCBR, the WisdomTree Cybersecurity Fund, held 25 stocks on June 30, 2026 with CrowdStrike 7.73%, Datadog 6.87%, Palo Alto Networks 6.75% at the top and its ten largest at 58.70%. It charges 0.45%, the lowest of the five, and had $103M in net assets, about a tenth of IHAK.

The same holdings-first approach graded the best semiconductor ETFs, the best AI ETFs of 2026 and the best data center ETFs. In each case the fund name told us less than the portfolio did.

What is not cybersecurity in a cybersecurity ETF

Cisco and Broadcom both sell security products. So do Microsoft and Alphabet. But security is one business line among many for each of them, and their weight in a fund moves with networking, chips or cloud as much as with security spending. We grouped those holdings into four buckets. The buckets are our classification, not the funds', so every member is named with its weight:

• Cisco and Broadcom: CIBR Cisco 7.75%, Broadcom 6.72%; HACK Broadcom 6.01%, Cisco 5.79%.
• Defense primes: HACK General Dynamics 4.93%, Northrop Grumman 4.30%.
• Government IT and defense services: IHAK Science Applications International 3.89%, CACI International 3.56%, Booz Allen Hamilton 3.33%; CIBR Leidos 1.60%, Booz Allen Hamilton 1.12%, Science Applications International 0.83%; BUG Telos 0.50%.
• Big platforms and IT services: CIBR IBM 1.88%, Alphabet 1.87%, Infosys 1.65%, Microsoft 1.65%, Accenture 1.32%.

21.02% of HACK sits in Cisco, Broadcom and two defense primes. CIBR's total in these buckets is larger, 26.37%, and it is spread over ten companies. That figure leaves out Thales (1.83%) and infrastructure names such as Arista and NetApp, which a stricter reader could add. IHAK's 10.78% in SAIC, CACI and Booz Allen is the largest government IT weight of the four, and it matches the “and Tech” in its name. BUG's only entry is Telos.

The N-PORT shows what a fund holds, not why. The rules that put defense primes in HACK or IT services companies in CIBR are in each fund's prospectus, and that is the document to read before treating any of these as a pure security fund.

Strip securities lending collateral before ranking

Sort IHAK's N-PORT holdings by weight and the first row is not a company. It is BlackRock Cash Funds: Institutional, SL Agency Shares at 8.94% of net assets: cash the fund received as collateral for shares it lent out, invested in a BlackRock money market vehicle. Here is a three-row request and its full response:

curl "https://api.stockfit.io/v1/api/fund/holdings?symbol=IHAK&pageSize=3" \
  -H "Authorization: Bearer $STOCKFIT_API_KEY"

{
  "page": 1,
  "pageSize": 3,
  "totalPages": 16,
  "totalResults": 48,
  "data": [
    {
      "name": "BlackRock Funds III: BlackRock Cash Funds: Institutional; SL Agency Shares",
      "cusip": "066922519",
      "isin": "US0669225197",
      "title": "BLACKROCK CASH FUNDS INSTITUTIONAL FUND SL AGENCY",
      "valueUsd": 90954253.81,
      "pctVal": 8.939760636216,
      "balance": 90926975.7192,
      "units": "NS",
      "assetCat": "STIV",
      "issuerCat": "RF",
      "country": "US",
      "payoffProfile": "Long",
      "fairValueLevel": 1,
      "reportDate": "2026-07-31"
    },
    {
      "name": "Qualys Inc",
      "cusip": "74758T303",
      "isin": "US74758T3032",
      "ticker": "QLYS",
      "title": "QUALYS INC",
      "valueUsd": 50876440.5,
      "pctVal": 5.000570957822,
      "balance": 351478,
      "units": "NS",
      "assetCat": "EC",
      "issuerCat": "CORP",
      "country": "US",
      "payoffProfile": "Long",
      "fairValueLevel": 1,
      "mappedCik": 1107843,
      "mappedSymbol": "QLYS",
      "reportDate": "2026-07-31"
    },
    {
      "name": "VARONIS SYSTEMS, INC.",
      "cusip": "922280102",
      "isin": "US9222801022",
      "ticker": "VRNS",
      "title": "VARONIS SYSTEMS INC",
      "valueUsd": 47205479.3,
      "pctVal": 4.639757548244,
      "balance": 1181614,
      "units": "NS",
      "assetCat": "EC",
      "issuerCat": "CORP",
      "country": "US",
      "payoffProfile": "Long",
      "fairValueLevel": 1,
      "mappedCik": 1361113,
      "mappedSymbol": "VRNS",
      "reportDate": "2026-07-31"
    }
  ],
  "reportDate": "2026-07-31"
}

The row has assetCat STIV (a short-term investment vehicle), no ticker and no mappedCik, while the two stock rows below it carry assetCat EC, a ticker and a CIK. In the filing itself, the same line carries a percent value of 8.939760636216 and the flag isCashCollateral set to Y. Our API does not return that flag as a field, so we identify collateral from assetCat and confirm it in the filing. All four funds carry some:

The collateral is an asset the fund owes back to the borrowers, so it is reported in addition to the stocks and the rows add up to more than 100% of net assets: about 103.1% for BUG and 101.6% for CIBR. Rank on raw rows and IHAK's largest holding is a cash fund, and BUG's six repo lines land in its holdings count. IHAK's book also has 10 currency lines worth about 0.05% together and one futures line, XAK Technology SEP26, at -0.04% (14 contracts). The simplest filter is to keep rows where assetCat is EC (equity, common), which is what every top-10 figure on this page uses. After that, IHAK's largest stock is Qualys at 5.00%.

The same collateral rows run through our comparison of the best ETF holdings APIs, which uses HACK as its worked example and compares the quarterly filing with the issuer's daily file.

Cybersecurity ETF overlap, matched on ISIN

13 companies sit in all four funds: PANW, CRWD, FTNT, OKTA, ZS, CHKP, TENB, QLYS, VRNS, S, ATEN, RDWR and Trend Micro. The matrix shows how much of each fund is in names another fund also holds:

87.62% of HACK sits in companies CIBR also holds, but only 67.67% of CIBR sits in companies HACK holds, because CIBR's extra names (the platforms, the contractors, the infrastructure names) are not in HACK. BUG's book is mostly inside CIBR's (84.56%) and inside IHAK's (84.44%), so adding BUG to either of those funds mostly raises the weight of names the first fund already holds. HACK and IHAK have the fewest shared companies, 14.

Why a CUSIP join misses Trend Micro

Trend Micro trades in Tokyo and has an ISIN (JP3637300009) but no usable CUSIP in any of the four filings: CIBR files it with the placeholder 000000000, and HACK, BUG and IHAK leave the CUSIP out. Here is row 15 of the same IHAK response (page=5 at pageSize=3), with an isin and no cusip, ticker or mappedCik:

{
  "name": "Trend Micro Incorporated",
  "isin": "JP3637300009",
  "title": "TREND MICRO INC JAPAN",
  "valueUsd": 37290119.2,
  "pctVal": 3.665191299797,
  "balance": 925500,
  "units": "NS",
  "assetCat": "EC",
  "issuerCat": "CORP",
  "country": "JP",
  "payoffProfile": "Long",
  "fairValueLevel": 2,
  "reportDate": "2026-07-31"
}

It is 3.67% of IHAK, 3.38% of HACK, 2.98% of BUG and 0.97% of CIBR. Join on CUSIP and the funds share 12 companies instead of 13, and every pairwise overlap comes out low.

/api/fund/overlap compares two funds in one call, and it matches on CUSIP. For these funds its shared counts come out one to three below the ISIN match: CIBR and HACK 19 against 20, CIBR and BUG 16 against 17, CIBR and IHAK 16 against 17, HACK and BUG 15 against 16, HACK and IHAK 13 against 14, BUG and IHAK 18 against 21. BUG and IHAK lose the most, because they also share NCC Group and Digital Arts, two more ISIN-only listings. For funds with non-US holdings, build the overlap from each fund's /api/fund/holdings rows and join on ISIN, as in the script below. Our ETF overlap API guide walks through the endpoint and its output.

Cybersecurity ETF fees, flows and country exposure

Expense ratios from the prospectus

/api/fund/fees returns the fee table from each fund's N-1A filings with the accession number. The four funds lowest first, then WCBR:

The spread from WCBR to HACK is 0.15 percentage points a year. One detail when you parse the response: for CIBR, BUG and WCBR the symbol field holds the SEC class ID, not the ticker, so keep your own ticker label on each row. BUG's latest row:

curl "https://api.stockfit.io/v1/api/fund/fees?symbol=BUG&pageSize=1" \
  -H "Authorization: Bearer $STOCKFIT_API_KEY"

{
  "page": 1,
  "pageSize": 1,
  "totalResults": 10,
  "data": [
    {
      "filedDate": "2026-03-28",
      "accessionNumber": "0001432353-26-000311",
      "symbol": "C000214985",
      "managementFee": 0.005,
      "distribution12b1Fee": 0,
      "otherExpenses": 0,
      "totalExpenseRatio": 0.005,
      "feeWaiver": null,
      "netExpenseRatio": null
    }
  ]
}

Our ETF fee analysis guide covers fee waivers and history across share classes.

Fund flows from N-PORT

/api/fund/profile returns net assets and the sales and redemptions reported in each N-PORT. For the latest quarter of each fund, net flows were: CIBR +$216.9 million (three months to Jun 30, 2026), HACK -$34.0 million (three months to Jun 30, 2026), BUG +$340.9 million (three months to Aug 31, 2026), IHAK +$65.5 million (three months to Jul 31, 2026). BUG took in more than CIBR in its latest quarter, though CIBR's net assets are about 8 times larger, and HACK was the only one with net outflows. The quarters end on different dates, so treat this as four separate readings, not a race. CIBR's net assets rose from $9.49 billion at March 31, 2026 to $13.84 billion at June 30, and only +$216.9 million of that came from flows; the rest is the change in market value of its holdings. Our guide to ETF fund flows explains how these totals are built.

Country exposure, as each filer codes it

/api/fund/chart/countries sums holdings by the country each filing reports. Lines coded US make up 87.92% of CIBR, 90.92% of HACK, 97.23% of BUG, 84.72% of IHAK, with Israel next for CIBR (4.49%), HACK (6.55%) and IHAK (5.71%). BUG shows no Israel line at all, and the reason is in the filing, not the portfolio: BUG's N-PORT reports Check Point and Radware with country US, while the CIBR, HACK and IHAK rows for both carry IL. The country chart also counts collateral and cash lines, which is why BUG's countries add up to more than 100%. To compare Israel exposure across issuers, remap each stock by its ISIN prefix (IL for both companies) instead of trusting the filed country.

Reproduce the comparison with the API

Everything above starts with one request per fund to /api/fund/holdings. This script pulls each fund's latest N-PORT book, keeps the stock lines, keys them by ISIN with a CUSIP fallback, and computes the top-10 weight and one overlap pair:

import os
import requests

BASE = "https://api.stockfit.io/v1/api/fund"
HEADERS = {"Authorization": f"Bearer {os.environ['STOCKFIT_API_KEY']}"}
NO_CUSIP = {None, "", "000000000"}


def stock_book(symbol):
    """Latest N-PORT holdings, stock lines only, keyed by ISIN with a CUSIP fallback."""
    resp = requests.get(
        f"{BASE}/holdings",
        params={"symbol": symbol, "pageSize": 1000},
        headers=HEADERS,
        timeout=30,
    )
    resp.raise_for_status()
    body = resp.json()
    book = {}
    for row in body["data"]:
        if row["assetCat"] != "EC":  # drops collateral, repo, cash funds, currencies and futures
            continue
        cusip = row.get("cusip")
        key = row.get("isin") or (cusip if cusip not in NO_CUSIP else None) or row["name"]
        book[key] = book.get(key, 0.0) + row["pctVal"]
    return body["reportDate"], body["totalResults"], book


def overlap(a, b):
    shared = a.keys() & b.keys()
    return len(shared), sum(a[k] for k in shared), sum(b[k] for k in shared)


books = {s: stock_book(s) for s in ["CIBR", "HACK", "BUG", "IHAK"]}
for symbol, (period, rows, book) in books.items():
    top10 = sum(sorted(book.values(), reverse=True)[:10])
    print(f"{symbol:5} {period}  {rows} rows  {len(book)} stock lines  top 10 = {top10:.2f}%")

n, in_a, in_b = overlap(books["CIBR"][2], books["BUG"][2])
print(f"CIBR/BUG: {n} shared, {in_a:.2f}% of CIBR, {in_b:.2f}% of BUG")

Applied to the responses we pulled on October 30, 2026, this logic gives:

CIBR  2026-06-30  44 rows  42 stock lines  top 10 = 58.06%
HACK  2026-06-30  25 rows  23 stock lines  top 10 = 52.13%
BUG   2026-08-31  36 rows  30 stock lines  top 10 = 62.57%
IHAK  2026-07-31  48 rows  35 stock lines  top 10 = 45.07%
CIBR/BUG: 17 shared, 49.09% of CIBR, 84.56% of BUG

From there, the buckets are a dictionary of tickers you choose, and the fees come from /api/fund/fees. Before paying for holdings, /api/fund/holdings/daily/supported-funds (free) confirms coverage: all five funds here are on the daily list, and /api/fund/holdings/daily serves their issuer files on the ETF and Pro plans. Keep daily and N-PORT figures in separate tables, since they describe different days. To go the other way and find every fund that holds one stock, such as CrowdStrike or Palo Alto Networks, see the reverse ETF lookup walkthrough.

N-PORT holdings are on the Starter, ETF and Pro plans, and a free API key covers fund profiles and the supported-funds list. Each figure on this page traces back to one of these filings on SEC EDGAR:

The SEC also publishes the same reports in bulk as the Form N-PORT data sets.

Pitfalls when comparing ETF holdings

Mixed period ends

Two months separate BUG's report (August 31, 2026) from CIBR's and HACK's (June 30, 2026). Weights drift with prices in that time, so a difference of a point or two between funds can be the calendar, not the strategy. Put the period end next to every figure, as the tables here do.

Share counts across a stock split

CrowdStrike began trading on a 4-for-1 split-adjusted basis on July 2, 2026. CIBR's June 30 filing shows 1,503,766 CrowdStrike shares, before the split. BUG held 117,400 on May 31, 2026 and 575,209 on August 31, 2026; the split alone turns the first number into 469,600, so most of the jump is not buying. Compare weights or values across period ends, not shares.

Change feeds full of collateral

Between BUG's May and August reports, no stock entered or left the fund. A change feed still shows six additions and one removal, all of them repo collateral lines. Filter on assetCat before you diff two holdings snapshots, or the collateral churn will look like trading.

Identifiers that are not there

Non-US listings often come with an ISIN and no CUSIP, or with a placeholder CUSIP of zeros. Any join that uses CUSIP alone will drop them silently, as the Trend Micro case shows. Use ISIN first, CUSIP second, and treat 000000000 as missing.

FAQ