Cybersecurity and Defense ETFs

• Two themes. Three funds hold cybersecurity companies and three hold aerospace and defense companies.
• Cost range. Expense ratios run from 0.35% to 0.60%, which is $250 a year on $100,000.
• Concentration varies. The ten largest holdings are 76% of ITA and 32% of XAR.
• Little cross-overlap. Cyber and defense funds share almost no stocks, apart from two contractors in HACK.
• Different recent paths. Cyber funds returned 31% to 39% in the year to Sep 30, 2026, while defense funds were about flat.
• Little income. SEC yields were below 0.5% where reported.

Holdings are dated Nov 9, 2026 (HACK Nov 10, 2026) and returns Sep 30, 2026, all from issuer pages. Net assets are issuer figures dated Nov 9, 2026.

These six funds follow two industries that both live on security budgets. Cybersecurity funds hold the software and networking companies that protect computer systems. Aerospace and defense funds hold the companies that build aircraft, engines, ships, missiles and satellites, mostly for governments and airlines.

The cybersecurity funds differ in how strictly they define the theme. BUG requires companies to earn at least half of their revenue from cybersecurity, so 97% of it sits in security software. CIBR admits large networking and IT services companies, which make up about 47% of the fund. HACK holds a short list of 23 names and includes two defense contractors.

The defense funds differ in weighting. ITA weights by size, so two companies are 38% of the fund. XAR spreads its money almost evenly over 50 stocks, which gives small space and drone companies 12% of the fund. PPA holds the longest list and reaches into defense technology and industrial suppliers.

When a cybersecurity fund fits: you want software companies whose sales depend on security spending. When a defense fund fits: you want aerospace manufacturers and military contractors. Neither is a broad market holding. These describe what the funds hold, not recommendations.

Inside each theme the three funds share many holdings, but the index rules lead to different portfolios. Among the cyber funds, overlap runs from 44% for CIBR and BUG to 64% for HACK and BUG. Among the defense funds it runs from 47% for XAR and PPA to 70% for ITA and PPA.

Weighting is the main cause on the defense side. Over five years to Sep 30, 2026, the size-weighted ITA returned 15.63% a year, the equal-weighted XAR 14.70% and PPA 17.31%. On the cyber side the definition matters more: over the same five years CIBR returned 16.63% a year, HACK 14.84% and the pure-play BUG 9.20%.

The table below groups each fund’s holdings by main business, using one scheme for all six funds.

Industry groups are assigned by this site from each stock’s main business, so they are comparable across funds but will not match an issuer’s own sector table. Cash and futures are left out.

All six issuers report returns to Sep 30, 2026, so the table compares like with like. Figures are annualized NAV total returns, net of fees.

Source: issuer fund pages (Amplify, First Trust, Global X, iShares, State Street and Invesco). BUG launched in 2019, so it has no 10-year figure. Past performance does not guarantee future results.

The two themes went different ways over the last year. The cyber funds returned between 30.94% and 39.41%, while the three defense funds were roughly flat, between -1.59% and -0.13%. Over three years the gap narrows, and over ten years all five funds with a record returned between 13.47% and 18.51% a year.

That pattern is a reason to be careful with one-year numbers. Read how to measure investment growth and P/E ratio explained before treating any figure as a forecast.

Neither theme is an income play. The 30-day SEC yield was 0.46% for ITA and 0.36% for PPA, since defense contractors pay dividends, and 0.05% for CIBR and -0.25% for BUG, since most security software companies pay none. HACK and XAR did not show a comparable figure on the pages used.

A negative SEC yield, as BUG shows, means the fund’s costs are larger than the dividends its stocks pay. ITA and XAR pay quarterly and BUG twice a year.

See what is dividend yield and yield vs total return for how income and price change add up.

Every comparison page matches the two funds’ full holdings by ticker and adds up the smaller of the two weights for each stock both hold.

Funds inside a theme overlap by 44% to 70%. Across the two themes the overlap is close to zero, with one exception: HACK shares 6% to 10% with the defense funds because it holds Northrop Grumman and General Dynamics.

Overlap is an estimate from issuer holdings dated Nov 9, 2026 (HACK Nov 10, 2026). Foreign shares are matched on the exchange ticker each issuer reports. Cash and futures are excluded.

Each page below puts two funds side by side on cost, holdings overlap, industry mix, concentration, returns and trading. Every figure carries its date, and the data room at the bottom of each page lists the source and grade of each number.

• 1. Theme definition Check how strictly the index defines the theme. BUG is pure-play, while CIBR and PPA cast a wider net.
• 2. Weighting Size-weighted funds such as ITA follow a few giants. Equal-weighted funds such as XAR lean on smaller companies.
• 3. Top holdings The largest position runs from 3.5% in XAR to 21.7% in ITA.
• 4. Cost Expense ratios run from 0.35% to 0.60% here. Add the bid/ask spread when you trade.
• 5. Overlap Compare with your core fund as well as with the other funds in the theme.
• 6. Size and trading Issuers reported 30-day median spreads from 0.06% to 0.13%. Larger funds usually trade more cheaply.
• 7. Dates and sources Compare returns only when the periods match, as they do on this page.

Start with how to research an ETF if the terms are new, and size any theme fund inside your whole allocation with asset allocation explained.

On a $100,000 balance, 0.35% is $350 a year, 0.50% is $500 and 0.60% is $600. The two cheapest funds are the defense funds XAR and ITA, and the cyber funds cost between 0.50% and 0.60%. Use the ETF Fee Calculator to turn a fee gap into dollars over time.

Trading costs come from the bid/ask spread and any premium or discount to NAV. Issuer pages showed 30-day median spreads of 0.06% for ITA and BUG, 0.07% for CIBR and PPA, 0.10% for XAR and 0.13% for HACK. Use limit orders for larger amounts.

A cheaper fund is not automatically the better holding if it owns something different from what you want. Start with the holdings, then use the fee to choose between funds that hold similar things.

You want pure cybersecurity companies: BUG holds only companies that earn most of their revenue from security. Compare it on the CIBR vs BUG page.

You want the largest cyber fund: CIBR is the biggest and adds large networking names. See HACK vs CIBR.

You want the big defense and aerospace names: ITA is weighted toward GE Aerospace and RTX. Read ITA vs XAR.

You want smaller defense and space companies to count: XAR weights its stocks about equally. See XAR vs PPA.

You are choosing between the two themes: CIBR vs ITA shows how little they share. Size any position against your whole portfolio with the Diversification Calculator.

Assuming all cyber funds match. CIBR and BUG share only 44% of their weight.

Ignoring concentration. Two stocks are 38% of ITA.

Owning two funds in one theme. ITA and PPA share 70% of their weight, so the second adds little.

Chasing last year. Cyber funds led over one year and defense funds led BUG over five. Leadership changes.

Buying on headlines. News about a breach or a conflict is usually in prices quickly, and budgets move slowly.

Making a theme the core. These funds hold one industry each, so they belong beside a diversified core.

Owning dozens of companies inside one theme lowers single-company risk, but it does not remove theme risk. The funds can fall together and the recovery can take years. Past gains are not a limit on future losses.

U.S.-listed funds such as HACK, CIBR, BUG, ITA, XAR and PPA trade in U.S. dollars. Buying them from a Canadian account usually involves converting Canadian dollars, which adds a cost, and a move in the U.S. dollar also changes your return in Canadian dollars.

Dividends paid to Canadian holders are generally subject to U.S. withholding tax, with treatment that depends on the account type. These funds pay little income, so the effect is small.

Confirm the rules for your accounts with a qualified tax professional, and see how to build an ETF portfolio for how a theme fund fits inside an allocation.

Figures come from the issuer pages for each fund: Amplify for HACK, First Trust for CIBR, Global X for BUG, iShares for ITA, State Street for XAR and Invesco for PPA. Fund facts and holdings are dated Nov 9, 2026 (HACK holdings Nov 10, 2026) and returns Sep 30, 2026. Gaps are shown as Not captured, and nothing was filled from memory or from another fund.

Overlap sums the smaller weight of each ticker held by both funds and is an estimate. Industry groups are assigned by this site so every fund uses the same labels. The pages are educational research, not personal advice, and they do not recommend any fund.

Pathways, not rankings or recommendations.