Every time major data breach strikes a well-known company, cybersecurity stocks outperform the public markets by about fivefold on average.
That’s one of the findings of Bessemer Venture Partners’ newly debuted Cyber Index. The venture capital firm’s collection of tickers tracks the performance of 29 pure-play cybersecurity companies as weighted by their market capitalizations (where larger companies count for more than smaller ones) since January 2011.
Get Data Sheet, Fortune’s technology newsletter.
BVP, best known for investing in startups such as Pinterest, Box (BOX), Yelp (YELP), and LinkedIn (LNKD), pulled together the index as part of its research on the cybersecurity sector, in which it has made three dozen investments since 1993. The firm currently has 11 early stage cybersecurity startups in its portfolio, including Endgame, Auth0, Dashlane, and Virtru.
You’ll notice some big names absent from the Index: No Cisco (CSCO), no Hewlett Packard Enterprise (HPE), no Intel (INTC), no IBM (IBM). That’s because these companies engage in security as a side business; the Index showcases companies that are cyber through and through.
On the list is a wide-ranging set of cybersecurity firms. Domestic success stories like Palo Alto Networks (PANW) and Fortinet (FTNT), next to internationals such as Check Point (CHKP) and Gemalto (GTOFF), beside tinier firms like Zix (ZIXI), an email security firm, and Mobileiron (MOBL), a mobile security firm.
In the stock chart, reproduced below, one can see the fluctuations of cybersecurity share price compared with standard measures of market performance over time, like the Nasdaq and S&P 500. You’ll notice the plots generally follow each other, except the Index’s gains outpace the others by about double. The Index also gets a boost right after big data breaches are announced.
Fear fuels the business. For the most part, the share price ups and downs stay in sync (barring an early 2014 cybersecurity market correction). Yet in the wake of major hacks, the Cyber Index takes off.
In January 2014, a month after the public learned that hackers had ransacked retailer Target (TGT), the cybersecurity sector’s share prices spiked 27% compared with the Nasdaq’s 3% and the S&P’s nada, according to BVP’s findings. After attackers breached film studio Sony (SNE) Pictures at the end of that year, cybersecurity stocks jumped 12% versus the Nasdaq’s and S&P’s 5%. And after we learned of last year’s robbing of the health insurer Anthem (ANTM), cyber stocks surged 29% in contrast to the Nasdaq’s 5% and the S&P’s 9%. You get the idea.
“Hackers continue to move the needle,” Sunil James, a cybersecurity investor at BVP and alum of Google (GOOG), Amazon (AMZN), and Mandiant, told Fortune on a call. He said he believes that entrenched security companies often have a hard time coping with the latest attacks, so they lean on acquisitions to stay ahead. “Often you don’t find bleeding-edge capabilities in their tool kits just yet—that’s why they buy companies.”
The prospect of such exits coupled with heightened fears about hacking has made cybersecurity an attractive sector for venture capital dollars in recent years. Recently, though, there has been a notable chilling in the industry, and earlier stage companies have had more difficult time raising funding (a predication that Fortunemade at the end of last year).
For more on cybersecurity startup funding, watch:
David Cowan, head of BVP’s cybersecurity practice, puts the predicament of the incumbents in blunter terms. “All these public company stocks we’re tracking are basically selling obsolete products,” he told Fortune, mentioning that he expects an uptick in mergers and acquisitions to take place. “The only way to sustain this growth rate is to develop a successful or rapid cadence for acquiring smaller companies. In the security space all the innovation comes from startups.”
For reference, here is a list of all the companies included in BVP’s Cyber Index:
Absolute Software (ALSWF)
AVG Technologies (AVG)
Barracuda Networks (CUDA)
Check Point Software (CHKP)
Cyberark (CYBR)
F-Secure (FSOYF)
FireEye (FEYE)
Fortinet (FTNT)
Gemalto (GTOFF)
Guidance Software (GUID)
Imperva (IMPV)
Imprivata (IMPR)
KEYW Holding (KEYW)
Lifelock (LOCK)
Mantech International (MANT)
Mobileiron (MOBL)
NQ Mobile (NQ)
Palo Alto Networks (PANW)
Proofpoint (PFPT)
Qualys (QLYS)
Radware (RDWR)
Rapid7 (RPD)
Sophos
Splunk (SPLK)
Symantec (SYMC)
Trend Micro (TMICY)
Vasco Data Security International (VDSI)
VeriSign (VRSN)
Zix (ZIXI)
This isn’t the first time that Bessemer has debuted an index. In 2013, the firm put out a Cloud Index that tracks the performance of cloud software companies—like Hubspot (HUBS), Salesforce (CRM), and Workday (WDAY)—in the public markets. The companies included had a combined market cap of $100 billion, and cap-weighted returns that, like the Cyber Index, also exceeded the Nasdaq and S&P.
“We believe that the companies we’re creating ultimately have to partner with these public companies, that’s why we need to ultimately understand them,” Cowan said, explaining the rationale behind the creation of the firm’s indexes.
The Cyber Index is the latest addition to the BVP family. Even barring the spikes that accompany big data breaches, investors’ cybersecurity bets seem to have paid off. Now you know: If you’re looking to buy securities, you might consider investing in, well, security.
