Navigating Cybersecurity in the Age of AI

In this episode, Andrew Wilkinson speaks with Alexander Gunz, Fund Manager at Heptagon Capital, about the evolving cyber security landscape. They explore the growing risks posed by AI advancements, the increasing scale of cyber threats, and how businesses and investors can navigate these challenges in both public and private sectors.

Summary – IBKR Podcasts Ep. 195

The following is a summary of a live audio recording and may contain errors in spelling or grammar. Although IBKR has edited for clarity no material changes have been made.

Andrew Wilkinson 

Welcome to today’s episode. My name is Andrew Wilkinson. My guest today is once again, Alexander Gunz, who is a Fund Manager for Heptagon Capital in London. Alex, your latest commentary at Heptagon Capital is live on the website, and you’ve returned to discussing cyber security, which you last wrote about in 2017, although I know this has been a big theme for you since probably 2011, correct me if I’m wrong, but two things caught my eye. 

First, as much as the growth of AI is likely to revolutionize more than just our way of life, it’s inherently wrapped up in creating cyber security risks. So with that backdrop, the second item you mentioned is that you say cyber security remains at least as big a risk today as it did when we previously explored the topic seven years ago. 

Please put that into perspective for us. 

Alex Gunz 

It’s an absolute pleasure to do that, Andrew, and before I start, thanks clearly for being on your show once again, and we’re always delighted to talk about future trends here at Heptagon. Really, the starting point in the way I’d frame this whole discussion is, in fact, as you alluded to, to go right back to 2011. 

The very first thematic white paper we wrote here at Heptagon, it’s available on our website along with all of the others, was called The Data Deluge. And we made a very simple argument in that piece that remains as valid today as it did then. In it, we said data is only going to grow exponentially, both the amount we produce and the amount we consume. 

However, that data will have zero value unless you secure it, you store it, and you analyze it. And that creates a whole swathe of investment opportunities. But just if we take a tiny step back, what do we mean by that statement about data growing, data having no value? And to give you some context, think about it in the following way. 

This year, 90% of all data that’s ever been created will have begun or started from scratch. That’s the rate at which data is growing. If you go back to 2010, 2011, the time we wrote it, the amount of physical data, or virtual data if you will, in the world has gone up by something like 80 times. So, the sheer volume of data that needs to be secured is only getting bigger and bigger. 

AI, in our opinion, is only going to amplify that, and whilst it will clearly give defenders, people trying to secure their data, a new set of tools, by the same token it’s clearly going to give the malicious actors, the attackers, a new set of tools, too. 

Andrew Wilkinson 

Now, Alex, cyber threats have increased by four-fold in the last three years. Tell us, who is at risk? And the scale and scope of such attacks, please. 

Alex Gunz 

I think the simplest answer to your question, Andrew, is that everyone’s at risk. There’s no way of beating around the bush in that sense. And something we may well come on to address in more detail later on in this conversation is that you talk to any business, you talk to any Chief Technology Officer or Chief Information Security Officer, and they will tell you that the number one risk in their organization is someone like you, someone like me, any of our colleagues we might be sitting next to. 

And that’s basically why, when you take the figures they’re absolutely huge. Again, I’d love to share a couple with you. The conventional wisdom is that this year, cyber-attacks will cost the world something like $9 trillion dollars and to frame that figure nine trillion dollars for everyone listening, that’s equivalent to about a third of the US’s GDP or about 25x Apple’s last reported revenues. So it’s an utterly nontrivial figure. When you actually delve into the weeds, there’s some other data that’s really quite shocking, I think, for many people to learn and to understand when they’re trying to get a gauge of the significance of this problem. 

You look at businesses with revenues of over $5 billion and the data suggests that in the last 12 months, 72% of them have experienced cyber-attacks. When you try and delve into it by industry, you’ll find that typically tech companies are probably the number one target, followed by Telecoms Businesses, Consumer Services, Retail Businesses, another obvious target. 

And then finally Government Entities, perhaps because their security protocols aren’t always so robust. And then to come back to the more human element, or human angle, it’s also people like you and me, people we know. And the reality is that humans are weak, they are flawed people, they’re susceptible to scams, and that’s why phishing attacks are so significant. 

Andrew Wilkinson 

So would you agree that we might just need to learn to live with cyber threats to that extent, Alex? 

Alex Gunz 

I think that’s a very fair contention, Andrew. I mean, tools will only take you so far. And we’ve consistently argued in our own work on cyber, we make the point again in the piece that we published earlier in September at Heptagon, is that cyber is ultimately a very asymmetric industry.  

The biggest problem and the sad reality is that even if 99% of all threats are stopped in some fashion by an effective cybersecurity solution, an effective tool, it’s the 1%, those tiny few that get through that cause untold damage, and that damage can be both reputational and it can be financial.  

Without wanting to trivialize the problem, often when I get asked this question, or a variant of this question, I quote a very famous sports personality, actually. Mike Tyson once famously or notoriously said, “Everyone has a strategy until they get punched in the face”. And I think that’s the sad reality of cyber. 

So yes, you are going to see a huge increase in cyber spend. Again, consensus forecasts are suggesting something like a 15% year on year increase in ‘24 versus ‘23. AI, as we said, will give a whole new set of tools, both to attack us, but more importantly to defend us. 

But those tools, I would argue, are only necessary. They’re far from sufficient. The sufficiency really comes through better education, better training, and almost as our Chief Technology Officer here at Heptagon would say, it’s creating that culture of paranoia. It’s making people aware that they are always potentially going to be at risk. 

Andrew Wilkinson 

Alex, I think when we last spoke, you mentioned the fact that it’s very difficult to pin down the investing winners, or winners for investors within this field, because a lot of what are public companies get taken private.  

Who do you see as being the future winners in both the public and private arenas from this perspective? 

Alex Gunz 

The challenge, I think, both practical buyers of cyber products have, as well as investors looking at it from a different angle, is the following. And the reality is, sadly, the pace of threats is typically much faster than the ability that defenders have to respond to them. 

So you’re constantly in a position of playing catch up. And particularly if you’re a large organization, the challenge of getting new products rolled out quickly enough often becomes very difficult. The corollary of that is really the following.  

Our view has always been that if you want to play cybersecurity from an investment perspective, and we are talking here either public markets or private markets, then to our mind there are really only two ways of doing it. 

You’ve either got to find those businesses that are in really cool, really specific niches that are doing something different, something proactive, and it’s almost like an incremental add on. Some genuine value add for a cyber buyer. Or, you go to the opposite end of the spectrum, and you’re basically saying, look just listen to what chief executives of cyber companies are saying. Listen to what’s being said on the internet. 

And your typical IT buyer is really suffering from fatigue. Your average company might be buying from 10 to 12 different vendors. They might have 70 to 80 different cyber products. And that’s a really big challenge. Almost where you get to with this line of thought is the logic for consolidation, the logic for platformization. 

I’m reluctant to cite any specific names in public here, but I think it should be fairly evident who we’re alluding to. Businesses that have pivoted, if you will, to this platform position where they can effectively offer a much larger sort of bundle, if you will, of services to a potential buyer. 

That can potentially be a very attractive solution both to solving practical cyber problems and for investors seeing potentially compelling returns. 

Andrew Wilkinson 

So Alex, you and I very recently met in New York late summer. What were the highlights of the trip? But more than anything, I know you spoke to a lot of people in the run up to the US election. What are your takeaways here? 

Alex Gunz 

It was a wonderful trip to the U. S.; I think both from a business and from a personal point of view. And without a doubt, there were a few highlights. Number one, from a political perspective, it was abundantly obvious to me just how divided the country currently is. That said, almost everyone with whom I spoke, whether it was people in industry, people within the world of fund management and financial services, or just people on the street like taxi drivers, people in bars, there seems to be no clear consensus today, or certainly no clear consensus in August, no clear consensus even today, mid to late September, on who’s going to be in the White House. 

So that will create a huge amount of uncertainty. 

All of that said, just on this topic of politics, we made this observation back in 2016. Listeners will clearly recall that Hillary was ahead in the polls for a long time, and then Donald Trump won the election. The consensus or conventional view back in late ‘16 was that Donald Trump would be a disaster for the economy and for the stock market. 

The reality was quite the opposite. The economy grew, the stock market went up. albeit from a perspective of low interest rates, low inflation and no exogenous wars or diseases. So I think the key takeaway from this respect anyway, Andrew, is that we should be very wary of inferring any immediate consequences from what’s going to happen when we have the election on November 5^th. 

I guess the second observation that was abundantly clear to me was that in almost every conversation we had with businesses there, some of that debate came back to the topic of AI. And AI, I have no doubt, is going to be a game changer. The bigger question in our mind is really the length of time this AI story is going to play out. 

And then perhaps more interestingly, from a number of the businesses with whom we spoke is about trying to consider the second derivative. And what I mean by that is the following. AI is great, but ultimately, you won’t be able to do anything with that data unless you’ve actually got the power, the infrastructure if you will, sitting behind it. 

So a lot of the work we’re doing at Heptagon, at the moment, we’ve been doing for some time, and where we’ve been making investments, is in those infrastructure players. Basically, the companies that are providers of critical electricity and infrastructure, the contractors, the people who can physically build data centers, for example. 

Andrew Wilkinson 

I guess my final question then, Alex, is where do you perceive that we are in the hype cycle? 

Alex Gunz 

It’s a question that we’ve been asked many times and I’m always delighted to debate this topic, Andrew. I guess I’ll give you two perspectives. Number one is the stock market hype cycle, and number two is the reality, in other words, how long it takes for AI to play out.  

So when we think about it from a stock market perspective, I’m sure many listeners will be very familiar with the impact that the so called Magnificent Seven have had on stock market returns in the last 12 months, or since ChatGPT took off in November ‘22. 

The work we did suggested that it’s been absolutely huge, and maybe 70%, 7-0, of the MSCI World’s Returns in 2023 actually just came from those seven names. Our take therefore is perhaps that this has become a somewhat overextended, overcrowded trade and it’s been quite interesting really to watch the price action that we’ve seen since about the middle of July this year. 

Some of these names have rolled over and I think the conclusion we can draw from this, and it’s a little bit like Mark Twain’s famous line here. 

“Even if history doesn’t repeat itself, it can still rhyme.” Expectations have got very high for these businesses in terms of earnings forecasts in terms of valuation multiples. 

And if there’s any hint or whiff of disappointment, it’s very easy to see how that can generate a derating. Certainly what we can see from history is that if you take the so called leaders, if you will, from any decade, I started my career when the Dot Com boom was taking off, but if you go back, you think about oil majors, you think about Japanese financials, you think about the nifty fifty. 

A decade on from where those businesses peaked, in every historical instance, the market capitalizations, the valuations of those leading businesses have been markedly lower, and we think that trend may well play out again this time. 

When you move the debate on, and yet the two are clearly very interlinked, where are we practically in terms of AI deployments? 

And I think, again, the story here is quite interesting. There was a huge arms rush, as you’ll be aware, as many of our listeners will be aware, that everyone was trying to scramble to buy NVIDIA’s GPU chips. There’s been a lot of concern about whether NVIDIA will actually be able to keep up with supply. 

People like Intel, AMD are trying to catch up. But really, again, I think history is quite instructive here. What’s occurring at the moment is there is a massive rush to build out an infrastructure for AI. But when you think practically and it doesn’t matter whether you talk to Coca Cola, whether you talk to JP Morgan, whether even you think of a business like ours at Heptagon Capital, when you try and quantify how is AI practically being deployed, what’s the revenue benefit, if you will? 

What are the cost savings or productivity benefits? That’s a lot harder. And so we think there may be a little gap or pause here between the build phase, the infrastructure phase, and the application phase. And again, that might lead to a certain reset of expectations. 

Andrew Wilkinson 

Alex Gunz, a fund manager and author at Heptagon Capital in London, thank you very much for joining me today. 

Alex Gunz 

Always a pleasure. Thank you, Andrew. 

Andrew Wilkinson 

Thanks, Alex. And to the audience, please remember to rate our recent episodes and don’t forget to subscribe wherever you download your podcasts from. If you want to hear more from Alex on our channel specifically, don’t forget to go to the IBKR campus and look under more contributors for Heptagon Capital and you’ll see additional podcasts and webinars there. 

Thanks again, Alex. 

Alex Gunz 

Thank you. 

Andrew Wilkinson 

Bye for now, everybody. 

Go Source