The cybersecurity ETF HACK rally has pushed Amplify’s HACK ETF up more than 49% from its February 23 year-to-date low, recently hitting an all-time high as AI-assisted attacks drive enterprise security spending to record levels. The fund now holds $2.62 billion in assets under management and carries a Moderate Buy consensus rating based on 531 analyst ratings covering more than 96% of its portfolio.
| Metric | Value |
|---|---|
| YTD gain from Feb. 23 low | +49% |
| Assets under management | $2.62 billion |
| Expense ratio | 0.60% |
| Short interest (% of float) | 0.19% |
| Institutional inflows vs. outflows (12 mo.) | $171M vs. $75M |
| Consensus rating | Moderate Buy |
What’s Driving the Cybersecurity ETF HACK Rally
The threat data behind the move is hard to dismiss. IBM’s 2026 X-Force Threat Intelligence Index found that vulnerability exploitation became the single largest cause of cyberattacks in 2025, accounting for 40% of all incidents tracked by X-Force. The same report logged a nearly 4x increase in large supply chain and third-party compromises since 2020, driven by attackers exploiting trust relationships in CI/CD pipelines and SaaS integrations.
Ransomware groups grew 49% year over year. Some 300,000 AI chatbot credentials appeared for sale on the dark web. The average AI-enabled data breach now costs organizations $4.88 million, a figure that excludes regulatory fines and reputational fallout. Boards are responding with budget lines to match.
The result: Grand View Research projects the global cybersecurity market will expand from roughly $272 billion in 2025 to more than $663 billion by 2033, a CAGR of 11.9%. The cybersecurity services segment is set to grow even faster at 14.8% annually. Cloud security is the fastest-moving pocket, forecast to compound at more than 15.9% through 2033, while hardware held the largest revenue share in 2025 at 54.2% of the total market.
HACK’s Portfolio: Top Holdings and Concentration
Launched in 2014 as the first ETF built specifically around the cybersecurity industry, HACK tracks the Nasdaq ISE Cyber Security Select Index. Constituents must derive at least 90% of revenue from cyber defense. The fund holds 24 securities, with the top 10 positions accounting for 56.1% of assets, according to AAII’s ETF data.
The top five names tell the story of this year’s cybersecurity ETF HACK rally in individual-stock terms. CrowdStrike is up roughly 60% year to date. Palo Alto Networks has gained more than 50%. Cisco Systems leads the group, up more than 65%. Fortinet is close behind at nearly 85%. Broadcom rounds out the five with a roughly 40% gain. Together those five positions represent more than 36% of the portfolio; the broader top-10 bloc pushes that concentration to 56.1%.
More than 87% of holdings are U.S.-domiciled. The remainder are based in Israel and Japan, providing a degree of geographic diversification within a single-sector mandate.
Fund Mechanics and Institutional Positioning
HACK is passively managed and charges a 0.60% expense ratio, in line with the thematic ETF category average. The NYSE Arca-listed fund trades roughly 127,000 shares daily, which is light for a fund its size. Investors willing to use limit orders can navigate the spread without much friction.
Institutional flows lean bullish. Over the past 12 months, inflows from institutional buyers exceeded outflows by roughly $171 million to just over $75 million. Short interest is negligible: 0.19% of the float, or about 48,136 shares out of 24.85 million outstanding. The low short interest cuts both ways. There is little short-covering fuel for a squeeze, but it also signals that professional traders are not betting against the trend.
Before this year, HACK’s five-year return heading into its February low was only around 20%, making the 2026 surge look less like a continuation and more like a repricing of the threat environment. The cybersecurity ETF HACK rally reflects a market catching up to a structural shift that the underlying attack data had been signaling for years.
The near-term catalyst to watch is enterprise IT budget season. If second-half security allocations come in above consensus, the top holdings have room to extend. A single high-profile breach affecting a Fortune 100 company could sharpen that narrative fast.
