Being right about the technology is not the same as making money
Over the next 20–30 years, AI will probably rewrite large parts of the economy. This page accepts that premise. The investor's real question comes after it: will your capital actually capture any of that change? History says it is entirely possible to be right about the technology and still lose on the stock. The same test is then applied to cybersecurity, where the demand is written into law and the returns still are not.
"If a capitalist had been present at Kitty Hawk, he should have shot Orville down."
The thesis was right. The stock still lost.
In 1999 the claim "the internet will change everything" was completely correct. Cisco Systems, sitting at the centre of it, became the most valuable company on earth in March 2000. Internet traffic then grew exponentially for two more decades. The thesis worked. And yet:
| Company | Its position at the time | Fall from peak | Time to reclaim the peak |
|---|---|---|---|
| Cisco Systems | March 2000: most valuable company in the world, core of internet infrastructure | ≈ −85% | ≈ 24 years (around 2024) |
| Microsoft | End of 1999: undisputed ruler of the PC era | ≈ −60% | ≈ 17 years (2016) — then became one of the great compounders |
| Intel | 2000: synonymous with semiconductors | ≈ −80% | Still not reclaimed a quarter-century later; lost the process lead, missed mobile and AI |
| Nokia | 2007: roughly 40% of the global handset market | ≈ −90% | Not reclaimed. Lost the throne within a few years of the iPhone |
| Amazon | 1999: an online bookseller | ≈ −93% | ≈ 9 years — then one of the best compounders in history |
Approximate, price basis, rounded for readability.
Two things to take from this table. First, the people who lost were not the ones who backed the wrong technology — they were the ones who backed the right technology at the wrong price. Cisco kept earning and growing after 2000. The business was fine; the entry multiple was not. Second, the Amazon and Microsoft rows show that even the genuine winners put their holders through drawdowns of 60–93%. Whether you can sit through that is what decides your outcome.
The AI value chain — where the money actually flows
"AI stocks" is not one thing. Each layer has a different margin structure, a different competitive position, and — most importantly — a different amount of expectation already priced in.
| Layer | Role | Representative companies | What matters for an investor |
|---|---|---|---|
| Chip design | The AI accelerators themselves | Nvidia, AMD, Broadcom (custom ASICs) | Today's largest profit pool. Software (CUDA) is the real moat — and it is also the layer with the most expectation already in the price |
| Manufacturing | Actually fabricating the chips | TSMC, Samsung Foundry, Intel Foundry | At the leading edge TSMC is close to a single point of failure for the whole industry. Geopolitical risk concentrates here |
| Equipment & materials | The machines and inputs that make chips possible | ASML (EUV monopoly), Tokyo Electron, Advantest, Disco, Shin-Etsu | The "sells to whoever wins" layer, and the heart of the Japanese market's AI exposure. Still fully exposed to the semiconductor cycle |
| Memory | High-bandwidth memory and storage | SK Hynix, Samsung, Micron, Kioxia | HBM is a genuine bottleneck for AI training. Memory has always been a violently cyclical commodity business, and that has not been repealed |
| Power & infrastructure | Data centres, electricity, cooling | Utilities, grid operators, cooling and power equipment | The overlooked physical constraint. Power availability may end up limiting AI build-out more than chip supply |
| Cloud | Renting the compute out | Microsoft, Amazon, Google, Meta | Simultaneously the biggest buyers of accelerators and, through their own silicon, the biggest long-term threat to the chip layer |
| Users of AI | Everyone applying it to their own business | Every industry | Over 20–30 years this may be where most of the value lands. Historically the gains from a general-purpose technology accrue more to its users than its makers |
The companies people ask about
Before any judgment, the facts that constrain what you can actually do. Whether a company is even listed is skipped surprisingly often.
| Company | Listing status | Role in AI | Principal risks |
|---|---|---|---|
| Nvidia | Listed (NASDAQ) | The de-facto standard for AI accelerators; CUDA is the durable asset | Customer concentration (a handful of hyperscalers dominate revenue), those same customers building their own silicon, China export controls, semiconductor cyclicality |
| Tesla | Listed (NASDAQ) | EVs plus energy storage, with autonomy and humanoid robotics as option value embedded in the valuation | Price competition from Chinese manufacturers, EV market maturation, a long record of autonomy timelines slipping, key-person dependence |
| SpaceX | Listed (IPO'd on Nasdaq, 12 June 2026, ticker SPCX) | Launch, Starlink satellite internet, and — since absorbing xAI in February 2026 — the Grok models too. One company now spanning launch, connectivity and frontier AI | The largest IPO on record: priced at $135, closing its first day near $161 for a market capitalisation around $2 trillion. Which replaces "you cannot buy it" with a harder question — what does that entry price require the business to deliver? Add a very short public record, lock-up expiries still ahead, heavy loss-making AI investment inside the same entity, and acute key-person dependence |
| Toshiba | Delisted in December 2023 | Taken private by a JIP-led consortium | Not purchasable on the market. Its memory business was separated years earlier and became Kioxia |
| Kioxia | Listed (IPO'd on the TSE in December 2024) | NAND flash memory; storage demand from AI data centres | NAND pricing is extremely cyclical. Very short history as a listed company, so little long-run data to judge it by |
| Samsung Electronics | Listed (KOSPI) | DRAM, NAND, HBM, foundry and handsets combined. The largest KOSPI constituent | Ceded early HBM leadership to SK Hynix; foundry gap versus TSMC; and the Korea discount |
| SK Hynix | Listed (KOSPI) | Became the principal HBM supplier to Nvidia and one of the clearest beneficiaries of AI capex | Memory has always been a boom-bust industry. A technology lead in memory has never been permanent |
Listing status and business mix change. Verify with company IR and the exchanges before acting.
Japan's AI exposure is equipment and materials
The Japanese market's real AI leverage is not in finished products but in the machines and materials: Tokyo Electron, Advantest (test), Disco (dicing and grinding), Shin-Etsu and SUMCO (silicon wafers). They supply whichever chipmaker wins. Rapidus is attempting a leading-edge foundry, but judging that will take years, not quarters.
Korean investors already own this trade
Samsung and SK Hynix are such a large share of the KOSPI that simply holding a Korean index means already carrying enormous AI memory exposure. Adding individual AI names on top creates unintended double concentration. If you hold domestic equities, size any additional AI position with that in mind.
Cybersecurity: the demand is legislated, the returns are not
Every argument for AI is also an argument for security. The same models that draft code draft phishing mail; the same agents that book your travel hold your credentials. Ask any investor whether cybersecurity spending grows over the next twenty years and the answer is almost always yes — and they are almost certainly right. That is the easy half of the question, and it is not the half that pays you.
Why the demand is unusually predictable
Most sector theses rest on a forecast. This one rests substantially on published dates and statutory obligations, which is a different and firmer thing.
| Driver | What is actually fixed | Horizon |
|---|---|---|
| Post-quantum cryptography | NIST finalised the replacement standards in August 2024 (ML-KEM, ML-DSA, SLH-DSA). RSA-2048 and ECC P-256 — the cryptography holding up most of the internet — are slated for deprecation around 2030 and removal from the standards by 2035. The US NSA's CNSA 2.0 timetable requires new national-security systems to be quantum-safe from 2027, with applications and then infrastructure following. | A mandatory, dated replacement of cryptography across essentially all computing. "Harvest now, decrypt later" — traffic captured today and decrypted when the machines exist — makes the deadline retroactive, so it is not deferrable. |
| Japan: active cyber defence | The Cyber Response Capability Enhancement Act (サイバー対処能力強化法), passed May 2025, takes effect 1 October 2026. It builds a framework for government and designated critical-infrastructure operators to share attack information and act before damage spreads. | Compliance obligations arriving on a known date for a defined list of operators. |
| Korea: security disclosure | Information-security disclosure (정보보호 공시) already binds a defined set of companies, and expansion to all listed companies from 2027 is being pursued. Public-sector procurement additionally requires domestic certification (ISMS-P, CC, validated crypto modules). | Disclosure obligations tend to convert security from a discretionary cost into a reported one, which changes budgets. |
| Europe and the US | NIS2 and DORA in the EU; SEC rules requiring US-listed companies to disclose material incidents. | The same conversion, in the two largest regulatory blocs. |
| AI on both sides | The marginal cost of a fluent, targeted phishing message has gone to roughly zero, deepfaked voice and video are now practical fraud tools, and AI agents create an attack surface that did not previously exist — prompt injection, and agents holding credentials and permissions of their own. | Not a deadline, but a structural change in attacker economics that does not reverse. |
Regulatory timetables slip and get amended. Verify dates against the relevant authority — NISC and the Cabinet Office in Japan, KISA and the FSC in Korea, NIST and the SEC in the US — before relying on any of them.
And now the half that decides your return
Cybersecurity spending has risen in almost every year for two decades. Over the same two decades, a great many cybersecurity stocks have been poor long-term holdings. This is the identical gap the emerging-markets section describes between GDP growth and shareholder returns, and the one Korea illustrates between corporate quality and what reaches minority shareholders.
Symantec
For years the dominant name in the category — the one consumers could actually name. The enterprise business was eventually sold to Broadcom and the company broken up. The category kept growing; the shareholder did not keep the growth.
FireEye / Mandiant
Effectively the byword for breach investigation, called in after the largest incidents of its era. It sold its products business, and what remained was acquired by Google. Being the acknowledged expert is not the same as being a durable compounder.
The mechanism is not mysterious. Security technology turns over fast; today's category — antivirus, then next-generation firewall, then endpoint detection, then zero trust, then cloud posture — keeps being replaced by the next one, and the incumbent is rarely the company that wins the replacement.
Consolidation: owning an independent is often a bet on being bought
Three transactions in three years, each among the largest in enterprise software history:
| Deal | Size | Status |
|---|---|---|
| Cisco → Splunk | ~$28B | Completed March 2024 |
| Palo Alto Networks → CyberArk | ~$25B | Completed 11 February 2026 |
| Google → Wiz | ~$32B | Completed 11 March 2026 — the largest acquisition in Google's history |
A risk specific to this sector: the defender is a single point of failure
On 19 July 2024 CrowdStrike shipped a faulty content update. Roughly 8.5 million Windows machines — airlines, hospitals, banks, broadcasters — failed to boot. One analysis put the cost to Fortune 500 companies alone at about $5.4 billion. The shares fell from about $343 before the incident to near $201 in early August, erasing over $30 billion of market value — a drawdown of roughly 41% caused by the company's own update, not by an attacker.
Then it recovered above $300 within about three months. Both halves matter, and they say opposite-seeming things that are both true. Security software runs deep inside the operating system, so the vendor is itself able to halt the world — a concentration of operational risk with few parallels in other industries. And yet customers largely stayed, because ripping out an endpoint platform is enormously disruptive. The same switching cost that makes the business durable is what made the failure catastrophic.
The three markets
Where the platforms are — and the largest one is not a security company
The listed pure plays most people name are Palo Alto Networks (platform consolidation, now including CyberArk for identity), CrowdStrike (endpoint and XDR), Zscaler (zero trust access), Fortinet (firewalls, hardware and software), Cloudflare (edge and DDoS) and SentinelOne.
The largest security vendor by revenue, though, is Microsoft — Defender, Entra and Sentinel together. Google now owns Mandiant and Wiz; Cisco owns Splunk; Broadcom owns the old Symantec enterprise business. If you hold a broad US index fund, you already own the biggest owners of this sector, which is the single most useful fact on this page.
The demand mostly flows through the integrators
Trend Micro (4704, TSE Prime) is Japan's rare large listed pure play. Smaller listed names include Digital Arts (2326), FFRI Security (3692) and Cyber Security Cloud (4493); Secom (9735) sits where physical and cyber security meet.
The list of listed pure plays gets shorter, not longer. LAC (3857) was one of the best-known security names in Japan until KDDI took it over. A tender offer that closed in January 2025 left KDDI holding roughly 92% of the shares, and LAC was delisted on 25 February 2025. Anyone who had bought LAC to own the theme did not hold Japanese security demand for a decade — they were bought out at a fixed price and handed cash. That is the consolidation pattern described above, in the market closest to this page.
The structural point matters more than the list: a large share of Japanese security spending is delivered by systems integrators — NEC, Fujitsu, NTT Data, Hitachi and their subsidiaries — as part of larger contracts. Rising security budgets can therefore show up as a modest line inside a big, slow-growing IT services business rather than as revenue at a pure play. With the October 2026 act arriving, this is where much of the compliance work will actually be absorbed.
A protected home market — which is also a ceiling
AhnLab (053800) is the symbolic name, alongside WINS (136540), Genians (263860), IGLOO (067920), Raonsecure (042510) and Fasoo (150900). SK Shieldus is not listed (EQT holds the majority) and SECUI sits under Samsung SDS.
Two features are specific to Korea and pull in opposite directions. Public-sector procurement requires domestic certification — ISMS-P, CC, validated cryptographic modules — which reserves a real market for local vendors, and at the same time builds a ceiling: products shaped around Korean certification are harder to export. The market is projected to pass ₩4 trillion in 2026, but market size and company profitability are different questions. AhnLab reported roughly ₩130.4bn of revenue and ₩7.3bn of operating profit in the first half of 2026 — an operating margin near 5.6%, an order of magnitude below the large US platforms.
And one warning that belongs on this site specifically. AhnLab is the textbook Korean political theme stock: its founder went into politics, and the share price has repeatedly moved on political news rather than on results. A real company with real products can still have a share price detached from its fundamentals for long stretches. If you cannot explain a move by the business, you do not understand what you own.
How a long-horizon investor should actually handle this
- Check what you already hold first. Microsoft, Google, Cisco, Broadcom and Palo Alto are all in a broad US index. For most readers the honest answer to "how do I get exposure to cybersecurity" is that you already have it and need buy nothing.
- Treat sector ETFs with the caution set out in the rules above. Security ETFs turn over constituents heavily, and acquisitions keep removing holdings — you are frequently paying a fee to be handed cash for your winners.
- If you buy an individual name, run it through the decomposition tool and look at what your own assumptions are quietly requiring of earnings growth and the exit multiple. Then read the base rates again.
- Do not confuse the certainty of the demand with certainty about the winner. The demand being legislated is exactly why competition for it is fierce.
- LAC (3857) delisting and the KDDI tender offer — company disclosure, LAC IR and KDDI news releases; delisting date confirmed as 25 February 2025.
- Japan's Active Cyber Defence legislation and its October 2026 commencement — National center of Incident readiness and Strategy for Cybersecurity (NISC).
- AhnLab's half-year revenue and operating profit — the company's semi-annual report filed on DART (Financial Supervisory Service).
- Ownership of Mandiant, Wiz, Splunk and the former Symantec enterprise business — the acquirers' own completed-acquisition announcements.
Decompose, don't predict
Nobody can tell you what an individual stock will return, and this site will not pretend otherwise. What it can give you is the decomposition that determines long-run returns. This is not a forecast — it is arithmetic on assumptions you choose:
Long-run equity returns decompose almost entirely into these three: how much earnings grew, what multiple the market came to pay for those earnings, and the cash you collected along the way.
For a high-multiple stock, the second term is what bites. You can be right about the business and still watch a fall from 50× to 20× earnings subtract from your return every single year. Put your own assumptions in below.
This is not a forecast for any company. It computes the consequence of the assumptions you entered. Wrong assumptions in, wrong answer out.
Same 20% growth, wildly different outcomes
Every row below assumes your business call is exactly right: 20% annual earnings growth, sustained for ten years. Only the exit multiple moves (starting at 50×, no dividend):
| P/E after 10 years | Annual return | What it means |
|---|---|---|
| 60× (re-rates higher) | +22.2% | Growth and sentiment both on your side — the best case |
| 50× (unchanged) | +20.0% | Earnings growth converts straight into return |
| 30× | +14.0% | Excellent — though a third of the growth went to de-rating |
| 20× | +9.5% | Ten years of 20% growth, and you match the index |
| 15× (a mature multiple) | +6.4% | Thesis perfectly correct — and you lose to the index |
That is the arithmetic this page exists to show. "This company will grow" can be true while the reward goes to the company rather than to you, because of the price you paid. Read it the other way round: to earn 10% a year from a 50× stock that settles at 20×, the business must compound earnings at 20.6% a year for a decade. Asking how often that actually happens is a better use of your time than watching the price.
Base rates for individual stocks
If you are going to pick stocks, it is worth knowing the starting probabilities. Hendrik Bessembinder's well-known research on US listed equities since 1926 found:
- The majority of individual stocks underperformed Treasury bills over their lifetimes.
- All of the market's net wealth creation came from roughly 4% of stocks. The other 96%, in aggregate, contributed approximately nothing.
Stock market returns are extremely concentrated in a few extreme winners. That creates a brutal asymmetry for the stock picker: a diversified index holder owns all of that 4% automatically, while someone holding ten names is more likely to miss the winners than to catch them.
If you're bullish on AI, how should a long-term investor act?
Wanting exposure to AI is not a mistake. The question is how you size it. This site's position is consistent: run it as a satellite around a core.
1. Measure what you already hold
Before buying anything, count the AI exposure already in your portfolio. The top of the S&P 500 is heavily AI-linked; a KOSPI holder carries a large Samsung + SK Hynix position by default. Know the existing position before adding.
2. Set the cap before you buy
Satellites together under 10–20% of the portfolio, no single company above 5%. The test is simple: if this went to zero, would my retirement date change? The probability of zero is higher than it feels.
3. Be wary of thematic ETFs
Thematic funds tend to launch when the theme is at peak attention, and charge an order of magnitude more than a broad index fund. Many historically underperformed their benchmark after launch. Check the inception date, the holdings and the fee before buying one.
4. Never stack leverage on concentration
Concentrated positions plus margin or leveraged ETFs turn an 80% drawdown from temporary into permanent. Cisco and Intel holders who simply held at least kept the option to decide. Leveraged holders did not.
5. Mind which account it sits in
NISA offers no loss offsetting. Putting a high-variance concentrated bet there forfeits the tax relief you would otherwise get. Sheltered accounts are for things likely to win over decades; speculative positions belong in the taxable account.
6. Keep the contribution schedule
Strong conviction is exactly when people abandon their schedule and go in all at once. But averaging in protects you most precisely when enthusiasm peaks. Remember Cisco in 1999.
Scenarios, not predictions
Trying to call what the world looks like in 2050 is a poor basis for a portfolio. Building a plan that survives whichever scenario arrives is a much better one. At minimum, all three of these are plausible:
A. Today's winners keep winning
Software lock-in and scale economics hold, and the current leaders dominate for two more decades. Index investors capture it automatically. Stock pickers are rewarded too — provided they did not overpay at the entry.
B. The leadership changes hands
A new compute architecture, or hyperscalers' own silicon, shifts the profit pool to a different layer — exactly the Intel and Nokia precedent. The index follows along automatically; this is where concentration gets hurt most.
C. The gains go to the users
The technology diffuses, competition commoditises it, and the profits spread to the broad set of companies that used AI to get more productive — the electrification path. In this scenario, owning the whole market is ironically the optimal AI trade.
"Don't look for the needle in the haystack. Just buy the haystack!"