Capital Ideas^TM

Russia’s military aggression against Ukraine, which has become Europe’s largest ground war in generations, has impacted millions of people and triggered a large-scale humanitarian crisis as vulnerable Ukrainians take shelter or flee their homes. The intensification and spread of the conflict is deeply troubling and is having a devastating impact on those people caught in the crisis.

This article focuses on potential market and economic implications of the conflict.

As the war in Ukraine unfolds, cyberwarfare is likely to play a role. I suspect we will be confronted with some incredibly ugly realities that need addressing. My initial assessment is that this will support increased cybersecurity spending in the near term, but it will be more likely a meaningful inflection point for the industry. The Overton window (the range of policies politically acceptable to the mainstream population at a given time) around cyberwarfare as a tool in international relations could open wide and expose incredible weakness in U.S. and European security.

Most U.S. critical infrastructure assets fail even basic cybersecurity protocols and penetration testing. I feel reasonably good about the U.S.’s large financial institutions’ security and the tech companies, but that’s about it. Energy and utility companies in both the U.S. and Europe have substantially underinvested in cybersecurity, and many companies remain vulnerable.

Against this backdrop I think cybersecurity investments have strong potential. I have been positive on the cybersecurity industry for two reasons: 1) the spending outlook and 2) the fundamental change in industry structure that allows for platform formation and hence more sustainable growth.

In the short term, I think accelerating cybersecurity budgets among corporations, and federal and state governments is a near certainty. And if the situation in Ukraine continues to escalate, I think there is a chance for much more pronounced long-term changes.

The single biggest change could be a substantially different regulatory environment. Federal and state laws could become extremely prescriptive about minimum cybersecurity standards, especially in industries that are relevant to national security or impact the public. We could see an enormous investment cycle, specifically in the energy and utility sectors. In Europe as well, we could see a massive cybersecurity investment cycle and possibly an acceleration in cloud migrations.