The iShares Digital Security UCITS ETF (LOCK, ISIN IE00BG0J4C88) has quietly become one of Europe’s larger thematic funds — roughly €1.6 billion as of August 2026 — on a thesis that never goes out of season: every year of digitalization creates another year of things to defend. At 0.40% it’s the mid-priced option among Europe’s cybersecurity funds, with a broader “digital security” screen than its rivals — a distinction that matters more than the marketing suggests.
I cover the cybersecurity theme extensively on this site; LOCK is the single-fund deep-dive the category page can’t provide. What the screen actually includes, how it differs from the L&G and First Trust alternatives, where it overlaps the defence funds — and the honest case against paying thematic fees for it at all. Verified against iShares and justETF, August 2026.
LOCK key facts
| Fact | Detail |
|---|---|
| ISIN | IE00BG0J4C88 |
| Ticker | LOCK (London · Xetra · Milan · Amsterdam) |
| TER | 0.40% per year |
| Screen | Digital security — cyber software, hardware, and secure-transaction infrastructure |
| Replication | Physical |
| Domicile | Ireland (UCITS) |
| Use of income | Accumulating |
| Fund size | ~€1.6bn (Aug 2026) |
What “digital security” means — broader than you think
LOCK’s screen extends past the obvious cyber-software names into three tiers:
This analysis sits within our sector and thematic UCITS ETF hub.
Pure cyber software
The names everyone expects — endpoint, cloud and identity security vendors of the CrowdStrike/Palo Alto tier. High growth, high multiples, the volatility engine of the fund.
Security hardware and semiconductors
Chip and hardware makers whose products carry security functions — secure elements, smart-card silicon, networking gear. Steadier economics, industrial cyclicality, and overlap with the semiconductor theme.
Secure transactions and infrastructure
Payment-security processors, ID-verification and secure-connectivity businesses — the tier rival “pure cyber” funds mostly exclude, and the main reason LOCK behaves less explosively than the narrowest competitors in both directions.
Net effect: LOCK is the diversified take on digital security — more holdings, flatter concentration, a value-growth blend — versus the concentrated pure-play recipes. Check the live top-ten on justETF; the breadth is visible at a glance.
Comparing UCITS funds? Take the decision workbook with you.
The ETF Comparison Workbook: TER, domicile, withholding and overlap checks in one printable spreadsheet.
The demand engine: why this theme compounds quietly
Cybersecurity spending has a property most themes lack: it’s non-discretionary and ratchet-shaped. Breaches create regulation (NIS2 in the EU, disclosure rules in the US), regulation creates budgets, and no CISO ever proposes cutting security spend after a quiet year. Add the state dimension — cyber-defence as alliance capability, the same budget stream feeding the NATO fund’s cyber pillar — and the AI wave, which simultaneously expands attack surfaces and sells AI-powered defence tooling. The result is one of the few themes where the demand story strengthens through recessions. The equally honest caveat: everyone knows this, and the sector’s valuations have long priced the ratchet. Structural demand is the floor of the thesis, not the return.
LOCK vs the alternatives
- vs L&G Cyber Security (ISPY): the veteran pure-play — narrower screen, historically punchier in both directions, similar fee class. Choose by breadth preference: diversified digital security (LOCK) vs concentrated cyber (ISPY).
- vs First Trust Nasdaq Cybersecurity (CIBR UCITS): methodology sits between the two; liquidity and availability vary by venue.
- vs simply holding a Nasdaq/tech fund: the uncomfortable comparison — big platforms carry huge internal security businesses, and a CNDX-style fund captures the megacap end of security spending at half the fee. LOCK’s answer is the mid-cap pure-play tier the giants’ indices dilute. Whether that tier deserves 0.40% is the real decision.
- vs the defence funds: real overlap in the government-cyber names — if you hold NATO or DFNS, check the intersection before adding LOCK; my cybersecurity category guide maps the whole space.
Taxes and buying
Irish accumulating UCITS standard: 15% internal US withholding (the holdings are US-heavy), no annual declarations in most EU states until sale, the usual DE/AT/NL specifics (UCITS guide, calculator). Trades in euros on Xetra/Milan/Amsterdam, savings-plan eligible broadly (setup). Near-zero dividend yield — pure capital growth.
Risks, stated plainly
- Valuation regime: security software trades at premium multiples; tech de-ratings hit LOCK hard regardless of the demand story — 2022 was the proof.
- Winner rotation: the security stack re-platforms every few years (endpoint → cloud → identity → AI-native); today’s leaders defend their moats against genuinely fast disruption. The index rotates with the market — after the repricing, not before.
- Breach paradox: major incidents lift the theme’s narrative but can crush individual holdings — single-name risk in a concentrated tier.
- Overlap stacking: tech fund + defence fund + LOCK can quietly triple-count the same demand stories.
Common mistakes with cyber investing
- Buying after the breach headlines. Incident-driven spikes mean revert; the demand ratchet works on budget cycles, not news cycles.
- Confusing sector growth with shareholder returns. Security spending compounds ~10%+ annually; heavily-diluting, competition-squeezed vendors don’t automatically pass that to holders. The index’s job is riding the rotation — your job is not overpaying for the privilege at the theme’s euphoric moments.
- Holding two cyber funds: LOCK + ISPY is the same thesis twice with different concentration — pick the recipe, not the collection.
- Sizing it like an infrastructure holding: the demand may be utility-like; the equities are emphatically not. Growth-tech sizing rules apply.
Portfolio fit and sizing
A 4–7% satellite for investors who want the security ratchet specifically — on €50,000, that’s €2,000–3,500 costing €8–14/year. Pre-decide the drawdown response: this fund’s 2022-style episodes run 30–40%, and the thesis only pays holders who were still there for the recovery. Pair it consciously: with a world core always; with SMH or defence funds only after the overlap audit.
What to watch through 2026–2027
NIS2 enforcement — the EU directive’s implementation wave is a multi-year compliance-spending driver for exactly this fund’s vendors. Government cyber budgets — the alliance-defence stream, visible in procurement announcements. AI-security product cycles — whether AI-native security vendors take share from incumbents decides the next winner rotation. Consolidation — the sector’s serial M&A rewrites the index regularly; premiums paid to holdings are the pleasant version of the churn.
Quick-start checklist
- Decide the recipe: diversified digital security (LOCK) vs pure cyber (ISPY-style) — one, not both.
- Audit overlap with tech, semiconductor and defence funds you hold.
- Size 4–7%; write the drawdown response before buying.
- Buy the euro line or automate monthly; limit orders as ever.
- Review annually on the regulation-and-rotation watchpoints, not on breach news.
Verdict
LOCK is the sensible middle path of cyber investing: broad enough to survive winner rotation, large and liquid, fairly priced for the category. The theme’s demand ratchet is as real as thematic stories get — and it’s fully famous, so returns depend on entry discipline and holding behavior more than on the narrative. As a measured satellite inside the framework this site applies to every theme, it earns its place; as a conviction-free “cyber is the future” purchase, it will test you at the worst moment. The category context — and LOCK’s rivals — live in the cybersecurity ETF guide.
Reader scenarios
“My company just suffered a breach and doubled its security budget. Isn’t this the clearest buy signal in investing?” Your company’s experience is the thesis; it isn’t the entry point. The demand ratchet is real, famous and priced — the sector trades at premium multiples precisely because every CFO knows what yours knows. LOCK rewards entries made on valuation resets (2022-style) and punishes entries made on conviction peaks. Buy the ratchet when the market briefly forgets it, or automate monthly and stop timing entirely.
“LOCK, or single stocks like CrowdStrike and Palo Alto?” The security stack re-platforms every few years, and each rotation reshuffles leadership — endpoint champions ceded ground to cloud-native entrants inside five years. Single names cap your outcome at your ability to call the next rotation; the index inherits whoever wins it. In a sector where disruption is the product, the basket’s mediocrity insurance is worth more than usual.
“Is the AI wave good or bad for this fund?” Both, asymmetrically: AI expands attack surfaces (more spend — good for the theme) while threatening to consolidate security into the platforms’ AI stacks (bad for mid-cap pure-plays). The index’s rotation mechanism is the hedge — AI-native security winners enter as they scale. Watch whether the pure-play tier’s revenue growth holds against platform bundling; that’s the decade’s competitive question.
“How does LOCK fit if I already hold the NATO defence fund?” Subtract before adding: NATO’s cyber pillar already gives you the government-facing slice. LOCK adds the commercial-enterprise security economy — real incremental exposure, but size the pair’s combined security weight (aim ≤8%) rather than treating them as unrelated.
The valuation discipline this theme demands
Digital security is the rare theme whose demand story is almost unfalsifiable — which makes valuation the entire game. The sector’s revenue multiple has swung by a factor of three across recent cycles while underlying spending grew steadily every single year: holders who entered at multiple peaks endured years of flat returns while being right about everything; entrants at the 2022 trough were paid double-digits annually for the same correct thesis. Practical translation for a fund like LOCK: check the portfolio’s weighted revenue multiple against its own history (justETF and issuer factsheets carry the data) before sizing up; automate baseline buying so the resets get bought without courage; and treat euphoric repricings as rebalancing events. The theme will keep compounding for decades — whether your holding does is decided at entry and rebalance, not by the demand curve.
The pure-play rival: LOCK’s defining comparison — the pioneer’s tighter, mid-cap-heavier screen — is reviewed in full in the L&G Cyber Security (ISPY) guide.
Frequently asked questions
Is LOCK the same as a cybersecurity ETF?
It’s the broader cousin — cyber software plus security hardware plus secure-transaction infrastructure. Pure cyber funds are narrower and spikier; LOCK trades some upside for stability.
Does LOCK hold the big platforms like Microsoft?
No — the screen targets companies whose business is security, not giants with security divisions. That focus is what the 0.40% buys; the giants live in your core fund already.
How does LOCK overlap with defence ETFs?
Government-facing cyber names appear in both; the overlap is real but partial. Holding LOCK plus one defence fund is defensible with sizing awareness; LOCK plus NATO plus a cyber fund is triple-counting.
Is €1.6bn big enough to be safe?
Comfortably — closure risk concerns sub-€100m funds. LOCK is among iShares’ established thematic flagships.
Why did LOCK fall in 2022 if cyber demand kept growing?
Multiple compression — the sector’s valuations, not its revenues, were repriced as rates rose. Demand growth and shareholder returns are cousins, not twins; entry valuation bridges them.
LOCK or the L&G cyber fund for a first position?
LOCK for breadth and drawdown tolerance, ISPY for maximum pure-play beta. Both are legitimate; the choice is a volatility preference, not a quality ranking.
Does LOCK include Chinese cybersecurity companies?
The developed-market screen keeps the portfolio Western-centric — a feature for investors treating cyber as an alliance-security theme, and a limitation for anyone wanting the global sector including China’s domestic champions.
How concentrated is LOCK versus the pure cyber funds?
Noticeably flatter — the broader digital-security screen spreads weight across more names and tiers, so single-vendor blowups hurt less than in concentrated pure-play rivals. That breadth is the fund’s core design choice.
What happened to LOCK in the 2022 tech de-rating?
It fell hard with the software sector — the demand ratchet kept ratcheting while multiples compressed roughly by half across security software. The episode is the permanent reminder that this theme’s risk lives in valuation, not demand.
Cited sources: iShares fund data, justETF data, and ENISA — EU cybersecurity agency. Verify current fund figures before investing. Educational content, not financial advice.
European UCITS/ETF investor with 11+ years building a global dividend and index portfolio, and founder of Financial Expert Class. I write every guide here from first-hand experience investing across EU brokers and tax regimes — not theory. More about me →