Europe’s cybersecurity shelf began here: the L&G Cyber Security UCITS ETF (ISPY, ISIN IE00BYPLS672) launched in 2015 as the continent’s first dedicated cyber fund and remains its pure-play pioneer — a concentrated basket of companies whose business is security, tracked against the ISE Cyber Security index at a 0.69% TER. My LOCK review kept referencing it as the concentrated alternative; this review gives the pioneer its own full treatment.
The fund’s decade of receipts makes the category’s trade-offs unusually visible: purity’s sharper rallies and harder de-ratings, the winner-rotation problem at concentrated scale, and the fee question a 0.40% rival forces. One housekeeping note: buy the Irish line — a legacy German class (DE000A14ZT85) exists at the usual surplus cost. Verified against L&G and justETF, August 2026.
ISPY key facts
| Fact | Detail |
|---|---|
| ISIN | IE00BYPLS672 (avoid the legacy DE class) |
| Ticker | ISPY (London · Milan · Xetra) |
| TER | 0.69% per year |
| Index | ISE Cyber Security UCITS |
| Character | Pure-play concentration — security-native companies |
| Domicile | Ireland (UCITS) |
| Use of income | Accumulating |
| Vintage | 2015 — Europe’s first cyber ETF, a full decade of history |
Purity’s portfolio: what the ISE screen holds
The index selects companies deriving their business from cybersecurity — the endpoint/cloud/identity software tier (CrowdStrike/Palo Alto-class), the network-security hardware names, and the services specialists — without LOCK’s secure-transactions and payments ballast. The concentration consequences run both directions: fuller participation in security-software manias, fuller exposure to their de-ratings (2022’s episode hit ISPY visibly harder than the blended rival), and a decade-long demonstration of the winner-rotation problem — the security stack re-platforms every few years, and the pure basket rides each rotation at full amplitude while the index rotates constituents behind the repricing.
This guide is part of our thematic ETF guide.
Comparing UCITS funds? Take the decision workbook with you.
The ETF Comparison Workbook: TER, domicile, withholding and overlap checks in one printable spreadsheet.
ISPY vs LOCK: the category’s defining pair
The comparison the whole shelf reduces to:
| ISPY | LOCK | |
|---|---|---|
| Philosophy | Pure-play concentration | Diversified digital security |
| TER | 0.69% | 0.40% |
| Vintage | 2015 — the record | 2018+ scale |
| Volatility | Higher, both directions | Moderated |
| Theme purity | Maximum | Blended with infrastructure |
The decision rule mirrors every purity-vs-breadth pair this site has reviewed: maximum theme expression at maximum amplitude and fee (ISPY) versus moderated exposure at better economics (LOCK) — with the honest note that the 0.29-point annual fee gap compounds meaningfully across a decade-long theme, tilting the default toward the blend for undifferentiated buyers. ISPY’s earned seat: the investor whose thesis is specifically the pure security-software tier — the fastest-growing, highest-multiple, most rotation-prone slice — and who wants its full ride, decade-tested wrapper included.
The framework, inherited
The cyber theme’s full logic lives in the LOCK review and category guide and transfers whole: the demand ratchet (regulation, breaches, budgets that never cut), the valuation discipline it demands (the ratchet is famous and priced), the platform-bundling threat to the pure tier, and the overlap audit against defense funds’ cyber pillars (NATO’s especially). ISPY’s purity amplifies every line: more upside in the theme’s good scenarios, more exposure to bundling’s bad one, sizing at the band’s tighter edge (3–6%).
Taxes and buying
Irish accumulating UCITS standard (guide, calculator); euro lines on Xetra/Milan, the German plan lists carry it widely (the fund’s DACH following is its commercial base), Irish-ISIN discipline per the housekeeping note.
Reader scenarios
“A decade of history — what does ISPY’s record actually show?” The theme’s full anatomy: strong compounding through the category’s build-out years, the 2022 de-rating at full amplitude, recovery with the AI-security narrative — and across it all, returns competitive with the blended rival at higher volatility and fee. The record validates the theme; the construction choice it leaves open.
“ISPY or LOCK for my first cyber position?” LOCK by default economics; ISPY by specific pure-tier conviction — the pair’s rule, applied. Never both.
“Does AI-native security help or threaten ISPY?” Both at maximum amplitude: the pure tier houses the AI-security winners and the disruption’s casualties alike — the index’s rotation is the mechanism; the ride is the price.
“Why is the fee 0.69% after a decade?” Pioneer pricing that competition hasn’t yet forced down — the category’s flows favor the cheaper blends, and a fee cut is the obvious lever if L&G defends share. Holders would simply collect it.
What to watch through 2026–2027
The category dashboard from the LOCK review — NIS2 enforcement, government cyber budgets, AI-security product cycles, consolidation — plus ISPY’s specifics: the fee question under competitive pressure, and pure-tier revenue growth vs the platforms’ bundled offerings — the existential line the concentrated fund rides fully.
And a closing word on the theme’s temperament: cybersecurity rewards the same holder the rest of this site’s thematic shelf does — sized modestly, automated fully, reviewed annually against the demand data rather than the price chart. The sector will print both a mania and a derating within most holding periods; the demand line beneath them has never yet printed a down year. Position for the second fact, survive the first, and the decade’s compounding does the rest.
For readers arriving from the defense side of the site: the cluster budget applies both directions — sum this fund with any NATO or ARMR holding before sizing either, because the government-cyber tier bills all three funds for the same names.
Quick-start checklist
- Choose the philosophy: pure tier (ISPY) vs blend (LOCK) — one fund, whole category.
- Buy the Irish ISIN; euro line; limit orders.
- Size 3–6%, summed with defense-fund cyber pillars.
- Automate; the theme’s entries reward valuation resets, not conviction peaks.
- Annual review: rotation health, bundling pressure, and the fee landscape.
Verdict
ISPY earned its pioneer status and keeps its purpose: the purest liquid expression of security software’s ratchet economy, decade-tested, honestly volatile. Its fee ages badly against the blended rival and its concentration demands the tighter sizing band — and for the investor whose conviction is specifically the pure tier, no other UCITS vehicle delivers it as directly. The category’s pair is now fully reviewed; the choice is a philosophy; the discipline — audit, size, automate — is the constant that outranks it.
The economics that make cybersecurity a durable theme
Beneath the breach headlines runs a business model the thematic shelf rarely matches. Security spending is non-discretionary — boards cut marketing before firewalls, and regulation (NIS2 in Europe, disclosure rules in the US) converts prudence into legal obligation. Revenue is subscription-shaped — the industry completed its migration from license sales to recurring cloud contracts, giving the pure plays software-grade retention and visibility. Demand compounds with the attack surface — every cloud migration, remote-work seat and AI deployment enlarges what must be defended, and the adversaries are funded, professional and state-sponsored: an arms race with a budget line on both sides. The caveats that keep the theme honest: valuation regimes swing hard (the pure plays trade at software multiples and de-rate with them), consolidation is relentless (platform vendors absorbing point solutions — good for acquired holders, compressing for the rest), and the mega-cap platforms’ bundled security offerings are the structural threat to the specialists’ pricing that no index screen can filter away. Durable demand, volatile pricing: the exact profile the review’s 3–5% sizing and automation rules exist to hold.
Reader scenarios, continued
“AI breaks or makes this theme — which is it?” Both, asymmetrically: AI-powered attacks raise the defense budget floor (good for the whole index), while AI-native security products reshuffle the winners inside it (good for the adaptive, fatal for the legacy). The index’s periodic reconstitution handles the reshuffle mechanically — one more argument for owning the screen rather than picking the champion.
“How do I avoid buying the legacy ISPY listing by mistake?” Check the ISIN before ordering: the current Irish wrapper’s IE00BYPLS672, not the delisted German-domiciled predecessor’s line some broker searches still surface. Ticker collisions across venue listings are a recurring European nuisance — the ISIN habit solves every instance of it.
A decade of ISPY: what the pioneer’s record teaches
The strategy’s ten-year history doubles as the category’s biography, and its phases are instructive. The early years rewarded the pioneer’s monopoly on the exposure — assets compounded as breach headlines marketed the theme better than any issuer could. The 2020–2021 software mania carried the mid-cap portfolio to its amplitude highs; 2022’s rate shock demonstrated the symmetric truth as multiples halved while the underlying businesses kept growing — the clearest single lesson in the difference between a theme’s demand and its price. The subsequent recovery tracked the industry’s consolidation into platforms and the arrival of AI on both sides of the arms race. Through all four phases the constant was the demand line — security budgets rose every single year, breach or boom — while the return line swung entirely on what the market paid per euro of that demand. That decomposition is the fund’s whole ownership manual: buy the demand line with automation, survive the multiple line with sizing, and let the decade’s pattern — volatile route, persistent destination — set expectations for the next one.
Worth reading next: ja.
Frequently asked questions
Was ISPY really Europe’s first cyber ETF?
Yes — the 2015 launch predated the category’s build-out; the decade of published history is its rarest asset.
How much does ISPY overlap with LOCK?
The pure software tier is common ground; LOCK’s transactions-and-infrastructure ballast is the difference. Check live overlap on justETF — enough commonality that holding both is one theme double-fee’d.
Does ISPY hold defence-sector cyber companies?
The government-facing security names appear where the screen qualifies them — the overlap with defense funds’ cyber pillars that the summed sizing rule addresses.
What happened to ISPY in 2022?
The security-software de-rating at pure amplitude — the multiple compression documented across the category, deepest where purity was highest. The valuation-discipline lesson in one drawdown.
Is the German share class ever preferable?
No — higher cost for identical exposure; the Irish line is the fund. The legacy-class pattern repeats across L&G’s range.
Does ISPY pay dividends?
Accumulating — the tier yields almost nothing; growth is the entire proposition, as across the security shelf.
Was ISPY Europe’s first cybersecurity ETF?
The strategy line dates to 2015 — the category’s European pioneer — with the current Irish-domiciled wrapper carrying the franchise forward. Longevity brought scale and liquidity that younger rivals still chase.
Do government cyber contracts make this a defense fund?
Partially — the government-facing tier overlaps with the defense shelf’s cyber pillars, which is why the site’s cluster budget sums cyber and defense holdings before sizing either.
How volatile is ISPY compared to the Nasdaq?
Expect more: mid-cap software multiples swing harder than the mega-cap index in both directions. The theme’s demand is defensive; its valuations are not — the distinction most cyber marketing omits.
Does ISPY pay a dividend?
Accumulating, with the sector’s near-zero underlying yield — security firms reinvest in the arms race. Income seekers have no business on this shelf; that is the sector’s nature, not the wrapper’s flaw.
What happened to cybersecurity stocks in 2022?
The sector’s demand grew while its multiples halved — the rate shock repriced all long-duration software, and mid-cap security fell with it. The episode is the fund’s defining risk lesson: budgets are defensive, valuations are not, and the two lines diverge exactly when portfolios least expect it.
Do I need cyber exposure if I already hold a Nasdaq fund?
The mega-cap index carries the platform vendors’ bundled security revenue but almost none of the pure-play tier — the specialists are mid-caps beneath its threshold. ISPY adds genuinely different names; whether the addition earns its fee against the concentration you already own is the sizing question, not an overlap one.
Cited sources: L&G fund data, justETF data, and ENISA — EU cybersecurity agency. Verify current fund figures before investing. Educational content, not financial advice.
European UCITS/ETF investor with 11+ years building a global dividend and index portfolio, and founder of Financial Expert Class. I write every guide here from first-hand experience investing across EU brokers and tax regimes — not theory. More about me →