CIBR vs HACK: What's Actually Inside the Two Big Cybersecurity ETFs

Data as of the June 26, 2026 holdings snapshot. Every weight here is pulled from the funds' reported holdings, not estimates.

If you want cybersecurity exposure in one ticker, two names come up first: CIBR, the First Trust NASDAQ Cybersecurity ETF, and HACK, the ETFMG Prime Cyber Security ETF. They sound interchangeable. They are not. We pulled the full holdings for both, and the differences change what you actually own.

Start with the thing nobody tells you. The single biggest position in HACK isn't a cybersecurity company at all. It's Broadcom at 6.57%. Cisco is right behind it at 6.39%. CIBR does the same thing, just in a different order: Cisco sits third at 8.47% and Broadcom fifth at 7.28%. So the two most popular "pure cyber" funds both lean on two networking and semiconductor giants near the top of the book. That's not a criticism. Both companies sell real security products. But if you thought you were buying a basket of CrowdStrike-style software, you're buying a lot of legacy infrastructure too.

CIBR is concentrated. HACK is spread out, and it's spread into defense.

CIBR's top five holdings are Fortinet at 8.97%, Palo Alto Networks at 8.62%, Cisco at 8.47%, CrowdStrike at 7.84%, and Broadcom at 7.28%. Add those up and the top five is 41% of the fund. It holds 43 names, but the money piles into the mega-cap security leaders. If Palo Alto and CrowdStrike keep running, CIBR feels it.

HACK spreads the same money thinner. Its top five is Broadcom, Cisco, Palo Alto, Fortinet, and CrowdStrike, and together they're only 30% of the fund. It holds fewer names, 24 in total, but weights them more evenly. Nothing dominates.

Here's where they truly split. HACK holds General Dynamics at 5.22% and Northrop Grumman at 4.60%. That's almost 10% of the fund in old-school defense primes, the companies that build submarines and stealth bombers. HACK is treating cyber as a warfare category, government contracts and national defense budgets, not just enterprise software subscriptions.

CIBR gets to the government too, but through a side door. Instead of defense primes it holds IT services and contractors: Leidos, Booz Allen Hamilton, SAIC, Accenture, IBM, Infosys. None of them is large on its own, most sit under 2%, but stack them and you've got a meaningful bet on federal and enterprise IT consulting rather than fighter-jet makers.

So which one is "better"? Wrong question. They're different trades wearing the same label.

If you want the fastest, most direct read on the software leaders, CIBR gives it to you. Its top-heavy weighting toward Fortinet, Palo Alto, and CrowdStrike means it moves closely with the names that dominate the cybersecurity conversation. You're getting concentration, and concentration cuts both ways.

If you want the sector with a defense hedge baked in, HACK is the one. The General Dynamics and Northrop weighting smooths out the wild swings of high-multiple software, because defense earnings don't trade like a SaaS stock. In a rough tape for growth names, that 10% in defense is ballast. In a monster software rally, it's a drag.

One more thing worth saying plainly. Both funds own the same core software roster underneath: CrowdStrike, Palo Alto, Fortinet, Zscaler, Okta, Cloudflare, SentinelOne, Tenable, Qualys. If you already hold three or four of those individually, buying either ETF on top means you're doubling down on positions you already have, not diversifying away from them. Check the overlap before you add.

The label on the tin says cybersecurity. What's inside is a semiconductor giant, a networking giant, a pile of software subscriptions, and, in HACK's case, a chunk of the defense-industrial complex. Know which bet you're making.

Want the full side-by-side with live scores and every holding? Here's the best cybersecurity ETFs breakdown, and the full ETF library if you want to compare against semis, robotics, or defense funds.