The pandemic is showing that knowing the answer will improve investment returns. But choosing the right sectors is not enough. Outperformance comes from predicting winners and losers within sectors. Cyberhedge can help. Knowing the right questions to ask about technology before the pandemic hit is why the Cyberhedge Cyber Governance Indices outperformed the market by 19% in the US and 41% in the EU in 1H2020.
Union Pacific has solidly outperformed US Industrial Peers while GE has dramatically underperformed. Why are companies within the same sector performing so differently amid COVID-19?
Companies within the same sector have performed very differently amid COVID-19 despite being impacted in similar ways. As outlined in a previous article, cyber governance helps explain the significant difference in performance between companies, across markets and within sectors.
At the start of every month, companies in Cyberhedge’s public indices are ranked from 1-Star (worst) to 5-Star (best) based on their cyber governance performance i.e. how well they have managed their digital transformation.
The US Industrials sector is our first focus in a series on outperformers and underperformers since the start of the COVID-19 crisis. We examine the performance of 5-Star-rated Union Pacific (UNP) and 1-Star-rated GE to illustrate how cyber governance is a key contributor to both firms’ trajectories.
Union Pacific: A 5-Star company that has performed well despite macro headwinds
Union Pacific’s strong financials and solid technology management program put it in a better position to weather the COVID-19 crisis relative to its peers in the Industrials sector. Its investments in technology have contributed to the productivity and operational efficiency gains that are supporting the resilience of the company’s financials. For example, despite a 24% YoY drop in revenues in Q2, UNP’s free cash flow YTD increased 62% from the same point in 2019.
As an indication of how important technology is to business operations, cash invested in technology overall is ~42% of what Union Pacific invested in locomotives and freight cars in FY19. This is up from ~28% in FY18. The company’s effective investment in its security program is evident in strong underlying cyber scores that support its 5-Star sector rating. This investment is enabled by the company’s strong financials, including manageable debt levels and strong cash flows. Union Pacific recognizes the threat posed by cyber to its operations, stating in the company’s 2019 Annual Report that “a breach or circumvention of our systems or the systems of third parties, including by ransomware, other cyber attacks, or human error may result in significant service interruption, safety failure, other operational difficulties, including financial losses...” As a result, it has taken steps to minimize the likelihood of a financially costly disruption, unlike worse-ranked industrial peers.
This is especially important considering the ~25% increase in corporate ransomware attacks this year and the significant impact these disruptions can have on operating income.
Union Pacific does have some key weaknesses in its overall cybersecurity, including its security-related management systems. But the combination of strong financials, manageable debt load and a strong market position provide it with the financial resources necessary to address these issues in the short term. This in turn reduces the likelihood of the company experiencing a financially damaging ransomware attack.
GE: A struggling 1-Star with poor financials and underperforming cyber governance
In contrast, despite the fact that GE has rightly identified digital transformation as essential to all of its businesses, its low rating indicates significant underperformance and heightened downside financial risk at a time when its business is already enduring significant shocks amidst COVID‑19. Weak cyber governance entering COVID-19 positioned the company poorly to navigate the significant disruptions, in contrast to its better performing Industrial peers.
GE is a case study in why applying a ‘Cyber-Financial’ lens to companies is a better way to understand which companies are more likely to win or lose amid the current crisis. Low operating margins and high leverage mean that there are significant financial constraints to GE investing in needed improvements to its cybersecurity. The result is heightened exposure to further downside financial risk in the form of a possible operational disruption to any one of its businesses. Specifically, the increasing digitization of industrial control systems (ICS) among industrial, energy and utility companies create heightened cyber risks for companies like GE to manage.
GE’s 1-Star rating among US Industrials over the past year suggests the company has persistent structural shortcomings related to its cyber posture. These scores indicate the company has done a worse job relative to its peers at managing its IT network, the people and processes that underpin its cybersecurity and active security risks facing the network relative to the financial resources available to effectively manage them.
It is no surprise to us that GE has continued to underperform US Industrial year to date.
Investors that use our company ratings knew the right questions to ask before the pandemic hit, and as a result are up +19% over the broader market in the US and +41% in the EU this year.