Future Returns: Investing In The Cannabis Industry

Several years ago Morgan Stanley did a poll of over 1,000 high-net-worth investors to see if they’d invest in legal cannabis. A full 65% said they were not likely to invest if cannabis were legalised in the next 12 months.

But Matt Bottomley, equity research analyst at Canaccord Genuity in Toronto, doesn’t hear this same level of objection to the industry today, and for good reason. “At the end of the day, I think the U.S. cannabis sector at maturity is probably US$80 billion to US$100 billion in sales,” he says.

The stigma once associated with cannabis has dropped off dramatically, and within the past month states including New York and Virginia, as well as Mexico, have either legalised it or announced plans to do so.

“You’re going to see it slowly, over the next years and decades transition from a more traditional consumer-packaged goods market,” Bottomley says. Presently, leading U.S. companies “are kind of doing everything in every market,” he says—from growing to producing, up to creating edibles and even operating retail in some markets. As legalisation expands across the world, big pharma may look to get in on it, changing valuations.

Big-name companies trading in the U.S. such as Canopy and Tilray see their stock prices appreciate when pro-legalisation stories hit the news. But because cannabis is still a Schedule I drug, meaning tightly regulated by the government, Bottomley says, “the fundamentals are not necessarily going to flow down to those types of companies.”

Meanwhile, leading American companies like Curaleaf or Trulieve trade on Canadian junior exchanges, less easily accessed by the overall U.S. retail investor market. He thinks there’s a tremendous amount of capital yet to come into this space. Many companies, he adds, are underserved by institutional investors as well.

“Over the long term if you pick the right horses in the sector, there’s still quite a lot of growth to be had.”

Here are three things Bottomley says to keep in mind when investing in the cannabis sector.

Take Stock of Your Risk Profile

Investors entering the cannabis market have to consider their risk thresholds. “All of our buys on cannabis stocks to date are all speculative buys, and we do have holds and sells as well,” Bottomley says.

The sector can be home to wild price swings where for weeks at a time stocks go in one direction, before pivoting and going the other way. If they consider a 2%-to-3% move in a day outside their risk threshold, it might not be for them. Especially because the “wild directions” stocks move in aren’t necessarily tied to company performance.

Bottomley says it also requires a lot of patience. “You really have to be comfortable about where you are on that growth curve and how far ahead of markets opening up—you want to invest your incremental dollar to get ahead of what could eventually be a very large push upward.”

Valuation is Relative

Cannabis is a sector where policy announcements about the future of legalisation can cause stocks to move in the same direction, but investors can’t let that alone sway them. Even if every cannabis stock is moving up or down, and the shift seems uniform, Bottomley advises exercising caution.

Not every cannabis company has exposure to the same markets or regions. When looking at companies in the cannabis space, he says it’s necessary to see how they’re situated in markets relative to their peer group.

He offers the example of a Canadian company trading at 30 or 40 times its forward profitability metrics, or Ebitda (short for earnings before interest, taxes, depreciation, and amortization), but that lacks access to the U.S. market or other growth drivers.

“I prefer buying a company that’s trading at a lower multiple than that, but actually has that exposure,” he says. “That’s the first thing that I look at when I’m putting a rating to any of these companies that I cover.”

Understand the Management Team

For Bottomley, management teams and their philosophies are particularly important in the cannabis industry. “We’ve seen a lot of good case studies for huge success stories and a lot of case studies where things haven’t gone so well,” he says.

Prior to Covid-19, Bottomley went on a lot of site visits, meeting management teams. What benefits investors long term, he says, are companies that aren’t too aggressive with mergers and acquisitions, don’t overpay for assets and focus on core markets where they have competencies and market share. But this also means having good infrastructure, like call centres to support patients for medical cannabis companies, or adequate supply for and quantity of retail locations to gain market share.

“Management teams can be fairly aggressive with respect to their messaging,” Bottomley says, “and that’s fine if you can back it up, but I think that’s something investors have to be particularly careful of when they’re choosing which operators they want to back.”

As tech leaders race to bring Windows systems back online after Friday’s software update by cybersecurity company CrowdStrike crashed around 8.5 million machines worldwide, experts share with CIO Journal their takeaways for preparing for the next major information technology outage.

Be familiar with how vendors develop, test and release their software

IT leaders should hold vendors deeply integrated within IT systems, such as CrowdStrike , to a “very high standard” of development, release quality and assurance, said Neil MacDonald , a Gartner vice president.

“Any security vendor has a responsibility to do extensive regression testing on all versions of Windows before an update is rolled out,” he said.

That involves asking existing vendors to explain how they write software, what testing they do and whether customers may choose how quickly to roll out an update.

“Incidents like this remind all of us in the CIO community of the importance of ensuring availability, reliability and security by prioritizing guardrails such as deployment and testing procedures and practices,” said Amy Farrow, chief information officer of IT automation and security company Infoblox.

Re-evaluate how your firm accepts software updates from ‘trusted’ vendors

While automatically accepting software updates has become the norm—and a recommended security practice—the CrowdStrike outage is a reminder to take a pause, some CIOs said.

“We still should be doing the full testing of packages and upgrades and new features,” said Paul Davis, a field chief information security officer at software development platform maker JFrog . undefined undefined Though it’s not feasible to test every update, especially for as many as hundreds of software vendors, Davis said he makes it a priority to test software patches according to their potential severity and size.

Automation, and maybe even artificial intelligence-based IT tools, can help.

“Humans are not very good at catching errors in thousands of lines of code,” said Jack Hidary, chief executive of AI and quantum company SandboxAQ. “We need AI trained to look for the interdependence of new software updates with the existing stack of software.”

Develop a disaster recovery plan

An incident rendering Windows computers unusable is similar to a natural disaster with systems knocked offline, said Gartner’s MacDonald. That’s why businesses should consider natural disaster recovery plans for maintaining the resiliency of their operations.

One way to do that is to set up a “clean room,” or an environment isolated from other systems, to use to bring critical systems back online, according to Chirag Mehta, a cybersecurity analyst at Constellation Research.

Businesses should also hold tabletop exercises to simulate risk scenarios, including IT outages and potential cyber threats, Mehta said.

Companies that back up data regularly were likely less impacted by the CrowdStrike outage, according to Victor Zyamzin, chief business officer of security company Qrator Labs. “Another suggestion for companies, and we’ve been saying that again and again for decades, is that you should have some backup procedure applied, running and regularly tested,” he said.

Review vendor and insurance contracts

For any vendor with a significant impact on company operations , MacDonald said companies can review their contracts and look for clauses indicating the vendors must provide reliable and stable software.

“That’s where you may have an advantage to say, if an update causes an outage, is there a clause in the contract that would cover that?” he said.

If it doesn’t, tech leaders can aim to negotiate a discount serving as a form of compensation at renewal time, MacDonald added.

The outage also highlights the importance of insurance in providing companies with bottom-line protection against cyber risks, said Peter Halprin, a partner with law firm Haynes Boone focused on cyber insurance.

This coverage can include protection against business income losses, such as those associated with an outage, whether caused by the insured company or a service provider, Halprin said.

Weigh the advantages and disadvantages of the various platforms

The CrowdStrike update affected only devices running Microsoft Windows-based systems , prompting fresh questions over whether enterprises should rely on Windows computers.

CrowdStrike runs on Windows devices through access to the kernel, the part of an operating system containing a computer’s core functions. That’s not the same for Apple ’s Mac operating system and Linux, which don’t allow the same level of access, said Mehta.

Some businesses have converted to Chromebooks , simple laptops developed by Alphabet -owned Google that run on the Chrome operating system . “Not all of them require deeper access to things,” Mehta said. “What are you doing on your laptop that actually requires Windows?”