The security market, from public numbers

A practitioner's read on the business of the security market: who is growing, who is consolidating, who is being bought, and what it means if you run a security program. Public sources only. Written by Jesse Pike.

Not a news site and not investment advice. · Last complete data refresh: not established · Domain stances judged 16 Aug 2026 by Jesse Pike.

Data refresh status

Last complete data refresh: not established.

Latest attempt: 14 Oct 2026, 19:30 UTC — incomplete and held. Published figures and their reporting periods are unchanged.

74 of 74 suppliers attempted; 37 have failed or unverified checks. A data update is published only when every required applicable check passes.

App deployment revision: f053a78. This status update does not refresh the data. Latest attempt receipt.

This week · week ending 6 Sep 2026 · published 19 Sep 2026 · Issue 2026-w36 · Feed

Record earnings from CrowdStrike, Zscaler, Palo Alto, Rubrik and NVIDIA meet thin VC and quiet M&A — the infra-to-security lag call holds.

Site note The lag call is this site's refusal to claim that infrastructure spending leads security spending by a fixed interval.

The market by domain

These are figures the companies themselves reported, listed alphabetically. They measure different things over different periods, so they are labelled and not ranked. Being listed is not a recommendation, and being absent is not a criticism. Private companies that publish no comparable figures are tracked through funding and acquisitions instead.

Network / SASE

JUDGED · Jesse Pike

PREPAREAct now

Horizon · This quarter

Tracked suppliers and what they last reported

  • Cato Networks+42%

    ARR milestone · AUG ’26

  • Check Point+1%

    revenue · JUN ’26

  • Cloudflare+36%

    revenue · JUN ’26

  • Fortinet+52%

    product revenue · JUN ’26

  • Netskope+27%

    ARR · JUL ’26

  • Zscaler+20%

    organic ARR · JUL ’26

Data / AI Security

JUDGED · Jesse Pike

PREPAREAct now

Horizon · This planning cycle

Tracked suppliers and what they last reported

  • Rubrik+33%

    subscription ARR · JUL ’26

  • Varonis+25%

    SaaS ARR ex-conversions · JUN ’26

Cloud Security

JUDGED · Jesse Pike

INVESTIGATEWatch closely

Horizon · Next 1–4 quarters

Tracked suppliers and what they last reported

  • CrowdStrike Falcon Cloud>35%

    cloud ending ARR · FY26 · older figure · product line, not the whole company

Identity

JUDGED · Jesse Pike

INVESTIGATEWatch closely

Horizon · Next 1–4 quarters

Tracked suppliers and what they last reported

  • Okta+14%

    cRPO · JUL ’26

  • SailPoint+25%

    ARR · JUL ’26

SecOps

JUDGED · Jesse Pike

INVESTIGATEWatch closely

Horizon · Next 1–4 quarters

Tracked suppliers and what they last reported

  • Cisco Security+2%

    FY2026 security revenue · FY26

  • CrowdStrike+25%

    ending ARR · JUL ’26

  • Palo Alto XSIAM+100%

    segment ARR YoY · Q3 FY26 · product line, not the whole company

  • SentinelOne+22%

    ARR · JUL ’26

AI Runtime

JUDGED · Jesse Pike

INVESTIGATEWatch closely

Horizon · Next 1–4 quarters

Tracked suppliers and what they last reported

No comparable public growth figures yet. Tracked through funding and acquisitions.

What we now think

This week combined eight public-issuer earnings prints — CrowdStrike, Zscaler, SentinelOne, Okta, Rubrik, Palo Alto Networks, Broadcom and Nutanix all reported in-window — with thin early-stage funding and quiet, mostly undisclosed M&A. The pattern is consistent with the standing infrastructure-to-security lag call, not a change to it.

Standing analysis: holds. See the record.

  • Stable 0–8-quarter infrastructure-to-security lag: this window adds one mature infrastructure impulse and no comparable registered security response, so the lag stays a no-call rather than a measured number of quarters.

Signed by Jesse Pike · 19 Sep 2026

New companies and funding

  • Socure raises $156.0M Series E for digital identity and fraud prevention

    Summit Partners led one of the week's larger identity-fraud raises.

  • KAZIMI raises $2.6M Pre-Seed for mobile anti-bot protection (Germany)

    Market One Capital backed the anti-bot platform, a small early-stage formation signal.

  • CYBERA raises $2.5M Venture round for SD-WAN with built-in network security

    The US SD-WAN vendor folds network security into its platform for distributed enterprises.

  • Opgate raises $60.0K Pre-Seed for AI-agent runtime security and policy enforcement

    A very early formation bet on runtime controls for autonomous AI agents.

  • DetectifAI raises undisclosed Seed round for AI deepfake voice detection

    Backers include Josh Constine and Manohar Kamath; no round size was disclosed.

  • HiddenLayer raises $100M Series B for AI runtime security

    Delta-v Capital led the round, joined by Booz Allen Ventures, M12, Morgan Stanley and Ten Eleven Ventures.

  • AIR Security emerges from stealth with $50M for an AI agent firewall

    Sequoia Capital and Greenoaks led the round alongside individual industry angels.

Acquisitions and consolidation

  • Palo Alto Networks reportedly paid $500M for Console, sources say

    TechCrunch reports the AI-agent IT helpdesk startup deal; Palo Alto has not confirmed it.

  • ePlus acquires Daymark Solutions for an undisclosed amount

    Adds Daymark to ePlus’s portfolio; deal terms were not disclosed.

  • Echo acquires container security firm Minimus (formerly Gutsy)

    The Israel-based secure-by-design container image company was acquired for an undisclosed amount.

  • Ampcus acquires smarterd, an IT asset management and risk platform

    Terms were undisclosed for the US-based IT asset management and risk-prioritization deal.

  • Trace3 acquires Calian's U.S. Commercial IT Business, an MSSP

    The managed security services provider was acquired for an undisclosed amount.

  • Integrity360 acquires CyberIAM, a UK identity and access management consultancy

    The IAM professional-services firm was acquired for an undisclosed amount.

Earnings and reported numbers

  • CrowdStrike revenue hits $1.47B, +26% YoY; net new ARR $333M, +51%

    Net new ARR accelerated to 51% year-over-year, the strongest reacceleration among this week’s prints.

  • Zscaler FY2026 revenue grows to $898.2M, +25% YoY; ARR grows to $3,771M, +25%

    Net new ARR added $246M in the quarter, extending Zscaler’s growth at scale.

    CORRECTED

    Zscaler fiscal fourth-quarter revenue (quarter ended 31 July 2026) grows to $898.2M, +25% YoY; ARR grows to $3,771M, +25%

    See correction

  • SentinelOne revenue grows 21% to $292M; ARR up 22% to $1,218M

    SentinelOne’s revenue and ARR growth held steady this quarter, consistent with a platformizing XDR market.

  • Okta revenue rises 11% to $805M, subscription revenue $793M

    Subscription revenue grew 12% year-over-year, Okta’s core identity business still expanding steadily.

  • Rubrik revenue grows 38% to $427.3M; subscription ARR $1.66B, +33%

    Subscription ARR growth accelerated to 33%, reinforcing Rubrik’s place in the data-security landscape.

  • Palo Alto FY2026 revenue grows 34% to $3.41B; Next-Gen Security ARR $9.10B, +63%

    Next-Gen Security ARR growth of 63% is the fastest among this week’s public-issuer prints.

    CORRECTED

    Palo Alto fiscal fourth-quarter revenue (quarter ended 31 July 2026) grows 34% to $3.41B; Next-Gen Security ARR $9.10B, +63%

    The original "why it matters" comparison, that this growth was the fastest among this week's public-issuer prints, is withdrawn. Next-Gen Security ARR is a company-defined segment and is not comparable with other companies' total revenue growth.

    See correction

  • Broadcom Q3 revenue up 86 percent to $29.6B; AI chip revenue $16.7B, +221%

    AI semiconductor revenue grew 221% year-over-year and 54% quarter-over-quarter, per CEO Hock Tan.

  • Nutanix revenue grows 16% to $757.1M; ARR reaches $2.55B, +16%

    Nutanix’s ARR growth held at 16% for a second straight readout, a steady infrastructure-layer print.

Capital and financial position

  • NVIDIA revenue hits $96.2B, +106% YoY; Data Center revenue $89.0B, +117%

    Data Center revenue growth accelerated to 117% year-over-year, the strongest print in this week’s set.

  • Microsoft guides capex to over $50B, citing a useful-life update

    The next-quarter capex guide is a new infrastructure-buildout data point for the standing infra-to-security lag call.

The landscape · four domains

Where the security market is going, not where it has been.

Dated postures, the evidence under each one, and an honest mark on how sure anyone is. A posture moves only when a person signs it.

Network / SASERefresh is live. Cato and Netskope are growing faster than Zscaler organic. That is a split, not a new SASE wave.

PREPARE

Appliance-led network security is live now. Private SASE and public SSE are split from Zscaler organic — not a category re-acceleration.

TRACKED

Fortinet +52% · Cato +43% · Netskope +31%

JUDGED · Jesse Pike

HORIZON · This quarter

Data / AI SecurityPublic data vendors are up. DSPM names are capital and M&A, not a broad spend series.

PREPARE

Selected data vendors are accelerating. Not a broad realized series yet.

TRACKED

Rubrik +32% · Varonis +25% · Sentra · Securiti close

JUDGED · Jesse Pike

HORIZON · This planning cycle

Cloud SecurityCrowdStrike cloud segment is real. CNAPP names show 2026 GTM or last disclosed equity — not a clean category ARR series.

WATCH

Qualify residual gaps when capacity goes live.

TRACKED

Falcon Cloud >$800M · Upwind · Orca · Aqua

JUDGED · Jesse Pike

HORIZON · Next 1–4 quarters

IdentityIGA is up. Mega-seed and strategic rounds are capital heat in agentic identity — not buyer spend yet.

WATCH

Use identity as a qualification topic where machine identities go live.

TRACKED

SailPoint +28% · Oak $60M · Hush $30M

JUDGED · Jesse Pike

HORIZON · Next 1–4 quarters

Platform pressure

Who is holding, who is buying in, who is being outrun

The partner question. Where an incumbent is still the safe pick, where it is acquiring its way into a category, and where a challenger is printing faster inside the same motion.

TRACKED PRINTS · JUDGED READ

VendorPositionLatest tracked printJudged read
Holding position
FortinetIncumbent

product revenue +52%

Refresh spike. Not yet proven as a lasting rotation.

JUDGED · Jesse Pike

CrowdStrike Falcon CloudPlatform

cloud ending ARR >35%

Recovered. The cloud segment is real revenue, not a category series.

JUDGED · Jesse Pike

OktaPlatform

cRPO +14%

Recovered. The cloud segment is real revenue, not a category series.

JUDGED · Jesse Pike

Buying in rather than building
Protect AIAbsorbed

Palo Alto · $634.5M · closed Jul 2025

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

CalypsoAIAbsorbed

F5 · $145.2M · closed Sep 2025

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

CyberArkAbsorbed

Palo Alto · $25B · closed Feb 2026

Identity becomes a Palo Alto platform pillar. Capital, not customer spend.

JUDGED · Jesse Pike

WizAbsorbed

Google · $32B · closed Mar 2026

Cloud security absorbed into a hyperscaler. Watch what it does to the specialist gap.

JUDGED · Jesse Pike

SurePath AIAbsorbed

F5 · $50.1M · closed Jun 2026

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

Being outrun in their own motion
ZscalerPlatform

organic ARR +20%

Cato Networks at +42% and Netskope at +27% are printing faster in the same category.

JUDGED · Jesse Pike

Cisco SecurityPlatform

FY2026 security revenue +2%

Networking orders +40% carried the quarter. Security did not.

JUDGED · Jesse Pike

SailPointIncumbent

ARR +25%

No clean re-acceleration inside this window.

JUDGED · Jesse Pike

Challengers worth a look
Cato Networks · NetskopeChallenger

+42% · +27%

Growing faster than Zscaler organic. A split inside the category, not a new SASE wave.

JUDGED · Jesse Pike

Rubrik · VaronisChallenger

+33% · +25%

Both accelerating on public numbers. The cleanest data-side signal here.

JUDGED · Jesse Pike

Oak · Hush SecurityEarly

$60M · $30M

Agentic identity. Capital, not customers. Too early to place a bet on.

JUDGED · Jesse Pike

Holding position

Fortinet

Incumbent

product revenue +52%

Refresh spike. Not yet proven as a lasting rotation.

JUDGED · Jesse Pike

CrowdStrike Falcon Cloud

Platform

cloud ending ARR >35%

Recovered. The cloud segment is real revenue, not a category series.

JUDGED · Jesse Pike

Okta

Platform

cRPO +14%

Recovered. The cloud segment is real revenue, not a category series.

JUDGED · Jesse Pike

Buying in rather than building

Protect AI

Absorbed

Palo Alto · $634.5M · closed Jul 2025

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

CalypsoAI

Absorbed

F5 · $145.2M · closed Sep 2025

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

CyberArk

Absorbed

Palo Alto · $25B · closed Feb 2026

Identity becomes a Palo Alto platform pillar. Capital, not customer spend.

JUDGED · Jesse Pike

Wiz

Absorbed

Google · $32B · closed Mar 2026

Cloud security absorbed into a hyperscaler. Watch what it does to the specialist gap.

JUDGED · Jesse Pike

SurePath AI

Absorbed

F5 · $50.1M · closed Jun 2026

AI security absorbed into a platform vendor. Watch whether it survives as a product or becomes a feature.

JUDGED · Jesse Pike

Being outrun in their own motion

Zscaler

Platform

organic ARR +20%

Cato Networks at +42% and Netskope at +27% are printing faster in the same category.

JUDGED · Jesse Pike

Cisco Security

Platform

FY2026 security revenue +2%

Networking orders +40% carried the quarter. Security did not.

JUDGED · Jesse Pike

SailPoint

Incumbent

ARR +25%

No clean re-acceleration inside this window.

JUDGED · Jesse Pike

Challengers worth a look

Cato Networks · Netskope

Challenger

+42% · +27%

Growing faster than Zscaler organic. A split inside the category, not a new SASE wave.

JUDGED · Jesse Pike

Rubrik · Varonis

Challenger

+33% · +25%

Both accelerating on public numbers. The cleanest data-side signal here.

JUDGED · Jesse Pike

Oak · Hush Security

Early

$60M · $30M

Agentic identity. Capital, not customers. Too early to place a bet on.

JUDGED · Jesse Pike

Tracked hypotheses

Stated in advance · scored against evidence, not opinion

  • NO-CALL

    Infrastructure spend leads security spend by a stable 0 to 8 quarters

    Needs two mature buildout impulses. This window has one.

    JUDGED · Jesse Pike

  • NO-CALL

    AI adoption compresses that lag

    No series exists to test it against yet.

    JUDGED · Jesse Pike

  • TRACKING

    Platforms absorb adjacent security categories rather than compete with them

    Wiz in Cloud, CyberArk in Identity, Protect AI in AI runtime, CalypsoAI in AI runtime and SurePath AI in AI runtime

    JUDGED · Jesse Pike

  • TRACKING

    Incumbents that cannot pivot lose ground to challengers inside their own motion

    Cato Networks and Netskope against Zscaler organic is the first test.

    JUDGED · Jesse Pike

Standing analysis

Does security spending lag infrastructure spending?

Infrastructure is running ahead. Security is splitting, not booming.

JUDGED · Jesse Pike

Read the analysis and its record

What moved: edition delta

What moved

WINDOW · 11 Aug–17 Aug 2026

TRACKED · public prints, no judgment applied

  • PRINT

    Cato Networks at +42% and Netskope at +27% are printing faster in the same category.

  • CAPITAL

    Oak raised $60M, Hush Security raised $30M. Capital heat, not disclosed revenue.

  • M&A

    No new closed transaction in the window. Palo Alto · $634.5M · closed Jul 2025 and F5 · $145.2M · closed Sep 2025 and Palo Alto · $25B · closed Feb 2026 and Google · $32B · closed Mar 2026 and F5 · $50.1M · closed Jun 2026. Neither is this month's demand signal.

JUDGED · a person signed this · · Jesse Pike

  • HELD

    All 4 postures unchanged.

    Edition delta
  • WHY

    One strong print is a card. A domain posture needs more than one company and a reason the motion is not just share shift or M&A.

    Method · breadth rule

A quiet week is reported as a quiet week. Nothing is invented to fill the space.

Domain tempo and M&A activity

Tempo

Each domain has a dated posture, a horizon, and the evidence that produced it. Tag will not exceed the Episode 002 posture.

Confidence: MEDIUM across every landscape domain.

Since 17 August 2026

No posture moved. The AI runtime rationale is now carried by filings rather than by funding rounds.

SurfaceThis editionVs last
PrintsAI runtime gains three absorbed-close prints: Protect AI, CalypsoAI and SurePath AI.Moved
ActivityThree M&A closes added to the AI runtime board — two background, one at more.Moved
EvidenceFive FILING-class records (D32–D36) added from SEC filings on the three closes and the CyberArk deregistration.New
Network / SASEUnchanged.Held
Data / AI SecurityUnchanged.Held
Cloud SecurityUnchanged.Held
IdentityUnchanged.Held
SecOpsUnchanged.Held
AI RuntimeUnchanged.Held
DomainAs ofHorizonDo
Network / SASEThis quarterPREPARE

Refresh is live. Cato and Netskope are growing faster than Zscaler organic. That is a split, not a new SASE wave.

Produced by

Tension

Data / AI SecurityThis planning cyclePREPARE

Public data vendors are up. DSPM names are capital and M&A, not a broad spend series.

Produced by

Tension

Cloud SecurityNext 1–4 quartersWATCH

CrowdStrike cloud segment is real. CNAPP names show 2026 GTM or last disclosed equity — not a clean category ARR series.

Produced by

Tension

IdentityNext 1–4 quartersWATCH

IGA is up. Mega-seed and strategic rounds are capital heat in agentic identity — not buyer spend yet.

Produced by

Tension

SecOpsNext 1–4 quartersWATCH

Public XDR and XSIAM segments are healthy. SOAR capital (Torq, Tines) is scale-up, not a new cycle.

Produced by

Tension

AI RuntimeNext 1–4 quartersWATCH

Platforms are paying disclosed prices for AI security companies whose revenue the filings call immaterial. Acquisition is running ahead of any visible buyer spend.

Held Posture held. The evidence under AI runtime changed class, from funding announcements to audited SEC filings: three more platform closes, each priced, each with revenue the filing calls immaterial. Buyer spend is still not visible — a purchase price is not a spend series.

Produced by

Tension

Activity below is the pre-issue window (RoS) — going forward each issue's "New companies and funding" and "Acquisitions and consolidation" lanes carry this account.

M&A and startups

Window: Jul 6 – Aug 10, 2026. Platforms that bought identity are now seeding and buying agent control. Agent governance funded at every stage in one window; capital heat runs ahead of disclosed revenue. First disclosed agentic-identity revenue is the falsifier.

Zenity raised $115M Series C (+ $10M secondary)$115M + $10M

Norwest · AI runtime

Series C. Some outlets report $125M total — primary plus secondary, not a conflict. Valuation is not ARR.

Oak raised $60M seed$60M

Accel, CRV, Greylock · Identity

Mega-seed for AI-native identity OS. Capital, not buyer spend.

Hush raised $30M with Akamai strategic$30M

Akamai, Battery, YL Ventures · Identity

Series A. Akamai joined as strategic investor — cap table is the story.

Cyera to acquire Oasis Security~$1B

Cyera · Data / identity

LOI, not close. Cyera raised $600M weeks earlier — raise-then-acquirer. Capital, not ARR.

Onyx raised $113M$113M

Bessemer · AI runtime

Series B. Agent control plane. Company-stated revenue growth is not a public ARR series.

More in this window (13)
Horizon3.ai raised $250M Series E$250M

NightDragon, NEA · Exposure

Autonomous pentest scale-up. Not a lead — mature-category check.

CrowdStrike fund backed Above SecurityUndisclosed

CrowdStrike Falcon Fund · AI runtime

Agent-driven insider threat. Strategic fund signal; amount undisclosed.

Glow emerged with $180M$180M

Sequoia, Cyberstarts · Endpoint

Company PR: $180M at launch. Source does not label a round type.

Cathedral raised $160M$160M

a16z, Sequoia · Exposure

Defense-tech: autonomous red team for military cyber operations. Different audience than enterprise agent governance.

Neo launched with $100M$100M

a16z, Bessemer · AI runtime

Company PR: $100M at emergence. RoS listed $75M Series A — priced round vs total at launch.

Cisco invested in ZafranUndisclosed

Cisco Investments · Exposure

Strategic round in exposure/risk prioritization. Amount undisclosed.

Arcade just appeared (Series A 2026)Undisclosed

SYN Ventures · AI runtime

Secure action layer for production AI agents. SYN portfolio — round year 2026 only; no public amount or date.

CodeIntegrity just appeared (Seed 2026)Undisclosed

SYN Ventures · AI runtime

Runtime control layer for AI agents. SYN portfolio — round year 2026 only; no public amount or date.

Cisco completed AstrixUndisclosed

Cisco · Identity

NHI / agent identity into Cisco Identity Intelligence. Cisco did not disclose terms.

F5 closed SurePath AI$50.1M

F5 · AI runtime

$39.1M of the price is goodwill.

Cyera raised $600M at $12B$600M / $12B

Evolution Equity · Data

Series G. Context for Oasis lead row. Valuation is not ARR.

Palo Alto closed PortkeyUndisclosed

Palo Alto · AI runtime

AI gateway into Prisma AIRS. Control, not demand. Terms not disclosed.

Zscaler intends Symmetry SystemsIntent

Zscaler · Data / identity

Intent, not close. Access graph to govern agent-to-data communication. Terms not disclosed.

Background — last disclosed raises (6)
Google closed Wiz$32B

Google · Cloud

Closed. Announced Mar 2025. Capital, not customer spend.

Palo Alto closed CyberArk$25B

Palo Alto · Identity

Closed. Identity becomes a PANW platform pillar.

F5 closed CalypsoAI$145.2M

F5 · AI runtime

Closed. Revenue not material in the filing.

Palo Alto closed Protect AI$634.5M

Palo Alto · AI runtime

Closed. Revenue not material in the filing.

Lumos last disclosed $35M Series B$35M

Scale VP · Identity

Last disclosed raise. Mar 2026 agent-identity product launch is not a new capital print.

Secuvy last disclosed seedSeed

Dell Capital · Data

Last disclosed raise. 2026 partner listings only. Do not invent ARR.

Market layers

Market layers

Panel window 2023-Q1 through 2026-Q1 (2023-Q1 = 100). Later JUL ’26 scorecard prints are not on these charts. Fiscal quarters are mapped into calendar buckets — NVIDIA FY27 Q1 ended 2026-04-26 sits in 2026-Q1. Descriptive sequence only, not a fitted lag.

All three charts use the same log-scale index axis (50–1800; 2023-Q1 = 100) so proportional differences are visually honest — e.g. infrastructure near 18× vs. security near 2×.

Loading charts…

View data table (accessible alternative)
Derived panel indices by quarter (2023-Q1 = 100)
QuarterNVIDIA DCMSFTAMZNGOOGHyperscaler medianCRWDOKTAFTNTZSCHKPSecurity median
2023-Q1100.0100.0100.0100.0100.0100.0100.0100.0100.0100.0100.0
2023-Q2241.1135.280.6109.5109.5105.6107.3102.4108.6104.1105.6
2023-Q3339.0150.187.8128.1128.1113.5112.7105.7118.6105.3112.7
2023-Q4429.9147.4102.7175.2147.4122.0116.8112.1125.4117.3117.3
2024-Q1527.1165.7105.1190.9165.7133.0119.1107.2132.1105.8119.1
2024-Q2613.8209.8124.0209.7209.7139.2124.7113.6141.6110.8124.7
2024-Q3718.9225.7159.2207.6207.6145.9128.4119.5150.0112.2128.4
2024-Q4831.3239.0195.8227.0227.0152.9131.7131.5154.7124.4131.7
2025-Q1913.8253.4176.1273.4253.4159.3132.8122.0161.9112.7132.8
2025-Q2960.3258.4226.5356.9258.4168.8140.5129.1171.7117.5140.5
2025-Q31196.7293.3247.0380.8293.3178.2143.2——119.8143.2
2025-Q41455.8452.0278.1442.8442.8188.4146.9150.9—131.6148.9
2026-Q11758.2467.2311.0567.1467.2200.1147.7—203.1118.0173.9

Panel window is calendar 2023-Q1 through 2026-Q1. Later JUL ’26 scorecard prints are not on these charts. Company fiscal quarters are mapped into those calendar buckets — NVIDIA FY27 Q1 (ended 2026-04-26) sits in 2026-Q1. All three charts share the same log-scale index axis (50–1800; 2023-Q1 = 100). Infrastructure: NVIDIA Data Center revenue. Hyperscaler: median indexed Microsoft, Amazon, and Alphabet quarterly cash capex (not additive). Security: median indexed CrowdStrike, Okta, Fortinet, Zscaler, and Check Point revenue where reported. Gaps remain null — no interpolation.

Watch next

Watch next

What would change the read before the next freeze.

  1. Next IANS publication

    2026 security-budget growth and share of IT

    The +4% / 10.9% hero numbers are the 2025 IANS print (published August 2025). A 2026 edition is the first buyer-budget falsifier.

  2. Next 60 days

    Palo Alto Q4 FY26 — first full CyberArk quarter

    Separates organic platform demand from acquired identity revenue.

  3. Next print

    Fortinet product-revenue follow-through

    Tells refresh spike vs architectural rotation toward converged appliance.

  4. Next print

    Zscaler FY27 ARR guide

    Tests whether SASE deceleration is company-specific or category-wide.

  5. Any hyperscaler print

    A 2027 capex guidance cut

    Largest threat to the infrastructure-lead story. Would change the call.

  6. Open

    Any vendor disclosing agentic-identity revenue

    First disclosed number defines whether the category is real spend or product naming.

How this is built

How this is built

Public sources only. This edition is the Episode 002 packet (SEC-MARKET-SIG-002 v0.2) plus an August 2026 surface refresh — SentinelOne, SailPoint, identity coverage names, and 2026 capital events — legacy snapshot date September 21, 2026. Each domain posture is dated, with a horizon and the evidence that produced it. This edition shows what held or moved versus the one before. Not a live feed. Every number links to a source excerpt and its limits.

How editions age

Current prints stay on the scorecard. Older still-true context collapses to Background. Superseded prints leave the card and stay in evidence. Acquired vendors keep their last independent print — we do not rewrite them into the buyer. Domain postures keep the date they were set; the next edition shows what held or moved. Tracked figures are updated as companies report. A signed read is published most weeks.

Signals we use

SignalExamplesWe treat it as
Infrastructure printsNVIDIA Data Center, Cisco orders, Arista, Dell, VertivSupply and buildout. The lead layer.
We do not. Proof that security budgets will follow.
Hyperscaler capexMicrosoft, Amazon, Alphabet cash investmentDemand for capacity. Market condition, not a vendor score.
We do not. A security-spending forecast.
Security vendor printsFortinet, SentinelOne, CrowdStrike, Rubrik, Varonis, SailPoint, Okta, Palo Alto, CiscoRealized category motion — after stripping acquisitions.
We do not. A boom from one headline growth rate.
Buyer budgetsIANS security-budget growth and share of ITThe best check on whether customers actually spent.
We do not. Vendor guidance dressed up as demand.
Buyer intentETR planned increases, McKinsey AI-use surveysDirection of attention. Useful, early, weak.
We do not. Bookings or a category call.
Capital and M&AWiz, CyberArk, Portkey, Astrix, Symmetry, Cyera, Onyx, LumosWhere incumbents are placing bets.
We do not. Customer spend. A $32B deal is not a demand series.
Forcing eventsDORA, SEC cyber rule, incidents, insurance hygieneReasons spend can move on a different clock than infra.
We do not. A product-revenue print.

How we turn that into a call

  1. 1

    Separate the fact from the story

    Keep the excerpt, date, period, and metric definition. Interpretation sits next to it, not on top of it.

  2. 2

    Do not collapse signal types

    Realized revenue, organic growth, guidance, intent, funding, and acquisitions stay in different buckets.

  3. 3

    Need breadth before a domain call

    One strong print is a card. A domain posture needs more than one company and a reason the motion is not just share shift or M&A.

  4. 4

    Refuse the lag if the window cannot support it

    A stable infra-to-security lag needs two mature buildout impulses and a comparable security response. This window has one mature impulse. That is a no-call, not a guessed number of quarters.

  5. 5

    Action follows exposure, not the composite

    PREPARE only where the account has a matching live motion. A split market is not a license for a broad campaign, and this episode does not authorize RUN.

  6. 6

    Age the edition; do not pretend it is live

    Keep the latest comparable print on the card. Demote still-true context. Leave superseded prints in evidence. Freeze acquired entities. Refresh on earnings, material capital events, and falsifiers — not on a news clock.

  7. 7

    Date the posture; show the delta

    Every domain posture carries the date it was set, the horizon it governs, and the evidence that produced it. Each edition states what held or moved versus the prior edition. Do not overwrite the last state.

Research & evidence

Research & evidence library

Search the Episode 002 packet and the August 2026 surface refresh. Click any row to inspect full attribution.

109 sources

How a posture is set

One strong print is a card. A domain posture needs more than one company and a reason the motion is not just share shift or M&A.

Standing analysisRead the methodOpen the evidence librarySend a correction

Corrections

If a figure is wrong, send it

Corrections and counter-evidence are more useful than agreement. If a print is wrong, a source has been superseded, or a read goes further than the evidence does, that is worth an email. There is no form, and every correction that gets published is listed at /corrections/.

Send a correction or a question

Jesse Pike · jesse@keatingpike.com