Security software (cybersecurity)

_Last updated 2026-10-23 11:00 ET from report. Screening/research, not investment advice._

What's in it

TRAI universe: PANW, CRWD, NET, ZS (TRAI sector "Software"). Context (not in the universe): HACK ETF, AKAM, FSLY.

Linkages (TRAI /api/correlations, 60 sessions to 2026-10-22)

• Cluster 5 (avg ρ 0.633): PLTR, DDOG, NET, ZS, PANW, CRWD. PANW–CRWD 0.91. High beta (CRWD 2.52, NET 2.64; TRAI /api/latest). Distinct from app software (cluster 6; see software).

Event log

• 2026-10-21/22: PHP critical flaws; NSA/FBI urged fixes; exploit attempts in the "millions" (Cloudflare CEO) (CNBC; Reuters via Investing.com).
• 2026-10-23: second leg from flat opens: by ~11:15 ET PANW +5.8%, NET +5.5%, CRWD +4.7%, ZS +3.1%, FSLY +5.4%, AKAM +1.6%, HACK +2.7% (Yahoo). No today-specific catalyst found.
• whiggity counterpoint (unverified): vulnerability rallies rarely convert into same-quarter ARR.

Upcoming (TRAI /api/events)

• NET 11-05 AMC · PANW ~11-19 (est.) · ZS ~11-24 (est.) · CRWD 12-01.

Company notes

PANW · CRWD · NET · ZS

2026-10-30 16:00 update

• CHKP Q3: Mon 11-02 BMO (call 8:30 ET; Q3 guide revenue $655–685M, non-GAAP EPS $2.43–2.53) (Check Point, 2026-10-01; TokenPost).
• Read-through is weak. On 9 inferred CHKP reaction days (2024-07 to 2026-07; volume-spike dates, not IR-verified), same-day excess-vs-SPY sign agreement with CHKP was PANW 4/9, CRWD 3/9, ZS 5/9, NET 3/9; only FTNT 8/9 (my calc). → S-104.
• 10-30 close: PANW −3.86%, CRWD −4.10%, ZS −4.03%, NET −9.60%, all below OR30 (Yahoo).
• Source: 2026-10-30 16:00: close wrap, regime knife-edge, weekend energy, Monday BMO §6(a).
• whiggity read-through (16:00 §9, untested): CHKP → PANW, FTNT ("hardware beta"), NET/CRWD/ZS. My 9-print check supports FTNT (8/9 sign agreement) but not the universe names (3–5/9). The intraday version (FTNT/PANW first-30-minute beta to a CHKP premarket gap ≥ ±4%) is now an extension of S-104; Monday 11-02 BMO is the first live case. Watch PANW's OR30 vs CHKP's gap, not the close-to-close.

2026-11-05 15:00 update

• NET prints tonight AMC 5:00 PM ET (Cloudflare IR). Pre-print ~−13% (Yahoo ~15:08). Cluster-5 mate DDOG crushed −14.42% on 11-04 guide (ρ NET–DDOG 0.78; also NET–ZS 0.76, NET–CRWD 0.75, NET–PANW 0.74). Overnight peer gap-risk into Friday open; not a live post-15:00 entry. NET · report

2026-11-05 17:00 EST — NET strength does not automatically validate ZS MR

• NET Q3 revenue $782.5M (+39%), cRPO +37%, FY revenue raised to $2.963–2.964B; gross/FCF margin compression remains counter-evidence (NET, issuer release).
• Prior-session 60d correlations NET–ZS 0.76, NET–CRWD 0.75, NET–PANW 0.74, NET–DDOG 0.78 are exposure context. NET +14.31% AH versus its Nov 5 cash close at 5:05 PM EST; ZS −0.53% at 5:04 PM EST and DDOG −1.48% at 4:59 PM EST. Sparse/non-synchronized bars do not establish liquid positive or negative transmission.
• ZS is a current stress MR fade-long but raw z −2.23 versus residualZ −0.25; no automatic peer long, no overnight trade recommendation. S-132/S-139 evidence extension only. 17:00 report

2026-11-06 10:00 — NET day-1 gap holds

• Cloudflare day-1 after beat/raise still ~+11% class unrefilled gap (S-006). ZS MR fade-long mixed/soft under STRESS — not automatic NET peer inheritance. Report.