A data artifact, not a security-spend signal

CrowdStrike underwent a first-ever 4-for-1 stock split effective for split-adjusted trading on July 2, 2026, and the unadjusted local price history around that date produces an apparent -58 to -60% "collapse" that is purely mechanical. Split-adjusted, CRWD is up roughly 69% over three months, and the session before the split, shares actually jumped alongside a Wells Fargo price-target hike and broad cybersecurity strength, with PANW and CRWD both rallying on June 29 on sector-wide momentum. That removes CRWD entirely as evidence of either company-specific weakness or a sector security-budget problem.

The real bull transitions happened weeks ago

Band-transition data shows the genuine bear-to-bull flips for DDOG, NET, PANW, OKTA, SNOW and DT clustered between May 4 and June 30 — one to three months before the current snapshot — meaning the trailing-30-day 2.3%/4.5% category gain is largely a plateau after the real move, not a fresh inflection. Those transitions are fundamentally grounded: Datadog's Q1 revenue crossed $1B for the first time, up 32% YoY, with AI-related business now over 10% of revenue and growing 100%+ annually; Snowflake posted 126% net revenue retention and remaining performance obligations up 38% YoY; and Palo Alto guided Next-Generation Security ARR to $8.90-8.95B (+59-60% YoY), with platformization economics reinforced by the CyberArk deal that closed in February. DDOG, NET and SNOW now sit within single digits of 52-week highs, leaving limited pure mean-reversion runway; PANW and OKTA trail by roughly 11-12%.

Two names never actually exited bear regimes

ServiceNow has spent nearly the entire trailing year in strongly bearish, briefly easing in June before reverting on July 9 after management cut subscription gross-margin guidance 50bps and flagged an implied second-half revenue shortfall tied to rising hyperscaler/AI costs, even after strong Q1 execution. NOW remains 44% below its 52-week high. Palantir has been continuously strongly bearish since April 21 with no recovery, sitting 40% off its high. Both are explicit members of the categories under review and were under-weighted in the original framing relative to AKAM/OKTA/CRWD. MDB and TOST also show fragility — MDB briefly touched strongly bullish on July 16 before slipping back to mildly bullish days later, and TOST only exited its bear band on July 22, six days before this snapshot.

The evidence supports a genuine quality bifurcation among consumption-driven names, but not a uniform category-wide bull exit, and not a fresh 30-day inflection.