On 14 July, International Business Machines — the mainframe, software and consulting group — pre-announced a quarter that badly missed. Chief executive Arvind Krishna told investors clients "were distracted with rapidly-evolving, industry-wide cybersecurity concerns in the quarter," and named Anthropic's frontier model Mythos as the reason customers would "pause on new deals until they know" how much to spend defending themselves. Preliminary revenue of $17.2bn missed the $17.9bn consensus and IBM fell 25.2%. Investors read it as budget moving out of one line and into another: CrowdStrike rose 12.1% that session, Okta 10.8%, Zscaler 7.2%, Palo Alto Networks 6.8%.

That was the largest single day of the month for this group of seven, and it was genuinely about security. The rest was not. Four sessions — 14 July, and 3, 4 and 7 August — delivered 18.6 percentage points of equal-weighted daily return against a month that finished around 9.0% equal-weighted and 10.6% weighted by market value. Every other session was net negative. The 4 August leg was simply the market: the Nasdaq Composite rose 2.59% and the S&P 500 1.79%, with Palantir up 29% on earnings. Over the same thirty days Atlassian gained 74%, Paycom 55% and Workday 30%, and security vendors outside this group — SailPoint, SentinelOne, Qualys — all rose more than 19%. Cybersecurity followed the software tape; it did not lead it.

A stock split that hid a doubling

Any screen run on unadjusted prices reports CrowdStrike, the endpoint-security vendor whose Falcon platform monitors laptops and cloud workloads, as down 49.6% over twelve months. It is not. The board approved a four-for-one split on 3 June, effective 2 July. Corrected, CrowdStrike is up 101.8%, and the group's equal-weight twelve-month return is roughly 56%, not the 37.8% an uncorrected table produces.

The businesses: four confirm, one contradicts

Fortinet, which builds FortiGate firewall appliances and a single in-house security operating system spanning branch networking, endpoint and security operations, had the best quarter of the seven: revenue up 25.6% to $2.048bn, billings up 33% and product revenue up 52%, with GAAP operating margin at a record 33.7% against 28.0% a year earlier and free cash flow more than tripling to $966m. It gained 1.9% on the month and its price-to-sales multiple moved from 15.46x to 15.56x. It is the only member whose advance is earnings rather than re-rating.

Cloudflare, which runs a global edge network selling content delivery, denial-of-service protection and increasingly serverless developer compute, reported revenue up 36% to $696.1m, a fourth straight acceleration, with dollar-based net retention up six points year over year to 120% and gross margin rising sequentially for the first time in eight quarters. But management's 6 August narrative was the Workers developer platform — two million developers added in one quarter versus 1.5 million in all of 2025 — and agent traffic now exceeding half the network. That is edge compute, not security.

Palo Alto, the largest name here at $296.5bn and a seller of firewalls plus cloud and security-operations subscriptions, grew 31.1% last quarter against 14.9% the quarter before. The step-change is largely bought: of $8.1bn in next-generation security annual recurring revenue, $1.6bn came from acquisitions, principally CyberArk. Gross margin fell to 67.6% from 72.9% and the company posted a GAAP operating loss.

CrowdStrike accelerated for a fourth quarter to 25.6% on record net-new annual recurring revenue of $255.8m, up 32%, as concession packages from its 2024 outage rolled off. Rubrik, the data-backup and ransomware-recovery vendor and the group's only recent listing, grows fastest at 39% — but that is down from 51.2% four quarters ago. Okta, which sells corporate single sign-on and multi-factor authentication, contradicts outright: 11.2% growth, stuck in an 11-13% band for five quarters, with consensus modelling 10.0% next year and 9.5% after that.

Business verdict: CONFIRMS at Fortinet, CrowdStrike and Cloudflare, INCONCLUSIVE at Palo Alto and Rubrik, CONTRADICTS at Okta.

What the prices have already taken

Every one of the seven trades at a higher price-to-sales multiple than nine sessions ago, with no intervening earnings at five of them: Rubrik from 10.32x to 13.01x, CrowdStrike 36.34x to 42.86x, Palo Alto 24.51x to 27.96x. Palo Alto's has gone from 14.8x in May to 28.0x. Six sit at or near the top of their twelve-month ranges — Cloudflare at 99% of its range, Palo Alto 99%, Okta 93%, Fortinet 91%, Rubrik 85%, CrowdStrike at a split-adjusted high. Okta's forward price-to-earnings of 38.6x is roughly four times its expected growth rate.

The exception is Zscaler, at 8.6x trailing and 7.0x forward sales on 25.4% growth, sitting at 23% of its own range. That discount is not an oversight: the shares fell 31% in a session in May after management cut fiscal 2027 growth guidance to 16-17% from a Street near 20% and disclosed sales-leadership turnover.

Valuation verdict: CONTRADICTS for six of seven. Fortinet, at 14.5x forward sales, 46.6x forward earnings and a 2.7% free-cash-flow yield, is the one whose multiple has not run ahead of its numbers.

One technical note, because it cuts against the framing: Zscaler led the month at 17.5% while sitting in a downtrend, its 50-day average below its 200-day since June, and CrowdStrike's own trend deteriorated through July even as it rose. Cloudflare's unbroken uptrend since 5 May is matched day-for-day by Fortinet's.

Finally, coherence. Of $33.3bn in combined trailing revenue, 79% comes from four core security vendors. An equal-weighted average of the seven gives 43% of its weight to Cloudflare, Okta and Rubrik — an edge network, an identity seat business and a backup vendor.

The setup

Where it stands — Four sessions and two names carried the month; only Fortinet's advance is backed by fresh, accelerating results. Would confirm — Palo Alto's mid-August quarter showing organic next-generation ARR growth above 30% excluding CyberArk. Would invalidate — CrowdStrike's 2 September net-new ARR falling below $255.8m, breaking the four-quarter acceleration. Watch next — Okta reports 26 August, Rubrik 27 August, CrowdStrike 2 September. Valuation — Group spans Zscaler at 7.0x forward sales to CrowdStrike at 36.7x; Palo Alto's trailing multiple has doubled since May.