The setup: a bear-to-bull reversal, not a breakdown

On 2 March 2026, seven of the eight security platform names with local price history — CRWD, NET, OKTA, PANW, S, TENB and ZS — carried strongly bearish trend bands, with FTNT mildly bearish. By 22 July, six of eight (FTNT, NET, OKTA, PANW, S, TENB) sat in strongly bullish, the maximum bullish band. Over the trailing 90 days PANW rose 93.6% ($173.21→$335.28), FTNT 87.3%, OKTA 79.8%, TENB 68.5%, NET 31.2% and S 31.0%.

The fundamentals backed it. Palo Alto reported fiscal Q3 revenue up 31% to $3.0 billion with Next-Generation Security ARR up 60% to $8.1 billion. CrowdStrike posted record net-new ARR of $256 million, up 32%, with a raised full-year net-new ARR outlook. The macro overlay was a UBS forecast of 13% global cybersecurity market growth in 2026 to $240 billion, and sell-side targets were being lifted, not cut — Wells Fargo raised Okta's target 50% to $150 and Fortinet's 71% to $120. The group even became a rotation destination, holding near highs as the AI trade cracked.

The crack: a synchronized six-session drawdown

The cohort topped within a three-day window, 14–17 July. From 14 July closes through 22 July: TENB -23.0%, OKTA -11.6%, CRWD -10.6%, FTNT -7.1%, ZS -6.5%, PANW -5.0% (from its 17 July peak of $358.68) and NET -4.5%. Tenable led, falling about 10% in one afternoon after Truist cut it to Hold, citing balanced risk/reward post-run-up and no clear signs of durable revenue growth — while simultaneously raising its target from $27 to $40. UBS then downgraded Tenable to Neutral on valuation.

That framing matters: both downgrades were price-based, not demand-based. The cohort now carries CRWD at 35.0x price/sales, PANW at 27.6x P/S and 311.9x trailing earnings, FTNT at 15.6x, OKTA at 8.2x P/S on 102.7x earnings. The lone de-rated name, Zscaler, trades at 6.7x P/S — 57.7% below its November 2025 high after it fell 31% on 27 May, its worst day ever, guiding FY2027 growth to 16–17% and citing sales-leadership departures.

Two data caveats

CrowdStrike's local series was never back-adjusted for its 4-for-1 forward split declared 3 June 2026, independently confirmed by the OCC's option adjustment memo. That corrupts CRWD's own trend band, which falsely read mildly bearish on 22 July — split-adjusted, the stock is up ~69% over three months and sits ~2% below its all-time high. Local prices also end 22 July, so the tail of this pullback is not yet visible in desk data.