An essay about artificial-intelligence safety, written by a man who sells neither firewalls nor endpoint software, repriced every listed cybersecurity vendor in a single session on Monday, September 14. Dario Amodei, chief executive of Anthropic, had published "We Must Pace the Frontier" two days earlier, warning that "in 6-12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage)". By Monday's close Zscaler was up 16.5%, Rubrik 15.6%, CrowdStrike 13.9% and Palo Alto Networks 13.1%; Fortinet and Cloudflare brought up the rear at 9.0% and 7.8%, and the Global X Cybersecurity ETF rose 10.1%.

That one session is almost the entire recent strength of the group. Over the thirty days to September 18 the seven names gained 16.5% on average; strip out September 14 and the average is 3.6%, with three of seven lower — Palo Alto worst, down 8.0%. What was bought that day was not a security budget. It was a rotation: the iShares Expanded Tech-Software ETF rose 5.04% while the VanEck Semiconductor ETF fell 4.75%, the widest one-day gap in a quarter century — the same session that sent Corning and the optical-component suppliers sharply lower.

What Palo Alto's own numbers had said

Two weeks earlier the same shareholders had read Palo Alto's fiscal fourth quarter and marked it down. The company, which sells firewall appliances and software plus attached subscriptions to enterprises and governments, beat on both lines — revenue of $3.41bn against a $3.35bn consensus — and grew 34.4%, the fastest of the eight quarters on file. Gross margin was the problem: GAAP gross margin fell 5.6 points to 67.6% as purchase accounting from the CyberArk identity acquisition landed in cost of revenue, and GAAP operating income fell 66% to $169m. The shares fell 14.1% over the two sessions after the report.

The contracted metrics were the strong part. Next-generation security annual recurring revenue reached $9.1bn, up 63%, with nearly $1bn added in the quarter, and remaining performance obligations crossed $20bn for the first time at $21.2bn; 220 net new platformizations took the bundled base to roughly 2,500. "We are now securing a whole new castle of machine identities with autonomous permissions," chairman and chief executive Nikesh Arora told investors on the September 1 call. But the fiscal 2027 guide inverts the deferred-economics logic that has justified the strategy: revenue growth of 23–24% against next-generation security growth of 22–23% and backlog growth of 19–20%. Backlog is guided to stop outgrowing the recognized line. At $363.58 on September 18, even after the essay handed back 13.1%, the shares remained 4.9% below where they closed before the report.

What CrowdStrike's had said

CrowdStrike is paid per endpoint, per module, per year, and its quarter went the other way. July-quarter revenue of $1.471bn grew 25.8%, a fourth straight acceleration, and net new annual recurring revenue hit a record $333m, up 51%, on ending ARR of $5.84bn. Module attach — the swing factor in that model — stood at 51%, 35% and 26% of subscription customers running six, seven and eight or more modules. Falcon Flex, the multi-module contract vehicle, carried $2.29bn of ARR, up 101%. "This quarter, we are raising our FY27 year over year net new ARR growth outlook by an additional 630 basis points even more than last quarter," chief executive George Kurtz said on the August 26 call. The company is still unprofitable on a GAAP basis, with a $33.2m operating loss, narrowed from $113.0m a year earlier. One housekeeping note for anyone comparing charts: CrowdStrike split four-for-one in late June, and unadjusted histories show a 53% twelve-month loss where the split-adjusted figure is an 89% gain.

Price and the rest of the roster

Both have re-rated hard on the measure that survives acquisition accounting and GAAP losses. Palo Alto trades at 36.7x trailing gross profit against 20.2x in early May; CrowdStrike at 59.6x against 32.1x. The September 14 session made no distinction across a group whose latest revenue growth runs from 10.6% at Okta to 37.9% at Rubrik, and whose price to trailing gross profit runs from 12.3x at Zscaler — the only one of the seven lower over twelve months, at −32% — to 65.1x at Cloudflare, a usage-metered network and developer-platform business that gained the least on the day. Fortinet, which sells the box-plus-subscription model Palo Alto is converting away from, is the only genuinely profitable name, at a 33.7% operating margin. Rubrik, billed on data under management rather than seats, grew subscription ARR 33% to $1.66bn. Okta was the one idiosyncratic mover, up 21.4% over thirty days even excluding September 14, on its own results — though on the AI-agent identity revenue the whole theme rests on, chief financial officer Brett Tighe told investors on August 26 it was "still immaterial. Still very small. We're very early innings."

So the honest split: CrowdStrike's contracted growth is accelerating and earns a re-rating in kind, if not this degree. Palo Alto is growing fast while its margin is absorbed by an acquisition and its own guidance retires the argument that the backlog is running ahead of the revenue line. Neither business earned 13% in a day from an essay, and the Federal Reserve's 25 basis point increase to a 3.75%–4.00% target range on September 16 — its first since 2023 — took some of it back within two sessions.

The number that would settle whether the market is paying for platform economics or for a security badge is the one CrowdStrike did not publish: it said dollar-based net and gross retention both improved sequentially, and disclosed neither rate, nor how the multi-year packages handed to customers after the July 2024 outage are repricing as they come up for renewal.