The First Trust NASDAQ Cybersecurity ETF traded up 3% to $96.20 on Thursday against 0.3% for the S&P 500 ETF at $768.17, and the fund’s year-to-date gain now sits at 31%. Twin fiscal second-quarter beats from CrowdStrike and Okta the previous evening did the work, and the read-across carried everything with a security ticker attached to it: Zscaler up 10% to $187.83, SentinelOne up 10% to $22.62, Fortinet up 8% to $169.49, Palo Alto Networks up 5% on its approach to the record near $398.
That 31% index figure is an average of two trades that have almost nothing to do with each other. Through Wednesday’s close, Fortinet was up 98% on the year. Zscaler was down 24%. One hundred and twenty-two percentage points of dispersion inside a single sector and a single ETF is not what a sector boom looks like. It is what a sector looks like when the market has already decided which business models survive consolidation and which get bundled away, and has spent eight months expressing that opinion with a great deal of conviction.
What Thursday did was compress the spread, and it compressed it in exactly the direction positioning rather than fundamentals would predict. The most negative name on the year moved the most. The largest gainer moved the least. Neither Zscaler nor Fortinet reported anything. The information that arrived concerned two other companies’ order books, and it moved five stocks by roughly the inverse of their year-to-date rank. Convergence trades run on sentiment repair, and sentiment repair travels fastest to whatever was most damaged.
The more interesting asymmetry is between the two companies that did report. Okta rose 22% to $163.98. CrowdStrike rose 13%. CrowdStrike delivered total revenue of $1.47 billion, up 26%, annual recurring revenue of $5.84 billion, up 25%, and record net new ARR of $332.8 million, an acceleration of 51% year over year. Non-GAAP operating income was $371.6 million against $255.0 million a year earlier, and the company swung to GAAP net income. Management raised the full-year net new ARR growth outlook by 630 basis points to 34% at the midpoint, from the 27.7% it set only one quarter earlier, which makes roughly 1,150 basis points of cumulative raises in six months. Okta grew subscription revenue 12%. Remaining performance obligations rose 17% to $4.858 billion and current RPO rose 14%, net retention was 107%, operating margin more than doubled to 13.3% from 5.6%, and billings fell 5.4% to $681.2 million.
The market paid nearly twice the move to the company growing at less than half the rate with a bookings metric going backwards. That is not a demand signal. It is a multiple decision, and the multiple being decided is the one attached to a story rather than to a growth rate. Okta was priced for permanent stagnation and got repriced as the identity layer for AI agents. CrowdStrike was already priced for acceleration and delivered acceleration. The magnitude of the re-rating is legible in Okta’s own buyback: during the quarter it just reported, the company repurchased 1,542,442 shares at an average cost of $81.06. Two months later the stock trades at roughly twice that.
Which raises the question of what is actually being bought. Thursday’s move was co-driven by Nvidia’s roughly $96.2 billion quarter and its spending outlook, and that co-movement matters more than it appears. Cybersecurity’s traditional claim on a premium multiple was defensive: the budget line is non-discretionary because attackers do not observe the business cycle, so security holds up through software de-ratings that flatten everything else. What the tape showed on Thursday is the sector being bid as an AI infrastructure derivative. CrowdStrike’s own framing is that securing AI adoption is the largest market opportunity in its history, its AI detection and response ARR grew more than 250% sequentially in the prior quarter, Falcon Flex ARR doubled, and it sits as a launch partner inside both Anthropic’s Project Glasswing and OpenAI’s Trusted Access for Cyber. Okta’s entire 22% is an agentic identity narrative. If the marginal buyer is buying AI attach, the sector’s correlation has moved from the breach cycle to the capex cycle. It will de-rate when hyperscaler capex de-rates, and the threat environment will not rescue it, because the threat environment was never what was being priced.
The durable advantages sit in different places than the price action suggests. CrowdStrike’s is arithmetic: module adoption rates of 51%, 35% and 26% for six or more, seven or more, and eight or more modules. Eight modules is not a purchase, it is an operating dependency, and Falcon Flex converts that dependency into committed dollars ahead of consumption. Palo Alto’s platform story is real but its reported growth is substantially bought. Fourth-quarter next-generation security ARR was guided to $8.90 billion to $8.95 billion, up 59% to 60%; organic ARR excluding CyberArk and Chronosphere was $6.5 billion, up 28%, on organic net-new NGS ARR of $370 million. Roughly half the headline growth rate is a purchase order, and at about 91 times forward earnings and 59 times forward EV/EBITDA the market is underwriting the 40% fiscal 2028 free cash flow margin target rather than the acquisitions themselves. Okta’s moat is neutrality: it is the last large identity vendor not owned by a platform that also sells the assets being governed, which is why it can plausibly be the agent control plane, and why Palo Alto had to buy CyberArk rather than build one. That is a genuine structural asset. It is also currently producing 12% growth.
Zscaler and SentinelOne are the same trade viewed from the other end. Both are point vendors in a market whose organizing thesis is consolidation, both are consequently cheap relative to the platform names, and both therefore rally hardest when a sector bid arrives and surrender it fastest when one leaves. Thursday’s 10% moves were not re-ratings of either business. They were beta to somebody else’s quarter.
Palo Alto reports fiscal fourth quarter on September 1, and the bottom line is effectively pre-agreed: guidance of $0.96 to $0.98 against consensus near $0.98, on revenue around $3.35 billion, with options implying a move of roughly 8.6%. The number that decides the cohort is the first fiscal 2027 revenue guide, and somewhere near 22% growth is the threshold that holds the recent wave of target increases in place. Land below it, and what re-rates is not Palo Alto’s quarter but every multiple in the group, because they have all been marked to the same story since Wednesday evening. The figure worth isolating in that release is organic net-new NGS ARR, stripped of CyberArk and Chronosphere. It is the only number in the sector this week that measures demand rather than purchased revenue or somebody else’s read-across.