Cybersecurity stocks at the PANW + CyberArk close: 22 names across 5 layers, 3 portfolios — June 2026 guide for Indian investors

Four events have rewritten the US cybersecurity setup in twelve months:

February 11, 2026 (PANW + CyberArk closed): Palo Alto Networks completed its $25 billion cash-and-stock acquisition of CyberArk — the largest deal in cybersecurity history. Closed earlier than guided (had been "expected in PANW's fiscal Q3"); Q3 FY26 results already included a full quarter of CyberArk contribution. CyberArk + Chronosphere + Koi Security combined Q3 contribution: $388 million.

June 3, 2026 (CRWD post-outage recovery essentially complete): CrowdStrike Q1 FY27 revenue $1.39 billion (+26% YoY) — fourth consecutive quarter of acceleration. Ending ARR $5.51 billion (+24%). Net new ARR $255.8 million (+32% YoY) — fiscal Q1 record. Gross retention 97%. FCF $468 million record. The July 19, 2024 channel-file outage that took down 8.5M Windows endpoints is now a permanent procurement-cycle "buyer-of-record" topic but no longer a revenue overhang.

Cloudflare Q1 2026 (the first FAANG-scale cyber agentic-AI restructure): Cloudflare announced a 20% workforce reduction (~1,100 employees) in Q1 2026 explicitly to transition to an "agentic AI-first operating model." Restructuring charges $140-150 million. The strategic narrative: AI agents will handle most support + sales engineering + internal ops; Cloudflare needs to "lead and ship that internally before externalizing to customers." First FAANG-scale cyber/cloud name to publicly restructure around AI agents.

Zscaler Q3 FY26 (deceleration disclosed): Revenue $850.5 million (+25% YoY). All-time-high non-GAAP operating margin 23%. But the print was overshadowed by preliminary FY27 outlook of 16-17% ARR + revenue growth — significant deceleration from FY26's 25%. Sales-org shakeup layered on. The cleanest "platformization is taking dollars" data point in the cyber universe.

Together these four events have crystallized the central investment question of 2026: the platform consolidators (PANW + CSCO + MSFT) or the platform pure-plays (CRWD + FTNT + ZS + NET + S)? The data is mixed. PANW's $25B CyberArk integration is the biggest single bet on platformization ever made. CRWD's record net new ARR validates that pure-play scale still works when execution holds. Zscaler's deceleration validates that the SSE/SASE category is becoming commoditized as PANW, CSCO, MSFT, NET push competing stacks.

This guide is for the Indian-resident investor who wants real cybersecurity exposure into a sector where ARR (annual recurring revenue) is the leading indicator that revenue lags by 1-3 quarters.

What this guide is and isn't

It is: 22 names organized by what platformization + AI-cyber convergence + Microsoft bundling actually reward, one verdict per name, three model portfolios.

It is not: "buy CrowdStrike at any price." Not pretending the Microsoft bundling threat isn't real. Not assuming platformization is a one-way trade.

A note on data. Every revenue, ARR, NRR, customer count, and acquisition date traces to a primary source — SEC 10-Q/10-K/8-K, earnings call transcripts. ARR figures are end-of-quarter; net new ARR is the leading indicator.

The framework: track ARR, not revenue

Use ARR, lean ARR. Most pure-play cyber names report GAAP revenue and an ARR figure derived from total subscription contracts at quarter-end. ARR leads revenue by 1-3 quarters because it captures bookings as signed; revenue is recognized ratably. Net New ARR is the most important leading indicator. NRR (net revenue retention) above 110% means existing customers expand faster than churn; below 105% is a warning.

The 2026 differentiator is AI-cyber convergence. Three sub-themes:

• AI-powered SOC automation — Charlotte AI (CrowdStrike) delivers 70% reduction in manual investigation, 40+ hr/week analyst capacity, >98% decision accuracy. Purple AI Auto-Investigations (SentinelOne, Q1 FY27). Microsoft Security Copilot inside Defender + Sentinel + Purview.
• LLM injection + agent security as new product category — 50+ documented production incidents (data exfiltration from chatbots, unauthorized agent actions). PANW Prisma AIRS + AI Access; CRWD Charlotte AgentWorks (March 2026); SentinelOne Prompt Security (ARR nearly doubled QoQ in Q1 FY27); Cloudflare AI Defense.
• Agentic-AI use case as a new SOC moat — Charlotte AgentWorks Ecosystem (March 2026) launch partners Accenture, AWS, Anthropic, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, Telefónica Tech.

The Microsoft bundling threat is the dominant structural headwind. Microsoft Security $20+ billion annualized revenue. Defender + Sentinel + Entra + Purview sold standalone and embedded in M365 E5 bundles. Every enterprise with E5 is a Defender/Sentinel/Entra/Purview customer-of-last-resort for free-with-license. Pure-plays must out-execute on capability + speed + breadth or accept being "best-of-breed for the 30% that won't bundle."

Five layers, ranked by 2026 opportunity for Indian retail:

Layer	What it is	2026 read
1. Platform consolidators	PANW, CRWD, FTNT, CSCO, MSFT	PANW + CyberArk closed; CRWD record Q1 FY27
2. Cloud security pure-plays	ZS, NET, S	ZS decelerating; NET restructuring; S cheapest
3. Identity + access	OKTA, SAIL	OKTA 11% growth; SAIL post-IPO
4. Vulnerability + niche	VRNS, TENB, QLYS, RPD, BB	RPD ARR declining is the warning
5. ETFs	CIBR, HACK, BUG, IHAK	CIBR dominant

Verdict format:

Verdict — [Action]: [Reason]. [Caveat].

---

Layer 1 — Platform consolidators

PANW — Palo Alto Networks

Q3 FY26 (reported May 20, 2026): revenue $3.0 billion (+31% YoY), beat $2.94B consensus. Non-GAAP EPS $0.85 (beat $0.79). CyberArk + Chronosphere + Koi Security combined Q3 acquired revenue: $388 million. NGS (next-gen security) ARR guide raised to $8.90-$8.95 billion for FY26 (+59-60% growth). RPO guide raised to $20.9-21.0B (+32-33%). FY26 revenue guide raised to $11.415-11.425B (+24%).

CyberArk deal closed February 11, 2026 — $25B cash-and-stock. CYBR shareholders received $45 cash + 2.2005 PANW shares per CYBR share. Closed earlier than guided. The largest acquisition in cybersecurity history.

Three-platform model: Strata (firewall + SASE), Prisma Cloud (CNAPP + AI Access), Cortex (XSIAM + XDR + XSOAR). CyberArk completes the Strata identity layer.

Forward P/E ~75× FY26e; EV/Sales ~19.5× TTM. FCF margin ~37-38%.

Catalyst: Q4 FY26 report (August 2026); first full-quarter pure CyberArk integration; XSIAM ARR ramp; Prisma AIRS GA pricing.

Risk: Multi-quarter integration risk on $25B deal; CyberArk's $1.44B Q4 2025 ARR (+23%) decelerated post-announcement; valuation leaves no room for stumble.

Verdict — Core buy: The most successful platform consolidator with the cleanest 3-platform pitch. CyberArk integration is the multi-quarter test but Q3 acquired-revenue contribution at $388M validates the close.

CRWD — CrowdStrike Holdings

Q1 FY27 (reported June 3, 2026): total revenue $1.39 billion (+26% YoY) — fourth consecutive quarter of acceleration. Subscription revenue $1.32B (+26% YoY). Ending ARR $5.51 billion (+24% YoY). Net New ARR $255.8 million (+32% YoY) — fiscal Q1 RECORD. GAAP profitability achieved. FCF $468 million record (33.7% margin). CFO $591 million record.

FY27 guidance raised: Revenue $5.915-5.959B; net new ARR growth lifted +520 bps midpoint to 27.7%.

July 19, 2024 outage recovery essentially complete. Gross retention held at 97% throughout. Customer Choice Program (CCP) largely run off — peak quarterly drag was $10-15M; revenue tailwind now reasserting.

Charlotte AI AgentWorks Ecosystem launched March 2026 — partners Accenture, AWS, Anthropic, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, Telefónica Tech. Falcon Next-Gen SIEM delivered record net new ARR in Q3 FY26. Falcon Flex average deal size now >$1M.

Stock action: All-time closing high ~$619 May 24, 2026. After Q1 FY27, stock sold off ~13% AH on "modest guidance" despite the beat — typical for stock priced for perfection.

Forward P/E ~95-110× FY27e (non-GAAP); EV/Sales ~22-25× TTM.

Catalyst: Q2 FY27 print (late Aug 2026); Falcon Flex >$1M ACV deal cadence; Charlotte AgentWorks ecosystem ARR; Next-Gen SIEM displacement of Splunk in PANW/CSCO accounts.

Risk: Valuation priced for perfection; MSFT bundling structural; PANW + CyberArk identity integration could pull dollars from Falcon Identity Protection.

Verdict — Core buy: The recovery thesis is essentially complete. Net New ARR +32% YoY fiscal Q1 record validates execution. Multiple is steep but the moat (Falcon platform + Charlotte AI) is unique. Add on the 13% AH sell-off.

FTNT — Fortinet

Q1 2026 (reported May 6, 2026): revenue $1.85 billion (+20% YoY). Total billings $2.09 billion (+31% YoY) — critical because hardware-channel billings lead revenue. Product revenue $645M (+41% YoY) — higher-performance FortiGate appliances, AI infrastructure refresh. Service revenue $1.21B (+11% YoY); deferred revenue +15%. Non-GAAP operating margin 35.8% (+160 bps YoY) — fiscal Q1 record. Non-GAAP EPS $0.82 (+41% YoY). FCF $1.01 billion record; adjusted FCF $1.07B (+27%) = 58% margin.

FY26 guide raised: Billings $8.8-9.1B (+18% midpoint); revenue $7.71-7.87B (+15% midpoint).

OT security exposure: Fortinet recognized as Challenger in 2026 Gartner Magic Quadrant for CPS Protection Platforms; IEC 62443-4-1 Maturity Level 2 certification; FortiGate-OT dominant industrial firewall. The cleanest OT-cyber pure-play in public-market cybersecurity.

Forward P/E ~37-40× FY26e; EV/Sales ~10× TTM.

Catalyst: FortiGate appliance refresh cycle; unified SASE billings ramp; FY27 budget guide; OT vertical wins.

Risk: Hardware cycle exposure; service billings only at +27% (narrowing moat); SASE/SSE competition; competition with PANW Strata post-CyberArk.

Verdict — Core buy: Best risk-adjusted exposure — 58% FCF margin is the highest in cyber. OT-cyber differentiation is real and underappreciated. Premium multiple supported by record execution.

CSCO — Cisco Systems

Q3 FY26 (reported May 13, 2026): total revenue $15.8 billion (+12% YoY) — company record. Non-GAAP EPS $1.06 (+10% YoY). Non-GAAP gross margin 66% (-260 bps YoY). AI infrastructure orders: $2.1B in Q2 FY26; full-year FY26 AI order outlook raised to >$5 billion. Security (excluding Splunk): double-digit YoY growth. Hypershield + Secure Access + XDR + AI Defense: 1,000+ new customers in Q3 single quarter; cumulative ~5,000 since launch.

Splunk integration (~2 years post March 2024 close at $28B): 500 new logos in H1 FY26, on track for 1,000 by FY26 year-end. Cloud-subscription transition still a near-term revenue drag.

Forward P/E ~17-18× FY26e (non-GAAP); EV/Sales ~5× TTM; FCF margin ~25%+.

Risk: Margin compression from AI mix + memory costs (already showing in Q3); Splunk dilution to gross margin still present; cyber is "important contributor, not engine" — enterprise networking still dominates.

Verdict — Add (for dividend + cyber optionality): Hypershield + Splunk is the platformization play at a value multiple. Cheaper alternative to PANW for similar platformization thesis.

MSFT — Microsoft (cyber lens)

Q3 FY26 (reported April 29, 2026): Microsoft Cloud revenue $54.5 billion = ~$218B ARR. Microsoft Security business $20+ billion annualized. No standalone segment disclosure but Nadella explicitly called out "knowledge work, coding, and security" as the three structural TAM pillars in Q3 FY26 prepared remarks.

Microsoft Security Copilot: GA across Defender + Sentinel + Purview. Agentic AI security strategy announced March 22, 2026 — new Defender + Entra + Purview agents specifically for protecting AI agents from prompt injection, data leakage, identity compromise.

Forward P/E ~32-34× FY27e; EV/Sales ~13× TTM; FCF margin ~30%.

Risk: Cyber is ~5-7% of total revenue; Azure consumption is the dominant valuation driver; bundling strategy could draw US/EU antitrust attention.

Verdict — Core buy (for everything else, get cyber free): Same framing as quantum guide — MSFT is the AI infra trade with cyber as embedded option. Own for Azure, not for Security Copilot specifically.

---

Layer 2 — Cloud security pure-plays

ZS — Zscaler

Q3 FY26 (reported May 26, 2026): revenue $850.5 million (+25% YoY). Ending ARR $3.525 billion (+25% YoY). Net new ARR $166 million. Non-GAAP operating margin 23% — all-time high. FCF $136M (+14% YoY). FY26 ARR guide $3.74-3.75B.

Preliminary FY27 outlook: 16-17% ARR + revenue growth — significant deceleration from FY26's 25%. Sales-org shakeup (new CRO process) layered on. The dominant negative narrative on the print.

Products: ZIA (Internet Access), ZPA (Private Access), ZDX (Digital Experience). Zenith AI strategy.

Forward P/E ~55-60× FY27e (non-GAAP); EV/Sales ~12× TTM. FCF margin Q3 ~16% — markedly lower than CRWD's ~34%.

Catalyst: Q4 FY26 print (September 2026) must beat or match deceleration narrative; new CRO appointment; AI Access GA pricing; FY27 final guide.

Risk: 25% → 16-17% deceleration is the cleanest "platformization is taking dollars" data point in cyber. SSE/SASE becoming commoditized as PANW, CSCO, MSFT, NET push competing stacks. Sales-org changes mid-cycle signal go-to-market stress.

Verdict — Skip: The deceleration is structural, not transient. Better SSE/SASE exposure via PANW Strata or NET Zero Trust at lower multiples for the growth.

NET — Cloudflare

Q1 2026 (reported early May 2026): revenue $639.8 million (+34% YoY). Large customers ($100K+) 4,400+ (+25% YoY) = 72% of revenue. Non-GAAP net income $94M ($0.25/diluted). FCF $84.1M (13% margin). Cash $4.16 billion. FY26 revenue guide $2.805-2.813B (~+30% YoY).

Agentic AI restructuring announced Q1 2026: 20% workforce reduction (~1,100 employees) to accelerate "agentic AI-first operating model." Restructuring charges $140-150 million. First FAANG-scale cyber/cloud name to publicly restructure around AI agents.

Forward P/E ~135-150× FY27e (non-GAAP); EV/Sales ~28× TTM — most expensive pure-play cyber name.

Catalyst: Q2 2026 print (early August); first full quarter post-restructuring; Workers + AI Inference revenue; Magic WAN enterprise wins.

Risk: Valuation is extreme — single weak quarter could compress multiples 30-40%; 1,100-headcount cut is large and execution risk non-trivial; Zero Trust competes vs ZS + PANW + CSCO.

Verdict — Hedge: The agentic-AI thesis is real but the multiple already prices in execution success. Size 1-2% max as AI-restructuring optionality.

S — SentinelOne

Q1 FY27 (reported May 28, 2026): revenue $277 million (+21% YoY). International +25%, 39% of total. ARR growth +23% YoY. Net new ARR $44M (+55% YoY) — driven by new logo + platform expansion. Non-GAAP operating margin 4% (+550 bps YoY). Non-GAAP EPS $0.40 (+83% YoY). $100K+ ARR customers +17% YoY. Emerging products ~50% of total ARR.

Purple AI Auto-Investigations launched Q1 FY27 — "one-click automation and human-level reasoning at scale" (direct CRWD Charlotte AI competitor). Prompt Security (LLM injection): ARR nearly doubled QoQ in Q1 FY27 — one of the cleanest "LLM-injection product line ramp" data points in public cyber.

Forward P/E ~150-180× FY27e (non-GAAP); EV/Sales ~4.5-5.0× — the cheapest pure-play cyber name on EV/Sales.

Risk: SentinelOne lost ground vs CrowdStrike during post-July-2024 outage window when many guides predicted S would gain share; operating margin still ~4% vs CRWD high-20s; profitability gap is what's keeping EV/Sales depressed.

Verdict — Add: Cheapest EV/Sales in cyber with real product momentum (Prompt Security, Purple AI). Margin convergence is the multi-year catalyst.

---

Layer 3 — Identity + access

OKTA — Okta

Q1 FY27 (reported May 29, 2026): revenue $765 million (+11% YoY). Subscription revenue $750M. RPO $4.719B (+16% YoY). Non-GAAP EPS $0.91 (beat $0.85). Gross margin 77.4%. FY27 guide raised: revenue $3.185-3.205B (+9-10% YoY); non-GAAP op margin 25-26%; FCF margin 27-28%.

Forward P/E ~28-30× FY27e (non-GAAP); EV/Sales ~6× TTM — meaningfully discounted vs CRWD/ZS/NET on growth-deceleration. FCF margin ~30%+ — best-in-class FCF margin in pure-play identity.

Risk: 11% YoY revenue growth is the single biggest "platformization is eating identity" data point. Microsoft Entra (free with E5) is the structural headwind; PANW + CyberArk eats privileged-access SKUs; valuation now mid-cap-software not high-growth-cyber.

Verdict — Hold: The Entra bundling threat is real. Cheap multiple compensates but better growth elsewhere.

SAIL — SailPoint

Re-IPO February 13, 2025 at $23/share (~$12B+ valuation) post-Thoma Bravo private period. FY26 full year: revenue $1.071B (+24% YoY); SaaS revenue +35%; ending ARR crossed $1.35B (+~28% YoY); SaaS ARR +38%. Q4 FY26 revenue $342M (+31% YoY). Q1 FY27 guide: ARR $1.155B (+25%); revenue $275M (+19%); adj op margin 11.1%. FY27 full guide: ARR $1.361B (+21%); revenue $1.265B (+18%); adj op margin 18.5%; FCF target $200M.

Identity Governance (IGA) — distinct from OKTA Entra IAM/SSO. 62% YoY increase in customers with ARR >$1M in FY26. Larger competitor Saviynt (private).

EV/Sales ~9-10× FY27e; FCF margin ~16-18% FY27e.

Catalyst: Q1 FY27 print June 9, 2026 — first true post-IPO recurring cadence test. Atlas AI product revenue; large-enterprise win rate; partner channel (Deloitte, Accenture).

Risk: Post-IPO multiple compression if 18% growth materializes vs OKTA at 6× sales for 9-10% growth; Microsoft Entra Permissions Management is a real threat; LBO-debt overhang from Thoma Bravo years.

Verdict — Watch: Q1 FY27 print is the test. IGA is differentiated vs IAM. Wait for the June 9 print before initiating.

---

Layer 4 — Vulnerability + niche

VRNS — Varonis

Q1 2026: revenue $173.1M (+27% YoY). SaaS ARR $683.2M (+69% YoY); ex-conversions +29% YoY to $522.6M (cleaner growth number). Non-GAAP op loss $1.4M. FCF $49M. FY26 guide raised: SaaS ARR $814-845M (+20-21% ex-conversions); revenue $731-737M.

DSPM (Data Security Posture Management) — unstructured data + M365 + Salesforce + Azure permissions. MDDR services add-on.

EV/Sales ~7-8× FY26e; FCF margin ~28% TTM.

Verdict — Add: DSPM is a real category with structural moat. SaaS conversion completing normalizes ARR growth toward ~30%.

TENB — Tenable

Q1 2026: revenue $262.1M (+9.6% YoY). Non-GAAP op margin 23.6% (+320 bps YoY). Non-GAAP EPS $0.47 (+30.6%). Unlevered FCF $88.6M. FY26 guide raised: revenue $1.068-1.078B; non-GAAP EPS $1.90-1.98; unlevered FCF $285-295M.

Tenable One unified Exposure Management platform — combines Nessus + CNAPP + Identity + Web App.

Forward P/E ~21-22× FY26e; EV/Sales ~4× TTM — one of the cheapest pure-play cyber names. FCF margin ~27-28% FY26e.

Risk: 9.6% growth is single-digit; Wiz (Google acquisition March 2025 for $32B) is the structural CNAPP competitor with infinite distribution.

Verdict — Hold: Cheap multiple + real FCF margin but growth deceleration is the bear case. Wiz inside Google Cloud is the structural threat.

QLYS, RPD, BB

Qualys (QLYS) — vulnerability mgmt + EDR. Steady single-digit growth.

Rapid7 (RPD) — ARR actually declining YoY ($832M vs $837M PY) — the cleanest "platformization is killing best-of-breed" data point.

BlackBerry (BB) — IoT + cyber pivot continues; structurally challenged.

Verdict (all three) — Avoid: RPD ARR decline is the warning shot; QLYS slow; BB structurally challenged.

---

Layer 5 — Cybersecurity ETFs

ETF	Strategy	Top holdings	AUM
CIBR (First Trust NASDAQ Cybersecurity)	Largest cyber ETF	PANW, CRWD, FTNT, CSCO, ZS, OKTA, NET	$7B+
HACK (ETFMG Prime Cyber Security)	Diversified cyber	Similar to CIBR	$2B+
BUG (Global X Cybersecurity)	Pure-play tilt	CRWD heavy	$700M+
IHAK (iShares Cybersecurity & Tech)	Broader theme	Mix cyber + adjacent	$700M+

Verdict — Add (CIBR): The most diversified active-management exposure. Use as anchor for any cyber sleeve.

---

What not to chase

• CYBR direct — acquired by PANW Feb 11, 2026; no longer trades standalone
• RPD — ARR declining is structural warning
• BB — IoT + cyber pivot has struggled for years
• PFPT, MIME (Proofpoint, Mimecast) — went private 2024
• APP / DDOG for cyber thesis — observability adjacency; not pure cyber

---

Three model portfolios

Defensive: platform giants + ETF

Bucket	Weight	Names
Platform consolidators	50%	PANW 18%, CRWD 15%, FTNT 12%, CSCO 5%
Mega-cap (for everything else)	20%	MSFT 20%
Identity defensive	10%	OKTA 10%
ETF	15%	CIBR 15%
Cash	5%	—

Balanced: platforms + cloud security + identity

Bucket	Weight	Names
Platform consolidators	40%	PANW 15%, CRWD 15%, FTNT 10%
Cloud security	20%	S 10%, NET 6%, ZS 4%
Identity	12%	OKTA 7%, SAIL 5%
Mega-cap	10%	MSFT 10%
Niche	8%	VRNS 5%, TENB 3%
ETF	5%	CIBR 5%
Cash	5%	—

Aggressive: high-growth pure-plays + AI-cyber

Bucket	Weight	Names
AI-native moats	35%	CRWD 18%, S 12%, NET 5%
Platform consolidator anchor	25%	PANW 15%, FTNT 10%
Identity	15%	SAIL 8%, OKTA 7%
Niche AI-cyber	10%	VRNS 7%, TENB 3%
Cisco for value	5%	CSCO 5%
ETF	5%	CIBR 5%
Cash	5%	—

---

The risk scenarios

Microsoft bundling. Defender + Sentinel + Entra inside E5 is the structural compressor for OKTA, ZS Internet Access (vs Defender for Cloud), and the SIEM market.

Platformization compression. ZS 25% → 16-17% deceleration is the cleanest example. Any pure-play deceleration trades down 20-30% same-day.

Multiple compression. PANW 75× FY26e; CRWD 95-110× FY27e; NET 135-150× FY27e. Any narrative shift triggers fast unwinds.

Major breach. CRWD July 2024 outage took the stock down ~30% in one week. CRWD recovered; others might not.

CIO budget cycle. Q4 2026 budget season is the test for FY27 platforms.

AI displacement of SOC analysts. Both bull case (Charlotte AI 70% productivity gain) and bear case (legacy cyber pricing pressure as labor costs compress).

---

How an Indian-resident investor actually executes this

Platform map. All US-listed cyber names (NASDAQ + NYSE) broadly available on Vested / INDmoney / IBKR / Rovia.

Tax on gains. Foreign equity LTCG 12.5% under Section 112 with 24-month holding period.

Schedule FA. Calendar-year disclosure for any held during January-December. See Schedule FA guide.

Dividend WHT. Most cyber pure-plays do not pay dividends. MSFT + CSCO + FTNT (occasional) pay modest dividends — US 25% under DTAA.

---

The closing

The honest read on June 2026:

• The PANW + CyberArk $25B close (Feb 11, 2026) is the cleanest single illustration of platformization. Q3 FY26 acquired-revenue $388M validates execution.
• CRWD post-outage recovery is essentially complete — Q1 FY27 record net new ARR $255.8M (+32%) and FCF $468M record.
• Cloudflare 1,100-job cut for agentic-AI restructure is the first FAANG-scale cyber play on AI-agent ops. Real bet, real execution risk.
• ZS 25% → 16-17% deceleration is the cleanest "platformization is taking dollars" data point. Pure-play SSE/SASE is structurally pressured.
• OKTA 11% growth + Rapid7 ARR declining = identity + vulnerability mgmt pure-plays both face Microsoft bundling.
• MSFT Security $20B+ floor is the structural compressor for everyone else.

Own PANW + CRWD + FTNT for the platform thesis. Add SentinelOne for cheapest EV/Sales pure-play. Hedge with Cloudflare for agentic-AI optionality. Use CIBR ETF for diversified anchor. Watch SailPoint's June 9 print for first post-IPO test.

The press releases will continue to dominate the headlines.

The Net New ARR figures are what actually clear into multi-year contracted revenue.