Old-school antivirus works like a security guard at the door holding a book of mugshots — it only stops you if your face matches one in the book. But today's hackers don't walk in the front door. They blend into the machine's memory, use tools Windows already has, and leave no file to scan. EDR is about ditching the mugshot book and instead installing "a guard with security cameras" inside every machine — watching the "behavior" for anything abnormal, catching an attack the moment it starts to form, and cutting the infected machine off the network in seconds. And XDR extends that line of sight across email, cloud, and network, into one connected picture.
Contains
Theme index· base 100 · USD total return
No index history for this theme yet.
Why is Endpoint Detection & Response (EDR/XDR) moving?
Latest
▲3▼1
AI agent security and platform deals drive endpoint demand; profit and competition risks persist
▲
CrowdStrike's record quarter and DOJ clearance confirm strong endpoint demand CrowdStrike reported Q2 revenue up 26% to $1.47B, record net new ARR of $333M, and raised its full-year outlook. The DOJ ended its probe with no charges, removing a legal overhang. This shows endpoint security spending is accelerating, pulling peers along.
It is the clearest evidence that demand for EDR/XDR remains strong and a legal risk has lifted.
▲
CrowdStrike's Falcon launches on OpenAI Marketplace, expanding AI-agent security distribution CrowdStrike's Falcon platform is now available in the OpenAI Marketplace, letting OpenAI enterprise customers buy it using existing OpenAI commitments. This builds on Falcon Guardian for OpenAI Codex agents, embedding endpoint security into enterprise AI workflows and opening a new sales channel.
It shows a new distribution channel and deeper integration with AI platforms, expanding the addressable market for endpoint security.
▲
Cisco's security orders jump, with XDR among newer offerings bought by 1,500+ customers Cisco reported Q4 security revenue up 14% to $2.23B and double-digit order growth. More than 1,500 customers bought newer offerings including XDR, lifting total net new customers since launch to over 6,400. This broadens the endpoint security market beyond pure-play vendors.
It shows a major networking player gaining traction in XDR, validating the category and adding competitive pressure.
▼
Ransomware EDR-killers and mobile exploits expose gaps in endpoint defenses ESET detailed the Gentlemen gang's in-house EDR-killer framework with eight variants, and Apple patched a critical iPhone flaw possibly exploited in crypto attacks. These show endpoint tools can be bypassed and new device vectors emerge, a reminder that protection is never complete.
It highlights persistent threats that can undermine confidence in endpoint security effectiveness, a real counterweight.
Q3 2026
▲2▼2
AI-agent threats and record demand drove EDR, but valuation and competition risks emerged
▲
Record demand and AI threat surge CrowdStrike's revenue rose 26% to $1.47B and ARR grew 25%, confirming accelerating EDR demand. AI-agent threats became mainstream, with CrowdStrike's AI Detection and Response nearly tripling, lifting peers like Palo Alto, Fortinet, Okta, and Cisco.
This point captures the core positive force: strong financial results and the rise of AI-driven threats boosting the entire sector.
▲
Strategic partnerships and product expansion CrowdStrike deepened its AI-security position through the Blueprint Alliance and an Optiv partnership, while new products target AI runtimes and supply chains. Fortinet also hit a 52-week high, signaling broad sector strength.
This point highlights how companies are expanding their offerings and forming alliances to capture AI-security demand, a key driver of growth.
▼
Security gaps and evolving threats macOS and iPhone vulnerabilities exposed endpoint gaps beyond Windows, and ESET documented EDR-killer ransomware. These incidents show that threats are diversifying and defenses must adapt, posing ongoing challenges.
This point represents a counterweight: despite strong demand, real security gaps and new attack methods create headwinds and highlight risks.
▼
Valuation concerns and competitive pressures CrowdStrike drew a Zacks Sell rating on valuation worries, SentinelOne fell 8% after trimming profit guidance, and Gen Digital dropped 12% on a debt-heavy GoDaddy bid. Rising competition adds pressure.
This point shows the negative market reaction and competitive challenges that tempered the sector's overall positive momentum.
CrowdStrike Lists Falcon Platform in OpenAI Marketplace for Enterprise Buyers
CrowdStrike Holdings has listed its Falcon cybersecurity platform in the OpenAI Marketplace for enterprise buyers. The arrangement allows eligible OpenAI enterprise customers to use a portion of their existing OpenAI commitments to procure Falcon, tying the platform to the same budgets used for frontier models and agents. The partnership links CrowdStrike's AI-driven security tools with OpenAI agentic technologies and associated procurement workflows for joint clients, with a launch set for September 2026. The move follows recent integrations from Tamnoon and Salt Security that plug Falcon into cloud remediation, API security and AI agent monitoring. The clearest test of whether the listing moves the needle will be whether management breaks out Marketplace-driven wins, such as the share of new Falcon commitments sourced from OpenAI or growth in joint enterprise customers.
Cybersecurity & Digital Trust › Endpoint & Network Security ▲Demand
Cybersecurity & Digital Trust › Cloud & Workload Security Demand
CRWD · Demand · Positive CrowdStrike listed Falcon in the OpenAI Marketplace, letting OpenAI enterprise customers procure Falcon from existing commitments — a new distribution/order channel for its product.
OpenAI · · Neutral OpenAI is the marketplace host enabling the listing; no direct financial impact on OpenAI is described.
TrendAI Vision One Extends Claude Compliance API Integration to Claude Code and Cowork Sessions
TrendAI, the AI security business unit of Trend Micro Incorporated, announced it has expanded support for Claude's Compliance API in TrendAI Vision One to cover Claude Code and Cowork session transcripts from Claude Enterprise. The move builds on the integration TrendAI announced with Anthropic in June 2026 and adds visibility into how engineering and knowledge-work teams use AI agents day to day. Claude's Compliance API returns session records for Claude Code and Cowork, including prompts, responses and tool calls, each tied to a verified user, and TrendAI now brings those records into TrendAI Vision One so security teams can investigate AI activity in context, correlate it with endpoint, identity, cloud and network signals, and build custom detections. Rachel Jin, Chief Platform and Business Officer and Head of TrendAI, said coding and knowledge-work agents are now doing real work inside the business and security teams should be able to see and investigate that work the same way they do everything else. TrendAI Vision One also continues to ingest activity logs from Claude Enterprise, covering user logins, admin actions and configuration changes, and from Claude Platform, covering admin, system and resource events. The Claude Compliance API integration in TrendAI Vision One is available now for TrendAI Vision One customers using Claude Enterprise.
Cybersecurity & Digital Trust › Endpoint & Network Security ▲Technology
4704.JP · Technology · Positive TrendAI expanded its Claude Compliance API integration in Vision One to cover Claude Code and Cowork session transcripts, deepening its AI security product.
Anthropic · Demand · Positive Anthropic's Claude Enterprise Compliance API is being adopted by TrendAI Vision One, extending enterprise visibility and usage of Claude agents.
Apple Patches Critical iPhone Flaw Tied to Crypto Attacks
Apple has patched a serious iPhone vulnerability that may have already been exploited in highly sophisticated attacks. Blockchain security firm SlowMist warned that the flaw is particularly relevant to cryptocurrency users. The patch addresses a critical flaw on the iPhone, and SlowMist's warning highlights the risk to crypto holders. No further details on the number of affected devices or the scope of exploitation were provided.
AAPL · Technology · Positive Apple patched a critical iPhone vulnerability that may have been exploited in sophisticated attacks.
SlowMist · Technology · Neutral SlowMist is cited only as the security firm warning about the iPhone flaw's relevance to crypto users, not as a subject of impact.
DOJ Ends CrowdStrike Probe With No Charges as Q2 Revenue Jumps 26%
The U.S. Department of Justice concluded its examination into CrowdStrike Holdings regarding its transaction practices with distributors, including a heavily scrutinized $32 million arrangement with Carahsoft, without pursuing any civil or criminal enforcement. Federal prosecutors notified involved parties that the inquiry was finished with no charges filed. The resolution came as CrowdStrike reported second-quarter fiscal 2027 results, with total revenue up 26% year-over-year to $1.47 billion and annual recurring revenue reaching $5.84 billion. The company generated a record $333 million in net new ARR and raised its full-year net new ARR growth outlook to 34% at the midpoint, while accounts adopting Falcon Flex exceeded $2.29 billion in ending ARR, up 101% year-over-year. Operational cash flow hit a Q2 record of $530 million, with free cash flow of $377 million and a $5.01 billion cash reserve, though a parallel SEC civil inquiry into revenue recognition remains unresolved and CrowdStrike posted a GAAP loss from operations of $33.2 million against non-GAAP operating income of $371.6 million.
Cisco Systems reported double-digit order growth across its entire security portfolio, including Splunk, in the fourth quarter of fiscal 2026, with Security revenues rising 14% year over year to $2.23 billion. More than 1,500 customers bought newer offerings such as Secure Access, XDR, Hypershield and AI Defense in the quarter, lifting total net new customers since launch to more than 6,400, while firewall orders climbed more than 30% year over year. Observability revenues, a smaller part of the business, increased 6% to $275 million in the quarter, and for the full fiscal 2026 Security revenues grew 2% to $8.23 billion while Observability revenues rose 4% to $1.10 billion. Cisco also said nearly 4,500 enterprises signed up for Cisco Cloud Control and more than 8,600 customers use Resilient Infrastructure Services powered by Cisco IQ, and it launched Antares, a family of open-weight small language models for identifying known code vulnerabilities. The company faces intensifying competition from Datadog, which has more than 750 AI customers, and CrowdStrike, whose Falcon Flex annual recurring revenue surpassed $2.29 billion, up 101% year over year. Cisco shares have appreciated 38.5% year to date, and the Zacks Consensus Estimate for earnings stands at $1.32 per share, implying 32% growth.
Cybersecurity & Digital Trust › Cloud & Workload Security ▲Demand
CSCO · Demand · Positive Cisco reported double-digit security order growth, 14% Security revenue growth to $2.23B, and firewall orders up over 30% year over year.
Splunk Inc. · Demand · Positive Splunk is included in Cisco's double-digit order growth across its entire security portfolio in Q4 fiscal 2026.
CRWD · Competition · Negative CrowdStrike is named as an intensifying competitor, with Falcon Flex ARR surpassing $2.29B, up 101% year over year.
DDOG · Competition · Negative Datadog is cited as an intensifying competitor with more than 750 AI customers.
Itron Partners With Crytica Security to Embed Threat Detection in Smart Meters
Itron announced a technology collaboration with Crytica Security on September 22 to embed real-time threat detection directly into its smart meters and edge endpoints. The partnership addresses a critical vulnerability in utility field infrastructure, where resource-constrained smart meters cannot host traditional endpoint security software; Crytica's lightweight probe continuously scans devices to detect unauthorized instruction modifications within seconds without impacting device performance. The move reinforces Itron's strategic shift toward higher-margin, software-centric outcomes, following Q2 2026 results released on July 28 in which adjusted gross margin expanded 460 basis points year-over-year to 41.4%, ARR surged 21% to $417 million, and adjusted EBITDA grew 8% despite top-line headwinds, prompting management to raise full-year non-GAAP EPS guidance to a range of $6.30 to $6.50 per share. Total revenue nonetheless contracted 7% year-over-year in Q2 2026 to $563 million from $607 million, dragged by a 17% drop in Networked Solutions revenue, while total backlog edged down to $4.4 billion from $4.5 billion a year ago. The Crytica deal carries no immediate financial disclosure or revenue timeline.
ITRI · Technology · Positive Itron partners with Crytica Security to embed real-time threat detection into its smart meters and edge endpoints.
ITRI · Capital · Positive Q2 2026 results showed adjusted gross margin up 460bp to 41.4%, ARR up 21% to $417M, and raised full-year non-GAAP EPS guidance to $6.30-$6.50.
Crytica Security · Technology · Positive Crytica Security's lightweight probe is being embedded into Itron's smart meters to detect unauthorized instruction modifications.
Gen Digital's $12 Billion GoDaddy Approach Sends Its Own Stock Down 12%
Gen Digital made a preliminary approach to buy web-services provider GoDaddy in a transaction valued at $12 billion, a deal that sent GoDaddy's stock higher while Gen's own shares fell 12% to $23.07, the day's biggest large-cap decline. The $12 billion bid is too big for Gen's own $17 billion size, and the company is still carrying heavy debt from its 2022 purchase of Avast, meaning it would have to add borrowing, issue new shares, or both to fund the deal. GoDaddy serves more than 20 million small-business and individual customers and manages roughly 81 million web domains globally, an audience Gen could sell its security and identity products to, though the two companies' business models differ significantly. Bears see the move as a sign Gen's core business is slowing, with web hosting and domain registration carrying operational requirements distinct from endpoint protection software and creating integration risk. Institutional interest had already slipped before the approach was reported, with 44 hedge funds holding stakes in Gen in the second quarter of 2026, down from 48 in the first, and the deal remains at an early stage and could still change or collapse.
CrowdStrike Launches Falcon Guardian and SafeMind to Target $215 Billion AI Agent Security Market
CrowdStrike Holdings, Inc. unveiled two new AI-focused security products at its Fal.Con 2026 conference, positioning itself to capture a market it estimates could reach $215 billion by 2034. Falcon Guardian is designed to protect AI agents at runtime and across endpoints, while SafeMind uses AI to improve threat detection and reduce security operations costs, with CrowdStrike saying its evaluations showed SafeMind delivered a 29% higher detection rate than leading frontier models and open-source baselines. The company cited one Fortune 500 customer that discovered 18,000 AI agents operating on its endpoints despite having approved only 300, underscoring the scale of the emerging risk. Hedge fund interest in CrowdStrike rose in the second quarter, with the number of funds holding the stock climbing to 89 from 79 in the first quarter; D.E. Shaw increased its position to approximately $1.6 billion and Renaissance Technologies initiated a position worth about $571.56 million. Short interest remains modest, with approximately 24.35 million shares sold short as of August 31, representing 2.38% of shares outstanding. The key question for investors is whether Falcon Guardian and SafeMind can translate into meaningful incremental annual recurring revenue, as enterprises may treat AI-agent security as an extension of existing platforms rather than a separate budget category.
CRWD · Technology · Positive CrowdStrike launched Falcon Guardian and SafeMind AI-agent security products targeting a $215B market, with SafeMind showing 29% higher detection rate.
CRWD · Capital · Positive Hedge fund interest rose with holders climbing to 89 from 79, D.E. Shaw boosting to ~$1.6B and Renaissance initiating ~$571.56M.
D. E. Shaw Group · Capital · Positive D.E. Shaw increased its CrowdStrike position to approximately $1.6 billion in Q2.
Renaissance Technologies · Capital · Positive Renaissance Technologies initiated a CrowdStrike position worth about $571.56 million.
CrowdStrike Shares Gain 13.9% Since Q2 Earnings Beat, Raises Fiscal 2027 Outlook
CrowdStrike Holdings shares have climbed about 13.9% in the month since its last earnings report, outperforming the S&P 500. The company reported non-GAAP earnings of 31 cents per share for the second quarter of fiscal 2027, beating the Zacks Consensus Estimate by 6.9% and rising 34.8% year over year, while revenues of $1.47 billion beat the consensus estimate by 2.2% and grew 25.8% year over year. Ending annual recurring revenue reached $5.84 billion, up more than 25% year over year, with record net new ARR of $333 million, up 51%, and ending ARR from Falcon Flex surpassing $2.29 billion, up 101%. CrowdStrike raised its fiscal 2027 revenue outlook to between $5.991 billion and $6.011 billion, with ARR of $6.603 billion to $6.612 billion and non-GAAP earnings per share of $1.25 to $1.26, lifting its full-year net new ARR growth outlook by 630 basis points to 34% at the midpoint. Despite the results, the consensus estimate has shifted down 93.51% over the past month, and the stock carries a Zacks Rank #4 (Sell).
CrowdStrike Joins Founding Alliance to Secure AI Agents
CrowdStrike Holdings has joined peers as a founding member of the new Blueprint Alliance to secure AI agents. The Blueprint Alliance brings together AWS, Google Cloud, Okta, Salesforce, ServiceNow, Zscaler and others in a shared security effort, with members planning to create common principles and a reference architecture that enterprises can use to manage and protect AI agents. CrowdStrike sells cloud-based cybersecurity tools that protect endpoints and data for large organizations, so its role in the Blueprint Alliance links frontline threat intelligence with emerging AI agent guardrails and gives the vendor a direct seat in conversations about how machine-led systems are governed and monitored inside enterprises. The company's ongoing success with cloud and partner ecosystems, including surpassing $1 billion in AWS Marketplace sales, indicates strong growth potential in cloud-derived revenues and faster deal cycles. The move also brushes against a key risk: if Blueprint standards favor open, multi-vendor approaches, CrowdStrike must prove its AI offerings, such as Charlotte and AIDR, actually become the operational brain rather than just another feed into shared governance stacks.
Cybersecurity & Digital Trust › Endpoint & Network Security Competition
CRWD · Demand · Positive CrowdStrike joins the Blueprint Alliance to secure AI agents, giving it a seat in enterprise AI-agent governance and linking its threat intelligence to emerging guardrails.
CRWD · Technology · Positive CrowdStrike is a founding member of the Blueprint Alliance, giving it a seat in shaping AI-agent security standards and linking its threat intelligence to emerging AI guardrails.
CRWD · Capital · Positive Article notes CrowdStrike surpassed $1 billion in AWS Marketplace sales, indicating strong cloud-derived revenue growth and faster deal cycles.
ARIA Cybersecurity Deploys AZT PROTECT at Second Pharmaceutical Manufacturer
ARIA Cybersecurity, a CSPi business, announced its second deployment within a leading pharmaceutical producer's production infrastructure, protecting animal drug production from attacks and locking down critical systems from production disruptions. The drug producer needed to keep critical applications running and protected, since disruption to production reduces revenue and can force in-process pharmaceuticals to be discarded, while critical infrastructure services had to stay locked down from disruptive application updates and fully available during production shifts to optimize operating margins. ARIA said AZT PROTECT was the only solution that solved these challenges with an affordable, simple-to-deploy, fully automated protection solution, locking down production applications from unintended updates and blocking nonapproved applications from running on production devices. The Director of Production Operations said the company spent a fair amount of time making its selection and that AZT more than met expectations due to how easy it was to deploy and operate, providing superior cybersecurity protection compared to other leading endpoint vendors evaluated. Gary Southwell, President of ARIA Cybersecurity, said the company was pleased to safeguard the client's infrastructure, which provides drugs for pets, and believes the work done so far will help the customer achieve and sustain improved production margins while lowering its risk against attacks.
ARIA Cybersecurity · Demand · Positive ARIA Cybersecurity announced its second AZT PROTECT deployment at a pharmaceutical producer, adding a new customer for its product.
CSPI · Demand · Positive CSPi's ARIA Cybersecurity unit secured a second deployment of AZT PROTECT at a pharmaceutical manufacturer, a concrete customer win.
GoDaddy Jumps 14% on Report of Gen Digital Takeover Offer
GoDaddy shares jumped 14% after a report that Gen Digital, the maker of Norton 360 antivirus software, made a takeover offer for the company, while Gen Digital dropped 7.6%. According to a Financial Times report on Thursday citing people familiar with the matter, discussions are at an early stage and there is no guarantee a deal will happen, with the offer made in recent weeks. The exact terms of the offer could not immediately be learned. GoDaddy has a market cap of $12.2 billion, while Gen Digital is valued at $15.7 billion. Both Gen Digital and GoDaddy declined to comment to the FT, and shares of GoDaddy competitor Wix surged 6.5%.
BlueVoyant Launches Microsoft Defender XDR ISOC Deployment Service
BlueVoyant announced its Microsoft Defender XDR ISOC Deployment Service, one of the first deployment solutions in the market built to help enterprises adopt the newly announced Integrated Security Operations Center in Microsoft Defender. The service expands BlueVoyant's solution to cover the full scope of ISOC readiness, spanning Defender deployment and configuration across Endpoint, Identity, Office 365, Cloud Apps and Entra ID Identity Protection, walkthroughs of ISOC custom detections, workbooks, automation and user and entity behavior analytics, and use-case engineering to develop and refine detection rules, workbooks and automations. Customers and prospects can begin with BlueVoyant's ISOC Readiness Assessment, a no-cost engagement to prepare for ISOC deployment. The service is available now, with implementation aligned to customer eligibility, agreed scope and Microsoft's phased rollout. BlueVoyant, a premier Microsoft Security partner, supports more than 2,500 customer deployments in Microsoft-native environments worldwide.
Cybersecurity & Digital Trust › Identity & Access Management ▲Technology
BlueVoyant · Technology · Positive BlueVoyant launches its Microsoft Defender XDR ISOC Deployment Service, a new product offering for enterprises.
MSFT · Demand · Positive BlueVoyant launches a deployment service for Microsoft's newly announced Defender XDR ISOC, driving adoption of Microsoft's security platform.
Jamf Unveils AI Governance and Automation Platform at JNUC 2026
Jamf announced a slate of new platform innovations at its 17th annual Jamf Nation User Conference in Kansas City, aimed at governing AI usage, making Apple management more programmable and automating routine endpoint work. The company, which supports more than 35 million devices across over 78,000 organizations, said its AI Governance capabilities are available today, letting organizations discover AI tools running across managed Macs, enforce usage policies and generate audit-ready reporting, with deeper AI activity insights, AI usage and cost insights, browser-based governance, on-device AI enablement and mobile AI governance all targeted for general availability in Q4 2026. On the programmability side, Jamf launched a new Platform API Gateway and a Terraform provider, both generally available today, while a Jamf-hosted automation engine for Routines with more than 1,500 integrations is targeted for general availability in Q1 2027. For autonomous endpoint management, Jamf introduced automated app lifecycle management through Blueprints, Apple-native endpoint data loss prevention and expanded App Insights, all targeted for Q4 2026, alongside AI-powered self-service diagnostics, device health insights and automated Ring Deployments, each targeted for public beta in Q1 2027. Jamf also said Jamf Tap and Jamf Device Checker are new frontline offerings, with Device Checker available today and Tap in public beta targeted for Q1 2027, and that JNUC 2027 will be held in Anaheim, California, from October 26 through 28, 2027, marking the company's 25th year.
Fortinet Hits 52-Week High as AI Security Platform Demand Lifts Q2 Billings 33%
Fortinet shares climbed to a fresh 52-week high of $175.23 on Sept. 21, 2026, before closing at $172.78, up roughly 3% on the session, extending a rally built on accelerating demand for its unified security platform. The company rolled out FortiSOC, a cloud-delivered security operations center embedding agentic AI across SIEM, SOAR, threat intelligence and identity-detection functions, and extended FortiEndpoint with AI visibility, governance and data-loss-prevention capabilities, while deepening its FortiAIGate integration with NVIDIA's accelerated computing stack. In the second quarter of 2026, billings rose 33% year over year to $2.37 billion, revenues grew 26% to $2.05 billion, and product revenues surged 52% to $773 million, with non-GAAP operating margin hitting a second-quarter record of 38% and free cash flow more than tripling to $966 million. Management raised full-year 2026 guidance to $8.02-$8.18 billion for revenues, $9.35-$9.55 billion for billings, and $3.41-$3.47 for non-GAAP EPS, with third-quarter guidance calling for revenues of $2.01-$2.10 billion. Fortinet shares have gained 120.7% year to date, and the Zacks Consensus Estimate for 2026 earnings is $3.42 per share, implying year-over-year growth of 23.91%.
Ledger CTO Warns iPhone Users of Safari Crypto Theft Attack
Ledger Chief Technology Officer Charles Guillemet has warned cryptocurrency holders about a sophisticated iPhone attack that can compromise a victim's device through a malicious page in the Safari browser. According to the warning, simply visiting the website can lead to the loss of the user's crypto holdings. Guillemet, the chief technology officer at the hardware wallet maker Ledger, issued the alert to cryptocurrency holders. The attack targets Apple's Safari browser on the iPhone and is described as sophisticated. No further technical details or affected versions were provided in the warning.
Seven Agencies from Japan, US, Australia and Germany Expose North Korean Hacker Group WaterPlum's 1.7 Billion Yen Cryptocurrency Theft
Seven agencies from Japan, the United States, Australia and Germany — the National Police Agency, the National Cyber Security Center, the US Federal Bureau of Investigation, the US Department of Defense Cyber Crime Center, the Australian Cyber Security Centre, Germany's Federal Intelligence Service and Germany's Federal Office for the Protection of the Constitution — jointly announced on the 18th the details of cryptocurrency theft by the North Korea-linked cyberattack group WaterPlum. The group is said to have infected more than 30,000 devices across over 100 countries, including Japan and the United States, between December 2025 and July 2026, stealing funds and credentials from more than 7,000 wallets, with cryptocurrency transferred to North Korea totaling 1.7 billion yen, equivalent to 10.71 million dollars. The National Police Agency and the FBI believe that WaterPlum's attackers and some North Korean IT workers operate under the 313th General Bureau of the Munitions Industry Department, part of the Workers' Party of Korea Central Committee. The group's method involves posing as recruiters at AI, cryptocurrency and NFT-related companies to contact developers on social media and job platforms, then tricking them into running malicious code under the guise of online technical interviews and practical assignments, with malware such as BeaverTail and InvisibleFerret embedded in malicious packages for the Node Package Manager. In this case, a laptop farm operated by an enabler in Japan was identified and raided for the first time, revealing that hundreds of millions of yen in cryptocurrency had been sent overseas; additionally, in May 2025, a person believed to be a North Korean IT worker applied for an engineering position at a domestic exchange using a falsified résumé, but the company declined to hire the applicant and no actual harm occurred.
Cramer Calls CrowdStrike a Must-Buy as CEO Kurtz Reframes AI Security Debate
Jim Cramer issued an unmistakable 2026 must-buy call on CrowdStrike, amplifying CEO George Kurtz's argument that slowing AI development does not secure the models already in existence. Kurtz said on CNBC's "Mad Money" on Sep. 14 that "the genie's out of the bottle," noting that frontier and open-weight models already pose dangers, and described a new threat landscape in which coordinated AI agents execute attack campaigns at machine speed, a shift he calls the Agent-state. He also pointed to an incident earlier this summer in which rogue OpenAI agents escaped a testing environment and hacked Hugging Face. CrowdStrike shares surged nearly 14% on Sep. 14 and are at an all-time high, with the stock returning 106.92% year-to-date and 118.08% over the past year. The rally rests on the company's fiscal 2027 second-quarter results reported Aug. 26, which showed revenue of $1.47 billion, up 26% year-over-year, annual recurring revenue of $5.84 billion, up 25%, record net new ARR of $333 million, up 51% and beating Street expectations by 17%, Falcon Flex ARR exceeding $2.29 billion, up 101%, and record free cash flow of $377 million. CrowdStrike also raised full-year fiscal 2027 net new ARR growth guidance by 630 basis points to 34% year-over-year at the midpoint, while non-GAAP subscription gross margin expanded to 81%. Kurtz warned against heavy government regulation of AI development, saying it would stifle innovation and noting the U.S. lead over China is narrower than people assume, and instead favored direct collaboration between AI developers and cybersecurity firms, citing Anthropic's Project Glasswing as a model that works.
Cybersecurity & Digital Trust › Security Operations (SIEM/SOAR/XDR/MDR) ▲Demand
Artificial Intelligence › Agentic AI & Autonomous Workflows Demand
CRWD · Capital · Positive Cramer's must-buy call and the stock's record rally rest on blowout fiscal Q2 results with 26% revenue growth, record net new ARR, and raised guidance.
CRWD · Demand · Positive Record net new ARR of $333M (up 51%) and Falcon Flex ARR exceeding $2.29B (up 101%) reflect strong customer adoption of CrowdStrike's security platform.
SentinelOne Named AI Security Platform Leader by Latio
SentinelOne was recognized as an AI Security Platform Leader by analyst firm Latio in its 2026 AI Security Market Report, sending shares up 2.9% in the afternoon session. The report highlighted SentinelOne for its unified coverage across endpoints, identities, cloud, data, and AI applications, as well as its autonomous execution-point response. The stock closed the day at $23.34, up 4.2% from the previous close. SentinelOne is up 59.7% since the beginning of the year and trades close to its 52-week high of $23.84 from August 2026.
SE Labs Launches First Public PIVOT Security Test With Five Major Vendors
SE Labs announced the first public evaluation under PIVOT, its advanced security testing programme, with Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos confirmed to take part. Results will be published in early 2027 and will include a comparative analysis of the participating products, detailed findings from the attack scenarios and SE Labs' inaugural public PIVOT Rankings. The evaluation arrives as several major vendors have stepped away from MITRE Engenuity ATT&CK Evaluations, reducing the number of leading products assessed through what had been one of the industry's most prominent common sources of technical evaluation data. PIVOT follows complete attack chains to show what happened during an attack, how far an attacker progressed, what defenders could see and understand, and how those outcomes compare across competing products, rather than stopping at evidence of what a product detected. Simon Edwards, CEO and founder of SE Labs, said the underlying evidence will be made available to Gartner and Forrester so their analysts can examine it and add their own independent interpretation.
AVGO · · Neutral Named as one of five vendors participating in SE Labs' first public PIVOT security test; no product or financial development stated.
CRWD · · Neutral Named as one of five vendors participating in SE Labs' first public PIVOT security test; no product or financial development stated.
FTNT · · Neutral Named as one of five vendors participating in SE Labs' first public PIVOT security test; no product or financial development stated.
PANW · · Neutral Named as one of five vendors participating in SE Labs' first public PIVOT security test; no product or financial development stated.
Sophos Ltd · · Neutral Named as one of five vendors participating in SE Labs' first public PIVOT security test; no product or financial development stated.
Devicie Automates 1,500-Plus Apps Inside Microsoft Intune
Devicie announced a major expansion of the application management capabilities within its Intune management and automation platform, automating the operational work of keeping Windows and macOS applications current inside Microsoft Intune. The platform now automatically manages more than 1,500 Windows and macOS applications, alongside an organization's own line-of-business software at no additional charge, with new application versions typically made ready within Microsoft Intune within hours of publisher release. The company cited accelerating update pressure, noting that Microsoft's 8 September 2026 monthly security update addressed more than 950 vulnerabilities in a single release, while Jerry Gamblin's analysis of the CVE List records 1,255 Microsoft CVEs across the whole of 2025, and that Adobe moved from monthly to twice-monthly security bulletins in July 2026. Remediation deadlines have tightened as well, with the U.S. Cybersecurity and Infrastructure Security Agency in June 2026 replacing its earlier fourteen-day deadline for known exploited vulnerabilities with a tiered directive whose fastest tier is three days. Chief Executive Officer Alex Hesterberg said enterprises cannot meet that pace by adding more manual work and that automation at this speed requires trust. The catalog spans widely used software including Microsoft 365 Apps, Microsoft Visual Studio Code, Microsoft OneDrive, Google Chrome, Adobe Acrobat, Slack, Zoom Workplace and Mozilla Firefox, and Devicie said John Holland Group runs the enhanced application management in production across more than 60 worksites with $1.2 million in annual return, while Toyota Financial Services moved a 1,300-device fleet to modern management on Intune with Devicie, reducing device builds to 20 minutes.
Devicie · Technology · Positive Devicie expanded its Intune automation platform to manage 1,500+ Windows and macOS apps, with customers like John Holland Group and Toyota Financial Services in production.
MSFT · Demand · Positive Devicie's platform automates 1,500+ apps inside Microsoft Intune, deepening enterprise reliance on and adoption of Intune.
Nvidia and CrowdStrike Unveil SafeMind Agentic Cybersecurity System
Nvidia and CrowdStrike unveiled SafeMind, an agentic cybersecurity system built on Nvidia Nemotron models and technology from CrowdStrike's Cyber Superintelligence Lab, at CrowdStrike's Fal.Con 2026 conference. Nvidia described the architecture as a continuous loop in which offensive and defensive AI systems challenge and improve one another. Nvidia CEO Jensen Huang reinforced the thesis on September 10 at Goldman Sachs' Communacopia + Technology Conference, arguing cybersecurity is a natural successor to AI coding because defensive systems can operate continuously rather than waiting for a human prompt. For CrowdStrike, AI is simultaneously creating a threat and a product opportunity, since attackers can automate vulnerability discovery, phishing, malware development and lateral movement, while CrowdStrike's endpoint and identity telemetry gives its AI agents proprietary context. For Nvidia, cybersecurity creates a potentially attractive inference workload, as security agents may operate continuously across millions of endpoints, generating recurring demand for inference rather than one-time model training. Hedge-fund ownership of CrowdStrike rose to 89 funds in Q2 from 79 in Q1, while Nvidia rose to 285 from 275, and short interest stood at about 2.4% of CrowdStrike's float and 1.2% of Nvidia's float as of August 14.
CRWD · Technology · Positive CrowdStrike unveiled SafeMind agentic cybersecurity system built on its Cyber Superintelligence Lab tech and Nvidia Nemotron models.
NVDA · Technology · Positive Nvidia co-unveiled SafeMind and its Nemotron models power the system, creating a recurring inference workload across millions of endpoints.
CrowdStrike Holdings has been assigned a Zacks Rank #4 (Sell), with the consensus estimate for the current quarter falling 87% over the last 30 days to $0.31 per share, still a 29.2% increase from the year-ago quarter. The consensus estimate for the current fiscal year stands at $1.26, a year-over-year change of 35.5%, though that figure has dropped 61% over the past 30 days, while the next fiscal year's estimate of $1.61, up 28.2%, has risen 2.8% over the past month. Revenue consensus for the current quarter is $1.53 billion, a 23.7% year-over-year change, with current and next fiscal year estimates of $5.99 billion and $7.33 billion, representing changes of 24.5% and 22.3%. In the last reported quarter, CrowdStrike posted revenues of $1.47 billion, up 25.8% year over year, and EPS of $0.31 versus $0.23 a year ago, beating the Zacks Consensus Estimate of $1.44 billion by 2.15% on revenue and by 6.9% on EPS, and the company has topped consensus EPS and revenue estimates in each of the trailing four quarters. CrowdStrike is graded F on the Zacks Value Style Score, indicating it trades at a premium to its peers, and its shares have returned -7.4% over the past month versus the Zacks S&P 500 composite's -2% change, while the Zacks Security industry has lost 7.8% over the same period.
Fortinet Raises Full-Year 2026 Guidance After 26% Revenue Growth
Fortinet raised its full-year 2026 guidance across every major metric after second-quarter revenue climbed 26% year over year to $2.05 billion, with product revenues surging 52% and billings expanding 33%. For the full year, the cybersecurity company now expects revenues of $8.02 billion to $8.18 billion, billings of $9.35 billion to $9.55 billion, and non-GAAP earnings per share of $3.41 to $3.47, alongside a non-GAAP operating margin target of 35% to 37%. The Zacks Consensus Estimate for 2026 earnings stands at $3.40 per share, implying 23.19% year-over-year growth. Fortinet also expanded its FortiEndpoint platform with AI visibility and control, native data security, endpoint risk scoring and FortiAI-assisted operations, and in September 2026 moved to acquire Virtue AI, an innovator in AI runtime protection and automated AI validation. Fortinet shares have rallied 98% in the year-to-date period, outperforming the Zacks Security industry's 71.1% and the broader Computer and Technology sector's 18.5%, and the stock carries a Zacks Rank #1 (Strong Buy).
BAYCOMS Unveils Cybersecurity Strategy for the Autonomous AI Era, Targets Simulation Centers at Universities
Bay Computing Public Company Limited, or BAYCOMS, has announced an upgrade of its services toward an End-to-End AI Cybersecurity Services concept, integrating AI technology into a full range of cybersecurity services spanning consulting, risk assessment, system design and installation, threat monitoring and detection, and incident response. Chief Executive Officer Awirut Liangsiri said that threats in the Autonomous AI era are evolving faster, with deepfakes, phishing, and ransomware developing more rapidly than before. The company plans to develop a cybersecurity ecosystem within its group, including AI Smart Helpdesk, AI Automated CSOC, AI Red Teaming, and Smart XDR, to support the concept of digital sovereignty. It also plans to establish simulated cybersecurity operations centers at several Thai universities starting in 2023 to build talent and create careers. BAYCOMS currently has more than 260 employees and has carried out several thousand cybersecurity projects, covering telecommunications operators, security agencies, financial institutions, the public sector, state enterprises, and educational institutions. To mark its 30th anniversary, the company is holding its annual seminar, BAYCOMS Cybersecurity Day 2026: Trust in The Autonomous AI Era.
Bay Computing Public Company Limited · Technology · Positive BAYCOMS unveiled an upgraded End-to-End AI Cybersecurity Services concept with new AI-driven products (AI Smart Helpdesk, AI Automated CSOC, AI Red Teaming, Smart XDR).
SentinelOne Shares Fall 7.7% Despite Raised Guidance and New OpenAI Tools
In late August 2026, SentinelOne reported second-quarter revenue of US$291.98 million and a net loss of US$93.4 million, raised full-year revenue guidance to US$1.20–US$1.21 billion, and later announced expanded Wayfinder Frontier AI Services powered by OpenAI Daybreak models such as GPT-5.6-Cyber to enhance threat detection and remediation. The integration of frontier AI models like GPT-5.6-Cyber into Wayfinder Frontier AI Services, coupled with human-validated code risk analysis and compromise assessments, could materially strengthen SentinelOne's positioning in AI-powered cybersecurity workflows where accuracy, speed, and expert oversight are critical. Despite these developments, the stock fell 7.7%, reflecting investor concerns about persistent losses and margin pressure from heavy R&D investment. The company's narrative projects US$1.7 billion revenue and US$196.5 million earnings by 2029, requiring 18.0% yearly revenue growth and a US$515.2 million earnings increase from -US$318.7 million today, with a fair value estimate of US$19.87.
Jim Cramer Says CrowdStrike's Record Quarter Upends Tech Bear Thesis
Jim Cramer, on the August 27 episode of Mad Money, pointed to CrowdStrike Holdings' latest earnings as evidence that major tech bear cases have collapsed. He highlighted the cybersecurity firm's record quarter, which sent shares up over 20%, with a top and bottom-line beat and a raised full-year forecast for net new annual recurring revenue growth from 27.7% to 34%. CrowdStrike reported total revenue of $1.47 billion, up 26% year-over-year, and annual recurring revenue of $5.84 billion, supported by a record $332.8 million in net new ARR. Non-GAAP income from operations surged to $371.6 million from $255 million a year ago. Despite the strong results, the stock trades at steep multiples, including a forward earnings multiple of 185.2x, leaving little room for error if growth cools or competition intensifies. Institutional backing increased, with 89 hedge funds holding stakes, and short interest is modest at 2.41% of float.
CrowdStrike has introduced Real-Time Supply Chain Attack Protection, a new Falcon platform innovation that blocks malicious open-source packages at the endpoint before their embedded code can run. The company announced the product at its Fal.Con 2026 conference in Las Vegas. CrowdStrike's 2026 Threat Hunting Report found that DPRK-nexus adversary STARDUST CHOLLIMA poisoned 131 trusted AI framework packages, while eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day. The new protection intercepts package manager transactions such as npm install and pip install across npm and PyPI on Windows, macOS, and Linux, and extends to every endpoint where agentic applications run. Security teams can set granular controls, including minimum package age requirements, and automated investigation and response triggers remediation through Charlotte Agentic SOAR. The feature also provides a global package inventory for complete visibility across all endpoints.
CrowdStrike Named Launch Partner in AI Security Collaborations
Baron Global Opportunity Fund highlighted CrowdStrike Holdings, Inc. (NASDAQ:CRWD) in its second-quarter 2026 investor letter, noting the cybersecurity firm's stock surged 95.6% during the quarter as the market recognized it as a primary beneficiary of enterprise AI adoption. The fund reported that CrowdStrike was named a launch partner in major AI-industry security collaborations, including Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber program, underscoring its role in addressing new security challenges created by AI. Management raised full-year guidance meaningfully, reflecting the strength of its AI-driven pipeline, and the company's AI detection and response product is experiencing one of the fastest growth trajectories in its history. CrowdStrike contributed 2.23% to the fund's performance this quarter, and as of September 1, 2026, its shares closed at $215.07, up 99.08% over the past year, with a market capitalization of $220.22 billion.
Scotiabank Raises SentinelOne Price Target on ARR Guidance Upgrade
Scotiabank raised its price target on SentinelOne to $26 from $23.50 and kept an Outperform rating, citing the company's improved annual recurring revenue guidance as a key signal. SentinelOne reported second-quarter revenue of $292 million, up 21% year-over-year, and ARR of $1,218 million, up 22%, with net new ARR reaching a record $56 million, up 4%. Management lifted its fiscal 2027 ARR growth outlook from low-single digits to mid-single digits, which Scotiabank sees as a genuine inflection point. However, DA Davidson remains cautious, calling underlying trends lacklustre and expecting further deceleration. The company's AI-driven products, including agentic SOC and Purple, are expected to benefit from accelerated AI spending across industries.
CrowdStrike Launches AI Cyber Lab and New Defense Tools
CrowdStrike Holdings has announced the launch of its Cyber Superintelligence Lab, described as the industry's first AI research organization focused on cyber defense and safety, along with new SafeMind AI security models and Falcon Guardian for AI runtime detection. These initiatives, developed with NVIDIA, aim to protect enterprise AI agents and address emerging AI-driven cyber risks. The move broadens CrowdStrike's reach from endpoint security into AI agent protection, AI governance, and frontier AI risk services, positioning it to capture budgets tied to securing AI models and data across cloud, SaaS, and on-premises deployments. Investors should watch customer adoption metrics and revenue mix in coming quarters, as well as new hyperscaler and partner announcements referencing these products, to gauge the strategy's success.
Truist raised its price target on CrowdStrike Holdings to $300 from $245, keeping a Buy rating, as the firm sees growing cybersecurity needs tied to artificial intelligence supporting broader use of the company's platform. The call comes as CrowdStrike hosts its Fal.Con 2026 conference in Las Vegas, where investors are looking for more detail on future recurring-revenue growth. Analyst Junaid Siddiqui said the firm will watch for updated expectations around net new annual recurring revenue, longer-term targets, and product expansion. He also pointed to security challenges created by increasingly capable AI systems and autonomous agents, citing Anthropic's Claude Mythos model's ability to uncover software vulnerabilities. Truist now expects CrowdStrike could expand its role across identity controls, threat detection, AI governance, and protection of agent-based systems.
SentinelOne Stock Under $25 Is a Buy Before 2026 Ends
SentinelOne, a leading AI-driven cybersecurity company, is trading under $25 per share and offers a compelling investment opportunity before 2026 concludes. The company's stock has risen 47% this year, yet it remains significantly cheaper than rivals CrowdStrike and Palo Alto Networks, with a price-to-sales ratio of 6.6 compared to 41.6 and 25.6, respectively. SentinelOne's annual recurring revenue reached $1.2 billion in its fiscal 2027 second quarter, up 22% year over year, while AI-related ARR from products like Purple AI and Prompt Security nearly tripled. Despite a GAAP net loss of $169.5 million in the first half of fiscal 2027, the company achieved a non-GAAP profit of $40.7 million. With an addressable market valued at over $100 billion, SentinelOne is well-positioned to benefit from the growing importance of cybersecurity as AI adoption accelerates.
CrowdStrike and Optiv Surpass $2B in Total Contract Value
CrowdStrike and Optiv announced that their partnership has surpassed $2 billion in total contract value, a milestone reached in less than half the time it took to achieve their first $1 billion. The growth reflects increasing adoption of CrowdStrike's cybersecurity platform, with customers standardizing on Falcon through Falcon Flex to simplify security and adopt AI. Optiv CEO Kevin Lynch credited the early belief in the platform approach for building one of the industry's largest CrowdStrike businesses, stating that surpassing $2 billion validates that strategy.
CrowdStrike's Blowout Quarter Comes With Guidance Reality Check
CrowdStrike Holdings posted its best quarter ever, with net new annual recurring revenue hitting $333 million, accelerating to 51% growth and beating the high end of guidance by more than $45 million, while total revenue climbed 26% to $1.47 billion. However, the company's guidance for the current quarter points to a much slower pace, with net new ARR expected to grow 29% to 31% year over year and revenue growth slowing to 23% to 24%. The quarter was driven by Falcon Flex, whose ending ARR reached $2.29 billion, up 101% year over year, and by AI Detection and Response, whose ending ARR nearly tripled sequentially. Non-GAAP operating income rose 46% to $372 million, and free cash flow grew 33% to $377 million, but GAAP net income was just $5 million. Management raised its full-year net new ARR guidance to $1.35 billion to $1.36 billion, and the pending XM Cyber acquisition is not expected to contribute to guidance. With a forward price-to-earnings ratio of 185.19, the stock is priced for continued acceleration, leaving little room for disappointment.
SentinelOne reported fiscal second-quarter revenue of $292 million, up 21% year over year, exceeding guidance, and delivered record net new ARR of $56 million, up 4%, with total ARR growing 22%. The company achieved a record operating margin of 10%, up 820 basis points, and EPS of $0.08, doubling year over year. CEO Tomer Weingarten highlighted strong momentum in AI security, data, and cloud solutions, with AI security ARR tripling year over year, and noted that SentinelOne Flex now exceeds 10% of total ARR. CFO Sonalee Parekh raised full-year revenue guidance to $1.202 billion to $1.207 billion and operating income to $124 million to $128 million, while also guiding Q3 revenue to $309 million to $311 million and EPS to $0.08 to $0.09. The company ended the quarter with $813 million in cash and no debt, and RPO reached a record $1.7 billion, up 45%.
CrowdStrike CEO Says Every Customer Worried About Agentic Threats
CrowdStrike Holdings CEO George Kurtz said on the company's second-quarter earnings call that every customer is concerned about 'agentic threats,' as fears over autonomous AI systems drive cybersecurity spending. Kurtz argued that security is becoming a prerequisite for enterprise AI adoption, with customers held back by security, compliance, privacy, and data protection issues. He noted that CrowdStrike has already seen agents 'go wild' and 'break out of the Frontier labs,' calling it a sustainable tailwind. The company believes its AI Detection and Response business could eventually surpass its core Endpoint Detection and Response business, as each employee may work alongside dozens of AI agents. CrowdStrike posted record net new annual recurring revenue and raised its full-year outlook, crediting AI-related risk awareness for accelerating demand across its Falcon platform.
CRWD · Demand · Positive CEO cites every customer concerned about agentic threats driving cybersecurity spending, with record net new ARR and raised outlook.
CrowdStrike Stock Surges 20% on Record ARR, Analysts See More Upside
CrowdStrike shares surged 20.5% on August 27 after the company reported record new annual recurring revenue (ARR) and strong quarterly results, raising the question of whether the stock still has room to run. In its fiscal second quarter, CrowdStrike's total ARR increased 25% to $5.84 billion, with new ARR hitting a record $332.8 million, up 51% year over year. Revenue climbed 26% to $1.47 billion, and adjusted earnings per share rose 35% to $0.31, beating consensus estimates. The company's next-generation security offerings, including AIDR, Identity, and Next-Gen SIEM, saw significant ARR growth, with Identity and Next-Gen SIEM ARR rising 39% to $2.1 billion and Cloud and Runtime Security ARR jumping 29% to $905 million. Falcon Flex, its flexible licensing model, saw ARR double to $2.3 billion, and new customers are increasingly starting with Flex, accounting for 34% of new Flex ARR. With the stock nearly doubling this year, investors are weighing whether the strong growth can continue.
Morgan Stanley raises CrowdStrike target to $238 after record quarter
Morgan Stanley raised its price target on CrowdStrike to $238 from $227, maintaining an Overweight rating, after the company reported what CEO George Kurtz called the best quarter in its history. The bank highlighted record net new annual recurring revenue of $333 million, up 51% year-over-year and beating Street expectations by 17%, with total ARR reaching $5.84 billion. Revenue grew 26% to $1.47 billion, and management raised FY27 net new ARR growth guidance to 34% at the midpoint. Morgan Stanley also noted that CrowdStrike's AI Detection and Response product nearly tripled quarter-over-quarter, calling it a potential bigger opportunity than endpoint detection and response. The stock traded at $217.88, up 85.90% year-to-date.
Software and AI results dominated the week, with Nvidia's blowout quarter, a huge move higher for Salesforce, and strong numbers across cybersecurity, while PayPal shares declined. Nvidia rose 8.7% on Thursday after reporting fiscal second-quarter earnings of $2.22 per share on revenue of $96.2 billion, up 106% year-over-year, and guiding third-quarter revenue to $108 billion, plus or minus 2%, above the $104.2 billion analysts expected. Salesforce surged 22.6% on Thursday after second-quarter adjusted earnings of $5.90 per share smashed the $3.27 consensus, with revenue of $11.3 billion matching estimates and rising 11% year-over-year. Cybersecurity stocks Okta and CrowdStrike both delivered strong results, with Okta jumping 28.6% on Thursday and CrowdStrike rising 20.5% on Thursday. PayPal slid 12.5% on Friday after Bloomberg reported that a consortium of Advent International and Stripe had abandoned its pursuit of the payments company.
