deadrisk

Analysis

Cyber Cash Needs a Filing Check

Three note offerings changed cyber balance sheets after the last quarter. They do not appear in our retrieved company graphs.

STENBNETCVLT
Coverage intelligence, not investment advice — methodology.
Cyber Cash Needs a Filing Check
The card this piece shares as. Coverage data from TEXXR; fundamentals from SEC filings.

The cash changed after the quarter

The cyber spending case begins with demand: more exposed software, more automated activity and more work to secure. The shareholder case also needs a financing check. A company’s most recent quarterly cash balance can predate a large borrowing, a repurchase or an option payment. Each changes what the common shares represent, even if the revenue outlook stays the same.

Three examples now sit inside our cyber coverage. SentinelOne’s October documents report about $1.408 billion of net note proceeds, a $151.4 million capped-call purchase and roughly $150 million of concurrent repurchases. The pricing terms specify a $1.25 billion base offering and a $187.5 million option. That is a different capital position from July’s balance sheet.

Tenable’s September filing describes $800 million of new 0.25% notes, repayment of the old term loan and cash spent on capped calls and concurrent repurchases. Cloudflare’s August filing reports $2.5 billion of new zero-coupon notes, roughly $2.462 billion of net proceeds and a $259.5 million capped-call purchase. Neither transaction is current operating revenue.

Cheap borrowing can improve flexibility. Refinancing can reduce cash interest. Repurchases can reduce shares. Those benefits have different sources from a customer buying more security software. Reading them separately keeps a financing improvement from becoming an invented product-growth claim.

What the record did not contain

On October 23, our canonical entity queries returned 37 SentinelOne relationships, 11 Tenable relationships and 435 Cloudflare relationships. A same-day CoreWeave query returned 291, including one without a first-seen date. None reached the 500-row query limit. The three cyber records contained 20, five and 83 financial-tagged edges, respectively. Reviewing those rows found none describing the three note offerings above.

This is a limit of those retrieved company records, not proof that no financial publication reported the deals. The records include earnings, forecasts, share-price reactions and older transactions. A financial tag is not a complete list of financing claims. The source that establishes the new debt is the filed document.

The contrast is visible in Cloudflare’s response to the PHP flaws. Its deployed web protections appear in the news record, including the indexed announcement. That is useful evidence of product delivery. It cannot establish the later balance-sheet effect of a different event. A coverage graph and a filing answer different questions; one cannot supply a missing answer from the other.

Three amounts that should stay separate

First, distinguish gross proceeds from net cash. New notes increase cash and a creditor’s claim at the same time. Fees and cash spent on protection or repurchases reduce the amount retained. For Cloudflare’s August issue, $2.5 billion of principal compares with $2.4623 billion of net proceeds, before $259.5 million spent on capped calls. The difference matters even with a zero ordinary coupon. The financing filing provides each amount.

Second, distinguish protection from liquid cash. Capped calls buy rights designed to offset some conversion dilution or cash settlement above principal. Their effect depends on contract terms and future prices. They are not cash available to pay staff, and their economic value is not necessarily zero. Their accounting classification also should not be guessed from the word “option.”

Third, keep debt and conversion shares consistent. A basic-share comparison can retain note principal as debt. A separate conversion case can remove the converted principal and add the relevant shares. Charging both the full debt and every share underlying conversion overstates the same claim. Counting a repurchase while ignoring employee issuance can understate shares in the opposite direction. A transaction-only estimate remains an estimate until another reported share count arrives.

The product test still matters

Tenable has broader platform adoption, but that mix still needs to produce faster total growth. SentinelOne has faster recurring-revenue growth, but ordinary cash and compensation remain separate tests. Cloudflare can deploy useful defenses quickly, while its debt and share claims still require a dated reconciliation. The financing documents neither erase the products’ value nor prove their future margins.

Commvault’s recovery business adds another useful distinction. Its trailing cash calculation needs the annual statement plus the new quarter minus the old comparison quarter. One strong quarter should not become a full-year forecast. Interest earned on financial assets also needs to stay separate when valuing the operating business and crediting cash independently.

This is the discipline Graham’s analysis asks of a security: identify what the claim owns and what ranks ahead of it. In cyber, the next attack may explain a need for software. Subsequent filings explain whether the common shareholder’s claim changed while that need was growing.

Sources