Cyber Resilience

The Thesis

Security becomes urgent when a flaw reaches software that many firms already run. That urgency has several possible business outcomes: a customer installs a patch, turns on an existing service, pays for a new product, or replaces a vendor. Only some of those actions create new revenue. Our cyber coverage follows the steps between the flaw and the financial result.

The PHP advisory on 21 October gives this work a clear starting point. Two flaws can permit code to run on a server without authentication. PHP released fixes, while European security agencies urged firms to find affected systems and update them. The event establishes a serious weakness in a widely used software component. It does not establish how much any security vendor will earn from the response.

We are opening coverage across six parts of that response: Fortinet, SentinelOne, Tenable, Zscaler, Rubrik and Cloudflare. The question is which can turn useful products into durable, paid use. Revenue growth, customer expansion and cash costs matter alongside the speed of a launch.

This extends the work in the inference layer and AI capex. More software and more machine activity create more work to secure. They do not assign that work to a particular vendor or set a fair price for its shares. The evidence must do both jobs separately.

The Evidence

The confirmed PHP event has a defined technical scope. The PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Its advisory covers installations serving web requests and says the highest risk is in mod_php, where a demonstrated attack can run before application code. A password check inside that application cannot fix a flaw that runs first. That is a reason to update the runtime; it is not evidence that all authentication systems failed. PHP’s release notice supplies the affected scope and the remedy.

Cloudflare supplies a useful test of the business claim. It says it made WAF protections available by default to free and paid customers roughly nine hours before public disclosure. WAF means web application firewall: software that checks web traffic. Its new detection method uses both the request and the server’s response. This is evidence of a product change deployed during a live threat. Because free users received protection too, the announcement supplies no measure of added revenue. PHP and Cloudflare both say customers still need to patch.

Our own record adds a second distinction: reported activity and independent evidence. On 22 October, the TEXXR graph returned 434 Cloudflare edges across 234 distinct edge dates, against 291 edges across 103 distinct dates for CoreWeave, queried the same day; one CoreWeave edge lacked a date. The five other newly covered cyber names were much thinner: Fortinet 16 edges across 12 dates; SentinelOne 37 across 24; Tenable 11 across eight; Zscaler 17 across 11; Rubrik 30 across 22. These are counts of extracted relationships and their distinct dates, not unique reports, customers or product releases.

Reading the rows matters. Cloudflare’s PHP response appears as record 1297494 and record 1297519, dated one day apart, with the same original blog URL. Fortinet’s June credential-leak report likewise appears in two records pointing to one original article. Neither pair proves two events. A launch count that ignores these joins overstates product speed; a threat count can overstate incident frequency in the same way.

The reporting test therefore has three steps. Establish what changed in the product. Find evidence that customers adopted or expanded it. Then check whether revenue and cash generation reflect that use. A feature that reaches existing users for free may improve retention, but that remains a hypothesis until renewals or other reported measures support it. A signed contract, annual recurring revenue and recognized revenue also measure different stages of a sale.

The Companies

Fortinet: the link between hardware and recurring services. In its second-quarter 2026 results, Fortinet reported revenue of $2.05 billion, up 26% from a year earlier, and product revenue of $773 million, up 52%. It also reported a 34% GAAP operating margin. Those figures establish growth with current operating profit. The release lists FortiGate 1200G, FortiSOC and an expanded FortiEndpoint offering. The next question is how those products change recurring service demand after the initial deployment. The Intel processor collaboration gives our record a dated development milestone, on 21 July. A development agreement and a shipped product remain separate milestones.

SentinelOne: expansion with a cost test. For the quarter ended 31 July 2026, SentinelOne reported revenue of $292 million, up 21%, and annual recurring revenue of $1.218 billion, up 22%. Customers with at least $100,000 in annual recurring revenue rose 13% to 1,715. That supplies a useful check beyond a list of new features. The same release shows a 10% adjusted operating margin and a negative 31% GAAP operating margin. Both belong in the account. Our coverage will test whether broader paid use improves margins while keeping sight of stock compensation and the cost of delivering the service.

Tenable: broader sales before faster growth. The Tenable dossier follows the task that comes before a patch: finding exposed systems and deciding which need work first. For the quarter ended 30 June, revenue rose 8.6% to $268.5 million. Contracted revenue still to be recognized rose 15.4%, faster than sales. The Tenable One platform accounted for 50% of new sales; that is a mix measure, not half of total revenue. Hexa AI became generally available on 20 May to automate parts of discovery and remediation. No separate Hexa revenue figure appears in these sources. The test is whether wider platform use raises growth, rather than just changing the package in which customers pay for existing work.

Zscaler: growth needs an acquisition check. The Zscaler dossier follows secure access and expansion across customer work. Its year ended 31 July produced $3.353 billion in revenue, up 25%. Excluding acquired Red Canary, revenue grew 20% to $3.209 billion. Annual recurring revenue also grew 25% as reported and 20% without Red Canary. Both views matter: acquired sales enlarge the business but do not establish faster growth in the existing operation. AI Guard reached general availability on 27 January. That is a dated product milestone. The next test is paid expansion at a size that matters to the whole company. Broader platform revenue cannot identify the contribution from one new AI feature.

Rubrik: recovery with measurable recurring growth. The Rubrik dossier follows what a customer can restore after a failure and how it proves that recovery works. In the quarter ended 31 July, revenue rose 38% to $427.3 million and subscription annual recurring revenue rose 33% to $1.66 billion. Agent Cloud became generally available on 18 February, adding controls around AI agents. Aggregate growth establishes demand for the business; it does not isolate Agent Cloud’s sales. The quarter also carried $101 million of stock compensation, compared with $65.7 million of free cash flow. New paid use must justify its cash and share costs, as well as the product claim.

Cloudflare: deployment speed before revenue attribution. The Cloudflare dossier has the most direct product evidence in this incident. Its full transaction detection combines signals from both sides of a web exchange and can block a matching response. Protection across free and paid plans demonstrates distribution and response speed. Protected sites are not a count of new paying customers. The quarter ended 30 June showed company revenue up 36% to $696.1 million and dollar-based net retention of 120%, against 114% a year earlier. Those are signs of growth and expansion across a broader business. They predate the October PHP event and cannot measure revenue from that response.

The Lenses

Hamilton Helmer’s framework asks which benefit a product creates and what stops a rival from copying it. Cybersecurity makes that test concrete. A vendor may lower the cost of checking traffic, reduce the work of joining security tools, or make recovery faster. Those benefits need evidence. A large installed base may create switching costs, but scale and switching costs should not become labels applied to every growing vendor. The 7 Powers reading notes explain the distinction between a useful feature and a benefit that persists under competition.

Cloudflare’s PHP response suggests a test of shared distribution: can one deployed change protect a broad base quickly? Fortinet’s processor work suggests a cost and performance test: does purpose-built hardware improve delivered results enough to matter? These are questions derived from the evidence, not findings that either company has proved lasting power. The test gets stronger when customer retention, contract expansion and margins agree with the product account.

Benjamin Graham’s lens adds the valuation discipline. Faster growth and a useful product do not set a reasonable price. Any valuation account needs a stated revenue period, a consistent share count, cash and debt, and the cost of future dilution. Cash flow also needs context: customer prepayments and timing can make one quarter look stronger than the underlying earnings trend. The Security Analysis notes supply the habit of checking what the numbers actually support.

For this coverage, “reasonable value” is a question to document. A low sales multiple may reflect slow growth or weakening retention. A high one may require growth to persist for years. We will state those demands and the evidence that could disprove them. Product adoption and stock valuation answer different questions, even when the same release moves both discussions.

What Moved

22 October 2026 — coverage begins. The immediate trigger is the 21 October PHP advisory and Cloudflare’s same-day account of its response. The coverage spans six vendors with different roles and different levels of evidence in TEXXR. We count the duplicate Cloudflare and Fortinet records once when describing their underlying events.

The institutional filings offer a useful cross-check with a strict date boundary. Anatole’s report filed 14 August lists 2,189,257 Rubrik shares as of 30 June, absent from its 31 March table. Fundsmith’s Fortinet count fell from 6,156,675 at 31 March to 3,629,938 at 30 June. The filings became public on 15 May and 14 August respectively. They describe earlier holdings, omit shorts and do not establish current buying. The SEC’s next deadline for September holdings is 16 November.

The next updates will look for dated product availability, paid customer expansion, recurring revenue growth and the cash cost of that growth. We will also track vendor failures and patch delays. Security demand can grow while a specific supplier loses trust; the record has to allow that outcome.

Sources

• “Security advisory: Critical remote code execution vulnerabilities, update now” — PHP, 2026-10-21. Original advisory.
• “Joint statement on critical PHP vulnerabilities” — ENISA, 2026-10-21. Original statement.
• “Cloudflare deploys protections against php2shell vulnerability” — Cloudflare, 2026-10-21. Original response. TEXXR entries: 1297494, 2026-10-21; 1297519, 2026-10-22. These entries point to the same post.
• “Intel to co-develop and manufacture Fortinet’s next-gen firewall ASIC” — Tom’s Hardware, 2026-07-21. Original report. TEXXR record 1173378; graph edge 408342.
• “FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices” — BleepingComputer. Original report. TEXXR entries: 1171103, 2026-06-17; 1171130, 2026-06-18. These entries point to the same article; graph edge 403553 joins them.
• “Fortinet Reports Strong Second Quarter 2026 Financial Results” — Fortinet, 2026-07-29, quarter ended 2026-06-30. Company release.
• “SentinelOne Announces Second Quarter Fiscal Year 2027 Financial Results” — SentinelOne, 2026-08-27, quarter ended 2026-07-31. Company release.
• Tenable, second-quarter results and investor presentation, 2026-07-29, quarter ended 2026-06-30. Filed release, presentation. Hexa AI availability, 2026-05-20.
• Zscaler, fourth-quarter and fiscal 2026 results, 2026-09-03, year ended 2026-07-31. Company release. AI Guard availability, 2026-01-27.
• Rubrik, second-quarter fiscal 2027 results, 2026-08-27, quarter ended 2026-07-31. Company release. Agent Cloud availability, 2026-02-18.
• Cloudflare, second-quarter 2026 results, 2026-08-06, quarter ended 2026-06-30. Company release.
• TEXXR graph audit, queried 2026-10-22: Fortinet, SentinelOne, Tenable, Zscaler, Rubrik, Cloudflare and CoreWeave. Counts describe returned edges and distinct edge dates; they do not count unique reports.
• Anatole Investment Management, Forms 13F-HR: 31 March holdings, filed 2026-05-15; 30 June holdings, filed 2026-08-14.
• Fundsmith, Forms 13F-HR: 31 March holdings, filed 2026-05-15; 30 June holdings, filed 2026-08-14.
• SEC, Form 13F FAQ, questions 25 and 41, accessed 2026-10-22.
• Hamilton Helmer, 7 Powers: The Foundations of Business Strategy (2016) — public reading notes.
• Benjamin Graham and David Dodd, Security Analysis (1934); Benjamin Graham, The Intelligent Investor (1949) — Security Analysis notes, Intelligent Investor notes.