Themes / Cluster
Inactive · established relationshipLive session · 03:03 ET

MARKET-DISCOVERED GROUP

Cybersecurity Software

THE TRADER READBroad price confirmation, weak flow alignment

3 of 4 measured SPY-adjusted paths align to the downside across 3.5 effective names. Capital-flow agreement is 13%, so the basket is not yet clean. No verified headline preceded the measured move.

Price breadth4 of 4 falling-1.5% median path versus SPY
Capital-flow alignment13%Price breadth is not yet confirmed by flow
Activity nowCalmActivity score 0/100
Evidence depth2 support daysLow sample—context, not a validated playbook
EVIDENCE CLOCK

What happened, in timestamp order

4 timed events · 09:30–15:55 ET
TIMING READNo verified timestamped headline was found within 24 hours of the first measured price move in the available common-bar window. The move currently reads as market-led or unexplained.
  1. 5-minute inferenceCGNT registered the first material downside path

    -2.14% session path at the threshold · CGNT

  2. 5-minute inferenceFTNT registered a material downside path

    -2.56% session path at the threshold · FTNT

  3. 5-minute inferenceZS registered a material downside path

    -2.16% session path at the threshold · ZS

  4. 5-minute inferencePANW registered a material upside path

    +0.51% session path at the threshold · PANW

2 earlier filing context receipts

TUE, FEB 24FTNT filing documented shared operating contextproduct pipeline / R&D affecting expense · date precision only

TUE, JUN 2PANW filing documented shared operating contextproduct pipeline / R&D affecting expense · date precision only

Headline times and retained activity confirmations are point-in-time evidence. Price order is inferred from aligned 5-minute bars. Filing evidence has date precision only and is context, not an intraday catalyst claim.
THEME CONSTRUCTION

Broad move or one-stock disguise?

SPY-adjusted 5m paths

Observed movement is balanced across 3.5 effective names. CGNT represents 36.8% of absolute path energy; 3 of 4 members align with the down relative path.

ConstructionBalanced36.8% from the largest path
Effective names3.5 / 4Movement diversity after concentration
Direction breadth3/4 aligneddownside relative path · 1 counter-moving
Largest moverCGNT 36.8%69.2% from the top two paths
CGNT36.8%Dominant mover · path -2.44% · basket -0.61pp
FTNT32.4%Dominant mover · path -2.14% · basket -0.54pp
PANW18.0%Counter-move · path +1.19% · basket +0.30pp
ZS12.8%Aligned contributor · path -0.85% · basket -0.21pp
Top six names by movement share are shown. Movement share measures absolute 5-minute path energy; signed basket contribution is equal-weight. Neither is a portfolio weight or causal attribution.

01 · WHAT IS HAPPENING

The move, the flow and who is driving it

Price breadth, unusual activity and signed capital flow are separate observations
HOW THE PRICE MOVE SPREAD

Observed session sequence

5-minute bars · inferred
  1. CGNT moved lower firstFirst member to clear the material path threshold · path -2.14%
  2. FTNT registered a material lower path0m after the first price move · path -2.56%
  3. ZS registered a material lower path0m after the first price move · path -2.16%
  4. PANW registered a material higher path75m after the first price move · path +0.51%

Sequence inferred from aligned 5-minute price paths; it is not a causal ordering.

RELATIVE CO-MOVEMENT

How the members are behaving together

SPY-adjusted
Aug 28 · 09:30 ETMove visible 10:00 ETAug 28 · 15:55 ET
Group median -1.49%Strongest relative path PANWWeakest relative path CGNT

Observed member paths adjusted against SPY. The dashed marker shows when the median move first cleared a material threshold; shading marks the latest 20% of the observed window.

02 · WHY IT MATTERS

Why now and where the move could travel

Context and lead/lag links are evidence, not proof of causation or a forecast
WHY NOW

Verified recent context

0 items

No verified recent catalyst is attached to this move. The relationship may be market-led rather than news-led.

WHY THIS GROUP EXISTS

Shared filing context

3/4 members covered

Moderate filing support: the strongest shared 10-Q/K outlook is operating setup (near-term outlook) across PANW, ZS.

product pipeline / R&D affecting expense

“The provision was partially offset by excess tax benefits of $60.9 million from stock-based compensation expense, a tax benefit of $84.3 million from the FDII deduction, and a tax benefit of $15.4 million from federal research and development tax credits.”

FTNT 10-K · 2026-02-25
credit / rates affecting interest expense

“Interest expense consists of interest expense due to the senior notes and other miscellaneous interest expense.”

FTNT 10-K · 2026-02-25
demand / volume affecting revenue

“As a result of customer buying patterns and the efforts of our sales force and channel partners to meet or exceed quarterly quotas, we have historically received a substantial portion of each quarter’s sales orders and generated a substantial portion of each quarter’s billings and revenue during the last two weeks of the quarter.”

FTNT 10-Q · 2026-05-08
CONFIRMATION NETWORK

Outsiders and cross-asset links

0 outsiders confirming

No qualified cross-asset lead/lag link is available for this group.

Filing-linked outsiders test whether the move is spreading beyond the established cohort.

NETNot confirming

ZS · text peer

SNot confirming

ZS · text peer

QLYSNot confirming

PANW · text peer

SAILNot confirming

PANW · text peer

03 · WHO IS IN IT

Member participation

Unusual activity and daily price direction are shown separately
FTNTPANWCGNTZS

0/4 active0 rising · 4 falling

MemberUnusual activityToday's moveRead now
FTNTFortinet, Inc.
Quiet · 0/100
-3.9%
Watch / laggardActive in 0% of observed group sessions
PANWPalo Alto Networks, Inc.
Quiet · 0/100
-2.9%
Watch / laggardActive in 0% of observed group sessions
CGNTCognyte Software Ltd.
Most unusual · 0/100
-2.6%
Watch / laggardActive in 0% of observed group sessions
ZSZscaler, Inc.
Quiet · 0/100
-1.6%
Watch / laggardActive in 0% of observed group sessions
View exact member values
TICKERCompanyRole nowTodayObserved historyTrader interpretation
FTNTFortinet, Inc.Quiet / lagging-3.9%0% of 0 sessionsNot participating yet; a breadth test or a genuine divergence.
PANWPalo Alto Networks, Inc.Quiet / lagging-2.9%0% of 0 sessionsNot participating yet; a breadth test or a genuine divergence.
CGNTCognyte Software Ltd.Most unusual-2.6%0% of 0 sessionsMost unusual activity in this snapshot; performance direction may differ.
ZSZscaler, Inc.Quiet / lagging-1.6%0% of 0 sessionsNot participating yet; a breadth test or a genuine divergence.

04 · HAS THIS HAPPENED BEFORE

Identity history versus measured outcomes

Structural recurrence is not the same as a validated trading outcome
POINT-IN-TIME LIVE OUTCOMES

Live outcome ledger collecting

0/0 events completed

No completed point-in-time outcome is available yet. New live confirmations are now retained with their exact observation timestamp; statistics appear only after the corresponding candles complete.

Only point-in-time live watcher observations and conservative same-day EOD observations are included. Later backfills and replay runs are excluded.
Low structural sample

Only 0 completed episodes across 0 active sessions; treat history as context, not a validated playbook. These episode counts describe recurrence; the outcome ledger above is the only forward-performance evidence.

Structural support2 daysHow often the cohort identity was observed
Completed episodes0Separate periods of broad group activity
Active sessions0Completed session observations, not trades
2026-08-284 names in the durable cohort
2026-08-273 names in the durable cohort
MEMBER CONSISTENCY IN OBSERVED ACTIVE SESSIONS
CGNT0% · 0 episodes
FTNT0% · 0 episodes
PANW0% · 0 episodes
ZS0% · 0 episodes