R15 — cybersec leg promoted under risk-on-tech-rotation umbrella

Update

R15 — cybersec leg promoted under risk-on-tech-rotation umbrella

  • Type: refresh (subtype: leg-promotion)
  • event_id: 2026-05-20-war-ends-playbook-r15-cybersec-leg-promoted
  • Source: R15 current-week research desk cycle — workflow/RUNS.md 2026-05-20 r15-current-week-research-desk-cycle. Inputs: published/research-notes/2026-05-20-r15-cybersec-cohort-parabolic-stacked-catalysts.md; published/scan-result-buckets/2026-05-20-r15-current-week-research-desk-cycle.json (cybersec-cohort-parabolic bucket); web verification of cohort catalyst stack (CSCO Q3 2026-05-14, FTNT Q1 ~early-May, PANW PT raises May 6 + 14, ZS B. Riley upgrade May 18, DZ Bank FTNT cut May 19); defense → cybersec rotation corroboration (LMT/NOC -10%/-15% 30D + sector commentary).
  • Decision context: R15 freshness-backfill on the 5/19 tape surfaced a cybersec cohort going parabolic that R14's partial coverage masked. 8/11 names RSI > 70, FTNT RSI 87, cohort 7d +7-15% (CSCO +14.8%, FTNT +10.5%, CRWD +11.2%, PANW +9.4%, ZS +7.5%). The desk had NO active cybersec perspective — move was invisible to the framework. Subagent verification confirmed catalyst-anchored (CSCO Q3 +35% product orders in-window; FTNT Q1 beat + raised guide; PANW BTIG-then-Jefferies PT raises; ZS upgrade). Defense → cybersec rotation explicitly corroborated by sector commentary and internal LMT/NOC weakness.
  • Decision — promote as a NAMED LEG, NOT a new perspective slot. ACTIVE is at 11 active vs the editorial-playbook 8-active soft cap; adding a 12th would worsen the overflow. The cybersec move is a leg of an existing rotation thesis (defense → cybersec rotation IS the same risk-on regime), so the natural home is THIS perspective. Reasoning encoded in published/research-notes/2026-05-20-r15-cybersec-cohort-parabolic-stacked-catalysts.md.
  • Cohort additions to key_tickers:
    • Leaders (event-resolution): FTNT (anchor — Q1 beat already + RSI 87 + DZ Bank hairline crack), CRWD (June 3 print), PANW (June 2 print), ZS (June 4 print), CSCO (post-print momentum test)
    • Followers: OKTA, S, NET (breadth-confirmation tier; not promoted to ACTIVE.json key_tickers but tracked in README leg)
    • ETF breadth instruments: HACK, BUG, CIBR (all 7d +7-8%, $11.3B + $1.3B + $675M AUM respectively — confirms institutional flows)
  • Invalidation gates (added to watch_for):
    1. Earnings invalidation: CRWD or PANW miss/guide-down on 2026-06-02/03
    2. Technical invalidation: FTNT close < $115 OR CIBR < $76 OR HACK < $86
    3. Sell-side confirmation gate: ≥3 cohort downgrades within 5 trading days (DZ Bank FTNT cut 2026-05-19 is the first hairline crack — needs 2+ confirms to flip from noise to distribution)
    4. Catalyst-exhaustion gate: all three June earnings beat + guide AND cohort fails to make new highs within 5 trading days post-prints → "good news exhausted"
  • Case state: emerging — catalyst-supported, but late-cycle on price (RSI 80+ readings + Josh Brown CNBC May 18 generalist-investor stage). The honest read: price action is late-cycle, but the cohort thesis is mid-stream — the binary 14-day earnings window resolves it.
  • Per-ticker (R15 5/19 tape):
    • FTNT $127.64 RSI 87.2 (most extreme), 7d +10.54%, 30d +54.53% — anchor + first downgrade
    • CRWD $616.88 RSI 84.1, 7d +11.16%, 30d +42.42% — pre-print 6/3
    • PANW $240.13 RSI 78.7, 7d +9.38%, 30d +41.62% — pre-print 6/2
    • CSCO $115.38 RSI 79.5, 7d +14.79% (largest), 30d +31.55% — in-window catalyst (5/14)
    • ZS $174.69 RSI 72.3, 7d +7.51%, 30d +29.59%, 5/18 stale — pre-print 6/4
    • HACK $91.30 RSI 75.2, BUG $32.75 RSI 77.7, CIBR $80.40 RSI 78.6 — ETF breadth confirms basket flow
    • NET $206.73 RSI 50 7d +8.69% — late-rotation breadth name, not yet overheated
  • Effect on parent thesis: HOLD on the mega-cap concentrated cohort (AMZN/GOOGL/NVDA/MSFT/TSM/EWY/EWT — all still working per R15 focus list); ADD the cybersec leg as a parallel risk-on-rotation expression. The "concentrated mega-cap + AI supercycle" thesis natively extends to "AI-leveraged software including cybersec" — same flow regime, different cohort.
  • Graduation criterion: if the leg resolves binary-positive (all three June earnings beat + guide) AND the cohort can either consolidate OR make new highs without immediate distribution, reconsider whether the leg has graduated into a standalone "cybersec-supercycle" perspective at the next post-earnings review. ACTIVE.json capacity must improve (≤ 8 active) before a new slot is added.
  • Watches (→ SCANS): CRWD/PANW/ZS June print calendar; FTNT/CIBR/HACK technical-breakdown level monitoring; sell-side downgrade tracking on cybersec cohort (DZ Bank FTNT cut 5/19 is the leading edge).
7 events
DateTypeEvent
May 29 ScanCybersec Scan May 29 ScanAI Scan May 29 ScanAI Infrastructure Scan May 23 ArticleDaily Actions — May 23, 2026 (R30-A Phase 4) Apr 28 ScanAI Scan Apr 28 ScanCybersec Scan Apr 26 ScanCybersecurity Scan

No direct external sources are attached to this read.