Cybersecurity Scan — October 9, 2026 Close
Cybersecurity Scan — October 9, 2026 Close
Cybersecurity extended its rebound — 10 of 11 rose, led by Zscaler (+18.89%), Okta (+9.76%) and Fortinet (+7.63%) — and three names now sit above RSI 70 while the three basket funds closed Friday above their base highs. All 11 remain above their 200-day averages; BlackBerry (-4.19%) was the only decliner, and Zscaler is still -25.85% on the year after the surge.
Data as of the 2026-10-09 close (settled, Friday). The previous edition closed October 2; the seven-day column runs from that close to this one, so it is the change since then.
Quick Snapshot
| Signal | Reading |
|---|---|
| Overall | 🟢 Strong but stretching: 10 up, 1 down, all 11 above their 200-day averages. Three names at RSI 70 or above (OKTA, ZS, FTNT); the three funds sit within 0.12% of their 52-week highs. |
| Leaders | ZS (18.89%), OKTA (9.76%), FTNT (7.63%) |
| Laggards | BB (-4.19%), CRWD (1.85%), NET (3.4%) |
| Caveat | Tape from the desk's pre-computed summaries, 2026-10-09 close. News for most names was last pulled before this week's moves and no October 9 captures are on file yet, so most causes read "not on file", which is not the same as no cause. |
What's Going On
Zscaler led: +18.89% to $233.73, +7.8% on Friday, RSI 72.9. It is 40.8% above its 200-day but -25.85% on the year and -30.64% from its high, so this is a fast repair, extended in the short run and still not a long trend. Cause not on file: the October 8 news pull holds only quote pages listing analyst target raises and an agentic security-operations product launch without dates, Friday's +7.8% came after that pull, and the event records and October 3–8 captures carry nothing on Zscaler.
Okta (+9.76%, RSI 76.5) is the most stretched name: 101.1% above its 200-day on a +147.9% year, -0.36% from its high. Fortinet (+7.63%, RSI 72.7, 1Y +125.95%) closed -0.1% from its high. Both are intact trends that are extended: strength, not entries. Causes not on file: Okta's news was last pulled October 3 and Fortinet's September 25.
Every name rose on Friday, October 9, from +2.99% (Fortinet) to +7.8% (Zscaler), and HACK, BUG and CIBR closed above the highs of ranges held for 12.4, 6 and 9.4 weeks ($128.84, $49.62 and $109.07). Positioning context, not a cause: Connor Bates on X (October 8) counted a record $950 million of September net inflows into cybersecurity funds and wrote that the theme "isn't under-owned anymore and quite extended."
BlackBerry fell 4.19% (RSI 54, -34.44% from its high) but stays 37.1% above its 200-day on a +83.71% year: a pullback in an intact trend. CrowdStrike (+1.85%) lagged the group but holds a +116.09% year, 74.8% above its 200-day.
What Changed Since Prior Scan
Ten up and one down, against eleven of eleven up on October 2. All eleven sat above their 200-day averages both weeks. On October 2 no name was at RSI 70 (CrowdStrike at 68.7 and Okta at 68.4 were closest); now Okta, Zscaler and Fortinet are. Leaders rotated from BlackBerry, SentinelOne and Okta to Zscaler, Okta and Fortinet, and BlackBerry went from first to last. Zscaler, the one broken long trend a week ago (1Y -36.08% then), now leads the board, though its year is still negative.
How To Read The Board
This is a price-and-momentum screen built from the desk's pre-computed summaries: it shows where each name sits on the tape, not why it moved. RSI under 30 is a washout and 70 or above is extended; neither is a recommendation on its own. The structure label carries the long view, and it outranks the week:
- Trend intact: above the 200-day average with a positive trailing year. A bad week here is a pullback.
- Repair: above the 200-day but still down on the year. Price has recovered; the trend has not yet proved itself.
- Trend under test: below the 200-day with a positive year. The 200-day is the line to retake.
- Trend broken: below the 200-day and down on the year.
A raw screen reading becomes a setup only when an intact trend pulls back and holds a level, then turns up. No insider, fundamentals or options data is included.
Price Table
As of 2026-10-09. Price and SMA20 in dollars; RSI is a 14-day reading; all other columns in percent.
| Stock | Price | RSI | SMA20 | vs SMA20 | 7D | 30D | 1Y | vs SMA200 | Signal |
|---|---|---|---|---|---|---|---|---|---|
| ZS | 233.73 | 72.9 | 204.11 | 14.5 | 18.89 | 40.72 | -25.85 | 40.8 | 🟠 Extended repair |
| OKTA | 232.13 | 76.5 | 204.01 | 13.8 | 9.76 | 34.38 | 147.9 | 101.1 | 🟠 Extended, trend intact |
| FTNT | 194.75 | 72.7 | 178.82 | 8.9 | 7.63 | 23.87 | 125.95 | 60.6 | 🟠 Extended, trend intact |
| BUG | 50.08 | 69.6 | 46.38 | 8 | 6.73 | 22.53 | 39.3 | 48 | 🟢 Trend intact |
| HACK | 130.76 | 68.4 | 122.36 | 6.9 | 6.24 | 17.84 | 46.77 | 39.3 | 🟢 Trend intact |
| CIBR | 110 | 69.2 | 103.44 | 6.3 | 5.06 | 16.43 | 41.04 | 36.1 | 🟢 Trend intact |
| S | 26.27 | 68.5 | 24.04 | 9.3 | 4.83 | 35.13 | 45.94 | 54.9 | 🟢 Trend intact |
| PANW | 418.78 | 63.1 | 389.72 | 7.5 | 3.85 | 24.97 | 94.63 | 63.6 | 🟢 Trend intact |
| NET | 360.93 | 61.7 | 345.93 | 4.3 | 3.4 | 14.88 | 63.35 | 51 | 🟢 Trend intact |
| CRWD | 275.04 | 64.9 | 257.71 | 6.7 | 1.85 | 32.36 | 116.09 | 74.8 | 🟢 Trend intact |
| BB | 8.91 | 54 | 8.58 | 3.8 | -4.19 | 14.97 | 83.71 | 37.1 | 🟢 Pullback, trend intact |
Tier Analysis
Capitulation (RSI under 25)
No names in this tier.
Oversold (RSI 25-40)
No names in this tier.
Neutral to strong (RSI 40+)
| Stock | RSI | 1Y | vs SMA200 | Read |
|---|---|---|---|---|
| BB | 54 | 83.71 | 37.1 | Trend intact |
| NET | 61.7 | 63.35 | 51 | Trend intact |
| PANW | 63.1 | 94.63 | 63.6 | Trend intact |
| CRWD | 64.9 | 116.09 | 74.8 | Trend intact |
| HACK | 68.4 | 46.77 | 39.3 | Trend intact |
| S | 68.5 | 45.94 | 54.9 | Trend intact |
| CIBR | 69.2 | 41.04 | 36.1 | Trend intact |
| BUG | 69.6 | 39.3 | 48 | Trend intact |
| FTNT | 72.7 | 125.95 | 60.6 | Trend intact |
| ZS | 72.9 | -25.85 | 40.8 | Repair: above 200-day, down on the year |
| OKTA | 76.5 | 147.9 | 101.1 | Trend intact |
Entry Zones
Levels are the 20-, 50- and 200-day averages from the summaries, in dollars. Each row is a condition, not an order.
| Stock | Entry zone ($) | Condition |
|---|---|---|
| ZS | 185.78–204.11 | Extended repair; no entry until it pulls back toward the 20-day and holds the 50-day. |
| OKTA | 173.11–204.01 | Extended; the flag is a pullback toward the 20-day that holds the 50-day, then a turn back up. |
| FTNT | 167.37–178.82 | Extended; the flag is a pullback toward the 20-day that holds the 50-day, then a turn back up. |
| BUG | 43.39–46.38 | Breakout attempt from a base; a retest that holds the base high or the 20-day is the entry, and a close back under the 50-day voids it. |
| HACK | 116.92–122.36 | Breakout attempt from a base; a retest that holds the base high or the 20-day is the entry, and a close back under the 50-day voids it. |
| CIBR | 99.23–103.44 | Breakout attempt from a base; a retest that holds the base high or the 20-day is the entry, and a close back under the 50-day voids it. |
| S | 22.24–24.04 | Trend intact; entry on a pullback that holds the 50-day and closes back above the 20-day. |
| PANW | 370.85–389.72 | Trend intact; entry on a pullback that holds the 50-day and closes back above the 20-day. |
| NET | 316.02–345.93 | Trend intact; entry on a pullback that holds the 50-day and closes back above the 20-day. |
| CRWD | 228.7–257.71 | Trend intact; entry on a pullback that holds the 50-day and closes back above the 20-day. |
| BB | 8.4–8.58 | Trend intact; entry on a pullback that holds the 50-day and closes back above the 20-day. |
Action Matrix
| Stock | Signal | Action | Notes |
|---|---|---|---|
| ZS | 🟠 Extended repair | ⚠️ Don't chase | Extended repair. Oct 8 news pull holds quote pages only; Friday's jump came after it. Cause not on file. |
| OKTA | 🟠 Extended, trend intact | ⚠️ Don't chase | Most extended name on the board. News last pulled Oct 3; cause not on file. |
| FTNT | 🟠 Extended, trend intact | ⚠️ Don't chase | At its high and extended. News last pulled Sept 25. |
| BUG | 🟢 Trend intact | 🔒 Hold | Fund. Closed above its base high, a hair under its 52-week high. |
| HACK | 🟢 Trend intact | 🔒 Hold | Fund. Closed above its base high, a hair under its 52-week high. |
| CIBR | 🟢 Trend intact | 🔒 Hold | Fund. Closed above its base high, a hair under its 52-week high. |
| S | 🟢 Trend intact | 🔒 Hold | Near RSI 70; trend intact. |
| PANW | 🟢 Trend intact | 🔒 Hold | Above the 200-day on a positive year. |
| NET | 🟢 Trend intact | 🔒 Hold | Above the 200-day on a positive year. |
| CRWD | 🟢 Trend intact | 🔒 Hold | Lagged the group; trend intact. |
| BB | 🟢 Pullback, trend intact | 📈 Accumulate on flag | Only decliner; a pullback in an intact trend, holding above its 50-day. |
What To Watch Next
| Watch | Trigger | Why it matters |
|---|---|---|
| OKTA, ZS, FTNT | RSI back under 70 with price holding the 20-day (OKTA 204.01, ZS 204.11, FTNT 178.82) | The flag after an extended run; entries come from the rest, not the spike. |
| ZS | Holds the 50-day (185.78) while the trailing year turns positive | Turns a repair into a trend. |
| HACK, BUG, CIBR | A second close above their base highs | Confirms the fund breakout; positioning is already heavy after September's record inflows. |
| BB | Holds the 50-day (8.4) | The only decliner; a hold keeps it a flag. |
Sources
- Tape data (price, RSI, averages, returns, long-horizon fields, base highs): pre-computed summary, 2026-10-09 close — cybersec.
- Cybersecurity fund flows — Connor Bates on X, October 8 (https://x.com/ConnorJBates_/status/2108151697826799738), capture 2026-10-08-ConnorJBates_-cybersecurity-funds-saw-a-record-950-million-of--26799738.
- Zscaler quote pages (Stock Analysis https://stockanalysis.com/stocks/zs/, Simply Wall St, Investing.com) from the Zscaler news pull of 2026-10-08.
- News check (stocks<SYM>/news/latest.json
, pull dates): FTNT 2026-09-25; PANW 2026-10-08; CRWD 2026-10-03; ZS 2026-10-08; NET 2026-10-08; S 2026-10-03; OKTA 2026-10-03; BB 2026-10-03; HACK 2026-06-21; BUG 2026-09-15; CIBR 2026-06-21. Event records (research/stock-events/`) checked for October 3–9: the only entries are earnings or dividend records for NEOG, PENG, APLD, 6506.T, AEHR, ATZ.TO, DAL, NRIX, PEP and ORCL, none on this board. Article, X and filing captures for October 3–8 (articles, tweets, filings) were searched by company name; no October 9 captures were on file at writing. A news pull dated before a move does not cover it, and a pull with no item on the move is not proof of no cause.
Related
10 eventsSource links
Tweets, videos, filings, articles, and source pages tied to this read.