AI labs move into cybersecurity
event window since 2026-09-30
Google unveiled Gemini 4 Argon on 2026-09-30 (after the close): a model that finds, validates and patches vulnerabilities on its own, made generally available on 2026-10-13. On 2026-10-14 The Information reported OpenAI is in early talks to buy Trail of Bits, and PANW fell about 4% (also downgraded), CRWD about 3%, FTNT slipped. Vulnerability scanning and pen-testing are the most automatable part of security spend. The window starts at the first unveiling, so any earlier repricing counts as priced in.
| Ticker | Role | Side | Exposure | Return | vs SPY | z | Priced in | Mechanism |
|---|---|---|---|---|---|---|---|---|
| TENB | second order | short | 0.60 | +6.2% | +5.3% | +0.4 | 0% | vulnerability scanning is exactly what Argon-style agents automate |
| RPD | second order | short | 0.50 | +2.7% | +1.8% | +0.1 | 0% | vulnerability management and detection |
| QLYS | second order | short | 0.50 | +0.6% | -0.3% | -0.0 | 2% | vulnerability management |
| FTNT | first order | short | 0.30 | +3.6% | +2.7% | +0.3 | 0% | network security |
| CRWD | first order | short | 0.40 | -4.7% | -5.6% | -0.4 | 40% | endpoint and SOC platform vs AI-native rivals |
| PANW | first order | short | 0.40 | -4.4% | -5.3% | -0.4 | 45% | largest security platform; frontier labs become rivals |
| S | second order | short | 0.30 | -3.2% | -4.1% | -0.3 | 33% | AI-SOC differentiation erodes |
| GOOGL | beneficiary | long | 0.20 | +2.1% | +1.2% | +0.2 | 17% | Cloud and Mandiant upsell |
Get the daily radar
New threat statements from filings, the names the market hasn't connected yet, and every paper trade with entry, exit and P&L.