Verdict: the first door was touched and not opened; chips led software for a second week, but the bid went to power and construction, not to the tools. Both questions stay open into the Fed.

Last Sunday asked whether September ends the Rubin consolidation, and named the doors: 2,017 (the 50-day average), 2,155 (the range top), then the record. The Rubin Build-Out 100 closed Friday at 1,963.98, +1.0% on the week. It rose four sessions running to 1,986.30 on Wednesday, touched the 50-day — which has itself drifted down to 1,989 as August’s high closes rolled out of the window — and was sold 2.0% on Thursday. Friday recovered 0.9%. The 20-day average at 1,957 is reclaimed; the 50-day is not. The September 2 low at 1,877 was never in play, so the rising-lows argument stands, and the first door is still shut.

The second question — was Friday’s chip bid the catalyst or the reflex — got the answer at the index level and not at the sector level. Through a week of software prints and inflation data, chips led software again: the semiconductor fund +1.4%, the software fund −2.9%, the Nasdaq 100 fund −0.6% at 714.88, still inside its 701 / 746 frame. But inside Rubin the week belonged to data-centre construction (+6.7%) and data-centre power (+6.5%), foundry and integration (+5.2%) and the server assemblers (+3.9%). The equipment layer that the diary said must turn on kept falling: lithography −3.7%, storage −3.5%, photomasks −3.2%, wafer processing −3.1%. Half a catalyst. Oracle’s window is open — 153.83 on Friday against a 152.94 entry, paid above 157.53, sold below 148.35 — and closes at Tuesday’s close, with Adobe (252.23 against 248.83) beside it.

1 · The signal — cybersecurity into the frontier-model year

Ten cybersecurity names have been sold on the screen for two weeks and bought underneath it for a month. That divergence is this week’s subject.

The case for the sector is not a Closelook thesis; it is the companies’ own. Over the summer the frontier labs began publishing what their newest models can do to software — OpenAI wrote in August about putting its cyber-capable models “in more trusted hands”, and CrowdStrike announced with Nvidia a pair of models built for offence and defence. The argument, as the vendors make it, is that the time between a vulnerability being disclosed and being exploited at machine speed is collapsing, so defence has to move from human-led detection to automated response. Nvidia’s chief executive said in an interview reported on Thursday that cybersecurity is the AI industry’s next large market. The same models also widen the attack surface: every deployed agent and every tool server is a new door.

The diary does not score narratives; it scores what the tape did with them. On the year the narrative has been paid: Fortinet +96%, Okta +93%, Palo Alto +80%, CrowdStrike +76%, Datadog +63%, Cloudflare +56%, and the two funds +32% (CIBR) and +41% (WCBR), against the software fund at −4%. On the month it has been sold: nine of twelve instruments are down, Palo Alto by 14%, SentinelOne by 12%, Rubrik and Datadog by 10%. Eight of the twelve now sit ten percent or more below their 52-week highs, and most of those highs are dated August 13 to August 31 — five weeks ago.

What makes this a signal rather than a drawdown is the second reading, in section 4. The flow scan of Saturday has every one of the ten names “getting stronger” or “turning up” over twenty-one sessions, with the largest gains in exactly the names the price has punished most: Zscaler +37 points, Rubrik +34, Okta +26, SentinelOne +23, Palo Alto +22. Money has been moving into these names while their prices fell. The diary has a name for that configuration — flow building while price is sold — and a rule: it resolves within a few weeks, one way or the other, and the level that says which is in section 7.

More from CloselooknetRubin 100 Our 100-name AI build-out index — masked headline, 37 sub-indices from architects to interconnects.Open Rubin 100 →

2 · The three groups, name by name

Endpoint. Cloud and zero trust. Identity, observability and resilience. The digest divides the sector three ways, and the tape treats the three groups differently.

Endpoint and platform. CrowdStrike (206.74, −3.0% on the week, −10.5% off its August 31 record at 231) is the name whose print was paid — +22.1% in the three-session window after August 26, the widest window on its card — and which has since given back everything but the first day. It closed Friday 2% above its 50-day average. Palo Alto Networks (330.65, −0.8%, −16.5% off the August 13 high at 396) is 5% under its 50-day after selling a seventh consecutive double beat. SentinelOne (19.75, −0.7%, −17% off its high) is the small one of the three, +32% on the year and −12% on the month.

Cloud and zero trust. Cloudflare (306.53) was the week’s exception: +9.9%, back within 7% of its August 13 record at 330.83, 7.5% above its 50-day. Zscaler (164.54, −3.1%) is the outlier in the other direction — −27% on the year, −51% from a November 2025 high at 336.27, the only name in the set with a negative flow score (−52) and the largest 21-day improvement in it (+37). Fortinet (156.07, −0.1%) is the year’s best performer at +96% and one of the flattest weeks, 2% under its 50-day, 10% off its August 27 high.

Identity, observability, resilience. Okta (166.50, −2.4%) is the strongest chart in the sector: +93% on the year, +11% on the month, 4% off its August 31 record and 12% above its 50-day. Datadog (221.21, +3.9%) is the one still carrying the August verdict — 23% below its August 4 high after the beat-and-raise that was sold 19% on day one. Rubrik (86.65, −7.5%) was the week’s weakest, closing below its 50-day for the first time since the print, 19% off its August 27 high. IBM (243.29, +3.6%), named in the digest for its models partnership, is −18% on the year and −26% off its June high; the flow scan does not cover it.

3 · The Print Record — six clean quarters, one payment

The season’s scorecard for the group: six double beats, one paid. CrowdStrike’s +22.1% (from a 189.18 anchor; Thursday alone +20.5% to 227.96) is the exception that makes the rule visible. Palo Alto beat on both lines for the seventh quarter running — EPS $1.02 against $0.978, revenue $3.41 billion against $3.35 billion — and sold −8.0%, the third window in a row between −8% and −9%. Zscaler beat by 9% on EPS, grew revenue 25% to $898 million, raised the year, and sold −6.6%: the fifth unpaid window on a card that has beaten every estimate for eleven quarters.

Rubrik’s was the loudest: the largest EPS beat on its card ($0.20 against $0.039) answered with −17.4%, the second-deepest window in its history, on a record that has never once closed inside the ±3% band. Datadog’s beat-and-raise on August 6 was sold 19% on day one, four times its worst three-day reaction in the covered record, and the stock has not recovered it. Cloudflare’s double beat the same week was bought 5.6% on day one, touched a record intraday, and faded.

Read as a group, the record says the market audited the sector’s multiples in August, not its quarters. The quarters were fine. The entries were the problem — Palo Alto went in 12.6% up in three sessions, Rubrik and CrowdStrike went in after a 5% sector selloff, Datadog went in 0.6% off its high. That is the same shape the diary described in the software complex a month ago: perfect columns, unpaid windows. The next prints for the cohort are November (Palo Alto, Zscaler) and December (CrowdStrike, Rubrik). Between now and then the tape has no quarterly excuse.

More from CloselooknetAbsolute Breadth How many stocks actually participate — the breadth engine behind the index headlines.Check the breadth →

4 · Directional Flow — ten rising scores, seven falling prices

The flow score is the diary’s measure of the direction and force of money moving through a name. It is not a price momentum reading; a name can fall on the screen while its score rises, and that is what the sector has done for a month. Over twenty-one sessions every name in the group improved: Zscaler +37.0, Rubrik +34.3, Okta +26.0, SentinelOne +22.7, Palo Alto +21.8, CrowdStrike +18.6, Cloudflare +17.3, Fortinet +8.7, Datadog +4.8. Over the last five sessions nine of ten still rose; Datadog was the only one to slip, and only by 0.7.

The levels of the scores matter as much as their direction. Fortinet (116), Palo Alto (112), Datadog (100), CrowdStrike (98) and Okta (97) are all at or near the +100 line the scanner treats as “strong” — these are names with money already behind them. Cloudflare (61), Rubrik (51), SentinelOne (49) and the CIBR fund itself (51) sit in the middle, building. Zscaler at −52 is the one still draining, and it is the one improving fastest: “turning up” is the scanner’s word for a score that was falling and has reversed.

Set the two columns beside each other and the picture is unusual for this year. In the spring the sector’s flow and price rose together. In August they parted: the price went down on the prints and the macro, the flow kept coming. The diary’s record with this configuration — flow building while price is sold two weeks running — is that it does not persist for long. Either the price catches up to the money, or the money stops. Section 7 names the level for each.

5 · The two funds against software and the index

One year on, the two cybersecurity funds are +25% each, the Nasdaq 100 fund +22%, the software fund −10%. The whole gap to software was built between April and August: from the April 10 low CIBR ran 68% to its August 13 high at 102.20 while IGV rose 48% into late August and has since given a quarter of that back. The last two weeks are the first sustained stretch since April in which the cyber funds have lagged the index on a one-month view — CIBR −5.5% and WCBR −6.9% against the Nasdaq 100 fund’s −0.5% — and the first in which they have fallen with software rather than against it.

CIBR closed Friday at 94.40, 0.1% above its 50-day average; it has hugged that line within half a percent for four straight sessions, a hair under it on Monday and Wednesday, a hair over on Tuesday and Friday. WCBR, the smaller and more concentrated fund, closed at 39.12, 0.5% below its own. That is the chart-level version of section 4: the price has come down exactly to the line where a rising-flow name either holds or does not. Above it the funds keep the year’s leadership over software; below it the sector rejoins the software drawdown it had escaped since April.

6 · Inside the Agentic Ecosystem — the security and identity sleeves

The Agentic Ecosystem index, the AI software supply chain, carries the sector in two sub-indices, and both lost ground last week. The Agentic Security sleeve — CrowdStrike, Palo Alto, Fortinet, SentinelOne, Rubrik, Zscaler, Trend Micro and Sangfor, equal weight — closed at 1,350.55: −3.1% on the week, −9.3% on the month, +38.1% on the year. Only Trend Micro (+1.6%) rose; Zscaler (−7.5%) and Rubrik (−6.0%) led it down. The Identity, Trust & Governance sleeve — Okta and SailPoint — was the weakest multi-name sub-index in the whole index at −6.8% (only the one-name Foundation Models sleeve fell more), SailPoint −11.1% and Okta −2.3%, though it remains +1.7% on the month and +40.0% on the year.

Operations & Observability, where Datadog sits with JFrog and Dynatrace, held better: −1.5% on the week, −0.8% on the month, +51.1% on the year. The Govern & Secure layer, which groups the security and identity sleeves, closed −2.8% on the week and −7.8% on the month at +42.0% for 2026 — still ahead of the Agentic Ecosystem headline at +55.3% only in the sense that it fell less in the summer. The parent index lost 1.2% on the week and 9.1% on the month.

Two more house readings belong here. The Agentic Security demand pulse — the diary’s attempt to read security spending from the vendors’ own disclosures rather than from price — sits at 39 of 100 with a “not enough data” regime flag, its endpoint basket −9.1% over twenty-one sessions (CrowdStrike −6.8%, SentinelOne −11.4%); the pulse has not confirmed anything the narrative says. The Enterprise Workflow pulse, by contrast, reads 82, carried by Salesforce’s disclosed agent revenue. And the AI Handoff ratio for trust-versus-execution — the diary’s price ratio of the governance layer against the execution layer — slipped 1.8% on the week to 1.017, still +1.7% since its June 30 base. The tape has not decided that security is where the agent economy pays; it has decided, for now, that workflow is.

7 · The levels

InstrumentFriday closeAbove this, the flow winsBelow this, the price winsCIBR · the group94.4098.56 (Aug 28 close, the last one before the selloff)93.54 (Sep 2 low)CrowdStrike206.74214.97 (Sep 3 close), then the 231 record202.58 (50-day) and 203.42 (Sep 2 low)Palo Alto Networks330.65349.54 (50-day), 362.09 (pre-print close)328.48 (Sep 2 low)Zscaler164.54175.06 (200-day), 187.30 (Aug 27 close)161.94 (Sep 8 low)Okta166.50173.04 (record close)163.15 (Sep 2 low), 148.85 (50-day)Rubrik86.6587.45 (50-day, lost Friday), 93.67 (Sep 4 close)86.65 itself — Friday was the lowest close since the printCloudflare306.53330.83 (record close, Aug 13)285.20 (50-day)

Closes through Sep 11 · 50- and 200-day averages from the lake and the Print Record cards · a level is “taken” on a closing basis.

The group level is the one to score. CIBR at 94.40 has the August 28 close at 98.56 four percent overhead; that was the last close before the two-week selloff, and a close above it says the money in section 4 has reached the price. The September 2 low at 93.54 is one percent below; a close under it says the flow was late and the sector is rejoining software. The individual levels follow the same logic — the pre-selloff close above, the post-print low below — and Rubrik is already at its line.

8 · The board and the questions ahead

IndexCloseWeek1 month2026NoteRubin Build-Out 100 (EW)1,963.98+1.04%−6.6%+91.1%50-day 1,989 · range top 2,155Rubin Build-Out 100 (CW)1,710.61+0.69%−2.5%+66.1%large names quieterAgentic Ecosystem (EW)1,532.78−1.17%−9.1%+55.3%security sleeve −3.1% wkEuro-AI Sovereign 50 (RI)1,494.61−4.39%−8.9%+27.0%closes through Sep 11HALO Growth 100 (EW)1,019.73−3.54%−7.2%+0.3%non-AI growth, flat on the yearAgentic Winners 40 (EW)910.65−4.71%−0.3%−7.0%AI software usersCybersecurity (CIBR)94.40−0.20%−5.5%+32.1%−7.6% off Aug 13 high · at the 50-daySoftware (IGV)101.52−2.86%−2.3%−3.9%−14% off highSemiconductors (SOXX)527.07+1.39%−1.3%+75.0%50-day 531.52 overheadNasdaq 100 (QQQ)714.88−0.57%−0.5%+16.4%frame 701 / 746 · 50-day 710.41

Closes through Sep 11 · week = Sep 4 → Sep 11 · Closelook indices count 2026 from the first close of the year (Tokyo and Seoul are closed on Dec 31); ETFs from the prior year-end close · indices from the index workers, ETFs from the Closelook data lake.

Of the five Closelook indices, Rubin was again the only one that rose last week, for a second week running. Non-AI growth (HALO) is now flat on the year, the AI software users (Agentic Winners 40) −7%, and Europe’s AI names lost 4.4%. The only thing the market bought for two weeks running was the physical build-out — and inside it, power and construction rather than tools.

First question: does the flow reach the price, or does the price stop the flow? The scoring level is CIBR — 98.56 above, 93.54 below — with the seven single-name lines in section 7. The tape has a full week without a print in the group to answer, and the Fed on Wednesday to complicate it. If the cyber funds hold their 50-day through the Fed and the record-high names (Okta, Cloudflare) lead, the divergence resolves upward and the sector keeps its year. If Rubrik’s Friday close under its 50-day is the first of several, the flow was late.

Second question: does the Fed open Rubin’s first door? The doors have not moved: 1,989 (the 50-day, drifting lower each week the index stays under it), 2,155 (the range top), the record above. Below, 1,877 remains the line that must hold. Tuesday closes Oracle’s and Adobe’s windows and brings Taiwan’s August revenues; Wednesday is the decision, with a hike priced at roughly four chances in five; Thursday and Friday the Bank of Japan; Friday the quarterly expiry. A close above 1,989 on the decision day, with the equipment layer finally positive on the sector board, is what an opened door looks like. A close under 1,877 is what the October window looks like instead.

9 · The count

Nothing resolved. The Nasdaq 100 fund closed at 714.88, inside its 701 / 746 frame and just above its 50-day at 710.41; the potential third-of-a-third remains possible, not resolved. The S&P 500 fund lost 0.8% to 764.29, 1.7% under its August 13 record. The Magnificent Seven fund added 0.65% to 69.89 and closed a week back above the 69.5 shelf it lost the week before — the one equity line this week that was retaken.

The bond market withheld its countersignature for an eighth week and then some: the seven-to-ten-year Treasury fund fell 1.3% to 91.01, two full points under the 93 line it failed to hold in August, and the long fund lost 1.6% to 80.87, below the 81.2 it gave up last week. Gold fell 2.0% to 398.77, back under the 410.22 line and a point above its 396.75 falsifier; bitcoin’s fund lost 3.2% to 43.77 and gave back the 44.5 line it had just reclaimed. The dollar fund was unchanged. Hold both sides: the equity lines are being retaken one at a time while the instruments that confirm regimes keep breaking theirs.

One sentence to close, because a diary should say what it actually thinks. The cybersecurity names have been sold for a month on entries and multiples while every flow reading the diary keeps has strengthened; the price has come down to the line where that either pays or fails; the sector has no print to hide behind this week and a Fed decision to trade through; if CIBR closes above 98.56 the money was early and the sector keeps its year, and if it closes under 93.54 the money was wrong and the sector is software again. Probability, not prophecy. We monitor, and we score it next Sunday.

Related on Closelook: Directional Flow · Print Record · Agentic Ecosystem · Agentic Security pulse · AI Handoff · Rubin Build-Out 100 · CIBR on the terminal

Verdict: zero of four — the thaw call did not confirm, and the equity market answered the rotation question its own way.

Last Sunday set four tells for the dollar-thaw trend and its own scoring rule: three of four would say trend, one of four says pause. The week delivered none of four. The dollar fund rose 1.0% instead of extending …

Read more

0 · Last week, scored

Verdict: both questions answered no — and the no is the signal.

Last Sunday asked whether Japan would join the Asian trifecta on the memory bid. It did not. Japan was −3.09% on the week, the Nikkei −3.…

Read more

Verdict: one question answered yes, the other answered no, and the worry we flagged resolved the wrong way for the bears.

Last Sunday put two questions on the table. The first was whether storage and memory would join the build-out or keep lagging — they were the only red on the Rubin Build-Out’s twenty-four-sector board, with Wester…

Read more

0 · Last week, scored

Verdict: the break never came — the bid did. Last Sunday’s signal sat both hedges on their decision lines: a break of 370 on GLD was to open the road to 320, and 60,000 was bitcoin’s floor to hold. Neither line broke. The first negative payroll print of the cycle (−23k) killed the hike premium in…

Read more

Verdict: mixed — the tape answered with a rejection sequence, and two of the three branches partially fired. The lines said: SOXX above 530–532 Friday overturns distribution, below 522.24 extends it. The week did both and settled on neither — a six-percent reclaim to Tuesday’s 552.69 close (the old 554 floor tested from below and co…

Read more

Earnings season opens Tuesday against the highest expectations bar of the cycle — and the market just spent a week pricing in the good outcome before seeing a single print.

The signal has two layers. The narrow one: the numbers themselves — the first AI-compute bellwethers, ASML on Wednesday and TSMC on Thursday, print before any US heavyweight opens its books. The broad one, and the more important one: the market’s reaction function. How does the tape treat this year’s leaders when they print above consensus — and when they merely match or fall short, with guidance the focus either way? And the mirror image: how does it treat the laggards, software above all, on their numbers? The prints answer one week. The reaction read answers the month: whether the leaders still have room to run, and whether the laggards have absorbed all their bad news — or not.

This chart is the tape-side referee: SOXX at 581, sandwiched between the 554 floor it reclaimed and the 590 shelf it hasn’t.

2 · What it is

Two weeks ago the semiconductor complex repriced 7–12% in three sessions. This week the market took the other side: SOXX +2.7%, SMH +3.2%, fabless +5.1%, Nvidia +8.3% back above its 200-day — while last week’s hiding places gave the money back. Software slipped (IGV −1.2%), and the prior week’s rotation winners reversed hard across our own universe: HALO‘s defense cohort −9.4% and space −9.9% after leading everything at +18/+17, the Agentic index’s identity tier −6.1% after +14.7%. The dip was bought, the hedges were sold — before the evidence.

And the tape narrowed while it happened: the S&P 500 gained +1.4% but the equal-weight version fell −0.3%, the Dow −0.4%, small caps −0.5%. One theme carried the index into its own examination week.

The bar being examined, in three numbers:

The dispersion is the story: the index-level bar is carried almost entirely by one theme's capex cycle.

3 · Why it matters

A +24% consensus year is post-recession-sized — the kind of number that stands at the start of a profit cycle, not five years into one. When the forward bar crosses roughly 20%, the market has priced flawless execution: small misses and soft guidance get punished out of proportion, and next year’s comparisons turn unforgiving before a single number is reported.

Read more

The headline indices hid the real story. The S&P 500 added +2.2% and the equal-weight version matched it (RSP +2.2%) — participation was broad. The Dow gained +2.0%, the Nasdaq Composite +2.3%. But the Nasdaq-100 made only +0.9%, and small caps fell (IWM −0.7%). An up week for almost everything — except the two ends of the barb…

Read more

The S&P 500 closed Friday at 7,354, down 2.0% on the week, while the Nasdaq fell 4.5%. Apple and Microsoft raised consumer product prices, citing memory and storage chip costs tha…

Read more

State of play

Where we stand — using numbers you can verify on any screen.

• 60% of S&P 500 stocks are above their 200-day average, and 59% are positive on the year. More than half the market is in an uptrend — this is …

Read more

The Signal — in one line

For two years the market priced US technology on the assumption that anything built in America could be sold to everyone.

Three developments now say that assumption may be dead — and a frictionless-global premium may be repriced into a permissioned-access discount across the entire US commercial stack, not just AI.

Read more

TLT, monthly. A five-wave decline from the 2020 high (~180); wave (5) is testing the wave (3) low at ~83 — the line in the sand. Source: TradingView, 24 May 2026.

Signal of the week: The whole thesis fits on one number. Hold 83 on a monthly close, and long-duration Treasuries may be carving a major bottom. Break it decisively, and the message flips to a …

Read more

First TLT Weekly Signal — composite score 34/100 (Red regime) at multi-decade horizontal support. Path A vs Path B framework, April CPI/PPI shock, sector dispersion at extremes, XHB breaks $100.

Regime reads bearish; setup reads contrarian-bullish. The score is honest about where TLT sits today; the narrative argues for why th…

Read more

“Of two equally good solutions, the less complex one is better.”

That sentence is roughly seven hundred years old. William of Ockham wrote it as entia non sunt multiplicanda praeter necessitatem — entities should not be multiplied beyond necessity — sometime in the 14th century. Six hundred years later, a Lockheed en…

Read more

But this is not …

Read more

Read more

(1) Why A Special Edition This Week

Every so often the market sets up a question so specific and so cleanly answerable that running the regular nine-dimensional scorecard would bury the signal rather than surface it. This is one of those weeks. Our regular scorecard — the nine-factor, six-instrument regime monitor — returns next Sunday. For the next five…

Read more

Three active conflicts have rewritten modern military doctrine in real time.

In Ukraine, Patriot intercept rates against modified Russian Iskander missiles dropped sharply as Russia adapted terminal-phase maneuver profiles. In the Middle East, Iran launched ballistic missiles at U.S. bas…

Read more

Read more

Today we’re launching something we’ve been building for a while.

The Weekly Signal is a systematic regime analysis published every Monday. One instrument per week. 7 levels of analysis. 9 scored dimensions. One composite score that summarizes the market's state in a single number.

Why build this? Because most weekly mar…

Read more