0 · Last week, scored
Verdict: the first door was touched and not opened; chips led software for a second week, but the bid went to power and construction, not to the tools. Both questions stay open into the Fed.
Last Sunday asked whether September ends the Rubin consolidation, and named the doors: 2,017 (the 50-day average), 2,155 (the range top), then the record. The Rubin Build-Out 100 closed Friday at 1,963.98, +1.0% on the week. It rose four sessions running to 1,986.30 on Wednesday, touched the 50-day — which has itself drifted down to 1,989 as August’s high closes rolled out of the window — and was sold 2.0% on Thursday. Friday recovered 0.9%. The 20-day average at 1,957 is reclaimed; the 50-day is not. The September 2 low at 1,877 was never in play, so the rising-lows argument stands, and the first door is still shut.
The second question — was Friday’s chip bid the catalyst or the reflex — got the answer at the index level and not at the sector level. Through a week of software prints and inflation data, chips led software again: the semiconductor fund +1.4%, the software fund −2.9%, the Nasdaq 100 fund −0.6% at 714.88, still inside its 701 / 746 frame. But inside Rubin the week belonged to data-centre construction (+6.7%) and data-centre power (+6.5%), foundry and integration (+5.2%) and the server assemblers (+3.9%). The equipment layer that the diary said must turn on kept falling: lithography −3.7%, storage −3.5%, photomasks −3.2%, wafer processing −3.1%. Half a catalyst. Oracle’s window is open — 153.83 on Friday against a 152.94 entry, paid above 157.53, sold below 148.35 — and closes at Tuesday’s close, with Adobe (252.23 against 248.83) beside it.
1 · The signal — cybersecurity into the frontier-model year
Ten cybersecurity names have been sold on the screen for two weeks and bought underneath it for a month. That divergence is this week’s subject.
The case for the sector is not a Closelook thesis; it is the companies’ own. Over the summer the frontier labs began publishing what their newest models can do to software — OpenAI wrote in August about putting its cyber-capable models “in more trusted hands”, and CrowdStrike announced with Nvidia a pair of models built for offence and defence. The argument, as the vendors make it, is that the time between a vulnerability being disclosed and being exploited at machine speed is collapsing, so defence has to move from human-led detection to automated response. Nvidia’s chief executive said in an interview reported on Thursday that cybersecurity is the AI industry’s next large market. The same models also widen the attack surface: every deployed agent and every tool server is a new door.
The diary does not score narratives; it scores what the tape did with them. On the year the narrative has been paid: Fortinet +96%, Okta +93%, Palo Alto +80%, CrowdStrike +76%, Datadog +63%, Cloudflare +56%, and the two funds +32% (CIBR) and +41% (WCBR), against the software fund at −4%. On the month it has been sold: nine of twelve instruments are down, Palo Alto by 14%, SentinelOne by 12%, Rubrik and Datadog by 10%. Eight of the twelve now sit ten percent or more below their 52-week highs, and most of those highs are dated August 13 to August 31 — five weeks ago.
What makes this a signal rather than a drawdown is the second reading, in section 4. The flow scan of Saturday has every one of the ten names “getting stronger” or “turning up” over twenty-one sessions, with the largest gains in exactly the names the price has punished most: Zscaler +37 points, Rubrik +34, Okta +26, SentinelOne +23, Palo Alto +22. Money has been moving into these names while their prices fell. The diary has a name for that configuration — flow building while price is sold — and a rule: it resolves within a few weeks, one way or the other, and the level that says which is in section 7.
2 · The three groups, name by name
Endpoint. Cloud and zero trust. Identity, observability and resilience. The digest divides the sector three ways, and the tape treats the three groups differently.
Endpoint and platform. CrowdStrike (206.74, −3.0% on the week, −10.5% off its August 31 record at 231) is the name whose print was paid — +22.1% in the three-session window after August 26, the widest window on its card — and which has since given back everything but the first day. It closed Friday 2% above its 50-day average. Palo Alto Networks (330.65, −0.8%, −16.5% off the August 13 high at 396) is 5% under its 50-day after selling a seventh consecutive double beat. SentinelOne (19.75, −0.7%, −17% off its high) is the small one of the three, +32% on the year and −12% on the month.
Cloud and zero trust. Cloudflare (306.53) was the week’s exception: +9.9%, back within 7% of its August 13 record at 330.83, 7.5% above its 50-day. Zscaler (164.54, −3.1%) is the outlier in the other direction — −27% on the year, −51% from a November 2025 high at 336.27, the only name in the set with a negative flow score (−52) and the largest 21-day improvement in it (+37). Fortinet (156.07, −0.1%) is the year’s best performer at +96% and one of the flattest weeks, 2% under its 50-day, 10% off its August 27 high.
Identity, observability, resilience. Okta (166.50, −2.4%) is the strongest chart in the sector: +93% on the year, +11% on the month, 4% off its August 31 record and 12% above its 50-day. Datadog (221.21, +3.9%) is the one still carrying the August verdict — 23% below its August 4 high after the beat-and-raise that was sold 19% on day one. Rubrik (86.65, −7.5%) was the week’s weakest, closing below its 50-day for the first time since the print, 19% off its August 27 high. IBM (243.29, +3.6%), named in the digest for its models partnership, is −18% on the year and −26% off its June high; the flow scan does not cover it.
3 · The Print Record — six clean quarters, one payment
The season’s scorecard for the group: six double beats, one paid. CrowdStrike’s +22.1% (from a 189.18 anchor; Thursday alone +20.5% to 227.96) is the exception that makes the rule visible. Palo Alto beat on both lines for the seventh quarter running — EPS $1.02 against $0.978, revenue $3.41 billion against $3.35 billion — and sold −8.0%, the third window in a row between −8% and −9%. Zscaler beat by 9% on EPS, grew revenue 25% to $898 million, raised the year, and sold −6.6%: the fifth unpaid window on a card that has beaten every estimate for eleven quarters.
Rubrik’s was the loudest: the largest EPS beat on its card ($0.20 against $0.039) answered with −17.4%, the second-deepest window in its history, on a record that has never once closed inside the ±3% band. Datadog’s beat-and-raise on August 6 was sold 19% on day one, four times its worst three-day reaction in the covered record, and the stock has not recovered it. Cloudflare’s double beat the same week was bought 5.6% on day one, touched a record intraday, and faded.
Read as a group, the record says the market audited the sector’s multiples in August, not its quarters. The quarters were fine. The entries were the problem — Palo Alto went in 12.6% up in three sessions, Rubrik and CrowdStrike went in after a 5% sector selloff, Datadog went in 0.6% off its high. That is the same shape the diary described in the software complex a month ago: perfect columns, unpaid windows. The next prints for the cohort are November (Palo Alto, Zscaler) and December (CrowdStrike, Rubrik). Between now and then the tape has no quarterly excuse.
4 · Directional Flow — ten rising scores, seven falling prices
The flow score is the diary’s measure of the direction and force of money moving through a name. It is not a price momentum reading; a name can fall on the screen while its score rises, and that is what the sector has done for a month. Over twenty-one sessions every name in the group improved: Zscaler +37.0, Rubrik +34.3, Okta +26.0, SentinelOne +22.7, Palo Alto +21.8, CrowdStrike +18.6, Cloudflare +17.3, Fortinet +8.7, Datadog +4.8. Over the last five sessions nine of ten still rose; Datadog was the only one to slip, and only by 0.7.
The levels of the scores matter as much as their direction. Fortinet (116), Palo Alto (112), Datadog (100), CrowdStrike (98) and Okta (97) are all at or near the +100 line the scanner treats as “strong” — these are names with money already behind them. Cloudflare (61), Rubrik (51), SentinelOne (49) and the CIBR fund itself (51) sit in the middle, building. Zscaler at −52 is the one still draining, and it is the one improving fastest: “turning up” is the scanner’s word for a score that was falling and has reversed.
Set the two columns beside each other and the picture is unusual for this year. In the spring the sector’s flow and price rose together. In August they parted: the price went down on the prints and the macro, the flow kept coming. The diary’s record with this configuration — flow building while price is sold two weeks running — is that it does not persist for long. Either the price catches up to the money, or the money stops. Section 7 names the level for each.
5 · The two funds against software and the index
One year on, the two cybersecurity funds are +25% each, the Nasdaq 100 fund +22%, the software fund −10%. The whole gap to software was built between April and August: from the April 10 low CIBR ran 68% to its August 13 high at 102.20 while IGV rose 48% into late August and has since given a quarter of that back. The last two weeks are the first sustained stretch since April in which the cyber funds have lagged the index on a one-month view — CIBR −5.5% and WCBR −6.9% against the Nasdaq 100 fund’s −0.5% — and the first in which they have fallen with software rather than against it.
CIBR closed Friday at 94.40, 0.1% above its 50-day average; it has hugged that line within half a percent for four straight sessions, a hair under it on Monday and Wednesday, a hair over on Tuesday and Friday. WCBR, the smaller and more concentrated fund, closed at 39.12, 0.5% below its own. That is the chart-level version of section 4: the price has come down exactly to the line where a rising-flow name either holds or does not. Above it the funds keep the year’s leadership over software; below it the sector rejoins the software drawdown it had escaped since April.
6 · Inside the Agentic Ecosystem — the security and identity sleeves
The Agentic Ecosystem index, the AI software supply chain, carries the sector in two sub-indices, and both lost ground last week. The Agentic Security sleeve — CrowdStrike, Palo Alto, Fortinet, SentinelOne, Rubrik, Zscaler, Trend Micro and Sangfor, equal weight — closed at 1,350.55: −3.1% on the week, −9.3% on the month, +38.1% on the year. Only Trend Micro (+1.6%) rose; Zscaler (−7.5%) and Rubrik (−6.0%) led it down. The Identity, Trust & Governance sleeve — Okta and SailPoint — was the weakest multi-name sub-index in the whole index at −6.8% (only the one-name Foundation Models sleeve fell more), SailPoint −11.1% and Okta −2.3%, though it remains +1.7% on the month and +40.0% on the year.
Operations & Observability, where Datadog sits with JFrog and Dynatrace, held better: −1.5% on the week, −0.8% on the month, +51.1% on the year. The Govern & Secure layer, which groups the security and identity sleeves, closed −2.8% on the week and −7.8% on the month at +42.0% for 2026 — still ahead of the Agentic Ecosystem headline at +55.3% only in the sense that it fell less in the summer. The parent index lost 1.2% on the week and 9.1% on the month.
Two more house readings belong here. The Agentic Security demand pulse — the diary’s attempt to read security spending from the vendors’ own disclosures rather than from price — sits at 39 of 100 with a “not enough data” regime flag, its endpoint basket −9.1% over twenty-one sessions (CrowdStrike −6.8%, SentinelOne −11.4%); the pulse has not confirmed anything the narrative says. The Enterprise Workflow pulse, by contrast, reads 82, carried by Salesforce’s disclosed agent revenue. And the AI Handoff ratio for trust-versus-execution — the diary’s price ratio of the governance layer against the execution layer — slipped 1.8% on the week to 1.017, still +1.7% since its June 30 base. The tape has not decided that security is where the agent economy pays; it has decided, for now, that workflow is.
7 · The levels
InstrumentFriday closeAbove this, the flow winsBelow this, the price winsCIBR · the group94.4098.56 (Aug 28 close, the last one before the selloff)93.54 (Sep 2 low)CrowdStrike206.74214.97 (Sep 3 close), then the 231 record202.58 (50-day) and 203.42 (Sep 2 low)Palo Alto Networks330.65349.54 (50-day), 362.09 (pre-print close)328.48 (Sep 2 low)Zscaler164.54175.06 (200-day), 187.30 (Aug 27 close)161.94 (Sep 8 low)Okta166.50173.04 (record close)163.15 (Sep 2 low), 148.85 (50-day)Rubrik86.6587.45 (50-day, lost Friday), 93.67 (Sep 4 close)86.65 itself — Friday was the lowest close since the printCloudflare306.53330.83 (record close, Aug 13)285.20 (50-day)
Closes through Sep 11 · 50- and 200-day averages from the lake and the Print Record cards · a level is “taken” on a closing basis.
The group level is the one to score. CIBR at 94.40 has the August 28 close at 98.56 four percent overhead; that was the last close before the two-week selloff, and a close above it says the money in section 4 has reached the price. The September 2 low at 93.54 is one percent below; a close under it says the flow was late and the sector is rejoining software. The individual levels follow the same logic — the pre-selloff close above, the post-print low below — and Rubrik is already at its line.
8 · The board and the questions ahead
IndexCloseWeek1 month2026NoteRubin Build-Out 100 (EW)1,963.98+1.04%−6.6%+91.1%50-day 1,989 · range top 2,155Rubin Build-Out 100 (CW)1,710.61+0.69%−2.5%+66.1%large names quieterAgentic Ecosystem (EW)1,532.78−1.17%−9.1%+55.3%security sleeve −3.1% wkEuro-AI Sovereign 50 (RI)1,494.61−4.39%−8.9%+27.0%closes through Sep 11HALO Growth 100 (EW)1,019.73−3.54%−7.2%+0.3%non-AI growth, flat on the yearAgentic Winners 40 (EW)910.65−4.71%−0.3%−7.0%AI software usersCybersecurity (CIBR)94.40−0.20%−5.5%+32.1%−7.6% off Aug 13 high · at the 50-daySoftware (IGV)101.52−2.86%−2.3%−3.9%−14% off highSemiconductors (SOXX)527.07+1.39%−1.3%+75.0%50-day 531.52 overheadNasdaq 100 (QQQ)714.88−0.57%−0.5%+16.4%frame 701 / 746 · 50-day 710.41
Closes through Sep 11 · week = Sep 4 → Sep 11 · Closelook indices count 2026 from the first close of the year (Tokyo and Seoul are closed on Dec 31); ETFs from the prior year-end close · indices from the index workers, ETFs from the Closelook data lake.
Of the five Closelook indices, Rubin was again the only one that rose last week, for a second week running. Non-AI growth (HALO) is now flat on the year, the AI software users (Agentic Winners 40) −7%, and Europe’s AI names lost 4.4%. The only thing the market bought for two weeks running was the physical build-out — and inside it, power and construction rather than tools.
First question: does the flow reach the price, or does the price stop the flow? The scoring level is CIBR — 98.56 above, 93.54 below — with the seven single-name lines in section 7. The tape has a full week without a print in the group to answer, and the Fed on Wednesday to complicate it. If the cyber funds hold their 50-day through the Fed and the record-high names (Okta, Cloudflare) lead, the divergence resolves upward and the sector keeps its year. If Rubrik’s Friday close under its 50-day is the first of several, the flow was late.
Second question: does the Fed open Rubin’s first door? The doors have not moved: 1,989 (the 50-day, drifting lower each week the index stays under it), 2,155 (the range top), the record above. Below, 1,877 remains the line that must hold. Tuesday closes Oracle’s and Adobe’s windows and brings Taiwan’s August revenues; Wednesday is the decision, with a hike priced at roughly four chances in five; Thursday and Friday the Bank of Japan; Friday the quarterly expiry. A close above 1,989 on the decision day, with the equipment layer finally positive on the sector board, is what an opened door looks like. A close under 1,877 is what the October window looks like instead.
9 · The count
Nothing resolved. The Nasdaq 100 fund closed at 714.88, inside its 701 / 746 frame and just above its 50-day at 710.41; the potential third-of-a-third remains possible, not resolved. The S&P 500 fund lost 0.8% to 764.29, 1.7% under its August 13 record. The Magnificent Seven fund added 0.65% to 69.89 and closed a week back above the 69.5 shelf it lost the week before — the one equity line this week that was retaken.
The bond market withheld its countersignature for an eighth week and then some: the seven-to-ten-year Treasury fund fell 1.3% to 91.01, two full points under the 93 line it failed to hold in August, and the long fund lost 1.6% to 80.87, below the 81.2 it gave up last week. Gold fell 2.0% to 398.77, back under the 410.22 line and a point above its 396.75 falsifier; bitcoin’s fund lost 3.2% to 43.77 and gave back the 44.5 line it had just reclaimed. The dollar fund was unchanged. Hold both sides: the equity lines are being retaken one at a time while the instruments that confirm regimes keep breaking theirs.
One sentence to close, because a diary should say what it actually thinks. The cybersecurity names have been sold for a month on entries and multiples while every flow reading the diary keeps has strengthened; the price has come down to the line where that either pays or fails; the sector has no print to hide behind this week and a Fed decision to trade through; if CIBR closes above 98.56 the money was early and the sector keeps its year, and if it closes under 93.54 the money was wrong and the sector is software again. Probability, not prophecy. We monitor, and we score it next Sunday.
Related on Closelook: Directional Flow · Print Record · Agentic Ecosystem · Agentic Security pulse · AI Handoff · Rubin Build-Out 100 · CIBR on the terminal