AI security gets a harder earnings test

Guidance became the AI security proof point

CrowdStrike set the tone. On 26 Aug, the company reported Q2 FY27 revenue of $1.47 billion, annual recurring revenue of $5.84 billion and GAAP net income of $5.3 million, then raised full-year guidance after record annual net new ARR. The market response was immediate across the following days: articles on 27 Aug cited a 15% stock surge, on 28 Aug a 20.5% rise was described as its best stock performance day, and by 30 Aug reports said the shares were up 13.8% after raised full-year revenue guidance and had reached an all-time high of $227.64.

Okta had the other clean read-through. On 26 Aug it launched Agent SSO, a product for governing access to enterprise AI agents. On 27 Aug it reported better-than-expected Q2 CY2026 sales, lifted its annual revenue view and saw its stock rise 20% after hours. On 28 Aug and 30 Aug, further coverage put the post-earnings move at nearly 29% and tied demand to identity security for AI agents. Okta also closed the Permiso acquisition during the period, adding another AI security capability to the story.

The market is not simply buying the words AI security. It is buying AI security when it is attached to raised outlooks, subscription growth and a product surface that customers can map to a budget owner. CrowdStrike made AI security look like platform expansion. Okta made agent identity look like the next control plane.

SentinelOne found the limit of a revenue beat

SentinelOne delivered plenty of operating evidence. Across reports on 28 Aug, 29 Aug and 31 Aug, the company beat Q2 revenue estimates, reported ARR of $1.22 billion and showed an 800 basis point expansion in non-GAAP operating margin. Analysts raised forecasts in some coverage, UBS raised its price target to $24, and management commentary pointed to strong cybersecurity demand.

The stock still fell. Reports cited a 6.4% decline on 28 Aug, an 8% slide on 29 Aug and a 3.1% after-hours drop in later coverage after the company lowered its EPS forecast or trimmed its profit outlook. That is the new valuation tax in this category: revenue growth can clear the bar, while forward profitability still resets the multiple.

SentinelOne also had customer proof in the fortnight. On 25 Aug, its customer page added the Golden State Warriors logo and a Carnival Corporation case study. On 27 Aug, coverage included a Redington partnership for cybersecurity distribution in India. The disconnect is the point. Customer momentum and distribution can be real, while public-market patience tightens around earnings quality.

The product war moved into agents, workflows and code

The most useful signal of the fortnight sat below the earnings headlines. On 27 Aug, CrowdStrike launched a product page for building Falcon Fusion workflows with Claude Code and removed a Spanish workflow automation page. On 29 Aug, fusion-skills v1.1.0 added support for Claude Code, Codex, Copilot CLI, Cursor and Antigravity CLI, allowing Falcon Fusion workflows to be built from prompts in those tools. On 27 Aug, falcon-mcp v0.17.0 added an AgentWorks module for interacting with Charlotte AI agents.

That sequence matters. The page changed first, then the developer artefact broadened two days later. This is how AI security positioning becomes operational rather than ornamental: marketing, workflow automation and command-line developer surfaces moved in the same week.

Okta showed the same pattern from the identity side. Its terraform-provider-okta 7.0.0 release, published on 24 Aug and observed again in the period, introduced breaking changes including migration to the Terraform Plugin Framework and changes to okta_email_template_settings. During the same fortnight, Okta created repositories including okta-auth-java, okta-mobile-kotlin, okta-sdk-golang, okta-react, okta-spring-boot, customer-detections and okta-management-openapi-spec. The company also cycled hiring pages aggressively, adding 18 careers pages and removing 16 on 26 Aug, then continuing to add and remove roles across engineering, product, customer success and legal operations on subsequent days.

This is not normal brochure maintenance. Three surfaces moved together: agent identity messaging, infrastructure-as-code plumbing and hiring allocation. In a market where every vendor now says AI, the timing of these small changes is the cleaner tell.

Palo Alto Networks was loud in strategy and still shipping

Palo Alto Networks had the noisiest strategic backdrop. On 26 Aug and 27 Aug, multiple reports said the company had held acquisition discussions with Okta and Datadog, with the discussions not leading to a deal. Coverage also referred to a deeper M&A push around AI and to market interest ahead of Q4 earnings. On 27 Aug, articles cited a 10.3% stock increase, and on 30 Aug five more articles focused on the stock outlook, AI security optimism and expected earnings movement.

Underneath that, the company kept editing the product battlefield. On 25 Aug, it launched a Cortex Cloud versus CrowdStrike comparison page and added five blog pages. On 26 Aug, it added four blog resources around success subscriptions and technical support while removing four product-related pages on SD-WAN and cyber incident reporting. On 28 Aug, it introduced two Identity Governance and Administration blog pages and removed two product pages, including one comparing CNAPP with CrowdStrike and one on AI governance.

There were also two service events, both resolved. On 25 Aug, Palo Alto Networks reported a minor WildFire issue that lasted about 32 minutes. On 26 Aug, Cortex XSOAR8 and XSIAM had degraded performance in the US region for about 217 minutes. The operational note sits beside continued engineering activity: pan-chainguard v0.14.0 shipped with a workaround for PAN-321143 and certificate common-name changes, while repositories including pan-os-ansible, demo-local-ai-hr-it-bot and terraform-provider-cortexcloud were created on 28 Aug.

Rapid7 kept widening the practical surface

Rapid7 did not produce the same category-defining earnings moment, but interest rose. On 28 Aug, four articles reported a stock surge, with one citing a 14.4% increase. On 31 Aug, four more articles discussed Rapid7, including earnings history and reasons behind the stock move.

The product motion was broad and utilitarian. On 26 Aug, Rapid7 added product pages for cyber threat intelligence and security content automation protocol. On 27 Aug, it added pages focused on CIS benchmarks and MSP versus MSSP positioning, plus a blog post on protecting SSH and Apache with Fail2Ban on Ubuntu Linux. On 28 Aug, it added content on identity as a service, dark web marketplaces, deepfakes and vulnerability scanning tools. On 29 Aug, it added pages around compliance and automation, two blog posts on critical vulnerabilities and Metasploit updates, and a new Global Financial Services Firm logo on its customer page.

The repository activity matched that applied posture. Rapid7 released rapid7-rapid7_insightvm plugin version 8.0.18 on 27 Aug, created metasploit-omnibus on 28 Aug, created smbj-rpc and presto-query-builder on 29 Aug, and released rapid7-sophos_central plugin version 4.4.2 on 31 Aug. The story is not a single platform slogan. It is a steady accumulation of vulnerability, compliance, automation and integration surface area.