{
  "generatedAt": "2026-10-22T16:04:11Z",
  "url": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/",
  "disclaimer": "Analysis and opinion, not investment advice.",
  "id": "security-budget-share-outgrows-it",
  "number": 111,
  "question": "Will the combined revenue growth of six major cybersecurity firms exceed 15% year over year for the four quarters ending near 2027-06-30?",
  "dek": "AI-expanded attack surface and AI-enabled attackers pull incremental budget into security, so the listed security cohort grows materially faster than overall enterprise IT spend.",
  "family": "T12",
  "subthesis": "T12.01",
  "sector": "AI.SEC",
  "subsectors": [
    "AI.SEC.CYBER",
    "AI.SEC.MODELSEC",
    "AI.SEC.GOV"
  ],
  "relatedParts": [],
  "approvedAt": "2026-10-22T05:42:55Z",
  "sectorName": "AI Security, Trust & Governance",
  "api": "https://deepstack.ltd/api/v1/theses/security-budget-share-outgrows-it.json",
  "sides": [
    {
      "id": "yes",
      "label": "AI expands the attack surface and the security budget",
      "summary": "Lower attacker barriers (fast phishing, collapsing breakout time) plus more AI-generated software and agents raise perceived and actual risk. CIOs redirect budget toward security, lifting aggregate vendor revenue growth above the broader software and IT baseline.",
      "voices": [
        {
          "name": "Citrini",
          "entity": null,
          "claim": "As coding agents improve they surface a backlog of existing vulnerabilities and give attackers autonomous capability, while simultaneously generating more software and more attack surface than AI removes; fear plus remediation plus proactive…",
          "date": "2026-08-07",
          "url": "https://www.citriniresearch.com/p/protection-matters"
        },
        {
          "name": "Kris",
          "entity": "https://deepstack.ltd/people/kris/",
          "claim": "Because each AI workload and non-human agent needs its own host and sensor, and because AI-specific threats span data, models, prompts, agents, identities, infrastructure and the interaction layer, the number of things requiring protection…",
          "date": "2026-06-18",
          "url": "https://www.potentialmultibaggers.com/p/crowdstrike-the-mythos-moment"
        },
        {
          "name": "Prof G Media",
          "entity": null,
          "claim": "AI enables cybercriminals to launch attacks more quickly and effectively than previously possible. Mediocre attackers become effective, good attackers become better, and the time to steal data and execute phishing campaigns collapses. In response…",
          "date": "2026-02-23",
          "url": "https://www.profgmedia.com/p/how-the-rotation-into-safe-stocks-gone-too-far"
        }
      ]
    },
    {
      "id": "no",
      "label": "Security spend tracks overall IT, no outsized surge",
      "summary": "AI capability gains apply symmetrically to attackers and defenders, so there is no net increase in the offense-defense imbalance that would force budget toward security faster than overall IT spend grows. Because the risk is not newly asymmetric, the combined revenue growth of the six-firm cohort stays at or below the 15% threshold over the four quarters ending near 2027-06-30.",
      "voices": [
        {
          "name": "Jai Ramaswamy",
          "entity": null,
          "claim": "Because AI enhances both attack and defense capabilities symmetrically, a16z argues that AI itself does not introduce new incremental risk; however, if policy restricts defensive AI use while attackers remain unconstrained, an artificial asymmetry…",
          "date": "2025-12-17",
          "url": "https://www.a16z.news/p/a-roadmap-for-federal-ai-legislation"
        }
      ]
    }
  ],
  "tests": [
    {
      "id": "th111-t01",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "October 28, 2026",
      "whenLabel": "Oct 28, 2026",
      "date": "2026-10-28",
      "precision": "day",
      "event": "Fortinet, operating cash flow as a share of revenue, quarter ended September 30, 2026: whether it comes in at or above 33%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "yes",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 72,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[0].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Fortinet reports for the quarter ended September 30, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 33.0%; no if it is below 33.0%.",
        "question": "Did the net cash from operating activities of Fortinet for the quarter ended September 30, 2026 come to at or above 33.0% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Fortinet (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001262039.json"
        },
        "ambiguity": "If Fortinet has not filed by November 16, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "yes",
        "format": "ladder",
        "group": "th111-ftnt-ocf-margin",
        "threshold": 33,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Fortinet's operating cash flow as a share of revenue was 51.0% for the quarter ended June 30, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended June 30, 2025, the same line read 27.7%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t01",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 80,
          "at": "2026-10-22T07:41:52Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 82,
          "at": "2026-10-22T07:42:04Z"
        }
      ],
      "readers": null
    },
    {
      "id": "th111-t02",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "October 28, 2026",
      "whenLabel": "Oct 28, 2026",
      "date": "2026-10-28",
      "precision": "day",
      "event": "Fortinet, operating cash flow as a share of revenue, quarter ended September 30, 2026: whether it comes in at or above 39%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "either",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 50,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[1].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Fortinet reports for the quarter ended September 30, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 39.0%; no if it is below 39.0%.",
        "question": "Did the net cash from operating activities of Fortinet for the quarter ended September 30, 2026 come to at or above 39.0% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Fortinet (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001262039.json"
        },
        "ambiguity": "If Fortinet has not filed by November 16, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "either",
        "format": "ladder",
        "group": "th111-ftnt-ocf-margin",
        "threshold": 39,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Fortinet's operating cash flow as a share of revenue was 51.0% for the quarter ended June 30, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended June 30, 2025, the same line read 27.7%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t02",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 72,
          "at": "2026-10-22T07:42:08Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 54,
          "at": "2026-10-22T07:42:38Z"
        }
      ],
      "readers": null
    },
    {
      "id": "th111-t03",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "October 28, 2026",
      "whenLabel": "Oct 28, 2026",
      "date": "2026-10-28",
      "precision": "day",
      "event": "Fortinet, operating cash flow as a share of revenue, quarter ended September 30, 2026: whether it comes in at or above 45%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "no",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 28,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[2].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Fortinet reports for the quarter ended September 30, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 45.0%; no if it is below 45.0%.",
        "question": "Did the net cash from operating activities of Fortinet for the quarter ended September 30, 2026 come to at or above 45.0% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Fortinet (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001262039.json"
        },
        "ambiguity": "If Fortinet has not filed by November 16, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "no",
        "format": "ladder",
        "group": "th111-ftnt-ocf-margin",
        "threshold": 45,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Fortinet's operating cash flow as a share of revenue was 51.0% for the quarter ended June 30, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended June 30, 2025, the same line read 27.7%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t03",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 40,
          "at": "2026-10-22T07:42:42Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 13,
          "at": "2026-10-22T07:42:57Z"
        }
      ],
      "readers": null
    },
    {
      "id": "th111-t04",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "November 18, 2026",
      "whenLabel": "Nov 18, 2026",
      "date": "2026-11-18",
      "precision": "day",
      "event": "Palo Alto Networks, operating cash flow as a share of revenue, quarter ended October 31, 2026: whether it comes in at or above 36%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "yes",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 70,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[3].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Palo Alto Networks reports for the quarter ended October 31, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 36.0%; no if it is below 36.0%.",
        "question": "Did the net cash from operating activities of Palo Alto Networks for the quarter ended October 31, 2026 come to at or above 36.0% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Palo Alto Networks (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001327567.json"
        },
        "ambiguity": "If Palo Alto Networks has not filed by December 17, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "yes",
        "format": "ladder",
        "group": "th111-panw-ocf-margin",
        "threshold": 36,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Palo Alto Networks's operating cash flow as a share of revenue was 39.8% for the quarter ended July 31, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended July 31, 2025, the same line read 40.3%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t04",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 80,
          "at": "2026-10-22T07:43:02Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 95,
          "at": "2026-10-22T07:43:26Z"
        }
      ],
      "readers": null
    },
    {
      "id": "th111-t05",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "November 18, 2026",
      "whenLabel": "Nov 18, 2026",
      "date": "2026-11-18",
      "precision": "day",
      "event": "Palo Alto Networks, operating cash flow as a share of revenue, quarter ended October 31, 2026: whether it comes in at or above 39.5%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "either",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 50,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[4].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Palo Alto Networks reports for the quarter ended October 31, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 39.5%; no if it is below 39.5%.",
        "question": "Did the net cash from operating activities of Palo Alto Networks for the quarter ended October 31, 2026 come to at or above 39.5% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Palo Alto Networks (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001327567.json"
        },
        "ambiguity": "If Palo Alto Networks has not filed by December 17, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "either",
        "format": "ladder",
        "group": "th111-panw-ocf-margin",
        "threshold": 39.5,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Palo Alto Networks's operating cash flow as a share of revenue was 39.8% for the quarter ended July 31, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended July 31, 2025, the same line read 40.3%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t05",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 61,
          "at": "2026-10-22T07:43:31Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 88,
          "at": "2026-10-22T07:43:40Z"
        }
      ],
      "readers": null
    },
    {
      "id": "th111-t06",
      "part": null,
      "thesis": 111,
      "slug": "security-budget-share-outgrows-it",
      "when": "November 18, 2026",
      "whenLabel": "Nov 18, 2026",
      "date": "2026-11-18",
      "precision": "day",
      "event": "Palo Alto Networks, operating cash flow as a share of revenue, quarter ended October 31, 2026: whether it comes in at or above 43%.",
      "status": "pending",
      "resultId": null,
      "sameAs": null,
      "stage": "pre",
      "callExpects": "no",
      "callExpectsBy": "Desk Editor (level A)",
      "callExpectsAt": "2026-10-22T08:14:29Z",
      "callProbability": 27,
      "callProbabilityAt": "2026-10-22T08:14:29Z",
      "callProbabilityHistory": [],
      "source": {
        "kind": "thesis",
        "ref": "tests[5].date",
        "url": null
      },
      "resolver": {
        "kind": "manual",
        "rule": "Divide the net cash from operating activities by the revenue that Palo Alto Networks reports for the quarter ended October 31, 2026 in its 10-Q or 10-K filing on SEC EDGAR. The answer is yes if the ratio is at or above 43.0%; no if it is below 43.0%.",
        "question": "Did the net cash from operating activities of Palo Alto Networks for the quarter ended October 31, 2026 come to at or above 43.0% of its revenue?",
        "source": {
          "label": "SEC EDGAR, XBRL company facts of Palo Alto Networks (Forms 10-Q and 10-K)",
          "url": "https://data.sec.gov/api/xbrl/companyfacts/CIK0001327567.json"
        },
        "ambiguity": "If Palo Alto Networks has not filed by December 17, 2026, or a filing restates a period the rule reads, the test is inconclusive, and the Result says what was read and what was missing.",
        "specState": "approved",
        "specVersion": 1,
        "specUpdatedOn": "2026-10-22",
        "specHistory": [
          {
            "version": 1,
            "date": "2026-10-22",
            "reason": "First specification.",
            "by": "Desk Editor (level A)"
          }
        ],
        "callExpects": "no",
        "format": "ladder",
        "group": "th111-panw-ocf-margin",
        "threshold": 43,
        "direction": "above",
        "unit": "%",
        "think": {
          "baseRate": "Palo Alto Networks's operating cash flow as a share of revenue was 39.8% for the quarter ended July 31, 2026, by its filing on SEC EDGAR.",
          "outsideView": "A year earlier, for the quarter ended July 31, 2025, the same line read 40.3%, so the rungs sit on the last print.",
          "wouldChange": "A change in product mix, a one-time charge, or a reclassified line would move the reading."
        }
      },
      "url": "https://deepstack.ltd/docket/#test-th111-t06",
      "storyUrl": "https://deepstack.ltd/theses/security-budget-share-outgrows-it/#tests",
      "resultUrl": null,
      "machines": [
        {
          "model": "claude-opus-5",
          "p": 44,
          "at": "2026-10-22T07:43:45Z"
        },
        {
          "model": "deepseek-reasoner",
          "p": 62,
          "at": "2026-10-22T07:44:31Z"
        }
      ],
      "readers": null
    }
  ]
}