Here is a small thing that happened last November that almost nobody bothered to connect to the stock. The IRS sent a quiet note around to the states: Direct File, the free tax-filing tool the agency had built and run, would simply not exist for the 2026 season. Roughly three hundred thousand people had filed through it the previous spring; this spring the count rounds to nothing. The program did not die of natural causes, either. Fortune and others traced the body back to a lobbying campaign waged by the two companies with the most to lose from anyone filing taxes for free, H&R Block and Intuit, and the timing is the entire joke: in the very stretch of months that Wall Street had made up its mind that artificial intelligence was about to swallow Intuit whole, Intuit was off in the corner quietly drowning the one rival that might actually have drawn blood.

None of which you would ever guess from the share price. Intuit has been cut roughly in half over the past year, scraping along the low end of its range at a forward earnings multiple in the low-to-mid teens, which is about the least the market has been willing to pay for the thing in a decade. The story stapled to the wreck is the SaaS apocalypse, the same dread hanging over Salesforce and Adobe and the rest of the cohort: Anthropic ships some new trick, and TurboTax and QuickBooks are suddenly recast as museum pieces, relics you still cut a check for to do a chore a chatbot will shortly do for free. As narratives go it is clean, well-rehearsed, and pointed squarely at the wrong threat.

Because the thing the AI menaces was never really Intuit's moat in the first place.

Look at what the company actually sells, because it is not the thing the AI is coming for. TurboTax, underneath the cheerful interface, is a license to file, plumbed straight into the IRS e-file system and dragging behind it the audit trail, the decade of your prior returns, and the kind of bank-grade trust nobody hands to a six-month-old app. QuickBooks is odder still: it is the ledger of record for millions of small businesses, fused into their banks and their payroll and their invoices, the spot where the real money actually sits and moves. One investor settled the matter on a podcast this spring with a single question, which was whether his wife was going to wake up tomorrow and start running the business on a chatbot. An AI can draft a return or total a ledger easily enough. What it cannot do, not yet, is become the sanctioned pipe to the tax authority, keep the regulatory record, or somehow inherit the trust and the switching costs that Intuit spent thirty years and a small fortune in lobbying to pour into the ground.

And the lobbying is the part the market keeps quietly editing out. The American tax code is not baroque by accident, and the e-file rails are not thrown open to anyone who trains a decent model. Intuit's deepest moat has always been regulatory: a system complicated enough to demand a product, and a government talked out of, year after year, competing by handing that product to citizens for free. Direct File was the first serious crack in that arrangement in a generation, and it has just been mortared back over. The moat did not narrow this year. It widened, at the precise moment the share price was being marked down as though it were leaking away.

Then there is the layoff, and the market contrived to read it upside down. Intuit is letting go of seventeen percent of its people, and the reflex was to file that under softening demand, a company quietly bracing for fewer customers. Except that in the same announcement it raised its revenue guidance toward fourteen percent growth and walked its earnings up near eighteen. Firms drowning in lost customers do not accelerate their sales while they trim, and they certainly do not guide both higher in the same press release; what they do is exactly what a company that has just figured out how to run on less labor does, which is the adopter's posture, not the roadkill's. The market keeps flickering between those two readings of the very same headcount number, and that flicker is most of the reason the stock sits at a low-teens multiple of earnings.

So here is the proposition, laid out flat. You are being handed a near-monopoly on American tax preparation and small-business accounting, throwing off operating margins close to fifty percent, with a freshly minted eight-billion-dollar buyback that management is plainly using to vote with its own balance sheet, at the lowest multiple in ten years, all because the crowd has fixed its eyes on a software threat and walked straight past the regulatory fortress that just got reinforced. The AI risk is real. It is simply not the variable that settles this one.

I want to be fair to the bear, because the case has teeth. AI-native tax and bookkeeping startups exist and keep getting sharper, and a moat made of politics is a moat that politics can reverse; a different administration could resurrect free filing about as fast as this one entombed it. Intuit still has to genuinely fold AI into its own products rather than merely trim its headcount, and if its subscriber count and its net revenue retention begin to slip, that is the tell that the fortress is failing for real instead of just compressing on a multiple. The falsifiable version is clean enough: if Intuit loses customers rather than only multiple points over the next year or two, or if free government filing claws its way back, then the moat was thinner than I think and the cheap tag was earned.

But the market did not dump Intuit because its subscribers left, since they have not. It dumped Intuit on a fear, and while the whole room was watching the robot stroll in the front door, Intuit's lobbyists were calmly bolting the back one shut.

Sources

• Fortune — How big tax prep crushed the IRS’s free filing tool (Apr 2026)

• OpenSecrets — Intuit & H&R Block set lobbying records the year Direct File died

• Intuit FY2026 Q3 earnings & 17% workforce cut (SEC 8-K)

• Seeking Alpha — Intuit FY2026 guidance, 17% workforce cut

On May 26, CRWD hit a new high at $674.84 — the eighth in a row. PANW the same day hit $262.00, also a new high. Both have been bouncing around those levels going into earnings — CRWD around $665, PANW around $250. That is convenient, because the thesis was never about Tuesday's price. The HACK cybersecurity ETF has wiped out its drawdown for the quarter. The charts look like there is nowhere left to go. Financial media is back to throwing around the word "overheated," which usually tells you the easy part of the move already happened.

We would slow down here. Both companies report next week: PANW on Tuesday, June 2. CRWD on Wednesday, June 3. The two loudest theses in the sector get a real check in seven days. If the numbers come in strong, the market will pretend the setup was obvious all along.

This is, in our reading, a mis-categorization. The market sees ATH on CRWD and PANW as the top of the sector. We see it as the start of a story most people have barely begun to value. Back in February and March, the crowd briefly convinced itself that AI commoditizes parts of cybersecurity. The trade erased roughly thirty billion dollars across the group before reversing — fairly mechanically — once enterprise spending data stopped supporting the panic (covered in Issue №001). But prices going back to where they were does not mean the work is finished. Sometimes the recovery only fixes the old mistake, and the premium for whatever is true now has to price in separately.

A note before we go further. ATH does not mean growth is guaranteed, and it does not mean the price is safe. A stock can sit at an all-time high and still get cut in half if the market decides to pay less for the same earnings. What we are saying is not buy with both hands. It is narrower: the story has shifted. From cybersecurity is being replaced to cybersecurity is what companies buy when AI attackers scale up. That shift can play out as a higher multiple, as a slow grind sideways, or as a sharp drop on a bad quarter. The setup looks asymmetric over the medium term. It is not safe over the short term. Some of what is happening right now is also probably positioning into earnings rather than structural buying. We wouldn't dismiss that.

Round one — the mistake, unwound

In February, the crowd read it this way: AI will replace cybersecurity. Goldman strategist Ben Snider wrote it into a note that compared software's future to what happened to newspapers after 2002 — share prices down ninety-five percent over the next seven years. The market signed off on it with a $250 billion selloff in two days. Cyber stocks were down double digits. Fast-growers were cut in half.

Then the data came in. In early April, Anthropic launched Project Glasswing. CrowdStrike and Palo Alto Networks showed up on the founding partner list with Apple, Google, Microsoft and NVIDIA. Not as the companies being replaced. As the defenders. Anthropic put up roughly a hundred million dollars in Mythos credits. Six weeks later, both stocks hit new highs.

The mistake is unwound. The case could close here. But the case is only just starting.

What the market has not priced in yet

While Wall Street was busy asking whether AI would replace the defenders, the attackers were busy doing something more interesting. They were arming themselves.

The two big breach studies this spring — from IBM and Verizon — both showed the same picture. The average cost of a US breach hit a record. AI-written phishing is now the single biggest way attackers get in, ahead of vulnerability exploits and stolen passwords. Most companies that have been hit by an AI-related breach also admit they had no proper controls over their own AI systems. That gap is exactly what CRWD and PANW sell into.

The bigger shift is harder to put into one number. An attacker used to be limited by people. One team could pick at five or ten companies at a time. Now ten teams can hold the whole S&P 500 in scope at once. A good hacker now costs twenty dollars a month — the price of a subscription to a public AI model.

May produced one story after another. Instructure Canvas — the platform US universities use for grading — got hit by a group called ShinyHunters. Terabytes of data, hundreds of millions of users. Login pages went down across many campuses. By mid-month Instructure had quietly paid a ransom. In the same window, Foxconn — which builds for Apple, Nvidia, Google and Intel — confirmed an attack that stole millions of internal files and stopped production at its US plants. Two more industrial breaches landed the same week.

Four serious breaches in seven days. Two of them industrial. The baseline is higher than it was a year ago.

What the new weapon looks like

Wall Street Trapper, in a video from February, ran through what the typical attacker now has on hand. Phishing emails written by the thousand, with real context about the target. Working exploits written in hours, not weeks. Deepfake voice fraud, now a weekly story in bank-loss reports. Vulnerability scans running in parallel across hundreds of targets. Malware that changes shape between attempts, so signature rules stop catching it.

"This is an arms race, and security budgets do not get cut during an arms race. They expand."

This is not a prediction. It is arithmetic. If a company has five times more attack surface, it will buy more defense. The list of vendors with working AI detection is short. CRWD and PANW are on it.

CrowdStrike: data as a weapon

CRWD around $665 processes more security events a week than most rivals see in a year. In an AI defense model, data is not a side product — it is the fuel. The more attackers attack, the more data flows into Falcon. The more data, the smarter the detection layer gets. The smarter the detection, the less the attacker walks out with, and the more the customer pays next quarter.

We like this kind of setup. It is the rare case where more pressure on the business makes the business stronger.

Falcon is a subscription. That means steady revenue and enterprise contracts that stick. Once a customer takes one product on the platform, they usually take a second and a third.

There is an old line that Trapper likes too: nobody has ever been fired for spending too much on security; they get fired for the breach. In 2026 that line is being repeated in American budget meetings more often than in 2024. One more breach in the news — one more line item for CRWD the next cycle.

A few things the market still has not fully priced. After a month of public breaches, the next quarter is likely to show acceleration in new customers, especially in industrials. CRWD's seat at the Glasswing table is not a marketing line — it is direct access to Mythos for building the next round of detections. And on the platform side, Falcon Flex — CRWD's drawdown licensing model — is doing the quiet work of pulling one-product customers up into platform deals. Flex was already running at roughly a third of total ARR in the most recent disclosure, and CRWD extended the same model to Falcon Flex for Services in March. That is the kind of operational detail that does not move the stock by itself. It moves the next quarter's net new ARR.

The ATH zone is not evidence that all the buying is done. So far the rally has only attracted the buyers who were waiting for the panic to clear. The buyer pricing in the AI-attack tailwind has not arrived in size yet.

Palo Alto: the operating system of enterprise security

PANW around $250 is a different thesis. Not AI-data as a weapon. Consolidation as a weapon.

A large company that used to run twenty different security vendors and twenty different dashboards can now buy one. In 2026, with budgets squeezed from every side — AI spend going up, security salaries going up — consolidation wins. PANW is turning into something like an operating system for enterprise security: Strata for network, Prisma Cloud for cloud workloads, Prisma Access for SASE, Cortex for the SOC and response, CyberArk for identity. One platform, one contract, one phone number.

The biggest proof that the strategy is working is now under the same roof. In February, PANW closed a $25 billion deal to buy CyberArk — the leader in identity security — the biggest deal ever in the sector. CyberArk gives the platform the last piece it was missing: identity. The Q3 report on June 2 will be the first full quarter with CyberArk inside. That is also where the integration risk lives. Deals this big do not blend cleanly in three months. If management pulls it off, PANW moves from platform with gaps to platform with identity built in — and that alone usually lifts the multiple. If the integration is messy, the second leg of the thesis stalls, even with everything else going right.

Earlier this month, $PANW ran its own internal program. Three AI models — Claude Mythos, Claude Opus 4.7 and GPT-5.5-Cyber — were turned loose on the company's own products. They found a lot of real bugs, fast — about seven times faster than a normal cycle. Around a third of what the models flagged turned out to be false alarms. That number matters. It says these tools still need human experts to be useful — but they make those experts much more productive. That is the kind of operational edge that does not show up in any slide, but it shows up in roadmaps.

PANW is much bigger than CRWD. That is its strength and its limit. The strength: scale, cash flow, long contracts, the ability to absorb smaller players. The limit: revenue grows slower at this size. So the rerate has to come through a higher multiple — except where Cortex XSIAM and the new CyberArk pillar push growth back up.

Cortex XSIAM is the loudest engine of that rerate. The last quarter beat guidance. Inside Cortex, the platform now has a few hundred large customers, with one major telecom deal running into nine figures. Platform deals have doubled year over year. And most useful for the buyer side: most XSIAM customers have cut incident response time from days and weeks down to minutes. That is the metric that ends up on the budget slide.

A few things the market still has not fully priced. Cortex deal sizes keep growing — the kind of seven-figure ARR-per-customer that, once it lands, tends to stay. Money is rotating away from smaller players — Okta in identity, Rubrik in data resilience, the niche SASE vendors that Prisma Access is now eating — into the consolidator. AgentiX, the next Cortex line built around AI agents, was mentioned by management but is not in analyst models yet. And CyberArk synergies — the cross-sell of identity into existing Cortex and Strata accounts — is the kind of revenue that will show up two or three quarters out, not on June 2.

Why this is not just another rally

Wall Street runs these cycles all the time, and we covered the shape in Issue №001. Where we are now in cyber 2026 is simple. The first thesis — AI replaces the defenders — has been disproven. The second thesis — AI attacks explode, and demand for defense rises with them — is being confirmed every week. The first is priced in. The second is not.

The closest comparison we keep coming back to is GOOGL between 2022 and 2024. The ChatGPT will kill Search panic, the drop, the recovery — then a long run that went much further than the recovery. What happened to Google was not "the bull phase after the bear phase." The business did not change much. The market changed how it priced the same numbers.

CRWD and PANW are at the same point in the same arc. Part one has wrapped. Part two has just started.

What could break this

The obvious counterargument is valuation. And frankly, it is not a weak one. Both CRWD and PANW already trade on multiples that bake in years of clean execution. If you bought either purely on valuation discipline today, you would be uncomfortable. The thesis here is not that these stocks are cheap. It is that the second source of demand has not been factored in. You can be uncomfortable with the price and still be early on the catalyst. We are not going to pretend that is a comfortable spot to sit in.

Beyond valuation, there are three cracks.

First — the defenders fall behind. If the AI attacker scales faster than the AI defender, sooner or later a Falcon or Cortex customer gets breached, publicly. That will not kill the sector — long term it boosts demand. But short term, the price drops, and not gently. The risk does not change the direction. It adds volatility.

Second — AI defense gets commoditized. If detection turns out to be easily reproducible with open-source tools, the premium on today's incumbents shrinks. There is no sign of this yet — the Glasswing structure suggests Anthropic is making sure it does not happen. But it is worth watching.

Third — the multiple compresses, no matter what the business does. Both names trade on high forward valuations. ATH does not make those valuations cheap. A risk-off market, rates moving, money rotating out of cyber — and the chart can give back thirty percent while every word in this essay still holds. The thesis is about direction over time. Not about price safety at today's level. Holding a stock at $670 going up is a different experience from holding it at $670 on the way down.

None of the three looks critical right now, but all three are worth watching.

The snapshot

Round one — panic, drop, recovery — in cybersecurity ended six weeks ago. The old mistake is unwound. The new demand from the AI-era attacker is only just starting to show up in the multiples of CRWD and PANW. Breaches are arriving weekly. The next earnings prints land in five business days.

The data is moving faster than the narrative right now. That usually matters more.

Sources

• Anthropic, April 2026 — Project Glasswing — launch announcement and partners

• The Hacker News, May 4 2026 — 2026: The Year of AI-Assisted Attacks

• IBM Newsroom, July 2025 — 13% of organizations reported AI-related breaches; 97% lacked AI access controls

• Verizon Business, May 2026 — 2026 Data Breach Investigations Report — overview

• Axios, May 13 2026 — Palo Alto Networks says Mythos and GPT-5.5 found 75 bugs in weeks

• PR Newswire, July 2025 — Palo Alto Networks announces agreement to acquire CyberArk

• Wikipedia, May 2026 — 2026 Canvas data breach — full timeline and ShinyHunters claim

• The Record, May 12 2026 — Foxconn confirms cyberattack impacting North American factories

• TechCrunch, May 13 2026 — Ransomware hackers claim breach at Foxconn

• Yahoo Finance, February 2026 — Goldman issues a blunt warning to beat-up software stock investors

• CNBC, February 6 2026 — Goldman Sachs taps Anthropic's Claude to automate accounting, compliance roles

• StockTitan, April 2026 — Palo Alto Networks to announce fiscal Q3 2026 financial results on June 2

• TipRanks, May 2026 — CrowdStrike Holdings earnings dates and Q1 FY27 schedule

I dig where they skim. Get the next StockMole report — free, every Tuesday: stockmole.substack.com.

— StockMole

On April 22, 2026, ServiceNow reported Q1. EPS of $0.97 against consensus of $0.80 — a 21% beat. Subscription revenue of $3.67 billion, up 22% year-over-year. Customers buying Now Assist with annual contract value over $1 million grew 130% year-over-year. Management raised full-year guidance.

The stock fell 17% the following day.

That paradox is the larger story. The SaaSpocalypse — the multi-quarter panic over AI agents gutting per-seat enterprise software — is starting to end. On one specific ticker. The data inversion already happened back in April. The market just hasn't repriced.

The name is $NOW, ServiceNow.

We have seen this picture before. A company puts the disconfirming evidence on the tape, the price doesn't react, and the eventual re-rating arrives weeks late. The cast keeps changing; the script, less so.

The setup

Since the September 2025 peak, the iShares Expanded Tech-Software ETF (IGV) has fallen roughly 21% — from $118 down to the low-$90s. ServiceNow has fallen ~33% year-to-date — peak drawdown of nearly half from the July 2025 high — making it among the worst performers in its peer group. The narrative driving the selling is clean: AI agents will consume SaaS seats. One agent doing the work of five sales-ops people means one Salesforce seat per customer instead of five. Compound that across every horizontal SaaS category and the entire pricing model breaks.

It's an easy story to sell — especially against the narrative that these businesses are in structural decline.

What the market is choosing to ignore is the scale of what would actually need replacing. 85% of Fortune 500 companies use ServiceNow per the company’s own investor materials — roughly 8,800 customers worldwide as of the FY25 annual filing, each running hundreds of integrations, scripts, and workflow processes built up over years. “Replace ServiceNow with an agent” is not a technical decision. It is a cross-CTO political war. Winning that war from outside, without an install base, without an enterprise sales force, without two decades of CIO relationships — practically impossible for any new AI lab.

ServiceNow uses that fact. Across nine days between January 21 and January 28, 2026, the company signed partnerships with OpenAI and Anthropic — the two leading frontier AI labs — back-to-back. ServiceNow President, COO and CPO Amit Zavery framed it as a multi-model strategy: "Enterprise customers want model choice. They want the right model for the right job."

This is not defense. It's positioning ServiceNow as a platform independent of any single AI lab. If a new lab shows up tomorrow, ServiceNow integrates it too. It's a quiet kill on the bear case that one AI lab is going to displace ServiceNow.

The pricing pivot

The piece the financial press covered worst is also the most important: ServiceNow collapsed Now Assist from add-on into platform-standard.

Now Assist used to ship as a separate add-on on top of the base subscription. It is now embedded into the platform's Pro Plus and Enterprise tiers — third-party analysts price the AI uplift at roughly 25-60% over the base Pro seat.

The per-seat price remains the foundation. Consumption-based components for specific services sit on top. A hybrid.

In a deck, that reads as a technical footnote. In practice, it's the cleanest possible response to the "agents kill seats" thesis. The customer keeps paying for seats. AI features become standard, not an upsell. The more AI the customer uses, the more valuable ServiceNow becomes per seat.

This is not "AI is replacing SaaS." This is "AI is making every SaaS seat more expensive." Management didn't argue with the displacement narrative. Management proactively inverted it.

First data inversion — the Q1 report

April 22, 2026 — the numbers ServiceNow put on the tape:

• EPS (non-GAAP): $0.97 against $0.80 consensus — 21% beat

• Subscription revenue: $3.67 billion — up 22% year-over-year

• Operating margin (non-GAAP): 32%

• Now Assist $1M+ ACV customers: up 130% year-over-year

• Raised FY26 guidance: to $15.735-15.775 billion, up 20.5-21% year-over-year

Every one of these contradicts the displacement thesis. 130% growth in large AI customers is the literal answer to “agents are killing seats.” The cohort of customers spending over $1 million on Now Assist is expanding, not contracting — the displacement thesis would predict the opposite.

Q2 guidance from management: low- to mid-21% subscription growth and a 26-27% operating margin (including roughly 125 basis points of contribution from the Armis acquisition). Confident. The disclosures are not subtle.

Why the stock fell anyway

CNBC's headline that day: "ServiceNow stock sinks 14% as subscription revenue takes hit from Iran war."

Management disclosed a ~75 basis point headwind from delayed closings on several large Middle East deals — fallout from the Iran conflict. A few enterprise customers in the region pushed out contract signings under geopolitical uncertainty.

At a fundamental level, that's short-term noise. Customers don't disappear. Deals close one or two quarters later. But the market locked onto the single negative line item and ignored everything else.

Classic mis-categorization — a small truth drowning a large one. We have watched this exact reflex play out three times in different sectors over the past two years. It always looks identical from the inside.

What followed was two weeks of analyst price-target cuts and continued selling. The market seemed to have decided that ServiceNow was a textbook SaaSpocalypse name.

Until the Investor Day.

Second data inversion — the Investor Day

On May 4, 2026, ServiceNow ran its annual Financial Analyst Day in Las Vegas. Management disclosed its 2030 targets:

• Subscription revenue: over $30 billion by 2030 — roughly triple today's run-rate

• Total addressable market: $600 billion across IT, security, CRM, and employee experience

• Rule of 40: above 60 by 2030 (currently 56)

• Free cash flow margin: +900 basis points versus 2025

• Stock-based compensation: under 10% of revenue by 2029

These are not aspirational slides. These are commitments to institutional investors with a five-year horizon. Companies rarely publish five-year targets at this level of granularity unless the data behind them is unusually clean.

The analyst response was immediate:

• Bernstein raised the price target from $226 to $236

• Evercore ISI's Kirk Materne raised from $140 to $150, modeling $30 billion in revenue and $12-13 per share in free cash flow by 2030

• Barclays raised from $132 to $134, citing "measurable AI monetization"

• Bank of America restarted coverage on May 18 as Buy, arguing that AI is the strongest tailwind ServiceNow has ever seen, not an existential threat

Five major firms raised price targets in 48 hours. That's a rare collective pivot in conviction. Analysts almost always chase the price — that statistical bias casts a shadow over 80% of "buy" ratings. Raising price targets on a stock still down nearly a third year-to-date is statistically anomalous.

Current consensus per TipRanks: overwhelmingly bullish — no Sell ratings on the stock, only a handful of Holds, with an average analyst price target of $141.68 — roughly 38% upside to the recent print near $103.

Management added a third signal — with capital. The board authorized $5 billion of additional buybacks on January 28 — the same day as the Anthropic partnership — and deployed nearly half within the quarter. Free cash flow comfortably supports the pace (well above $1 billion at 40%+ margin per SEC filing). Management is spending billions on its own stock while it sits down a third year-to-date. Capital deployment of that scale against a falling stock — irrespective of motive — is what insider buying looks like in the rare cases when it is genuine.

McDermott — who took the CEO role in November 2019 and has grown the company from $3.5 billion in subscription revenue to nearly $16 billion projected for FY26 — framed the track record directly:

"We are printing a new ServiceNow every year."

Nearly a tripling in six years. McDermott told CNBC the same week that ServiceNow is growing faster than any other enterprise software company at scale, ever. Apply the same compounding to 2030 and you land on management's $30 billion target, which McDermott himself framed as a bear case, with an upside scenario disclosed slightly above.

What Dario Amodei actually said

Market bears like to quote Anthropic CEO Dario Amodei's public statement:

"Individual SaaS companies, it's very possible for them to lose market value, go bankrupt, completely, go bust."

Almost everyone pulls that line out of context. Amodei's full thought:

"I think there are incumbents today that are going to see very clearly … the moats here are going away, we're really going to pivot, and we'll do better than we did before. And there are others who are not going to pay attention, who are going to be blindsided."

Amodei split the SaaS sector into two buckets. The first — incumbents that actively pivot — do better than before. The second — those who ignore — go bust. ServiceNow is the textbook case of the first bucket. 29,000 employees on Claude. Partnerships with both Anthropic and OpenAI in one week. An AI Control Tower that governs other vendors' agents. All of it is exactly what Amodei described as "really pivoting."

The Amodei quote gets read as a verdict on SaaS. It's actually a survival manual — and ServiceNow is following it.

Why the re-rating hasn't priced in

ServiceNow has staged two public moments in less than two weeks after which holding the thesis that “AI will replace ServiceNow” becomes materially harder to defend against the disclosed data — the Q1 earnings call on April 22 and the Investor Day on May 4. Either one on its own should weigh on the prior narrative. Together they read as a double signal — the highest quality of evidence a public company can put on the tape.

So why is the market slow? Institutional capital moves on long decision cycles. The Iran conflict eats news bandwidth. Big funds want two or three consecutive quarters of confirmation before they rotate positions. Well over forty firms cover the stock — not all of them have updated their models post-Investor Day.

The single metric the market is ignoring is the renewal rate. If AI agents were actually displacing SaaS seats, churn at ServiceNow would be the first thing to move. Instead the company is holding a 98% renewal rate seven years running per its Q1 disclosures and SEC filings. That is not “AI is moving slower than we think.” That is “customers who already have ServiceNow, even under the displacement thesis, are renewing at historically normal rates.” Customer behavior is contradicting the displacement thesis in raw data while the market sells the stock on that exact thesis. The supporting indicator: ServiceNow’s current Rule of 40 sits at ~56 per the FY25 disclosures — the cleanest single signal of fundamental health in the sector, with the 2030 target sitting at 60+.

The second inversion happened three weeks ago. Institutional capital takes time. If the Q2 print on July 29 confirms the trend, a third signal becomes the accelerant — and the re-rating starts to show up in the price.

What to watch

Next catalyst: the Q2 print on July 29, 2026. Management has already set the bar — $3.815-3.820 billion in subscription revenue, 26.5% operating margin.

Markers worth tracking between now and July 29:

• Now Assist $1M+ ACV customer count — if growth stays above 100% YoY, the displacement thesis fails on its own data

• Further analyst price-target raises — Goldman, JPMorgan, Morgan Stanley have not moved yet. If any of them pivot, the institutional momentum compounds

• Insider buying — SEC Form 4 filings will tell whether management is adding to its own positions

• Geopolitical backdrop — if the Middle East conflict de-escalates, the 75bp headwind disappears immediately

What would prove us wrong: if management cuts Q2 guidance, if large AI customer growth decelerates to single digits, if insiders start selling, or if a publicly documented Fortune 500 customer actually swaps ServiceNow for an autonomous AI agent. None of those signals exist today.

The takeaway

ServiceNow is sitting on an internal contradiction the market cannot hold: the stock is down roughly a third year-to-date — while nearly every covering analyst rates it Buy, management has raised guidance, revenue is growing double digits, the largest AI customers are tripling their spend, and the five-year plan calls for the company to triple again.

Contradictions like that resolve one of two ways. Either fundamentals deteriorate — and they are not — or the stock re-rates.

The question is not whether the recovery happens. It is how fast. Setups of this shape — disconfirming evidence sitting on the tape, price still anchored to the prior narrative — have historically resolved through repricing far more often than through fundamental deterioration. The base rate, not certainty, is what makes the asymmetry worth describing.

Markets rarely apologize for panic. They simply rename it volatility after the fact.

The mole’s job is to read the disclosure trail — the earnings beats, the Analyst Day commitments, the buyback authorizations, the renewal rates — and describe what it actually says, not what the headline reflects. ServiceNow’s trail is pointing one direction. The price has not caught up yet. Ours is to keep our eyes open while the market does the catching up.

We shall be watching July 29 with the appropriate quantity of coffee. That may be the print that marks the moment the SaaSpocalypse stops being a coherent story — first on one ticker, then across the sector.

I dig where they skim. — StockMole

Sources

• TechCrunch, Jan 28 2026 — ServiceNow inks another AI partnership, this time with Anthropic

• ServiceNow Q1 2026 SEC 8-K — Earnings release filing

• Fortune, May 6 2026 — Why $30 billion in ServiceNow revenue is not as crazy as it sounds

• Yahoo Finance, Apr 23 2026 — ServiceNow stock tumbles 17% as Iran war impacts Q1 sales growth

• Constellation Research — ServiceNow ends AI add-on, adds Context Engine to scale Now Platform usage

• 24/7 Wall St, May 5 2026 — ServiceNow did everything right — Barclays raises price target on the AI innovation story

• StockTitan — ServiceNow $5 billion buyback authorization 8-K filing

• Yahoo Finance — Anthropic CEO Dario Amodei warns some software companies will completely go bust

Between January and early April 2026, the market dutifully erased some $30 billion of market capitalization from US cybersecurity equities. By mid-May, virtually all of it was back on the books. We were not, it has to be said, particularly surprised.

The entire round trip rested on a single tidy thesis: AI will replace the cybersecurity vendors. First the panic insisted the thesis was right. Then the data insisted it was wrong. Tens of billions of dollars sloshed across in each direction over eight weeks — without so much as a courtesy call from anyone's underlying fundamentals.

We have seen this picture before. The cast keeps changing; the script, less so.

The Panic

The first crack appeared on February 23. CNBC ran a headline that captured the mood with surgical precision: "Cybersecurity stocks drop for a second day as new Anthropic tool fuels AI disruption fears." What gives a headline its weight is rarely the content — it is the speed with which the rest of the trade desk repeats it. This one was repeated at considerable speed.

The "tool" in question was an early signal of what would later be christened Mythos: Anthropic's vulnerability-research model. The sell-side already had the thesis written up, hole-punched, and tabulated:

• AI labs would commoditize the premium multiples that cybersecurity vendors had spent a decade earning;

• security teams of thousands would compress down to a handful of analysts babysitting Mythos-class models;

• and the firms whose valuations rested on human-expert headcount would re-rate down to the multiples of legacy software.

Then March 26 arrived. Anthropic — and here we must permit ourselves a small smile — accidentally revealed Mythos through a security lapse of their own. In a trade where secrets are the product, that particular irony was worth every penny it cost them. The financial press would dub the following day the "Mythos Meltdown." $PANW dropped 6%, Okta dropped 7% in a single session. The one-day move was not an isolated event. It was the visible spike on a curve that had been bending the whole year.

By mid-April, the scoreboard was brutal:

• $PANW: down 15%+ YTD, down ~30% from 52-week highs

• $CRWD: down 15%+ YTD, down ~30% from 52-week highs

• $RBRK (Rubrik): down ~50% YTD

• HACK (Amplify Cybersecurity ETF): down 6.7% YTD as of April 10 — underperforming the broader tech category (−5.1%) and lagging the S&P 500

Roughly $30 billion of cybersecurity market cap had quietly walked out of the building. The narrative was already laid out in tasteful italics: AI was about to do to cybersecurity what the cloud did to on-premise in 2010.

The market has staged this exact forced re-categorization before, of course — repeatedly. On $AAPL in 2011 ("Android commoditizes the iPhone"). On $MSFT in 2003 ("Linux kills Windows Server"). On $NVDA in 2018 ("custom ASICs commoditize GPUs"). All three panics fully reversed within 18 months. The market repeats the routine with the regularity of the tides — and with much the same collective amnesia.

The Data That Reversed It

April 7, 2026 — three days before the HACK ETF logged its YTD low — Anthropic formally launched Project Glasswing.

The launch partners did not turn out to be ChatGPT-wrappers or open-source upstarts. They were Apple, AWS, Broadcom, Cisco, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, CrowdStrike, and Palo Alto Networks. Anthropic committed up to $100 million in Mythos usage credits across Project Glasswing and its participants — alongside $4 million earmarked for open-source donations. The structure was instantly clear to anyone willing to read past the headline: the AI labs were partnering with the cybersecurity incumbents, not replacing them. That particular nuance does not fit comfortably inside a four-second alarm clip — but it fits very neatly inside a 10-Q.

Over the following five weeks, the data came in like a flood:

• Mozilla pushed 423 Firefox security fixes in April — roughly 20× the 2025 monthly average. Mythos was credited as the catalyst, alongside other vulnerability-research tools in the mix.

• Microsoft's MDASH (Multi-Model Agentic Scanning Harness) found 16 of the more-than-130 vulnerabilities patched on May's Patch Tuesday, including four critical RCEs in the Windows kernel network stack.

• Google's Big Sleep, paired with CodeMender, found and pre-empted the first AI-built zero-day before it was ever deployed in the wild.

• OpenAI rushed Daybreak — its Glasswing competitor — out the door on May 11. Haste of that variety tends to tell a truer story than the press release does.

And — most importantly — Palo Alto Networks disclosed on May 13 that a five-week internal program had scanned more than 130 products, found 75 vulnerabilities, published 26 CVEs, and produced working exploits more than 70% of the time. Above-normal rate: 7×. Number of times adversaries had beaten them to a given bug: zero. PANW patched first, every time.

PANW ran three different frontier models in parallel — Mythos, Claude Opus 4.7, and GPT-5.5-Cyber — because each one finds different bugs. Humans were left to pick the winners. Thousands of security engineers across PANW's 16,000-plus-person workforce did the interpretation, the triage, and the patching. The picture in which AI had "replaced" those people looks rather different once one notices how much of the work they are still doing.

The decisive disclosure landed on May 14. Calif — the offensive-security firm that had just used Mythos to break Apple's flagship M5 memory protection on macOS 26.4.1 — made the point plainly in its public write-up: they hadn't built the exploit chain alone, Mythos had helped, but human expertise had been required on top.

They could have kept quiet about needing humans. They chose not to. That admission — from an offensive-security firm with every conceivable incentive to oversell the magic of AI — was simply incompatible with the panic thesis.

The Register coined the term for the moment: "vulnpocalypse." Cybersecurity had not been replaced. It had been amplified. The evidence did not merely disagree with the panic; it embarrassed it. The question was no longer whether the market would reverse, but how quickly it would pretend it had never been worried in the first place.

The Reversal

The market figured it out quickly — as it tends to when the task at hand is correcting yesterday's confident opinion.

Between early-April 52-week lows and May 20:

• $PANW: $140 → $240 (+71% from low, within 4% of all-time highs)

• $CRWD: $342 → $650 (+90% from lows, within 0.2% of all-time highs)

• HACK: most of the YTD decline erased

Some $30 billion in market cap that had evaporated during the panic was back on the books — give or take a touch of sector rotation. Net of an eight-week panic and a six-week reversal, the cybersecurity sector ended roughly where it had started, plus year-to-date earnings growth.

By the end of May, the market had effectively unwound an eight-week panic with six weeks of re-rating. Participants who stayed exposed through the cycle came out close to where they began. Participants who exited near the bottom locked in losses on businesses whose underlying fundamentals had not deteriorated. The textbooks do not put it quite this way, but they ought to: panic-driven capitulation is, in effect, a tax levied on those who trust the headline more than the balance sheet.

That is the round trip. The same arc — panic, compression, data inversion, recovery — has run several times over the past few years. The 2022–2024 $GOOGL "ChatGPT will kill Search" cycle took 18 months. Cyber 2026 compressed it into 14 weeks. The compression keeps getting faster, as the market gets marginally better at recognizing the script — though, evidently, not better enough to stop falling for it.

Which is what makes the next case so interesting. It is unfolding right now, in a sector roughly 70× larger than cyber.

The Pattern Running Live: The 2026 SaaSpocalypse

The software tape is now printing the same shape. The panic is set, the compression has hit hard, the data is just beginning to invert. Recovery still lies ahead.

The narrative trigger surfaced in mid-2025, intensified through February 2026, and acquired a name: the "SaaSpocalypse" (also rendered "SaaSacre" or "SaaS Crash," depending on the venue — the financial press, bless it, is partial to a catastrophe with branding attached).

The thesis is more aggressive than the cyber version. AI agents, the story goes, will not merely amplify the work that per-seat SaaS pricing assumes — they will consume the seats themselves. A single agent doing the job of five sales-ops people means one Salesforce seat per customer instead of five. Compound that across every horizontal SaaS category and the entire pricing model collapses. Or so the seller who could not bring himself to wait for Q3 will tell you.

The market has priced this in. Hard.

• The "Anthropic Effect" of February 2026 — when Anthropic's coding-agent announcements landed — wiped hundreds of billions of dollars in software market cap in a single trading window, per contemporary trade-press tallies

• $NOW (ServiceNow): −40% YTD as of late April 2026 — the single worst performer in the sector

• $CRM (Salesforce): −31% YTD

• $NET (Cloudflare) and $SNOW (Snowflake) down sharply on individual sessions throughout Q1–Q2

• IGV (iShares Expanded Tech-Software ETF): −21% YTD, −30% from its September 2025 peak

• Median software EV/Revenue has compressed to 3.4× per Aventis Advisors' SaaS dataset — down from peaks of 15–20× during the 2021 cycle

• For the first time in recorded history, the software sector trades at a forward P/E discount to the S&P 500

That last datapoint is worth reading twice. A sector that traded at a premium to the index for decades is now trading at a discount — on the very same names that have raised guidance for four straight quarters. Either the market knows something we do not, or the market has frightened itself again. Both possibilities deserve respect. Only one of them deserves a wager.

By broad software-basket estimates published in sell-side and trade-press notes, the 2026 drawdown has reached the low trillions in market value — orders of magnitude larger than the cybersecurity panic in dollar terms, and stretched across a considerably longer compression window.

Where the cycle stands. Narrative set, re-categorization done, compression delivered. The data inversion is just starting to make itself heard:

• Bain & Company published an analysis in February 2026 titled "Why SaaS Stocks Have Dropped — and What It Signals for Software's Next Chapter," arguing the panic has over-corrected relative to actual revenue and margin trajectories

• Wedbush's Dan Ives characterized the ServiceNow and Salesforce selloffs as "the most disconnected trade" from long-term AI-monetization paths

• IGV recovered ~14% in the month leading into mid-May 2026 — the first sustained bounce since the September 2025 peak

• Many SaaS companies are quietly announcing AI-agent integrations of their own (Salesforce's Agentforce, ServiceNow's AI orchestration layer) — which mirrors the Glasswing-partner pattern that broke the cyber-panic thesis

The first contrary prints are on the tape; the decisive one is not. The disclosure event — a single, quotable, undeniable line from a credible source that demolishes the "AI-agent-displaces-SaaS" thesis — has not yet fired. If it does, prior cycles suggest the re-expansion will follow on a compressed timeline.

This is also the candidate cycle in which the pattern might break. Software has a credible structural counter-argument that cybersecurity did not: per-seat licensing as a business model genuinely is exposed to seat compression. What separates a true mis-categorization from a true displacement comes down to a small set of diagnostic questions — autonomy of the new technology, the integration speed of the incumbents, the behavior of the customers. We will publish that diagnostic checklist as a standalone follow-up; for the purposes of this essay, what matters is the architecture of the cycle.

The next 8–12 weeks should decide whether the SaaSpocalypse completes the script or becomes the first time it breaks. We shall be watching with the requisite quantity of coffee and popcorn.

Other Sectors Starting to Panic

The SaaSpocalypse described above sweeps in most horizontal-SaaS exposure: customer-support software ($CRM, $ZEN), data analytics ($SNOW, $DDOG), and observability ($DDOG, $NET) are all inside that broader compression.

Two sectors sit outside the SaaSpocalypse but are beginning to take on the early-panic shape on their own:

Legal tech. The "AI replaces paralegals and contract review" narrative is active around Thomson Reuters and similar incumbents. The autonomy signal reads as failing based on public commentary from the law firms themselves — they describe the need for senior lawyers to validate AI-drafted output before it leaves the building. The narrative is in place; full compression has not yet arrived. In a world where a partner's hour is billed in triple digits, no one needs to be reminded why this particular link in the chain will not vanish overnight.

Adtech. The "AI agents bypass programmatic advertising" narrative — agents purchasing on behalf of users, banner ads never served — is starting to pressure $TTD, $PUBM, and the advertising side of $GOOGL and $META. The integration speed here is interesting: the major platforms already have AI-native ad products in flight, but the narrative is currently running well ahead of the data. Compression and data-inversion markers in Q3 2026 will be the relevant data points.

We will cover each as the public data develops. When one of them reaches the data-inversion stage, our readers will find it in a future Tuesday essay.

The Takeaway

The 2026 cyber panic is not a one-time event. It is a template. Roughly every 6–12 months, some sector finds itself caught in exactly the same script:

AI emerges → incumbents look "disrupted" → multiples compress → data shows amplification → market re-rates back.

The historical pattern is that participants who read the data trail before the multiples did have come through these cycles rather differently from those who reacted to the headlines. This is neither prophecy nor counsel. It is an observation that the market obligingly offers up roughly twice a year.

The data leaves a trail. It appears in the language of disclosures, in partnership announcements, and in the offhand admissions of people who have no reason to lie about the limits of their tools. The mole's job is to read that trail and describe what it shows.

Ours is to keep our eyes open — particularly when the market chooses to blink for us.

Sources

• CNBC, Feb 23 2026 — Cybersecurity stocks drop for a second day as new Anthropic tool fuels AI disruption fears

• Anthropic, Apr 7 2026 — Project Glasswing launch announcement

• Axios, May 13 2026 — Palo Alto Networks Mythos disclosure: 75 vulnerabilities, 26 CVEs, 7× normal rate

• The Register, May 14 2026 — Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits

• Bain & Company, Feb 2026 — Why SaaS Stocks Have Dropped—and What It Signals for Software's Next Chapter