Security Operations (SIEM/SOAR/XDR/MDR)

Leidos has introduced UpHold Effect Agentic SOC Automation, an agentic AI capability that uses AI agents around the clock to help security operations center teams identify threats requiring immediate action amid a deluge of cyber alerts. The capability is a feature within UpHold Effect, Leidos' offering for agentic cyber response and part of the UpHold product suite, and it works across an organization's existing security tools to investigate alerts, gather information and recommend next steps rather than requiring agencies to replace their existing systems. Customers determine how much authority the AI receives based on mission, risk tolerance and governance requirements, and recommendations and actions create auditable records showing what the AI observed, concluded and proposed or did. A FedRAMP Class D High deployment option is available, and the capability can also provide a pathway toward Department of war Impact Level 4 and 5 environments with appropriate government sponsorship. Steve Hull, president of Leidos Digital, said cyber teams need to keep pace with threats without giving up control, and that the capability can take on more of the investigative workload while giving agencies the flexibility to decide when AI recommends an action and when it is allowed to act. Leidos, headquartered in Reston, Virginia, with 50,000 global employees, reported annual revenues of approximately $17.2 billion for the fiscal year ended January 2, 2026.

The U.S. Department of Justice concluded its examination into CrowdStrike Holdings regarding its transaction practices with distributors, including a heavily scrutinized $32 million arrangement with Carahsoft, without pursuing any civil or criminal enforcement. Federal prosecutors notified involved parties that the inquiry was finished with no charges filed. The resolution came as CrowdStrike reported second-quarter fiscal 2027 results, with total revenue up 26% year-over-year to $1.47 billion and annual recurring revenue reaching $5.84 billion. The company generated a record $333 million in net new ARR and raised its full-year net new ARR growth outlook to 34% at the midpoint, while accounts adopting Falcon Flex exceeded $2.29 billion in ending ARR, up 101% year-over-year. Operational cash flow hit a Q2 record of $530 million, with free cash flow of $377 million and a $5.01 billion cash reserve, though a parallel SEC civil inquiry into revenue recognition remains unresolved and CrowdStrike posted a GAAP loss from operations of $33.2 million against non-GAAP operating income of $371.6 million.

Cisco Systems reported double-digit order growth across its entire security portfolio, including Splunk, in the fourth quarter of fiscal 2026, with Security revenues rising 14% year over year to $2.23 billion. More than 1,500 customers bought newer offerings such as Secure Access, XDR, Hypershield and AI Defense in the quarter, lifting total net new customers since launch to more than 6,400, while firewall orders climbed more than 30% year over year. Observability revenues, a smaller part of the business, increased 6% to $275 million in the quarter, and for the full fiscal 2026 Security revenues grew 2% to $8.23 billion while Observability revenues rose 4% to $1.10 billion. Cisco also said nearly 4,500 enterprises signed up for Cisco Cloud Control and more than 8,600 customers use Resilient Infrastructure Services powered by Cisco IQ, and it launched Antares, a family of open-weight small language models for identifying known code vulnerabilities. The company faces intensifying competition from Datadog, which has more than 750 AI customers, and CrowdStrike, whose Falcon Flex annual recurring revenue surpassed $2.29 billion, up 101% year over year. Cisco shares have appreciated 38.5% year to date, and the Zacks Consensus Estimate for earnings stands at $1.32 per share, implying 32% growth.

Palo Alto Networks has launched Unit 42 Continuous Frontier AI Defense, an annual subscription service that uses Anthropic's Claude Mythos, OpenAI's GPT-5.6-Cyber, and open-weight models to continuously identify, validate, and remediate vulnerabilities across web applications, APIs, and cloud infrastructure. Reuters reported the service is designed to respond to growing attacker use of AI, while Palo Alto Networks said AI can compress breach cycles from weeks to hours in some cases, with pricing depending on the AI models customers select. The launch fits the company's broader AI-security push, following its April Koi acquisition to secure agentic AI endpoints and its September Console acquisition to add agentic capabilities to Cortex. Palo Alto Networks ended fiscal 2026 with $9.1 billion of Next-Generation Security ARR, up 63% year over year, and remaining performance obligations of $21.2 billion, up 34%, while targeting $11.075 billion to $11.175 billion of NGS ARR in fiscal 2027. Subscription and support revenue accounted for $9.2 billion of its $11.48 billion fiscal 2026 revenue, and the company generated $4.1 billion of free cash flow, though GAAP gross margin fell from 73.4% in fiscal 2025 to 70.4% in fiscal 2026 and operating margin dropped from 13.5% to 6.1%.

Federal authorities have closed criminal and civil probes into CrowdStrike Holdings over its distribution deals without pursuing legal action, removing a legal overhang that had weighed on sentiment. The company has been on a sharp upswing, with a 30-day share price return of 33.28% and a 90-day gain of 43.85% as the market digests both the cleared investigations and strong quarterly results. CrowdStrike last closed at $252.13, while the most followed narrative anchors fair value closer to $193.13, implying the stock is 31% overvalued. The company's strategic focus on Next-Gen SIEM, cloud-native security, and large-scale partnerships, along with its expansive data capabilities for AI development, positions it for robust demand growth. Still, the story could change quickly if newer products or acquisitions disappoint, or if rising competition pressures the rich P/E assumptions already reflected in the valuation.

SentinelOne announced that its Wayfinder Threat Hunting service now covers AWS, Azure, and Google Cloud, extending AI-powered Singularity telemetry and expert human-led hunting across endpoints, identities, and cloud control planes to address threats such as IAM privilege escalation, unauthorized access, and data exfiltration. A key element of the launch is a unified, continuous hunting workflow that fuses SentinelOne and Google Threat Intelligence, giving security teams consolidated visibility and enriched Purple AI summaries across their entire hybrid cloud environment. The move follows the earlier expansion of Wayfinder Frontier AI Services, which added AI-powered code risk analysis and compromise assessments using advanced OpenAI models, and reinforces SentinelOne's push beyond endpoint security into AI, identity, and cloud. SentinelOne's narrative projects $1.8 billion in revenue and $213.5 million in earnings by 2029, yielding a $24.25 fair value, an 8% upside to its current price, while the most pessimistic analysts still saw only about 16.7% annual revenue growth and no profitability in three years. Investors are still watching the risk that hyperscaler partners eventually prioritize their own security stacks, and that higher compliance costs and rising localization demands could reshape both narratives once the announcement is fully reflected in forecasts.

CrowdStrike Holdings, Inc. unveiled two new AI-focused security products at its Fal.Con 2026 conference, positioning itself to capture a market it estimates could reach $215 billion by 2034. Falcon Guardian is designed to protect AI agents at runtime and across endpoints, while SafeMind uses AI to improve threat detection and reduce security operations costs, with CrowdStrike saying its evaluations showed SafeMind delivered a 29% higher detection rate than leading frontier models and open-source baselines. The company cited one Fortune 500 customer that discovered 18,000 AI agents operating on its endpoints despite having approved only 300, underscoring the scale of the emerging risk. Hedge fund interest in CrowdStrike rose in the second quarter, with the number of funds holding the stock climbing to 89 from 79 in the first quarter; D.E. Shaw increased its position to approximately $1.6 billion and Renaissance Technologies initiated a position worth about $571.56 million. Short interest remains modest, with approximately 24.35 million shares sold short as of August 31, representing 2.38% of shares outstanding. The key question for investors is whether Falcon Guardian and SafeMind can translate into meaningful incremental annual recurring revenue, as enterprises may treat AI-agent security as an extension of existing platforms rather than a separate budget category.

CrowdStrike's Next-Gen Security Information and Event Management platform ended the second quarter of fiscal 2027 with annual recurring revenue surpassing $695 million, up about 60% year over year, as the company reported record net new ARR for the quarter. Management said new and existing customers are increasingly standardizing on Falcon as the operating system of the security operations center, helped by first-party data and a cloud-native architecture that lets enterprises enable the SIEM without deploying another agent. The structure is driving larger deals, including an eight-figure Falcon Flex agreement in which a major American power provider replaced a legacy acquired SIEM with CrowdStrike's next-gen SIEM. CrowdStrike's GSI business grew nearly 50% year over year, with much of that activity focused on next-gen SIEM transformations and vulnerability management. The Zacks Consensus Estimate points to revenue growth of around 24.6% for fiscal 2027 and 22.4% for fiscal 2028, while the consensus earnings estimate implies growth of 35.5% and 28.2%, respectively, with the fiscal 2027 and 2028 estimates revised up by 8 cents and 4 cents over the past 30 days.

BlueVoyant announced its Microsoft Defender XDR ISOC Deployment Service, one of the first deployment solutions in the market built to help enterprises adopt the newly announced Integrated Security Operations Center in Microsoft Defender. The service expands BlueVoyant's solution to cover the full scope of ISOC readiness, spanning Defender deployment and configuration across Endpoint, Identity, Office 365, Cloud Apps and Entra ID Identity Protection, walkthroughs of ISOC custom detections, workbooks, automation and user and entity behavior analytics, and use-case engineering to develop and refine detection rules, workbooks and automations. Customers and prospects can begin with BlueVoyant's ISOC Readiness Assessment, a no-cost engagement to prepare for ISOC deployment. The service is available now, with implementation aligned to customer eligibility, agreed scope and Microsoft's phased rollout. BlueVoyant, a premier Microsoft Security partner, supports more than 2,500 customer deployments in Microsoft-native environments worldwide.

Fortinet shares climbed to a fresh 52-week high of $175.23 on Sept. 21, 2026, before closing at $172.78, up roughly 3% on the session, extending a rally built on accelerating demand for its unified security platform. The company rolled out FortiSOC, a cloud-delivered security operations center embedding agentic AI across SIEM, SOAR, threat intelligence and identity-detection functions, and extended FortiEndpoint with AI visibility, governance and data-loss-prevention capabilities, while deepening its FortiAIGate integration with NVIDIA's accelerated computing stack. In the second quarter of 2026, billings rose 33% year over year to $2.37 billion, revenues grew 26% to $2.05 billion, and product revenues surged 52% to $773 million, with non-GAAP operating margin hitting a second-quarter record of 38% and free cash flow more than tripling to $966 million. Management raised full-year 2026 guidance to $8.02-$8.18 billion for revenues, $9.35-$9.55 billion for billings, and $3.41-$3.47 for non-GAAP EPS, with third-quarter guidance calling for revenues of $2.01-$2.10 billion. Fortinet shares have gained 120.7% year to date, and the Zacks Consensus Estimate for 2026 earnings is $3.42 per share, implying year-over-year growth of 23.91%.

Cisco Systems is extending Splunk AI into private-cloud, on-premises and air-gapped environments, targeting enterprises that cannot send sensitive machine data into public AI systems. The AI POD packages Cisco infrastructure with Nvidia accelerated computing and Kubernetes software, giving customers a controlled path to deploy AI workloads behind their own security boundaries. Splunk AI Assistant is already available, while Agent Launchpad is expected later this year, and Cisco is adding Tokenomics capabilities to track agent spending, attribute usage and forecast consumption. Shares gained approximately 0.2% to $109.73, though the stock trades 47.05% above a GF Value estimate of $74.62. Cisco has yet to disclose pricing or committed deployment volumes for these products.

Cisco Systems introduced the Cisco AI POD for Splunk at the 2026 Splunk conference in Denver, a configuration that brings Splunk AI capabilities to customers running Splunk Enterprise in on-premises, private-cloud, and air-gapped environments by combining Cisco infrastructure with Nvidia accelerated computing. The move extends Cisco's push to capture more enterprise AI spending beyond hardware, and it comes alongside a multi-year agreement with AWS to co-develop Splunk-centered security products for AI-driven threats. Cisco took in $9.3 billion of AI infrastructure orders from hyperscalers in fiscal 2026, including $4 billion in the fourth quarter alone, and generated around $4 billion in AI infrastructure revenue during the year, a figure it expects to nearly double to $7.5 billion in fiscal 2027. The stress point is that infrastructure leads this growth and is exposed to competitive pricing and component cost inflation, while observability revenue grew just 6% in the fourth quarter, leaving open how quickly Cisco converts AI infrastructure into higher-value recurring software and security growth. Hedge fund positioning moved supportively before the Splunk announcement, with the number of funds holding Cisco rising to 101 in the second quarter from 97 in the first quarter and 77 in the fourth quarter, and short interest falling 5.77% from the prior reading to 55.5 million shares as of August 31.

CrowdStrike Holdings was named a Leader in The Forrester Wave Q3 2026 report on external threat intelligence services. The Forrester evaluation highlights CrowdStrike's approach to Threat AI as a foundation for next generation security operations. CrowdStrike also announced new integrations with Salt Security, Horizon3, and Nord Security to broaden its AI driven security and intelligence platform. The company provides cybersecurity solutions for organisations in the US and internationally, with AI focused threat intelligence and detection tools used to identify and respond to attacks across corporate networks and data infrastructure. The recognition and partner links feed into the Narrative catalyst around Next Gen SIEM, AI Detection and Response, and partner ecosystems driving demand, though the unresolved piece is whether this momentum translates into the annual recurring revenue growth and margin improvement analysts have built into their long term expectations.

Cisco Systems pushed Splunk AI deeper into tightly controlled enterprise environments with a new AI POD built for on-premises, private-cloud and air-gapped deployments. The validated setup brings together Cisco infrastructure, Nvidia accelerated computing and Kubernetes-based software, letting enterprises run AI workloads without sending sensitive information outside their own environments. Splunk AI Assistant is available now, while Agent Launchpad is scheduled for later this year, and customers can host selected models from Google, OpenAI and Cisco, with Nvidia models expected to follow. Splunk is also adding Tokenomics, a capability designed to track token spending across AI agents and coding tools while estimating future consumption. Cisco shares climbed nearly 3.3% to $111.255 Thursday, though GuruFocus shows the stock trading 49.36% above its GF Value of $74.49, with product pricing and committed customer volumes still undisclosed.

Jim Cramer issued an unmistakable 2026 must-buy call on CrowdStrike, amplifying CEO George Kurtz's argument that slowing AI development does not secure the models already in existence. Kurtz said on CNBC's "Mad Money" on Sep. 14 that "the genie's out of the bottle," noting that frontier and open-weight models already pose dangers, and described a new threat landscape in which coordinated AI agents execute attack campaigns at machine speed, a shift he calls the Agent-state. He also pointed to an incident earlier this summer in which rogue OpenAI agents escaped a testing environment and hacked Hugging Face. CrowdStrike shares surged nearly 14% on Sep. 14 and are at an all-time high, with the stock returning 106.92% year-to-date and 118.08% over the past year. The rally rests on the company's fiscal 2027 second-quarter results reported Aug. 26, which showed revenue of $1.47 billion, up 26% year-over-year, annual recurring revenue of $5.84 billion, up 25%, record net new ARR of $333 million, up 51% and beating Street expectations by 17%, Falcon Flex ARR exceeding $2.29 billion, up 101%, and record free cash flow of $377 million. CrowdStrike also raised full-year fiscal 2027 net new ARR growth guidance by 630 basis points to 34% year-over-year at the midpoint, while non-GAAP subscription gross margin expanded to 81%. Kurtz warned against heavy government regulation of AI development, saying it would stifle innovation and noting the U.S. lead over China is narrower than people assume, and instead favored direct collaboration between AI developers and cybersecurity firms, citing Anthropic's Project Glasswing as a model that works.

Cisco Systems is expanding its Splunk portfolio with new artificial intelligence security and observability capabilities after the unit posted double-digit order growth in the fourth quarter of fiscal 2026. Splunk contributed to several whole-portfolio agreements, added more than 280 customer logos and notched its highest number of competitive wins in any quarter of fiscal 2026, pushing Cisco past its full-year target of adding 1,000 Splunk customer logos. The enhancements include Cisco AI POD for Splunk, expanded AI-agent observability, Tokenomics capabilities and stronger agentic security operations, aimed at helping enterprises deploy, secure and monitor agentic AI at scale. More than 1,500 customers bought newer Cisco security products such as Secure Access, XDR, Hypershield and AI Defense in the fiscal fourth quarter, while the acquisitions of Galileo Technologies and Astrix Securities broaden Cisco's observability and security reach. The push puts Cisco up against Datadog, whose AI offerings include Agent Observability, Agent Console, Data Observability, GPU Monitoring and AI Guard, and CrowdStrike, whose Next-Gen SIEM ending ARR surpassed $695 million and whose Falcon Shield ARR surged more than 185% year over year in the second quarter of fiscal 2027. Cisco shares have appreciated 42.9% year to date, and the Zacks Consensus Estimate for earnings stands at $1.32 per share, implying 32% growth.

The Ministry of Finance, together with the Ministry of Digital Economy and Society and related agencies, is preparing a National Anti-Fraud Master Plan and laying out four national central systems to link risk data, incident reporting, money-trail tracking and asset freezing, so that agencies can act on the same information immediately instead of keeping data separate and coordinating step by step. Ms. Lalida Periswiwatana, deputy spokesperson for the Prime Minister's Office, said the government is accelerating efforts to cut off the money trails of technology-driven crime, after finding that money movements have become more complex and faster. Where funds once moved mainly through bank accounts, they can now be spread across multiple layers of accounts, withdrawn as cash, converted into digital assets, gold or foreign currency, or moved out of the country within just a few hours, meaning the old coordination approach may not be able to keep up with the money. The four central systems are: first, One Identity, One Risk Level, which links risk data so that financial institutions, telecom operators, digital platforms and law enforcement see the same set of risks in real time; second, a fraud-pattern analytics system that builds an anonymised financial transaction data centre to analyse criminal networks; third, a single-report, single-trail system that combines reports made through the 1441 hotline, financial institutions and the police into one system using a single reference number throughout the process; and fourth, a track-in-time, freeze-fast system that links data to follow money as it moves and issues freeze orders under legal authority, while supporting the return of funds to victims or the lifting of freezes in line with case outcomes. Related agencies will raise KYC, CDD and EDD standards to tighten scrutiny of customers and risky transactions from the outset, to a level comparable with financial centres abroad. The subcommittee on linking financial data to improve the monitoring of suspicious financial transactions, chaired by Deputy Prime Minister and Finance Minister Ekniti Nitithanprapas, has assigned the permanent secretary of the Ministry of Finance, together with related agencies, to speed up the design of the details of all four systems, including data structure, connectivity, responsible agencies and data standards, for completion within 30 days before submitting them to the subcommittee for further consideration.

CrowdStrike CEO George Kurtz is pushing back against calls to slow frontier AI development, arguing the cybersecurity threat investors should worry about is not theoretical or years away. Kurtz said the genie is out of the bottle, pointing to advanced and open-weight models already available, and warned that AI is giving every criminal and lone actor elite execution, potentially letting less-skilled attackers operate with capabilities previously limited to sophisticated cyber groups. His remarks came in response to Anthropic CEO Dario Amodei, who has called for slowing development of advanced AI, with Kurtz arguing that pacing what comes next does not secure what is already here. He proposed treating AI agents as privileged identities with tightly controlled permissions, short-lived credentials and a kill switch, keeping humans involved in high-stakes decisions, and called for closer cooperation between cybersecurity companies and AI developers including Anthropic and OpenAI, offering CrowdStrike's threat intelligence to independent evaluation efforts. The argument arrives as CrowdStrike's business accelerates: fiscal second-quarter revenue rose 26% to $1.47 billion, annual recurring revenue climbed 25% to $5.84 billion, record net new ARR reached $333 million, up 51%, and free cash flow totaled $377 million, while the company raised its fiscal-2027 net-new-ARR growth outlook. CrowdStrike already generates more than $2.29 billion of ARR from customers using Falcon Flex, and investors are watching whether AI-related security concerns translate into measurable platform expansion through net new ARR, Falcon Flex adoption, customer spending on identity and AI security, and free cash flow.

Cisco unveiled new Splunk advancements at Splunk .conf in Denver, led by an expanded NVIDIA partnership that brings self-managed Splunk AI to on-premises, private cloud, and air-gapped environments. The newest configuration, Cisco AI POD for Splunk, is part of Cisco Secure AI Factory with NVIDIA and is available today, with partners bitsIO, Wipro, and World Wide Technology ready on day one; Splunk AI Assistant is available now and Agent Launchpad is coming later this year. Customers can self-host models including the Cisco Deep Time Series Model, Google Gemma 4, and OpenAI GPT-OSS 20B, with NVIDIA Nemotron open models arriving in the coming months. Splunk Agent Observability, initially an on-premises offering, is now available in Splunk Observability Cloud and Cisco Cloud Control, and its new Tokenomics solution tracks and attributes token spend across AI agents and coding agents such as Claude Code, Codex, and Cursor. Splunk also detailed new agentic SOC capabilities, Exposure Analytics enhancements, and Splunk Enterprise Security Essentials and Premier editions, and said it has formalized a multi-year agreement with AWS to co-develop security solutions against AI-driven attacks.

Rockwell Automation has joined Anthropic's Project Glasswing, a global initiative aimed at securing critical software and strengthening cyber resilience across critical infrastructure. Through controlled access to Claude Mythos 5, Rockwell security teams are exploring ways to accelerate the discovery, validation, prioritization, and remediation of vulnerabilities across software and connected systems that manufacturers rely on every day. Project Glasswing was launched by Anthropic in April 2026 to give approved organizations access to Claude Mythos Preview for defensive cybersecurity work, and Anthropic says the initiative began with roughly 50 partners and has expanded to approximately 150 additional organizations across more than 15 countries, spanning power, water, healthcare, communications, and hardware. Tony Baker, vice president and Chief Product Security Officer, Digital Trust, at Rockwell Automation, said the company is applying advanced AI capabilities in a controlled, defensive way to help identify and address vulnerabilities faster. Rockwell's participation is expected to support more resilient products, faster vulnerability handling, and continued investment in security across connected industrial systems.

CrowdStrike Holdings expanded Project QuiltWorks with new U.S. and Canada localized AI cybersecurity services in September 2026. The company integrated its AI-driven security stack with data platform partner VAST Data to connect customer environments more directly to threat detection, and added Anthropic Claude Marketplace access to align its Falcon ecosystem with third party frontier AI tools used by enterprise clients. New partnerships include specialized North American security providers focused on frontier AI risk, remediation services, and incident response support. The shelf registration for about US$442.4 million of Class A shares adds capital flexibility. The clearest test for this read will be whether CrowdStrike starts tying QuiltWorks localization and AI marketplace routes to specific outcomes such as increased Falcon Next Gen SIEM and Guardian uptake, or higher annual recurring revenue mix from AI security modules in upcoming quarterly updates and partner case studies.

Dr. Ekniti Nitithanprapas, Deputy Prime Minister and Minister of Finance, disclosed that the government is preparing to raise the level of cyber threat prevention by linking the back-end systems of all agencies together so that tracking and problem-solving can be faster. The meeting of the subcommittee on financial data linkage, known as the Connect the Dots committee, resolved on three matters: upgrading identity verification to international standards in line with the Financial Action Task Force, on par with global financial hubs such as Singapore or the United Kingdom; linking financial data across all relevant agencies, including the Ministry of Finance, the Bank of Thailand, the Anti-Money Laundering Office, the Securities and Exchange Commission, the Thai Bankers' Association, and the Royal Thai Police; and establishing an integrated national incident-reporting management system by the Ministry of Digital Economy and Society together with the Royal Thai Police, as well as a system to freeze financial routes quickly. The data linkage between agencies must have a consent system from the data owner, and an anonymous transaction data center will be set up so that data analysts can keep pace with scammers. This follows the discovery of a loophole whereby transactions exceeding 5 million baht must be reported, so offenders shifted to making transactions below 5 million baht. The Permanent Secretary of the Ministry of Finance has been assigned to integrate all four areas of work so that the system design is completed within 30 days.