Actionable insights — Cybersecurity's AI Moment

1. Separate one-time deal noise from the operating business

1. When a headline operating loss/profit looks shocking, check whether the company recently closed an acquisition — deals inject large non-cash and one-time charges into the income statement.
2. Back out intangible amortization (writing down the value assigned to acquired tech/brand) and deal costs (bankers, lawyers, integration) — these are accounting artifacts of the purchase, not the run-rate business.
3. Cross-check against cash flow, which the deal noise doesn't distort the same way — if free cash flow is strong while GAAP profit is ugly, the business is fine and the headline is misleading.

• Any post-acquisition quarter where GAAP losses and record cash flow point opposite directions — read the cash, not the headline.

2. Use organic growth to confirm an acquisition isn't masking a slowdown

1. When total growth is inflated by an acquisition, hunt for the organic (ex-deal) growth figures — companies disclose them precisely so you can isolate the underlying business.
2. Check that the core recurring metrics (ARR, RPO/backlog) are still compounding strongly before the acquired revenue is added.
3. If organic growth is healthy, the deal is additive; if it's weak, the acquisition is papering over a decelerating core.

• A widening gap between headline and organic growth, or organic growth quietly decelerating quarter over quarter under a busy M&A program.

3. Read net-new ARR as the truest momentum gauge — not ending ARR

1. For a subscription business, separate ending ARR (the whole installed base) from net-new ARR (the fresh recurring revenue added this quarter).
2. Lean on net-new ARR for momentum: ending ARR is a large, slow base that masks turns, while net-new ARR shows how fast new business is landing now.
3. Adjust for seasonality — a record set in a seasonally weak quarter is a stronger signal than the same figure in a strong one.

• Net-new ARR rolling over even while ending ARR keeps climbing — the earliest sign growth is fading beneath a still-growing base.

4. Score the consolidation flywheel — commit, spend, re-commit

1. For a multi-module platform, look for the "land a budget, spend across modules, re-commit a bigger budget" loop — and measure each stage (accounts on the program, % that re-commit, uplift per re-commit).
2. Read net-retention >120% and single-digit churn as evidence the platform is sticky and customers expand rather than leave.
3. Note the trade-off: discounts/commitments buy stickier, longer multi-year relationships — judge the program on expansion (uplift), not headline discount.

• Slowing re-commit rates or shrinking per-customer uplift — the flywheel losing speed even as logo counts rise.

5. Diagnose "beat-and-raise-but-sell" as an expectations problem, not a results problem

1. When a stock falls on a clean beat-and-raise, separate the results (good) from the expectations already in the price.
2. Check the run-up into earnings — a 50–60% rally means investors pre-paid for a great print, so even an excellent one can't surprise higher.
3. Anchor on valuation (e.g. forward EBITDA multiple) to gauge how much perfection is priced in, and treat the sell-off as a re-rating of expectations rather than a business deterioration.

• Large pre-earnings rallies plus stretched multiples — the setup where good news is "not good enough" and the stock sells the news.

6. Read management buying its own dip as a conviction signal

1. During a broad sector sell-off, watch whether the company aggressively buys back its own stock at the depressed price — and how large the buy is relative to the dip.
2. Treat a sizable, opportunistic buyback into panic as a "put your money where your mouth is" tell — distinct from steady programmatic repurchases.
3. Compare the buy price to the later market price to size the conviction (and the gain).

• Outsized opportunistic buybacks or insider buying during a sector panic — a signal management sees the sell-off as mispricing, not a fundamental break.