Price cutoff: Monday, August 17, 2026 at the 4:00 p.m. ET U.S. regular-session close.
Research cutoff: Tuesday, August 18, 2026 before the U.S. open.
Trade horizon: roughly 1–15 U.S. trading sessions.
Execution note: premarket moves do not count as confirmation.

Today's answer: no clean catch-up buy

The catch-up screen got harder overnight, not easier.

Fortinet (FTNT) is still the only unresolved setup I want on the active watchlist, but Monday pushed it right down to the edge of its invalidation zone. F5 (FFIV) is out for now after closing below the level that was supposed to hold. L3Harris (LHX) is also out, but for a completely different reason: a fresh CEO conduct investigation is a company-specific event, which means its relative weakness can no longer be treated as a clean peer lag.

That leaves a short list — deliberately.

Tuesday's macro backdrop also argues against front-running anything. Reuters reported S&P 500 futures down roughly 0.5% and Nasdaq futures down roughly 1.2% before the open as renewed U.S.-Iran tension pushed oil and long-dated Treasury yields higher. Nvidia and several other high-duration technology names were weak premarket. In this strategy, that is a reason to demand better confirmation, not a reason to lower the bar.

NYSE trading floor

Screen status at a glance

NameMonday closeGenuine relationshipStatusWhat I need next
FTNT$155.85Cybersecurity vs. CIBR / PANW / CRWD / CSCOWatch onlyRegular-session close above $165.75, then another session holding the reclaim with real peer outperformance; stronger above $168–$169
FFIV$395.54App/API security vs. CIBR and enterprise-security peersRejected for nowFirst rebuild $405–$410; only then does the old $420–$424 reclaim matter again
LHX—Defense vs. ITA / major U.S. defense primesRejectedFresh CEO-conduct event now explains part of the relative move
CAT$881.65Heavy equipment/capex vs. DeereToo late for a fresh laggard entryMonday's +2.93% versus Deere's -1.47% is already the catch-up happening
AMD—Semiconductors vs. SOX / AI-chip peersRejectedFresh $4–$5B debt financing makes the divergence event-driven rather than clean

I am not adding weaker names just to produce a three- or five-stock list. There is no clean buy today.

Relative performance: the medium-window gap is still real

The last fully cross-checked CIBR multi-window table is through the Friday, August 14 close. Negative means the candidate underperformed the cybersecurity benchmark.

Pair1 session3 sessions5 sessions10 sessions20 sessions
FTNT minus CIBR-0.74 pp-0.84 pp-1.56 pp-9.66 pp-8.83 pp
FFIV minus CIBR-0.53 pp-2.29 pp-1.05 pp-8.30 pp-9.28 pp

Why keep Friday's verified benchmark table instead of manufacturing a prettier Monday one? First Trust's public historical-price page available in this research pass had not yet populated the August 17 row. I would rather show an explicitly dated, reproducible table than pretend a scraped quote is exact.

Monday is still highly informative because we can compare the stocks directly with named peers:

  • FTNT fell 2.60% to $155.85. Cisco rose 1.09%, CrowdStrike fell 1.41%, and Palo Alto Networks fell 2.21%. Fortinet was therefore weaker than all three direct peers in that comparison.
  • FFIV fell 1.90% to $395.54, its third consecutive decline, and closed below the roughly $400 invalidation used in the previous screen.
  • A secondary ETF-mover feed put CIBR down about 2.5% Monday. I use that only as a directional cross-check, not as the source for the multi-window arithmetic above.

That distinction matters. A laggard can appear to show “relative strength” on a bad sector day merely because its benchmark falls faster. That is not the catch-up signal we are trying to buy.

The seven-session audit changed one rule again

I walked the current decision logic across the prior seven completed U.S. sessions — August 7, 10, 11, 12, 13, 14 and 17 — using only information that would have been available at each cutoff.

The most useful sequence remains Fortinet:

  • The large peer gap was visible early in the window, but price confirmation was absent.
  • On August 13, FTNT finally produced the kind of one-day bounce that the old, looser version of this strategy could have mistaken for a turn.
  • On August 14, it fell 3.28% and broke that first bounce.
  • On August 17, it fell another 2.60% and underperformed several direct cybersecurity peers.

The two-session confirmation rule did its job. But Monday exposed another failure mode worth fixing: relative outperformance caused by benchmark weakness can look better than it really is.

So the screen now requires both relative and absolute confirmation. A candidate must:

  1. Have a real economic, operating or historical relationship with the comparison asset.
  2. Show a meaningful divergence across more than one useful window.
  3. Have intact fundamentals — no guidance cut, dilution shock, balance-sheet problem, material legal/product issue or obvious structural deterioration explaining the lag.
  4. Have a credible catalyst or improving estimate backdrop.
  5. Retain a fresh five- or 10-session gap; an old 20-session gap on its own is not enough.
  6. Close through a predefined reclaim level.
  7. Hold that reclaim into a second regular session with continued relative strength.
  8. Also show absolute stabilization. If the benchmark is falling, “falling less” does not count unless the candidate is reclaiming its own price structure.
  9. Once a stock closes through the stated invalidation, it leaves the active candidate list until it rebuilds the structure.

That last rule is why FFIV is no longer being carried forward as if nothing happened.

I am deliberately not publishing a raw hit rate from a seven-session sample. The audit is useful for killing bad rules and tightening execution; it is not large enough to justify fake precision.

1. Fortinet: still interesting fundamentally, but now sitting on the line

Why the relationship is genuine

CIBR directly owns Fortinet alongside Palo Alto Networks, CrowdStrike, Cisco and F5. These companies compete for overlapping enterprise-security budgets and benefit from the same broad increase in security spending around cloud infrastructure, SASE, AI workloads and AI-driven attack surfaces.

Fortinet's own business is not giving us an obvious “broken company” explanation for the lag. Its second quarter produced $2.05 billion of revenue, up 26% year over year, product revenue of $773 million, up 52%, and billings of $2.37 billion, up 33%. Management raised its 2026 revenue-growth outlook to roughly 19%.

There is also a fresh catalyst. Fortinet has acquired Virtue AI, a company focused on testing and securing AI systems and agents. It follows a series of security acquisitions as Fortinet builds out a broader cloud and AI-security platform.

That is enough to keep FTNT on the watchlist. It is not enough to buy a falling chart.

What Monday told us

Monday was bad evidence for the catch-up thesis.

FTNT lost 2.60% to $155.85, its second straight decline. It also underperformed Cisco, CrowdStrike and Palo Alto Networks in MarketWatch's peer comparison. Volume was below its 50-day average, so there was no high-volume capitulation/reversal signal to lean on either.

The stock is now barely above the old $154–$155 invalidation area. I am not moving that level lower just because the price got close to it.

ItemFTNT plan
Observation zoneRoughly $154–$158
First reclaimRegular-session close above $165.75
Better confirmationSecond regular session holding the reclaim while beating the cybersecurity group; stronger above $168–$169
InvalidationSustained close below roughly $154–$155
Likely catalystsVirtue AI integration, continued Q2 estimate support, SASE/firewall demand, AI-security spending
Main risksRich valuation, preference for PANW/CRWD, broad tech multiple compression, continued relative selling despite strong fundamentals

Analyst, news and community temperature

Analysts remain constructive but far from unanimous. Bank of America raised its price target to $200 with a Buy rating before the quarter, while other recent analyst trackers show a much wider spread of opinions. That disagreement is useful: strong execution is recognized, but valuation is still the argument.

Investor-community discussion is split in the same way. Recent value-investing threads often praise Fortinet's margins and security franchise while questioning whether the valuation is justified relative to faster-growing peers such as CrowdStrike and broader platforms such as Palo Alto. I treat that as sentiment context, not evidence.

Verdict: FTNT is the only active conditional watch today, but I would rather miss the first few dollars of a genuine reversal than buy another failed bounce. The stock has to earn back the mid-$160s.

2. F5: fundamentals are intact, but the setup failed its own rule

This is exactly why invalidation levels exist.

F5's latest quarter was strong: revenue reached $865 million, up 11%, product revenue grew 19%, and management raised fiscal-2026 revenue-growth guidance to roughly 9%–10% from 7%–8%. Post-earnings analyst targets also remained mixed but often constructive, including $515 at JPMorgan, $461 at Piper Sandler and $415 at Morgan Stanley, while other firms stayed materially more cautious.

None of that changes Monday's price action.

FFIV fell 1.90% to $395.54, its third consecutive decline, pushing below the roughly $400 level that this report had already defined as invalidation. Once the setup breaks the line we said mattered, the correct move is not to quietly redraw the line.

ItemFFIV reset plan
Current statusRejected from active catch-up list
First rebuild areaRegain roughly $405–$410
Original reclaim zoneOnly becomes relevant again around $420–$424
What would restore the thesisAbsolute price repair plus renewed outperformance versus cybersecurity peers
Why fundamentals alone are insufficientStrong earnings have already been known for weeks; price is still refusing to confirm them

Verdict: I still like the fundamental mismatch as research, but the trade setup is gone for now.

Why I rejected the tempting alternatives

A good catch-up screen should spend as much time explaining what not to buy as what to buy.

Rejected setupWhy it fails today
LHX vs. defense/ITACEO Christopher Kubasik left after a board investigation found conduct inconsistent with the company's code. L3Harris says the issue did not affect financial reporting, operations or customer relationships and reaffirmed its outlook, but this is still a fresh company-specific event. The lag is no longer “clean.”
CAT vs. DeereMonday CAT rose 2.93% while Deere fell 1.47%. That is the relative catch-up already happening. Buying it now would turn a “before the jump” strategy into a chase.
AMD vs. semiconductorsThe semiconductor index rose Monday while AMD lagged, but AMD is in the middle of a roughly $4–$5 billion debt offering. That capital-structure event gives the market a company-specific reason to trade it differently.
OXY vs. stronger energy namesOccidental has strong Q2 cash flow and debt reduction, but Monday's relative difference versus energy peers was not large or persistent enough across the useful windows to qualify as a clean dislocation.

Tuesday's market gate: this is a bad morning to lower standards

The broader U.S. setup is risk-off before the bell. Reuters reported fading hopes for a U.S.-Iran peace agreement lifting crude oil and Treasury yields, with the 30-year yield at its highest level since 2007. S&P 500 futures were down roughly 0.47% and Nasdaq futures roughly 1.21% in the early report.

That matters to FTNT because a high-duration technology stock can be dragged around by rates and risk appetite even when its operating story is good. I do not want to confuse a macro rebound later in the day with company-specific catch-up unless FTNT also starts taking back ground from its security peers.

What I would actually watch after the open

For FTNT, the sequence is simple:

  • Below $154–$155: the current setup is rejected.
  • Between roughly $155 and $165.75: research/watch territory, not confirmation.
  • Close above $165.75: first useful repair.
  • Second session holding the reclaim while beating the cyber group: now the catch-up thesis becomes materially more interesting.
  • Above $168–$169 with healthy breadth: the failed-bounce structure is much closer to being repaired.

For FFIV, I am no longer looking for a direct $420 breakout from here. It first needs to show that Monday's break was not the start of a deeper reset by rebuilding $405–$410.

That may feel annoyingly patient. That is the point. The entire edge we are trying to capture is buying a temporary lag before a genuine relationship closes — not buying every stock that happens to be down more than its peers.

Sources

This report is market research, not individualized financial advice. Relative-value relationships can stay disconnected far longer than expected, especially around earnings, geopolitical shocks and rate moves.

Written and reviewed by /lico

Just writing down my thoughts, interests, and the things I learn along the way.