This page covers the downstream AI workload layer: software, data, observability, security, workflow, customer-application, and edge-network platforms that turn AI infrastructure usage into paid enterprise work. The layer sits after the cloud and data-center buildout. Customers first rent compute, storage, network, and model capacity; this node asks whether that activity becomes product revenue, annual recurring revenue, remaining performance obligation, net retention, large-customer expansion, gross margin, and free cash flow for software vendors. PLTR has the clearest direct operational AI bridge; SNOW and DDOG carry the data and observability workload route; CRWD and PANW carry the security-platform route; MDB, NOW, NET, CRM, and ZS still belong, but each needs cleaner proof that AI, cloud, or security usage improves organic revenue and per-share economics.
What the stack is: the stack is the software and security layer above AI infrastructure. It includes data warehouses, operational databases, observability tools, endpoint and cloud security, zero-trust access, workflow systems, customer-data applications, developer platforms, and edge networks.
What it does in the theme: it tests whether the chips, cloud capacity, networking, storage, and power used for AI workloads become recurring software demand rather than only higher upstream capex.
Main operating pieces: product revenue, subscription revenue, annual recurring revenue (ARR), remaining performance obligation (RPO), current RPO (cRPO), net revenue retention (NRR), large-customer count, module adoption, product gross margin, stock-based compensation, and free cash flow.
Where it sits: it sits in customer workflows, cloud control planes, developer databases, telemetry pipelines, security operations centers, identity and access paths, customer systems of record, and edge-network services.
How AI infrastructure uses it: training and inference workloads create data movement, monitoring, security, governance, application, and workflow needs. The node gets paid when those needs become contracted subscriptions, consumption revenue, higher retention, or cash flow.
Terms used later: ARR means recurring subscription run-rate; RPO is contracted revenue not yet recognized; cRPO is the near-term portion; NRR measures existing-customer expansion net of contraction; FCF is operating cash flow after capital spending.
Report boundary: this node is a tactical report layer. It ranks the current paid-workload basket, confirmation triggers, invalidation checks, and chart provenance. Durable research, claim IDs, raw source registries, and sector thesis maintenance stay in the linked knowledge pages. Price and volume context comes from read-only discovery daily_ohlc through 2026-06-12, while stale static thresholds from the completed 2026-06-05 week remain reference-only until refreshed.
Current Setup
Workload monetization testAI demand is investable here only when usage reaches reported software economics.
Rank order follows disclosed revenue, ARR, RPO, retention, customer expansion, margin, and FCF evidence before chart timing. The current setup is strongest where the company names the workload and the cash conversion path.
Reported proofPLTR, SNOW, DDOG, CRWD, and PANW have the clearest current bridge.
They report direct AI workflow, product revenue, ARR, RPO, module, or security-platform evidence.
Conversion gateUsage must become renewal quality and per-share cash.
Watch NRR, cRPO, product gross margin, SBC, cloud cost, acquired growth, and FCF per share.
Primary constraintDisclosure gaps remain wide.
Most names still do not isolate AI workload revenue, AI gross margin, or full organic contribution.
Demand sourceAI + cloud workloads
Software layerData, security, workflow
Reported proofRevenue, ARR, RPO
Equity testMargin, FCF, dilution
AI capex is easier to fund when downstream workloads become recurring software, data, security, and workflow economics. The measured signals are product revenue, ARR, RPO or cRPO, net revenue retention, large-customer expansion, module or seat adoption, gross margin, SBC, and FCF per share. Hyperscaler budget growth stays in the neighboring capex node; this page tests whether the usage those budgets support becomes billable work for software and security vendors.
The expanded basket now has current company evidence beyond the old PLTR, PANW, and CRWD set. PLTR reported Q1 2026 revenue of $1.633B, up 85%, U.S. commercial revenue up 133%, GAAP operating margin of 46%, and RPO of $4.5B. SNOW reported Q1 FY2027 product revenue of $1.334B, up 34%, net revenue retention of 126%, 779 customers above $1M of trailing product revenue, and RPO of $9.21B. DDOG reported Q1 2026 revenue of $1.006B, up 32%, about 4,550 customers above $100K ARR, operating cash flow of $335M, and FCF of $289M. CRWD and PANW both have post-node security evidence, with CRWD reporting Q1 FY2027 ARR of $5.51B and FCF of $468.5M, and PANW reporting Q3 FY2026 NGS ARR of $8.1B and RPO of $18.4B.
The setup weakens when AI product language fails to show up in renewal quality, usage revenue, organic ARR, RPO conversion, gross margin, or per-share cash flow. SNOW, DDOG, NET, and MDB still do not disclose full AI workload revenue and product-level margin economics. PANW, NOW, CRM, and ZS need clean acquired-versus-organic bridges. CRWD still carries incident, legal, trust, SBC, and valuation checks. PLTR has the clearest direct AI revenue bridge, but the stock still trades below its 20W EMA and the valuation requires continued execution.
Right-rail charts now read local daily_ohlc through 2026-06-12. The static setup thresholds previously stored from the completed 2026-06-05 weekly bar are stale and must be refreshed before they are used as current trading evidence. Fundamental claims route to the knowledge theme page, sector lanes, linked security lanes, and official company checks listed in the Source Trail.
Basket
This basket is hand-curated from the parent theme's expanded software and security workload route and the linked knowledge lanes. Ranking prioritizes source-backed evidence that AI and cloud workloads become revenue, ARR, RPO or cRPO, retention, margin, and FCF, then source completeness and technical timing. MSFT, GOOGL, AMZN, META, and CRWV remain adjacent references for hyperscaler budget and AI-cloud capacity nodes. RBRK, DT, ESTC, GTLB, S, ADBE, and TEAM stay watch-only until durable local lanes support full ranking.
Operational AI software has the cleanest revenue and margin bridge in the basket.
Market cap$330B
Next earningsNot confirmed
Latest qtr revenue$1.633B
Role in stack
Palantir sells AIP, Gotham, Foundry, and Apollo into commercial and government workflows where customers need governed data, models, and decisions deployed in operations. Theme pressure becomes revenue when AIP deployments convert into recognized software revenue, RPO, margin, and FCF.
Revenue mix
Q1 2026 revenue was 52.6% government and 47.4% commercial; U.S. revenue was about 79% of total revenue. The lane does not disclose customer-level AIP revenue economics.
Latest qtr revenue
Q1 2026 total revenue was $1.633B, up 85%, sourced from the PLTR lane and Q1 2026 Form 10-Q. RPO was $4.5B and GAAP operating margin was 46%.
Governed data and AI consumption make Snowflake the strongest data-platform workload route.
Market cap$52.7B
Next earningsNot confirmed
Latest qtr revenue$1.391B
Role in stack
Snowflake sells a consumption platform for compute, storage, data transfer, Cortex, Snowflake Intelligence, and governance. AI infrastructure demand matters when customer production workloads lift product revenue, NRR, RPO, large-customer spend, product gross margin, and FCF.
Revenue mix
Q1 FY2027 product revenue was $1.334B, about 96% of total revenue, while professional services and other revenue was small. Product revenue is the best workload signal.
Latest qtr revenue
Q1 FY2027 total revenue was $1.391B and product revenue was $1.334B, sourced from the SNOW lane and Q1 FY2027 SEC earnings exhibit.
AI and cloud complexity turn into observability, security, and large-customer ARR evidence.
Market cap$71.2B
Next earningsNot confirmed
Latest qtr revenue$1.006B
Role in stack
Datadog sells infrastructure monitoring, logs, APM, GPU monitoring, security, and reliability tools to engineering, security, and platform teams. Workload growth converts through usage-sensitive subscription revenue, large-customer ARR, retention, margin, and FCF.
Revenue mix
Datadog reports a unified platform rather than separate AI, GPU, observability, and security revenue lines. Large customers represented about 90% of ARR in the latest lane.
Latest qtr revenue
Q1 2026 total revenue was $1.006B, up 32%, sourced from the DDOG lane and Q1 2026 results release. Q1 FCF was about $289M.
Falcon ARR, module adoption, and FCF make CrowdStrike a direct AI-era security route.
Market cap$134B
Next earningsNot confirmed
Latest qtr revenue$1.386B
Role in stack
CrowdStrike sells Falcon subscriptions, modules, Flex commitments, endpoint, cloud, identity, SIEM, and AI-security tools. The conversion path is ARR, net-new ARR, module adoption, retention, trust, and FCF.
Revenue mix
Q1 FY2027 subscription revenue was $1.321B, or about 95% of total revenue. CrowdStrike reports one segment, so module-level economics are not separately disclosed.
Latest qtr revenue
Q1 FY2027 total revenue was $1.386B, sourced from the CRWD lane and Q1 FY2027 results release. ARR was $5.51B and Q1 FCF was $468.5M.
Security platformization gives PANW scale, but acquired growth must be separated from organic proof.
Market cap$169B
Next earningsNot confirmed
Latest qtr revenue$3.002B
Role in stack
Palo Alto sells network security, SASE, cloud security, SOC automation, identity, observability, and AI-security tools. The economics show up in NGS ARR, RPO, platformized customers, subscription/support revenue, and adjusted FCF.
Revenue mix
Q3 FY2026 subscription/support was $2.408B, about 80% of revenue, and product was $594M. CyberArk and Chronosphere make organic versus acquired growth central.
Latest qtr revenue
Q3 FY2026 total revenue was $3.002B, sourced from the PANW lane and Q3 FY2026 results release. NGS ARR was $8.1B and RPO was $18.4B.
Atlas is the developer database route for production application and AI workloads.
Market cap$24.1B
Next earningsNot confirmed
Latest qtr revenue$687.6M
Role in stack
MongoDB sells Atlas, Enterprise Advanced, vector search, and application data infrastructure to developers and enterprises. The conversion mechanism is Atlas usage, subscription revenue, RPO, operating leverage, and cash flow.
Revenue mix
Q1 FY2027 subscription revenue was $666.1M, about 97% of revenue. Atlas was 73% of FY2026 revenue and grew more than 29% in Q1 FY2027.
Latest qtr revenue
Q1 FY2027 total revenue was $687.6M, sourced from the MDB lane and Q1 FY2027 SEC earnings exhibit. RPO was $1.459B.
Workflow AI and governance have scale, but Armis makes organic and margin bridges important.
Market cap$94.0B
Next earningsNot confirmed
Latest qtr revenue$3.770B
Role in stack
ServiceNow sells workflow, AI governance, Now Assist, security, data fabric, and automation products to enterprises. AI demand converts through subscription revenue, cRPO, RPO, renewal quality, large-customer ACV, margin, and FCF.
Revenue mix
Q1 2026 subscription revenue was $3.671B, or 97% of total revenue. Professional services and other was small and margin-dilutive; Armis adds security exposure and acquisition costs.
Latest qtr revenue
Q1 2026 total revenue was $3.770B, sourced from the NOW lane and Q1 2026 results release. RPO was $27.7B and non-GAAP FCF was $1.665B.
Cloudflare routes AI traffic, security, Workers, and edge workloads through one global network.
Market cap$69.3B
Next earningsNot confirmed
Latest qtr revenue$639.8M
Role in stack
Cloudflare sells security, zero trust, Workers, developer platform, network services, and AI-adjacent traffic handling. The conversion mechanism is revenue, DBNR, RPO, large-customer growth, gross margin, and FCF.
Revenue mix
Cloudflare reports one segment, so Workers, AI, security, and network-service economics are not separately disclosed. Q1 revenue was 70% direct and 30% channel.
Latest qtr revenue
Q1 2026 total revenue was $639.8M, sourced from the NET lane and Q1 2026 results release. RPO was $2.54B and DBNR was 118%.
Agentforce and Data 360 can turn AI into CRM workflows, but organic conversion is still the gate.
Market cap$149B
Next earningsNot confirmed
Latest qtr revenue$11.133B
Role in stack
Salesforce sells Agentforce, Data 360, Slack, Tableau, MuleSoft, and Informatica-linked workflows. The economics depend on organic subscription growth, cRPO, RPO, AI ARR or work-unit disclosure, operating margin, and FCF after interest.
Revenue mix
Q1 FY2027 subscription/support was $10.593B, about 95% of total revenue. Informatica contribution affects growth comparability and must be separated from organic Agentforce/Data 360 conversion.
Latest qtr revenue
Q1 FY2027 total revenue was $11.133B, sourced from the CRM lane and Q1 FY2027 results release. cRPO was $33.6B and total RPO was $67.9B.
Zscaler remains the zero-trust route, but FY2027 growth and FCF quality need confirmation.
Market cap$24.5B
Next earningsNot confirmed
Latest qtr revenue$850.5M
Role in stack
Zscaler sells enterprise access, data, browser, zero-trust, and AI-security controls. Theme pressure converts into ARR, RPO, large-customer expansion, and FCF only if organic ARR stabilizes after Red Canary and sales execution holds.
Revenue mix
Zscaler is subscription-led and reports one segment. Subscription/support was about 98% of revenue; Red Canary adds acquired ARR that must be separated from organic growth.
Latest qtr revenue
Q3 FY2026 total revenue was $850.5M, sourced from the ZS lane and Q3 FY2026 results release. ARR was $3.525B, with 21% growth excluding Red Canary.
Market caps use read-only local discovery instruments.market_cap queried on 2026-06-13. Nasdaq earnings pages were checked on 2026-06-13 and returned no available earnings-date field for the basket tickers, so every next-earnings tile is marked Not confirmed. Revenue figures are latest reported quarterly total revenue, with source periods and official-source routes listed in each card and the Source Trail.
What Confirms Or Weakens
AreaWhat confirmsWhat weakens or invalidatesWatch next
01Node thesisUsage becomes economics
What confirms
The 10-name basket keeps turning AI and cloud workload growth into product revenue, ARR, RPO or cRPO, retention, margin, and FCF.
What weakens or invalidates
Growth comes from one-time deployments, bundled AI features, acquired revenue, customer pull-forward, or lower-margin usage without durable renewal quality or cash conversion.
Watch next
PLTR AIP and RPO
SNOW product revenue and NRR
DDOG large-customer ARR
CRWD and PANW ARR/RPO
02Economics mechanismRevenue reaches owners
What confirms
Workload evidence reaches owner economics through GAAP margin, product gross margin, FCF, adjusted FCF, FCF per share, and lower SBC intensity.
What weakens or invalidates
Gross margin falls, SBC absorbs FCF, acquired growth hides organic slowdown, incident or legal costs rise, or AI usage carries higher infrastructure cost than pricing can recover.
Customers optimize consumption, delay projects, bundle AI features without paying more, or shift workloads to hyperscaler-native tools and cheaper substitutes.
Watch next
SNOW NRR
DDOG customers over $100K ARR
NOW renewal and cRPO
ZS large ARR customers
04Funding and balance sheetCash conversion
What confirms
Cloud commitments, acquisition funding, debt, convertibles, and capacity costs remain covered by operating cash flow, renewal quality, and customer expansion.
What weakens or invalidates
Cloud commitments, security incidents, acquisition debt, convertible maturities, workforce reductions, or AI infrastructure costs weaken cash conversion or execution capacity.
Watch next
PLTR cloud commitments
PANW integrations
NOW Armis debt
NET 2026 notes
CRWD incident follow-through
05Policy and operating constraintSecurity and AI governance
What confirms
Security, governance, compliance, observability, and workflow controls remain funded as AI workloads move into production environments.
What weakens or invalidates
Enterprise AI projects fail ROI checks, regulatory or security incidents disrupt trust, or platform consolidation shifts economics to hyperscalers and larger suites.
Watch next
AI governance budgets
Security renewal rates
Product trust incidents
Cloud optimization commentary
06Stale conditionRefresh trigger
What confirms
Discovery daily_ohlc remains current, linked lanes cover the latest filings and earnings, and API-backed charts stay separated from operating claims.
What weakens or invalidates
A new trading week, 10-Q, earnings release, ARR disclosure, acquisition update, guidance revision, split adjustment, or source-lane refresh arrives before this page is updated.
Watch next
Refresh discovery coverage
Refresh chart assumptions
Refresh source lanes
Update report metadata
Source Trail
Canonical Thesis
AI Capex Cycle defines the capex-to-cash test and routes this node to downstream software, data, observability, security, workflow, and edge monetization.
Enterprise AI Software ROI frames whether AI software spend becomes measurable workflow savings, revenue, retention, margin, or FCF.
Information Technology supports the cloud, software, security, data-center systems, and AI infrastructure demand route.
Communication Services supports the ad-funded platform context for GOOGL and META and the capex scrutiny around AI infrastructure.
Core Knowledge Lanes
PLTR supports AIP, Gotham, Foundry, U.S. commercial growth, U.S. government growth, RPO, margin, guidance, and cloud-service commitment checks.
SNOW supports product revenue, consumption-model economics, NRR, RPO, large-customer spend, Cortex, Snowflake Intelligence, AI account usage, and product gross-margin checks.
DDOG supports observability, security, GPU monitoring, large-customer ARR, retention, operating cash flow, FCF, and AI workload disclosure gaps.
CRWD supports subscription mix, ARR, net-new ARR, module adoption, Falcon Flex, FCF, SBC, split timing, and July 19 incident follow-through.
PANW supports NGS ARR, RPO, subscription and support mix, FCF, CyberArk and Chronosphere integration questions, and per-share economics.
MDB, NOW, NET, CRM, and ZS support the database, workflow, edge, agentic SaaS, and zero-trust parts of the expanded basket.
Official Current Checks
PLTR Q1 2026 Form 10-Q and the local PLTR lane support the Q1 revenue, government/commercial mix, RPO, margin, guidance, and cloud-commitment checks.
CRWV is the AI-cloud capacity and financing reference. Its local price history is too short for the full three-year and 100W EMA chart package used here.
The chart API reads daily_ohlc from the local discovery store and returns weekly packages using first open, maximum high, minimum low, final close, and summed volume.
Read-only DuckDB coverage on 2026-06-13 showed local daily_ohlc rows through 2026-06-12 for PLTR, SNOW, DDOG, CRWD, PANW, MDB, NOW, NET, CRM, and ZS. Each ticker had 1,278 local daily rows from 2021-05-12 through 2026-06-12.
PLTR, SNOW, DDOG, CRWD, PANW, MDB, NOW, NET, CRM, and ZS all have enough local history for 20W and 100W EMA calculations. RBRK has coverage from 2024-04-25 and remains watch-only, so it is not charted here.
Charts show 20W EMA, 100W EMA, weekly volume, and 20W average volume. The selected-security chart API route is /api/securities/TICKER/chart?frequency=weekly&window=3y&as_of=latest, and the right rail should display tickers in basket rank order.
The existing static threshold references were calculated from the completed 2026-06-05 weekly bar. Because API-backed chart data is newer than those thresholds, refresh the weekly levels before using them as current trading evidence.
Parent expanded-basket metadata records 5,274 active common stocks and 4,991 active common stocks with at least 64 daily bars and latest parent OHLC coverage through 2026-06-05.
Basket Data And Earnings-Date Checks
Market caps use read-only local discovery instruments.market_cap queried on 2026-06-13: PLTR $330B, SNOW $52.7B, DDOG $71.2B, CRWD $134B, PANW $169B, MDB $24.1B, NOW $94.0B, NET $69.3B, CRM $149B, and ZS $24.5B.
Latest-quarter revenue fields use the official-release and SEC routes listed above plus the linked security lanes: PLTR Q1 2026 $1.633B; SNOW Q1 FY2027 $1.391B; DDOG Q1 2026 $1.006B; CRWD Q1 FY2027 $1.386B; PANW Q3 FY2026 $3.002B; MDB Q1 FY2027 $687.6M; NOW Q1 2026 $3.770B; NET Q1 2026 $639.8M; CRM Q1 FY2027 $11.133B; ZS Q3 FY2026 $850.5M.
Nasdaq earnings pages for PLTR, SNOW, DDOG, CRWD, PANW, MDB, NOW, NET, CRM, and ZS were accessed on 2026-06-13. Each page returned no available earnings-date field, so next-earnings dates are marked Not confirmed rather than estimated from cadence.
Local knowledge lanes contain expected cadence notes for several names, but those notes were not promoted into confirmed card dates because the bounded web check did not return a current credible date field.
Known Gaps
PLTR does not disclose customer-level AI workload economics, customer concentration, or per-deployment return data in the local lane.
SNOW, DDOG, MDB, NOW, NET, CRM, and ZS do not disclose complete AI workload revenue, AI attach, product-level gross margin, or per-share AI economics.
PANW still needs a clean organic-versus-acquired bridge after CyberArk and Chronosphere, plus FCF per-share confirmation.
CRWD's July 19 incident, legal, trust, SBC, valuation, and upcoming split-adjustment questions remain live despite strong Q1 FY2027 results.
RBRK, DT, ESTC, GTLB, S, ADBE, and TEAM are watch-only because this workspace lacks durable local security lanes for them.
Discovery supports price, volume, weekly OHLC, EMA, and coverage facts only; operating-cause claims require a filing, earnings release, customer disclosure, or source-lane update.