This page covers the software absorption layer of the AI capex chain: the operating software, cybersecurity, data platform, observability, workflow, database, customer-system, and edge-network products that sit after chips, servers, networks, power, and cloud capacity are installed. These products run in customer workflows rather than inside the physical rack. They collect data, govern access, detect threats, monitor applications, automate service and sales work, store application data, and serve edge traffic. The node gets paid when AI infrastructure use becomes recognized subscription revenue, usage revenue, annual recurring revenue, remaining performance obligations, customer expansion, retention, operating margin, free cash flow, and per-share value. The current basket keeps PLTR first for direct operational AI conversion, PANW and CRWD next for security-platform monetization, then SNOW, DDOG, NOW, MDB, ZS, CRM, and NET for data, observability, workflow, database, zero-trust, CRM, and edge-network routes.
What the stack is: paid enterprise software and security products that absorb AI infrastructure into customer operations, including application platforms, security clouds, data clouds, observability tools, workflow systems, databases, CRM systems, and edge-network services.
What it does in the chain: chips and cloud capacity create compute supply; this layer turns that supply into governed workflows, threat detection, data processing, application monitoring, automation, customer records, developer platforms, and traffic delivery that customers pay to use.
Main operating pieces: subscription contracts, usage meters, identity and access controls, endpoint agents, telemetry pipelines, data warehouses, application databases, workflow engines, customer data records, edge proxies, APIs, AI assistants, and support or implementation services.
Where it sits: in enterprise software budgets, cloud accounts, security operations centers, developer pipelines, IT service desks, sales and service workflows, database clusters, and edge-network points of presence rather than in the data-center power or hardware stack.
How the parent theme uses it: AI capex is stronger when this layer proves that infrastructure spending creates durable customer payments and cash flow after cloud hosting, telemetry, inference, support, acquisition, legal, and stock-compensation costs.
Terms used later: ARR means annual recurring revenue; RPO means contracted revenue not yet recognized; cRPO is the current portion expected within about 12 months; NRR or DBNR measures expansion from existing customers; FCF means free cash flow after operating cash flow and capital spending adjustments.
Report boundary: this node is a tactical report layer. Durable company research stays in the linked knowledge lanes. Price and volume context comes from read-only discovery daily_ohlc; selected-security charts render through the right rail using the report API. Static setup thresholds from the prior node were based on completed weekly bars through 2026-06-05 and are stale against local daily coverage through 2026-06-12, so this page does not use those thresholds as current trading evidence.
Current Setup
Downstream conversion testSoftware evidence needs paid usage alongside AI activity.
The investable read improves when ARR, RPO, product revenue, retention, margin, and FCF rise together after customers deploy AI, cloud, security, data, and workflow workloads.
Strongest evidencePLTR, PANW, and CRWD have the strongest current evidence.
Operational AI growth, security ARR/RPO, module adoption, and FCF are visible.
Conversion gateData, workflow, and edge names need margin evidence.
SNOW, DDOG, NOW, MDB, ZS, CRM, and NET must show usage becoming durable revenue and cash.
Primary constraintAI revenue lines remain incomplete.
Acquisitions, SBC, legal costs, cloud costs, and high valuations can absorb operating progress.
Infrastructure usedCloud + data + security
Customer paysARR, usage, RPO
Economics proveMargin + FCF/share
Live watchOrganic growth + SBC
This node sits downstream from the AI equipment, networking, power, and cloud-capacity buildout. The theme improves when infrastructure usage becomes paid software or security economics: ARR, RPO, cRPO, product revenue, consumption revenue, module adoption, retention, large-customer expansion, margin, SBC discipline, and FCF per share. It weakens when AI workloads create activity without durable customer payments or when cloud, telemetry, inference, acquisition, legal, or support costs absorb the revenue before it reaches per-share cash flow.
The evidence base is broad enough to rank ten durable software and security lanes. PLTR reported Q1 2026 revenue of $1.633B, up 85%, U.S. commercial revenue up 133%, and a 46% GAAP operating margin. PANW reported fiscal Q3 2026 revenue of $3.0B, NGS ARR of $8.1B, and RPO of $18.4B. CRWD reported fiscal Q1 2027 revenue of $1.39B, ARR of $5.51B, net new ARR of $255.8M, and FCF of $468.5M. SNOW, DDOG, NOW, MDB, ZS, CRM, and NET add data-cloud, observability, workflow, database, zero-trust, CRM, and edge-network evidence. The next positive evidence is organic growth, customer expansion, retention, product margin, and FCF per share.
The setup weakens when valuation and narrative outrun measurable conversion. PLTR lacks a disclosed AIP revenue line. PANW, NOW, CRM, and ZS need organic growth separated from CyberArk, Chronosphere, Armis, Informatica, Red Canary, or other acquisition effects. CRWD must keep Falcon renewal quality intact after the July 19 incident while managing legal costs and SBC. SNOW, DDOG, MDB, and NET need evidence that AI, observability, database, and edge traffic improve gross margin, retention, and FCF rather than only raising compute, telemetry, bandwidth, or support costs.
The visual summary compresses the three hidden source fields above. Right-rail charts use API-backed weekly views from daily_ohlc; the prior static chart thresholds are stale because local daily coverage now extends to 2026-06-12.
Basket
This basket is inherited from the AI Capex parent report and hand-ranked by source-backed node economics before chart timing. PLTR ranks first because reported operational AI growth and margin evidence are strongest. PANW and CRWD rank next because security-platform ARR, RPO, module adoption, and FCF convert AI-era risk into measurable enterprise spending. The rest of the basket is ordered by visibility into paid data, observability, workflow, database, zero-trust, CRM, and edge-network economics. Watch-only names remain RBRK, DT, ESTC, GTLB, S, ADBE, and TEAM because this report does not have durable local security lanes for company-level claims.
Operational AI software route with the clearest current revenue growth and margin evidence.
Market cap$330.3B
Next earningsNot confirmed
Latest qtr revenue$1.633B
Role in stack
Palantir sells Gotham, Foundry, Apollo, and AIP to government and commercial customers that need governed data, AI workflow deployment, and operational decision systems. Theme pressure converts when AIP and related platforms become recognized revenue, RPO/RDV, operating margin, and FCF.
Revenue mix
Q1 2026 revenue split between government revenue of $858.4M and commercial revenue of $774.2M, including $595M of U.S. commercial revenue. The lane still lacks a disclosed AIP-only revenue line.
Latest qtr revenue
Q1 2026 total revenue was $1.633B for the quarter ended March 31, 2026, from Palantir's May 4, 2026 SEC Exhibit 99.1.
Security platformization route with visible NGS ARR, RPO, and AI-security demand.
Market cap$168.6B
Next earningsNot confirmed
Latest qtr revenue$3.0B
Role in stack
Palo Alto sells network security, SASE, cloud security, Cortex/SecOps, identity, and observability products to enterprise security buyers. Theme pressure converts when AI and cloud risk becomes NGS ARR, RPO, platformized customers, adjusted FCF, and organic growth.
Revenue mix
The company is subscription and support heavy, with NGS ARR and RPO as forward platform metrics. CyberArk and Chronosphere contributed to reported Q3 results, so organic conversion remains a required bridge.
Latest qtr revenue
Fiscal Q3 2026 total revenue was $3.0B for the quarter ended April 30, 2026, from Palo Alto Networks' June 2, 2026 release.
Endpoint-to-cloud security route with visible ARR, module adoption, and FCF.
Market cap$134.3B
Next earningsNot confirmed
Latest qtr revenue$1.39B
Role in stack
CrowdStrike sells Falcon modules and Flex commitments to security operations teams protecting endpoints, identities, cloud workloads, data, and AI-enabled attack surfaces. Conversion depends on ARR, net-new ARR, renewal quality, module depth, legal costs, and FCF.
Revenue mix
Revenue is subscription-led. Fiscal Q1 2027 subscription revenue was $1.32B of $1.39B total revenue, while ARR, net-new ARR, module adoption, and Falcon Flex remain the best platform gauges.
Latest qtr revenue
Fiscal Q1 2027 total revenue was $1.39B for the quarter ended April 30, 2026, from CrowdStrike's June 3, 2026 release.
Data-cloud consumption route for governed data, Cortex, and AI workloads.
Market cap$52.7B
Next earningsNot confirmed
Latest qtr revenue$1.391B
Role in stack
Snowflake sells governed data, compute, sharing, Cortex, Snowflake Intelligence, and application workloads to data and AI teams. Theme pressure converts when consumption becomes product revenue, NRR, RPO, product gross margin, and FCF.
Revenue mix
Product revenue is the main line because the model is consumption based. Q1 FY2027 product revenue was $1.334B, or 96% of total revenue, with professional services and other revenue at $56.6M.
Latest qtr revenue
Fiscal Q1 2027 total revenue was $1.391B for the quarter ended April 30, 2026, from Snowflake's SEC Exhibit 99.1; product revenue was $1.334B.
Observability and security-operations route for AI application complexity.
Market cap$71.2B
Next earningsNot confirmed
Latest qtr revenue$1.006B
Role in stack
Datadog sells monitoring, APM, logs, cloud security, GPU monitoring, Bits AI, and automation tools to cloud, DevOps, SRE, platform, and security teams. Conversion depends on usage growth, large-customer ARR, gross margin, retention, and FCF.
Revenue mix
Revenue comes from subscription usage across observability and security products. Customers above $100K ARR were about 4,550 at March 31, 2026, but product-level AI and security revenue remain less visible.
Latest qtr revenue
Q1 2026 total revenue was $1.006B for the quarter ended March 31, 2026, from Datadog's May 7, 2026 release.
Enterprise workflow AI route where Now Assist must convert into subscription growth.
Market cap$94.0B
Next earningsNot confirmed
Latest qtr revenue$3.770B
Role in stack
ServiceNow sells IT, employee, customer, creator, and security workflow automation to enterprises. AI infrastructure pressure converts when Now Assist and platform automation increase subscription revenue, cRPO/RPO, renewal quality, and FCF.
Revenue mix
Subscription revenue dominates the model. Q1 2026 subscription revenue was $3.671B of $3.770B total revenue, with cRPO of $12.64B and RPO of $27.7B.
Latest qtr revenue
Q1 2026 total revenue was $3.770B for the quarter ended March 31, 2026, from ServiceNow's April 22, 2026 release.
Application database route for AI and developer workloads, led by Atlas.
Market cap$24.1B
Next earningsNot confirmed
Latest qtr revenue$687.6M
Role in stack
MongoDB sells Atlas, database services, search, and vector or AI-agent features to developers and application teams. Conversion depends on Atlas consumption, subscription revenue, RPO/cRPO, customer expansion, GAAP margin, and SBC discipline.
Revenue mix
Atlas is the main cloud route. The local lane uses Atlas growth, subscription revenue, RPO, customer expansion, and FCF as the best available evidence because AI-agent revenue is not separately disclosed.
Latest qtr revenue
Fiscal Q1 2027 revenue was $687.6M for the quarter ended April 30, 2026, from MongoDB's company release and local lane; the official page was blocked during this pass, so the same period should be rechecked at the next refresh.
Zero-trust and data-security route with acquisition and sales-execution caveats.
Market cap$24.5B
Next earningsNot confirmed
Latest qtr revenue$850.5M
Role in stack
Zscaler sells Zero Trust Exchange, SASE, data protection, and acquired security tools to enterprise buyers controlling cloud, AI-agent, user, and data access risk. Conversion depends on ARR, RPO, large customers, organic growth, and FCF margin.
Revenue mix
Revenue is subscription security platform revenue, with ARR and RPO as forward metrics. Red Canary contribution must be separated before reported growth is treated as clean organic conversion.
Latest qtr revenue
Fiscal Q3 2026 revenue was $850.5M for the quarter ended April 30, 2026, from Zscaler's company release.
CRM and agentic workflow route with large cash flow but organic AI proof still needed.
Market cap$148.7B
Next earningsNot confirmed
Latest qtr revenue$11.133B
Role in stack
Salesforce sells sales, service, marketing, data, Slack, and platform software to customer-facing teams. Theme pressure converts when Agentforce, Data 360, and core CRM automation become cRPO, organic subscription growth, FCF, and per-share value.
Revenue mix
Subscription and support revenue dominates. Q1 FY2027 subscription and support revenue was $10.593B of $11.133B total revenue, including Informatica contribution that must be separated in the organic growth read.
Latest qtr revenue
Fiscal Q1 2027 total revenue was $11.133B for the quarter ended April 30, 2026, from Salesforce's May 27, 2026 release.
Edge network, app-security, and developer-platform route with margin and restructuring risk.
Market cap$69.3B
Next earningsNot confirmed
Latest qtr revenue$639.8M
Role in stack
Cloudflare sells security, performance, zero trust, Workers, storage, and AI-adjacent network services to developers, network teams, and security teams. Conversion depends on large-customer growth, DBNR, RPO, gross margin, restructuring execution, SBC, and convert mechanics.
Revenue mix
Cloudflare reports one subscription platform segment. Large customers, DBNR, RPO, FCF, and gross margin are the best available gauges because product-line AI or Workers economics are not separately disclosed.
Latest qtr revenue
Q1 2026 total revenue was $639.8M for the quarter ended March 31, 2026, from Cloudflare's May 7, 2026 release.
Market caps use local discovery instruments.market_cap queried on 2026-06-13. Next-earnings dates are marked Not confirmed because bounded web checks did not find confirmed future quarterly earnings dates on the reachable company or Nasdaq earnings pages. Latest-quarter revenue uses company IR or SEC release figures where reachable; MDB uses the local lane and secondary search result because the company release page returned a 403 during this pass.
What Confirms Or Weakens
AreaWhat confirmsWhat weakens or invalidatesWatch next
01Node thesis
Usage becomes paid software
What confirms
AI infrastructure use turns into recognized software, security, data, observability, workflow, database, CRM, or edge-platform revenue with stronger ARR, RPO/cRPO, retention, module adoption, margin, and FCF per share.
What weakens or invalidates
AI features lift demos, pilots, traffic, or usage without improving renewal quality, consumption durability, organic growth, gross margin, operating margin, SBC intensity, or per-share FCF.
Watch next
Next confirmed earnings dates
ARR and RPO/cRPO
Retention and large-customer expansion
02Economics mechanism
Revenue reaches cash flow
What confirms
Gross margin, GAAP operating margin, adjusted operating margin, operating cash flow, FCF per share, and share count improve while revenue grows.
What weakens or invalidates
Cloud hosting, GPU, telemetry, inference, bandwidth, M&A, legal, restructuring, support, or SBC costs rise faster than price and usage.
Watch next
PLTR margin and cloud commitments
CRWD legal and renewal costs
NET gross margin and restructuring
SBC and share count
03Customer and demand quality
Enterprise budgets stay real
What confirms
Large customers expand, usage cohorts retain, AI or security modules attach to production workflows, and RPO/cRPO turns into recognized revenue.
What weakens or invalidates
Customers optimize cloud or telemetry spend, delay enterprise software decisions, demand concessions, or use bundled hyperscaler tools instead of paid independent platforms.
Watch next
SNOW NRR and product revenue
DDOG $100K-plus customers
NOW cRPO and renewals
MDB Atlas growth
04Funding and valuation
Duration tolerance check
What confirms
High-growth software and security names keep access to duration-sensitive equity support because revenue growth is paired with cash generation and lower dilution.
Security vendors show renewal quality, FedRAMP or public-sector wins, incident remediation, compliance credibility, and AI security adoption without material trust leakage.
What weakens or invalidates
Security incidents, legal settlements, public-sector scrutiny, privacy rules, customer data restrictions, or failed acquisition integrations reduce renewals or margin.
Watch next
CRWD incident and legal updates
PANW CyberArk integration
ZS sales and Red Canary bridge
PLTR government timing
06Operating and supply constraint
Costs do not absorb growth
What confirms
AI inference, telemetry, network bandwidth, support, and cloud-capacity costs stay inside gross-margin plans while product velocity and enterprise support quality hold.
What weakens or invalidates
AI usage raises compute, data, bandwidth, storage, support, or implementation costs without offsetting price, retention, or workload expansion.
Watch next
SNOW product gross margin
DDOG telemetry economics
NET capacity costs
CRM and NOW acquisition costs
07Stale condition
Sources remain current
What confirms
Discovery daily_ohlc remains current, company releases are rechecked after each earnings cycle, and security lanes are refreshed when filings or guidance change.
What weakens or invalidates
A new earnings release, 10-Q, guidance update, acquisition close, incident disclosure, material security event, trading week, or knowledge-lane refresh arrives before the node is updated.
Watch next
Confirm next earnings dates
Refresh stale setup thresholds
Recheck MDB official release access
Review watch-only lanes
Source Trail
Canonical Thesis
AI Capex Cycle defines software and security absorption as the downstream test for whether AI infrastructure demand becomes revenue, margin, FCF, and per-share returns.
Enterprise AI Software ROI frames the evidence needed for AI workload productionization, budget conversion, renewal quality, margin, and FCF.
Information Technology supplies the sector context for AI infrastructure, cloud governance, security, data, software duration, and ROI-gated enterprise demand.
PLTR, PANW, and CRWD support the top ranking through operational AI growth, security ARR/RPO, module adoption, margin, FCF, valuation, SBC, trust, legal, and integration checks.
SNOW, DDOG, and MDB support data-cloud, observability, security operations, AI/GPU monitoring, Atlas, RPO, NRR, FCF, margin, and SBC checks.
NOW, ZS, CRM, and NET support workflow AI, zero-trust, Agentforce/Data 360, edge-network, RPO/cRPO, ARR, DBNR, integration, restructuring, and per-share quality checks.
Official Operating Sources
PLTR Q1 2026 SEC exhibit records $1.633B Q1 2026 revenue, U.S. commercial revenue, government revenue, GAAP operating margin, and Q2/FY2026 guidance.
MDB fiscal Q1 2027 revenue of $687.6M came from the local MDB security lane and bounded search result during this pass because the company release URL returned a 403. Recheck the official MongoDB IR release at the next node refresh.
Earnings-Date Checks
Bounded web checks were run on 2026-06-13 for the ten basket tickers. Nasdaq earnings pages were checked for PLTR, PANW, CRWD, SNOW, DDOG, NOW, MDB, ZS, CRM, and NET; no confirmed future quarterly earnings date was captured.
The reachable CrowdStrike events page listed the June 3, 2026 fiscal Q1 2027 call and June 17, 2026 annual meeting, but not the next quarterly earnings date. Searches and reachable company IR/event pages did not produce confirmed next quarterly earnings dates for the remaining basket names. The cards therefore use Not confirmed instead of estimated dates.
Discovery And Chart Provenance
Read-only discovery checks used discovery status PLTR --json, discovery lineage-status --ticker PLTR --dataset daily_ohlc --limit 5 --json, and duckdb -readonly data/discovery.duckdb queries against instruments and daily_ohlc.
Local daily_ohlc coverage for PLTR, PANW, CRWD, SNOW, DDOG, NOW, MDB, ZS, CRM, and NET has 1,278 rows each from 2021-05-12 through 2026-06-12. The representative PLTR status command also showed filing metadata through 2026-06-08 and daily bars through 2026-06-12.
Market caps use the local instruments.market_cap values queried on 2026-06-13. Latest daily closes were available through 2026-06-12 for all ten ranked tickers.
Selected-security right rail route: /api/securities/TICKER/chart?frequency=weekly&window=3y&as_of=latest. Chart assumptions remain weekly OHLC from daily_ohlc, weekly aggregation from daily rows, three-year visible horizon, 20-week EMA, 100-week EMA, and volume subgraph. Chart order follows the ranked basket.
The prior static setup levels were built from completed weekly bars through 2026-06-05. Because local daily coverage now extends to 2026-06-12, those static thresholds are stale and should be refreshed before being used as current trading evidence.
Known Gaps
Most companies do not disclose clean AI-specific revenue, AI gross margin, or product-level AI FCF. This report uses ARR, RPO/cRPO, product revenue, NRR, module adoption, large-customer expansion, retention, margin, SBC, and FCF as the measurable proof set.
PANW, NOW, CRM, and ZS need clearer organic and acquired bridges after CyberArk, Chronosphere, Armis, Informatica, Red Canary, or other integration activity.
Watch names RBRK, DT, ESTC, GTLB, S, ADBE, and TEAM have discovery coverage but no durable local security lanes in this workspace. They remain unranked until knowledge coverage is filed.
Parent report metadata, sitemap entries, and theme routing already point to this node. They were not changed in this worker pass because shared files are outside the assigned write scope.
Review validation attempted a live selected-security HTTP check after static API-hook inspection. If local loopback remains unavailable, rely on the focused API unit tests and the recorded right-rail route until the coordinator pass can run the full site-level smoke test.