Software has just had the strangest fortnight in its recent history, and it happened in two sessions. The first was August 13, when Reuters reported that Silver Lake was in talks to take Workday private at around $43B. Workday rose 17.8%, which is what you would expect. What is more interesting is that the software ETF rose 3.1% against a 0.7% move in the S&P, with HubSpot up 14.5%, Elastic up 11.5%, and MongoDB and Braze both up 7.9% on a day none of them had any news. Buyout firms had spent most of this year avoiding large software take-privates precisely because AI made the forward growth impossible to underwrite. One credible bid told the market the de-rating had overshot.The second was August 27. Salesforce, CrowdStrike and Okta had all reported the previous evening and all three gapped more than 20%. The software ETF rose 7.74%, the eighth-largest single day in its twenty-five-year history and the third-largest in five years. Every other day on that all-time list is a crisis bottom snapping back: the dot-com washout, two days in October 2008, the COVID low, the CPI reversal, the tariff U-turn. This one had the S&P up 0.7% and the ten-year Treasury unchanged at 4.66%. There was no macro event at all. Atlassian rose 10.2% and ServiceNow 10.0% without reporting anything; Braze rose 10.6%, MongoDB 8.5%, HubSpot 7.9%. Marc Benioff used his prepared remarks to say “this nonsense of this SaaSpocalypse, I think it is time for it to stop,” and the market appears to have agreed with him inside a single session.Underneath those two days sit nine actual earnings reports, and they are less tidy than the tape suggests. Every one of the nine beat. The reactions ranged from Okta up 28.6% to Rubrik down 13% on the biggest beat it has ever posted. Workday guided next-quarter bookings growth down by three points and rose. Elastic’s expansion rate fell for the second consecutive quarter and it rose 19.3%. Take the eight names that reported in early August and compare each one’s print-day reaction with how it has traded since, and the correlation is low. Whatever the market thought it was grading three weeks ago has been worth nothing since. The demand underneath is real, and worth separating from the price action. CRWD posted record net new ARR of $332.8M, up 51% year over year against 32% the quarter before, and raised its full-year net-new-ARR growth guide by another 630 bps, the second consecutive raise. OKTA beat its own cRPO guide for a second straight quarter, this time by three points. PANW has guided the quarter it reports on September 1 to 32% revenue growth. One budget cycle, three witnesses, and the spending is there. None of that tells you what the equity is worth. Security, data infrastructure and application software give three different answers, and the market is currently paying the most for the one with the worst answer.Security: the control point moves, so the multiple cannot holdEvery stage of the security lifecycle is trading simultaneously right now, and the only honest way to compare them is on forward numbers, because a multiple is a claim about the revenue a business has not earned yet. ZS is expected to grow 17% next year and trades at 7.2 times that revenue. CrowdStrike is expected to grow 22% and trades at 29.9 times. Five points of extra growth, four times the price. Zscaler, still compounding at 25% today, is fifty percent below its November 2021 peak nearly five years later; Okta is 43% below its February 2021 peak with a business that is currently inflecting upward; Rapid7 is down 90.5%. None of those three was disrupted out of existence. They still sell software enterprises need. They were bought at the wrong multiple, and that alone did it. That is the failure mode to underwrite, and it is not the one people argue about. Check Point (CHKP) did not die. It invented the enterprise firewall, still owns a real share of it, still runs an 87% gross margin on $2.8B of revenue, and it grows in the low single digits at 12x forward earnings. It won its category permanently and became a bond. Gen Digital, what is left of Symantec after Broadcom took the enterprise half for $10.7B, sits at 4.6x forward revenue and 9x earnings. Three things drive that path, and none of them is bad luck.Security products are indexed to an architecture, not to a customer problem. Do not get breached is permanent. The control point that delivers it is defined by where the compute and the data physically sit, and that relocates about once a decade.Each move leaves the incumbent holding the wrong architecture, which is a much harder problem than being behind, and it is why the last winner so rarely wins the next round. CrowdStrike is the cleanest proof of it. The company exists because it took the endpoint away from two firms that had held it for twenty years, and it now sits in the position they once did, at a higher multiple than either of them ever carried. Look at what actually closed those rows, though, because it is not what the word disrupted implies. Symantec and McAfee were sold, FireEye was broken in half, and Check Point was neither of those things, it never lost its category and it never sold, it just stopped growing. Being right about the technology and wrong about the decade is the normal outcome in this industry, not the tail.The incumbent’s moat is distribution, not product, so the answer to every shift is to go and buy the new control point. Palo Alto is the successful example here, paying $25B for CyberArk to own identity and settling most of that in its own shares, and it is still leading fourteen years after its IPO precisely because it keeps doing this. Paying in stock is the purest version of the problem, because the growth is being bought with the multiple, which means the multiple has to stay high for the strategy to keep working. That makes the platform thesis a serial-acquisition thesis, and serial acquirers earn acquirer multiples. Microsoft does not report security as a segment, but outside estimates put its FY2025 security revenue near $37B, several times the largest pure play, most of it bundled into E5 and Azure. It does not need a better product, only one good enough that the incremental line item gets hard to defend at renewal. Okta’s own bear case names Entra; Elastic’s names Sentinel’s free ingestion tier.Fortinet is the sharpest illustration in the group, and it cuts against the premium cohort rather than for it. It grew 25.6% last quarter, but the Street has it at 11% next year, the steepest deceleration in the cohort, and it still trades at 13.1 times forward revenue against Zscaler’s 7.2 on six points more growth. Nearly twice the price for materially less of the thing you are buying. That is the handover from growth multiple to value multiple caught in progress rather than described after the fact, and it is the most useful thing on the chart. Run CrowdStrike backwards against that. To justify today’s enterprise value at Fortinet’s forward multiple it needs about $16.8B of revenue, 2.3 times the $7.3B the Street has it earning next year, or roughly four years of 22% compounding. At Zscaler’s 7.2x it needs $30.5B, which is seven years out. At the mature-franchise multiple Check Point trades at, about $46.7B, which is most of a decade. The trap is that the variables are not independent: by the time CrowdStrike reaches $16.8B it will not still be growing 22%, so it will not deserve Fortinet’s multiple either. That is not a short as the timing is hard to predict but the forward returns look unattractive. The demand cycle is real, an improving trajectory holds an expensive multiple up longer than arithmetic suggests, and this stock already round-tripped once inside twelve months. Two smaller reads sit in the same segment. Okta gapped 28.6% on a session the press attributed to agentic AI demand, and its own CFO, asked directly how much of the raise was AI, said “still immaterial, still very small... for FY 2027 we do not think it is going to be material.” What is working is governance and privileged access plus large-enterprise share gain, unglamorous and now fully paid for at 7.6x forward revenue. And Rubrik (RBRK) is the fragility tell: biggest beat yet, revenue $31M above its own guide, EPS of $0.20 against a $0.03 to $0.05 guide, and the stock fell 13% on one ambiguous sentence about second-half bookings, the second straight quarter of beating big and being sold. At 11x forward revenue there was no room for ambiguity, and CrowdStrike trades at nearly three times that.Data infrastructure: the control point is moving right nowApply the same question to SNOW, MDB and ESTC and the answer is less settled, because this shift is still in progress. The warehouse franchise was built on holding the data. You landed it in Snowflake’s proprietary format, and every query afterward was compute billed by Snowflake against data only Snowflake read well. Holding the data was a control point in the same sense the firewall was, and open table formats dissolve it. By 2026 Apache Iceberg has effectively won the format war, with Snowflake, Databricks, AWS, Google and Microsoft all reading and writing it, and the practical consequence is write once, query from anywhere. The contest has moved up a layer to the catalog, the service that tracks which tables exist and brokers commits, where Snowflake’s Polaris, Databricks’ Unity Catalog and AWS Glue are now fighting over the same ground. Owning the catalog means owning governance and lineage, which is a real position, but it is thinner than owning the storage, and three hyperscalers are contesting it. That is a directional read and I would hold it loosely, since it comes from the ecosystem and not from Snowflake’s own disclosure. It still changes what a 14.8x forward revenue multiple is buying, and it is the kind of transition that shows up in net revenue retention years before it shows up in revenue. Snowflake’s was 126% when it last reported, and that line matters more in the September 2 print than the beat does.Elastic is running a self-inflicted version and has been more open about it. Columnar Mode, which it released into technical preview this quarter, pushes metrics storage costs down 20% to roughly three bytes per sample. That is a price cut pointed at a usage-priced contract, and because it is still a preview the effect is ahead of the company rather than behind it. Elastic has scheduled a metrics webinar for September 22, and the question worth taking to it is whether Columnar Mode gets sold as an upsell into the log-analytics base or arrives as a discount on workloads customers already run. The second is deflation wearing an innovation costume, and it is the cleanest explanation available for why AI penetration of Elastic’s over-$100K cohort doubled from 21% to 37% in a year while net expansion stepped down to 111% from 112%, its second consecutive decline. The stock rose 19.3% anyway.MongoDB is least exposed on this axis and most exposed on another. Its control point is not storage, it is the application code written against its query API, which is sticky, and the pressure comes from Postgres and its derivatives closing the JSON-flexibility gap from below while hyperscalers commoditize the database layer from above. That erosion is slower than a format shift. What is more immediate is that the backlog everyone quotes is a much weaker signal here than it looks. MongoDB reported $1.46B of remaining performance obligations for the April quarter, of which 53% is expected to land as revenue inside twelve months, so roughly a quarter of next year’s revenue is contracted, and contracts shorter than twelve months are excluded from the figure altogether under the practical expedient. The company also says in the same note that the timing of that recognition depends on customers’ future consumption, which is “inherently variable at the customers’ discretion.” Neither the headline backlog nor its current portion decides this quarter. Atlas consumption does, and the number that reports it is the net ARR expansion rate, 121% at the last print, which is the same metric that just went the wrong way at Elastic.Application software: the control point holds, but not all records are equalRun the same test on Veeva, Workday and Salesforce and the answer comes back the other way. The control point in application software is the system of record: the data model plus the compliance and workflow lock-in wrapped around it. It does not relocate every decade. WDAY has held HR since 2005. VEEV has held life sciences since 2007. SAP has held ERP since before most of these companies existed. Nobody re-platforms payroll because a better architecture appeared. That durability is why app names deserve multiples security names do not, and it is why a $43B private equity bid showed up for Workday this month and not for a security vendor. But the three are not interchangeable, and the difference is how much regulated process is welded to the data model.Veeva sits at the defensible end. Its record sits inside the trial master file, the safety and pharmacovigilance systems and the regulated quality suite. Those are systems a life sciences company validates once and then does not lightly revalidate, which makes displacing Veeva a different kind of decision from switching a CRM. That is why it won Lilly, Biogen and Regeneron in the year after its Salesforce platform agreement lapsed, when the Street was modelling a bleed, and why it just put up its third consecutive quarter of accelerating growth, 16.0% to 16.3% to 17.6%, with a third consecutive guidance raise and Commercial Cloud reaccelerating from 10.6% to 13.9%. The risk it disclosed is about products, not architecture. CFO Brian Van Wagener said the engine is rotating from mature products to early ones and “the S-curves don’t stack up exactly,” with second-half growth guided near 13.75% against 17.0% in the first half.Workday sits in the middle. Payroll and financial close carry statutory and audit weight, so the record is safe. What is not safe is the billing layer. Workday has more than 5,500 customers using its AI agents, up 35% sequentially, and AI SKU ARR near $600M, and about 200 customers actually paying for Flex Credits, the consumption layer that turns any of it into revenue. Co-founder Aneel Bhusri called it “a delayed gratification model” and “one of the reasons for cautious optimism going into next year,” and the company guided next-quarter cRPO to 11-12% from the 14.2% it had just printed. The franchise is not under threat. The seats-to-consumption transition is where the growth rate goes to sit for a while.Salesforce is the one I would rank last, and the reasoning runs through the same frame, none of it about disliking the company. Its record is a list of accounts, contacts, opportunities and cases. Valuable, certainly, but nothing about it is regulated, audited or externally validated. The lock-in has always come from the layer above the record, the decade of accumulated customization, custom objects, Apex, workflows and integrations that made rebuilding elsewhere prohibitively expensive. That moat is real, and it is also the one in enterprise software most directly exposed to cheap code generation. If the cost of rebuilding a configuration layer falls by an order of magnitude, the least regulated system of record is the first one where switching stops being impossible and starts being a budget question. I do not think that shows up as customers leaving. I think it shows up as pricing power quietly ebbing at renewal, which is roughly what the numbers already look like. Salesforce’s own guidance puts the Informatica contribution at slightly above four points of growth against a headline of about 11%, and stripping it out of the reported quarter leaves organic growth decelerating from an estimated 8.5% to 6.4%, with Contentful and Fin closing behind it.Salesforce’s answer is to become the agent layer on top of its own record, and Benioff laid the architecture out himself on the call, a data layer, an application layer, and agents across it. Agentforce ARR reached $1.5B and accounts with agents in production grew 70% sequentially, which is real. But an agent layer is a thinner control point than a system of record, in exactly the way a catalog is thinner than storage. The shape is the same as in the other two segments. There is an irony in the mechanics, too. Some 43% of the quarter’s headline non-GAAP EPS, $2.53 of $5.90, came not from operations but from a non-operating gain on strategic investments, while the company’s strategic answer to AI is Claudeforce, a partnership with Anthropic announced on CNBC minutes before the call began. The most valuable thing Salesforce owned this quarter was a stake in the kind of company that makes rebuilding its configuration layer cheap.The one genuinely underpriced disclosure in these nine quarters is the demand-generation version of the same problem, and it came from ZM, which cut its full-year Online guide from a slight increase to flat for a reason that was neither competition nor churn. Management said it was “due to dynamics that we saw in Q2 at the top of funnel across the industry where people are just discovering products in different ways... they’re going from search to more AI.” Every self-serve, search-acquired software business carries that exposure and almost none have been asked about it on a call. If the system of record is safe and the billing layer is in transition, the acquisition layer is the third place the economics can leak, and it is the one nobody is modelling.PD is the one place in the cohort where a control point is changing hands instead of moving, though the claim needs stating carefully. Atlassian is retiring Opsgenie, a direct incident-management competitor, with end of support on April 5, 2027 and new sales already closed since June 2025. That is a real migration event, but Atlassian’s own recommended path is Jira Service Management, where the alerting has been folded into the Premium and Enterprise tiers, so the displaced base does not fall to PagerDuty by default. What is in play is the slice unwilling to buy up into JSM, and the competition for it includes incident.io and xMatters as well as PagerDuty. Against that, PagerDuty’s cRPO grew 5% on 0.8% revenue growth, the first positive divergence in the data, and at roughly 2x forward revenue with net cash you are not paying much for the option. The tell to watch is whether management starts naming Opsgenie displacements in its new-logo commentary. So far it has not.The easy money was the re-rating, and it has already been madeWhere multiples eventually end up is one question. Where the last four months of return came from is a different one, and it is the part that decides what the next twelve look like. Take each of these names from its spring low, the worst close between mid-March and mid-May, to August 28. The median move is +114%. The median trailing revenue growth over the same stretch is 5.7 points. Everything else was the multiple, and the split is not a story about one or two outliers. Across all eighteen names the multiple accounts for between 90% and 100% of the move. That would be fine if the multiples had somewhere left to go. Whether they do turns out to depend entirely on which segment you are in, and the answer lines up uncomfortably well with everything above.Measure each name against its own three-year range instead of against its peers, and the table sorts itself almost perfectly by segment. The four names sitting at or within a percentile of their three-year highs are Okta, CrowdStrike, Fortinet and Palo Alto. All four are security. Application software fills most of the bottom half: Salesforce and Workday at the 19th percentile of their own ranges, ServiceNow and PagerDuty at the 20th, Atlassian at the 25th, Veeva at the 39th. So the market spent four months re-rating the segment whose control point has the shortest record of staying put, and left alone the segment where it has never moved. That is the frame and the tape pointing in opposite directions, which is the only condition under which having a frame pays for itself. Security also ranks itself internally, and it ranks by how much of the cycle each name has already been through. Zscaler sits at the 18th percentile and Check Point at the 9th, the two whose transition is behind them. Rubrik is at the 68th, in the middle of its own. The four at the top are the ones whose transition has not happened yet. That ordering is not something I am imposing on the table. It is the shape the table already has.Two names break the pattern and both deserve naming. Datadog at the 92nd percentile is the one business up there that is genuinely accelerating, so its position is at least earned. Zoom at the 90th is not. Four percent expected growth next year, a guided decline in next-quarter earnings, and a multiple within a whisker of a three-year high is the hardest combination in the table to defend, and it is getting almost no attention because Zoom is not a name anyone argues about anymore. The table also hands you the strongest objection to my own ranking. Salesforce at the 19th percentile is genuinely cheap against its own history, and if you think the last three years are a fair guide to the next three, that is a buy and my ordering is wrong. My argument is that the history is the wrong guide for this particular name, because the thing being valued, a configuration moat and not a regulated record, is the thing changing. That is a view, and the multiple is the price of being wrong about it.The arithmetic from here is unforgiving. If the multiple simply holds, your return is revenue growth minus dilution, and dilution is not trivial in this group, with CrowdStrike’s own release putting stock compensation and related payroll taxes at $399M on $1,471M of quarterly revenue, or 27 cents in the dollar. Hold the multiple and what you get is next year’s growth: 22% at CrowdStrike, 12% at Veeva, 10% at Salesforce and Workday, 4% at Zoom, 2% at PagerDuty. Every one of those is below the trailing print the market has been extrapolating. If the multiple mean-reverts even partway, the growth goes to paying for the compression instead of to you. Elastic’s own base case is the honest illustration. Revenue compounding in the mid-to-high teens, margin expanding toward the 25% target, the multiple contracting from 30x forward earnings to 24x, and the whole thing still only compounds at about 10% a year with no valuation cushion left if delivery slips. None of these businesses has to disappoint for that to be a worse setup than the one that just paid out. They only have to grow at the rate they are already guiding to, into a multiple that has stopped rising. That is the ordinary way a good year is followed by a dull one, and it is what the next four months look like unless earnings do the work the re-rating did.Into SeptemberMongoDB and Palo Alto report September 1, Snowflake September 2, Braze on September 8. All four now trade within a couple of percent of the Street’s average price target, and unlike the just-reported names whose targets are still catching up, these are current. Three of the four got there by rising on somebody else’s earnings, which is a thin foundation for a print that now has to justify the move.Braze is where my view changes most, and only because of the price. Three weeks ago it was the cheap name with an accelerating forward signal and a target roughly 20% above the stock. It has since risen 20.1%, including 10.6% on August 27 for no company-specific reason, and the multiple went from about 2.6x forward revenue in the spring to 3.4x. Still the cleanest fundamental story of the four; the discount that made it the best setup is spent. Snowflake and MongoDB inherit Rubrik’s problem, which is that once the target is met a large beat buys a polite nod while any softness in the forward line gets punished without mercy. For Snowflake the two-sided case holds and I would not fight it, since consumption vendors have been discounting guide midpoints and the Cortex Code ramp is probably sandbagged. Read retention before you read the beat. For MongoDB, read the expansion rate, and treat the backlog as the least informative number in the release.Ranked by the only question that organises all of it: Veeva first, because its control point is welded to a regulator and cannot move. Workday second, because its record is equally safe, though what the market is paying for at the moment is the buyout, which is a different bet from the one written on the tin. Salesforce third, because it is defending the least regulated record in the group with a moat made of configuration and answering an architectural question with a partnership. And the security names last, not because the businesses are worse, but because the record says the vendor collecting this tax changes about once a decade and the multiple starts leaving several years before the growth does. Owning the current collector at thirty times next year’s revenue is a bet that this time the control point stays put.