Cybersecurity’s AI pitch meets the reliability test

The strongest pattern of the fortnight was not a single launch. It was the synchronised rewrite of how cybersecurity vendors want to be understood. On 10 Oct, CrowdStrike added 12 blog pages focused on topics including AI in security and endpoint leadership, plus 15 product pages tied to device posture management and identity security, while removing seven blog pages and 20 product pages. On the same day, analysts including Needham, BMO and StoneX raised CrowdStrike price targets, with the reported rationale including its Flex subscription model and AI developments.

Palo Alto Networks showed the same direction. On 7 Oct it added four blog pages related to success and AI defence, then on 10 Oct added two customer pages and three Cortex-focused blog pages while removing three product pages and two blog pages. Its GitHub activity also sharpened the developer-facing story: on 10 Oct, top repository stars rose from 1,267 to 1,881 and three repositories were added, including Unit42-timely-threat-intel, vortex and AppSecMCP.

The AI frame spread beyond the two largest visible movers. On 9 Oct, Tenable introduced product pages related to generative AI capabilities, vulnerability management dashboards, audit benchmarks and a customer update webinar. On 9 Oct, Proofpoint added four blog posts focused on AI security and threat protection, along with product pages related to cloud data security and ransomware protection. Okta, meanwhile, listed 33 roles in the prior seven days on 8 Oct, primarily engineering and machine learning roles across Singapore, Bengaluru, Sydney, Bellevue and San Francisco, followed by 26 postings noted on 11 Oct across engineering, machine learning and commercial roles in Tokyo, Singapore, Melbourne and Sydney.

The useful read was in the ordering. CrowdStrike showed 37 new Google ad creatives on 8 Oct, with 40 creatives running in total, before the 10 Oct product and blog rebuild. By 12 Oct, another snapshot showed 36 new creatives and the same 40 running total. Palo Alto Networks showed 37 new Google ad creatives on 10 Oct, also with 40 running, the same day its Cortex and customer page changes appeared.

Okta showed 24 new Google ad creatives on 8 Oct and 36 new creatives on 11 Oct, each against 40 running in total. Fortinet showed 25 new creatives on 9 Oct and 20 new creatives on 12 Oct, again against 40 running in total. Qualys, Rapid7, Proofpoint, Tenable, Darktrace, SentinelOne and Arctic Wolf all had creative updates during the period, most reported with 40 creatives running.

That matters because the category’s public motion was not random noise. Ads, page removals, customer proof and developer artefacts clustered tightly. On 8 Oct, Fortinet added customer logos and case studies for Aequs Ltd, Cotemar, FUNKE Mediengruppe and Skyone, while also introducing new blog pages on threat research and AI security. On 9 Oct, Darktrace refreshed product pages across German, Spanish, French, Japanese and English while removing five older versions. On 10 Oct, Proofpoint added case studies for Columbia University, California Department of Motor Vehicles, Citic Pacific Mining and Coventry University. The vendors that looked most active were not merely publishing more. They were replacing old surfaces while pushing new demand messages live.

The same fortnight that delivered AI-heavy positioning also exposed the operational bar these platforms now carry. On 8 Oct, Qualys reported five status incidents, including a critical issue involving UI logins and API authentication failures that lasted about 472 minutes, alongside minor delays in data processing and performance issues. On 11 Oct, Qualys reported a separate minor incident in which VM scans were erroring out on US Platform 4 for about 349 minutes before resolution.

Tenable had a busier reliability record. On 8 Oct, it reported three incidents, including a minor Cloud Scanner Plugin Update issue that was resolved after about 1,704 minutes, a major RBAC Permissions with Custom Roles issue under investigation, and a major performance degradation and intermittent unavailability. On 11 Oct, it reported a major incident in which scheduled scans did not launch for about 796 minutes, plus another major issue under monitoring related to possible GUI slowness and 502/503 errors.

Arctic Wolf also had multiple public service issues. On 9 Oct, it reported a minor incident involving third-party EDR tools flagging the Risk Scan Utility and a major outage involving Aurora MTC Tenant Creation that lasted about 357 minutes. On 12 Oct, it reported a resolved disruption in new BDE configuration and rule delivery for Aurora EDR in South America, and a major incident under investigation involving failures in Arctic Wolf Agent Downloads. Palo Alto Networks reported a 23-minute Cloud NGFW for AWS management portal access issue with no impact and a critical WildFire issue resolved after about 133 minutes on 10 Oct. Rapid7’s Vulnerability Management service had increased latency on 10 Oct, resolved after about 98 minutes.

Tenable had both strategic and security news in the same week. On 8 Oct, it announced Charlie Bell, formerly of Microsoft and AWS, to its Board of Directors, with an 8-K filing also referencing item 5.02 for a leadership change. On 9 Oct, CVE-2026-106126 was published with a CVSS score of 9.9, describing a critical command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS, allowing an authenticated, low-privileged attacker to execute arbitrary commands.

Fortinet’s public context was similarly mixed. On 8 Oct, eight articles discussed the FortiBleed campaign, reporting that it had compromised 86,644 Fortinet device credentials and that the FBI warned the attacks were ongoing against Fortinet gateways. On 11 Oct, further articles highlighted ongoing security issues with Fortinet devices and urged critical infrastructure operators to secure Fortinet gateways. In the same period, Fortinet continued shipping and selling the platform story: on 8 Oct it released version 2.0.0 of an IBM FortiGate cross-zone HA Terraform deployment repository, added new customer logos and published case studies, then on 11 Oct posted videos on AI’s impact on cyberattacks, Security Operations for the AI era, Sovereign SASE and FortiVoice Mass Notification.

Qualys was the cleaner upside story among the exposure names. On 8 Oct, it announced TotalAppSec was FedRAMP High Authorized for U.S. federal agency use, while articles also reported its stock reaching a 52-week high at 201.77 USD and climbing 16 per cent over a seven-day winning streak. On 11 Oct, Qualys was featured in eight articles, including coverage of a strong revenue beat, cloud platform momentum and a Yorkville Ives target price raise to $230 with a buy rating.

Several vendors refreshed public proof points rather than relying only on platform claims. SentinelOne added the City of LA to its public customer wall on 7 Oct while removing South Texas College, then on 9 Oct added a case study titled “City of Los Angeles Secures America’s Second-Largest Metropolis with SentinelOne”. On 11 Oct, it also created a product page promoting recognition as SIEM Solution of the Year in the Cybersecurity Breakthrough Awards 2026.

Proofpoint added four customer case studies on 10 Oct: Columbia University, California Department of Motor Vehicles, Citic Pacific Mining and Coventry University. Fortinet added and then reiterated customer additions across 8 Oct, including Aequs Ltd, Cotemar, FUNKE Mediengruppe and Skyone. Tenable added TechMatrix as a customer logo on 8 Oct, without adding a new case study.

The government and public-sector thread was notable because it appeared across multiple vendors. Qualys’ FedRAMP High Authorization came on 8 Oct. Palo Alto Networks press coverage on 10 Oct included FCN winning a $29.7 million Air Force cybersecurity contract for the Palo Alto Networks platform. SentinelOne’s City of Los Angeles case study landed on 9 Oct. This was not a quiet fortnight for credibility assets.