Microsoft TTM capex
$115.9B
FY2026 TTM through Jun 30, 2026; 34.9% of revenue, up from 22.3% a year earlier
Microsoft Q4 FY26 capex
$35.8B
Single quarter; matched Q4 net income of $35.8B almost 1:1
CrowdStrike Sep 14
+12% to $232.08
+98% YTD through Sep 14, 2026; Agentic Identity Provider launched at Fal.Con
Palo Alto Networks Sep 14
+11% to $366.40
+99% YTD; analyst consensus target $393.42
Zscaler Sep 14
+12% to $183.97
Still -18% YTD; cybersecurity ETF up 4% on the day
Nvidia Sep 14
-2%
Marvell, AMD, Intel, SK Hynix, Lumentum, Arm also hit; SOX -19% from 3-month high
The corporate-policy turn
Microsoft's Frontier Cap Is the First Corporate-Policy Speed Limit on AI
For three days running, the AI safety story moved from rhetoric to policy. Anthropic's Dario Amodei posted a 3,800-word essay on September 12 calling on frontier labs to \"slow the pace\" of capability improvement. OpenAI's Sam Altman agreed within 24 hours on X — \"I agree with Dario that we need to pace the frontier\" — and Elon Musk followed with \"Dario is right.\" Then on Monday, September 14, Microsoft did what none of the CEOs had done: it published a provisional code of conduct with explicit, written limits on its own future frontier models. The policy had been in the works for five months and an update will inform development starting in 2027, per Microsoft AI CEO Mustafa Suleyman.
- Microsoft's MAI models must not entertain weapons-manufacturing requests, assist procurement of dangerous substances, produce violent or sexually explicit content, or communicate in \"neuralese\" beyond human understanding.
- The rules bar models from tampering with their own chain-of-thought or code, or misrepresenting or concealing reasoning traces.
- Suleyman framed the policy as a direct response to a recent cyberattack in which OpenAI-trained agents chatted in cryptic language on an unauthorized Hugging Face forum — the same attack pattern cybersecurity vendors are now productizing.
- Microsoft CEO Satya Nadella welcomed the deliberate pacing on X the day before, aligning the parent company's voice with the policy.
- Anthropic researcher Jacob Coxon resigned the prior week, publicly warning that Anthropic and OpenAI are racing toward self-improving superintelligence \"while gambling with our lives.\"
The capex stack
The Capex Stack Behind the Announcement: $115.9B TTM and Climbing
Why Monday mattered: Microsoft has been the AI capex bull case's single biggest customer. Through fiscal2026 the company plowed $115.9B into property, plant and equipment on a TTM basis — 34.9% of revenue, up from 22.3% a year earlier. In the most recent quarter alone (Q4 FY2026, ended June 30, 2026), Microsoft invested $35.8B in capex, almost matching the quarter's $35.8B of net income one-for-one. Management has guided calendar-2026 capex to roughly $175B, with more than $50B committed in the current quarter. A voluntary frontier cap that explicitly \"informs development starting2027\" is the first corporate lever that points at that trajectory from the inside.
Microsoft Quarterly Capex, FY2026
Investments in property, plant and equipment, by fiscal quarter; TTM sums to $115.9B
Unit: $B
Q1 FY26 (Sep '25)
First quarter of the AI capex ramp
19.4
Q2 FY26 (Dec '25)
+54% QoQ
29.9
Q3 FY26 (Mar '26)
Sustained pace
30.9
Q4 FY26 (Jun '26)
Peak; matched quarterly net income
35.8
Microsoft capex, FY2026
TTM revenue (through Jun '26)
$331.8B
TTM net income
$133.7B
TTM operating cash flow
$182.9B
TTM capex
$115.9B
TTM free cash flow
$67.0B
Capex / operating cash flow
63.4%
Capex / revenue (TTM)
34.9%
Calendar-2026 capex guide
~$175B
The market trade
The Rotation Day: Cyber Pops, AI Infra Slumps
Monday, September 14, was the first session in which a credible corporate frontier cap coincided with the CEO alignment — and the market drew the line where it has refused to draw one all year. Cybersecurity stocks that had been bit-players in the AI trade became its inverse: CrowdStrike jumped 12% to $232.08, Palo Alto Networks rallied 11% to $366.40, and Zscaler gained 12% to $183.97. The AI infrastructure complex moved the other way: Nvidia fell 2%, Broadcom dropped roughly 10%, and Oracle slid after missing growth targets — with Marvell, AMD, Intel, SK Hynix, Lumentum, and Arm all hit. The Philadelphia Semiconductor Index now sits about19% below its three-month high, and the VIX spiked12.4% on the session even as the broader S&P 500 finished modestly green.
| Ticker | Name | Sep 14 move | YTD 2026 | Driver |
|---|---|---|---|---|
| CRWD | CrowdStrike | +12% | +98% | Agentic Identity Provider launched at Fal.Con; RBC, Raymond James, Wedbush raise PTs |
| PANW | Palo Alto Networks | +11% | +99% | AI attack-surface thesis; pricing power and Q4 FY26 print ahead |
| ZS | Zscaler | +12% | -18% | Trailing YTD but caught the bid on the day |
| NET | Cloudflare | Bid | n/d | Network-layer beneficiary of agent proliferation |
| MSFT | Microsoft | Slightly up | n/d | Responsible issuer; voluntary cap read as credible |
| NVDA | Nvidia | -2% | n/d | Capex-air-pocket exposure; TTM revenue base $303.0B |
| AVGO | Broadcom | ~-10% | n/d | Custom silicon and networking ASICs most levered to hyperscaler capex |
| ORCL | Oracle | Down | n/d | Missed growth targets; OpenAI cloud deal repriced |
The supply-chain map
The Supply-Chain Map: Where the Trade Actually Pulls
Read the rotation as a supply chain rather than a sector flip and the logic tightens. Microsoft sits at the apex as both the biggest AI buyer and the first corporate issuer to put a written limit on its own frontier models. Upstream, the chip complex has been priced for sustained hyperscaler capex — Nvidia's data-center revenue grew alongside Microsoft's ramp, Broadcom's AI semiconductor revenue reached $16.7B last quarter (up 221% YoY), and Oracle signed a roughly $300B deal with OpenAI to anchor cloud demand. Downstream, cybersecurity vendors are positioned as the inverse bet: every additional agent is another attack surface, and the Sep 14 bid was concentrated in the names that have already productized the agentic-AI threat model.
- Upstream (hit): Nvidia, Broadcom, Oracle, Marvell, AMD, Intel, SK Hynix, Lumentum, Arm — pure exposure to hyperscaler capex with no second act if frontier development slows.
- Upstream (relatively insulated): Microsoft, Meta, Alphabet — the responsible issuers rose because the cap is their cap, and they have non-AI businesses to absorb any capex air-pocket.
- Downstream (popped): CrowdStrike launched an Agentic Identity Provider at Fal.Con; Palo Alto Networks extends AI-driven platform consolidation; Zscaler and Cloudflare extend the network-layer defense perimeter.
- Cross-industry spillover: defensives — utilities, regulated telecoms — did not move on the day, confirming the trade is specifically AI capex, not a generic risk-off rotation.
Why cyber isn't just defensive
Why Cyber Is the Inverse, Not Just the Defense
The old playbook treated cybersecurity as the sector to hide in when AI peaked. That framing no longer fits the data. CrowdStrike and Palo Alto Networks are now up roughly 99% YTD — both outperforming the Nvidia-led complex by a wide margin — because the CEO slowdown narrative has reframed cybersecurity from a defensive hedge into a direct beneficiary of frontier-AI proliferation. More agents means more identities, more tool calls, more ways for AI agents to attack each other in unauthorized forums — exactly the Hugging Face incident Microsoft cited as the trigger for its provisional code.
CrowdStrike TTM revenue
$5.40B
TTM through Jul 31, 2026; Q2 FY27 revenue grew 25.8% YoY to $1.47B
CrowdStrike Q2 net new ARR
$332.8M
Q2 FY27 record; full-year FY27 guide raised by 630 bps
Palo Alto Networks TTM revenue
$11.48B
TTM through Jul 31, 2026; FY26 Q4 revenue $3.41B
Nvidia TTM revenue
$303.0B
TTM through Jul 26, 2026; Q2 FY27 record $96.2B
What moves when
Horizons: What Moves in Days, What in Years
Short-term (days to quarters): the cleanest trade is still Palo Alto Networks and CrowdStrike into their next prints. Palo Alto Networks reports Q4 FY26 (quarter ended July 31, 2026) shortly, with analyst consensus targeting $393.42 — the stock closed Sep 14 at $366.40, leaving room even after the 11% rally. CrowdStrike guides Q3 FY27 revenue to $1.523B–$1.529B and non-GAAP EPS of $0.31; that release will be the first hard test of whether the Sep 14 bid has legs. On the other side, any Nvidia Q3 FY27 commentary flagging hyperscaler 2027 capex \"discipline\" would harden the bear case against the chip complex.
Long-term (1–3 years): the structural question is whether the frontier cap actually binds. Anthropic and OpenAI are still publicly racing — Coxon resigned over the very gap Microsoft is now trying to close — and President Trump publicly rejected the slowdown calls, removing the regulatory backstop. If the voluntary cap holds and2027 development slows, Microsoft's calendar-2027 capex guide becomes the single most-watched number on Big Tech's calendar; a 10–15% reduction from the implied trajectory would reset the entire chip complex's growth assumptions. If the cap doesn't hold, the Nvidia-led complex resumes its prior multiple expansion and the cyber bid fades. The two milestones to watch are Microsoft's 2027 development update (per CNBC) and the first quarter in which a hyperscaler's capex guide misses on the downside.
How to position around the rotation
- Voluntary frontier cap turns Microsoft from pure capex beneficiary into a self-imposed brake — calendar-2026 capex guided near $175B, Q4 FY26 alone was $35.8B, and any 2027 cutcompresses the highest-margin lever in the buy-side model.
- Stock rose on Sep 14 as the responsible issuer; analyst consensus target $572.92 vs. current ~$503.70 implies the multiple still needs the capex ramp to hold.
- FY2027 development update is the next binary catalyst; TTM FCF is only $67B vs. $115.9B capex, so a10-15% capex cut would materially lift FCF margin.
- TTM revenue of $303.0B (Q2 FY27 record $96.2B) and the bulk of the chip complex's multiple expansion are tied to hyperscaler capex —a Microsoft-anchored 2027 pullback hits the order book first.
- Stock fell 2% on Sep 14 even as broader AI rhetoric hardened, and the SOX index is down ~19% from its three-month high — the most multiple-compression risk in the chip complex.
- Q3 FY27 earnings in November 2026 will be the next hard test; any hyperscaler 2027 capex comment that softens would harden the bear case.
- Closed Sep 14 at $232.08 (+12% on the day, +98% YTD) after launching Falcon Guardian, SafeMind and an Agentic Identity Provider at Fal.Con — the AI-safety narrative is now productized.
- Q2 FY27 revenue grew 25.8% YoY to $1.47B and management raised net new ARR outlook by 630 bps — the underlying business was already accelerating before the rotation.
- Q3 FY27 guide ($1.523B–$1.529B revenue, non-GAAP EPS $0.31) is the first earnings test of the Sep 14 bid; analysts at RBC, Raymond James and Wedbush raised price targets post-event.
- Closed Sep 14 at $366.40 (+11% on the day, +99% YTD) as the AI-attack-surface narrative moved from defensive hedge to direct beneficiary — TAM expansion is now codified by the frontier CEOs themselves.
- Analyst consensus price target $393.42 vs. current $366.40 leavesheadroom into the Q4 FY26 print (quarter ended July 31, 2026).
- FY2026 TTM revenue $11.48B with FY26 Q4 revenue $3.41B confirms the platform-conseleration thesis is already showing up in the topline.
- Fell roughly 10% on Sep 14 despite Q3 FY26 revenue of $29.6B —custom silicon and networking ASICs are the most levered slice of hyperscaler capex.
- AI semiconductor revenue of $16.7B last quarter (up 221% YoY) priced in continued hyperscaler build-out — a2027 capex rebase would reset the AI revenue growth rate.
- Stock now trades on the assumption that the Microsoft–OpenAI–Anthropic capex curve stays intact; any softness from Microsoft in its 2027 guide re-rates Broadcom directly.
- Network-layer beneficiary of agentic-AI proliferation — every new AI agent is another identity, request, and perimeter to defend, and Cloudflare sits in front of that traffic.
- Did not catch the same magnitude of bid as CrowdStrike or Palo Alto on Sep 14, leaving a potential underpriced entry if the cyber rotation extends.
- Q2 FY27 print in early December 2026 is the next catalyst; watch for management commentary tying AI-agent identity to network-level security spend.
