Decompose or mistake
the tide for the swimmer. Forty-three regressions, one verdict.

A price is the sum of its forces

When PANW moves, three things happen simultaneously: the market moves, the cyber sector moves relative to the market, and PANW moves relative to its sector. A single chart of PANW collapses all three into one line. A ratio chart isolates one and silences the rest.

This file runs that decomposition forty-three ways. Each pair holds a different variable constant and asks: what's left? What's left is the signal you actually want.

Where PANW actually stands

The decision tree: PANW/SPY at z=−0.93σ (36th percentile), PANW/CIBR at z=−0.12σ (54th percentile), CIBR/IGV at z=1.88σ (88th percentile).

Translated: PANW is mildly underperforming the market, exactly tracking cybersecurity, and cybersecurity is one of the most-bid sub-sectors of tech right now. The PANW underperformance vs SPY is not a PANW problem — it's reflecting IGV/SMH at z=−1.75σ, the extreme weakness of all software relative to semis.

Confirming: PANW/SMH sits at z=−1.60σ — PANW is at 2.7% of its 52-week range against semiconductors. Every software name looks broken against semis. That's the AI trade, not a PANW story.

R² is the trust score

Every pair returns a beta. Most of them are noise. The R² tells you whether to take that beta seriously.

Of 43 pairs, only four exceed R²=0.5: QQQ/SPY (0.91), CIBR/IGV (0.77), QQQ/SMH (0.77), CRWD/CIBR (0.67). For PANW specifically the cleanest hedges are PANW/CIBR (R²=0.56, β=1.18) and PANW/HACK (R²=0.53). Below R²=0.40 the regression slope is real but the residuals dominate — using it as a hedge ratio means you'll explain less than half the variance.

This is why PANW/SPY is a useful diagnostic ratio (it tells you the regime) but not a useful hedge ratio (R²=0.13). Different jobs, different ratios.

Peer ratios = market verdict on the competitive narrative

Inside cyber, the market has a strong opinion. PANW/CHKP is at z=4.53σ, the most-stretched ratio in the entire set — Check Point is being completely left behind. PANW/ZS at z=+2.42σ, PANW/OKTA near 52-week highs: PANW is winning the platform-consolidation narrative against legacy and against single-product vendors.

Against the high-growth competitors PANW is losing: PANW/CRWD at z=−0.95σ (R²=0.49 — these two genuinely move together) and PANW/NET at z=−1.61σ. The market is saying CrowdStrike and Cloudflare have stronger growth narratives than PANW, but PANW is the consolidator inside the legacy half of the space.

The cleanest take: PANW is the best of the legacy/platform names, but it's not in the same growth tier as CRWD/NET. PANW/FTNT sits at z=−0.47σ — the valuation gap (102x vs 37x P/E) hasn't closed because Fortinet is still seen as the more disciplined operator at a fraction of the multiple.

Macro pairs are mostly noise — except when they aren't

PANW vs duration and credit looks weakly related on average: PANW/TLT R²=0.003, PANW/HYG R²=0.09. You should not use these as hedge ratios. But the direction still tells you something: SPY/TLT at z=2.65σ — extreme stocks-over-bonds — confirms a peak risk-on regime.

Combine that with QQQ/HYG at z=+2.71σ (also extreme) and QQQ/SPY at z=+3.57σ (the most-stretched broad ratio in the set), and the macro picture is: we're in a Nasdaq-leadership-led, credit-tight, risk-on regime. PANW is an indirect beneficiary, but if any of those three macro extremes mean-reverts, PANW will decline alongside everything in QQQ — not because of anything PANW-specific.

This is the protective lens. When you're long PANW, you're effectively long the "big-tech-leads-the-cycle" trade. The macro ratios make that exposure visible.

The CYBR puzzle and what to watch next

The most surprising finding in the file: PANW/CYBR has correlation −0.08 and R² 0.001. PANW announced (or is integrating) CyberArk — and the market is treating these two stocks as completely unrelated. That's anomalous. Acquiring company / target pairs typically correlate strongly post-announcement; ours does not.

Three readings: (a) the deal is so far advanced that CYBR is trading on its own pre-close arb dynamics; (b) the market doesn't believe the deal will be value-accretive; (c) the integration is so opaque that fundamental investors are pricing PANW as if CYBR doesn't exist. Watch this ratio — when correlation rises, the market is starting to view PANW as PANW+CYBR. That re-rating is your signal.