The market noticed. Cable news noticed. Defence Twitter noticed. Everyone is watching the loud part.

Last week the FT ran a piece that should have stopped people in their tracks. “It’s all hands on deck: Iran’s hackers go to war.” Buried in the reporting was a line from Alexander Leslie at Recorded Future, one of the best-sourced analysts tracking Iranian cyber operations: “The loudest activity is not always the most important.”

Read that again.

The loud groups, the ones on Telegram claiming credit for DDoS attacks and website defacements, those are the fireworks. The quiet groups, the ones linked directly to Iranian intelligence, have been doing something else entirely. Searching for vulnerabilities. Scouting entry points. Pre-positioning inside target networks.

Symantec confirmed it in March. MuddyWater, a group the US and UK tie to the Iranian intelligence ministry, was already inside a US bank, a US airport, and the Israeli operations of a US defence supply chain software company before the first strike on February 28. Two previously unknown backdoors. Already deployed. Already waiting.

Then on March 11, a different group, Handala, turned Stryker Corporation’s own device management software against it and wiped tens of thousands of devices across 79 countries. No malware needed. They used Microsoft Intune, a tool that was already installed on every machine they destroyed. $12.4 billion in market cap, gone in three weeks. Chris Krebs, the former CISA director, called it a “five-alarm fire.” The stock still hasn’t recovered.

One company. One attack. One group.

And the federal agency whose entire job is to stop this from happening to every hospital, water utility, pipeline, and power grid in America? It has lost roughly half its operational capacity in fourteen months.

This is a spin-off of Epic Fury. Free to read in full. The thesis across seven prior instalments hasn’t changed: the market is mispricing the physical aftermath of the Hormuz conflict. Oil recovery isn’t V-shaped. LNG trains don’t restart with a light switch. Reservoir damage is permanent. All of that still holds. But something has been building for the last six weeks that might matter more than anything I’ve written about oil. The market is staring at the missiles and the tankers. It should be looking at the insurance contracts, the credit spreads, and the 153,000 water systems still running on default passwords.

If you’re new here: the full investment framework, tanker equities, LNG restart timelines, E&P positioning, second-order commodity plays, lives in Parts One through Seven. Sixty-plus investment firms subscribe. The rest of the Epic Fury series is available to paid subscribers.

Subscribe now

You’re watching the wrong screen.

The Agency That’s Supposed to Stop This Has Lost a Third of Its People

CISA entered January 2025 with approximately 3,400 full-time employees against 3,732 funded positions. In January 2026, Acting Director Madhu Gottumukkala testified to the House Homeland Security Committee that 2,389 positions remained filled as of December 2025. Approximately 1,000 people walked out the door through a combination of mechanisms that, taken together, look less like a budget exercise and more like institutional demolition.

The mechanisms were varied, probationary firings, two rounds of voluntary buyouts, early retirements, reassignments to border security roles (because apparently the person analyzing Iranian malware samples is fungible with someone processing asylum claims). But the contractor losses are what make the FTE headline misleading. The Joint Cyber Defense Collaborative went from over 100 ICF contractors to 10. Red team contracts were terminated on February 28, 2025, eliminating more than 100 penetration-testing specialists. Threat-hunting contracts with Nightwing and Peraton were cut in the following months. The field advisory force shrank from 164 to 97 nationwide. The Stakeholder Engagement and Requirements Division dropped from 200 to 53 positions.

The “one-third reduction” in headlines understates it. The “two-thirds” some reporters use overstates it for FTEs alone. The correct characterization: CISA’s operational capacity, combining permanent staff, contractors, and field personnel, has been reduced by roughly 40-50%, with certain critical functions degraded far more severely than that. Red teaming is gone. Threat hunting is gutted. The JCDC is a skeleton. The Cyber Safety Review Board, which was mid-investigation into China’s Salt Typhoon compromise of nine US telecom firms, was disbanded in January 2025 and has not been reconstituted.

The budget trajectory confirms this is deliberate. CISA’s enacted budget fell from $2.93 billion in FY2023 to a proposed $2.38 billion for FY2026, a $550 million cut. The Trump administration’s request eliminated 1,083 positions and cut $495 million, including $39.6 million for election security, $14 million from the JCDC, and $70 million from the National Risk Management Center. Congress has partially resisted. The House Appropriations Committee approved $2.7 billion. The Senate drafted a bill at $2.8 billion with language specifically prohibiting CISA from reducing staff “in such a way that it lacks sufficient staff to effectively carry out its statutory missions.” But as of April 1, 2026, DHS is the sole cabinet department without enacted FY2026 funding. Its appropriation lapsed entirely on February 14, 2026, triggering a partial government shutdown that has now lasted 46 days, with CISA employees working without pay.

Why this happened matters, because the causation determines whether it reverses.

In November 2020, CISA’s “Rumor Control” page debunked election disinformation. Director Chris Krebs called the 2020 election “the most secure in American history.” Trump fired Krebs by tweet. Project 2025 subsequently identified CISA as part of a “censorship industrial complex” and recommended dismantling it. DHS Secretary Kristi Noem stated at her confirmation hearing that CISA had “gotten far off mission.” On April 9, 2025, Trump signed an executive order specifically targeting Krebs personally, revoking his security clearances, suspending clearances for all employees of SentinelOne (the cybersecurity firm where Krebs then worked), and ordering a DOJ investigation.

This isn’t a budget cycle. It’s not “efficiency.” It’s a vendetta with a clear origin and a structural consequence: the one federal agency whose job it is to defend civilian infrastructure from state-sponsored cyber attack is running at roughly half capacity during an active shooting war with a state that has battle-hardened cyber operators already inside American networks.

By March 2026, Nick Andersen, the third acting director in fourteen months, testified to Congress that 60% of CISA’s workforce had been furloughed during the partial DHS shutdown and that activities “that reduce systemic risk over time” had been “scaled back or paused.”

Activities that reduce systemic risk have been scaled back. During a war.

The People Already Inside

Three groups. Pay attention to the third one.

Iran runs at least seven major state-linked cyber groups, split between the IRGC Cyber-Electronic Command and the Ministry of Intelligence and Security (MOIS). Three should concern you right now.

MuddyWater. MOIS-linked. On March 5, 2026, Symantec documented MuddyWater activity inside US networks beginning in early February, weeks before the February 28 kinetic strikes. The named targets: a US bank, a US airport, NGOs in the US and Canada, and the Israeli operations of a US defense supply chain software company. They deployed two previously unknown backdoors. They were inside before the first shot was fired.

CyberAv3ngers. IRGC. This is the group that developed IOCONTROL, which Claroty classified as a “state-level cyberweapon” targeting the programmable logic controllers that run water treatment plants, gas stations, and building automation systems. In November 2023, they compromised Unitronics PLCs across multiple US water utilities, including the Municipal Water Authority of Aliquippa, Pennsylvania. The exploit: they got in using the default password “1111” on internet-facing devices. The Treasury Department sanctioned six IRGC officials. The fundamental vulnerability, thousands of exposed industrial control systems with default credentials, remains substantially unpatched.

Handala. MOIS-linked. This is the group that hit Stryker. They deployed the wiper through Microsoft Intune, a legitimate endpoint management tool already installed on the target devices. Living-off-the-land attacks are the hardest class of intrusion to detect because the tools involved are the same ones defenders rely on daily.

The telemetry looks normal until it’s too late.

Iran’s wiper arsenal now includes at least 15 known malware families. Unlike ransomware, these don’t encrypt your data and demand payment. They delete it. Permanently. The objective is destruction, not profit.

The ODNI’s March 2026 Annual Threat Assessment confirmed: “Iran maintains persistent intent to target the U.S.” The intelligence community assesses that Iranian cyber operators “have previously used cyber attacks to effect against poorly defended targets and weaker opponents.”

Poorly defended targets and weaker opponents. Fourteen months ago, that didn’t describe American critical infrastructure. I’m not sure that’s still true.

153,000 Water Systems and a Default Password

Now look at what they’re pointing at.

The United States has 16 designated critical infrastructure sectors. Only four or five of them have mandatory cybersecurity standards: the bulk electric system (under NERC-CIP), nuclear facilities (NRC regulations), pipelines and rail (TSA Security Directives issued since 2021), and financial services (SEC and GLBA rules). The remaining 11 to 12 sectors, including water, healthcare, food and agriculture, commercial facilities, and critical manufacturing, rely on voluntary frameworks. Voluntary, in practice, means optional. Optional, in practice, means most of them do nothing.

Water is where all three lines cross: Iranian capability, demonstrated intent, and American vulnerability. This isn’t hypothetical. CyberAv3ngers already hit US water systems in November 2023. The default password was 1111.

The United States has approximately 153,000 public drinking water systems and more than 16,000 wastewater treatment systems. The vast majority are small municipal operations, decades behind on cybersecurity, staffed by people whose expertise is water chemistry, not network defense. When the EPA attempted to require cybersecurity evaluations through sanitary surveys in March 2023, Missouri, Arkansas, and Iowa sued. The 8th Circuit stayed the rule. The EPA withdrew it by October 2023.

The result: cybersecurity for the vast majority of US water systems is entirely voluntary.

The numbers are almost comical if you don’t think about what they mean for public health. An EPA enforcement alert found more than 70% of inspected water systems violated basic requirements under AWIA Section 1433, which only requires risk assessments, not actual security controls. The EPA Inspector General identified critical vulnerabilities in 97 drinking water systems serving 26.6 million people. Censys researchers found approximately 400 web-based control interfaces for US water facilities exposed directly to the internet in October 2024, 40 of them with zero authentication. Anyone, from anywhere, could adjust chemical dosing or pressure levels.

Healthcare is similarly exposed. The average hospital has 10 to 15 connected medical devices per bed. The FBI Cyber Division reports that 53% of connected medical devices and other IoT devices in hospitals have at least one known critical vulnerability. The Change Healthcare ransomware attack of February 2024 cost $872 million in the first quarter alone and ultimately compromised approximately 190 million patient records. There is no hospital OT security regime comparable to NERC-CIP for the grid; HIPAA’s Security Rule covers electronic health information, and the FDA now requires cybersecurity evidence for new device submissions, but neither mandates the kind of operational technology controls that would stop a wiper moving through a hospital network.

Across all sectors, Censys documented over 145,000 exposed industrial control system services globally, with 38% located in North America, over 48,000 of them in the United States. More than half of the exposed US systems operate on wireless and commercial internet service providers including Comcast and Verizon, rather than dedicated industrial networks. Dragos’s 2026 OT Cybersecurity Report found the number of ransomware groups targeting OT environments up 49% year-over-year (from 80 to 119), with an average dwell time of 42 days. Six weeks of undetected access before anything detonates.

Whether this infrastructure is vulnerable isn’t the question anymore. That’s settled. What happens to specific assets when it gets exploited, that’s the question.

“But What About Cyber Command?”

This is the rebuttal I hear most, and fair enough.

US Cyber Command is extremely capable. During Operation Epic Fury, CYBERCOM, in coordination with Israeli cyber units, drove Iran’s internet to somewhere between 1% and 4% connectivity during the opening phase of the campaign, compounded by Iran’s own defensive shutdowns of domestic networks. General Dan Caine, the Chairman of the Joint Chiefs of Staff, confirmed that “coordinated space and cyber operations effectively disrupted communications and sensor networks” before kinetic strikes. CYBERCOM was the first mover. This is impressive, and the offensive capability is real.

But CYBERCOM’s mandate is not defending your local water utility. Its mandate is defending DoD networks and projecting power in cyberspace. It operates under Title 10 military authorities. Its Cyber National Mission Force conducts “hunt forward” operations on foreign networks to disrupt threats at their source.

It has no authority and no mechanism to patch a Unitronics PLC in Aliquippa, Pennsylvania. That mission, the granular, unglamorous work of helping thousands of water systems implement basic hygiene, belongs to CISA

And there’s a resource problem. The Council on Foreign Relations addressed this directly in its March 16, 2026 analysis: offensive combat support missions “should be the top priority for U.S. Cyber Command, but they may limit its capacity to perform counter-cyber missions in defense of domestic critical infrastructure.” The Foundation for Defense of Democracies went further on March 27, warning that Iranian cyber operations are “taking advantage of weakened U.S. defenses” while CISA is in “freefall”, with roughly 60% of the agency’s workforce furloughed.

CYBERCOM has its own problems. The FDD’s March 2024 study, based on 75 interviews, found that CYBERCOM’s 2018 certification of all 133 Cyber Mission Force teams at full operational capacity was “hollow.” The command “merely shifted a limited number of effective personnel from team to team to make them appear complete at the time of certification.” The new CYBERCOM commander, General Joshua Rudd, was confirmed on March 10, 2026, with no direct cyber experience. He is a career special operations officer from Indo-Pacific Command. Senator Ron Wyden voted against confirmation, stating “there is simply no time for on-the-job learning.”

The architecture of US cyber defense has a designed-in gap: CYBERCOM handles hardened military networks and offensive operations abroad. CISA handles the sprawling mess of civilian critical infrastructure. Degrading one and surging the other does not close the gap. It widens it.

Israel Intercepted 97% of Iranian Wipers. The US Has No Equivalent.

Israel’s National Cyber Directorate (INCD) reports directly to the Prime Minister’s Office and can issue binding security instructions to designated critical infrastructure operators. CISA can issue Binding Operational Directives only to federal agencies. It has no equivalent authority over the private sector. None.

During the current conflict, INCD Director-General Yossi Karadi reported that Iran attempted to wipe data from “thousands of Israeli businesses.” They succeeded 50 times. That is a greater than 97% interception rate. Zero significant damage to designated critical infrastructure. Average incident response time reduced from over six hours to approximately 30 minutes.

Not a simulation. Real Iranian APT groups throwing real wiper malware at real infrastructure during a real war.

The comparison has obvious limitations. Israel is compact, has universal conscription, and its cultural cohesion enables coordination that may not scale to American dimensions. But the directional conclusion holds: centralized active defense with operational authority produces measurably better outcomes against a sophisticated state adversary than a fragmented, voluntary, advisory-only model. The US is now operating an even more degraded version of the already weaker model.

For those just finding this letter: TSCS publishes institutional-grade research across equities, credit, commodities, and macro. Primary data, not consensus. This is one of over 70 deep dives in the library. The full Epic Fury series, plus everything else we publish, is available to paid subscribers. 15,000+ readers. 60+ investment firms. If the work resonates, you know what to do.

Subscribe now

The Lloyd’s Binary: The Chokepoint Nobody Is Watching

Now here’s where it gets interesting. I haven’t seen anyone else frame this.

In August 2022, Lloyd’s of London mandated (Market Bulletin Y5381) that all standalone cyber insurance policies in the Lloyd’s market include state-backed cyber attack exclusion clauses, effective at policy inception or renewal from March 31, 2023. The most widely adopted clause, LMA5567A, does not blanket-exclude state-sponsored cyber attacks. It excludes them only when specific thresholds are met: the attack must be attributable to a state, the affected systems must be located in a country that qualifies as an “impacted state,” and the attack must cause “major detrimental impact” on that state’s ability to function or on its security capabilities.

The logic was straightforward: after NotPetya caused $10 billion in damage and triggered years of legal disputes over whether it was an “act of war,” Lloyd’s decided to draw a bright line.

The Stryker attack is the first real-world test of these exclusions during an actual armed conflict between the United States and a foreign state.

Walk through what has to happen for the exclusion to trigger. Handala is assessed by the US government and multiple cybersecurity firms to be linked to Iranian intelligence. The US and Iran are in an active military conflict. The attack was destructive, not criminal. It had no financial motive. Stryker itself confirmed there was no indication of ransomware or malware, the attackers appear to have compromised Azure Active Directory credentials and used Microsoft Intune’s legitimate remote-wipe functionality to erase devices across 79 countries. By any reasonable reading, this is exactly the scenario the exclusion clauses were written for. But the attack vector triggering a vendor’s own device management tool rather than deploying traditional wiper malware, could complicate the legal categorization, and any insurer looking for ambiguity will find it there.

But none of these thresholds have been adjudicated for the Stryker attack. The forensic attribution hasn’t been formalized through the clause’s own mechanism. The connection to the conflict hasn’t been legally established. The exclusion clauses are, as of right now, untested in a real-world wartime scenario.

There is one critical precedent. In January 2022, a New Jersey Superior Court ruled that Ace American Insurance could not invoke the traditional war/hostile acts exclusion to deny Merck’s claim from the NotPetya attack. Merck estimated its damages at approximately $870 million; its insurance claim under a $1.75 billion all-risk policy totaled $1.4 billion. The court held that the standard policy language about “hostile or warlike action” had always been understood by insureds to apply to conventional armed conflict, and that insurers had never updated the language to put policyholders on notice that it would extend to state-sponsored cyber operations. Lloyd’s directed the market to adopt new exclusion language, and the LMA published revised model clauses in January 2023, of which LMA5567A became the most widely used. (The B variants omit attribution mechanisms and are not Lloyd’s-compliant without prior approval, an important distinction if this goes to litigation, since which version a specific policy uses will determine the procedural pathway.) The new language was designed to capture exactly the gap the Merck court identified. But the new clauses have never been tested in court. The Stryker case is therefore not just the first test of war exclusions during a cyber conflict. It’s the first test of clauses that were specifically rewritten because the old ones failed.

Three scenarios. All three are investable.

Scenario A (25% probability): The exclusion holds cleanly. Lloyd’s syndicates invoke LMA5567A/B and decline to cover the Stryker losses. Stryker absorbs the full cost of the attack. Every Fortune 500 CISO and CFO in America immediately re-reads their cyber policy and discovers that their coverage may be worthless in the current threat environment. Demand for gap coverage, parametric triggers, and alternative risk transfer spikes. Companies that thought they had transferred their cyber risk to insurers realize they’re self-insured against state-sponsored attacks during the single moment when state-sponsored attacks are most likely.

Scenario B (30% probability): The exclusion doesn’t hold. Stryker’s insurers pay the claim, either because the forensic attribution isn’t clean enough, or because the political and reputational cost of denying a wartime claim to an American company is too high, or because the legal test of “major detrimental impact on state functioning” isn’t met by a corporate IT wipe. In this case, the loss ratio on cyber books blows out. Beazley, Hiscox, and every Lloyd’s syndicate with cyber exposure takes the hit. The reinsurance tower reprices. Premium increases that S&P projected at 15-20% for 2026 accelerate sharply.

Scenario C (45% probability): It drags. Handala deployed the wiper through Microsoft Intune, a legitimate endpoint management tool already installed on Stryker’s devices. From a forensic standpoint, an Intune remote-wipe looks functionally identical to an authorized IT administrator making a catastrophic error. Proving, to the standard required by LMA5567A’s attribution mechanism, that this was a state-directed act meeting the “major detrimental impact” threshold will be a protracted legal fight. The Merck/NotPetya litigation took five years to reach a Superior Court ruling, and that was on the old exclusion language, which the court found had never been updated to put policyholders on notice. The new LMA5567 clauses were specifically rewritten to close that gap, but they have never been tested. The first test will not be fast. And prolonged ambiguity is not neutral.

While the litigation runs, every insurer with a cyber book faces the same question from every policyholder: “Am I covered or not?” Every CFO running a risk budget faces the same question from the board: “Should we assume our cyber policy pays out in a state-linked attack, or should we reserve as though it won’t?” Uncertainty forces conservative behavior on both sides of the market. Insurers tighten underwriting standards and raise premiums to build reserves against an undefined liability. Corporates increase self-insurance allocations, accelerate cybersecurity spending, and demand new products (parametric triggers, affirmative coverage endorsements) that didn’t exist at scale six months ago. The ambiguity itself is a catalyst. It doesn’t need a verdict.

The legal fact pattern favors the insurer more than NotPetya did, but the “major detrimental impact” threshold in LMA5567A is high. The clause requires disruption to essential services at a state level, not corporate-level damage, however severe. Wiping a medical device company’s laptops is devastating for Stryker; whether it meets the bar of impairing the functioning of the United States is a different question. That’s what keeps Scenario A at 25% rather than higher

There’s a tension in these weights worth flagging. The fact pattern here is cleaner than NotPetya: unlike the Russia-Ukraine connection, which was indirect and where the damage was collateral, the Stryker attack occurred during a declared military conflict between the US and Iran, was executed by a group the US government formally ties to Iranian intelligence, and was purely destructive. The LMA5567 language was designed for exactly this fact pattern, which is what pulls Scenario A above 20%. But “designed for” is not the same as “survives litigation.” The attack vector, a living-off-the-land technique using the victim’s own device management infrastructure, gives any insurer looking for forensic ambiguity exactly enough to fight. And insurers always fight. The Merck precedent, where courts sided against the insurer on the old language, creates a judicial baseline that makes clean denial risky. The result is that neither side has an overwhelming legal advantage, which is precisely why this drags.

The chart tells you something I didn’t expect.

Beazley is up 55.8% year-to-date. Hiscox is up 11.4%. The FTSE 250 is down 3.4%. The market loves these stocks. Beazley’s spike came in mid-February, likely on earnings, before the strikes even began. The cyber insurance growth story is very much priced.

But look at March 11. The day Handala wiped Stryker. Neither stock moved. At all.

The market is pricing Beazley as a growth story: more cyber attacks mean more demand for cyber insurance mean higher premiums mean bigger book. That’s true. But it’s pricing the upside of the threat environment without pricing the downside of the exclusion test. If the LMA5567 clauses fail and Beazley has to pay the Stryker claim, the loss ratio impact hits a stock trading at 56% above where it started the year. If the clauses hold and corporates realize their cyber coverage is worthless during wartime, the long-term premium volume thesis takes a hit. Either way, the binary isn’t in the price. The stock didn’t even notice the triggering event.

This isn’t a “buy Beazley” call. If anything, it’s a caution for anyone already long. And it’s a potential opportunity for anyone with access to London-listed options who wants to express a view on the exclusion outcome at what appears to be normal implied volatility levels.

For more sophisticated portfolios, the deeper trade may sit further up the chain: the reinsurance and retrocession market where the actual systemic tail risk accumulates. Catastrophe bond spreads and ILS fund performance are the canary. If the retrocession market starts pricing cyber war risk before the primary equity market does, that’s your confirmation signal. As of April 1, it hasn’t.

Beazley’s cyber book wrote $1.164 billion in gross premiums in 2025, representing 19.1% of total GWP of $6.1 billion. This is not a niche line. It is a fifth of the company’s business and has been its fastest-growing segment, roughly tripling from $827 million in 2019. The combined ratio on the cyber book was 75.6% in 2025, up from 64.4% in 2024, with the loss ratio climbing from 39.4% to 46.3%. The margin of safety is 24.4 percentage points. That sounds comfortable until you consider what a single state-sponsored claim, or a cluster of them, could do to it.

The rebuttal writes itself: Beazley doesn’t eat a systemic loss raw. Primary cyber insurers cede tail risk through reinsurance and retrocession towers. Beazley’s net retention on any single cyber event is a fraction of gross exposure. The market knows this, which is part of why the stock didn’t move on March 11. Fair enough. But the reinsurance tower doesn’t eliminate the risk; it redistributes and potentially amplifies it.

If the LMA5567 exclusion holds (Scenario A), the reinsurance tower is never tested, because the primary insurer denies the claim before it reaches the cession. The repricing happens at the policyholder level: corporates discover their coverage is worthless in wartime, and the demand side of the cyber insurance market restructures.

If the exclusion fails (Scenario B), the claim flows through the tower, and every layer reprices: primary, reinsurance, retrocession, and the ILS market that backstops the tail.

This matters even more given where the market was heading before the conflict: Swiss Re’s September 2025 update documented a third consecutive year of cyber rate deterioration, and the January 2026 renewal season reflected continued softening across the broader reinsurance book. The market was loosening precisely when the threat environment was tightening. A failed exclusion test, or even prolonged ambiguity around one, reverses that trajectory violently.

A failed exclusion test accelerates that repricing across the entire chain.

And if it drags (Scenario C), the reinsurers face the same ambiguity as the primaries, and ambiguity in reinsurance pricing flows downhill. Beazley’s 2026 renewal negotiations for its own reinsurance protection will be conducted in the shadow of an unresolved coverage question on the single largest state-attributed cyber event in its book’s history. The reinsurance tower is not a shield against the adjustment I’m describing. It is a transmission mechanism.

I searched Bloomberg for any Beazley management commentary addressing Stryker. One result. A single Industry Dive article from March 25 mentioning the attack in connection with Beazley. Zero analyst notes. Zero updated guidance. Zero indication of reserve strengthening. I searched “War Exclusion” across all Beazley filings. 25 documents came back, but the most recent management discussion of the exclusion mechanics predates the Iran conflict entirely. Beazley’s leadership is running a $1.16 billion cyber book, the Stryker attack has handed them the first real-world test of the clauses their entire product line depends on, and they have not publicly addressed it.

Lloyd’s own systemic risk modeling, published with the Cambridge Centre for Risk Studies in October 2023, estimates a $3.5 trillion weighted-average GDP loss over five years from a hypothetical attack on financial services payment systems, with the US absorbing $1.1 trillion. That’s modeled as a 1-in-30-year event. The global cyber insurance market writes roughly $16 billion in annual premiums.

These aren’t apples-to-apples, premiums fund a reserve structure, not a one-to-one loss pool. But the orders of magnitude tell you everything.

The modeled tail risk dwarfs the market’s capacity to absorb it by a factor that makes the protection gap less a gap and more a canyon. And the first rock just fell in.

The Stryker Template: What Repricing Actually Looks Like

The historical playbook calibrates what to actually expect, and how fast. Because the pattern of state-linked destructive cyber attacks is remarkably consistent, and it tells you both how bad it gets and how fast.

The chart tells an uncomfortable story for my thesis.

Maersk dropped 6% and never recovered in the quarter. Merck dipped roughly 2% and was back to flat within weeks. FedEx, whose TNT Express division absorbed $400 million in losses, actually rallied 14% over the same period. The equity market treated the most expensive cyber attack in history as a one-time event. This is real evidence for the steelman. If NotPetya couldn’t durably reprice equity, why would the next Iranian wiper?

Honest answer: maybe not, at the single-name equity level. The Stryker drawdown is running longer than any NotPetya name, but the real story is in credit, not equity.

NotPetya, June 27, 2017. Attributed to Russian military intelligence. A supply chain attack through Ukrainian accounting software that spread globally and wiped systems indiscriminately. Merck suffered approximately $870 million in direct damages and filed an insurance claim for $1.4 billion. Maersk lost $250-300 million. FedEx’s TNT Express division lost $400 million. Total estimated damage exceeded $10 billion. It remains the most expensive cyber attack in history.

The dwell time data is what matters for the current threat. NotPetya’s attackers had a backdoor inside M.E.Doc’s update infrastructure for at least 6 weeks before detonation, with Cisco Talos finding evidence as early as April 2017, roughly 2 to 3 months before the June 27 attack. The Ukraine 2015 grid attack involved 6 to 8 months of pre-positioning before a 10-minute execution that cut power to 225,000 customers. SolarWinds operated undetected for more than 14 months. Shamoon sat inside Saudi Aramco’s network for 3 to 4 months before destroying 30,000 workstations.

The pattern: lengthy preparation that is detectable in theory but frequently missed in practice, followed by near-instantaneous destruction that is too fast to stop once triggered.

MuddyWater’s confirmed pre-positioning inside US networks, including a bank, an airport, and a defense-aerospace software supplier, began in early February 2026, according to Symantec and Carbon Black’s Threat Hunter Team. That is approximately two months ago. We are inside the historical window for every major state-backed destructive attack in the modern record.

Look at where the repricing actually happened. AMLP, the midstream equity ETF, didn’t flinch. It continued a steady uptrend as though nothing happened. RBOB gasoline futures spiked roughly 20% in the two weeks following May 7. The transmission mechanism ran through the commodity, not the equity. This matters for how you think about your pipeline positions.

Colonial Pipeline, May 2021. A criminal ransomware gang shut down 45% of East Coast fuel supply for six days without ever touching the pipeline’s operational technology. I’ll come back to why that distinction matters when we get to your midstream positions.

So what happens when the attacker isn’t a criminal gang looking for a payday, but a state-backed group with destructive intent, pre-positioned access, and zero interest in negotiation, hitting infrastructure that was never hardened for this threat level, and they don’t even need to touch the OT layer to shut it down?

SYK’s 1-month realized volatility tells the story in one chart. Through February, the stock was trading at 21-22 vol, one of the calmest readings of the year. By mid-March, it had spiked to 33.6. It hasn’t come down. As of April 2, it sits at 31.7, more than 50% above its pre-attack baseline. The market was sleepwalking, and it’s still not fully awake.

The Trade

If your first instinct is to buy cybersecurity stocks, note that CIBR, the largest cyber ETF, is down 13% year-to-date.

The market sold off cybersecurity names during the most active period of state-sponsored cyber warfare in US history. Growth-to-value rotation, apparently. The asymmetry isn’t in cyber equity.

The Insurance Trade

If the Beazley and Hiscox chart showed no meaningful reaction to Stryker, that’s the trade. The market hasn’t priced the Lloyd’s exclusion binary.

For sophisticated investors, the options market on London-listed specialty insurers may offer a way to express this view cheaply if implied vol is still at normal levels. The catalyst has a defined timeline: the industry’s coverage determination framework on Stryker-type attacks will be tested within months, not years.

The irony is critical for the trade structure: Stryker did not carry cyber insurance. This is confirmed by both Coalition and Gallagher Re, based on Stryker’s own governance disclosures and regulatory filings.

Stryker chose not to buy cyber coverage. Ate the full cost.

That means the test of Lloyd’s war exclusions on a state-attributed wiper will not come from Stryker directly. It will come from downstream: third-party business interruption claims, contingent loss triggers, and the hospitals and distributors whose operations seized when Stryker’s supply chain went dark.

The exclusion question is now live. It was made live by the fact pattern, not by Stryker’s policy status. And the downstream claims pathway is, if anything, messier for insurers to adjudicate than a direct first-party claim would have been, because each claimant’s policy wording, attribution mechanism, and “major detrimental impact” threshold may differ across a fragmented tower of coverage.

The Credit Trade

This is not a completed trade idea. It’s a screening framework that illustrates where the most exposed corner of the market sits, so you can size the tail risk that isn’t being priced. I’m publishing it now because Q1 earnings are weeks away and you need to be looking at this before the catalysts arrive, not after.

Community Health Systems is the name I keep coming back to.

CYH has a market capitalization of $408 million. It carries $10.3 billion in total debt. The debt is 25 times the equity. Net Debt/EBITDA is 6.6x. Debt as a percentage of total capitalization is 113%, meaning the company has negative book equity. The maturity wall starts in 2029 with $1.9 billion coming due, followed by $2.8 billion in 2030. The 2nd lien bonds, $1.24 billion at 6 7/8% due April 2029 and $1.23 billion at 6 3/8% due April 2030, trade at spreads of 491 and 671 basis points respectively. The ABL facility includes a springing fixed charge coverage ratio that triggers if availability drops below $95 million. As of year-end 2025, CYH had $786 million of ABL availability. That’s the cushion.

The 10-K has extensive disclosure about liquidity risk, debt covenants, refinancing risk, and potential defaults. It acknowledges that “a breach of any of these covenants could result in a default” and that “all amounts outstanding may become immediately due and payable.” What it does not contain, anywhere in the risk factor or liquidity discussion, is a substantive assessment of cybersecurity risk to operations, OT security posture, incident response capability, or business continuity planning for a destructive cyber event.

This is a company operating 70 hospitals that handles protected health information for millions of patients, carrying 25-to-1 debt-to-equity, with a maturity wall approaching, while state-sponsored groups are actively targeting healthcare infrastructure.

A Stryker-scale attack that shuts down operations for three weeks doesn’t just stress the P&L. It triggers a liquidity crisis. Yes, the government would likely step in with accelerated Medicare payments, as CMS did during the Change Healthcare attack in 2024. But those are advances against future revenue, not grants.

They keep the lights on. They don’t replace lost surgical volume, and elective procedures are where all the margin lives. When trailing-twelve-month EBITDA craters, the maintenance covenants on the term loans don’t care whether CMS floated you bridge cash. The springing covenant trips. The ABL draws down. The conversation with lenders begins from a position of negative equity.

This isn’t a recommendation to short CYH debt. In practice, lenders would likely grant forbearance and waive the covenant rather than accelerate into Chapter 11 over a wartime cyber event.

But forbearance comes with amendment fees, tighter terms, and accelerated refinancing timelines that compress whatever equity remains. It’s a map of what the most exposed corner of the market looks like, so you can size the tail risk that isn’t being priced.

The Stryker template tells you exactly how this works.

A destructive wiper shuts down operations for two to four weeks. Revenue stops. EBITDA for the quarter craters. For a company running at 6.6x leverage with a target of getting below 5.5x, one bad quarter from a cyber attack doesn’t just hurt the stock. It breaches the covenant. It triggers a technical default. It forces a conversation with lenders that nobody is prepared for.

The healthcare sector is the obvious target. Not because Iran specifically wants to attack hospitals (although Stryker suggests they’re not ruling it out), but because healthcare has the combination of high leverage, weak cyber defenses, operational concentration risk, and direct relevance to public fear that makes it the highest-impact target available. How exposed are hospitals? The honest answer depends on what you count. A 2022 Cynerio study, which the FBI subsequently cited, found 53% of connected medical and IoT devices in hospitals had known critical vulnerabilities. But that number includes printers, VoIP phones, and every other networked device. Newer Armis data scoping only clinical equipment puts the figure closer to 19%. Use whichever number you want. Neither is acceptable for systems connected to patients. There are no mandatory OT security standards for healthcare, though HHS has proposed making HIPAA security requirements mandatory rather than “addressable”, finalization isn’t expected before mid-2026. And the Change Healthcare attack already demonstrated the cascading consequences when a single node in the healthcare IT chain fails.

CYH doesn’t have liquid CDS, which is itself a data point: there’s no market mechanism for pricing this risk at the most levered healthcare issuer. HCA, the largest US hospital chain, does. Its 5-year CDS trades at 67 basis points. The chart shows it ranging between 44 and 90 over the past two years. Change Healthcare was attacked in February 2024. HCA CDS didn’t widen. Stryker was wiped in March 2026. HCA CDS didn’t widen. The most consequential wartime cyber attack in US history, targeting healthcare infrastructure, and the credit default swap market for the largest hospital company in America registered nothing. The credit market is not pricing cyber risk in healthcare.

The munis angle is even more overlooked. Municipal water utilities with revenue bonds face a specific risk. A prolonged boil-water advisory from a cyber disruption, whether it lasts days or weeks, impairs the revenue base that services the debt.

If the vulnerability that CyberAv3ngers exploited at Aliquippa remains substantially unremediated across the installed base, the target set is known, the capability is demonstrated, and the defenses are absent.

Your Pipeline Positions

I know who reads this letter. A lot of you own midstream energy names. Enterprise Products. Williams. Kinder Morgan. Energy Transfer.

Colonial Pipeline was a midstream operator. DarkSide, a criminal gang, hit the billing system. Never touched the physical pipeline controls. Colonial shut itself down because it couldn’t meter or invoice deliveries and couldn’t verify OT integrity. 45% of East Coast fuel supply went dark for six days.

Actual severe shortages concentrated in five to seven southeastern states, but panic buying amplified the disruption: Charlotte hit 71% of stations dry, Washington D.C. reached 87%. The TSA issued Security Directives in the aftermath, so pipelines are better defended than water systems. But “better defended than water” is not the same as “defended.” And the Colonial precedent tells you something the TSA Directives don’t address: you can air-gap the OT network perfectly and still lose operations for weeks if the IT layer goes dark.

Here’s the leverage table for the midstream names you probably own:

ET, ONEOK, and Kinder Morgan are all running above 4.4x. These are investment-grade credits and the leverage isn’t alarming in a normal environment. But Colonial Pipeline was a normal-environment company too.

The question for each of these names: not whether the OT network is air-gapped from IT, but whether the company can keep operating, billing, and delivering if the IT side goes dark for two weeks.

Colonial’s OT was reportedly segmented. It didn’t matter. The billing system went down and the pipeline stopped.

I read all six 10-Ks. Two disclose what I’d call substantive cyber programs. Williams discloses a dedicated CISO, a six-member Cybersecurity Executive Advisory Board (CIO, CFO, CHRO, General Counsel, COO), board-level cybersecurity dashboards reviewed at every regularly scheduled board meeting, and explicit TSA compliance tracking. Kinder Morgan discloses a dedicated cybersecurity group whose leaders hold top-secret US government clearances, have attended classified briefings in Washington, carry over 100 years of combined cybersecurity experience, and report quarterly to a named senior management team that includes the CEO, President, CFO, COO, and General Counsel.

The other four disclose materially less. Energy Transfer and ONEOK describe NIST-aligned programs with periodic reporting, but neither names a dedicated CISO and ONEOK discloses board-level cyber briefings only annually. Targa discloses tabletop exercises and third-party assessments but no named cybersecurity leadership. Enterprise Products discloses no cybersecurity framework, no named cybersecurity leadership, no governance detail beyond a standard risk factor, and explicitly states it does not carry cybersecurity-specific insurance.

Not a short call on pipelines. Fundamentals are fine. But if you own midstream names and don’t know which category yours falls into, you’re carrying risk you haven’t sized.

The Steelman: Why I Might Be Wrong

Pressure test.

Iran has never achieved strategic-scale disruption of hardened US infrastructure. The Stryker attack was a corporate IT wipe. It was not an attack on a power grid, a water system, or a military network. Iran’s most prominent ICS threat group, CyberAv3ngers, built its initial access on default passwords, not zero-day exploits, though by late 2024, Claroty documented IOCONTROL, a custom-built malware platform the group deployed against IoT and OT devices across multiple vendor platforms, only the tenth known ICS-specific malware family ever identified. The IISS classifies Iran as a “third-tier” cyber power, two full tiers below the US, and one below Russia, China, the UK, and Israel, defined as having “potential strengths in some categories but significant weaknesses in others.” CSIS senior fellow Nikita Shah stated in March 2026: “Iranian cyber operations are unlikely to impact or change the course of this war.” That’s a credentialed analyst at a serious institution making a confident call against my thesis.

The “cyber Pearl Harbor” prediction has a 35-year track record of not happening. Leon Panetta later described his 2012 warning as a form of “shock therapy” aimed at the American people and at Cyber Command, not, as is commonly misattributed, at Congress specifically. Thomas Rid’s core argument, that no cyber offense has ever been simultaneously lethal, instrumental, and political, remains essentially valid as of April 2026. Valeriano and Maness’s empirical analysis of 110 cyber incidents found them to be “a little-used tactic, with low-level intensity and few to no long-term effects”. Their dataset has been challenged for ending before NotPetya, SolarWinds, and Colonial Pipeline, but the directional finding still holds: catastrophic cyber events remain rare, and betting on them has historically been a losing trade.

The conflict itself has degraded Iranian cyber capability. Iran’s internet has been at 1-4% connectivity for 27 consecutive days. Israeli strikes hit the IRGC cyber warfare headquarters in eastern Tehran and may have killed the MOIS deputy intelligence minister overseeing Handala operations. Palo Alto’s Unit 42 assessed that “the loss of connectivity and significant degradation of Iranian leadership and command structures will likely hinder the ability of state-aligned threat actors to coordinate and execute sophisticated cyberattacks in the near-term.” You can’t hack if you can’t get online.

No major think tank is framing CISA degradation as creating imminent catastrophic risk. CSIS, CFR, RAND, Atlantic Council, and Brookings have all published on Iranian cyber operations and Trump administration cyber strategy. None has framed the CISA cuts as creating the specific catastrophic asymmetric risk I’m describing here. These institutions employ professional analysts specifically tasked with identifying such risks. Their relative silence is data.

CISA is one node in a broader ecosystem. CYBERCOM, NSA, FBI Cyber Division, Five Eyes intelligence sharing, sector-specific ISACs, and a $240 billion private cybersecurity industry all contribute to the defense. The CISA headcount metric, while real, may overstate the effective degradation.

All five are real. But the steelman has two weaknesses that keep me positioned.

First, it conflates “strategic-scale” with “investment-relevant.”

The thesis doesn’t need Iran to bring down the power grid. Doesn’t need a cyber Pearl Harbor. It needs one more repricing event.

The Stryker attack erased roughly $9.5 billion in market capitalization from a single company within the first week, with the drawdown deepening to over $12 billion at its trough. Colonial Pipeline triggered FMCSA emergency declarations across 17 states and D.C., with actual fuel station outages concentrated in roughly 11 southeastern states. NotPetya cost $10 billion across more than 2,300 organizations in over 100 countries, with the heaviest financial losses concentrated in roughly ten multinationals. None of these were strategic-scale. All of them repriced assets dramatically.

Wrong question: “can Iran cripple America’s infrastructure?” Right question: “can Iran hit another Stryker-scale target in a sector with weaker defenses and more systemic leverage?”

Second, the think tanks have actually raised alarm. CFR published “Trump’s Cyber Strategy Falls Short on China, Iran, and the Threats That Matter Most” in March 2026. FDD explicitly warned that Iranian operations are “taking advantage of weakened U.S. defenses.” The absence of a specific “imminent catastrophic risk” framing may reflect institutional caution about predictions, not analytical disagreement about the underlying vulnerability.

Think tanks don’t make investment calls. I do.

This is a risk-premium trade, not a prediction. The defensive posture is visibly degraded, the adversary is confirmed pre-positioned, the historical dwell-time window is active, and multiple asset classes are priced as though none of this is happening.

Probability weights: I assign these weights for portfolio sizing purposes, not because I believe the underlying probability is knowable with this precision. The sample of state-vs-state destructive cyber operations during active conflict is too small to derive base rates. What follows is scenario weighting based on the five factors laid out above, all active simultaneously, calibrated against the historical precedents discussed in this piece. If your framework requires point estimates to size a position, use these. If it doesn’t, the directional logic matters more than the specific numbers.

Probability that at least one additional Stryker-scale destructive cyber attack hits a US company or critical infrastructure operator in the next six months: 60-70%.

Any one of the five factors alone (degraded defenses, confirmed pre-positioning, demonstrated adversary capability, historical dwell-time window, voluntary-only security standards across most target sectors) wouldn’t justify this weight. The conjunction is what moves it.

Probability that such an attack hits a sector with meaningful credit or equity dislocation potential, healthcare, water/munis, energy infrastructure: 40-50% conditional on the attack occurring.

Probability that the Lloyd’s exclusion binary resolves definitively within 12 months: 30-40%. This is lower than I initially estimated, and the revision matters. The living-off-the-land attack vector and the absence of traditional malware signatures make forensic attribution legally contestable in a way that favours protracted proceedings. But a definitive resolution is not required for the trade to work. The uncertainty itself reprices risk budgets across the corporate and insurance sectors within quarters, not years.

The combined probability of at least one of these catalysts triggering a dislocation I’d define as investable, meaning: Beazley or Hiscox moving more than 10% on a single session on exclusion-related news, HCA 5-year CDS widening past 120 basis points, a municipal water utility revenue bond downgrade citing a cyber incident, or a second 8-K filing from a healthcare operator disclosing a destructive cyber event within 90 days of Stryker: I put it around 50-55%.

That’s high enough to position around. Not high enough to bet the book. And if the number is wrong by ten points in either direction, the asymmetry in the payoff structure still favours the position: the cost of being wrong on the long side (you miss a vol spike in specialty insurers, you hold midstream names that continue to perform) is modest. The cost of being wrong on the short side (you’re unhedged against a repricing event in credit markets that haven’t moved through two years of escalating attacks, and the Lloyd’s exclusion binary resolves against your book) is severe.

Kill Switches: I’m Wrong If…

What kills the trade:

1. CISA staffing is restored above 3,000 FTEs with contractor support reconstituted. That would mean the political headwinds have reversed and the defensive gap is closing. I’d need to see the JCDC contracts re-awarded, red team capability rebuilt, and field advisors back above 150 nationwide. A budget deal alone isn’t enough. I need to see bodies in seats.

2. A formal joint CISA/NSA/CYBERCOM advisory states that Iranian cyber intrusions in US critical infrastructure networks have been identified and contained. Not a generic threat warning. A specific assessment that the pre-positioned access documented by Symantec and others has been remediated.

3. A ceasefire that removes the operational trigger for escalatory cyber operations. Iranian cyber attacks have historically tracked the intensity of the broader geopolitical confrontation. A genuine de-escalation reduces the probability of weaponization even if pre-positioned access persists. The access becomes an intelligence tool rather than a weapon.

4. The Lloyd’s exclusion question is resolved definitively, or the market prices the ambiguity fully. A court ruling in either direction removes the binary. But the trade has a shelf life. The current edge is that nobody is talking about it. That won’t last.

None of these kill switches is triggered as of April 1, 2026.

What I’m Watching

Weekly monitoring framework:

CISA advisory cadence. CISA publishes joint advisories with the FBI and NSA when specific threats are identified. The frequency and specificity of these advisories is a real-time indicator of both the threat level and CISA’s operational capacity. If advisories slow to a trickle during an active conflict, that itself is information about the agency’s ability to function.

SEC 8-K Item 1.05 filings. Since December 2023, publicly traded companies must disclose material cybersecurity incidents within four business days of determining materiality, not four days from the incident itself. I’m tracking the frequency and sector distribution of these filings. A cluster of healthcare or infrastructure 8-K filings would validate the thesis in real time.

Threat intelligence reporting on MuddyWater/Seedworm activity. Symantec broke the March 2026 Dindoor/Fakeset discovery, and Mandiant maintains the definitive APT taxonomy, but Microsoft Threat Intelligence now tracks roughly 30 Iranian “Sandstorm” groups with unmatched visibility through Azure/M365/Windows telemetry, and CrowdStrike and Palo Alto Unit 42 both publish extensive Iranian operational reporting. New reports from any of these five firms naming additional targets or describing escalation from reconnaissance to pre-attack staging are the tripwire.

Lloyd’s and specialty insurer commentary on the Stryker claim. Earnings calls, analyst days, and regulatory filings from Beazley, Hiscox, and major Lloyd’s syndicates will be the first place the exclusion clause question surfaces publicly. Q1 earnings season starts in weeks.

Beazley and Hiscox equity and options pricing. If the market starts connecting the Lloyd’s exclusion binary to these stocks before the Q1 earnings cycle, the entry window narrows.

CYBERCOM posture and leadership signals. The February 2025 Hegseth stand-down order paused offensive cyber operations against Russia specifically, not Iran, and Gen. Haugh’s April 2025 firing left the dual-hatted CYBERCOM/NSA command vacant for months. Any public indication that CYBERCOM is reconstituting offensive capacity against Iran, or conversely shifting resources to domestic defense, would signal how the intelligence community is weighting the threat to civilian infrastructure versus the offensive campaign.

Conclusion

None of the kill switches above has triggered. The defensive gap is open, the adversary is inside, the insurance framework is untested, and none of it is in the price.

You’re watching the wrong screen.

Share

Disclaimer: This is not investment advice. TSCS holds no positions in any securities mentioned in this piece as of publication. All views are the author’s own. Do your own work.

Brent will move on this. It always does. The curve will flatten, the algos will reprice, and by the time you read this sentence the cable anchors will be calling it a breakthrough.

This is exactly the pattern this piece was written to trade against.

Every week since the Strait closed, the same cycle has played out: a headline suggesting resolution, a crude selloff, and then the physical reality reasserting itself within days. Energy Secretary Chris Wright posted that a tanker had been escorted through Hormuz. It was a lie. Crude dropped 17% before the White House retracted it. The market has been trading tweets, not molecules.

This piece is not about whether a ceasefire happens. A ceasefire will happen. Maybe this week. Maybe in three months. This piece is about what happens the day after, and the day after that, and the six to thirty-six months after that, when the market discovers that signing a document does not clear mines, restart refineries, fabricate cryogenic heat exchangers, or reprice the insurance markets that have repriced permanently.

The war ends. Here is what does not.

On March 28, a petroleum engineer at Texas A&M named Siddharth Misra published something that should have been front-page news and wasn’t. Three physical constraints. Three reasons the oil market’s post-ceasefire recovery model is physically impossible. First: midstream hysteresis. Shut down a pipeline and asphaltene and wax settle inside it. You cannot restart it until you run a 14-21 day integrity-pig inspection to confirm the line is not clogged.

Second: SPR limits. Misra’s argument was that prolonged drawdown eventually hits degraded sour crude at the bottom of the salt caverns, poisoning refinery catalysts.

I think the stronger version of this constraint is hydraulic, not chemical. The reserve’s maximum sustained rate of 4.4 million barrels per day is an engineering ceiling, not a policy choice. It depends on pipeline capacity, marine terminal throughput, and cavern pressure that degrades as volumes fall. The caverns use brine displacement; as inventory drops, you lose cavern pressure, and the maximum flow rate degrades materially after roughly 90 days of sustained drawdown. And the reserve doesn’t drain cleanly to zero.

Effective capacity falls well before the caverns empty. The SPR is not a battery. It is a leaky bucket with a sour bottom. Third: the cold-start problem. You are not just reopening a valve. You are restarting stagnant pipeline networks, remobilizing a tanker fleet into a former conflict zone, and doing it all with paralyzed insurance markets.

His conclusion: “L-shaped plateau, not V-shaped recovery.”

I think he is right. And I think the gap between his assessment and what the market is pricing is the single largest mispricing in global commodity markets right now.

The entire market is organized around one question: when does the Strait of Hormuz reopen?

Kalshi has normalization by June 1 at roughly 49%, down from 67% a week ago. The Brent forward curve has December 2026 at roughly $85 against spot around $112. Backwardation during a supply crisis is standard. But $27 of it over nine months is not standard. That’s the curve telling you it expects the majority of the supply disruption to resolve by year-end. The vol surface agrees. The put-call skew agrees. The options-implied probability distributions agree.

Everyone’s on the same side of the boat.

That is a directional bet on recovery speed, and the post-conflict analogs with comparable fragmentation say the bet is wrong. Energy Secretary Chris Wright went on TV and said the disruption would last “weeks, certainly not months.” Then he posted a claim that the Navy had already escorted a tanker through the Strait. Then he deleted it. Crude futures dropped 17% on that tweet before someone at the White House admitted it wasn’t true. Foreign Policy reported the incident on March 24. The man responsible for US energy policy caused a flash crash with a lie he had to retract within thirty minutes.

That is the thesis the market is trading. Weeks, not months. V-shaped recovery. War on, war off. Binary.

Everyone is watching the ceasefire calendar. The actual story is what happens the day after the ceasefire.

Here is the answer, supported by the majority of post-conflict energy recoveries in the modern era, and all of the ones with comparable political fragmentation: not what the curve is pricing. Not even close.

The market is modeling a V-shaped supply recovery. The actual shape is an L with a slow ramp. The gap between those two shapes is where the highest-conviction trades sit for the next twelve to thirty-six months.

Six pieces on what happens during the war. This one answers what happens after. The war ends. What is permanently broken?

This is Part VII of the Epic Fury series. Parts I through VI covered what happens during the war. This piece covers what happens after. If you are not already a subscriber, the full series, including the tanker thesis (8 Days to Kuwait), the fertilizer chain (Watch The Wrong Price), and the original Hormuz framework, is available to paid subscribers of The Sator Cipher Sator.

The trades in this series are long-duration, high-conviction, and built on physical constraints that do not negotiate with headlines. If that is how you think about markets, this is where the work gets done.

Subscribe now

Every post-conflict oil recovery took longer than the market expected

Read more

A Letter to the Gold Bug Who’s Panicking

You bought gold because you thought the world might break. The world is breaking. Gold is down $1,000. I know what you’re feeling right now because I’m feeling it too. I’ve spent the better part of a year building a thesis around precious metals, publishing research, putting numbers on it, arguing the case to institutional readers who manage real money.

I have skin in this game. Watching a thousand dollars an ounce evaporate in three weeks while the world validates every single reason I owned it in the first place is not academic. I'm not writing this from a detached analytical perch.

I’m writing it because I owe you an honest explanation, and because the explanation, once you see it, changes everything about how you should think about the next six months. Gold is not failing. Gold is being used. There’s a difference, and it is the entire difference.

You think you’re watching a thesis collapse. You’re not. You’re watching a thesis activate. Let me show you something. Here’s gold, the dollar index, and the Dow Jones Composite, all normalised to zero from March 2nd.

Gold down 15.6%. The dollar up 1.3%. Equities down 7%. Everything is falling except the dollar. Gold and stocks are selling off together while the dollar catches a bid. If you’ve traded macro for any length of time, you recognise this pattern instantly.

The market has not decided the geopolitical risk premium was overdone. Nothing about gold's fundamental value has changed.

This is a dollar liquidity event. Everything that can be sold for dollars is being sold for dollars, and gold, because it is the most liquid unencumbered reserve asset on earth, carrying no counterparty risk and no sovereign issuer risk, is being sold alongside everything else.

As James Aitken of Aitken Advisors noted on The Grant Williams Podcast this week, gold is the near-term “getaway car” for entities raising cash. Not a macro trade. A liquidity trade. The entities that accumulated gold over the past three years are now using it for exactly the purpose they bought it for.

The question is: who needs dollars this badly, and why?

Here’s your answer.

This is the spread between Brent crude and Dubai crude. In normal times, the difference is about a dollar. As of last week, it hit $14.57.

It’s sitting at nearly $12 today. That’s the 98th percentile of its entire historical range, almost four standard deviations from the mean.

What does this chart actually measure?

It measures the premium the world is willing to pay for a barrel of oil that can actually move versus a barrel that is trapped behind a closed strait. Brent is sourced from the North Sea. It doesn’t transit Hormuz. Dubai crude does. So when Hormuz is functionally closed, buyers who need physical oil right now will pay almost anything for barrels that can reach them. The premium for accessibility over geography has exploded from $1 to $12 in a matter of weeks. Now think about what this means for every country east of Suez that depends on Gulf crude and refined product.

Saudi Arabia itself retains partial export capacity through the East-West Pipeline to Yanbu on the Red Sea, bypassing Hormuz entirely, with roughly 5 million barrels per day of capacity. A Hormuz closure does not zero Saudi revenues, but it cuts effective export capacity by an estimated 25-50%, a severe fiscal shock for an economy running deficits and funding Vision 2030. For everyone else east of Suez, the picture is worse.

Japan, South Korea, India, Thailand, the Philippines. Their energy import bill hasn’t just risen. It has become an emergency.

They need to source alternative supply from the US Gulf Coast, from West Africa, from whoever has available cargoes, ships, and insurance. All of that is priced in dollars. All of it demands immediate settlement.

If you are the central bank of one of these countries, and you spent the last three years diligently accumulating gold as part of a reserve diversification strategy, and you now face a tripled energy import bill that threatens your economy’s ability to function, the motive to sell gold is obvious.

Here is what we can actually see.

The visible selling is speculative. The Commitment of Traders report for gold futures shows non-commercial (speculative) net longs declining by 3,263 contracts on the week, with shorts building by 3,779.

The options market at $5,400 gold is a different animal from the options market at $2,000 gold. When price breaks through a concentrated put strike, dealers who are short those puts sell futures to delta-hedge. That selling pushes price into the next strike, which triggers more hedging, which pushes price further. A mechanical cascade that does not care about your thesis or mine. The COT report captures net positioning. It does not tell you how much of the gross flow underneath is gamma hedging versus directional conviction. At this price level, the gamma component is not a footnote. It is a primary mover.

Layer on the CTAs. Every systematic trend-follower that built a long on the way from $1,800 to $5,400 has a stop-loss somewhere below. When those levels break, the models do not deliberate. They sell. Some flip short. This flow is large, mechanical, and mostly invisible in the weekly net figures.

There is also a plausible sovereign component. Central banks do not transact on COMEX. They operate OTC, primarily through the LBMA. The entities with the motive, acute dollar needs from tripled energy import bills, and the means, large gold reserves accumulated since 2022, are sovereign reserve managers.

The data constrains this more than I initially suggested, though, and precision matters here.

If sovereigns were dumping at massive scale through LBMA market-makers, those dealers would hedge by shorting COMEX futures. Commercial short positioning would spike. It has not.

Hedgers have actually covered slightly, reducing net shorts by 4,328 contracts. That is not what a tidal wave of sovereign metal looks like on the other side of the trade. Bilateral sovereign-to-sovereign transfers would bypass LBMA dealers entirely and leave no COMEX fingerprint, so the thesis is not dead. But the scale is probably smaller and more concentrated than the worst-case reading implies.

The honest decomposition: CTA and momentum unwind is the largest flow. Options gamma amplifies it. Retail capitulation adds a secondary wave. Sovereign OTC selling, if occurring, is a contributing factor at the margin. The combined effect is sufficient to explain a thousand dollars from a structurally bid market. Whether the split is 80/20 mechanical-to-sovereign or 95/5, the conclusion is the same: gold is being liquidated, not repriced. That distinction matters for how fast it recovers, not whether.

Where you draw the line between evidence and inference here matters for how you position around it.

If this analysis is useful to you, consider subscribing to TSCS. Much of our work, including the research that built the thesis now being stress-tested, is available to paid subscribers.

Subscribe now

If I am right, the forced selling is finite. Every ounce sold by a sovereign in crisis is an ounce that will need to be repurchased once the acute phase passes. The structural accumulation thesis does not end because gold gets used for the purpose it was accumulated for. It gets reinforced.

But there’s a dimension to this crisis that makes the dollar scramble potentially longer and more painful than you might assume from crude spreads alone: refined products. Crude can be rerouted. It takes longer, it costs more, but barrels eventually find buyers. Refined product is a different problem entirely.

Diesel, gasoline, LPG, jet fuel: these require refining infrastructure, which is concentrated in the Gulf, and logistics chains, which are now shattered. Ships are out of position around the world. Insurance markets have seized. Even after a ceasefire, even after the first tanker transits Hormuz again, the refined product market will take months to re-equilibrate. Infrastructure that has been taken offline does not come back at the flick of a switch.

This matters because the dollar demand driving gold lower is not primarily about crude oil. It is about refined products. Countries east of Suez are not just scrambling for barrels. They are scrambling for usable fuel, the kind that goes into trucks, planes, generators, and agricultural machinery.

That scramble is priced in dollars, settled immediately, and it will persist well after crude markets begin to normalise. If you are watching the Brent-Dubai spread as your signal for when forced selling ends, and you should be, understand that it is an imperfect proxy. The crude spread may compress before the refined product crisis eases. The better signal for the refined product tail is the Singapore gasoil crack spread: the premium that Asian refiners and importers pay for a barrel of refined diesel over crude. In normal markets, it trades in a relatively stable band. When the logistics of refined product delivery break, it spikes. Watch it alongside the Brent-Dubai spread. When both compress together, the acute phase is genuinely over. When only the crude spread compresses, you are seeing the easy part of the normalisation, not the hard part.

The stress on energy-importing nations is visible across Gulf credit markets too.

Dubai’s five-year credit default swap is up 39% in three months. Qatar up 21%. Saudi Arabia, Kuwait, all at or near their recent highs. Even Bahrain, already deep in high-yield territory, has seen further widening. Gulf sovereign credit, repriced across the ratings spectrum.

Here is the chart that tells you this is not a normal selloff.

The MOVE Index measures implied volatility in the US Treasury market. The VIX measures implied volatility in equities. They are not denominated in the same units, so the raw difference between them is not a traditional spread.

But the time series of that differential has a stable distribution, and the current reading sits at the 94.8th percentile of its historical range, 2.56 standard deviations from the mean. In a normal risk-off event, they move together. When the world panics, everything panics.

That is not what is happening. The MOVE is at 98, near its recent high. The VIX is at 26, elevated but nowhere close to crisis levels.

What does this divergence tell you? It tells you the stress is in the plumbing, not in the economy. The rates market, the funding market, the market for dollars, is under severe pressure. The equity market is not. This is a liquidity crisis that has not yet become a solvency crisis. And liquidity crises, by their nature, resolve faster than solvency crises, because they respond to policy intervention in a way that structural damage does not.

This matters for gold because it reframes the entire drawdown. If gold were falling because the market had decided the geopolitical risk premium was overpriced, you would see the VIX falling too. Risk-off unwind, premium compression, everything normalising together.

Instead, gold is falling while rates volatility runs well above its historical norm, which means gold is being converted into the thing the rates market is pricing stress around: dollars.

The MOVE-VIX divergence is, in my view, the single cleanest piece of evidence that the gold selloff is a dollar liquidity event, not a repricing of gold’s fundamental value. When it compresses, either because the MOVE falls or the VIX rises, the forced selling pressure on gold abates.

Here’s the part you forgot, or maybe chose to forget.

COVID. The world literally stopped. Every government locked its citizens indoors. Supply chains collapsed. Mortality was rising exponentially. And gold, your safe haven, the thing that was supposed to save you when everything else fell apart, dropped 12% in four weeks. Same mechanism. Everyone needed cash. Margin calls, redemptions, dollar funding stress, the plumbing seizing up. Gold was the getaway car then too. It recovered. Of course it recovered.

Once the Fed launched its emergency response and dollar liquidity normalised, gold ripped to new all-time highs. The people who panicked and sold the bottom in March 2020 missed one of the great moves in the history of the metal. The current drawdown, roughly 18-19% from $5,400 to $4,400, is materially larger than COVID’s. That tells you the forced sellers this time are more desperate. Nations facing energy emergencies are more motivated sellers than hedge funds facing margin calls. But the mechanism is identical, and there is no reason to believe the outcome will be different once the acute liquidity crisis passes.

The analogy breaks in places, though, and the breaks matter most for how you position from here.

The COVID drawdown resolved because of a specific, identifiable mechanism: the Federal Reserve opened emergency dollar swap lines with fourteen central banks, expanded repo operations to functionally unlimited capacity, and restarted quantitative easing at a pace that dwarfed anything prior. The plumbing seized. The Fed flooded it. The seizure ended. Gold ripped.

What is the equivalent mechanism now?

A ceasefire does not inject dollar liquidity into the system. It removes the source of demand for dollars, which is a different thing. In March 2020, the Fed actively pushed dollars into the global financial system. In a Hormuz resolution, you are passively removing the pull. The distinction matters because passive removal is slower. Contracts already signed at crisis premiums still need to settle. Ships already rerouted still need to complete their voyages. Insurance claims still need to process. The dollar demand does not snap off the way a swap line snaps on.

There is a second problem. In 2020, the Fed was saving its own plumbing. The stress was in American repo markets, American commercial paper, American money market funds. The Fed had direct authority and direct incentive to act. In this crisis, the entities most desperate for dollars are Asian and Gulf central banks.

The Fed has a standing swap arrangement with the Bank of Japan through the C6 network, and has extended temporary bilateral facilities to South Korea in prior crises. But extending emergency dollar liquidity to India, Thailand, the Philippines, or the Gulf states requires political will that is not guaranteed in the current administration.

The Fed’s willingness to act as the world’s dollar lender of last resort is a policy variable, not a constant. Do not assume it.

There is an important piece of plumbing that partially mitigates this: the Fed’s FIMA Repo Facility, established in 2020 and made permanent in 2021, allows foreign central banks to pledge US Treasuries overnight in exchange for immediate dollar liquidity without requiring bilateral negotiation or special political authorization. This is the first line of defense, and it is substantial. Asian and Gulf central banks collectively hold trillions in US sovereign debt that is FIMA-eligible.

But FIMA capacity is bounded by a country’s Treasury holdings, and the central banks most acutely exposed, those that rotated reserves most aggressively from Treasuries into gold over the past three years, have by definition a thinner FIMA-eligible collateral buffer.

FIMA is overnight repo. It provides short-term liquidity, not structural funding. Rolling it is mechanically simple. But it does not eliminate the underlying dollar shortfall, it defers it. If the energy import bill remains elevated for weeks or months, the central bank is not solving the problem, it is borrowing against its Treasury holdings to postpone it.

At the margin, selling reserve assets outright may be preferable to progressive encumbrance of the sovereign’s best collateral.

So the honest version of the COVID comparison is this: the mechanism is the same, but the resolution pathway is slower and less certain. The demand-side fix (ceasefire) does not directly address the liquidity shortage the way Fed facilities did.

The Fed’s role as global lender of last resort is politically contingent. And the refined product tail I described earlier means dollar demand persists even after headline crude normalises. If you are using March 2020 as your mental model for how fast gold recovers, adjust your expectations. The snap will not be as clean.

There is one more thing the COVID analog obscures, and it matters: gold at $5,400 is not structurally the same market as gold at $1,680.

The ETF complex has grown enormously in dollar terms, though not proportionally in physical tonnage. At $5,400/oz, total ETF holdings represent fewer physical ounces than the same dollar AUM would have at $1,680. A 5% redemption today moves fewer bars than it would have six years ago.

But the dollar value of that redemption is substantially larger, and what matters for price impact is not raw tonnage but the ratio of dollar-flow to available bid-side liquidity. If the sovereign accumulators who provided the marginal bid for three years have switched to the sell side, the market’s capacity to absorb even a modest tonnage outflow is diminished. Smaller physical selling can produce larger price impact in a thinner market.

The options market has scaled with the price. Put skew, dealer gamma exposure, the hedging flows that kick in when strikes get breached, all of these create non-linear selling pressure on the way down that simply did not exist at the same magnitude six years ago. When dealers are short puts at $5,000 and the price breaks through, they sell futures to hedge. That mechanical selling amplifies the drawdown in a way that is proportional to the size of the options market, which is materially larger than it was in 2020.

And the run from $1,800 to $5,400 attracted a cohort of retail buyers who have never sat through a 20% drawdown in gold. They bought the narrative, they rode the momentum, and they have no institutional framework for distinguishing a liquidity-driven forced sale from a thesis failure. If they capitulate, and watch GLD outflows for evidence of this, it adds a secondary selling wave that did not exist in the 2020 analog.

All of which sounds bearish. The structural change cuts the other direction too, though, and this is important.

The central bank accumulation since 2022 has fundamentally changed who owns gold. In 2020, the marginal seller in a liquidation was a hedge fund facing margin calls or an ETF processing redemptions. In 2026, the marginal seller is a sovereign. Sovereigns sell differently: larger blocks, OTC, less price-sensitive on timing, but concentrated in impact. The selling is lumpy, not continuous.

And when the last distressed sovereign finishes liquidating, the bid does not fade gradually back in. It snaps. The continuous drip of forced selling disappears all at once, and the market reprices the absence of supply faster than it repriced its arrival. But a sharp bottom is not the same thing as a sharp recovery. The dollar demand I described earlier, refined products, no Fed backstop, settlement lags, persists after the selling stops. The shape you should expect is a hard floor followed by a slow grind, not a V.

The net of this is that gold at $5,400 is a more volatile instrument in both directions than gold at $1,680 was. The mechanical selling pressure, ETF flows, options hedging, retail capitulation, is larger, which means the overshoot to the downside could be deeper than the COVID analog suggests. But the recovery, once sovereign forced selling exhausts itself, could be sharper, precisely because the selling is concentrated rather than distributed.

Do not use March 2020 as a template. Use it as a reference point, then adjust for the fact that the market you own today is bigger, more leveraged to momentum, and dominated by a different class of holder than the market that bottomed six years ago. The mechanism is the same. The math is not.

So here is what I think is most likely happening, stated plainly, with the caveat that I could be wrong and will explain the scenario where I am. The gold bull market that began in 2022 has probably not ended. But it has changed character in the last three weeks.

What started as a broad accumulation trade, central banks diversifying, institutions chasing momentum, retail following the narrative, is now being stress-tested by something the accumulation thesis always implied but never priced: what happens when the insurance gets used.

The National Bank of Poland, one of the world’s most persistent gold buyers for years, floated publicly last week that it might sell gold to fund defence spending. The Polish Prime Minister walked it back within hours.

The retraction was not purely about political optics. Under Article 123 of the Treaty on the Functioning of the European Union, EU central banks are prohibited from monetary financing of government deficits, which means the NBP cannot legally sell reserves to directly fund military expenditure. The idea was not just politically costly. It was, in its stated form, illegal.

But that makes the signal more interesting, not less. A senior official at a major EU central bank publicly floated an idea that violates treaty law. Either they did not know the legal constraint, which is alarming, or they knew and floated it anyway to test the political reaction, which tells you the pressure to monetise gold reserves is intense enough that sovereign policymakers are probing the boundaries of what is permissible. The retraction tells you the legal guardrails held. The fact that they needed to hold tells you something about the forces pushing against them.

This is actually a bull signal hiding inside a bearish anecdote. If sovereign gold selling is politically costly and operationally constrained, the volume of forced selling is likely smaller and more concentrated than the worst-case scenario implies. The pain is real, but it has limits imposed by political economy, not just by the size of the reserves.

There is something important to observe here beyond energy markets. Equities, broadly, have not panicked. Credit markets are hedging tails but not blowing out. The VIX is at 26, elevated but nowhere close to crisis territory. That is either because equity investors are rationally discounting a probable resolution, or because they have not yet caught up to the reality the bond market is already pricing.

I do not know which it is. Neither do the people managing significantly more money than I ever will.

What matters is that gold is selling off hard while rates volatility is elevated and equity volatility is not tells you something specific: none of this resembles a general risk-off event.

This is targeted, forced liquidation concentrated in the most liquid reserve asset. The mechanical selling, CTA unwind, gamma hedging, retail capitulation, is the dominant flow. But the environment driving it, acute dollar needs among energy-importing nations, is what distinguishes this from a normal positioning washout, and it is what determines whether the recovery is swift or slow.

That is a different animal from a broad de-risking, and historically, targeted forced selling resolves faster than systemic panic.

Every ounce sold today by a central bank in crisis is an ounce that will need to be repurchased once the crisis passes. That is the bull case for the next leg. But I need to be honest about the bear case too, because the bear case is not negligible. The scenario where I am wrong: If the Strait of Hormuz is not reopened in a meaningful way within two to three weeks, not months, weeks, the consequences for the global economy are not a slowdown. They are a sudden stop. You cannot move agriculture. You cannot move ships. You cannot run trucks. Consumption falls not gradually but to something approaching zero in the most affected economies. That is not stagflation. That is a disinflationary bust, and it would make the current gold drawdown look like a prelude.

In that scenario, gold does not recover quickly. It continues to fall because the forced sellers become more desperate, because central banks that held off selling are dragged into the liquidation by the sheer scale of the energy import bill, and because the dollar bid intensifies as the last functioning reserve currency absorbs global demand. The reflexive feedback loop, falling gold prices triggering more selling triggering further declines, is a real possibility, and I will not pretend otherwise.

I assign meaningful probability to this outcome. Not the base case, but not a tail risk either. Maybe one in four odds, possibly worse.

If I am wrong, the exit from this drawdown will be slower, deeper, and more painful than the COVID analog suggests, precisely because the forced sellers this time are sovereigns, not leveraged funds. Sovereigns do not face margin calls that can be met with a single repo operation. They face existential energy shortfalls that demand sustained dollar liquidity.

My base case, and I'd put it at slightly better than a coin flip, is that some form of de-escalation or ceasefire emerges within the next few weeks, whether driven by genuine diplomacy, by the pain trade forcing political hands, or by the mutual recognition that a closed Strait of Hormuz serves nobody’s interests for long, including Iran’s.

In that scenario, the acute phase of forced selling ends, gold stabilises, and the structural bid from reserve managers who have depleted their holdings reasserts itself over the following quarters. Not immediately. Not at $5,400. But the direction is higher, because the reserve managers who sold will need to rebuild.

The rest of the distribution covers muddled outcomes: partial reopening, prolonged uncertainty, intermittent escalation and de-escalation that keeps markets guessing for months. In that world, gold chops sideways in a wide range while the dollar remains bid and everyone waits for clarity that may not arrive cleanly.

None of which helps you today. If you sized your position correctly, if you own gold as a component of a broader portfolio rather than a leveraged bet on Armageddon, you can sit through this. If you did not, be honest with yourself about that now, before the next leg down forces the conversation on you. Reducing an oversized position is risk management, not panic selling.

For those watching and waiting, there are two sets of signals that matter. The first tells you when the mechanical selling is exhausting itself. The second tells you when the environment that triggered it is normalising. Both matter, but for different reasons.

The Brent-Dubai spread. When it compresses toward its historical mean, the crude market is normalising. But do not mistake crude normalisation for the end of the crisis.

The Singapore gasoil crack spread. Your refined product signal. When this compresses alongside Brent-Dubai, the logistical crisis is resolving, not just the headline one.

The MOVE-VIX spread. When it compresses from its current 95th percentile reading, the funding stress that is forcing dollar accumulation is easing. This is a second-derivative signal: it will not tell you gold has bottomed, but it will tell you the environment causing gold to fall is changing.

Junior gold mining stocks. The juniors tend to bottom before bullion. Right now, GDXJ and GLD are falling in tandem, with GDXJ showing no relative outperformance or volume divergence. The signal has not fired. When it does, you will want to be paying attention. We will have more to say about what the miners are telling us in the coming days.

And watch, more broadly, for the moment when the things that have been smashed stop going down. Not when they start going up, that comes later. Just when they stop falling. When a currency that has been crushed finds a floor, when a commodity that has been liquidated stabilises, when the bleeding halts even briefly, that is the market telling you something about the distribution of outcomes ahead.

I will be honest: I do not know when that moment arrives. I do not know if the next week brings de-escalation or further deterioration. I have skin in this game and I am sitting through it, but I am sitting through it with my eyes open, not with false confidence that I can see the other side.

What I do know is this.

You bought gold because you believed the global financial system was more fragile than it appeared. You were right. The fragility is here, now, in front of you. It just does not look the way you imagined it would. The structural reasons for owning gold, fiscal deterioration, reserve diversification, geopolitical realignment, the slow erosion of trust in fiat institutions, have not been repealed by this drawdown. If anything, they have been reinforced.

The path from here to a recovery in price runs through a period of genuine uncertainty that I cannot resolve for you with a chart or a spread or a historical analog. Stay solvent. Stay honest with yourself about your risk tolerance. And if you find yourself reaching for certainty in a moment that offers none, that is the signal to step back, not to double down.

If you found this valuable, the best thing you can do is share it. If you want more research like this, subscribe to TSCS.

Share

Subscribe now

This is not investment advice. TSCS does not provide personalised financial recommendations. The author holds positions in assets discussed in this piece. Do your own research.

Data sourced from Bloomberg Terminal. Charts: XAU BGN Curncy, DXY Curncy, CO1 Comdty, PGCRDUBA Index, GCC 5Y CDS Monitor, GDXJ US Equity, GLD US Equity, MOVE Index, VIX Index. Brent-Dubai spread at 98.4th percentile, 3.97 standard deviations from the mean. MOVE-VIX spread at 94.8th percentile, 2.56 standard deviations from the mean. COT data: GC1 Comdty, CFTC Commitment of Traders Report. This is not investment advice. Do your own research.

The one on your screen says $112. Brent futures, front month, closed Friday. Orderly. Almost calm. The talking heads cite the number like it means something. The sell-side notes say the market “has this priced in.” The administration points to the downward-sloping futures curve as evidence that cooler heads are prevailing.

They are watching the wrong screen.

Physical Oman crude, loading outside the strait at Mina al Fahal, is trading in the high $160s with reports above $170 per barrel. The premium over paper futures has blown out to $60, the largest physical-paper divergence in the history of the modern oil market. Jet fuel in Singapore has breached $200 per barrel equivalent. Diesel cracks have exploded across every major refining centre, with ICE gasoil leading at $65 per barrel over Brent and the 2022 peak of $80-100 no longer a tail scenario.

That $60 gap is not a rounding error. It is not a logistics hiccup. It is the sound of the physical market screaming a message that the paper market cannot yet hear, held below reality by three mechanisms that are quantifiable, time-bounded, and running out.

We told you what to watch. In Operation Epic Fury, we built the geopolitical framework. In 8 Days to Kuwait, we mapped the physical market mechanics before the first tanker was turned away. In Oil Isn’t The Trade, we wrote that oil was not the trade, that the second-order dislocations in tankers, LNG, and refined products would offer better risk-adjusted expressions of the same thesis. Every one of those calls is now in the market.

We also told you to watch Yanbu.

On March 18, Israel struck Iran’s South Pars gas field. Within 24 hours, Iranian missiles hit the SAMREF refinery at Yanbu and forced the suspension of operations at Ras Tanura, the exact bypass infrastructure we identified as the critical variable. The question we posed in Part III, whether Iran could sustain precision strikes or whether the first wave was the extent of its capability, has answered itself. Gate 1 has resolved. The “mission accomplished” off-ramp is no longer available when Iran is destroying allied export infrastructure faster than it can be repaired.

The scenario space has compressed. The centre of gravity has shifted. And the trade has changed.

This piece is the architecture of what comes next: a month-by-month supply waterfall showing exactly how and when the buffers expire, the demand elasticity math that tells you where Brent clears if they fail, the substitution arbitrage between $112 oil and $18.50 gas-equivalent that is quietly building the conditions for the spike’s own reversal, and the second-order trade matrix, from tanker equities to diesel cracks to fertiliser, that performs across every scenario without requiring you to survive a $35 adverse move to collect.

We are not going to pretend we know whether this ends in three weeks or six months. What we have built is a framework that reprices in real time as the two remaining gates resolve, with observable triggers, conditional weights, and trade expressions for each branch. The reversion is coming. It always does. The question is when, from what level, and what it permanently destroys on the way through.

Share

TSCS publishes institutional-grade research that 60+ investment firms already read.

The Epic Fury series has called the geopolitical framework, the physical market mechanics, and the second-order trade map before the consensus arrived. Part IV contains the full reversion waterfall, the scenario architecture update, the clearing price math, and the complete trade matrix.

If you are allocating capital around this crisis, or if you simply refuse to rely on sell-side notes that told you $112 “has this priced in,” this is the research you need.

If you're arriving mid-series, Operation Epic Fury and 8 Days to Kuwait will give you the framework. Everything that follows builds on it.

Subscribe now

Read more

I pulled 227 active software term loans from the Bloomberg Terminal. Every institutional-scale credit that matters for CLO and BDC portfolios, the near-complete universe. 72 instruments bid above 95: Oracle, SS&C, business as usual. 34 bid below 80. Fifteen of those below 50. SonicWall at 30 cents. The distribution is not a bell curve. It is two peaks with a valley in the middle, and the valley is where capital goes to die.

But the traded credits are not the scary part. 66 of the 227 instruments have no observable bid at all. No dealer making a market. No Bloomberg composite. 29% of the software loan universe is operating in the dark, and the composition is not random: 81% of PIK-TERM instruments and 83% of unitranches have no price. These are the credits held by BDCs marking to model, paying cash dividends on phantom income, with no secondary trade to confirm or contradict the marks. Names you would recognise (Zendesk, Hyland, Alteryx, Squarespace, CoreWeave), billions in outstanding debt, and no market-based price.

In Don't Short SaaS I argued that the "AI kills SaaS" narrative was wrong, that the real divide was between a Fortress Zone of entrenched platforms with 97%+ gross retention and a Dead Zone of commoditised tools already losing altitude. In Private Credit Is Eating Itself I mapped the mechanism: a self-reinforcing cycle where markdowns in one portfolio mechanically propagate to every other portfolio holding the same credit, amplified by CLO overcollateralisation tests and BDC dividend obligations. In Private Credit Is Lying to You I showed where the illusion is most acute: PIK instruments paying phantom income, unitranches with no secondary market, and managers marking to model because no observable trade exists to mark against.

This piece does what the first two promised. It opens the Bloomberg Terminal and shows you the wiring diagram: the CUSIP-level proof that 37 CLO managers hold positions across the same 15 distressed credits simultaneously, the maturity cliff that forces 48 instruments into a binary refinance-or-restructure outcome by 2028, the 28-point price cliff between B-minus and CCC+ that turns a single-notch downgrade into a portfolio event, the EU CLO contagion channel I did not expect to find, and the 126-percentage-point NAV gap between the best and worst BDC manager.

Every chart and table is built from Bloomberg Terminal data. The computed average bid matches the Bloomberg-reported average exactly. This is, to my knowledge, the most comprehensive public analysis of the software leveraged loan market. The dataset, the overlap network, the positioning framework, and the instrument-level evidence are below.

Subscribe to TSCS to read the full analysis. Paid subscribers get access to the complete 227-loan dataset, the CLO holder overlap map, the BDC quality spectrum, and the positioning framework I am using to build into Fortress Zone names ahead of Q1 earnings. If you manage capital with software credit exposure, this is the piece your risk committee will wish they had read in March.

Subscribe now

Read more

That single decision activated a forced deleveraging mechanism that most investors do not know exists. It does not respond to good earnings, strong cash flow, or any of the signals the equity market uses to price software companies.

It operates on its own logic, through its own plumbing, on its own timeline. Jamie Dimon told investors the bank was “being more prudent in lending against software assets.” The largest bank in America just told you the collateral backing a meaningful portion of private credit is not worth what the funds say it is.

Goldman is already moving. They have begun pitching total return swaps enabling hedge funds to short software loans. A veteran portfolio manager told the Financial Times: “There’s more discussion than I’ve ever seen in my career about broker-dealers trying to assist and partner with hedge funds to short loans.” You do not build bespoke shorting instruments for a dislocation that resolves in weeks.

The conflict of interest is worth stating plainly. Goldman is simultaneously a major loan arranger and underwriter to the PE firms whose portfolio companies are the targets. The same bank that helped originate the loans is now offering clients a way to bet against them.

Here is the mechanism in four sentences. The SaaS equity selloff compresses enterprise values, which makes private credit marks on leveraged software loans stale, which triggers CLO managers to trade out of tech loans and diverts cash flow away from CLO equity tranches. The forced selling depresses loan prices, which blows out BDC net asset values, widens discounts on publicly traded BDCs, and triggers redemption queues at semi-liquid funds, forcing those funds to liquidate performing credit. Meanwhile, the same “AI kills software” narrative driving the loan stress infects public equity positioning through multi-strategy rebalancing, systematic factor selling, and sector-wide de-risking, dragging down names that share nothing with the impaired credits except a sector label.

The software selloff is feeding itself.

Six weeks ago, I mapped these dynamics as parallel risks across two separate pieces. They are not parallel. They are sequential and self-amplifying, connected through overlapping CLO collateral pools, shared sector narratives, and the cross-asset positioning of multi-strategy funds. The taxonomy was right. The assumption of independence was wrong. This piece corrects it.

Why you should be reading TSCS

TSCS has mapped every stage of this dislocation in real time. "Don't Short SaaS" built the framework separating the software companies AI destroys from the ones it makes stronger. "Private Credit Is Lying To You" warned that the $1.7 trillion private credit market's exposure to software loans was a ticking time bomb.

Both generated significant institutional readership across 60+ investment firms. Both, I now believe, were incomplete, not wrong, but incomplete in ways that matter, and this piece is the correction. If you are not yet subscribed, this is a good place to start.

This piece maps the mechanism. The next one quantifies it. For paid subscribers, I am building the instrument-level companion using Bloomberg Terminal data: BDC NAV discount plotted against software concentration across every rated vehicle. The maturity wall by rating bucket and year. Fortress Zone versus Dead Zone NRR trajectories over four quarters. And the CUSIP-level CLO overlap analysis that would prove or disprove the degree of synchronous marking pressure across structures. That piece will either confirm the transmission coefficients implied here or force me to revise the framework. Either way, you will see the data

Subscribe now

The companies being sold in this loop are increasingly being sold for structural reasons, because they sit inside CLO and BDC portfolios that are deleveraging, rather than fundamental reasons, because their businesses are actually impaired.

That distinction is the entire opportunity.

Section 1: The Scorecard

I made six calls. Here is what happened.

A note on what this scorecard is and is not. Six names across two categories is a focused case study, not a statistical sample.

I designed the taxonomy, selected the names, defined the grading criteria, and graded them. Calling this an “83% hit rate” would imply a rigour the sample size does not support.

What I can say is that five of six confirmed on fundamentals, the one that did not (Adobe) failed for reasons I can identify and have acted on, and the K-shape divergence between the two groups widened on every metric that matters. The pattern is consistent with the framework.

It is not proof of the framework. Proof would require applying the Fortress Zone criteria (NRR above 115%, FCF margin inflecting above 20%, at least two of: regulatory compliance moat, proprietary data advantage, deep workflow embedding) to the full universe of 30+ public software names and testing out-of-sample.

That is work I intend to do. Until then, treat the scorecard as directional evidence, not validation.

Dead Zone evidence block

Five of six confirmed on fundamentals. The Fortress Zone is delivering. The Dead Zone is decomposing, and the data is now granular enough to show exactly how.

Five9 reported Q4 revenue growth of 8%, down from roughly 8% the prior quarter and 17% a year ago, with the deceleration sharpening through mid-2025. The trend is not cyclical. Enterprise customers are replacing Five9's contact centre seats with AI voice agents that cost 80-90% less per interaction and operate continuously. Management guided Q1 to 6-8% growth, which, adjusted for existing contract escalators, implies net-new bookings approaching zero. The stock has halved since the original piece. This is not a buying opportunity. This is a business model reaching terminal velocity.

Freshworks posted net dollar retention of 104%, barely above the ~100% threshold where expansion revenue fails to offset churn. For context, Fortress Zone names are running 120-130% NRR. The gap is not closing. It is widening. Freshworks’ core problem is architectural: its CRM and ITSM products sit in the exact horizontal, low-complexity category where AI agents perform best. A startup can now replicate 80% of Freshworks’ ticketing functionality using off-the-shelf LLM orchestration at a fraction of the seat cost. Freshworks is not losing to a specific competitor. It is losing to a cost curve.

HubSpot is the most instructive Dead Zone case because the bulls insist it belongs in the Fortress Zone. Q4 total revenue grew 20% (subscription revenue 21%), which looks healthy until you benchmark it. Management touted continued seat expansion that pushed Net Revenue Retention up to 105%. But 105% is a Dead Zone metric, sitting right next to Freshworks and miles below the 120-130% Fortress Zone standard.

More importantly, much of this recent seat growth is the mechanical result of a forced pricing and packaging overhaul that required customers to buy new 'core seats,' not a signal of deepening product stickiness. That is a pricing execution story masquerading as organic growth, and pricing levers have a ceiling.

When you sell horizontal marketing and sales software to SMBs in a market where AI agents are actively commoditising those exact workflows, banking on perpetual human seat expansion is a terminal bet.

The market is beginning to price this: HubSpot trades at roughly 4x forward revenue, down from 8-9x a year ago.

Cornerstone OnDemand, not in the original scorecard but worth flagging, is buckling under severe debt pressure. The $5.2 billion leveraged buyout, originated in 2021 at peak multiples, now sees its senior debt trading around 78 cents on the dollar, with junior debt marked down to 90 cents by lenders like Blue Owl.

The business model (enterprise learning management) faces the exact same AI substitution pressure as Pluralsight, which recently completed a massive $3.5 billion distressed debt-for-equity swap where lenders wiped out the sponsor's equity. One levered learning platform has already restructured, and a second is severely distressed under the same structural weight. The pattern is not coincidental.

The K-shape is not a framework anymore. It is an observable divergence with a widening gap. Fortress Zone NRR is expanding. Dead Zone NRR is compressing toward churn. Fortress Zone FCF margins are inflecting higher. Dead Zone bookings are approaching zero. The same AI that is confirming the Fortress Zone moats is eroding the Dead Zone floors, and the credit market is now pricing the Dead Zone names as distressed while the equity market has not fully caught up.

Three names warrant discussion because something changed.

CrowdStrike put up the best quarter in its history. Record Net New ARR of $331 million, 50% of customers on 6+ modules, Falcon Flex at $1.69 billion ARR growing 120%+. The stock dipped 4% in after-hours on the March 3 earnings release, which is where the "AI kills software" crowd celebrated prematurely. Then the data did what data does. CRWD rallied roughly 15% over the following week as the market digested a quarter that removes the Microsoft Defender bundling risk I flagged in the original piece. Displacing CrowdStrike now means replicating an integrated security fabric across endpoint, cloud, identity, SIEM, and AI security simultaneously. A platform war, not a feature competition, and CrowdStrike is winning it. This is the clearest case in the portfolio of earnings breaking through the sector narrative. The reflexive loop dragged CrowdStrike down with the sector through February. Q4 results snapped the elastic. Conviction: Upgraded to Medium-High.

ServiceNow is the hardest call and the most instructive one. Q4 revenue hit $3.57 billion, up 20.7%. Now Assist ACV more than doubled, surpassing $600 million. The board authorised a $5 billion share repurchase. A board does not commit $5 billion to buying back its own stock during a sector-wide panic for optics. They have run the numbers and concluded the market is wrong.

So why is it down 17.6%? Growth decelerated from 24% to 21% to guided high-teens. That is real. But the more important reason is structural, and it is the reason this piece exists: ServiceNow is a large-cap, liquid SaaS name that carries the same sector label as the leveraged software credits deteriorating inside CLO collateral pools and BDC loan books. When those structures deleverage and the “AI kills software” narrative intensifies, multi-strategy funds, systematic strategies, and generalist portfolio managers de-risk the sector indiscriminately. ServiceNow gets sold because it is the most liquid expression of “software exposure,” not because it should be sold. At $113.62, forward P/E of roughly 22x with a $5 billion buyback backstop and 21% subscription growth

Adobe is the one I need to level with you about. Three consecutive quarters where Adobe beats every metric and the stock drops. AI ARR tripled. $2.96 billion operating cash flow. Does not matter. The “Adobe equals Photoshop equals disrupted” narrative is structural, not temporary. CEO Shantanu Narayen’s exit plans add execution uncertainty. At $249, you are paying roughly 11x forward non-GAAP earnings for $12 billion in annualised cash flow, cheaper than Procter & Gamble. The valuation floor is ironclad. The catalyst is missing. I am removing Adobe from the portfolio entirely and moving it to the watchlist. A cheap stock without a catalyst is a value trap, no matter how good the cash flow. Re-entry conditions: a new CEO with a credible AI-native product strategy, or a price below 10x forward earnings. Until then, I am out.

Section 2: The Reflexivity Trap

Private credit funds do not just lend money. Many of them borrow to amplify returns, pledging their loan portfolios as collateral to banks. This is how a fund with $10 billion in investor capital ends up with $15-20 billion in lending capacity. Wall Street banks collectively lend approximately $300 billion to credit funds, roughly 17% leverage against the $1.8 trillion market.

JPMorgan uniquely reserves the right to revalue private credit assets at any time, while most rival banks require a discrete trigger like a missed payment. But this deserves more precision than I gave it in “Private Credit Is Lying To You.” The $300 billion in bank lending to credit funds is not monolithic. The largest and most sophisticated funds finance themselves primarily through unsecured bonds and asset-backed SPV facilities with negotiated valuation dispute mechanisms, including third-party arbiters. Banks cannot unilaterally mark a performing senior secured unitranche loan to 85 cents because a public ETF dropped.

However, for funds relying on subscription credit lines and warehouse facilities, the bank’s discretion over collateral values is real and consequential. If JPMorgan marks a software loan below par in a warehouse facility, the fund has less borrowing capacity. It either posts more collateral, reduces leverage, or sells assets. The cure periods are typically 30 to 60 days, and the process involves negotiation rather than instant margin calls.

This is a forced deleveraging mechanism, but it operates on a timeline of months, not days, and primarily affects mid-tier managers without the scale to negotiate bespoke structural protections. That makes it narrower than I originally framed, but not immaterial.

The Mechanism

When prices move far enough, they change the fundamentals that were supposed to justify the prices. This creates feedback loops that amplify until something breaks. That is what is happening in software, and it starts with the selloff that gave JPMorgan cover to act.

Step 1: SaaS equities sell off. The AI agent demos, the hiring freezes, the “AI kills software” narrative. By early February, roughly $1 trillion in software market value had been erased. The Bessemer Cloud Index just posted negative five-year returns. The iShares Software ETF trades at levels last seen in mid-2023, having retraced roughly three years of gains in under six months.

Step 2: Enterprise values compress. When public software equities drop 25-30%, the implied enterprise values of private software companies drop too. Except the private credit marks do not move. They update quarterly. The public market just repriced in real time. The loan books are still marked at par.

Step 3: CLO managers respond. Software and technology loans represent approximately 16% of outstanding loan balances, roughly $250 billion across 172 debt instruments in the Morningstar LSTA US Leveraged Loan Index, per PitchBook LCD. The single largest sector in the entire leveraged loan market.

Over 53% carry ratings of B-minus or lower by issuer count. The CCC share varies meaningfully by methodology: 26% by issuer count, but only approximately 10% by dollar value ($25 billion of $250 billion). The distinction matters for sizing the OC-test exposure.

From a dollar perspective, $130 billion, 52%, sits at B-minus or in the CCC category. 26% are rated CCC, with only 7% in the comparatively safer BB tier.

Within CLO pools specifically, software sits at 10-13% of collateral, according to PineBridge Investments.

Most CLO indentures require managers to mark CCC holdings at market value rather than par, and impose bucket limits, typically 7.5% of the portfolio. When CCC concentration exceeds the limit, the excess gets haircut in the overcollateralisation test, which can breach junior OC triggers and divert cash flow away from equity holders.

Critically, this is a cash flow diversion mechanism, not a forced liquidation mechanism. The penalty for breaching the OC test is that interest distributions get redirected from equity and junior tranches to pay down senior AAA debt (”turboing” the notes) until the test cures.

A rational CLO manager will often prefer to absorb the OC test failure and let cash divert rather than sell a performing software loan at 75 cents into an illiquid secondary market, because selling at a realised loss permanently destroys par and makes the OC test mathematically harder to cure.

The selling that does occur is discretionary, concentrated among newer and less experienced CLO managers, and it is meaningful in aggregate, but it is not the mechanical tripwire that equity-market commentary often implies.

But less disciplined shops, particularly those managing post-2021 vintage CLOs with concentrated software exposure, do sell, and the aggregate volume of that discretionary selling is large enough to move secondary loan prices.

PineBridge’s Q1 2026 report confirms the damage. MVOCs for BB-rated CLOs in repayment periods have declined an average of 1.2 points year-to-date, with individual results highly correlated to AI and software exposure. JPMorgan’s CLO research team, presenting at SFVegas 2026, estimated that $40 billion to $150 billion of leveraged loans packaged into CLOs fall within sectors most exposed to AI disruption.

The price action tells the story. PitchBook LCD data shows the weighted average bid on performing software loans collapsed 392 basis points in February alone, landing at 87.64, the lowest month-end level since March 2020. Strip out software, and the rest of the loan market only declined 75 basis points, to 96.12. That divergence is not rebalancing. That is liquidation with a sector label on it.

A record $25 billion of speculative-rated software loans are now trading below 80 cents on the dollar. Software accounts for 31% of all distressed loans in the Morningstar LSTA index despite being only 16% of the market.

(Note: the $25 billion distressed figure was accurate as of end-January; by end-February, PitchBook LCD data shows this had risen to approximately $32 billion.)

Step 4: BDC NAVs compress. The distinction between publicly traded BDCs and non-traded semi-liquid funds matters here, and I want to be precise about it. Publicly traded BDCs (TCPC, GBDC, ARCC) do not face redemptions. When investors want out, they sell their shares on the exchange, widening the discount to NAV. The fund’s balance sheet does not shrink, and the manager is not forced to liquidate a single loan. What does happen is that the widening discount impairs the BDC’s ability to raise new equity capital, and if write-downs are severe enough (as with TCPC), they can breach regulatory leverage covenants, which restricts new lending and forces the manager into runoff mode. KBRA downgraded TCPC to junk. Golub cut its dividend. These are real consequences, but they operate through capital market access and leverage constraints, not through forced asset sales. Non-traded semi-liquid funds (Blackstone’s BCRED, BlackRock’s HLEND, Blue Owl’s OBDC) face a different and more acute problem: actual redemption queues. Blue Owl permanently halted redemptions. BCRED hit its repurchase cap. These vehicles do face pressure to sell performing assets to fund investor exits, though their gate mechanisms are specifically designed to prevent fire-sale liquidation.

Step 5: The loop closes, through three distinct channels operating simultaneously. In the loan market, CLO managers trading out of CCC-excess software credits and semi-liquid funds liquidating performing loans to meet redemptions depress secondary loan prices further, which validates the original markdowns and triggers another round of the same behaviour. In the public equity market, the transmission is indirect but powerful: multi-strategy funds with cross-asset books rebalance away from software exposure entirely, systematic and factor-based strategies de-risk the sector on volatility signals, and the narrative contagion (”AI kills software”) that originated in the Dead Zone bleeds into Fortress Zone positioning. The large-cap names get sold not because any CLO or BDC is liquidating their stock (BDCs face severe concentration constraints on large-cap public equities under Section 55(a) of the Investment Company Act of 1940 (at least 70% of assets must be "qualifying assets," which exclude companies with listed equity capitalisation above $250 million), and CLO indentures forbid public equity purchases), but because they carry the same sector label as the credits that are deteriorating. ServiceNow and Veeva remain suppressed by this dynamic. CrowdStrike broke through it in early March on the strength of Q4 data, which is itself evidence that the mechanism is narrative-driven rather than flow-driven.

Sizing the Transmission Channels

The question is how large each of those channels actually is, because the answer determines whether this is a flow-driven selloff or a narrative-driven one, and the two imply very different trade structures.

Channel 1: Direct mechanical flow from credit liquidation into Fortress Zone equities. This channel is effectively zero. BDCs face binding concentration limits on large-cap public equities under the Investment Company Act of 1940 (the 70% qualifying-assets test makes meaningful positions impractical), and CLO indentures forbid public equity purchases. When BCRED liquidates $3.8 billion in performing loans to meet redemptions, or Blue Owl sells $1.4 billion to institutional buyers, not a single dollar of that selling pressure lands in ServiceNow, CrowdStrike, or Veeva order books. Anyone telling you that “private credit liquidation is dragging down software equities” through direct flow mechanics is wrong. The plumbing does not connect.

Channel 2: Multi-strategy and systematic fund rebalancing. This is the primary transmission channel, and it is quantifiable in principle though not with precision from public data. Multi-strategy funds (Citadel, Millennium, Balyasny, Point72) run cross-asset books where a deteriorating credit sleeve can trigger portfolio-wide de-risking. Systematic and factor-based strategies (AQR, Two Sigma, DE Shaw) respond to volatility and momentum signals at the sector level without distinguishing between names. When the Bessemer Cloud Index posts negative five-year returns and the software loan market drops 392 basis points in a month, these strategies mechanically reduce software equity exposure.

The question is whether this rebalancing is large relative to the daily traded volume of Fortress Zone names. ServiceNow trades roughly $1.5-2 billion daily. CrowdStrike trades $800 million to $1.2 billion. Veeva trades $300-500 million. The combined daily liquidity of the five Fortress Zone names in this portfolio exceeds $3 billion on an average day. Multi-strategy fund rebalancing, even if aggressive, is unlikely to represent more than 5-10% of that daily volume on any given day. This is meaningful at the margin, enough to push prices 2-5% below where they would otherwise clear, but it is not the kind of overwhelming flow that sustains a multi-quarter drawdown by itself.

CrowdStrike's post-earnings re-rating, roughly 15% in a week on data that confirmed the Fortress Zone thesis, is direct evidence that Channel 2 flow is marginal and reversible when fundamentals assert themselves.

Channel 3: Narrative contagion. This is the dominant channel, and admitting that matters for how you trade it. “AI kills software” is a sector-level story. It does not distinguish between Five9 (whose contact centre seats are being replaced by AI agents at 80-90% cost savings) and CrowdStrike (whose attack surface expands with every AI deployment), though CRWD's post-earnings re-rating suggests the narrative's grip loosens when the data is strong enough. Generalist portfolio managers, sell-side analysts issuing sector downgrades, and financial media amplify the narrative indiscriminately. When Bloomberg runs “Software Sector in Crisis” and the underlying data is about leveraged buyout credits from 2021, ServiceNow’s forward P/E compresses anyway because the incremental buyer checks out of the sector.

What this means for the trade. Narrative-driven selling exhausts itself. Mechanical forced selling does not. Because Channels 1 (zero) and 2 (marginal) are small relative to Channel 3 (dominant), the Fortress Zone selloff is predominantly a sentiment dislocation, not a flow-driven one. This is good news for the thesis: sentiment dislocations reverse when the narrative shifts or the pain becomes too obvious to sustain. But it is bad news for timing: sentiment dislocations have no structural endpoint. There is no CLO reset date or BDC refinancing window that mechanically stops the selling. The catalyst must come from earnings, buybacks, or the narrative itself breaking, and I address the specific triggers in the catalyst section below.

Step 6: The banks tighten the screws. And now you understand why I opened with JPMorgan. Steps 1 through 5 describe a feedback loop. Step 6 describes the ratchet that prevents it from self-correcting. Because the forced deleveraging from bank collateral markdowns operates independently of borrower performance, it feeds selling pressure into a loop that is already running. The equity selloff gave JPMorgan cover to mark down the collateral. The markdown forces more selling. The selling drives equities lower. Which gives banks more cover to mark down more collateral.

The systemic scenario requires a specific chain: markdowns shrinking the eligible collateral pool enough that target leverage becomes unmaintainable, cure periods (typically 30-60 days) expiring, overcollateralisation buffers (typically 15-25%) being exhausted, and substitute collateral being unavailable. That chain has not begun. But if Goldman, Morgan Stanley, and Citi adopt JPMorgan’s discretionary approach, it becomes significantly more plausible.

The “Doom Loop” Assets

The loop is not abstract. It has names. Edmentum. Razor Group. SellerX. HomeRenew. Hylan. InMobi. These are the six credits that drove two-thirds of TCPC’s NAV destruction. A necessary qualification: these six were largely bespoke private club deals, not broadly syndicated loans trading in the secondary market.

Marking down Razor Group at 19 cents does not mechanically reset the observable bid for CLOs holding horizontal infrastructure software BSLs. The contagion channel is informational, not mechanical: when a BlackRock-managed fund takes an 81% average write-down on its technology-adjacent credits, it changes the risk appetite and pricing assumptions of every other manager examining their own software-heavy book. That sentiment transmission is real, but it operates through risk committee conservatism and portfolio review cycles, not through price discovery on identical instruments.

The broader point about diversification becoming correlation still holds for genuinely overlapping credits within BSL CLO pools, where multiple managers do hold the same syndicated software loans and where one manager’s decision to sell does establish observable secondary market bids that affect every other holder.

Proving the exact degree of overlap requires CUSIP-level cross-referencing of CLO trustee reports and BDC Schedules of Investments, work I intend to publish in a follow-up piece. The directional claim, that software concentration across structures is high enough to create correlated selling pressure, is well supported by the PitchBook LCD data showing software at 16% of the index and 31% of distressed volume. The precise transmission coefficients are what remain to be mapped.

The liquidation machinery in credit does not care about fundamental quality. It cares about what can be sold. And within the leveraged loan universe, the most liquid performing software credits absorb disproportionate selling pressure because they are the easiest exit.

In the public equity market, a parallel but distinct dynamic operates: the Fortress Zone names absorb sector-wide de-risking because they are the largest, most liquid software equities, making them the path of least resistance for multi-strategy funds, systematic strategies, and generalist PMs reducing software exposure. The selling in credit and the selling in equities share a common cause but operate through different plumbing.

The Bifurcation Within Software

This is where the analysis gets more nuanced than the headline “$25 billion trading below 80 cents” suggests. “Software” is doing the same analytical disservice that “private credit” does at the asset class level. The leveraged loan software universe includes at least three distinct risk profiles, and treating them as one category is the exact error the market is making.

Point solutions and content platforms (Pluralsight, Cornerstone OnDemand, certain EdTech) face direct AI substitution risk. When an LLM can deliver personalised training at marginal cost approaching zero, a $3.5 billion levered buyout of a subscription learning platform is structurally impaired regardless of the rate environment. Pluralsight’s debt-for-equity at 45-50 cents is the template. Lenders ended up owning the company. Not getting repaid. Owning it. And owning a software company whose competitive moat is being eroded by the same AI that caused the loan to go bad is not a recovery. It is a consolation prize. These loans are unlikely to recover to par.

Horizontal infrastructure and financial plumbing (Finastra, certain ERP and payments platforms) face execution and competitive risk but not existential AI displacement. Finastra’s first-lien falling from the high 90s to 93-94.5 reflects concern about leverage and growth, not business model obsolescence. These businesses have high switching costs, regulatory moats, and genuinely sticky recurring revenue. The mark-to-market stress here is more likely to reverse than in the first category.

Vertical SaaS and mission-critical workflow tools occupy the middle ground. Some will be enhanced by AI (adding features that increase pricing power), some will be disrupted (commoditised by horizontal AI tools). The dispersion within this cohort will be enormous and company-specific.

Here is the number that complicates the simple “software is dying” narrative: Fitch’s technology software-specific default rate was only 1.9% through January 2026, down from 7.5% a year earlier. Only three unique software companies had formally defaulted. This is overwhelmingly a mark-to-market and restructuring story, not a default wave. Yet.

The $25 billion trading below 80 cents is the market front-running defaults that have not happened yet. Whether those defaults materialise depends on which of the three cohorts above dominates the maturity wall. And that wall is approaching: PitchBook data shows 29% of software sector loans in the index mature within three years, with 40 of those 50 facilities concentrated in 2028. Within that group, 20 are rated B-minus and 11 are CCC. These borrowers need to refinance into a market that does not want to own them. Every failed refinancing becomes another data point that reprices the entire sector lower.

The plumbing is repricing quality alongside junk because the plumbing cannot tell the difference. The earnings data proves it. Here is what the Fortress Zone names actually reported.

Section 3: The Triad of Illusions

Private credit was marketed to investors on three promises: your assets are safely valued, you can access your money when you need it, and you will earn a reliable yield. In the past 90 days, all three promises have broken. The way different managers responded tells you more than the events themselves.

Illusion 1: The Illusion of Valuation

BlackRock TCP Capital reported a 19% sequential decline in net asset value in Q4 2025. NAV plunged from $8.71 to $7.07 per share. In one quarter.

67% of that write-down was driven by just six companies: Edmentum, Razor Group, SellerX, HomeRenew, Hylan, and InMobi. Six names. Two-thirds of the destruction.

Prior to this quarter, BlackRock had marked only 4.4% of its performing loan book below 90% of par. The portfolio was, on paper, pristine. Then the write-downs hit, and the average fair-value reduction across those six names was 81%.

One quarter, the loans are marked at near par. The next quarter, they are marked at 19 cents on the dollar. This is not gradual deterioration. This is a regime change in a single reporting period. The prior quarter’s marks were not slightly optimistic. They were fictive.

Management confirmed approximately 91% of the NAV reduction was tied to investments underwritten in 2021 or earlier. Peak ZIRP vintage. Peak froth. The marks held until they could not.

These six companies are not technology infrastructure. Razor and SellerX are e-commerce aggregator roll-ups. Edmentum is legacy EdTech. They sit squarely in the Dead Zone: low complexity, shallow data, no regulatory moat, enterprise values built entirely on revenue multiples that have evaporated.

The collapse blew out TCPC’s leverage covenants. Net regulatory leverage spiked to 1.41x (1.74x including SBA debentures). KBRA downgraded TCPC’s unsecured debt to BB+. Junk status. For a BlackRock-managed fund. The stock opened at $5.03, down 14% in a single session.

KBRA downgraded a BlackRock-managed BDC to junk because of write-downs on six portfolio companies that were marked at near par the previous quarter.

TCPC is the worst case, not the median case, and intellectual honesty requires saying so. ARCC’s non-accruals sit at 1.2%. Golub’s at 0.8%. Most BDC managers did not concentrate into e-commerce aggregator roll-ups underwritten at peak 2021 multiples.

But TCPC’s collapse is directionally informative, though not for the reason most commentary assumes. The six credits that drove the write-down were largely bespoke private club deals, not broadly syndicated loans trading in secondary markets. Marking down Razor Group at 19 cents does not mechanically reset the observable bid for different credits in different structures. What it does is change the risk appetite and pricing assumptions of every other manager reviewing their own software-heavy book.

When a BlackRock-managed fund takes an 81% average write-down on technology-adjacent credits that were marked near par the previous quarter, risk committees across the industry start re-examining their own marks.

The contagion is informational, not mechanical, but it is real. The question is not whether other managers hold the same names. It is whether they hold the same vintage, the same risk profile, and the same sector concentration. Many do.

Now imagine this dynamic across the broader BDC ecosystem. Software and technology exposure ranges from 15% to over 30% depending on the manager, with concentrated vehicles like Blue Owl Technology Income sitting at 70%+. If the marks on even a portion of those holdings catch up to reality the way TCPC’s just did, the NAV compression cascades across the sector.

Illusion 2: The Illusion of Liquidity

If TCPC proves the assets are impaired, what happened across the semi-liquid fund complex proves the market structure is broken.

In the three weeks since I published “Private Credit Is Lying To You,” every major semi-liquid fund either gated, raised caps, or injected emergency capital.

The scale of the redemption wave is unprecedented. Blackstone’s BCRED ($82 billion AUM) reported record Q1 requests of $3.8 billion, 7.9% of NAV. BlackRock’s HLEND gated for the first time in its history, enforcing a 5% cap against 9.3% in requests, a 54% fulfilment rate. Morgan Stanley’s North Haven: 10.9% requested, 5% cap enforced, 45.8% fulfilment. Cliffwater reported the most extreme demand in the sector’s history, approximately 14% of shares outstanding, with CEO Stephen Nesbitt telling shareholders the maximum distributable was 7%.

Blackstone’s response tells you the stakes. They raised the quarterly repurchase cap from 5% to 7% and injected $400 million of the firm’s own capital, including $150 million from more than 25 senior executives personally. The largest alternative asset manager on earth decided that paying $400 million was cheaper than letting the gate activate. Blackstone understands exactly what gating BCRED would do to the sector.

And Blue Owl permanently halted redemptions at OBDC II.

Then the activists arrived. On March 6, Saba Capital and Cox Capital Partners commenced a tender offer for OBDC II shares at $3.80, a 33.2% discount to Blue Owl’s stated NAV. A sophisticated distressed investor, one who has done the due diligence and examined the loan book, publicly declared that Blue Owl’s stated NAV is inflated by at least a third.

Blue Owl’s board unanimously rejected. But the rejection is beside the point. The price discovery has already occurred. And institutional investors are not naive. The signal propagates.

To fund return-of-capital distributions and fend off Saba, Blue Owl executed a $1.4 billion asset sale to institutional buyers at 99.7 cents on the dollar, almost certainly the highest-quality, most liquid assets in the book. CalPERS, OMERS, and BCI bought. That is not naive money. That is institutional capital seeing value where wealth-channel capital sees risk.

But the cherry has been picked. The residual portfolio is more concentrated, less liquid, more software-heavy, and more likely to carry PIK-accruing credits than the pre-sale book.

A caveat on framing: many of these products operate under Rule 23c-3 interval fund structures or similar frameworks with well-defined repurchase ranges (commonly 5% to 25% of outstanding shares, board-determined). Oversubscription and proration are features, not bugs, of the legal design. The “illusion” is not in the prospectus. It is in how distribution channels communicated liquidity to end clients, many of whom were told “quarterly liquidity” without the asterisk that quarterly liquidity means “up to 5%, pro rata, if everyone else isn’t also trying to leave.”

When the exit door gets bricked shut and replaced with a slot, you are no longer running a fund. You are running a workout.

Who is redeeming matters as much as how much, and almost nobody is making this distinction. The wealth management channel (financial advisers facing career risk from holding clients in gated vehicles) is disproportionately represented in the redemption queue. These advisers do not have a view on whether the marks are correct. They have a view on whether they will get sued if they keep clients locked in a fund making headlines for the wrong reasons. Their incentive is to get out regardless of fundamentals.

Institutional LPs (pensions, endowments, sovereign wealth) committed to these vehicles with full understanding of the liquidity terms and generally have ten-year-plus horizons. If the redemption wave is predominantly wealth-channel driven, it is self-limiting over two to three quarters. Advisers who want out will eventually get out, and the wave exhausts itself. The other $1.3 trillion in private credit sits in closed-end funds, CLOs, and insurance company balance sheets with zero redemption mechanism. These permanent capital vehicles are natural buyers when semi-liquid funds sell under pressure.

If institutional LPs begin queuing, the dynamic is fundamentally different, because institutional capital is the permanent base that the carry-and-wait thesis depends on. Q2 composition will be more informative than the headline number.

Illusion 3: The Illusion of Income

Golub Capital BDC is widely considered the gold standard of middle-market lending. Conservative underwriting. Pristine asset selection. Non-accruals at a mere 0.8% of fair value. If any BDC should be immune, it is Golub.

And then they cut the dividend.

On February 2, Golub declared a quarterly distribution of $0.33 per share, down from $0.39, a 15.4% cut. The filing cited “the evolving outlook for rates, asset spreads, and financing costs.” Translation: the math stopped working. The gold standard of private credit just told its investors that it can no longer maintain the income stream that justified the allocation.

The mechanism is structural yield compression. The weighted average rate on new investments was 8.6%. The investments that repaid were yielding 9.4%. Every dollar that rolls over comes back earning less. Roughly 27% of GBDC’s portfolio sits in software and technology, the sector under the most acute liquidation pressure.

Layer on the rate cut wildcard. Over 80% of BDC loan portfolios (the asset side) are floating rate, meaning asset yields compress almost immediately when base rates fall. BDC liabilities, however, include significant fixed-rate unsecured notes and hedged positions, so funding costs may not decline in tandem. The result is asymmetric compression: the income side falls faster than the expense side, squeezing net investment income from both directions. If rate cuts materialise, this mismatch accelerates.

Lower rates theoretically help software borrower interest coverage, but they gut the yield narrative that justified the retail allocation, which accelerates redemptions, which forces more asset sales. The loop again.

And then there is the PIK problem. Fitch’s privately monitored default rate hit 9.4% in January 2026, the highest since the metric’s inception. When you decompose the defaults, 60% were driven by payment-in-kind conversions, where borrowers stopped paying cash interest and started paying in IOUs. Another 27% were distressed maturity extensions. Only 6% were actual uncured payment defaults.

The marks say “performing.” The cash register says “empty.”

PIK interest creates a painful mismatch for BDC economics. Under Subchapter M of the IRS tax code, BDCs structured as Regulated Investment Companies must distribute 90% of taxable income, and the IRS classifies PIK as taxable income. BDCs are therefore legally required to pay cash dividends on phantom PIK income, drawing on revolvers, principal prepayments, or existing cash balances to fund the distribution.

The income that justified the allocation thesis is technically being distributed, but it is being funded from sources other than the borrower’s cash interest payments. The borrower has stopped paying cash. The BDC is still paying cash out. That gap is not sustainable.

And when your borrowers turn off the cash spigot and pay you in IOUs, the income that justified the entire allocation thesis stops being real.

FS KKR has already cut its total distribution roughly 31% (from $0.70 to $0.48 per share), with non-accruals rising to 5.5% at cost. Apollo-managed MidCap Financial cut 18%. The BDC market is telling you who it trusts in the discount-to-NAV spread: Ares Capital at 10%, Golub at 19%, Blue Owl’s OBDC at 26%, FS KKR at 52%. That 42-percentage-point gap between ARCC and FSK is the market pricing manager quality in real time. “Private credit” is not a useful unit of analysis anymore. Manager selection has never mattered more.

The Synthesis

Three promises. Three breaks. One connected mechanism.

TCPC proves the assets are mispriced. The semi-liquid complex proves the exit door is locked. Golub proves the income is impaired. And all three are feeding the same reflexive loop: to cure OC tests, to fund emergency redemptions, to maintain dividend coverage, managers are dumping software debt into illiquid markets, which depresses prices, which triggers more write-downs, which triggers more selling.

KBRA’s sector analysis shows 23 of 32 rated BDCs have unsecured debt maturing in 2026, totalling $12.7 billion, a 73% increase over 2025. Golub faces approximately $750 million in August 2026 at a coupon of 2.5%. They will refinance into a 7%+ rate environment. Each refinancing mechanically crushes net investment income further.

The maturity wall is not a 2027 story. It is happening now.

Section 4: The Carry Breakeven

Neither the bulls nor the bears are making this number explicit.

The entire argument, bull and bear, reduces to one question: does the carry on performing loans exceed the losses on impaired ones?

Take a representative portfolio. All-in yields on performing private credit loans are running 10-12% (SOFR at roughly 3.65% as of mid-March 2026, plus spreads of 500-650 basis points plus OID amortisation). Call it 11%.

Assume impaired positions recover 50 cents on the dollar. Moody’s long-run average for first-lien is approximately 60-65%, though recent leveraged finance commentary suggests recoveries have been pressured relative to earlier cohorts, with meaningful dependence on capital structure thickness, covenant-lite terms, and restructuring tactics.

For software specifically, where enterprise values can erode rapidly under AI substitution pressure, 50 cents may prove optimistic rather than conservative in the most exposed cohorts.

At those assumptions, the arithmetic is more favourable to the asset class than the bears acknowledge. Over a three-year horizon, 11% annual yield generates roughly 33% cumulative gross carry.

With 50-cent recoveries (50% loss severity), the breakeven cumulative default rate is approximately 66%, far above any plausible scenario. Even at 30-cent recoveries (70% loss severity), the breakeven is roughly 47%. Those are the gross figures. Here are the net ones.

The Net Carry Breakeven: The Number That Actually Matters

The gross arithmetic above is the version you see in pitch decks. Here is the version that matters for portfolio allocation, adjusted for the costs that sit between gross yield and investor returns.

Start with the same 11% gross all-in yield on performing private credit loans. Now subtract the layers.

Management fees: 1.5% base fee on committed or invested capital (standard across the BDC complex). Incentive fees: approximately 1.0-1.5% effective drag, calculated as 20% of net investment income above a 7-8% hurdle rate plus 20% of realised capital gains. General and administrative expenses: 0.3-0.5%. Financing cost on leverage: BDCs typically operate at 1.0-1.25x debt-to-equity.

At current unsecured note coupons of 5.5-7.0%, the incremental borrowing cost on the levered portion creates roughly 1.0-1.5% drag on equity NAV returns. Non-accrual drag: with Fitch’s trailing twelve-month default rate at 5.8% and rising, the drag from non-performing positions on the overall portfolio yield is approximately 0.3-0.5%.

Net yield to the equity investor: approximately 5.5-6.9%. Call it 6.5% as the central estimate. Over a three-year horizon, 6.5% annual net yield generates roughly 20% cumulative net carry. Compare this to the gross figure of 33%.

The breakeven table shifts accordingly:

At 50-cent recoveries (50% loss severity): the gross breakeven was approximately 66% cumulative defaults. The net breakeven is approximately 40%. Still well above any plausible scenario, but 40% less cushion than the gross number implies.

At 30-cent recoveries (70% loss severity): the gross breakeven was approximately 47%. The net breakeven is approximately 28%. This is the number that should focus attention: a 28% cumulative default rate over three years, or roughly 9-10% annually, with below-average recoveries. Fitch’s trailing rate is 5.8% and accelerating. The Proskauer index has jumped from 1.84% to 2.46% in a single quarter. The buffer is real, but it is not the impregnable fortress the gross arithmetic suggests.

Now layer the rate cut scenario. If the Fed cuts a further 200 basis points from current levels, gross yields fall to roughly 7%, and after the same cost structure, net yields compress to approximately 2.5-3.5%. Three-year cumulative net carry: 7.5-10.5%.

At 50-cent recoveries: breakeven drops to roughly 15-21% cumulative. At 30-cent recoveries: 11-15%. A cumulative default rate of 11-15% over three years means roughly 3.5-5% annually with poor recoveries. Fitch is already at 5.8%.

In the rate cut scenario with below-average recoveries, the carry breakeven is not a cushion. It is already breached at current default rates.

This is the quantitative expression of what I described earlier: elevated base rates are simultaneously creating the stress and providing the cushion. The static bull case (”the carry absorbs the losses”) and the static bear case (”defaults are rising”) are both incomplete because they are both implicitly making a rate bet without stating it. If rates stay elevated, the buffer holds but the stress intensifies. If rates fall, the stress eases but the buffer evaporates. The asymmetry is not in one direction. It depends entirely on which effect dominates, and that is a function of the pace and magnitude of cuts relative to the default trajectory.

But the carry breakeven has a blind spot, and it matters: it assumes the performing book stays performing. If the reflexive loop I have mapped in this piece triggers cascading mark-to-market losses that impair the carry on the 80% of the portfolio that is supposedly healthy, the buffer collapses faster than the static arithmetic suggests. That is the tail risk scenario.

Section 5: Scenarios and Risks

I have built a deliberately contrarian case across three pieces.

Here is what breaks it.

Base case (most likely): Orderly repricing. The reflexive loop runs for another two to three quarters, then self-corrects. The redemption wave is predominantly wealth-channel driven and self-limiting. The software default cycle plays out over two to four years with cumulative impairment rates of 8-12% in the most exposed cohorts, absorbed by the carry on performing loans. Managers with less than 15% software exposure emerge intact. Managers above 25% face multi-year portfolio runoff but not existential risk. The carry breakeven holds. Fortress Zone equities re-rate once the structural selling abates.

Adverse scenario: The loop self-reinforces. Multiple banks adopt JPMorgan’s discretionary collateral revaluation. The back-leverage channel triggers forced deleveraging independent of borrower defaults. Institutional LPs begin queuing in Q3-Q4 2026. The carry breakeven compresses as both defaults and rate cuts erode the cushion from both sides. The permanent capital floor holds but at 85-90 cents, not par. The semi-liquid model suffers permanent reputational damage. Fortress Zone equities see another 15-20% drawdown before the bottom.

Tail risk: Exogenous shock scenarios. Sharp rate moves in either direction, broader recession, additional sector contagion beyond software. These do not have trackable leading indicators, which is what makes them tail risks.

Where I sit today: As of publication, one of the adverse scenario’s four conditions is partially met (JPMorgan has moved; Goldman is building shorting infrastructure but has not changed collateral policies). None are fully confirmed. The base case is the working assumption behind the positioning framework. If two of the adverse scenario’s conditions confirm simultaneously, I will publish a revised framework within two weeks, and the positioning shifts from accumulating equity to hedging credit.

I would rather give you a framework that updates cleanly than a number that implies more confidence than the evidence supports.

The Strongest Case Against This Framework

Before listing the signals that change my mind, I owe you the strongest version of the argument that the framework itself is wrong, not just early.

The bear case is not that the loop self-reinforces. That is my own adverse scenario. The bear case is that the AI disruption of SaaS is not a temporary narrative but a permanent repricing of the sector’s terminal value, and that what I am calling structural selling is actually rational price discovery. In this view, the equity market got there first and the credit market is catching up. The Fortress Zone taxonomy is wrong because the moats are shallower than I think. Compliance requirements can be met by AI systems within three to five years. Data advantages erode as foundation models train on increasingly comprehensive datasets. Workflow embedding becomes a liability rather than an asset when AI agents can orchestrate across systems without needing to be embedded in any single one.

If that is true, then buying Fortress Zone names into the selloff is not buying quality at a discount. It is buying secular decline at a slightly less expensive price.

I do not believe this, for three reasons. First, the Q4 earnings data directly contradicts it: Fortress Zone NRR is expanding, not compressing, which is the opposite of what you would see if AI were eroding these moats. Second, the compliance moat is not a feature that AI replicates. It is a regulatory relationship, an audit trail, and a liability framework that takes years to build and that enterprises will not abandon on the basis of a probabilistic system, regardless of accuracy. Third, the strongest versions of this bear case apply to the Dead Zone, not the Fortress Zone, and the K-shape data confirms exactly that divergence.

But I want to be explicit about the condition under which I am wrong: if enterprise AI accuracy crosses 99.5% in regulated domains and two or more Fortress Zone names show NRR compression below 115% in consecutive quarters, the moat thesis is breaking and the framework needs fundamental revision, not just updated positioning.

What Specifically Changes My Mind

Any two of the following occurring simultaneously would shift the adverse scenario from minority probability to something closer to a coin flip:

Proskauer Q1 above 4%. Currently 2.46%. The sharpest quarterly jump so far was Q3 to Q4 (1.84% to 2.46%). A move above 4% would indicate the default cycle is accelerating beyond what the carry can absorb.

Fitch monthly default events consistently above 10. February saw 11, nearly double the 2025 monthly average. One month could be noise. Three consecutive months above 10 is a trend.

BCRED Q2 redemptions above 8%. Blackstone paid $400 million to hold the line. If redemption requests come in above Q1’s 7.9% despite the injection, the confidence backstop failed.

A second major bank adopting discretionary collateral revaluation. JPMorgan is currently alone. If Goldman or Citi follow, the forced deleveraging mechanism activates across a much wider base.

AI reliability crossing the enterprise threshold. My entire framework rests on the deterministic/probabilistic divide. If models achieve 99.5-99.9% accuracy in regulated domains, the compliance moat weakens meaningfully. I think this is unlikely within 18 months but increasingly plausible over three to five years. Every 10x improvement in open-source model capability compresses the time advantage incumbents hold.

The carry breakeven as early warning system. If BIZD (the BDC ETF) stabilises for three consecutive weeks, the acute phase of the loop is likely over. If it breaks to new lows after a stabilisation attempt, the adverse scenario is becoming base case.

A Note on Sourcing Conflicts

I want to flag something almost nobody covering this story is making explicit. The loudest voices in this narrative all have economic interests in their conclusions. Saba Capital is acquiring assets at deep NAV discounts. Apollo’s Marc Rowan positioned against software-heavy competitors from 2% total exposure, then told Bloomberg Invest that managers with 30% software concentration “have not been good risk managers.” PIMCO’s Christian Stracke called it “a crisis of really bad underwriting” while representing a traditional credit competitor.

This does not make them wrong. Rowan’s read on the underwriting vintage risk has been vindicated by the data. Saba’s bid, while self-interested, provides genuine price discovery in a market starved of it. But their claims should be weighted against the data, not accepted as disinterested analysis.

The same applies to the rating agencies whose data underpins much of this analysis. KBRA, Fitch, and Morningstar DBRS derive revenue from the managers and structures they rate. Their incentives around timing and severity of downgrades are not neutral, even when their analysis is sound.

Including, for that matter, my own. I hold positions in the Fortress Zone names I recommend. I have told you that throughout. Weight accordingly.

The Monitoring Framework

The triggers above are useful individually. They are more useful as a sequence, because the signals will not arrive simultaneously. They will arrive in a specific order, and that order tells you which scenario is materialising before the consensus figures it out.

Signal 1: BIZD price action. This is the earliest and noisiest indicator. If the BDC ETF stabilises for three consecutive weeks, the acute phase of the loop is likely exhausting itself. Forced sellers have finished selling, and the market is searching for a clearing price. If it breaks to new lows after a stabilisation attempt, the selling pressure is structural, not episodic. Check weekly. This signal tells you about flow, not fundamentals.

Signal 2: BCRED Q2 redemption composition. Not the headline number. The composition. Blackstone paid $400 million to hold the line in Q1. If Q2 redemption requests come in below 6%, the confidence injection worked and the wealth-channel wave is exhausting itself. If requests come in above 8% despite the capital injection, the backstop failed. But the critical variable is who is redeeming. If institutional LPs begin queuing alongside wealth-channel advisers, the permanent capital base is fracturing, and the carry-and-wait thesis loses its foundation. Blackstone will not disclose LP composition voluntarily. Watch for language in the Q2 investor letter that distinguishes between channels. If they stop distinguishing, that is its own signal.

Signal 3: Bank behaviour. JPMorgan is currently alone in discretionary collateral revaluation. Listen to Goldman and Citi’s Q2 earnings calls for any language about private credit collateral policies, haircut adjustments, or “enhanced prudence” around leveraged lending. A second major bank adopting the discretionary approach widens the forced deleveraging channel from one institution to the system. This is the signal with the highest consequence and the lowest frequency. It may not arrive for two quarters. If it arrives at all, the adverse scenario is no longer a minority probability.

Signal 4: Proskauer default index, Q1 print. Currently 2.46%. The sharpest quarterly acceleration so far was 62 basis points (Q3 to Q4). A print above 3.5% indicates acceleration. Above 4% indicates the carry breakeven is under direct assault and cumulative impairment rates are approaching the zone where the buffer compresses meaningfully, particularly if rate cuts materialise simultaneously.

The decision logic is sequential, not parallel. If Signal 1 resolves favourably (BIZD stabilises), you are likely in the base case regardless of noise in the other indicators. If Signal 1 fails and Signal 2 breaks adversely (redemptions above 8%, institutional LPs queuing), the adverse scenario is becoming base case and you should be sizing hedges, not adding equity. If Signals 1 and 2 are ambiguous but Signal 3 fires (a second bank adopts discretionary revaluation), the structural floor has shifted and the entire framework needs re-evaluation.

I will update this framework quarterly. If the signals contradict each other, I will tell you. If they invalidate the thesis, I will tell you that too.

Section 6: Positioning

The thesis in five sentences. The model layer is commoditising into infrastructure economics. The application layer, specifically the compliance-moated, data-rich, workflow-embedded segment, has deeper moats than the market appreciates. A reflexive feedback loop between SaaS equity selling, private credit mark deterioration, and CLO/BDC forced liquidation is pushing Fortress Zone valuations to levels the fundamentals do not justify. Q4 earnings data is consistent with the Fortress Zone taxonomy across five of six names. The most asymmetric entry points sit in confirmed Fortress Zone names that are being sold because of where they sit in the credit plumbing, not because of what they earn.

The Catalyst Problem

The sceptical reader has been waiting for this section, and I owe it to you without hedging.

If the Fortress Zone selloff is predominantly narrative-driven (which the transmission analysis confirms), then the entry point is only as good as the catalyst that reverses the narrative. “Cheap relative to fundamentals” is a necessary condition, not a sufficient one. I need to identify what specifically reprices these names upward, and approximately when.

There are four identifiable catalysts, in order of specificity.

Catalyst 1: Earnings cycle confirmation (Q1 2026 reports, April-May 2026). This is the nearest and most concrete trigger. If the Fortress Zone names deliver a second consecutive quarter of NRR expansion, FCF margin improvement, and AI-driven upsell (particularly ServiceNow’s Now Assist ACV trajectory and CrowdStrike’s module adoption), the “AI kills all software” narrative becomes increasingly difficult to sustain in the face of contradictory data. Three consecutive quarters of Fortress Zone acceleration, against simultaneous Dead Zone deceleration, is the inflection point where generalist PMs begin differentiating rather than de-risking the sector wholesale. This is the most likely catalyst and the one I am positioning for.

Catalyst 2: ServiceNow buyback execution (Q2-Q3 2026). A $5 billion authorisation at current prices implies approximately 4% of shares outstanding. Buyback programmes typically execute over 12-18 months, with heaviest activity in the first two to three quarters. At $113.62, ServiceNow’s board is buying at 22x forward earnings with 21% subscription growth. The mechanical bid from buyback execution provides a price floor that tightens over the coming quarters. This is not a speculative catalyst; it is a committed capital deployment with a board-level mandate.

Catalyst 3: Wealth-channel redemption exhaustion (Q3-Q4 2026). Semi-liquid fund gate mechanisms enforce 5-7% quarterly redemption caps. An adviser who submitted a redemption request in Q1 and was prorated at 50% fulfilment will resubmit in Q2, get partially filled again, and by Q3-Q4 the backlog clears. This is a mechanical process with a finite timeline: at 5% quarterly caps, even the most severe redemption wave (15-20% of NAV requesting out) clears within three to four quarters. As the redemption pressure subsides, the forced selling of performing credit abates, the “private credit crisis” narrative loses its fuel, and the cross-asset contagion into software equities weakens. The key observable is BCRED’s Q2 redemption request versus Q1’s 7.9%. A declining trajectory confirms the wave is self-limiting. A flat or rising trajectory means the timeline extends.

Catalyst 4: Rate clarity from the Fed (timing uncertain). This is the background variable. If the Fed signals a clear cutting cycle, it simultaneously eases borrower stress (improving interest coverage ratios, reducing default pressure) and compresses the yield advantage that justifies private credit allocations (accelerating outflows). The net effect on software equities is likely positive: lower rates re-rate growth assets, and the improved credit environment reduces the “everything is breaking” narrative. But the timing is exogenous and I have no edge in predicting it.

The honest assessment. Catalysts 1 and 2 are near-term, identifiable, and within the normal analytical framework. Catalyst 3 is mechanical and calculable. Catalyst 4 is exogenous. If you are allocating off this framework, the position should be sized for a 6-to-12-month holding period, with the Q1 earnings cycle (April-May) as the first major confirmation or disconfirmation point. This is not a trade that resolves in weeks. If you need a faster catalyst, this is not the right framework for your capital.

With those catalysts as the timeline, the positioning below is scenario-conditional.

The trades are not the thesis. The loop is the thesis. The trades are what the thesis implies under each scenario, and they change depending on which signals fire.

If the base case holds (Signals 1 and 2 resolve favourably: BIZD stabilises, BCRED Q2 redemptions below 6%):

Core position: Veeva Systems. The cleanest confirmation, the widest margin of safety, the deepest regulatory moat. Under 10x forward revenue for 16% growth, 44% operating margins, and an accelerating competitive rout of Salesforce. Build to full position across two to three tranches, with Q1 earnings (May) as the sizing gate.

Core position: CrowdStrike. The module data (50% on 6+) removes the Microsoft bundling concern. Non-discretionary security spend in a world where AI expands the attack surface. The post-earnings rally confirms the framework: Q4 data broke the narrative and the stock re-rated 15% in a week. That is Catalyst 1 working in real time.

The risk I am still watching: CrowdStrike trades at roughly 90-95x forward earnings, the most expensive name in the portfolio by a wide margin. The February drawdown offered the cleanest entry. At $441.78, the easy margin of safety has compressed. If the reflexive loop intensifies again in Q2 (which it can, because the credit mechanics mapped in Section 2 have not resolved), a pullback to the $380-400 range would restore the risk-reward. Build to half position at current levels, with the remainder reserved for a sector-wide pullback or Q1 earnings confirmation. Full position only below $400 or after Q1 data removes remaining doubt.

Accumulate on weakness: ServiceNow. The $5 billion buyback is the clearest insider signal in the portfolio. Forward P/E of 22x with 21% subscription growth and an AI orchestration thesis confirmed by $600M+ Now Assist ACV. At $113.62 and roughly 27x forward earnings, you are being paid for patience. Full position, built over two to three tranches.

Hold, add on dips: Guidewire. Up modestly and quietly compounding. Insurance regulatory moat measured in decades. Cloud migration 74% complete. Not flashy. Possibly the safest. Maintain existing, add on any 10%+ pullback.

Hold, patience required: Procore. Confirmed on FCF and catalysts. Growth deceleration from 21% to 13% needs monitoring. Half position until Q1 data confirms the trajectory.

Long ARCC as the cleanest private credit expression. 10% discount to NAV with 1.2% non-accruals and $5.5 billion in borrowing capacity. If the stress stays contained, this re-rates first.

If signals are mixed (Signal 1 fails but Signal 2 is ambiguous: BIZD breaks to new lows, BCRED redemptions between 6-8%, LP composition unclear):

Half-size all Fortress Zone equity positions. Do not add new capital until Signal 2 resolves.

Initiate BIZD puts as a macro hedge. The BDC maturity wall peaks in Q2-Q3 2026. In this scenario, the asymmetry favours protection over accumulation.

Maintain ARCC at existing size. Do not add. The 10% NAV discount provides a cushion, but the risk-reward shifts if the loop is still running.

Move ServiceNow from “accumulate” to “hold.” The buyback backstop provides a floor, but if the structural selling is intensifying rather than exhausting, patience means waiting, not buying.

If the adverse scenario is materialising (Signals 1 and 2 break adversely, or Signal 3 fires: BIZD new lows after stabilisation attempt, BCRED above 8% with institutional LP participation, or a second bank adopts discretionary revaluation):

No new equity in any Fortress Zone name. The fundamental thesis may still be correct, but the structural selling has overwhelmed the timeframe. Being right and being early are indistinguishable when the plumbing is broken.

Full BIZD put position. The maturity wall, the refinancing squeeze, and the cascading NAV compression all accelerate in this scenario. Protection becomes the primary allocation.

Reduce ARCC to half position. Even the best-managed BDC faces headwinds when the entire sector is repricing. The 10% NAV discount can widen to 20-25% if institutional confidence fractures.

Reassess the entire framework. If two or more signals break adversely simultaneously, the base case is no longer operative. I will publish an update within two weeks of that occurrence.

Regardless of scenario:

Avoid Dead Zone names and Blue Owl Technology Finance (70%+ software). The selloff in these names is not an opportunity. It is a repricing to terminal value. No scenario makes these attractive.

Watchlist: AI Observability

Two names I am tracking but not yet recommending, with entry levels.

Datadog (DDOG): MCP server tool calls grew 11-fold quarter-over-quarter. 14 of the top 20 AI-native companies are core clients. The same disruption killing Five9 is building the case for Datadog. At current multiples, the growth is priced. I would initiate below 18x forward revenue, which implies roughly a 15-20% pullback from current levels. If the reflexive loop drags it there, the entry becomes compelling.

Dynatrace (DT): Where Datadog wins the cloud-native developer, Dynatrace owns highly complex on-prem/hybrid enterprise AI workloads. Davis AI engine is purpose-built for causal root-cause analysis in regulated environments. 81%+ gross margins. I would initiate below 8x forward revenue.

Removed from portfolio: Adobe. Valuation floor ironclad ($12 billion annualised cash flow at 13x forward earnings). Catalyst missing. Three consecutive quarters of beats followed by declines is not a market inefficiency. It is a market telling you the narrative has permanently repriced the multiple. A cheap stock without a catalyst is a value trap, no matter how good the cash flow. I will re-enter on one of two conditions: a new CEO with a credible AI-native product strategy, or a price below 10x forward earnings where the margin of safety compensates for the absent catalyst. Until then, watchlist.

Closing

The reflexive loop I have mapped in this piece explains why even the strongest names have been dragged below where fundamentals justify, and why some (ServiceNow, Veeva) remain there even as others (CrowdStrike) have begun to break free.

That is the entire opportunity. The market cannot tell the difference between a company being sold because its business is dying and a company being sold because it sits inside a CLO that is failing an OC test. The framework tells you which is which. The earnings data proves it works. The structural selling gives you the entry point.

Fortress Zone names are delivering. The plumbing is misbehaving. And you are being paid to know the difference.

This piece maps the mechanism. The next one quantifies it. For paid subscribers, I am building the instrument-level companion to this framework using Bloomberg Terminal data: BDC NAV discount plotted against software concentration across every rated vehicle, the maturity wall visualised by rating bucket and year, Fortress Zone versus Dead Zone NRR trajectory charts over four quarters, and the CUSIP-level CLO overlap analysis that would prove (or disprove) the degree of synchronous marking pressure across structures. That piece will either confirm the transmission coefficients implied here or force me to revise the framework. Either way, you will see the data.

Share

Correction (March 16, 2026): The original version of this piece listed CrowdStrike's price as $368.99, which was the after-hours price from the March 3 earnings release, not the March 13 close. The correct March 13 close was $441.78. The scorecard, return calculations, and forward P/E references have been updated. The corrected data strengthens the thesis: CRWD's 15% post-earnings rally is the clearest evidence in the portfolio that Fortress Zone earnings break through the sector narrative. The error was mine. It should not have made it to publication.

This article is for informational and educational purposes only and should not be construed as investment advice. The author may hold positions in securities mentioned. All views expressed are my own. Do your own due diligence before making any investment decisions.

The first is Trueflation’s year-over-year reading: 0.7%. It aggregates 15 million items daily from 30+ data providers, its historical correlation with CPI is 0.97, and it leads the Bureau of Labor Statistics by months because it uses real-time transaction data while the BLS is still surveying landlords about what they think their house would rent for. If Trueflation is directionally correct, the underlying demand-driven inflation in the American economy is beaten. The war is over. Inflation lost.

The second is Brent crude, which just printed above $110 for the first time since 2022, touching $119 intraday before the G7 floated a coordinated SPR release. Brent has roughly doubled from its January lows. Diesel hit $4.60. Jet fuel is repricing every airline’s full-year guidance. Nitrogen fertilizer is $520 to $550 a ton and planting season starts in weeks.

Here is how both numbers can be right simultaneously, because this is the only frame that matters for everything that follows. Trueflation measures demand-pull inflation: what consumers are voluntarily paying for things they choose to buy. It is correct. Demand inflation is beaten. The oil shock is something categorically different. It is a supply-push tax, a forced transfer from consumers to producers administered through a disrupted chokepoint, not a signal from excess demand. The tension is not a contradiction. It is a diagnostic. The question worth spending time on is not which number is right. It is this: at what sustained oil price does the supply tax overwhelm the demand-deflationary backdrop and re-anchor inflation expectations upward?

The 5-year breakeven inflation rate, T5YIE, is the market’s real-time answer. It sits at approximately 2.67% as of writing. Elevated. Not broken. The threshold that historically triggers Fed defensiveness is 2.75% to 3.0%. Goldman estimates each sustained $10 per barrel increase adds roughly 5 basis points to core CPI.

The move from $60 baseline to current levels implies 20 to 30 basis points of supply-push CPI pressure. That is not enough to break the 2.75% threshold on its own. But it is enough to prevent the Fed from cutting, which is a different and more damaging problem than re-anchoring expectations. Watch the T5YIE, not the headline CPI print. The breakeven is forward-looking and updated daily. The CPI print is backward-looking and revised quarterly.

I want to be upfront about one methodological problem before we go any further. That 0.97 Trueflation-CPI correlation was calibrated during a period where oil was not doing what it is doing now. A supply shock of this magnitude, hitting simultaneously across crude, LNG, fertilizer, and freight, is precisely the kind of regime break that kills historical correlations. It is possible that Trueflation is telling me what I want to hear because its sample period does not include a shock like this one. I am using it anyway, because it is the best real-time demand signal available. But you should hold the conclusion at a discount.

I am calibrating everything that follows against sustained $85 to $100 Brent for Q2 2026. Not every trading day. The quarterly average. Below that, the second-order effects described here moderate materially. Above $100, they are more severe. The structure of the damage is the same regardless. The price you believe determines the severity.

Everyone is writing the oil story. I wrote it. Operation Epic Fury mapped the tanker trade, the E&P hedge book filter, the LNG disruption, the fertilizer angle, and the Sinokor fleet concentration when Brent was still processing the first night of strikes.

8 Days to Kuwait stress-tested the equity expressions at $81 Brent before the market opened on the Monday that broke the KOSPI. Both frameworks held. The terminal data backed every line.

This piece is not about oil.

This piece is about what happens next. The second-order kill chain. The sectors, countries, asset classes, and trades sitting in the blast radius of sustained $85 to $110+ crude while everyone else is still arguing about the price of a barrel. The chain runs in sequence: oil reprices input costs, the input cost shock triggers a dollar surge, the dollar devastates EM importers through a double channel, the credit market absorbs the hit with no cushion (I told you in Private Credit Is Lying To You that the BDC complex was a late-cycle pressure cooker; Brent at $110 is the match) the consumer gets hit from both ends of the income distribution simultaneously, and the Fed finds itself trapped between two mandates it cannot serve at the same time. Each link feeds the next.

The first-order winners are obvious. I covered them. This piece maps the losers.

What follows is 7,500 words of sourced, Bloomberg-verified, trade-expression-level analysis across five links of the kill chain: input cost repricing (including the most mispriced value rotation in 27 years of data), the dollar wrecking ball, Asia’s LNG vulnerability, the private credit transmission mechanism, and the Fed trap that makes all of it structurally unresolvable. Every section ends with a trade. Every claim has a kill switch. This is what TSCS does.

If you are a portfolio manager, analyst, or allocator reading this on someone else’s forward, this is what every issue looks like.

Subscribe now

Let’s get into it.

Read more

The framework held. I also got things wrong, and I am going to tell you exactly what, because that is how this works.

Tier 3 moves from 20% to 30%. Not because the vibes shifted. Because there is a specific reinforcing loop between insurance withdrawal, commercial closure, and ceasefire probability, and I am going to lay out every input so you can disagree with any single assumption rather than just deciding you trust me or you don’t. The Kharg Island assessment gets corrected (satellite imagery showed a VLCC loading two days after the strikes, which means my “non-operational” call was premature, and I would rather flag that in print than pretend I never wrote it). And the LNG disruption, which I did not cover in the original note, gets its own section now, because a 91% spike in Asian LNG prices is not a footnote. It is a separate crisis with separate duration logic, and the equity expressions are sitting right there for anyone paying attention.

Here is what most of the coverage is getting wrong. They are treating this as an oil story. It is not. It is four simultaneous supply disruptions: Iranian exports offline, Qatari LNG in force majeure, Iraqi production shutting in, and Saudi Aramco rerouting through a Red Sea corridor that runs past the same Houthis everyone stopped worrying about.

The second-order trades, fertilizers, aluminum, LNG, freight, are hiding in the gap between where the news is and where the equity expressions are. That gap is where the money is. It always is.

What follows behind the paywall is the full equity map. Every name worth owning, shorting, or hedging, with the specific thesis for each across Tier 2 and Tier 3. A few things you will not find anywhere else:

A South Korean shipping conglomerate quietly controls roughly 25% of the global VLCC spot fleet. It is doing more to set tanker rates right now than the US Navy. I identified it before the first bomb fell. The sell-side still has not picked it up.

One US airline has 3.5x the fuel cost sensitivity of its closest peer and no hedge book. The short thesis is not the obvious one, and the entry signal is not the first week of the conflict. I will tell you when.

One aluminum producer is the direct equity expression of Qatar’s downstream shutdown. Almost nobody has connected the dots. By the time the sell-side publishes the note, the move will be priced.

I also lay out the Tier 3 option structures with concrete pricing (approximate Black-Scholes numbers at current vol, not hand-waving), the E&P hedge book filter that separates the stocks printing money from the ones that already sold the upside, and the five specific numbers that will tell you whether we are tracking Tier 1, Tier 2, or Tier 3 in real time.

One more thing. We have a Bloomberg Terminal on the desk now. Every price reference, every spread, every index print in this note is sourced directly. No “according to reports.” No secondhand data scraped from fintwit. When I tell you the JKM-TTF spread swung $10.78 from trough to peak, that is AJTTM1 on my screen, not someone else’s screenshot. When I tell you the Baltic Dirty Tanker Index moved 51% in five sessions, that is BIDY, pulled live.

TSCS now runs on the same data infrastructure as the institutions reading it. The difference is I do not have a compliance department deciding what I am allowed to conclude from it.

Eight thousand readers, sixty-plus investment firms. That is TSCS. If you are not subscribed, you are reading the equity map after the people who are.

Subscribe now

Read more

Brent closed Friday at $72.87, pressing the exact ceiling of that range before a single bomb had fallen.

Then, at approximately 1:15 AM Eastern on February 28, the United States and Israel launched the largest coordinated military operation against Iran since the 2003 invasion of Iraq.

The Pentagon designated it “Operation Epic Fury.” Israel called theirs "Operation Roaring Lion."

Strikes hit nuclear-related sites at Natanz and Fordow, alongside military and leadership targets across the country. Seven missiles struck the vicinity of Khamenei’s compound.

The Supreme Leader was killed in the strikes, as confirmed by Iranian state media on March 1.

Kharg Island, which handles 90% of Iran’s crude exports, has reportedly been shut down. Iranian exports may have collapsed from 1.7 million barrels per day to roughly 100,000 bpd overnight, potentially the largest supply disruption in over a decade.

The asymmetric upside I flagged is no longer theoretical. It is the dominant variable in global energy markets, and every portfolio with commodity exposure is being repriced against it right now.

This may prove the most consequential oil market event since Russia's invasion of Ukraine, and potentially since Iraq's invasion of Kuwait. It arrives into a market where speculative net-longs sit at 22-month highs, the options market is screaming, VLCC rates have tripled, and the forward curve is in backwardation despite what was supposed to be the most oversupplied market in years. The collision between the most bearish fundamental outlook in a generation and the most bullish geopolitical shock since 1990 is not additive. It is multiplicative in its uncertainty.

This piece is the update. It is written within hours of the initial strikes, with all the provisional caveats that demands, and it is built to be the most comprehensive public analysis of what just happened, what comes next, and how to position for it.

What follows: a full damage assessment of the strikes and their implications for physical supply; the Strait of Hormuz escalation ladder and the dual-chokepoint tail risk almost nobody is pricing; a complete revision of the oil price framework into three probability-weighted tiers ($70-80, $80-95, $100+); an updated Iran political probability matrix cross-mapped to price outcomes; the compounding supply disruptions across Kazakhstan, Russia, Venezuela, and US shale that the market has not aggregated; the bear case laid out honestly, including the administration’s price-suppression toolkit; cross-asset confirmation signals; a positioning framework mapped to each tier; and the five data points that will determine which scenario materialises over the next 72 hours.

A detailed equity positioning note, covering defence, tankers, E&Ps, and the sectors that lose, will follow later this week for paid subscribers.

Why you need to be reading TSCS

This analysis runs to over 8,000 words and represents the kind of work that institutional desks charge six figures for. TSCS publishes it weekly, without sell-side conflicts, without consensus bias, and without the obligation to protect banking relationships that keeps most research anodyne. If you are navigating this market with real capital, the frameworks below are designed to give you an analytical edge, not a narrative. Subscribe to get this piece in full, plus the equity positioning note dropping later this week.

Subscribe now

Operation Epic Fury: The Oil Market Just Broke at 2:30 AM

Read more

By Thursday, activist funds were offering to buy their trapped positions at 65 cents on the dollar.

By Friday, the stock hit a 52-week low.

That is a 72-hour sequence that does not happen to a $307 billion asset manager unless something has gone structurally wrong.

But Blue Owl is not the story. Blue Owl is the weakest link in a chain that runs through $1.7 trillion in private credit, $507 billion in BDC assets, and a software sector that just lost $830 billion in market value in three weeks.

The chain connects AI product launches in January to leveraged loan books marked at par in February, and the gap between those two realities is where the actual risk sits.

Here is what happened. DeepSeek released an open-source reasoning model that matched frontier AI performance at a fraction of the cost. Anthropic launched enterprise workflow automation that landed directly on the business models private credit had been lending against for a decade. Salesforce disclosed “lengthening sales cycles” for the first time.

Intuit flagged “competitive pressure from AI-native alternatives.” The software sector, which had been the single best borrower profile in private credit (recurring revenue, high margins, predictable cash flows, low capex), started repricing from “2030 disruption risk” to “2026 reality.”

The market moved. The marks did not.

That is the entire thesis of this piece, compressed into one sentence. The underlying economics of hundreds of leveraged software companies are deteriorating on a timeline measured in months, while the marks that determine their stated value (and the management fees earned on that stated value, and the NAVs reported to investors based on that stated value) update on a timeline measured in quarters. The gap is widening.

Fitch tracks a 5.7% default rate. Managers report sub-2%. Goldman estimates 15% of private credit borrowers can no longer fully service their interest obligations from cash flow. The DOJ has publicly warned about “creative marks.”

This is not 2007. The transmission mechanism to the banking system does not exist, the scale is different, and the Fed has room to cut. But that comparison, comfortable as it is to dismiss, is answering the wrong question. The right question is simpler and more uncomfortable: what happens when a $1.7 trillion market built on the assumption that software cash flows are permanent meets an AI cost curve that is making them optional?

Over the next 12,000 words, we answer it. We map the exposure across every tier of the private credit ecosystem. We quantify the gap between reported and actual default rates. We explain why recovery assumptions built on historical data are structurally wrong for AI-disrupted software credits. We name names, specific BDCs, specific managers, specific trades on both sides. And we lay out exactly where we think the stress goes next.

This is the most comprehensive analysis of private credit’s AI problem published anywhere. It is also, we think, the most important.

Why you should be reading TSCS

If you’re not yet subscribed to TSCS, here is what we do. We publish institutional-grade equity research and deep-dive analysis before the consensus arrives. We identified the Kitwave & Just Group acquisition setups months before OEP showed up with the bid. We published our AI inference economics framework before the market repriced the sector. Our Datacenter Bible became the go-to infrastructure primer. We called the MSTR bear thesis before it was syndicated across financial media.

7,200+ subscribers. Portfolio managers, analysts, allocators, and investors who want the signal before it becomes noise.

Paid subscribers get the full piece below, including the complete exposure framework, specific trade ideas with entry levels, and the vulnerability mapping across 30+ credits.

Subscribe now

A note on this collaboration.

This piece is a joint publication with .

Les has spent the last six months mapping the fundamentals underneath the AI financing boom. His "Private Credit's Slow-Motion Reckoning" called the structural fragility of this market five months before Blue Owl proved him right. His work on circular AI financing, conduit debt structures, and Significant Risk Transfers is the best independent coverage of how these financing structures actually work. FT Alphaville called it "a first-principles approach to explaining the technical architecture of modern finance." His structural expertise and my credit/disruption analysis are different skill sets, and the combination is why this piece exists.

Subscribe to Les Barclays

AI ate the software sector, and private credit owned the tab

Enterprise software businesses were ideal private credit borrowers: recurring revenue, high margins, predictable cash flows, low capital intensity. Lenders underwrote to revenue multiples and EBITDA, assuming these characteristics persist indefinitely. For a decade, they were right. The model worked beautifully. And then it stopped working, for reasons the models never contemplated.

But “software is in trouble” is lazy framing, and lazy framing is how you lose money.

Not all software is equally exposed. Think of it as a spectrum. On one end, you have workflow automation, horizontal SaaS, CRM, basic legal tech, tax preparation, and low-complexity business process tools.

These are the companies where the market now believes an AI agent can replicate most of the value proposition at near-zero marginal cost. I want to be careful here, because there is an enormous gap between “demo impressive” and “enterprise production-ready.”

Replacing a Salesforce implementation is not just replicating the CRM logic; it is replicating the integrations, the compliance audit trails, the vendor liability framework, the procurement workflows, and the organizational muscle memory built over years. AI agents are not doing that today. But they do not need to. They need to be good enough that the next contract renewal becomes a negotiation rather than a rubber stamp, good enough that a $500K annual license becomes a $200K annual license, good enough that growth stalls even if churn does not spike.

That margin compression, not outright replacement, is what kills the credit thesis. If your borrower’s revenue growth decelerates from 15% to 3% while carrying 6x leverage, the loan-to-value math breaks regardless of whether a single customer actually switches to an AI agent. And it is that repricing of growth expectations, more than any actual product substitution, that the market is expressing right now.

There is a third dimension that most private credit analysis ignores: what is happening to VC-backed software companies. They cannot raise, cannot sell to PE at 2021 multiples, and cannot IPO into a market repricing the sector in real time. They have roughly twelve months to integrate AI and demonstrate a legitimate productivity use case, or they will be deemed guilty until proven innocent.

This matters for private credit in two ways. The VC-backed companies that survive become the competitive threat that compresses margins for private credit borrowers. They are the AI-native alternatives that Intuit flagged in its mid-quarter update.

The ones that fail become a cautionary data point: if venture-funded software companies with no debt and maximum operational flexibility cannot survive AI disruption, what does that imply for leveraged middle-market companies carrying 6-7x? Most VC-backed failures will produce writedowns for venture LPs rather than defaults for credit investors. But their competitive effect on the private credit borrower base is real, and it is accelerating.

On the other end, you have mission-critical infrastructure: cybersecurity platforms, deeply embedded ERP systems (think SAP in a multinational supply chain), industrial control software, and anything that requires regulatory certification or carries liability risk. These businesses face margin pressure from AI, sure. But an AI agent is not replacing CrowdStrike’s endpoint detection next quarter. It is not ripping out a Fortune 500’s SAP implementation because ChatGPT can do invoicing.

The problem for private credit is that the loan books are disproportionately weighted toward the vulnerable end of this spectrum. Public BDC filings make this quantifiable.

The data, drawing on PitchBook’s BDC database, paints an even more interesting picture of the concentration. BDCs in aggregate hold approximately $507 billion in assets under management. Of that, technology sector exposure is $114 billion. When you include health tech (another $24 billion), total exposure reaches $138 billion, or roughly 27% of the entire BDC universe.

The sector is also structurally concentrated at the manager level: almost half the entire BDC industry is run by just four companies and their subsidiaries (Blackstone, Blue Owl, Ares, and BlackRock), with the largest ten funds accounting for more than half of all assets under management. A fifth of the industry sits in just two funds: Blackstone’s BCRED and Blue Owl’s Credit Income Corp.

What makes this concentration particularly dangerous is the overlap in underlying credits. Toby Nangle’s analysis of individual BDC loan books reveals that the same vulnerable names (Zendesk, Anaplan, The Access Group, PowerSchool Holdings, among others) appear in multiple BDC portfolios, financed at all-in rates of 9-13%, mostly as senior secured first lien. Being in a senior secured, first lien position sounds reassuring in investor presentations, but it is of limited economic value in a failing software business other than as negotiating leverage with other lenders over what scraps of value remain. The correlation risk here is underappreciated: if these overlapping credits deteriorate, the stress hits multiple BDCs simultaneously, and the “diversification” that investors believed they had across different BDC managers turns out to be largely illusory.

OBDC’s schedule of investments as of September 30, 2025 shows software and technology services representing approximately 18-22% of fair value across the portfolio, with meaningful additional exposure through adjacent categories (internet services, business services, data processing) that face similar AI disruption dynamics. Across the broader BDC universe, Fitch estimates technology and software exposure ranges from 15% to over 30% depending on the manager, with tech-focused vehicles like Blue Owl Technology Income Corp sitting at the extreme end.

The concentration exists for two reinforcing reasons, and the second is more damaging than the first. The first, which I have already outlined, is that workflow automation and horizontal SaaS companies were the best private credit borrowers on paper: asset-light, high-margin, beautifully predictable revenue, low capex. They were precisely the kind of business that a lending algorithm loves and a disruption model ignores.

The second reason is vintage-specific and structural. As Matthew Brooker at Bloomberg has documented, many of the buyouts and loans behind these software acquisitions were done at what turned out to be peak valuations for the tech sector, during and just after Covid.

At the same time, rising interest rates shut down the traditional syndicated loan market. Banks were stuck holding leveraged debt they could not sell and lacked capacity for fresh deals. Private credit stepped directly into that breach.

According to Matthew Mish at UBS, direct lenders’ market share in funding buyouts jumped from 15-25% pre-Covid to between 40% and 70% (depending on the quarter) in 2022 and 2023. That concentration of funding at that specific vintage means private credit is now disproportionately exposed to AI disruption not merely because software looked attractive, but because private credit was the only capital available to fund these acquisitions at the moment when valuations were highest and the traditional leveraged loan market had retreated. The selection bias did not just run the wrong way; it ran the wrong way at the worst possible time.

UBS estimates 25-35% of all private credit portfolios now face “elevated AI disruption risk.” Let me translate that from investment bank to English, because vague institutional framing is how sell-side research avoids being wrong while saying nothing useful and it may be closer to the truth than Blue Owl’s headline marks suggest.

“Elevated risk” is a spectrum, and it matters enormously where on that spectrum we land. At one end, it could mean a 5-10% revenue headwind over two years as AI tools compress pricing power, resulting in slightly lower coverage ratios but no defaults. At the other end, it could mean a 30-50% decline in enterprise value as entire software categories get commoditized, blowing out loan-to-value ratios and triggering covenant breaches across the portfolio. The difference between these scenarios is the difference between a mild repricing and a genuine default cycle.

UBS, to their credit, does provide an extreme case: in an “aggressive scenario” they explicitly describe as a tail risk, U.S. private credit default rates could climb to 13% (for context, leveraged loan defaults peaked at roughly 10% during the GFC).

This is a stress-test number, not a forecast.

The useful comparison is not between UBS’s modelled tail and managers’ reported sub-2%, because those numbers are measuring different things under different assumptions. The useful comparison is between Fitch’s 5.7% trailing twelve-month rate (which includes PIK conversions and interest deferrals) and the sub-2% that managers report on earnings calls (which excludes them).

That gap, roughly 3-4x, is the one that should concern allocators, because it exists today, in observable data, with no modelling assumptions required.

My own view sits somewhere in the middle. The 25-35% exposure estimate feels roughly right, but “elevated risk” is not binary. Perhaps 10-15% of private credit portfolios face genuine existential disruption risk (workflow automation, horizontal SaaS, basic legal and tax software). Another 10-15% faces meaningful but manageable margin pressure. And the remainder, the non-software book, faces normal cyclical risk.

The blended outcome is not 13% defaults. It is probably 5-7% true defaults (consistent with Fitch’s current tracking) with another 5-8% in PIK conversions and extend-and-pretend that the headline statistics conveniently exclude.

The number that actually scares me is the Fitch gap. When independent tracking shows 5.7% and managers report sub-2%, that is not a difference in methodology. It is a difference in incentives.

Managers have every reason to classify PIK conversions, covenant amendments, and maturity extensions as “performing” rather than “defaulted,” because the moment they reclassify, the NAV marks come down, redemptions accelerate, and the fee base shrinks. I am not alleging fraud. I am observing that the accounting framework gives managers extraordinary discretion over when a troubled credit becomes a defaulted one, and that discretion is being exercised in one direction only.

There is a feature of the loan documentation itself that makes all of this worse, and it is one of those things the industry prefers not to discuss publicly.

A substantial proportion of private credit loans originated during the 2021-2023 vintage were structured as covenant-lite or with springing covenants that activate only upon severe deterioration (typically a revolver draw above a threshold). In a traditional leveraged loan with maintenance covenants, credit deterioration triggers a covenant breach, which forces a renegotiation, which in turn forces the lender to acknowledge the problem in its marks.

Covenant-lite structures remove that trigger. The lender can continue marking the loan at or near par as long as the borrower is making interest payments (even if those payments are partially PIK), regardless of how badly the underlying business fundamentals have deteriorated.

The industry professional of 15 years I spoke with described it as “removing the fire alarm from the building. The fire still happens, you just don’t hear about it until the smoke is visible from the street.” For the AI-disrupted software credits specifically, this means the lag between fundamental deterioration and mark recognition that I described in the previous section is even longer than the quarterly reporting cycle alone would suggest. The covenants that would normally force early recognition of stress simply do not exist in many of these loans.

It gets worse. Private credit borrowers routinely report “adjusted EBITDA” that includes cost savings, projected synergies, and pro forma adjustments that inflate the denominator of leverage ratios. A company reported at 5x leverage on adjusted EBITDA might be 7-9x on actual cash EBITDA. This practice is well-documented (S&P has flagged it repeatedly, and Lincoln International’s quarterly reports track the divergence), and in a growth environment the add-backs are at least directionally plausible: if the business is expanding, some portion of the projected savings will materialise.

In a contracting environment, where AI competition is compressing the revenue line, the add-backs that were optimistic-but-arguable become fictional. The leverage math I have been citing throughout this piece (6x as a representative figure for stressed software borrowers) is almost certainly understating the actual leverage at many portfolio companies by 2-3 turns.

At 8-9x true leverage, the margin of safety between “performing credit” and “covenant breach” (to the extent covenants exist) is razor-thin, and the impact of even modest revenue deceleration is amplified.

There is a further layer of systematic optimism in the data that most investors are not aware of. Alongside the EBITDA add-backs, credit ratings on private credit borrowers are subject to a structural upward bias through the Private Letter Rating process. It costs money to obtain a Private Letter Rating from agencies such as KBRA, Egan Jones, or Morningstar DBRS.

As a result, firms are only likely to seek a new rating if they believe it will be better than their existing one.

Firms that agree with their current rating do not pay for another. Firms that believe their rating is higher than reality certainly do not pay for confirmation. Only firms that believe they deserve a better rating pay for the assessment. This is textbook sample selection bias: the observed distribution of rating changes systematically overstates credit quality because the sample is self-selected by borrowers who expect upgrades.

It also means the migration of rating agencies from the more established (and arguably more conservative) firms to newer entrants, which compete partly on the basis of more issuer-friendly methodologies, is itself an indicator of loosening standards rather than improving credit quality.

To make these default estimates actionable, they need to be translated into losses, and this is where the standard assumptions break down in ways that most analysis of this situation has not yet grappled with.

The historical recovery range for first-lien private credit is 50-65%, per Moody’s. That range is derived from recoveries on businesses where the underlying going-concern value was intact: the company was in distress because of leverage, cyclical weakness, or operational mismanagement, not because its core value proposition was being structurally impaired.

A senior direct lending professional with over 15 years of experience across credit committees and portfolio management, who spoke to me on condition of anonymity, put it bluntly: “The 50-65% recovery assumption is based on collateral that retains value through a restructuring.

For a software company whose recurring revenue is being competed away by AI, the enterprise value that secured the loan is itself the thing being disrupted. The IP has limited standalone value. The customer relationships are the asset, and those relationships are precisely what’s deteriorating.”

For non-disrupted credits in the portfolio (industrials, healthcare, business services), the 50-65% range remains reasonable.

For the AI-vulnerable software book specifically, recoveries are more likely to land in the 25-40% range. The logic is straightforward but worth making explicit. Historical 50-65% recoveries assume the acquirer in a restructuring is buying a going concern whose revenue base, while stressed, remains fundamentally intact.

The acquirer pays for the customer relationships, the recurring revenue streams, and the organisational capability. In an AI disruption scenario, those customer relationships are precisely what is deteriorating: the recurring revenue is recurring at lower prices, with shorter contract terms, and against credible competitive alternatives that did not exist when the loan was originated. A distressed acquirer buying a horizontal SaaS company in 2026 is not paying 5-6x revenue as they might have in 2021.

They are paying 2-3x a declining revenue base, which compresses recoveries to the 25-40% range before accounting for the restructuring costs (legal, advisory, operational disruption) that consume another 5-10% of residual value.

The counterargument, that customer contracts retain value even in a disrupted business, is valid for platforms with deep data moats and high switching costs. It is far less valid for workflow automation tools where the switching cost is precisely what AI is reducing. I want to be explicit that 25-40% is a base case for the disrupted portion, not a stress test.

There is one more distinction within the software book that most analysis overlooks, and it matters for how ugly the recoveries actually get: sponsor-backed and non-sponsor-backed credits will produce very different recovery outcomes.

Sponsor-backed companies (those owned by private equity firms) have a parent that can inject equity, negotiate with lenders from a position of institutional sophistication, and manage the workout process.

A PE sponsor with a $2 billion fund is not going to let a portfolio company slip into uncontrolled default if a modest equity injection can buy time for a restructuring. Non-sponsor-backed middle market software companies have no such backstop. When their revenue deteriorates, they are alone with their lenders, and the recovery outcomes are materially worse.

The BDC portfolios under discussion contain a mix of both, and the blended recovery rate will depend heavily on the proportion. Funds with higher concentrations of non-sponsor-backed software credits face the worst end of the 25-40% recovery range; those with predominantly sponsor-backed exposure will fare better, though still below the 50-65% historical norm because even a PE sponsor’s willingness to inject capital has limits when the business thesis itself is impaired.

There is a corollary to this that deserves explicit statement, because it determines how ugly the tail recoveries actually get. When enterprise values fall far enough, PE equity holders will walk away.

Their equity position becomes a deep out-of-the-money option, and the rational economic decision is to stop injecting capital and let the lenders negotiate over what remains. At that point, liens and covenants become largely meaningless, senior secured first lien status notwithstanding, because the restructuring process itself consumes value.

Legal fees, advisory fees, and the operational disruption of a workout eat into whatever residual enterprise value exists. The boring old bank lending adage, that high business risk sectors should carry lower financial risk, feels quite pertinent here, even if it does not sit well with the entrepreneurial approach to private credit lending that characterised the 2021-2023 vintage. The high leverage that was applied to these businesses is now inhibiting their ability to reinvest and stay competitive, which accelerates the very disruption that is compressing their enterprise values.

It is a reflexive loop: leverage constrains adaptation, constrained adaptation accelerates disruption, accelerating disruption compresses enterprise value, compressed enterprise value breaks the leverage math, and at some point the equity holder walks.

At a 5-7% blended default rate, the loss math depends heavily on how you segment the portfolio. On the non-software book, 50-65% recoveries produce implied losses of roughly 2-3.5%, consistent with the standard analysis.

On the software book, at 7% defaults with 30-40% recoveries, implied losses are 4.2-4.9% on that portion. For a fund with 25% software exposure, the blended drag is approximately 1-1.2% on total portfolio return before accounting for the PIK conversions that inflate reported income without generating cash. That sounds manageable in isolation, but it is additive to the income erosion from PIK (where the reported yield overstates actual cash generation), and the combination, real losses plus phantom income, is what compresses NAVs.

The cascading effect on management fees (typically 1-1.5% of NAV) is what makes this a fee revenue problem for the managers even before it becomes a solvency problem for the funds.

Blue Owl: slow-motion liquidity crisis

Before going further, I want to separate two stories that are being conflated in most coverage, because the conflation is analytically lazy even though it is narratively convenient. The first story is about AI disruption compressing software cash flows and threatening the credit quality of private loans to the sector. That story is market-wide and structural.

The second story is about Blue Owl’s specific governance problems, fund structure failures, and related-party transactions. That story is largely idiosyncratic. The two intersect (Blue Owl’s tech-heavy portfolio makes it disproportionately exposed to the first story), but they are separable, and treating Blue Owl as representative of all private credit is the same extrapolation error that people make every cycle. With that caveat stated clearly, here is the Blue Owl situation on its own terms.

Blue Owl Capital has become the poster child for everything that can go wrong in private credit simultaneously.

The stock hit a 52-week low of $10.51 on February 20, down from $23.98 a year earlier. Short interest has climbed to roughly 12.5-13% of float, up over 3 percentage points in 90 days. Here is the sequence of events:

November 2025: Blue Owl attempted to merge its non-traded BDC (OBDC II, $1.6 billion) with its publicly traded OBDC. The deal would have imposed a roughly 20% haircut on OBDC II investors because OBDC traded at a 20% discount to NAV. Fierce investor backlash killed the merger on November 19. This was the first public signal that Blue Owl’s stated NAVs did not reflect reality.

Late 2025: Redemption requests surged. Blue Owl Technology Income Corp paid out roughly 15% of assets in the final months of 2025. Across Blue Owl’s tech-focused funds, redemption requests hit over 15% by early 2026, far exceeding the quarterly 5% cap.

February 18-19, 2026: Blue Owl announced two simultaneous moves. First,it sold $1.4 billion in loans across three funds to three North American pension funds (CalPERS, OMERS, and British Columbia Investment Management) and its own insurance affiliate, Kuvare, at 99.7 cents on the dollar. Second, it permanently ended quarterly redemptions at OBDC II, replacing the 5% tender-offer structure with mandatory “capital distributions.” Management plans to return approximately 30% of OBDC II’s NAV by late March.

February 20: Business Insider reported that Blue Owl failed to secure financing for a $4 billion data center project with CoreWeave (rated B+ junk by S&P). One specialty lender told reporters: “We saw it. We passed.” A $500 million bridge loan matures in March. Blue Owl denied the report. The same day, Saba Capital and Cox Capital Partners formally announced tender offers for shares in three Blue Owl BDCs at 20-35% discounts to NAV.

The CoreWeave failure deserves more attention than it has received, because it exposes a second, largely undiscussed risk vector in Blue Owl’s business.

Blue Owl has committed at least $50 billion in data center financing since last year: a $27 billion joint venture with Meta for the Hyperion buildout, a $15 billion AI joint venture with Crusoe for the Stargate project, $7 billion raised for a digital infrastructure fund, and $1.7 billion for a digital infrastructure REIT. This is not a peripheral business line. It is a massive, concentrated bet on AI infrastructure demand, financed through the same leveraged structures that characterise Blue Owl’s software lending.

The analytical distinction that matters here is between the software credit risk (where the collateral is evaporating because the borrowers’ business models are being disrupted) and the data center credit risk (where the collateral is physical infrastructure but the counterparties are often questionable credits themselves).

CoreWeave and Applied Digital are examples of the latter category: highly leveraged data center operators whose equity cushions will vaporise quickly if their businesses deteriorate. The fact that lenders are already balking at CoreWeave’s creditworthiness suggests the market is beginning to price this risk.

For Blue Owl, this means the software disruption story and the data center credit story are additive: the portfolio faces structural impairment on the software side and potential credit deterioration on the infrastructure side simultaneously. Most analysis has treated these as separate narratives. They are not. They are two expressions of the same underlying problem: concentrated lending to sectors whose risk profiles are changing faster than the marking and reporting cycle can capture.

The $1.4 billion loan sale is the most debated transaction, and most of the debate is focused on the wrong question.

Blue Owl’s management argues the sale “validates” their marks. The near-par pricing is genuinely difficult for bears to dismiss: performing senior secured loans do not trade at 99.7 cents in a real credit crisis.

A senior direct lending professional I spoke with offered a more nuanced read: “The 99.7 price is almost certainly accurate for the specific loans sold. Senior secured performing loans to non-software companies in a diversified pool absolutely trade at or near par. Every direct lender I know would do the same thing under redemption pressure. It’s not evidence of fraud. It’s evidence of triage.”

The sceptics, including the anonymous commentary circulating on Substack, make three counterarguments that deserve engagement on their own terms.

First, one of the four buyers was Kuvare, whose asset management arm (Kuvare Asset Management) Blue Owl acquired for $750 million in 2024. Kuvare Holdings remains an independent insurer, but the asset management relationship creates an obvious conflict. Barclays analysts noted some loans may be repackaged into CLOs leveraged 9-10x. This looks like circular financing.

Second, the sold portfolio was 97% senior secured loans from 128 companies across 27 industries, almost certainly the highest-quality, most liquid assets in the book. Selling your best loans at par is not impressive; it’s cherry-picking.

Third, and this is the point that matters most: the loans left behind are not a random sample. They are what remains after the most marketable paper has been extracted.

The analytical question the market should be asking is not “was 99.7 cents a fair price?” It almost certainly was, for those loans.

The question is: what does the composition of the residual portfolio look like? If Blue Owl sold its most diversified, most liquid, highest-quality senior secured paper, then the remaining book is by definition more concentrated, less liquid, more software-heavy, and likely carries a higher proportion of PIK-accruing credits. The effective software exposure of the residual portfolio may be materially higher than the 18-22% I cited earlier for the pre-sale book. That repriced residual composition is what Saba is pricing when it tenders at 65-80 cents on the dollar.

The default rates everyone is quoting measure something different from what you think they measure

The headline private credit default rate, the number managers cite on earnings calls, has remained below 2% for years.

This figure is not fabricated. It is, however, constructed using a definition of “default” so narrow that it excludes most of the ways a credit can deteriorate in practice.

Fitch’s Private Credit Default Rate hit 5.7% on a trailing twelve-month basis through November 2025, the highest since early that year, with 13 default events in November alone (double the monthly average). Among companies with EBITDA below $25 million, the default rate was 12.9%. Critically, 59% of defaults involved interest deferrals or introduction of payment-in-kind (PIK) instead of cash interest, the kind of “extend and pretend” that doesn’t show up in traditional default statistics.

The Proskauer Private Credit Default Index rose sharply to 2.46% in Q4 2025 from 1.84% in Q3, with defaults among larger companies (EBITDA above $50 million) doubling in one quarter. Morningstar DBRS reported a trailing twelve-month borrower default rate of 4.0%, up from 2.8% a year earlier. KBRA recorded a record 61 borrowers at CCC- assessment (worst rating), with downgrades outpacing upgrades for seven consecutive quarters. Nearly 30% of companies with debt maturing before year-end 2026 have leverage exceeding 10x or negative EBITDA.

The gap between headline and true default rates exists because of liability management exercises (LMEs), PIK conversions, and stressed maturity extensions, mechanisms that prevent a technical “default” while the borrower’s credit quality deteriorates. Deutsche Bank forecasts the combined rate climbing to 4.8–5.5% in 2026.

Goldman Sachs estimates roughly 15% of private credit borrowers are no longer generating enough cash to fully service total interest obligations. It is worth pausing on what that actually means: these are borrowers whose cash EBITDA, after accounting for the EBITDA add-backs discussed above, does not cover total interest expense.

Some of these borrowers are servicing through PIK, which is by design in certain subordinated structures.

But in the senior secured first-lien loans that dominate BDC portfolios, PIK was not the original underwriting intent. When a first-lien borrower moves to partial PIK, it is a signal that the cash flow assumptions underpinning the original credit decision have deteriorated, even if the loan technically remains “performing.”

Public BDCs now receive an estimated 8–9% of investment income via PIK (borrowers paying interest with more debt rather than cash), though the figure varies enormously by manager, from under 5% at some BDCs to over 24% at Monroe Capital.

The most instructive data point may be BDC market pricing. Blue Owl’s OBDC trades at a 25.5% discount to NAV. FS KKR Capital trades at a 30–35% discount and recently cut its base dividend by 29.7%. Even Ares Capital, the sector’s blue chip, trades at a 4.4% discount, having slipped from its historical premium.

The BDC sector average discount is approximately 15%. BDC discounts reflect a package of factors: liquidity risk, management fee drag, market sentiment, and mark scepticism.

But when the average discount is 15% and the worst names trade at 25-35% below stated NAV, the market is telling you that some combination of stale marks and structural illiquidity makes stated NAV an unreliable measure of realisable value. The precise decomposition between “marks are wrong” and “the vehicle structure imposes a liquidity cost” is debatable. The direction is not.

The FinTwit narrative is just getting started

The private credit selloff has generated a powerful narrative ecosystem on financial social media, structured around one dominant frame: is this 2007?

Mohamed El-Erian set the terms of debate on the morning of February 19, posting on X that Blue Owl could be “a canary-in-the-coalmine moment, similar to August 2007”, referencing the Bear Stearns hedge fund failures that preceded the Global Financial Crisis. He added important caveats (”nowhere near the magnitude”), but the comparison stuck.

Dan Rasmussen of Verdad Capital, a long-standing critic who describes private credit as “high-interest-rate loans that banks wouldn’t touch”, told CNBC directly: “This is a canary in the coal mine. The private markets bubble is finally starting to burst.” The Kobeissi Letter posted viral threads framing the redemption halt as “A WARNING SIGN NOT SEEN SINCE THE GREAT FINANCIAL CRISIS.”

On the podcast circuit, Jeffrey Gundlach’s recent Odd Lots appearance calling private credit “a powder keg” and semiliquid private-credit ETFs “the ultimate sin” has been widely recirculated. Dan Rasmussen’s January 29 episode on Excess Returns, titled “The Bubble You Can’t Exit”, covered private credit stress, bankruptcy signals, and the dangers of democratizing PE through 401(k)s. Bloomberg’s Odd Lots newsletter on February 20 covered the Blue Owl situation as “private credit escape hatch” with “circular financing” framing.

The Substack ecosystem is producing analytical depth that traditional media cannot match. published a comprehensive multi-part series (”AI Bubble, Canary or Continuation: Blue Owl’s Ghosts of 2000/2008”) drawing explicit CDO parallels. ’s Substack amplified the contrarian Cliffwater research note arguing the panic is structural (failed BDC 2.0 model), not credit quality. The Expat Wealth at Work newsletter provided granular data showing average returns from the five largest private credit funds declining from 11.39% (2023) to 8.76% (2024) to 6.22% (first nine months of 2025), a trajectory that makes the redemption wave entirely rational.

The full ecosystem I’ve identified, as of February 22 2026, can be found at the end of this post.

The regulatory dimension sharpened as observers noted that Kuvare, a regulated insurance company, was among the buyers, raising questions about whether private credit risks are migrating into the regulated financial system. Senator Elizabeth Warren issued a statement calling the Blue Owl situation evidence of deeper problems in private credit, asking “Do I hear a cockroach?” and demanding federal stress tests on private credit exposures across the $1.7 trillion market.

Why most coverage of this story is missing the point

Most financial journalism operates on a binary: “crisis” or “nothing to see here.”

Private credit stress does not present as either. It presents as a slow accumulation of technical deteriorations, each individually insufficient to trigger a headline, but collectively sufficient to transform the risk profile of a $1.7 trillion market.

A PIK conversion does not look like a crisis. A covenant amendment does not look like a crisis. A maturity extension on a struggling software company does not look like a crisis.

Each one, in isolation, is a rational workout decision by a lender managing a troubled credit. But when 59% of defaults involve PIK conversions rather than outright failures, when headline default rates are 3-4x lower than independent tracking, when the DOJ is publicly warning about “creative marks,” these individual workout decisions aggregate into something the binary framing cannot capture: a systematic understatement of credit deterioration that is invisible in the data most investors rely on.

This matters because of how private credit losses actually materialise. In public credit markets, stress is visible in real-time: bond prices move, CDS spreads widen, rating agencies downgrade.

The market’s assessment and the manager’s assessment converge quickly because both are looking at the same observable prices. In private credit, there are no observable prices. The manager marks the book. The auditor reviews the marks annually. The investor sees a NAV that is, at best, a quarterly snapshot of the manager’s own assessment, reported with a lag.

When the underlying credits deteriorate, the information flow to investors is delayed, filtered through the manager’s discretion, and presented in a format (NAV per share, net investment income yield) that is structurally designed to smooth volatility rather than reveal it.

This is not a conspiracy. It is a feature of the asset class, and in normal environments it is a feature investors willingly accept because the smoothing reduces mark-to-market anxiety and the illiquidity premium compensates for the information disadvantage. The problem arises when a novel risk, one not captured in historical default models, arrives faster than the marking and reporting cycle can process it. AI disruption of software cash flows is that risk. The underlying economics of the borrowers are changing on a timeline measured in months, while the marks that determine NAVs (and therefore management fees, and therefore manager incentives) are updating on a timeline measured in quarters. The gap between reality and reported values is widening, and it will continue to widen until either the risk dissipates or the marks catch up.

The lag is further extended by amendment and extension (A&E) activity, the single largest mechanism keeping headline default rates low and the one least discussed in public coverage. Before a loan technically defaults, the lender and borrower typically negotiate an amendment: covenant relief, maturity extension, sometimes additional PIK or fee income for the lender in exchange for forbearance.

These amendments do not count as defaults in any tracking methodology, including Fitch’s.

They are a third layer of hidden deterioration that sits beneath both manager-reported defaults and Fitch’s broader tracking. According to practitioners I have spoken with, A&E volume in private credit is currently at or near historic highs, which is consistent with a market where borrowers are under genuine cash flow pressure but lenders have every incentive to avoid recognising defaults that would force mark-downs.

Understanding these layered lags, the quarterly reporting cycle, the covenant-lite structures that remove early warning triggers, and the A&E activity that prevents formal default recognition, is essential to interpreting everything that follows.

When I cite the Fitch gap (5.7% trailing default rate versus sub-2% manager-reported), when I discuss Blue Owl’s loan sale at 99.7 cents on the dollar, when I evaluate BDC discounts to NAV, the analytical question is always the same: what does the observable data tell us about the gap between reported values and actual credit quality, and which direction is that gap moving?

The most granular work on these questions has come from independent research: The Endtropy’s multi-part CDO parallels series, Larry Swedroe’s amplification of the Cliffwater structural argument, the Credit Strategist commentary circulating on Substack. I will be drawing on and extending that work throughout this piece.

The contrarian case deserves serious consideration

The bear narrative is compelling, but several data points cut the other way. Institutional investors, CalPERS, OMERS, British Columbia Investment Management, were the buyers of Blue Owl’s $1.4 billion in loans.

They are not naive. Bank of America announced a $25 billion commitment to private credit on the same day as the Blue Owl selloff, a signal that the largest bank in America sees value. Blackstone reported record $71 billion in Q4 inflows, and TPG raised a record $51 billion in 2025 fundraising. Apollo’s management disclosed they had already reduced software exposure over the prior two years and profited from shorts against First Brands and Tricolor debt.

Before getting to the structural arguments, there is a data point that complicates the blanket disruption narrative in ways the bears have not adequately addressed. ICONIQ’s GenAI survey data (N=298 AI builders, Q4 2025) shows that nearly 70% of AI builders are focused on vertical applications, up from 51% in Q2 2025, not on foundational models. The differentiation battle is not happening at the model layer; it is happening at the application layer, where data, proprietary workflows, and deep integrations matter.

This is significant because it suggests the value in enterprise software is shifting up the stack to whoever owns the data and the workflows, and that is, in many cases, precisely the SaaS incumbents everyone is panic-selling. An AI model that can draft emails does not own the customer relationship data, the compliance audit trails, or the integration layers that a Salesforce implementation represents. The model layer is commoditising exactly as expected (DeepSeek R1 confirmed this), which means the locus of defensibility may actually be moving toward, not away from, entrenched enterprise software platforms.

I want to be careful not to overstate this. The ICONIQ data tells you where builders are focusing, not where disruption will land. But it introduces a meaningful qualification to the blanket disruption thesis. If the model layer commoditises (which DeepSeek confirmed) while the application layer remains defensible through data and workflow ownership, then the incumbents who move fastest to integrate AI into their existing platforms may actually strengthen their competitive positions rather than lose them.

The disruption thesis holds for companies that are pure workflow automation with no proprietary data advantage. It weakens considerably for platforms sitting on years of customer data, compliance audit trails, and integration layers that an AI-native entrant would need years to replicate. The distinction between these two categories is doing most of the analytical work in this piece, and the ICONIQ data suggests the market may be drawing the line in the wrong place for at least some of the names currently being sold indiscriminately.

The Cliffwater research note makes the strongest structural argument for calm: OBDC II’s annualized return of 9.11% essentially matched the industry benchmark (Cliffwater Direct Lending Index at 9.19%).

The problem was not the asset class but the BDC 2.0 fund structure, a model that has now been abandoned industry-wide in favor of perpetual vehicles. Blue Owl’s newer funds (OCIC, which raised nearly $20 billion over five years) use this updated structure. James Staunton at Berenberg argues the jump from software equity repricing to private credit defaults is “too large”, these are senior secured loans with loan-to-value ratios around 30%, providing substantial equity cushion even if enterprise values decline.

Analyst consensus remains surprisingly bullish: most aggregators show 12 Buy ratings and 3-5 Holds, though Zacks downgraded OWL to Strong Sell on January 27. The median price target sits around $16-$18.50 (implying 50-70% upside from $10.85). The disconnect between Wall Street’s published ratings and the market’s pricing could mean either that analysts are behind the curve, or that the selloff has created a genuinely compelling entry point for investors willing to underwrite the AI disruption risk.

There is a stronger version of the bull case that deserves direct engagement, because it is the one most likely to be correct if the bears are wrong. The argument is simple: the market has compressed five years of AI disruption into five weeks of price action, and that compression is itself the mispricing.

Enterprise software replacement cycles are measured in years, not months. Procurement inertia, compliance requirements, integration complexity, vendor lock-in, and organisational switching costs are real frictions that AI agents reduce but do not eliminate. A Fortune 500 company is not ripping out its Salesforce implementation because Claude can draft emails. The disruption is directionally correct, but the market has priced the terminal state without discounting for the transition years. If that argument is right, the selloff is a classic overshoot and mean-reversion is the dominant trade.

I take this seriously, and I want to be explicit about where I think the bulls are right and where I think they are wrong, because the distinction determines which credits survive and which do not.

The bulls are right that deeply embedded software (ERP, cybersecurity, mission-critical infrastructure) faces a multi-year disruption timeline. These systems have tentacles that reach into every corner of an organisation: compliance frameworks, audit trails, integration layers, vendor liability structures, and years of organisational muscle memory. An AI agent cannot replicate that overnight, and the enterprises running these systems are not going to rip them out on the basis of a product demo, no matter how impressive.

For private credit exposures to this category, the pace argument is a strong defence of the underwriting thesis.

The bulls are wrong, in my view, about the vulnerable end of the spectrum: workflow automation, horizontal SaaS, basic legal and tax tools. These businesses do not require a full rip-and-replace to destroy the credit thesis.

They require only enough competitive pressure to compress margins and stall growth, and that can happen on a 12-18 month timeline. I have already laid out the arithmetic: a $500K licence becoming a $300K licence across enough renewals decelerates growth from 15% to 3%, and for a borrower carrying 6x leverage, that deceleration alone is the difference between a performing credit and a covenant breach.

The question for each specific credit in a private lending portfolio is which end of that spectrum it sits on. My concern, which I have documented with BDC filing data above, is that the loan books are disproportionately weighted toward the vulnerable end, because those were the businesses that looked best on paper: asset-light, high-margin, predictable revenue, low capex. The portfolio composition reflects it.

Mapping the exposure: who is vulnerable and who is not

Rather than a simple buy/sell list, I want to give you a framework for evaluating exposure across the private credit ecosystem, because the dispersion in outcomes here is going to be enormous.

The same macro event will produce winners and losers depending on three variables: portfolio composition (what percentage of the loan book sits in AI-vulnerable software categories), fund structure (whether the vehicle has liquidity gates, tender mechanisms, or perpetual structures), and management quality (whether the team anticipated AI disruption or is now scrambling to remark). I will walk through each tier with the specific data points I am watching.

Tier 1: Direct software credit exposure (most vulnerable)

These are the names where AI disruption hits the loan book directly. The key metric across this tier is the gap between stated NAV and market price, which tells you how much the market believes the marks are overstated.

Blue Owl (OWL) is the obvious case: concentrated technology lending (OBDC’s schedule of investments shows 18-22% in software and technology services, with additional exposure through adjacent categories), governance problems documented above, and a stock reflecting severe stress at a 25.5% discount to NAV. But the exposure extends beyond Blue Owl. FS KKR Capital (FSK) trades at a 30-35% discount to NAV and just cut its base dividend by 29.7%, the clearest signal a management team can send that it sees deterioration the headline numbers have not yet captured. Monroe Capital’s BDC carries PIK rates above 24%, the highest in the public BDC universe, meaning nearly a quarter of its reported investment income comes from borrowers paying interest with more debt rather than cash. Golub Capital BDC (GBDC) has meaningful software and technology services exposure in its middle-market book and its discount to NAV has widened from roughly 5% to 12% since January, a less dramatic move than Blue Owl’s but directionally the same signal.

The question for investors holding these names is simple: do you trust the stated NAVs? The BDC sector average discount is approximately 15%. If that discount represents the market’s best estimate of mark-to-market overstatement, then the fee revenue being earned on these portfolios (typically 1-1.5% of stated NAV) is partially earned on phantom assets. That is a second-order risk that has not yet been reflected in consensus earnings estimates for the managers.

Tier 2: Diversified alternative asset managers (contagion discount, potentially mispriced)

This is where the opportunity may sit, if the stress remains contained. But “if” is doing a lot of work in that sentence, so let me lay out both the case for and the case against buying the contagion discount.

The case for: Ares Management (ARES) has the sector’s strongest credit reputation and its flagship ARCC trades at only a 4.4% discount to NAV, a gap so narrow relative to the 25-35% discounts at weaker BDCs that the market is effectively telling you Ares’s marks are trustworthy. Ares also has meaningful insurance, real estate, and infrastructure businesses that are uncorrelated with software disruption.

Apollo (APO) stands out as the manager that most clearly anticipated this dislocation. David Sambur, co-head of Apollo’s private equity practice, has stated publicly that software valuations need a “much-needed reset” and disclosed that Apollo has zero software exposure in its PE business and less than 2% across its entire platform.

Marc Rowan, Apollo’s CEO and co-founder, has stated the firm aims to cut its direct lending exposure to software by half, from roughly 20% at the start of 2026 to below 10% net exposure in its credit funds. More tellingly, Apollo has taken active bearish positions against specific software credits, betting against the loans of companies including Internet Brands, SonicWall, and Perforce on the basis of disruption risk and weak credit quality.

This is not a manager reacting to a selloff. This is a manager that repositioned its portfolio before the selloff, which is the single most credible signal available about where the smart institutional money believes the risk lies, suggesting a management team that anticipated this dislocation rather than being caught by it.

KKR’s private credit book is one component of a diversified platform spanning infrastructure, real estate, and private equity. Blackstone (BX) reported record inflows even during the selloff.

The case against: the critical variable is whether the default cycle stays in software or broadens into the leveraged mid-market generally.

BCRED at $79 billion with rising redemption requests is the single most important data point in private credit right now, because if that vehicle gates, the “contagion discount” on diversified managers becomes a “legitimate discount” overnight.

More broadly, if rate cuts come slower than expected and the economy softens, the 6-7x leveraged buyouts that populate every private credit portfolio (not just the software ones) come under pressure too. At that point, the correlation between “software disruption risk” and “traditional credit cycle risk” spikes, and the diversification benefit these managers are priced for evaporates.

I am treating this as a moderate position because the two scenarios produce wildly different outcomes, and I do not have enough information to assign confident probabilities to either. If defaults stay contained in software (my base case, roughly 55-60% probability), these names re-rate 20-30% higher within twelve months. If the cycle broadens (35-40% probability), they have another 15-25% to fall.

Tier 3: The other side of the trade

If AI genuinely disrupts enterprise software, the disrupted revenue does not disappear. It migrates. Every dollar that a corporation stops paying to a legacy SaaS vendor gets reallocated: to AI-native tools, to the infrastructure those tools run on, or back to the bottom line as productivity gains. The hyperscalers (Microsoft, Google, Amazon) are the obvious beneficiaries, but they are already priced for AI dominance and carry their own capex risk if the infrastructure buildout overshoots demand.

The more interesting question is who provides the picks and shovels for an AI-native enterprise stack. I will name three categories rather than three tickers, because this deserves its own dedicated analysis: enterprise AI deployment platforms (companies that help organisations actually implement and manage AI agents at scale), observability and security tooling for AI workflows (because autonomous agents create novel monitoring and compliance requirements), and edge inference infrastructure (because latency-sensitive enterprise applications will not all run in centralised cloud). If you want specific names, they are coming in a follow-up piece for paid subscribers.

The point for now is that the “AI disrupts SaaS” thesis has a long side, and most commentary is ignoring it entirely.

On the short side, two separate trades deserve attention. The direct short on publicly traded software names most exposed to agent-based disruption (Salesforce down 25%, Intuit down 32%, Thomson Reuters down 30% year-to-date) has largely played out.

Remaining downside from here requires a view that the market has still not fully priced the disruption timeline, and after a 25-35% drawdown, the risk/reward on incremental shorts is poor unless you have a specific catalyst in mind (upcoming earnings, contract renewal data, further AI product launches).

The second-derivative short is more interesting and, I believe, still mispriced. Private credit managers earn fees (typically 1-1.5% of NAV plus 15-20% incentive fees above a hurdle rate) on stated portfolio values.

If BDC market pricing is correct that stated NAVs are 15-25% overstated, then fee revenue is partially earned on phantom assets. When those marks come down (and they will, because auditors must eventually reconcile marks with observable market prices and realised defaults), management fee revenue compresses mechanically. That compression has not yet been reflected in consensus earnings estimates for any of the publicly traded alternative asset managers. For Blue Owl specifically, where management fees represent the overwhelming majority of revenue, a 15-20% NAV writedown on the technology-exposed portion of the portfolio flows almost directly to the bottom line.

Tier 4: Hedges for passive exposure

Many investors have private credit exposure without knowing it, through pension funds, insurance products, target-date retirement funds, and increasingly through 401(k) allocations that include alternative sleeves. If you cannot easily assess or reduce that exposure, the simplest hedge is the BIZD ETF (VanEck BDC Income ETF), which is the most liquid publicly traded proxy for private credit.

March 2026 puts on BIZD are relatively inexpensive given the implied volatility in individual BDC names, suggesting the market is pricing idiosyncratic Blue Owl risk rather than broad sector risk. If you believe (as I do) that the stress will spread beyond Blue Owl before it resolves, that is a mispricing.

A final note on sizing and conviction. I am treating the diversified alt manager opportunity (Tier 2) as a moderate position, not a high-conviction trade, because my own analysis contains a tension I have already flagged: if defaults genuinely hit 5-7% across the private credit market, even the diversified managers take meaningful earnings hits. The hedge (Tier 4) I am more convicted on, because the asymmetry is favorable: if I am wrong and the stress is contained to Blue Owl, the puts expire worthless and the cost is modest; if I am right and BCRED or another large vehicle faces redemption pressure, the payoff is substantial. I will publish detailed position sizing and entry levels for subscribers in the follow-up pieces.

What I am actually doing with this information

The framework above tells you how to evaluate the exposure. Here is where I personally sit.

Here is my honest answer, and it is more nuanced than a single ticker.

The obvious short (which means it is probably too late): Blue Owl at $10.85 with 12.5% short interest and a management team selling its best assets to its own insurance subsidiary. The bear case writes itself. But 12.5% short interest means the trade is crowded, the borrow is expensive, and the stock is already down 54% from its high. Shorting something that has already halved requires either a catalyst for further decline or a thesis that fair value is materially below $10. If you believe the residual portfolio (after the $1.4 billion cherry-picked loan sale) is worth 60-70 cents on the dollar, the math works. If you think the marks are roughly fair and this is a liquidity event rather than a solvency event, you are shorting a stock that Wall Street has at $16-18.50.

My view: the marks are not fair, but 12.5% short interest with an expensive borrow means you are paying a significant carry cost to hold a position in a stock that has already priced in substantial distress. The asymmetry favours the short at $15-16, not at $10.85. I would not initiate here.

The more interesting trade sits in Tier 2 of the framework above: the diversified alternative asset managers trading at contagion discounts. I have already laid out the logic and the risks, so I will not repeat myself. The short version: I find the risk-reward compelling at current levels, but I am sizing it as a moderate position, not a high-conviction one, because the tension between “contained stress” and “broadening default cycle” is real and unresolved.

The contrarian long (for those with stomach lining): Blue Owl at 5x earnings with 50-70% implied upside to analyst targets, buying at the point of maximum narrative pessimism. The Saba tender offers at 65-80 cents establish a floor. The pension funds buying the $1.4 billion loan portfolio are not stupid.

If the AI disruption thesis is overblown, or if it takes three years to play out rather than three months, this stock re-rates violently. I am not taking this trade, because I think the AI disruption timeline is faster than the market appreciates. But I respect the logic, and I want to be honest that the bull case has real teeth.

The macro hedge: If you have broad exposure to alternative asset managers or private credit through your portfolio (and many people do without realizing it, through pension allocations and insurance products), the simplest hedge is reducing that exposure or buying puts on BDC ETFs. The BIZD (VanEck BDC Income ETF) is the most liquid proxy.

I will be writing dedicated deep-dives on the individual names over the coming weeks. If you are not a paid subscriber, now would be the time.

So is this 2007?

No. The comparison is seductive, the engagement incentive to amplify it is enormous, and the analytical case for it is weak. Here is why.

The analogy fails on scale (subprime involved synthetic leverage creating trillions in notional exposure wired into the banking system; private credit at $1.7 trillion is mostly held by institutional investors in locked-up vehicles), on transmission mechanism (in 2007 the risk sat inside bank balance sheets and the interbank lending market; today it sits with pension funds, insurance companies, and endowments that cannot trigger a bank run, only redemption queues and fund gates), and on monetary policy (Bernanke was hiking at 5.25%; today the Fed has room to cut).

Blue Owl gating OBDC II is a problem for Blue Owl’s investors. Bear Stearns’ hedge funds failing was a problem for everyone with a mortgage.

These are not comparable events.

Here is what this actually is: the first real-world stress test of the private credit model under a novel risk scenario that historical default models cannot capture. AI disruption of software cash flows was not in anyone’s underwriting assumptions.

The marks are stale, the default rates are understated, and the structural liquidity mismatch (illiquid multi-year loans inside semi-liquid wrappers marketed to retail investors) is a genuine vulnerability.

Blue Owl was the weakest link. Blackstone’s BCRED at $79 billion with $2.1 billion in quarterly redemption requests is the next one to watch. If that vehicle gates, the “canary in the coal mine” framing becomes consensus overnight.

But “canary in the coal mine” and “this is the next Global Financial Crisis” are wildly different claims. The former is plausible and supported by the data. The latter requires a transmission mechanism to the banking system that, as of today, does not exist.

The canary is singing. The question is whether anyone is listening carefully enough to hear what it is actually saying, rather than what they want it to say.

If you enjoyed this post, consider supporting our work by becoming a paid subscriber.

Subscribe now

This article is for informational and educational purposes only and should not be construed as investment advice. The authors may hold positions in securities mentioned. All views expressed are our own. Do your own due diligence before making any investment decisions.

Ecosystem

The Bank of Japan is hiking rates, running quantitative tightening, and shrinking its balance sheet simultaneously, something that would have been unthinkable two years ago.

Japanese life insurers now lose money owning U.S. Treasuries on a hedged basis compared to buying domestic bonds, a reversal of the arithmetic that has governed $1.14 trillion in cross-border capital flows for three decades.

And yet the yen is still weak. The money hasn’t moved. Not yet.

This piece is my attempt to explain why the gap between the arithmetic and the positioning is the single most important macro setup in global markets right now, and to build a specific, dated catalyst framework for when that gap closes. It covers:

• Why hedged Treasury returns have turned negative for Japanese institutions for the first time in 30 years, and what the $60 billion in unrealized losses means for allocation decisions

• Six specific catalysts, ordered by timing and impact, starting with the Shunto wage results in mid-March

• The Alex Gurevich “2014 dollar parallel” and why the structural comparison illuminates the trade (and where it breaks down)

• A serious engagement with the bear case, including the fiscal dominance scenario, Hugh Hendry’s USD/JPY 200+ thesis, and JP Morgan’s 164 forecast

• Why the two most popular consensus narratives (China as failed state capitalism, AI as U.S. exceptionalism engine) are functioning as intellectual cover for a positioning error

• Trade expressions ranked by dominance framework, threshold levels, and invalidation conditions

The first catalyst satisfies in three weeks.

The Shunto wage negotiations report mid-March. Life insurer investment plans drop in April. The BOJ meets April 30. If you want the catalyst framework, the threshold levels, and the specific data releases to watch before the market prices them in, not after, subscribe to TSCS.

Subscribe now

Read more

I think the consensus is carrying a systematic error worth approximately 200 million barrels. And I can show you exactly where it comes from.

The IEA’s terrifying 477 million barrel headline build for 2025 falls apart under decomposition. It counts 111 million barrels of Chinese strategic reserves, barrels locked away under a security-first mandate with a single test release in SPR history, as commercial surplus. It counts 248 million barrels of “oil on water” as oversupply, when more than half of the increase reflects Brazilian crude taking the long route to China rather than the short route to Houston. And it relies on a demand model that has underestimated global consumption for 18 consecutive years, a pattern the IEA’s own 330,000 b/d upward revision of 2022-2024 data confirmed just last May.

Once you strip out the misclassified reserves, the cartographic illusions, and the structural demand blindness, the real surplus is roughly a quarter of what the headlines describe. And that’s before you account for the 2.7 million b/d of OPEC+ supply that disappeared in January, the 700,000-900,000 b/d Kazakhstan lost to CPC terminal strikes, the structural rerouting of Indian crude away from Russia, or the geopolitical risk premium that Rapidan now prices at 75% probability of a US strike on Iran.

This piece is a full teardown of the surplus narrative: the barrel-by-barrel ledger rebalancing, the supply disruptions nobody is pricing, why OPEC+’s March 1 decision is less bearish than assumed, the US shale plateau, and the reflexivity problem that makes narrative itself a market fundamental. The conclusion is a $60-72 Brent range for 2026 with asymmetric upside, roughly $10 above where consensus expects to land.

Why you should be reading TSCS

Over 4,800 investors and analysts read TSCS for the research their Bloomberg terminal doesn't give them: deep, independent analysis on equity and macro themes, built from primary sources and written without conflicts. This piece alone dismantles roughly 200 million barrels of consensus assumptions. The full teardown, including the barrel-by-barrel ledger, the supply disruption catalogue, and the $60-72 range thesis, is below. Subscribe to TSCS to read it.

Subscribe now

Let’s get into it.

Read more

That’s how much market capitalisation evaporated from global software stocks in the first five trading days of February 2026.

Jefferies traders reported “get me out” selling they hadn’t seen since 2008. The Bessemer Cloud Index trades at a 54% discount to its five-year average. Anthropic launched 11 open-source plugins for Claude Cowork, and the market responded by pricing in the death of an entire sector.

The consensus is seductive: AI wins, SaaS loses. Short the incumbents, long the model companies. Simple.

It’s also wrong.

Not completely wrong. Parts of the software universe are genuinely facing existential risk, and we’ll name them. But the market is doing what it always does in moments of structural panic: treating a nuanced, category-specific disruption as a uniform extinction event.

It is selling 80% gross margin businesses to buy 40% gross margin businesses. It is selling companies with 124% net revenue retention to buy companies whose per-unit pricing is collapsing 200x per year. It is selling businesses that generate billions in free cash flow to buy businesses that have collectively burned more capital than the Apollo programme.

Something doesn’t add up. We’ll explain exactly what.

Over 12,000 words and weeks of research, we build the complete framework:

• why the model layer is commoditising into infrastructure economics while the application layer retains software economics;

• why the deterministic/probabilistic divide is the single most important concept for understanding who survives;

• why Jevons’ Paradox means cheaper AI is a subsidy for the right incumbents, not a death sentence; and

• where, specifically, capital should be allocated right now.

We name names. Six equity ideas, ranked by conviction, each stress-tested against the framework, with specific entry points, risk factors, and what would make us wrong. This isn’t a “SaaS is fine, don’t worry” piece. It’s a precision instrument for separating the fortress from the wreckage.

This is a joint publication with . When we realised we were independently building the same thesis from different angles, combining forces was the obvious move.

If you’re not yet subscribed to TSCS, now is the time.

We publish institutional-grade equity research, contrarian frameworks, and deep-dive analysis across sectors and market caps. We called the MSTR bear case before Yahoo Finance and Insider Monkey syndicated the thesis.

We published our AI inference economics piece months before the market caught up to the argument. Our Datacenter Bible became the go-to primer on AI infrastructure. We identified Kitwave as an acquisition target, and OEP Partners showed up with a £251 million bid.

Recent work includes our breakdown of AI’s circular financing problem, a full CATL deep dive on the self-funding battery monopolist, our MicroStrategy short thesis (now syndicated across financial media), and our analysis of why the S&P 500’s passive bid is the largest unpriced risk in markets.

That’s what this publication is: original research on the ideas that matter, before the crowd arrives.

If you want institutional-grade research without the institutional price tag, subscribe below.

Subscribe now

This piece is a joint publication with Les Barclays, and I want to say something about that directly. Les is one of the writers I actually read. Not skim, not bookmark for later, read. His work on AI Inference Value Capture and Conduit Debt Financing is consistently sharper than what most sell-side desks produce, and when we realised we were independently converging on the same thesis from different angles, combining forces was obvious.'

If you’re serious about equity research and you’re not already subscribed to , you’re leaving edge on the table. I don’t say that lightly and I don’t do paid endorsements. His work speaks for itself.

Subscribe to Les Barclays

Let’s get into it.

Section 1: The Catalyst and the Carnage

This is the “get lean” moment for software. The divergence between semiconductors and software has reached extremes that defy the historical relationship between these two sectors, which typically move together. Both were supposed to be part of the long AI trade. Now, with the onset of vibe coding and the launch of Claude Cowork, the market is reconsidering whether typical SaaS companies are winners or losers from AI.

The Timeline

January 16: Anthropic launches a feature allowing multiple Claude agents to coexist in a shared workspace and assign tasks to one another. Atlassian (TEAM) and Asana (ASAN) drop roughly 4% as investors realise project management software could be rendered redundant.

January 20: Multiple mid-sized technology and software companies announce freezes on junior hiring, citing AI as the driver of operational savings.

January 26: Dario Amodei publishes his “Adolescence of Technology” essay, signalling that AI could become a “super nation of workers” and potentially win a Nobel Prize within the decade.

January 29: Microsoft announces earnings with weaker Azure guidance. The stock drops nearly 12% the following day, one of the worst sessions in the company’s history. The entire software sector follows: ServiceNow (-11%), Salesforce (-6%).

January 30: Anthropic releases 11 new open-source plugins for Claude Cowork, covering legal (contract review, compliance), finance (analysis and reporting), sales (lead qualification), marketing (campaign management), and customer support (ticket routing).

January 31: Reports confirm nearly 25,000 tech jobs were cut in January alone, one of the highest tallies since 2020.

February 3: The Cowork plugins spark one of the largest single-day declines in software indices. Professional data aggregators sell off sharply: Thomson Reuters (-16%), RELX (-15%), LSEG (-8.5%), Experian (-7.2%).

What Claude Cowork Actually Does

Claude Cowork is Anthropic’s no-code, agentic AI assistant for businesses. The 11 new plugins automate tasks across legal, finance, marketing, sales, product management, and data analysis, work that has traditionally required various specialised software platforms. It collapses a significant portion of that stack into a single AI system that understands context, executes tasks independently, and retains institutional memory.

The plugins are designed around real enterprise workflows. Productivity tools manage tasks, plan the day, and build long-term memory of work context. Product management tools write feature specifications, plan roadmaps, and distill user research. Marketing agents create content, plan campaigns, and analyse performance. Finance tools assist with reconciliation, journal entries, and reporting. Data agents write SQL, explore datasets, and generate dashboards.

The Legal Agent is particularly significant. It competes directly with Harvey AI and Legora, but Anthropic owns its own models, giving it scale and control that startups dependent on third-party models lack. All outputs still require review by licensed attorneys, but the market reaction implies investors are already looking past the disclaimer and pricing in a future where AI shifts from helper to operator. The implication: fewer human seats and fewer software tools required for the same output.

Anthropic appears to be following the vertical integration strategy: own as much of the stack as possible, maintain an internal locus of control. As we argued in our piece on value capture within AI inference, the firms that control the stack and depend least on external infrastructure at any layer are the likeliest to emerge as the durable winners of the AI race. That combination has made Anthropic’s move genuinely unsettling for traditional software firms. For the first time, investors are openly pricing in a shift where AI doesn’t sit on top of existing software but replaces large parts of it altogether.

Feature Moats vs. Platform Moats

The sentiment is directionally correct, but the market’s response is indiscriminate. AI disruption hits products that are basically templated document work with thin moats. It rewards companies that own distribution, proprietary data, or deep integrations where the agent is just one layer in a complex stack. This is not a total SaaS apocalypse. It is multiple compression for some categories and a secular tailwind for others.

Consider the vibe-coding narrative. The argument that the same enterprises that aren’t downloading and self-hosting open-source alternatives today are suddenly going to spend time, money, and effort vibe-coding their own solutions, and then also host, secure, and maintain them, doesn’t survive contact with reality. There are free open-source replacements for most SaaS products available right now. The reason enterprises still pay for Salesforce is not because they can’t find alternatives. It’s because migration, integration, compliance, and institutional trust are worth more than the subscription fee.

It isn’t just Claude. It’s the expectation that these capabilities become cheap and embedded everywhere. The winners will be the tools with distribution, workflow depth, and trust, not just raw capability. The moral is straightforward: if your SaaS doesn’t have a wide moat and can be vibe-coded in minutes (or even days), your SaaS is toast. Someone will eat your lunch by doing it better, faster, and cheaper. But the transition won’t be instantaneous. Companies won’t abandon legacy SaaS overnight when there’s no trust infrastructure around the replacement.

Where the Damage Actually Lands

Goldman Sachs projects that AI agents will account for over 60% of software economics by 2030, absorbing dollars that currently flow to classic SaaS seats. Most deployments today are still chatbots wired to LLMs; the stronger agentic patterns remain proofs of concept or internal pilots. The stack needs a stable platform layer plus guardrails for identity, security, and data integrity, and broad standardisation is at least 12 months away.

The real turmoil in software is not the loss of existing customers. A Fortune 500 with its data already embedded in Salesforce or Workday is not going to rip it out and replace it with a vibe-coded internal tool. The real damage hits in two places.

First, the upsell of additional features that add analytics, insights, or ease-of-use on top of the core platform. If a CRM upcharges your subscription for customer insights, that feature becomes less valuable every quarter as AI makes it trivial to extract those insights independently. As long as you can export the data, the analytical layer above the system of record is increasingly commoditised.

Second, new customer acquisition. AI-native startups will evaluate alternatives before committing to incumbent platforms, stalling purchase decisions and compressing pricing. The real test will come down to whether you’re selling a feature or a platform. SaaS companies selling plug-in features with a monthly subscription will get replaced. Companies providing end-to-end platform-level solutions will not only survive but may see unit economics improve as they deploy AI to cut their own costs. The software sector is heading for a K-shaped bifurcation on steroids: the best companies emerge stronger, the worst vanish or miraculously reinvent themselves.

The Private Markets Angle

Most analysis of the SaaSacre has focused on public markets, which is understandable but incomplete. The private markets side is just as important, and arguably more fragile.

VC-backed software companies face a particularly grim set of constraints. They can’t raise more rounds, can’t sell to PE, and can’t IPO. They have roughly 12 months to figure out how to add AI to their products, and whether that saves them remains to be seen. The key for these companies is simple: be cash-flow positive so you can live to fight another day.

The ICONIQ data confirms what the market is missing. Nearly 70% of AI builders are focused on vertical applications, not foundational models. Vertical AI applications grew from 51% to 69% of what builders are creating.

These are companies building on top of models, not competing with them. The model layer is commoditising exactly as expected, which means the value is shifting up the stack to whoever owns the data and workflows. That’s the SaaS incumbents everyone is panic-selling.

The private credit exposure is where this gets genuinely concerning. As Matthew Brooker noted in Bloomberg, the vintage of software acquisitions made in the ZIRP era presents a serious problem. Many buyouts were executed at peak valuations just after Covid, and rising interest rates shut down the traditional syndicated loan market. Private credit stepped into the breach, with direct lenders jumping from 15-25% of buyout funding pre-Covid to 40-70% in 2022-2023, according to UBS credit strategist Matthew Mish.

That concentration means private credit is now disproportionately exposed to AI disruption. Mish estimates 25-35% of BDC portfolios face heightened threats, and forecasts private credit default rates rising roughly 2 percentage points this year to around 6%.

The sell-side is paying attention. UBS models an “aggressive AI disruption” scenario with defaults reaching 12-13% in private credit. Citigroup has initiated an underweight on software loans, citing 6-8% yields as insufficient compensation. Morgan Stanley is recommending shorting loan total return swaps versus high-yield swaps on the back of higher software exposure and worse convexity. Barclays notes that declining software equity valuations are increasing loan-to-value ratios across BDC portfolios, with potential obsolescence of some borrowers introducing material asset quality risk.

For years, software companies with high EV multiples, strong recurring revenue, and solid retention metrics were easy to lever at 7x or higher. That trade is breaking. PE will struggle to exit many legacy SaaS platforms acquired at peak multiples in 2021. For private credit lenders, the risk isn’t only higher defaults but lower recoveries. Software companies have few hard assets, and their IP isn’t worth much when it’s being disrupted. The high leverage inhibits reinvestment precisely when these companies need to spend aggressively to stay competitive.

It’s worth noting that these dynamics are probably more severe across the middle market than in public companies. Not all PE and private credit firms are created equal, but the trend of AUM accruing to the most scaled players isn’t stopping.

Section 2: The AI-Native Advantage (and Its Limits)

AI-native companies are growing 2-3x faster than top-quartile traditional SaaS benchmarks (ICONIQ).

The gap compounds. Every customer interaction becomes training data that improves the product. Better products attract more users, which generate more proprietary data. Legacy companies bolting AI onto existing workflows can’t replicate this because their architecture wasn’t designed to capture interaction data systematically.

Companies scaling AI across multiple workflows anticipate 24% greater productivity gains and 55% higher operating margins by 2030, with AI-native solutions deploying 90% faster than legacy systems requiring integration work.

The velocity advantage is real, and it stems from three compounding factors: data flywheel effects, organisational agility, and data-centric architecture.

The Structural Advantages

Data flywheels are the most powerful of the three. Unlike brand or network effects, data flywheels compound exponentially: user interactions generate proprietary data, that data improves AI models, better models attract more users. Proprietary datasets (transaction histories, usage patterns, domain-specific content) can’t be purchased or licensed. First-mover advantages in data collection create structural barriers that money alone can’t buy.

And yet 42% of business leaders report they don’t have enough proprietary data to effectively train or customise AI models.

The architectural divide is equally important. AI-native companies design their entire stack around data capture and utilisation: outcome interfaces, agent orchestration, and systems of record, all built modularly. Legacy companies are optimised for process efficiency, not data collection or feedback loops. The systems were built to do a thing.

AI needs them to learn from doing the thing. Retrofitting data flywheel capabilities onto workflow-centric architecture requires not feature additions but architectural reimagination. Technical debt and integration complexity make that transformation exponentially harder the longer you wait.

Organisational agility compounds the gap. AI-native startups operate with flat hierarchies, generalist teams, and distributed decision authority. McKinsey research shows flat structures enable 5-10x faster decision-making. Legacy companies are constrained by hierarchical approval chains and functional silos. BCG research confirms the pattern: 74% of legacy companies struggle to derive AI value, largely due to organisational rigidity, not technology gaps.

The Cost Structure Inversion

Legacy SaaS companies optimised for a cost structure where engineering talent was the dominant expense and infrastructure was cheap. AI products invert this. The marginal cost of an additional user is no longer near zero, because every interaction burns compute.

This is why routing strategies, model selection, and infrastructure efficiency determine who survives at scale. Companies that can optimise their model stack (shifting routine tasks to cheaper models, reserving frontier models for complex cases) will maintain 20-30% cost advantages over slower competitors. By the time a legacy company gets procurement approval for a multi-model strategy, AI-native competitors have already optimised three times.

The Probabilistic Problem

All of this paints a compelling picture for AI-native companies. But there’s a critical limitation that the breathless pitch decks consistently omit, and it’s the single most important concept for understanding which SaaS companies survive and which don’t.

LLMs are inherently probabilistic systems. Business processes run on deterministic ones.

A probabilistic system gives you a plausible next token, next sentence, next action. It’s about likelihood; you don’t get guarantees. That’s useful for drafting, exploration, pattern-spotting, and creative ideation. A deterministic system is designed so that given the same inputs, you get the same outputs every single time. That’s how invoicing, inventory, compliance, SLAs, and safety work. Business processes are built on “if X, then Y,” not “if X, then probably Y.”

As put it in his analysis of SaaS unbundling: AI will eat the probabilistic category, while deterministic systems become more valuable by integrating AI as a complementary layer. That framing is exactly right. When enterprises deploy AI agents in 2025 and 2026, they’re not replacing their systems of record. They’re building orchestration layers on top of them. CIOs are discovering that LLMs lack the deterministic consistency required for critical industries. A system that provides the correct answer six out of ten times is insufficient when the process demands 100% consistency.

A lot of money is being incinerated on “AI agents” and “RAG platforms” that amount to the mid-2010s chatbot strategy repackaged with better branding. People are bolting probabilistic models directly into deterministic workflows and then wondering why the system hallucinates, drifts, or quietly breaks guarantees the business depends on. More agents won’t fix this. What fixes it is architectural clarity: use deterministic systems to hold your source of truth (data, rules, constraints, anything that must be right 100% of the time), and use probabilistic systems at the edges for summarising, drafting, translating, and spotting patterns that humans then validate.

This distinction between deterministic and probabilistic systems is the analytical key to everything that follows. It explains why some SaaS companies face existential risk (those automating probabilistic tasks that AI handles natively) while others become more entrenched (those serving as the deterministic system of record that AI agents need to operate through). Keep this framework in mind. We’ll apply it directly in Section 4.

Section 3: The Counter-Thesis, Why the Model Layer Is the Fragile Part

Everything I’ve laid out so far paints a dire picture for SaaS. The Claude Cowork plugins, the hiring freezes, the private credit exposure, the blanket selloff. It’s compelling.

It’s also incomplete.

The market is treating “AI disrupts software” as a one-directional trade: short SaaS, long model companies. But nobody is asking the harder question: what happens when the model layer itself becomes a commodity?

Because that’s already happening. And if you follow the economics to their logical conclusion, the companies everyone is panic-selling may end up being more durable franchises than the ones everyone is celebrating.

The Model Layer Is Commoditising, Not Consolidating

Here’s the uncomfortable truth about foundation model companies: none of them have held market dominance for more than 18 months. Not one.

Menlo Ventures has now published three enterprise LLM market surveys, and the leaderboard has reshuffled in each one (full disclosure: that includes Anthropic, the company whose product I’m typing this into). Section 4 details the exact share shifts and the full pricing trajectory, but the pattern is clear: this market has no durable leaders, no pricing power, and unit economics that are fundamentally worse than the SaaS companies the market is selling. The numbers are stark, and we lay them out in full in Section 4.

Which brings us to DeepSeek.

The DeepSeek Precedent: Why Capital Isn’t a Moat

In January 2025, a relatively obscure lab in Hangzhou released R1, a reasoning model that matched OpenAI’s o1 on key benchmarks for a reported training cost of $6 million. The real figure was almost certainly higher (estimates from SemiAnalysis suggest the full R&D and hardware investment exceeded $500 million), but even at $500 million, the point stands: DeepSeek achieved frontier-adjacent performance at a fraction of what OpenAI and Anthropic spent.

This matters enormously for anyone trying to value foundation model companies. The traditional venture capital thesis was that training frontier models requires such enormous capital (tens of billions) that only a handful of companies could compete, creating a natural oligopoly with pricing power. DeepSeek blew that thesis apart. If a Chinese lab operating under US export controls on chips can match Western frontier models at a fraction of the cost, the “capital as moat” argument is dead. As the Institute for New Economic Thinking put it, the expensive infrastructure that once served as a moat for dominant firms can be undercut.

The Mixture-of-Experts architecture, Group Relative Policy Optimisation, Multi-Head Latent Attention, these techniques are now public knowledge. The method for building a frontier-adjacent model without frontier-level capital is written, published, and being studied by every lab on earth. The logical next step is straightforward: if anyone with sufficient (but not astronomical) resources can build a competitive model, then models will be priced like commodities, and the companies building them will earn commodity returns.

The only escape from commodity pricing is vertical integration into applications, which means competing with entrenched incumbents on their home turf. Anthropic is doing exactly this with Claude Cowork, and that’s precisely why the market panicked. But think about what that move actually signals: even Anthropic, arguably the hottest AI company on earth, recognises that selling model access alone won’t generate sustainable returns. The model layer is a means to an end, not the end itself.

Application-Layer Moats Are Deeper Than They Appear

The bear case on SaaS rests on a seductive but flawed premise: that AI “systems of action” will replace “systems of record.” It sounds elegant. AI agents will just do things, and the clunky software underneath becomes irrelevant.

Except systems of action need systems of record underneath them. You cannot act on data you don’t have.

Salesforce isn’t just a CRM. It’s the canonical source of truth for customer data that dozens, sometimes hundreds, of other tools read from. CRM data feeds marketing automation, customer support, billing systems, analytics dashboards, and sales forecasting. Replacing Salesforce doesn’t mean swapping one application for another. It means migrating every downstream integration, retraining every workflow, rebuilding every reporting pipeline, and risking data loss across the entire stack.

This is the integration graph problem, and it’s one that the “AI replaces SaaS” narrative consistently ignores. Epic in healthcare has hundreds of integrating applications. SAP in manufacturing has decades of customisation baked into operational processes. Procore in construction has legally mandated audit trails where system downtime means capital cannot deploy. These aren’t software products. They’re institutional infrastructure. Ripping them out is a multi-year, multi-million-dollar project, and no CEO is going to bet their company on a probabilistic system to replace a deterministic one in a regulated environment.

The Compliance Moat (Measured in Years, Not Months)

This is the part that tech Twitter consistently underestimates. Regulatory compliance isn’t a feature you bolt on. It’s a structural barrier that takes years and millions of dollars to build, and it creates switching costs that no AI agent can circumvent.

FedRAMP authorisation, the certification required to sell cloud services to US federal agencies, costs anywhere from $250,000 to over $2 million and takes 12 to 18 months or more to obtain. The Moderate level (which covers 80% of applications) requires implementation of 325 security controls. Annual maintenance adds $75,000 to $200,000 per year. And this is just one certification in one country.

HIPAA compliance for healthcare software requires minimum six-figure investments for updates, with ongoing audit requirements. FDA validation for life sciences software (think Veeva) involves years of documented validation trails that cannot be shortcut. SOX compliance for financial software means audit trails are legal requirements, not features. “The AI wrote it” is not an acceptable answer in any regulated industry. As the deterministic/probabilistic framework from Section 2 makes clear, a system that provides the correct answer six out of ten times is insufficient when the process demands 100% consistency.

These compliance frameworks don’t just protect incumbents from AI-native startups. They create a compounding advantage. Every year that Veeva has been FDA-validated is another year of audit trail that a new entrant would need to replicate. Every FedRAMP-authorised product has 12-18 months of head start that an AI-native competitor hasn’t even begun.

The Demo-to-Deployment Gap Is Enormous

This is perhaps the most underappreciated dynamic in the entire AI-versus-SaaS debate. Demos are not deployments. And the gap between the two is vast.

McKinsey’s 2024-25 surveys found that nearly 90-99% of organisations are using AI, yet only 1% consider themselves “mature,” and roughly 39% report actual EBIT impact. MuleSoft’s 2025 Connectivity Benchmark Report reveals that only 28% of enterprise applications are actually connected, and 95% of IT leaders say integration issues impede AI adoption. Organisations average around 897 applications. Capgemini lists the top scaling barriers as immature infrastructure, data quality gaps, low AI literacy, and privacy concerns.

Gartner predicts that by 2026, 40% of enterprise applications will include task-specific AI agents, up from less than 5% today. That projection sounds bullish until you realise it means 60% won’t. And “including” an AI agent is not the same as “replacing existing software with” an AI agent. The most common pattern isn’t replacement, it’s augmentation: embedding AI into existing workflows to make them faster, not tearing out the workflow entirely.

Deloitte’s 2026 State of AI report paints a more nuanced picture than the headlines suggest. Worker access to AI rose by 50% in 2025, and the number of companies with 40%+ of projects in production is set to double in six months. But only one in five companies has a mature model for governance of autonomous AI agents. And only 34% are “truly reimagining the business.” The rest are bolting AI onto existing processes, which is exactly what benefits incumbents.

The “AI can do X” demo is not the same as “enterprises will deploy X at scale with appropriate governance, security, and compliance.”

Anyone who has worked inside a large organisation knows this intuitively.

The procurement cycle alone for a Fortune 500 company is 6-18 months. Multiply that by the security review, the compliance assessment, the integration testing, the change management, and the internal politics, and you’re looking at multi-year timelines for any meaningful displacement of an entrenched system of record.

Historical Precedent Favours Adaptation, Not Extinction

We’ve been here before. The cloud transition was supposed to kill on-premise software. Oracle was dead. SAP was dead. Microsoft was a dinosaur. Instead, Microsoft successfully pivoted to Azure and Office 365 and is now the most valuable company on earth. Oracle maintained enterprise database dominance while adding cloud revenue. The incumbents didn’t die. They adapted. And they captured most of the value.

McKinsey’s research on technology transitions found that legacy vendors closest to the customer, with high industry and domain expertise, consistently protected their market share across disruption cycles. The same dynamic is already playing out here. The ICONIQ data from Section 1 confirms it: 70% of AI builders are focused on vertical applications, not foundation models. They’re building on top of models, not competing with them. The model layer is commoditising, and the value is shifting up the stack to whoever owns the data and workflows.

That’s the SaaS incumbents everyone is selling.

The Question the Market Should Be Asking

The market is treating this as a binary: AI wins, SaaS loses. But the actual question is far more nuanced. It’s not “will AI disrupt software?” Of course it will. The question is: “where does the value accrue when the model layer is free?”

When cloud computing commoditised infrastructure, the value didn’t accrue to AWS’s competitors or to the cloud infrastructure itself. It accrued to the applications built on top of that infrastructure. Salesforce, ServiceNow, Workday, the entire SaaS ecosystem was built on cheap, commoditised cloud compute.

Foundation Capital made this exact analogy in their post-DeepSeek analysis: “As the cost of intelligence plummets, AI is evolving from static tools to dynamic systems of agents that reason, plan, and act. This follows a familiar pattern: when core technologies commoditise, value moves up the stack. We saw this with cloud computing, AWS provided the foundation, but the real winners were the SaaS giants that built on top.”

The same AI model commoditisation that’s terrifying the SaaS market is actually the best possible outcome for SaaS incumbents. Cheaper AI means cheaper for SaaS companies to embed intelligence into their own products. It means Veeva can add AI-powered clinical trial analysis without building its own model. It means ServiceNow can deploy AI-driven workflow automation using whichever model offers the best price-performance ratio that quarter. It means the moat isn’t the AI, it’s the data, the workflows, the integrations, and the regulatory certifications that took decades to build.

The model layer is the commodity input. The application layer is where the margin lives.

Section 4: The Model Layer Economics Deep Dive

Section 3 made the qualitative case that the model layer is commoditising. This section puts numbers behind that claim. If the economics of foundation model companies are genuinely worse than the SaaS companies the market is selling to buy them, then the entire “AI kills SaaS” narrative doesn’t just weaken. It inverts.

4A: The Unit Economics Comparison

The divergence between SaaS incumbents and foundation model companies isn’t subtle.

Fortress Zone SaaS companies operate with gross margins that private equity investors would describe as “beautiful”: CrowdStrike at 81%, Adobe at 89%, ServiceNow at 78%, Veeva at 75%. The marginal cost of serving an additional customer on an existing software platform is close to zero. The server is already running. The code is already written. Every incremental dollar of revenue falls almost entirely to the bottom line.

Foundation model companies occupy a different universe. Anthropic’s gross margins in 2024 were negative 94% to negative 109%, depending on whether you include free-tier users. For every dollar of revenue, Anthropic spent nearly two dollars just on inference infrastructure, before counting R&D, talent, or anything else. The company projected improvement to roughly 50% gross margins in 2025, then revised that figure down to 40% after inference costs on Google Cloud and AWS came in 23% higher than anticipated. Even that revised 40% figure would put Anthropic’s margins below every single SaaS company in our Fortress Zone taxonomy.

OpenAI’s picture is, if anything, worse. The company’s “compute margin” reportedly improved from 35% in early 2024 to roughly 70% by October 2025. That sounds encouraging until you realise what it excludes.

OpenAI spent $6.7 billion on R&D in the first half of 2025 alone, $2 billion on sales and marketing in the same period, and stock-based compensation is running at $6 billion annually. When you include all costs, OpenAI spent approximately $1.69 for every dollar of revenue it generated in 2025. The company projects $14 billion in operating losses for 2026, roughly three times worse than 2025. Internal documents obtained by the Wall Street Journal show cumulative losses of $44 billion through 2028, with profitability not expected until 2029 or 2030.

For perspective: the cumulative cash burn OpenAI projects through 2029 ($115 billion) exceeds the inflation-adjusted cost of the Apollo programme.

Here is the comparison in full:

On every metric that matters for long-term business quality, SaaS incumbents score higher. The market is selling 80% gross margin businesses to buy 40% gross margin businesses. It is selling businesses with 124% NRR to buy businesses whose per-unit pricing is collapsing annually. It is selling businesses that generate billions in free cash flow to buy businesses that consume billions in venture capital.

Something doesn’t add up.

4B: The API Pricing Freefall

The pricing data deserves its own treatment because the magnitude of the decline is genuinely unprecedented in technology markets.

When OpenAI launched GPT-4 in March 2023, the flagship API was priced at $30 per million input tokens and $60 per million output tokens. That was the cost of frontier intelligence. Within 16 months, GPT-4o had brought output pricing down to $10 per million tokens, an 83% decline. By mid-2024, GPT-4o Mini arrived at $0.15 input and $0.60 output, a 99% reduction from original GPT-4 pricing for comparable task performance. As of late 2025, GPT-4-equivalent performance costs roughly $0.40 per million tokens, down from $20 just three years earlier.

Anthropic’s pricing trajectory follows the same curve. Claude 3 Opus launched at $15/$75 per million tokens (input/output). Claude 4.6 Opus launched at $5 per million tokens, a 67% reduction in a single generation.

Then DeepSeek entered the picture. DeepSeek R1 debuted at $0.55/$2.19 per million tokens, undercutting Western frontier models by roughly 90%. DeepSeek V3.2 offers reasoning capabilities competitive with GPT-5 at approximately one-tenth the price. By February 2026, OpenAI and Google have repeatedly slashed API costs to match what the market now calls the “DeepSeek Standard.” The price ceiling is set, and every lab must now match it or justify a premium against it.

Epoch AI’s analysis of inference price trends found that the rate of decline has actually accelerated. For models at GPT-4-equivalent performance levels, the median price decline was 50x per year through early 2024. From January 2024 onwards, that accelerated to 200x per year. Models that were state-of-the-art in 2023 have experienced approximately 1,000x price declines at equivalent intelligence levels.

For context, the semiconductor industry’s famed Moore’s Law delivered roughly a 2x improvement in price-performance every 18-24 months. LLM inference pricing is declining at 50-200x per year. This is not a gradual commoditisation. It is a pricing collapse without precedent in the history of technology markets.

4C: The Capital Requirements Arms Race

The bull case for foundation model companies requires believing one of two things: either margins will improve dramatically as scale increases, or revenue growth will be so explosive that margins become temporarily irrelevant. Both assumptions deserve scrutiny.

On margins, Anthropic projects reaching 77% gross margins by 2028. That would bring it into SaaS territory. But this projection was made before the company revised its 2025 margin forecast down by 10 percentage points, and before inference costs exceeded expectations by 23%. The path from 40% to 77% requires algorithmic efficiency gains, hardware cost declines, and revenue mix shifts toward higher-margin enterprise contracts that all need to go right simultaneously. It’s plausible. It’s not guaranteed. And even if Anthropic achieves 77% by 2028, it will have burned through billions in capital to get there, capital that SaaS companies never needed.

On revenue, the projections are staggering. Anthropic targets $20-26 billion in 2026 revenue, up from roughly $1 billion in 2024. OpenAI’s internal documents project $29.4 billion in 2026 revenue, scaling to $100 billion by 2029. To contextualise the latter figure: Nvidia generated approximately $130 billion in 2025 revenue on the back of what amounts to a near-monopoly over the largest hardware boom in technology history. OpenAI expects to approach that level in four years from a standing start.

These are not implausible figures if current adoption trends continue. Enterprise LLM spend has already tripled from roughly $13 billion in late 2024 to $37 billion in 2025, according to Menlo Ventures’ year-end survey. The market is growing fast enough to support massive revenue numbers. The question is whether the revenue belongs durably to any single provider.

Training frontier models costs hundreds of millions per run, and the trend line from Epoch AI shows training costs growing at 2.4x per year. By 2027, the largest training runs are expected to cost over $1 billion. Dario Amodei stated that “close to a billion dollars” was already being spent on single training runs in 2024.

Anthropic has raised over $13 billion, recently seeking an additional $10 billion at a $350 billion valuation. OpenAI has raised approximately $64 billion in total primary funding. Google DeepMind is backed by Alphabet’s balance sheet but cannibalises cloud margins in the process. Meta open-sources its models as a loss leader to drive engagement across its core platforms. OpenAI has committed $250 billion to Azure cloud services and signed a $38 billion AWS deal, the largest cloud contracts ever executed.

But hear me out: SaaS companies generate the cash to fund their own operations and return capital to shareholders. Foundation model companies consume capital from external investors to fund operations that may or may not become profitable within the decade. In an environment where interest rates remain elevated and the cost of capital is not zero, that distinction matters enormously.

The risk is not that these companies fail to grow. They are clearly growing at extraordinary rates. The risk is that they grow into a market structure where the model layer earns commodity returns while consuming capital at unprecedented rates. That is not a SaaS business. It is an infrastructure business with infrastructure economics, and the market is valuing it like a software business with software margins.

4D: The Market Share Instability Problem

The final piece of the model layer economics puzzle, and arguably the most underappreciated, is the complete absence of durable market position.

In late 2023, OpenAI held 50% of enterprise LLM API usage. By mid-2025, that had collapsed to 25%, with Anthropic surging to 32%. By year-end 2025, Anthropic had extended to 40%, OpenAI had slipped further to 27%, and Google had climbed to 21% (tripling from 7% in 2023). No provider has held the top position for more than 18 months.

Compare that to enterprise software. AWS launched in 2006 and still holds roughly 31% of global cloud IaaS market share nearly two decades later. Salesforce has been the CRM market leader for over 15 years. Oracle has maintained enterprise database dominance for three decades. Microsoft Office has been the productivity standard for 30+ years. That is what durable market position looks like.

In the model layer, the leaderboard is not just moving. It is spinning. And this instability is not a temporary phenomenon that will settle into oligopoly. It is a structural feature of a market where the underlying product is converging toward commodity status.

As Deedy Das at Menlo Ventures noted, “even when switching costs are low, most just upgrade to the latest model from their preferred provider.” That observation is revealing precisely because of what it implies: the stickiness, such as it is, comes from inertia and convenience, not from data lock-in or integration depth. The moment a competitor releases a model that is meaningfully better or cheaper, the switching cost is changing an API endpoint. That is a fundamentally different competitive dynamic than the one facing a Fortune 500 that has embedded its operations in Salesforce or ServiceNow over a decade.

You cannot build a durable valuation on volatile market share in a commodity market with collapsing unit pricing. The question “who will win the model layer?” may be the wrong question entirely. The better question is: “will anyone earn excess returns in the model layer?” And the data, at this point, suggests the answer is “probably not for long.”

The Synthesis

Would you rather own the business that generates $10 billion in free cash flow with 80% gross margins and 20 years of embedded customer relationships? Or the business that projects 40% gross margins on a good quarter, has raised $13 billion in venture capital to stay alive, and could lose half its market share in the time it takes to release a new model?

The market has given its answer. I think the market is wrong. The model layer is the commodity input. The application layer is where the margin lives. And at current valuations, you’re being paid to take the right side of that trade.

Section 5: The Taxonomy of Vulnerability

Section 5: The Taxonomy of Vulnerability

So the model layer is commoditising, the application layer has deeper moats than the market appreciates, and the selloff is indiscriminate. We’ve established all of that. But saying “the market is wrong” is useless without a framework for identifying exactly where it’s wrong, and who benefits or bleeds from here.

Not all SaaS is created equal. The market is treating the sector like a monolith, which is precisely why the opportunity exists. When Jefferies traders report “get me out” selling they haven’t seen since 2008, that’s not analysis. That’s capitulation. And capitulation doesn’t discriminate.

We need to.

The Framework

I’ve built a simple 2x2 matrix that maps every SaaS company along two axes:

X-axis: Workflow complexity. How structured and repeatable are the tasks the software automates? On the left end, you have simple, templated processes (routing a support ticket, sending a marketing email, generating an invoice). On the right, you have judgment-intensive, multi-stakeholder workflows that involve regulatory nuance, institutional knowledge, and deeply nested decision trees (adjudicating an insurance claim, managing a clinical trial, orchestrating enterprise IT across 500 applications).

Y-axis: Data moat depth. How proprietary, irreplaceable, and compounding is the data the platform accumulates? At the bottom, data is shallow, replicable, and easily exported (customer support transcripts, basic CRM records, project boards). At the top, data is deeply institutional, regulatory in nature, and functionally impossible to recreate (FDA validation trails, insurance actuarial histories, construction audit logs that are legal requirements).

The intersection of these two dimensions determines whether AI is an existential threat, a temporary headwind, or an outright tailwind for a given company.

Quadrant 1: The Dead Zone (Low Complexity, Shallow Data)

This is where the carnage is real and justified. These companies automate structured, repetitive tasks with minimal regulatory overlay, low switching costs, and data that can be replicated or scraped via APIs. AI doesn’t need to understand your business to do what these tools do. It just needs to follow a script.

Customer service pure-plays like Freshworks and the now-private Zendesk sit here. So do SMB marketing automation tools, basic project management software, and simple invoicing platforms. Five9, which automates contact centre workflows, has gone from a $209 all-time high to roughly $18. That’s not a selloff; that’s a market pricing in obsolescence. Freshworks is trading at a 36% discount to its 52-week high with net dollar retention of just 105%, barely above the churn line.

The tell for Dead Zone companies is straightforward: if Claude Cowork’s plugins can replicate your core value proposition out of the box, your moat was never a moat. It was a feature wrapped in a subscription. These companies sell outcomes that are increasingly achievable through general-purpose AI agents, and the pricing pressure will be relentless. When Anthropic launches legal, finance, marketing, and customer support plugins under an open-source licence, every company whose primary offering overlaps with those categories needs to articulate why they’re worth paying for.

Some of them can’t.

Quadrant 2: The Compression Zone (Low Complexity, Deep Data)

This is the trickiest quadrant for investors, because the data moat is real but the workflow simplicity means AI compresses the value of human seats interacting with that data. The data delays disruption, but it doesn’t prevent it.

HubSpot is the canonical example. Its CRM data is genuinely valuable (customer interaction histories, pipeline data, attribution models), but the SMB workflows built on top of that data are simple enough that an AI agent can execute most of them without human intervention. The result isn’t that HubSpot dies, it’s that a company paying for 50 seats suddenly needs 15. Revenue per customer compresses even as the platform remains sticky.

HubSpot’s 65% stock decline isn’t just panic selling. It’s the market repricing a business where seat-based economics face structural compression. At 4.3x forward revenue, it trades at all-time low multiples. The question isn’t whether HubSpot survives (it probably does), it’s whether the revenue model can adapt fast enough to offset the seat destruction. Management is guiding for 16% revenue growth in 2026, down from 21% in Q3 2025. That deceleration trajectory matters.

Analytics platforms and basic BI tools also sit here. The data they house can be valuable, but the act of querying, visualising, and summarising that data is precisely what LLMs are getting better at every quarter.

Quadrant 3: The Adaptation Zone (High Complexity, Shallow Data)

These companies operate in genuinely complex workflow environments, but the data they hold isn’t uniquely defensible. The moat is in the workflow depth, not the data. They survive by embedding AI into their workflows faster than AI-native startups can replicate their workflow complexity.

Adobe is the most interesting name here, and potentially the most mispriced large-cap in the entire software universe. The market is pricing it as if it’s only a creative tools company, when Document Cloud and Experience Cloud (enterprise digital marketing) are growing at or above the group rate and have zero overlap with text-to-image AI generation. The enterprise installed base, the workflow lock-in from Premiere to After Effects to Illustrator pipelines, and the sheer depth of professional creative workflows create switching costs that a text prompt cannot replicate. The question for Adobe is the same one it faced during the cloud transition: Is it Kodak, or is it Microsoft? We develop the full investment case in Section 7.

Atlassian sits here too, down 35% YTD. Development workflows are complex, but Jira’s data (tickets, sprint boards, backlogs) isn’t uniquely defensible. If Atlassian can’t embed AI deeply enough into the development lifecycle, faster-moving AI-native project tools will eat its lunch. It’s a race, and unlike Adobe, Atlassian doesn’t have the same margin of safety in its valuation.

Quadrant 4: The Fortress Zone (High Complexity, Deep Data)

This is where the selloff is not just wrong, it’s backwards. These companies don’t get disrupted by AI. They get more valuable because of it.

Fortress Zone companies share three characteristics. First, they operate in regulated verticals where compliance itself is the product (healthcare, insurance, financial services, construction, government). Second, their data moats are institutional, compounding, and legally mandated, not just commercially useful. Third, the complexity of their workflows makes them natural orchestrators of AI rather than victims of it.

Veeva Systems serves 19 of the top 20 pharmaceutical companies in a regulatory environment where FDA-validated audit trails create decades of compounding switching costs. No AI-native entrant can shortcut that institutional trust.

Guidewire is the dominant platform for property and casualty insurance core systems, operating in a regulatory environment where actuarial history, policy complexity, and compliance requirements make the demo-to-deployment gap measured in years, not months. The selloff here is sector contagion, not fundamental deterioration.

Procore in construction has legally mandated audit trails where system downtime means capital cannot deploy. The market is treating a regulated vertical monopoly like a generic SaaS tool.

ServiceNow is the orchestration graph. It doesn’t compete with AI agents; it’s the platform AI agents need to operate through. When an enterprise deploys agentic workflows, those agents need to interact with IT systems, HR processes, customer service queues, and security protocols. ServiceNow routes, governs, and audits those interactions.

CrowdStrike sits at the intersection of non-discretionary security spending and AI-driven attack surface expansion. Every argument the bears make about AI disrupting SaaS is an argument for spending more on security.

Snowflake’s consumption model directly benefits from AI workloads, because every AI agent needs to query data somewhere, and “somewhere” is increasingly a data warehouse or lakehouse.

We develop investment cases for each of these names in Section 7, with specific valuations, risk factors, and conviction levels.

The pattern should be obvious by now.

The Market Is Already Telling You

The SaaStr year-end data from December 2025 quantified the bifurcation perfectly. Palantir: +142%. Cloudflare: +80%. MongoDB: +70%. CrowdStrike: +51%. Snowflake: +47%. Those are 2025 full-year returns. On the other side: HubSpot: -51%. Bill.com: -43%. Monday.com: -36%. Atlassian: -34%. Salesforce: -31%.

That’s not random dispersion. That’s the market sorting companies into quadrants in real time, even if it can’t articulate the framework. The companies gaining are either AI-native from inception (Palantir), essential infrastructure that AI depends on (Snowflake, MongoDB, Cloudflare), or non-discretionary security that AI’s proliferation makes more critical (CrowdStrike). The companies losing are those where seat-based economics face compression, workflow complexity is moderate, or the moat was always thinner than the multiple implied.

What the 2026 selloff has done is extend the punishment indiscriminately, dragging Fortress Zone names down alongside Dead Zone names. That’s where the opportunity lives. When IGV is down 25% YTD and Guidewire has been halved from its highs, the market is not pricing in nuance. It’s pricing in fear. And fear is not an investment thesis.

The question for Section 7 is straightforward: which specific names in the Fortress Zone are the most compelling risk/reward right now, and where is the selloff actually justified?

Section 6: Jevons’ Paradox

Section 3 laid out the freefall in model pricing: a 99.7% decline in the cost-efficiency frontier since March 2023, algorithmic improvements boosting efficiency 4-10x annually, and inference costs being slashed fivefold in a matter of months. The marginal cost of intelligence is trending toward zero.

The consensus interpretation of this data is bearish for the model layer (correct) and bearish for total AI spending (almost certainly wrong). This is where Jevons’ Paradox enters the picture, and where the implications for SaaS become genuinely interesting.

William Stanley Jevons observed in 1865 that as coal-powered steam engines became more efficient, total coal consumption increased rather than decreased, because cheaper energy unlocked use cases that were previously uneconomical. The same dynamic is playing out in AI. As inference becomes cheaper, the number of viable applications expands dramatically, and total compute spending rises even as the per-unit cost collapses.

The early evidence supports this. The rapid adoption of AI coding tools hasn’t led to fewer developers being needed; it’s led to more complex software being built. Companies that would never have deployed AI at $37.50 per million tokens are deploying it aggressively at $0.14. The race to build more efficient models could fuel an exponential rise in overall GPU demand and electricity consumption rather than stabilising it.

As we noted in our earlier analysis of AI inference economics, the widely quoted compute margin of 70% for OpenAI requires careful interpretation. That metric measures margins on compute infrastructure costs alone: for every $1 collected from API usage or subscriptions, 30 cents goes toward GPU time, energy, and direct infrastructure overhead. It excludes R&D, talent, sales, and the continuous investment required to train successive frontier models. The all-in picture, as Section 3 detailed, is far less rosy. But the volume story is unambiguously bullish.

This has three implications for the SaaS thesis.

First, cheaper inference is a direct input cost reduction for SaaS incumbents. When it costs $0.14 per million tokens to run inference, embedding AI features into existing platforms becomes trivially cheap. The Fortress Zone companies identified in Section 4 can add AI capabilities at negligible marginal cost while maintaining premium pricing. The model layer bears the deflationary pressure; the application layer captures the surplus.

Second, Jevons’ Paradox means that every AI agent deployed by an enterprise needs to query, write to, and operate through existing systems of record. More agents means more API calls to Salesforce, more workflow transactions through ServiceNow, more data queries hitting Snowflake. The consumption rebound doesn’t just benefit GPU makers. It benefits the data and workflow infrastructure that AI operates through.

Third, the deflationary pressure on model pricing will eventually force model companies to integrate vertically into applications (as Anthropic is already doing with Cowork) or accept commodity returns. That vertical integration puts them in direct competition with entrenched incumbents on their home turf, a far harder fight than building a better model.

There’s a counterargument that deserves honest treatment. Jevons’ Paradox requires that cheaper inputs unlock genuinely new demand rather than merely substituting for existing spending. For coal, the new demand came from railways, factories, and industrial processes that didn’t exist before steam engines became efficient. The analogous question for AI is whether cheaper inference creates net new enterprise software spending, or whether it primarily redirects existing spending.

If a company uses cheap AI to eliminate 30 Salesforce seats, total software spending drops even if total compute spending rises. The Jevons’ framing only helps SaaS if the consumption rebound flows through existing platforms rather than around them. I think the evidence tilts toward “through” for Fortress Zone companies (more AI agents means more API calls to systems of record, more workflow transactions, more data queries) and “around” for Dead Zone companies (where the AI agent replaces both the human and the software the human used). The paradox is not uniformly bullish for SaaS. It’s bullish for the infrastructure layer that AI operates through, and bearish for the application layer that AI operates instead of. This reinforces the taxonomy from Section 4 rather than overriding it.

The market is pricing the decline in per-unit AI costs as a threat to software. It should be pricing it as a subsidy.

Section 7: The Equity Ideas

I’ve spent thousands of words building the framework. Now comes the part that actually matters: where to put capital.

The taxonomy from Section 5 gives us the filter. The selloff gives us the entry point. What follows is not a watchlist. It’s a ranked set of conviction ideas, each stress-tested against the framework, with specific data points that either support or undermine the thesis. I’ll flag what makes me nervous about each one, because any analyst who only gives you the bull case is either lazy or selling you something.

Before diving into individual names, the sector-level context matters. IGV, the iShares Expanded Tech-Software Sector ETF, is down 25% year-to-date. The Bessemer Cloud Index trades at roughly 5.5x forward revenue, compared to a five-year average of 12x. That’s a 54% discount to historical norms. The last time software valuations reached this level of compression was March 2020, which preceded a 120%+ rally over the following 18 months. I’m not predicting an identical rebound, but the base rate for buying quality software at these multiples has historically been very favourable over a 12-24 month horizon.

The thesis operates on two timelines. The near-term catalyst (6-12 months) is earnings stabilisation: when Fortress Zone companies report Q1 and Q2 2026 results showing that NRR, ARR growth, and margins are holding or accelerating despite the panic, the narrative shifts from “SaaS is dead” to “maybe the market overreacted.” The medium-term catalyst (12-36 months) is the first major AI compliance failure in a regulated industry, which triggers a flight to quality toward deterministic, auditable systems of record. Both catalysts are probabilistic, but the valuation floor means you’re being paid to wait.

Idea #1: Veeva Systems (VEEV), Highest Conviction

Veeva is the purest expression of the Fortress Zone thesis. The stock has been halved, from $310 to roughly $182. Market cap is $30 billion. And yet the business is printing numbers that most SaaS companies would kill for.

The numbers: $3.17 billion in FY26 revenue guidance, 16% year-over-year growth, 45% non-GAAP operating margins (up from 36% in FY24), and $1.07 billion in free cash flow. Net revenue retention is 124%, which is up from 121% in 2021. Read that again. In a year where the market is pricing in SaaS destruction, Veeva’s existing customers are spending more, not less.

The moat is institutional, not technical. 19 of the top 20 pharmaceutical companies are customers. 115 live Vault CRM deployments globally. Every FDA-validated audit trail is another year of switching cost that compounds like interest. If you’re a pharma executive and someone suggests ripping out the system that stores your regulatory submissions, clinical trial data, and compliance documentation to replace it with a vibe-coded alternative, you’d rightly question their judgment.

What’s genuinely interesting is the Salesforce separation. Veeva completed its formal break from Salesforce’s platform in September 2025, migrating to its own Vault CRM. Nine of the top 20 biopharmas have committed to Vault CRM versus Salesforce’s three. That’s not a competitive battle; it’s a rout. And the migration creates a multi-year revenue tailwind as customers upgrade and consolidate onto Veeva’s own stack.

The company is also embedding AI (using Anthropic’s Claude models, ironically) through Veeva AI Agents for commercial and R&D applications. But here’s the key: they’re including it at no additional cost. This is the exact thing I outlined in Section 2. The Fortress companies use AI to deepen entrenchment, not to extract incremental subscription fees. The AI makes the platform stickier, not more expensive.

At $30 billion, you’re paying roughly 9.5x forward revenue for a company doing $3.17 billion growing at 16% with 45% operating margins and $6.6 billion in cash and short-term investments. For context, Veeva’s five-year average forward revenue multiple is north of 20x. The stock is being valued as though growth is about to stall, but NRR of 124% (accelerating, not decelerating) tells you existing customers disagree.

The risk is real, though, and I want to be specific about it. Salesforce’s Life Sciences Cloud is not a hypothetical competitor; it’s live and being sold aggressively. Three of the top 20 biopharmas have committed to Salesforce versus nine for Vault CRM. That’s a clear Veeva lead, but the migration itself is a multi-year execution gauntlet. If a major pharma experiences data integrity issues or regulatory complications during the Salesforce-to-Vault transition, the narrative flips from “Veeva is winning the migration” to “Veeva broke the migration.” I’d weight that risk at maybe 20-25% over the next two years.

Despite that, the risk/reward skews heavily in Veeva’s favour. The downside is a company that still grows at 12-14% with best-in-class margins and a fortress balance sheet. The upside is a re-rating toward historical multiples as the migration proves out and AI embedding deepens the moat. I’m not going to call this a once-in-a-cycle opportunity because I think intellectual honesty requires acknowledging that the Salesforce risk is material, but it is the single name I find most compelling in the Fortress Zone.

Conviction: High. Timeline: 12-24 months for the migration narrative to inflect positively.

Idea #2: Adobe (ADBE), The Contrarian Heavyweight

Adobe trades at 16.1x trailing earnings. The 10-year average P/E is 45.8x. The forward P/E is approximately 14x. For context, that’s cheaper than Procter & Gamble, Coca-Cola, and most consumer staples companies that grow at half Adobe’s rate. The market is pricing a $265 stock as if it’s a value trap. It’s not.

Here’s what the market is getting wrong. The bear case treats Adobe as a pure creative tools play that gets disrupted by generative AI image generators. That framing ignores two-thirds of the business. Document Cloud (Acrobat, PDF services) and Experience Cloud (enterprise digital marketing, analytics, commerce) are growing at or above the group rate and have zero overlap with text-to-image AI generation. The PDF is not getting disrupted by Midjourney.

The numbers that matter: 96% recurring revenue, 130% net dollar retention, 89% gross margins, and roughly $10 billion in annual free cash flow. Adobe generated more free cash flow last year than Snowflake, CrowdStrike, and Veeva combined. The company has repurchased over $25 billion in stock over the past five years. It’s a cash generation machine trading at a decade-low multiple.

I keep coming back to the cloud transition analogy. In 2012-2013, Wall Street declared Adobe dead because Creative Suite was going subscription-only and piracy would kill them. The stock went from $32 to what was eventually a $700 peak. The bears were focused on the transition risk and completely missed the TAM expansion. We may be watching the same movie. The market is fixated on the Photoshop disruption narrative while the broader Adobe platform, which spans content creation, document management, and enterprise marketing, becomes the operating system for enterprise content workflows in an AI world.

The risk: Creative Cloud is genuinely exposed to erosion at the low end. Canva, Figma (which Adobe failed to acquire), and AI image generators will eat the casual creator market. If Adobe can’t retain the prosumer tier, revenue growth stalls and the multiple stays compressed. There’s also the question of whether Firefly is a genuine differentiator or just a defensive product. I think the former, but I hold that view with moderate confidence.

Conviction: Medium-High. Timeline: this is the longest-duration idea in the portfolio. The valuation floor limits downside, but the narrative may take 12-18 months to shift. The re-rating catalyst is likely a quarter where Document Cloud and Experience Cloud growth re-accelerates visibly enough to break the “Adobe = Photoshop” framing.

Idea #3: CrowdStrike (CRWD), The Non-Discretionary Compounder

Cybersecurity is the one software category where AI unambiguously increases demand. More AI agents means more attack surface. More automated workflows means more endpoints to secure. More data flowing through enterprise systems means more vectors for breach. Every argument the bears make about AI disrupting SaaS is an argument for spending more on security.

CrowdStrike just posted record Q3 Net New ARR of $265 million, up 73% year-over-year. Ending ARR is $4.92 billion, growing at 23%. Subscription gross margins are 81%. The Falcon platform is consolidating security spending across endpoint, cloud, identity, and SIEM, which is exactly the platform-level integration that protects companies from the “feature moat” erosion I described in Section 1.

At roughly $389, the stock is down 30% from its November 2025 high of $557 and 14% year-to-date. That’s the SaaS contagion effect. CrowdStrike is being sold alongside Freshworks and Five9 as if they face the same fundamental threat. They don’t. Morgan Stanley’s CIO survey shows enterprise cybersecurity budgets growing 50% faster than overall software spending. This is the one line item a CFO cannot cut.

One objection worth addressing head-on: I’ve argued throughout this piece that “feature moats” are vulnerable while “platform moats” are defensible. A fair critic would point out that CrowdStrike’s own rise was built on displacing legacy antivirus vendors whose endpoint protection was, at the time, considered a platform. The distinction between feature and platform is not static; it depends on the pace of consolidation and the competitive response. The reason I place CrowdStrike in the Fortress category rather than the Adaptation category is the breadth of its current platform (endpoint, cloud, identity, SIEM, and now AI security) combined with the non-discretionary nature of the spending. Displacing CrowdStrike today would require replicating not just one capability but an integrated security fabric across multiple domains. That’s a fundamentally different competitive dynamic than displacing a single-point antivirus product. But I hold this view with less certainty than the Veeva thesis, because Microsoft’s bundling strategy with Defender and Copilot Security is exactly the kind of platform consolidation play that could compress CrowdStrike’s standalone value over a 3-5 year horizon.

The risk: Valuation. At 30x sales and a negative GAAP P/E, CrowdStrike requires continued hypergrowth to justify the premium. Microsoft Defender is bundled free with enterprise licences and represents genuine competitive pressure. And the July 2024 outage, while operationally resolved, demonstrated single-point-of-failure risk that enterprise procurement teams haven’t forgotten. If Net New ARR growth decelerates below 20% in FY27, the multiple compresses significantly.

Conviction: Medium-High. Timeline: 6-12 months. The near-term catalyst is FY27 guidance (expected March 2026). If management guides Net New ARR growth above 30%, the stock re-rates quickly. This is the most execution-dependent idea in the portfolio.

Idea #4: ServiceNow (NOW), The AI Orchestrator

ServiceNow is the name I’ve spent the most time debating internally because the stock decline has been savage: down 46% over the past year. After its 5:1 stock split in December 2025, shares trade around $138. For a business doing $13.3 billion in trailing revenue growing at 22%, with 78% gross margins, a 97% renewal rate, and $4.58 billion in free cash flow, that is a remarkable de-rating.

The bull case is that ServiceNow isn’t a SaaS company that gets disrupted by AI agents, it’s the platform AI agents operate through. When an enterprise deploys agentic workflows, those agents need to interact with IT systems, HR processes, customer service queues, and security protocols. ServiceNow is the orchestration layer that routes, governs, and audits those interactions. Bill McDermott’s “semantic layer for AI” positioning sounds like marketing, but the underlying logic is sound: AI agents need a system of record to operate within, and ServiceNow processes 4 billion workflow transactions daily across the world’s largest enterprises.

The $7.75 billion Armis acquisition, expected to close in H2 2026, adds cybersecurity to the platform, which further entrenches ServiceNow as the enterprise control plane.

At a forward P/E of 26x and a free cash flow yield of roughly 4%, ServiceNow is trading at its cheapest valuation in five years. Dan Ives at Wedbush called the software selloff a “table pounder moment to buy.” He may be early, but I don’t think he’s wrong on names like this.

The risk: ServiceNow’s growth is decelerating (from 24% to 21% to guided high-teens). In a seat compression world, the question is whether ServiceNow can transition to consumption-based pricing without destroying near-term economics. The Armis acquisition at $7.75 billion is a large bet that could prove dilutive if integration stumbles. And at $138 per share, the stock is still pricing in substantial growth, just not as much as before.

This is the name where I’m genuinely torn. The thesis is sound: ServiceNow is the orchestration layer, not the disrupted application. But the growth deceleration (from 24% to 21% to guided high-teens) combined with the $7.75 billion Armis bet means execution has to be near-flawless to justify even the compressed multiple. I’d call this a “right company, uncertain timing” situation. The entry point is attractive if you have a 2-3 year horizon and patience for potential near-term multiple compression as the pricing model transitions.

Conviction: Medium. Timeline: 18-36 months. This requires patience through a pricing model transition. The catalyst is the first quarter where consumption-based revenue demonstrably offsets seat compression, which I don’t expect until H2 2026 at the earliest.

Idea #5: Guidewire Software (GWRE), The Insurance Fortress

Guidewire is the dominant platform for property and casualty insurance core systems globally, and arguably a purer Fortress Zone expression than ServiceNow with a fraction of the sell-side coverage. Its InsuranceSuite runs the operational backbone of insurers: policy administration, claims adjudication, and billing. This is the deterministic system of record that every AI agent in insurance must operate through.

The stock has been halved from its September 2025 highs of $272 to approximately $128-139. At ~9x forward revenue, you are paying mid-single-digit multiples for a company with 22% ARR growth, accelerating cloud migration, record-low attrition, and a regulatory moat that will take any competitor a decade to replicate.

The numbers: ARR of $1.06 billion (Q1 FY2026), up 22% year-over-year, with full-year guidance raised to $1.23 billion. Revenue guided at $1.4-1.42 billion (14-15% growth). Subscription gross margins of 71-72%, improving 4 percentage points year-over-year and targeting 80% long-term. Operating cash flow guided at $350-370 million. Cash position of $1.48 billion. Gross revenue retention at record highs. Cloud ARR growing 36% year-over-year, now 74% of total ARR.

The cloud transition is the key catalyst. Guidewire is mid-cycle converting on-premise insurers to its cloud platform. As each insurer migrates, Guidewire locks in longer contracts (Liberty Mutual signed a ten-year commitment), higher ARR per customer, and improving margins. The transition is still only ~74% complete, providing a significant remaining tailwind. The new CEO, Ajei Gopal (who tripled Ansys revenue and led it to a $35B acquisition by Synopsys), is an execution-focused operator suited to this stage.

Guidewire is also embedding AI through acquisitions (ProNavigator, Quanti) and new products (PricingCenter, UnderwritingCenter), all built on top of its own platform data rather than as standalone products. Think about it: AI deepens the moat rather than threatening it.

The risk: Execution on large-scale cloud migrations. Guidewire’s implementation projects are complex and multi-year. A botched migration at a tier-1 insurer would damage the referenceability that drives new deals. The company is also still expanding margins from a lower base than peers (71% subscription gross margin vs 80%+ for mature SaaS), so the margin expansion narrative needs to continue delivering.

Conviction: Medium-High. Timeline: 12-24 months. The catalyst is continued cloud migration progress and margin expansion toward the 80% target. Each quarter that ARR growth holds above 20% with improving margins narrows the valuation gap to peers.

Idea #6: Procore Technologies (PCOR), The Construction Monopoly at Distressed Prices

Procore is the dominant cloud-based construction management platform globally, covering the entire lifecycle from preconstruction through financial management. Construction is the most under-digitised major industry on earth, and the AI disruption narrative falls apart entirely here: you cannot vibe-code a system that tracks legally mandated audit trails for $500 million building projects.

At ~$52 (down 42% from its $89 52-week high), Procore trades at roughly 6x forward revenue. The market is pricing it as if construction management software is about to be disrupted by AI agents. In reality, construction is the one industry where AI adoption will be slowest and where the system of record is most critical.

The numbers: $339 million Q3 2025 revenue, up 15% year-over-year. FY2025 guided at $1.312-1.314 billion. Non-GAAP gross margin of 84%. Non-GAAP operating margin of 17%, expanding 400 bps year-over-year. Gross revenue retention of 95%. Free cash flow of $68 million in Q3, up 194% year-over-year. $300 million share repurchase programme authorised November 2025. FedRAMP “Moderate Equivalency” achieved in Q3 2025, opening US federal construction projects.

Procore is deploying AI through Procore Assist and Procore Agent Builder, both built on its proprietary construction data. An AI model cannot adjudicate a construction change order without access to the project documentation, budget history, and contractual terms that live inside Procore. The sector itself is a tailwind: the Infrastructure Investment and Jobs Act, CHIPS Act, and Inflation Reduction Act channel hundreds of billions into physical construction over the next decade. Barclays upgraded Procore to Overweight in January 2026 on this basis.

The risk: Revenue growth has decelerated from 21% to 15%, and the company is undergoing a CEO transition (Courtemanche to Gopal) with GTM restructuring that management has called a “transition year.” If the transition slows growth further (below 12-13%), the multiple compresses. Procore is not yet consistently GAAP profitable (GAAP operating margin was -4% in Q3 2025), though it is rapidly approaching the inflection point.

Conviction: Medium. Timeline: 6-12 months, with a hard catalyst on February 12, 2026 (Q4 2025 earnings). If results show growth stabilisation or re-acceleration, conviction moves to Medium-High. This is a name to size modestly and add on evidence.

What to Avoid: The Dead Zone Shorts

For completeness, and because I believe in symmetry: the Dead Zone names are not “oversold opportunities.” They’re structurally impaired businesses where the selloff hasn’t gone far enough.

Five9 at $18 (down from $209) is pricing in obsolescence, and I think the market is directionally correct. Freshworks at 105% NRR with commoditised customer service workflows faces a world where Claude Cowork plugins do 80% of what their platform does at near-zero marginal cost. Bill.com, down 43% in 2025, processes SMB financial workflows that are precisely the use case that AI agents handle most naturally.

I wouldn’t actively short these (the borrow costs are ugly and the timing is unpredictable), but I’d underweight the entire Quadrant 1 cohort. The risk/reward on the long side of Dead Zone names is atrocious. You’re catching knives with no gloves.

Section 7: Risk Factors and What Breaks the Thesis

I’ve built a deliberately contrarian case. Now let me tell you exactly what would make me wrong. Any analyst who doesn’t do this is either overconfident or intellectually dishonest, and I’m trying to be neither.

7A: Risks to the Bull Case (What Kills the Fortress)

AI capability step-change. My entire framework rests on the assumption that the demo-to-deployment gap remains wide. If models achieve genuine, reliable reasoning and agency (not the probabilistic pattern matching I described in Section 2), that gap closes faster than expected. Specifically, if LLM accuracy in regulated domains crosses the reliability threshold that enterprises require for production deployment (somewhere in the 99.5-99.9% range depending on the domain), the compliance moat weakens significantly. I think this is unlikely within 18 months but increasingly plausible over a 3-year horizon.

The rate of improvement from GPT-4 to Claude 4.6 in structured reasoning tasks has been faster than most analysts expected, and the gap between “impressive demo” and “production-grade reliability” is narrowing. The honest answer is that nobody, including the labs themselves, knows the trajectory with precision. What I can say is that the improvement curve has been steeper than linear, and anyone building a multi-year investment thesis around the assumption that AI stays unreliable is making a bet against a trend that has consistently surprised to the upside.

Open-source acceleration. DeepSeek has already demonstrated that frontier-quality models can be built for a fraction of the cost. If Llama 4 or the next DeepSeek iteration delivers enterprise-grade deterministic reliability alongside probabilistic capability, AI-native applications become drastically cheaper and faster to build. The cost of replicating workflow complexity drops, which directly erodes Quadrant 3 and 4 moats. Every 10x improvement in open-source model efficiency compresses the time advantage that incumbents hold.

Enterprise adoption faster than expected. The Bain data shows only 5% of enterprise AI projects are in full production. My timeline assumes this moves slowly (to maybe 15-20% by end of 2027). If it jumps to 30%+ in 2026 because of breakthrough tooling, the “institutional inertia” defence weakens materially. CIOs who were cautious in January could be aggressive by December if the tools prove themselves.

Pricing model transition failure. Fortress Zone companies need to transition from per-seat to consumption or outcome-based pricing. If that transition destroys near-term revenue recognition (as it did for many companies during the cloud transition in 2012-2015), the stocks can underperform even as the businesses remain fundamentally healthy. This is the biggest execution risk for ServiceNow and the large-cap names.

Talent drain. The best engineers at Adobe, ServiceNow, and Veeva are being recruited aggressively by AI-native startups offering equity packages worth 3-5x their current comp. If the top 10% of engineering talent leaves incumbents, execution quality degrades precisely when it matters most. I’m watching Glassdoor ratings and LinkedIn flow data on key engineering teams as leading indicators.

7B: Risks to the Bear Case (What Saves SaaS)

Regulatory backlash. The EU AI Act is already creating compliance overhead for AI deployment. If the first major AI hallucination causes a genuine compliance failure in healthcare, financial services, or government, enterprise risk committees will slam the brakes on AI-first strategies. Every CTO who pushed for aggressive AI adoption becomes the scapegoat. Risk aversion swings the pendulum back toward trusted incumbents.

Model commoditisation benefits incumbents. This is the argument I’ve been making throughout the piece, but it’s worth stating explicitly as a risk to bears: cheaper AI directly lowers the cost for SaaS companies to embed AI into their own products. If it costs $0.14 per million tokens to run inference, Veeva can add AI features at negligible marginal cost while maintaining premium pricing. The SaaS incumbents have the distribution, the data, and the customer relationships. Cheap AI is a gift to them, not a threat.

Enterprise procurement inertia. Large organisations move slowly. Fortune 500 procurement cycles are 6-18 months for significant software decisions, with 3-5 year contract locks on existing systems. Even if an AI-native alternative is demonstrably superior, the switching cost (migration, retraining, compliance re-certification, integration) creates a 2-4 year buffer that buys incumbents time to adapt.

Integration complexity. This one is underappreciated. AI agents don’t operate in a vacuum. They need to read from and write to existing enterprise systems: ERP, CRM, HRIS, financial systems, compliance databases. That integration layer is precisely where SaaS incumbents have spent decades building connectors, APIs, and middleware. An AI agent that can draft a perfect response is useless if it can’t access the customer’s order history, escalation history, and contract terms. The “last mile” of enterprise integration is where incumbents live, and it’s deeply unsexy work that startups consistently underestimate.

The hallucination liability bomb. Somewhere in 2026 or 2027, an AI agent will make a material error in a regulated industry that causes real financial or physical harm. The resulting litigation and regulatory response will create a chilling effect on AI-first strategies and a flight to quality toward vendors with proven, auditable, deterministic systems. That flight to quality benefits Fortress Zone names disproportionately.

Section 8: Conclusion and TSCS Positioning Framework

Let me synthesise everything into what I actually believe.

The February 2026 software selloff is a genuine inflection point, but the market is committing the cardinal sin of treating a structurally bifurcated sector as a monolith. When IGV drops 25% year-to-date and hedge funds make $24 billion shorting software in five weeks, nuance is the first casualty. The selloff is correct in direction for some companies and catastrophically wrong for others. That divergence is the entire opportunity.

Here’s the thesis in four sentences. The model layer faces commodity economics, brutal capital intensity, and winner-take-nothing market dynamics. The application layer, specifically the data-rich, workflow-embedded, compliance-moated segment, has deeper moats than the market appreciates. Cheap AI doesn’t destroy these businesses; it makes them cheaper to run and harder to replace. The most asymmetric opportunities in public equities right now sit in Fortress Zone companies that have been sold indiscriminately alongside genuinely threatened names.

What I’d do with capital today:

Accumulate aggressively: Veeva Systems. The cleanest Fortress Zone expression with the widest margin of safety. Regulated vertical monopoly, expanding margins, and a stock that’s been halved while the business accelerates. This is the kind of setup that generates 100%+ returns over 2-3 years if you have the patience.

Accumulate on weakness: Adobe. The valuation disconnect is extreme, but the creative tools narrative overhang could persist. I’d build a position in thirds, buying more on any further weakness below $250. At 14x forward earnings for a company generating $10 billion in FCF, you’re being paid to wait.

Hold, add on dips: CrowdStrike. Exceptional business, but the valuation requires continued execution. The non-discretionary nature of cybersecurity spending provides a floor, and the AI-driven expansion of attack surface is a secular tailwind. I’m more comfortable accumulating below $370.

Watch closely: ServiceNow. The “AI orchestration layer” thesis is compelling and the valuation has compressed meaningfully, but growth deceleration and the Armis integration create near-term uncertainty. I want to see Q4 2025 results before committing capital.

Avoid entirely: Dead Zone names. Customer service pure-plays, SMB horizontal SaaS with thin moats, and anything whose core value proposition overlaps with Claude Cowork’s plugin set. The selloff in these names is not an opportunity. It’s a repricing to a structurally lower terminal value.

Consider shorting (with caution): PE-exposed vehicles with concentrated software portfolios, as discussed in Section 1. The private credit angle is real and under-appreciated by the market. BDC portfolios with 12%+ software exposure face a double hit: lower recovery values and higher default rates on leveraged software buyouts from the 2021 vintage.

A final note on timing. I don’t know if the bottom is in. I rarely do. What I do know is that Veeva at $182, Adobe at $265, and ServiceNow at $138 represent valuations that the fundamentals don’t justify under any scenario short of catastrophic AI disruption happening within 12 months. And as I’ve argued throughout this piece, that scenario is far less likely than the market currently prices.

The SaaSacre is real for some companies. For others, it’s the buying opportunity of the cycle. The framework tells you which is which. The rest is conviction and patience.

As I’ve been saying for a while: the wheat will be separated from the chaff. The question is whether you’re positioned on the right side of that divide when it happens.

“The nine most terrifying words in the English language are: I’m from the government, and I’m here to help.”

— Ronald Reagan, 1986

Reagan was joking. The current administration is not.

There is a man at Rabobank named Michael Every who, if you are not reading, you are flying blind. I do not say this lightly. I have spent the better part of these 8 months telling you that consensus macro narratives are, at best, intellectually lazy and, at worst, actively dangerous to your portfolio. Every is one of the few strategists working today who is willing to follow the logic of what is actually happening to its uncomfortable conclusion, rather than retreating to the safety of “tariffs bad, free trade good, next question.”

His framework is called “Reverse Perestroika,” and I believe it is the single most useful mental model for understanding what the Trump administration is actually trying to do, why it might work, why it might fail catastrophically, and (most importantly for us) where the asymmetric investment opportunities sit.

The thesis is deceptively simple. In 1985, Gorbachev inherited an empire that was militarily powerful but economically broken. He traded guns for butter. It destroyed the Soviet Union. The United States in 2025 faces the mirror image: economically dominant but industrially hollowed out, strategically dependent on supply chains it does not control, and unable to produce enough ammunition to sustain a major conflict for more than a week. The administration’s answer, whether by design or by instinct, is to trade butter for guns. Tighten economic controls. Reshore industrial capacity. Rebuild the defence base. Accept short-term pain for long-term resilience.

Whether you think this is visionary or delusional (I genuinely cannot decide, and I suspect that ambiguity is the correct analytical posture), the data increasingly suggest it is what is actually happening.

We went deep on this. Federal Reserve H.8 credit data. DoD industrial base assessments. CSIS war game simulations. BEA foreign direct investment flows. World Gold Council central bank purchasing records. The National Security Strategy itself, all 29 pages of it, which most of Washington treated as boilerplate. It is not.

The picture that emerges is one of the most ambitious (and dangerous) economic restructurings attempted by a major power in the post-war era, with specific, investable implications across two themes we are most confident in.

Here is what we are covering:

• The 80/20 Problem. 80% of American bank credit inflates assets. 20% builds things. We pull the Fed’s H.8 data and show you exactly how the financial system is configured against reindustrialisation, and why fixing it means someone loses.

• The Ammunition Crisis. The U.S. can sustain Ukraine-intensity combat for approximately three days. Precision-guided munitions run out in under a week. The bottlenecks are almost comically specific, and they sit in the portfolios of companies the sell-side does not cover.

• The National Security Strategy. The White House published a 29-page document advocating “regime change” inside allied European nations. We read it so you do not have to.

• The Fed: Regime Change, Literally. Warsh’s nomination, Tillis’s block, and why the proposed monetary policy mix is precisely what you would design if your goal were redirecting credit from financial assets toward industrial production.

• Panama and the Chokepoints. CK Hutchison’s canal ports ruled unconstitutional. The timing is suggestive. The investment implications are concrete.

• Central Bank Gold Buying. 3,220 tonnes in three years. 57% of 2025 purchases deliberately undisclosed. The institutions that manage the world’s monetary reserves are hedging against the very restructuring this report describes.

• FDI: The Money Is Already Moving. Manufacturing’s share of new foreign direct investment jumped from 28.8% to 44.9% in a single year. Foreign capital is not stupid.

• The Tariff Wall. Highest since 1946. The legal status unresolved. The market is not pricing persistence.

• Investment Implications. Gold miners priced for $2,500 gold in a $4,850 world. Defence supply chain companies valued for peacetime procurement in a wartime mobilisation cycle. This is where the asymmetric returns sit.

Subscribe now

Why You Need to Be Reading TSCS

At TSCS, we have made it our mission to uncover opportunities before the crowd, and to do the work the sell-side cannot or will not do. Our community is built for investors who want institutional-grade analysis without the institutional groupthink.

This is not just research. It is a framework for understanding where markets are actually headed, not where consensus says they should be.

In recent months, we have published:

And ruthless, company-specific analyses:

If you want to understand not only what is happening in global markets, but how to position for the structural shifts that most investors will not see until it is too late, you need to be here.

Let’s get into it.

Read more

The consensus explanation: Kevin Warsh is a hawk. Hawks mean tight money. Tight money means dollar up, gold down. Trade over.

Here’s the problem: the trade was going to blow up anyway. Warsh was the headline. Margin math was the killer.

Silver had gained 320% in thirteen months. CME had shifted to percentage-based margins on January 13th. At $120 silver, that’s $60,000 per contract. The most leveraged macro trade of 2025 was a powder keg waiting for a match.

But if you think the crash was about Warsh’s policy views, you’ve misread both the man and the setup. And if you’ve misread both, you’ve mispriced what comes next.

What we cover

The mechanical reality of the crash, and why physical markets (lease rates at 8%, Shanghai premiums at 50%, COMEX inventories at multi-year lows) are screaming something different than futures prices.

Warsh’s actual framework, drawn from his own writings. The man markets just labeled a “hawk” has spent a decade arguing that QE is too tight for Main Street and too loose for Wall Street. His prescription: balance sheet reduction paired with rate cuts. Not higher rates. Lower rates.

The fiscal dominance collision. Interest expense now consumes 19% of federal tax receipts. True interest expense (gross interest plus annual entitlements as a share of tax receipts) has crossed 100%. Warsh can attempt QT. The arithmetic suggests that attempt fails within 18 months.

Scenario pathways with explicit probabilities. Five outcomes, summing to 100%, with detailed reasoning for each.

The bear cases. Where this thesis breaks. We steelman the opposition because conviction without rigor is just gambling.

Positioning framework. Entry points, stops, targets. Conservative to aggressive.

Why You Need to Be Reading TSCS

At TSCS, we’ve made it our mission to uncover hidden opportunities before the crowd. Our community is built for investors who want an edge: institutional-grade analysis, creative frameworks, and a proven record of outperformance.

This isn’t just research. It’s a blueprint for compounding wealth with conviction.

In recent months, we’ve published sector deep-dives such as:

We also provide ruthless stock-specific analyses, highlighting hidden moats and catalysts the market has barely begun to price:

If you want to understand not only where markets are headed, but also how to capture hidden compounding opportunities, you need to be here.

Subscribe now

The quick summary

The debasement thesis was never about Fed independence. It was about fiscal dominance. When debt service plus entitlements exceeds tax receipts, the Fed chair’s opinions become academic.

I assign 70% probability to outcomes where metals outperform over 24 months. That’s not certainty. That’s an edge worth sizing for.

The last time physical silver markets showed this level of stress, silver tripled within 18 months. The full scenario analysis and positioning framework is below.

What Actually Happened on Friday

Read more

“Stability is destabilizing.” — Hyman Minsky

Let’s cut the polite corporate jargon and stare directly into the abyss. The financial markets are no longer a mechanism for price discovery, capital allocation, or any of the high-minded bullshit they teach in MBA programs.

The market has mutated into a mindless, flow-driven Ponzi scheme of capital where one investor’s blindly allocated 401(k) contribution is sewn to the mouth of an index fund, which is sewn to the mouth of a CEO incentivized by stock options, creating a closed loop of excrement that we are told is “wealth creation.”

We are witnessing the systematic lobotomy of capitalism. The “active” brain (the skepticism, the valuation analysis, the short-selling discipline) has been excised. In its place, we have installed the “Passive Factor,” a relentless, price-insensitive algorithm that buys because it must, not because it should. And this algorithm is running on a chassis built of “Inelastic Markets,” where liquidity is a hallucination and a single dollar of selling could detonate the whole rigged structure with a 5x multiplier.

Meanwhile, in the dark corners of Private Equity (PE), the “smart money” is choking on its own vomit. They are sitting on $3.2 trillion of “unsold assets” (politely called garbage companies bought at peak valuations that they can’t sell without admitting they are insolvent). They are marking these assets to “myth” while the real world, exemplified by the catastrophic Chapter 7 liquidation of Renovo Home Partners, is burning down around them.

This report is not a forecast. It is an autopsy of a patient that is still walking around, unaware it is already dead. We’ve decided to actually look at “Passive Factor” that warns is driving a 1,200 basis point distortion in returns in a recent podcast with , and yes as we have stated several times already, we are actually looking into it. We have spent days going through dozens of reports.

We will mathematically prove the market is rigged using Gabaix and Koijen’s “Inelastic Markets Hypothesis.”

And we will look through the trash of the Private Equity collapse to show you why the exit doors are painted on the wall.

Enjoy the read. It’s going to get ugly.

This is a free post. We believe this analysis is too critical to keep behind a paywall.

Subscribe now

At TSCS, we’ve made it our mission to uncover hidden opportunities before the crowd. In recent months, we’ve published thematics & sector deep-dives such as:

…and stock-specific analyses, like our work on Ivanhoe Minerals (TSX: IVN) and Contemporary Amperex Technology (CATL), where we highlighted hidden moats, overlooked assets, and catalysts the market has barely begun to price.'

Our community is built for investors who want an edge: institutional-grade analysis, creative frameworks, and a proven record of outperformance. This isn’t just research, it’s a blueprint for compounding wealth with conviction. If you want to understand not only where zircon sands are headed, but also how to capture the hidden compounding opportunities in global markets, subscribe to TSCS.

Subscribe now

How We Broke the Machine

The “Simp” Market: A 1,200 Basis Point Hallucination

You think you’re a genius because your Vanguard S&P 500 ETF is up?

You’re not a genius; you’re a passenger on a bus with a brick taped to the accelerator.

Mike Green of Simplify Asset Management has been screaming this from the rooftops, and more recently with Adam Taggart, and the industry treats him like a leper because he’s diagnosing a cancer they are all selling as the cure.

Green’s research identifies a “Passive Factor” that is effectively front-running the entire global economy. This isn’t about “efficient markets.” It’s about physics. When you blindly pour billions of dollars into market-cap-weighted indices every two weeks via payroll deductions, you aren’t analyzing value.

You are force-feeding a goose to make foie gras.

Let that number burn into your retina. 1,200 basis points. That is 12% of compounded bullshit over a decade. That represents return that has zero connection to earnings growth, innovation, margin expansion, or economic reality.

It is purely the result of a mechanical bid that never turns off. It is the financial equivalent of a participation trophy, except the trophy is inflated asset prices that will vaporize the moment the flows stop.

The Feedback Loop of Stupidity

The mechanics of this are what Green calls a “concentrating factor.”

Here is how the “Simp” feedback loop works:

It is a self-perpetuating flywheel of stupidity. This is why the market is so narrow. This is why the “Magnificent 7” stocks behave like they are immune to gravity.

They aren’t immune; they are just the largest buckets catching the rain of passive liquidity.

Green notes, “Many people are reporting this as an anomalous outperformance by the size factor. That’s not what my research suggests. My research suggests that these are really the stocks that are most positively affected by the passive bid”.

We have created a market where “success” is defined solely by how much passive flow you can attract. Fundamentals are irrelevant. If you are in the index, you live. If you are out, you starve.

The Death of the Active Immune System

In a healthy market, the one that exists in the wet dreams of University of Chicago economists, active managers act as the immune system.

If a stock gets too expensive, a rational manager sells it. If it gets too cheap, they buy it. That “sell” discipline keeps valuations tethered to reality.

But we murdered the immune system.

Active management is dying, bled dry by fee wars and the relentless, mindless outperformance of the passive machine. Green points out that standard factor models can’t even explain the alpha of legends like Buffett anymore, interpreting the evidence as saying that “discretionary, active management cannot be fully replaced by passive factor investing”.

No shit. But the money leaves them anyway because who wants to pay 2 and 20 for “price discovery” when you can pay 3 basis points for “price hallucinations”?

When you remove the active manager, you remove the “sell” discipline. Passive funds do not sell because a stock is overvalued. They only sell if you redeem.

Until then, they are insensitive to price. We have replaced the skepticism of the short-seller with the blind, drooling optimism of the Target Date Fund.

The result is a market that is “significantly less elastic than previously believed”. We are driving at 100mph without brakes, convinced that the road goes on forever because we haven’t hit a wall... yet.

The “ESG” Inflationary Nightmare vs. The Passive Dream

The passive narrative relies on a Goldilocks world: low inflation, stable geopolitics, and endless growth. But the real world is messy, violent, and inflationary. Green and others warn that “geopolitics are an added source of significant uncertainty” and that “markets find it hard to price geopolitical risk”.

Take the “Green Transition.” The ESG scam artists tell you it’s good for business.

The data tells you it’s an inflationary bomb. Academic work from the ECB and the Fed suggests that “the shift to renewables may keep energy prices, and inflation, modestly higher” until economies of scale kick in. We are replacing cheap, dense fossil fuels with expensive, intermittent renewables. That is a recipe for cost-push inflation.

Does the passive algorithm care? No. It just buys Nvidia. It assumes that the low-inflation regime of the last 30 years is a permanent law of physics, ignoring the “recency bias” that blinds us to the return of history.

We are sleepwalking into a regime change (inflation, war, supply chain collapses, see our recent copper post explaining the collapse of the supply chain) while the passive machine is priced for a utopia that doesn’t exist.

The Inelastic Markets Hypothesis (IMH) – Math

The Lie of Liquidity

If Mike Green is the prophet of the passive doom, Xavier Gabaix and Ralph Koijen are the actuaries of the apocalypse.

Their “Inelastic Markets Hypothesis” (IMH) is the most important piece of financial research in twenty years, and almost nobody on Wall Street understands it because it terrifies them.

The standard “Efficient Market Hypothesis” (EMH) assumes that the demand curve for stocks is flat (perfectly elastic). The theory goes: If Apple trades at $150, and you try to buy it for $150.01, millions of sellers should theoretically emerge to arb away that discrepancy. The market is viewed as a deep, limitless ocean of liquidity.

Gabaix and Koijen prove this is absolute bullshit.

Their research indicates that the market is “macro inelastic.” The demand curve isn’t flat; it’s steep. Vertical. “In a seminal paper, Xavier Gabaix and Ralph Koijen introduced ‘The Inelastic Markets Hypothesis,’ in which they proposed that the multiplier could be as high as 5”.

The Multiplier from Hell: M=5

Let’s break down the math of this nightmare. Multiplier = 5.

This means that if a buyer wants to purchase 10% of the stock market (in dollar terms), prices don’t go up by 0.5% or 1%. They go up by 50%.

Conversely, and this is the part that should make you wet the bed: If someone needs to sell $1 billion worth of stock, they don’t destroy $1 billion of market cap. They destroy $5 billion.

Why? Because “institutional funds are often constrained, i.e. have pretty firm positions (be it 100% equity or 70% equity)”. A pension fund mandated to hold 60% equities cannot sell just because prices are high. An index fund cannot sell, period. There are “not enough arbitrageurs to supply you with the $1 of stocks you wish”. The arbitrage capital, the smart money, is a thimble of water in a desert of mandated, mindless passive money.

Keep in mind this is an extreme.

Flows are the Only Thing That Matters

This implies that “roughly over one third of all stock market fluctuations are driven by capital flows” rather than news, earnings, or fundamentals.

The “dark matter” of asset pricing, the mysterious movements that fundamental analysts can’t explain, is just flows hitting an inelastic wall.

When you see the market rip 2% higher on a Tuesday for no reason, it’s not because the “market expects better earnings.” It’s because a massive pension fund rebalanced, or a foreign sovereign wealth fund dumped cash into the system, and the inelastic multiplier (M=5) magnified that flow into a hallucination of wealth.

When flows are positive, this M=5 multiplier creates a euphoric “wealth effect.” A small amount of buying creates a massive amount of paper wealth. It feels like magic. It feels like we are all geniuses.

But it works in reverse.

If flows turn negative, if the Boomers start selling their 401(k)s to pay for nursing homes, or if a recession forces liquidations, or if the Fed tightens too hard, the market will crash 5x harder than the fundamentals justify.

“Mystery” of Volatility Solved

This hypothesis explains why financial markets are so violent. Koijen notes, “what we’re suggesting is that a large fraction of the market is restricted by mandates, therefore not necessarily reacting to new information”.

The market is like a crowded theater with one exit door. As long as everyone sits still (passive holding), it looks stable. But if a few people try to leave (flows turn negative), the crush at the door causes a catastrophic spike in volatility.

Yale’s Tobias Moskowitz puts it bluntly: “I’m a complete believer in the inelastic markets hypothesis... when you get huge inflows like this, they have a multiplier effect on the market”.

The volatility isn’t a bug; it’s a feature of a market dominated by participants who cannot adjust their positions based on price. We have engineered a system that is designed to explode.

Volmageddon

We do not have to imagine what happens when mechanical flows break the market. We saw it on February 5, 2018. “Volmageddon.” The collapse of the XIV (Inverse VIX) ETF is the perfect microcosm of the “Passive Factor” and “Inelasticity” converging to nuke a strategy. It was a live demonstration of the “death spiral.”

The “Free Money” Trap

The XIV was an Exchange Traded Note designed to short volatility. It was the “free money” machine of the post-GFC era. As markets rose and volatility fell, XIV went up. It was the ultimate “carry trade” for the retail bro who thought he was a hedge fund manager.

But the product had a fatal flaw: it had to rebalance its exposure at the end of every day to maintain its inverse leverage. If the VIX went up, XIV had to buy VIX futures to reduce its short exposure.

This is the exact same logic as a passive fund rebalancing, just on a faster timescale. It is a mechanical, non-thinking instruction: “If X happens, do Y.”

Feedback Loop

On that fateful day, the VIX spiked. This meant XIV had to buy VIX futures. But everyone knew this. The market is predatory.

“Given the rise in the VIX earlier in the day, market participants could expect leveraged long volatility ETPs to rebalance... They also knew that inverse volatility ETPs would have to buy VIX futures to cover the losses”.

The sharks smelled blood. “There were signs that other market participants began bidding up VIX futures prices at around 15:30 in anticipation of the end-of-day rebalancing”.

It was a slaughter. The sharks bought futures, driving the price up. This forced the XIV algorithm to buy more futures to rebalance, which drove the price up further, which forced XIV to buy even more.

4:15 PM: The Kill Shot

In one minute at 16:08, “transaction data show a spike in trading volume to 115,862 VIX futures contracts... at highly inflated prices”.

This was the death blow. The feedback loop spun out of control. “The value of one of the inverse volatility ETPs, XIV, fell 84% and the product was subsequently terminated”.

The fund went to zero effectively overnight. Billions of dollars of “wealth” evaporated because of a mechanical flaw in the rebalancing logic.

The Lesson Ignored: SVIX and the Next Bomb

Did we learn anything? Of course not. We just reinvented the same bomb with a different name.

The SVIX (a newer short vol product) explicitly warns that “SVIX can lose all or most of its value, as XIV and SVXY did during the ‘volmageddon’ in 2018”. Yet, investors pile back in.

Why does this matter for the broader market? Because the entire passive market is just a slower-moving XIV.

The “Passive Factor” operates on the same mechanical logic: receive cash, buy stock. If the flows reverse, the passive funds become the forced sellers. And in an inelastic market with a 5x multiplier, the prices will collapse until a buyer of last resort steps in.

The XIV collapse was a trailer for the movie we are currently filming.

The Private Equity Cesspool

If the public markets are a bubble blown by passive flows, the private markets are a tomb sealed with fake valuations. Private Equity (PE) has become the dumping ground for assets that are too expensive to exist in the real world. The industry is currently choking on a “$3.2 trillion in unsold assets” problem.

The Valuation Fake-Out

Private Equity firms thrive on the “illiquidity premium,” which is a polite way of saying “we don’t mark our assets to market, so we don’t have to admit we lost money.”

Bain & Company’s report highlights the disaster: “With lack of exits, GPs are left with $3.2 trillion in unsold assets. Buyout backed exits in 2023 saw a 44% decline from 2022”.

The exit channels are in a “deep freeze”. Why? Because nobody wants to buy this crap at the prices the GPs have marked them at. “Price multiples... have tipped downward over the last year, but only slightly so far. That’s because sellers are bringing to market only the highest-quality assets”.

The rest of the portfolio, the zombie companies, the “dogs”, sits on the books, marked at fantasy valuations derived from the bubble years of 2021. They are pretending that a widget maker bought at 15x EBITDA when interest rates were 0% is still worth 15x EBITDA now that rates are 5%. It is a lie.

The 2006 Vintage Déjà Vu

Bain compares the current situation to the disastrous 2006 vintage. “Drawdowns from recent post pandemic fund vintages are tracking the 2006 vintage closely”.

For those too young to remember or too stupid to read history, 2006 was the year massive amounts of capital were deployed right before the Global Financial Crisis. Those funds spent a decade digging out of the hole.

Today, “buyout GPs have 28,000 unsold PortCos worth a record $3.2 trillion”. This capital is trapped. Limited Partners (LPs), pension funds and endowments are “struggling with negative cash flows” because the distributions have stopped.

LPs are cash flow negative. They are paying out management fees but getting zero distributions. This creates a liquidity crunch. They can’t commit to new funds because they haven’t gotten their money back from the old ones. The “fundraising machine” is grinding to a halt because the Ponzi mechanics of “new money pays for old exits” has broken.

The Myth of the Secondary Market

The industry is pinning its hopes on the “secondary market”, where LPs sell their stakes to other LPs. “The extension of passive management to private investing will be facilitated by the expansion of secondary markets... The catalyst will be liquidity”.

This is delusional. You cannot create liquidity in an asset class defined by its opacity. The secondary market is tiny compared to the $3.2 trillion overhang. And the discounts required to clear that market would blow a hole in the balance sheets of every pension fund in America.

“According to MSCI, 36% of companies acquired six years ago or more are now just at breakeven or below”. Yet, these assets are likely carried at 1.5x or 2x on the books. It’s accounting fraud legalized by the “private” label.

Renovo Home Partners – The Canary in the Coal Mine

To understand what happens when the PE music stops, look at Renovo Home Partners. This isn’t theoretical. This is a body bag.

Renovo was a classic Private Equity “roll-up”, a strategy where you buy a bunch of small, shitty companies, mash them together, slap a corporate logo on top, and pretend you’ve created “synergy” to sell it to a greater fool.

The Roll-Up That Rolled Over

Renovo was founded by Audax Group, a PE firm, in a “roll-up transaction... combining Dreamstyle Remodeling, Remodel USA and Allure Home Improvements in February 2022”. They aggressively acquired regional remodelers like Minnesota Rusco and Reborn Cabinets.

It was the standard playbook: borrow cheap money, buy revenue, and flip it.

But the inelasticity of the real world hit them. Rates went up. Housing turnover slowed. The leverage that fueled the growth became a noose.

In November 2025, Renovo filed for Chapter 7 bankruptcy, liquidation.

Not Chapter 11 reorganization. Chapter 7. Death.

The Balance Sheet of a Corpse

“The filing lists the company’s liabilities in the range of $100 million to $500 million, while assets are reported at $0–$100,000”.

Read that again.

Liabilities: Up to half a billion dollars.

Assets: Zero.

The equity was wiped out. The debt holders, including BlackRock TCP Capital Corp, took a massive hit. BlackRock’s CEO Philip Tseng tried to spin it: “We view this outcome as a result of issues specific to the issuer, rather than a reflection of broader sector weakness”.

“Idiosyncratic.” The favorite word of every bagholder.

This is a lie. Renovo is not an outlier; it is a preview. It is the canary in the coal mine for the thousands of PE-backed portfolio companies that are over-leveraged, struggling with higher interest rates, and unable to find a buyer.

“Renovo’s main borrowing entity, HomeRenew Buyer Inc., filed for Chapter 7 bankruptcy liquidation... with reported liabilities between $100 million and $500 million”.

The collapse was sudden. “Renovo Home Partners... has reportedly ceased operations and several of its subsidiary brands appear to have closed abruptly, leaving customers with unfinished jobs and employees without advance notice”.

This is the reality of the “unsold assets” problem. When the liquidity dries up, these companies don’t just “underperform”; they vanish. The equity goes to zero, the debt takes a haircut, and the employees get fired via a Zoom call (if they’re lucky).

The Perfect Storm

The terrifying insight is that these two worlds, the passive public market and the illiquid private market, are inextricably linked. They rely on the same lie: that liquidity is always available.

Also at the end we’ll be modelling (and technically theorising) how the collapse will take shape, if you’re into some statistical jargon you’ll enjoy it.

The Correlation Singularity

In a crisis, correlations go to one. Mike Green warns that “passive investing... has a concentrating factor built into it”.

When the “Passive Factor” reverses, it won’t just be the S&P 500 that falls. It will be everything. The “transfer of equity risk across asset classes is small” in normal times, but when the 5x multiplier acts to the downside, the destruction of wealth will force liquidations everywhere.

LPs, starved for cash from their private equity portfolios, will be forced to sell their liquid public holdings.

Think about the mechanics:

The 1,200 Basis Point Reversal

If the “Passive Factor” added 1,200 basis points of return on the way up, what happens on the way down?

It subtracts it. And likely more.

The market has been levitating on this 1,200 bps cushion. Remove it, and the S&P 500 isn’t trading at 4,500 or 5,000; it’s trading at 2,500.

The passive indices are essentially “short volatility” strategies. They bet that tomorrow will look like today. They are “long GDP,” “long peace,” and “long liquidity.” When volatility spikes, the mechanical rebalancing logic that destroyed XIV will play out across the entire ETF complex.

The “Green” Trap

And don’t forget the macro backdrop. The “Green Transition” is inflationary. If inflation stays high, the Fed cannot cut rates to save the market. The “Fed Put” is dead because inflation killed it.

So you have:

Inelastic Markets (M=5 downside).

Trapped PE Capital ($3.2T).

Inflationary structural headwinds (Green transition).

A “Passive Factor” bubble (1,200 bps distortion).

This is not a “correction” setup. This is a “regime change” setup.

Modelling The Imminent Collapse

Boring for some, inspirational for others. See stated limitations before criticising.

First lets get some things out of the way.

What Cannot Be Proven Mathematically

The following claims, while central to IMH applications, are empirical hypotheses rather than

mathematical theorems:

• That markets actually operate according to this aggregated elasticity model

• That the estimated M » 5 is stable across time, sectors, or market conditions

• That collapse scenarios will manifest as the model specifies

• That ‘passive’ investors are genuinely price-insensitive (rather than heterogeneous)

• That the fundamental value V is knowable or exogenous

STATED LIMITATIONS

The M » 5 Parameter Problem

Gabaix and Koijen’s M » 5 estimate derives from specific identification strategies applied to 2010s US equity markets. This estimate:

• May not generalize to other market caps (small caps likely have different M)

• May vary with market conditions (bull vs. bear regimes)

• Is sensitive to the measurement window and econometric specification

• Conflates multiple types of ‘active’ investors with different elasticities

The Heterogeneity of ‘Passive

The framework treats passive capital as monolithically price-insensitive. In reality, ‘passive’ encompasses:

• Pure index funds (truly passive, but rebalance at discrete intervals)

• ETFs (subject to creation/redemption arbitrage, providing some elasticity)

• Target-date funds (mechanically adjust allocations, potentially countercyclical)

• Pension funds with rebalancing mandates (often countercyclical)

• Corporate buybacks (price-sensitive, but often misclassified)

Many ‘passive’ strategies are actually stabilizing, not destabilizing. The model’s binary classification obscures this heterogeneity.

Missing Policy Response

This simulation does not model central bank intervention. The Fed’s actions in March 2020

fundamentally altered the collapse trajectory. Any realistic scenario analysis must acknowledge that policy response functions exist but are not modeled here. The simulated collapses represent trajectories absent intervention, not predictions of realized outcomes.

Fundamental Value (V) Assumption

The model assumes V is exogenous and knowable. In practice, V is contested, endogenous to market prices (reflexivity), and depends on discount rates that are themselves market-determined. The ‘price deviation from fundamentals’ in our simulation is therefore a modeling convenience, not an observable quantity.

Looking at the results (we’re just going to omit everything else and add it to a different document for paid subs later on so thank you for your patience).

Conclusion

We have engineered a financial suicide pact.

We have incentivized a market structure where:

Mike Green is right. “A potential future crisis could blindside anyone who ignores Mike’s work”.

We are sitting in a theater where the movie is “The Great Moderation,” the audience is asleep, the exits are welded shut, and the projectionist, the passive flow, is pouring gasoline on the floor.

When the spark comes, whether from geopolitics, inflation, or just a sheer exhaustion of buyers, the “Passive Factor” will turn into the “Panic Factor.”

And with a multiplier of 5, the drop won’t be a “dip to buy.” It will be a liquidation of the American Dream.

If you are holding a standard 60/40 portfolio filled with passive index funds and thinking you are “diversified,” you are the mark. You are the liquidity that the smart money will use to exit. You are betting that the “Inelastic Markets Hypothesis” is wrong, despite the mathematical proof. You are betting that Private Equity wizards can turn garbage into gold without an exit market.

Good luck with that. You’re going to need it.

If you enjoyed this post consider supporting our work by becoming a paid subscriber. Your support is what makes this publication.

Subscribe now

Disclaimer: The information provided on this Substack is for general informational and educational purposes only, and should not be construed as investment advice. Nothing produced here should be considered a recommendation to buy or sell any particular security.

Appendix

The Gabaix-Koijen Multiplier (M=5) in Practice

To understand the visceral danger of the current market structure, one must dissect the arithmetic of Gabaix and Koijen’s findings. In a traditional model (M=0), a $1 billion buy order in a $10 trillion market moves prices by effectively zero. The market absorbs the flow.

In the Inelastic Market (M=5):

The Illusion: $4 billion of “wealth” is created out of thin air for every $1 billion bought. This is not based on earnings. It is phantom wealth created by the steepness of the demand curve.

The Reversal: If $1 billion is sold, $5 billion of market cap vanishes.

The “Dark Matter”: This explains why “roughly over one third of all stock market fluctuations are driven by capital flows”. The market is a leveraged play on flows.

The XIV “Death Loop” Timeline (Feb 5, 2018)

The mechanics of the XIV collapse serve as the Rosetta Stone for the next crash.

1. 3:30 PM: VIX futures rise. XIV (Inverse VIX) drops in value.

2. 3:50 PM: Traders anticipate XIV must buy VIX futures at 4:15 PM to rebalance. They front-run the trade, buying futures, pushing the VIX higher.

3. 4:00 PM: Market closes. XIV NAV is calculated. It is massively under-hedged.

4. 4:05 PM - 4:15 PM: XIV algorithm blindly buys VIX futures at any price.

5. Result: VIX futures double. XIV value drops 84%. Fund liquidates.

Insight: Passive ETFs rebalance daily or monthly. If the market drops 10% in a day, leveraged ETFs and certain risk-parity funds face the exact same “Death Loop.”

The Private Equity “Logjam”

The $3.2 trillion unsold asset figure is not just a number; it is a systemic blockage.

The Aging Inventory: “26% of that is four years old or older”. In PE land, an asset older than 5 years is “stale.” An asset older than 7 years is “dead.”

The Distribution Crisis: LPs operate on a cash-in, cash-out model. If GPs don’t sell (distribute), LPs can’t commit to new funds. This is why fundraising is down.

The Renovo Reality: Renovo represents the “mark-to-myth” colliding with reality. You can mark a roll-up at 15x EBITDA on your books, but if the bank cuts your line of credit and you file Chapter 7, the mark is zero. The loss of $100M-$500M in liabilities with essentially zero assets is a total wipeout of capital that was likely marked as “stable” months prior.

In the early 1840s, a seismic shift occurred in the British psyche.

A new technology, the steam locomotive, promised to annihilate distance, reshape commerce, and connect every corner of the kingdom with ribbons of iron.

At the center of this national euphoria stood George Hudson, the “Railway King,” a draper from York who rose to become a titan of industry and a Member of Parliament. He was the personification of the era’s boundless optimism, a man who seemed to possess an infallible Midas touch for turning iron rails into gold.

The British Railway Mania was not merely a technological revolution; it was a profound and frenzied realignment of capital.

Investors, swept up in speculative fever, poured fortunes into railway companies, often with little more than a prospectus and a map of proposed lines. The value of these companies was not measured by their current profits (many had yet to lay a single mile of track) but by the ambition of their plans and the sheer scale of their capital expenditure.

The market rewarded the promise of future dominance, and in doing so, it sowed the seeds of its own destruction. This historical echo reverberates today, not in the clatter of iron wheels, but in the silent hum of silicon clusters in sprawling data centers.

The Modern Parallel

The current acceleration of Artificial Intelligence is defined by the same metrics that fueled the Railway Mania: velocity, scale, and an almost religious faith in the transformative power of infrastructure.

The market has identified a new proxy for strategic commitment, and it is massive Capital Expenditure (CAPEX). Just as investors in the 1840s clamored to fund the most ambitious railway projects, today’s market rewards technology firms for the sheer scale of their data center buildouts.

No company exemplifies this more than Microsoft. In its pursuit of AI dominance, the company has guided for a quarterly CAPEX that will exceed $30 billion in the first fiscal quarter of 2026, implying a staggering annualized pace of nearly $120 billion.

This spending is not seen as a burdensome cost but as a badge of honor, proof of an unshakeable commitment to leading the AI revolution. Yet, this reward system is based on a strategic desperation to avoid obsolescence, not on proven operational economics.

The prevailing logic, openly stated by industry leaders, is that the risk of being too slow to build is far greater than the risk of misspending hundreds of billions.

This subordination of commercial logic to a race for strategic dominance is precisely the dynamic that warps rational markets and inflates speculative bubbles.

Subscribe now

Applying the Principle of Inversion: Demand

Amidst this rush, a critical question is often lost in the noise of market excitement and continuous funding announcements.

Read more

Everyone is watching the charts for a coming gas glut. They should be watching the backroom deal between Moscow and Beijing.

In the golden age of Periclean Athens, amidst the flourishing of democracy and philosophy, lived a merchant named Demetrios. He was not a man of idle speculation; he was a master of logistics, a student of the science of economics.

For years, he watched the city’s lifeblood, the grain shipments from the fertile colonies of the Black Sea, fluctuate with the seasons. He saw inefficiency, risk, and opportunity.

Demetrios dedicated himself to a singular, grand calculation.

He charted the harvest cycles in the Cimmerian Bosporus, modeled the insatiable demand of Athens’ large populace, and quantified the variables of spoilage, piracy, and the fickle Mediterranean weather.

His conclusion, arrived at through meticulous logic, was revolutionary.

A massive, purpose-built fleet of advanced grain ships, larger and faster than any before, could streamline the entire process.

By achieving an unprecedented economy of scale, he could undercut all rivals, guarantee Athens a stable food supply, and in the process, amass a fortune that would rival the city’s own treasury. His models were perfect, his logic unassailable.

He staked his family’s wealth and convinced the city’s most astute financiers to back his venture. The shipyards of Piraeus buzzed with activity, constructing what came to be known as Demetrios’s Folly, or his Armada, depending on one’s optimism. The ships were marvels of engineering, designed according to the purest principles of economic rationality.

Yet, for all his brilliance, Demetrios’s calculations contained a fatal flaw.

They were built entirely on the assumption of a rational world governed by supply, demand, and profit.

He had accounted for every variable except the one that mattered most: The irrational, non-linear force of a great power’s desperation.

As his fleet prepared for its maiden voyage, the Peloponnesian War raged on. Sparta, cornered and on the verge of collapse, made a move that no rational economic actor would ever predict.

They made a pact with the devil.

In exchange for a vast infusion of Persian gold, the very gold of their sworn, ancestral enemy, the Spartans ceded control of the Greek cities of Ionia and key islands in the Aegean. It was a strategically vital act of survival that was, on its face, economically and culturally insane.

Overnight, the geopolitical map was redrawn.

The sea lanes that Demetrios’s models had marked as safe and profitable were now patrolled by a Persian-funded Spartan navy. New alliances shifted the currents of trade. The very foundation of his perfect calculation, the predictable order of the world, crumbled. His magnificent fleet, a testament to economic logic, became a collection of stranded assets, too specialized to be repurposed, too expensive to maintain.

Demetrios was ruined not by a flaw in his math, but by the gravitational force of a rival state’s will to survive, a force that bends all market logic to its own ends.

When Desperation Bends Market Logic

Demetrios’s story, though fictional, reveals an important lesson, one with no expiration date.

It is this: standard market models, built on assumptions of rational economic behavior and commercial profitability, are inherently fragile.

When a major state actor believes its survival is at stake, it will subordinate commercial logic to strategic necessity. It will make deals that are value-destructive on paper to secure a political or strategic victory, creating price distortions and systemic risks that conventional forecasting, with its elegant curves and logical progressions, cannot possibly capture.

This idea, that the most potent forces often lie in the negative space, in the avoidance of ruin rather than the pursuit of profit, echoes through disciplines. It is the core of Socratic wisdom.

The Oracle declared Socrates the wisest man in Athens not because of what he knew, but because he alone was acutely aware of what he didn’t know. He understood the profound danger of assuming his knowledge was complete.

Similarly, market strategists who focus only on their quantifiable economic models, ignoring the vast, unquantifiable realm of geopolitical desperation, are falling into the same trap as the overconfident Athenian poets and politicians. They believe they have the answer to everything, but their ignorance of the unknown is the very source of their greatest risk.

The investor Charlie Munger championed the same concept with his principle of “inversion.”

To solve a problem, one should first invert it. Instead of asking how to achieve success, one should ask how to guarantee failure, and then avoid those paths.

For a multi-billion dollar energy project, the question is not, “How will this project be profitable?” The inverted, and far more useful, question is, “What could cause this project to catastrophically fail?”

The answer is rarely a minor miscalculation in demand forecasts. It is far more likely to be a geopolitical event, like a desperate state making a “sweetheart” deal that fundamentally rewrites the rules of the market.

We see this principle in action today.

Read more

“Finance is a professional field where you can look very smart while being completely wrong.” – Nassim Nicholas Taleb

If you want to build a portfolio of unique, high-conviction ideas and gain an edge by understanding the powerful forces shaping global markets, subscribe to The Small Cap Strategist and join a community of discerning investors.

Subscribe now

We have already done over 14 company deep-dives using institutional quality research. Today we’re relooking at MicroStrategy, Inc.

Executive Summary

On July 12, this publication issued a clear and unequivocal warning: MicroStrategy, Inc. was not a pioneering Bitcoin development company or a healthy proxy for digital assets, but a highly levered, speculative vehicle engineered for perpetual dilution.

The core thesis was that its complex capital structure, a tangled web of high-yield debt and preferred stock, was designed to systematically transfer value from new investors to earlier stakeholders under the guise of “intelligent leverage.” This financial alchemy, masking a decaying and unprofitable core software business, was deemed mathematically unsustainable. The prediction was that over a long enough time horizon, the crushing weight of its senior obligations and the inevitable collapse of its speculative stock premium would destroy the common equity, driving its intrinsic value toward its true worth: zero.

Those warnings were not theoretical. They were a precise forecast of an inevitable financial implosion. The events that have unfolded in the months since have not been a surprise, but rather the predictable consequence of a deeply flawed model. The market is finally awakening to the reality that MicroStrategy; now rebranded to the generic and vacuous "Strategy Inc." in a transparent attempt to obscure its singular, failing bet, is a fatally flawed vehicle.

The catalyst for its demise, the collapse of its speculative premium, is now happening in real-time. The evidence of its unraveling is no longer a matter of projection, but of public record.

This report will serve as the definitive follow-up, a forensic accounting of a bubble in its final, chaotic stages of collapse. It will demonstrate with irrefutable market data and the company's own desperate actions how the original thesis is materializing with astonishing speed and precision. The analysis will deconstruct the house of cards, brick by brick: the implosion of the premium that powered the entire scheme, the unsustainable tower of liabilities that guarantees its insolvency, the damning pattern of insider selling that exposes management's true convictions, and the complicit board of directors whose high-profile pedigrees have served only to legitimize a reckless gamble. The conclusion remains unchanged, only now it is reinforced by the harsh light of market reality: the common stock of Strategy Inc. is a deeply out-of-the-money call option on Bitcoin, and it is destined to expire worthless. The reckoning is here.

Update: How Our $MSTR Thesis Played Out in Real-Time

The most potent validation of a contrarian thesis is not eloquent argument, but the cold, hard verdict of the market.

In the months since the July 12 warning, the market has begun to aggressively reprice Strategy Inc., not as a visionary Bitcoin proxy, but as the over-leveraged, high-risk entity it truly is. The key mechanisms that inflated its bubble; a massive speculative premium and a self-reinforcing hype cycle, are now reversing, creating a negative feedback loop that is accelerating its demise.

The Premium Implosion

The first and most critical piece of evidence is the stark decoupling of Strategy's stock (MSTR) from the price of Bitcoin.

While Bitcoin rallied modestly over the summer, MSTR plunged by over 25% since our report, falling from the high $400s into the mid-$300s. This divergence is a clear signal that investors are no longer willing to treat MSTR as a simple proxy for the digital asset; they are beginning to price in the company-specific risks that the original thesis highlighted.

The most telling metric, the very lifeblood of Michael Saylor's strategy, is the stock's premium to its underlying Bitcoin holdings, or its market-implied Net Asset Value (mNAV) multiple. This premium is the "magic" that allows the company to sell overvalued equity to buy assets. At its peak in late 2024, this multiple reached a staggering 3.4x, meaning investors were paying $3.40 for every $1.00 of Bitcoin on the company's balance sheet.

Since the July 12 post, that premium has cratered to approximately 1.6x. This is not a minor correction; it is a fundamental destruction of the company's business model. The speculative air is rapidly leaving the balloon, a process graphically illustrated in the timeline below.