CrowdStrike, February 2026

An AI lab launched a code-scanning security product. Security stocks with little exposure to code scanning sold off anyway. This page replays one of them, CrowdStrike, as the record would have stood at the close on 23 February — and then what happened.

This is a historical replay, reconstructed after the event from our pre-registered event study. It is not a live call and not part of a track record. We use it because no live strict call has been graded yet.

Move the information cutoff

Everything to the right of the cutoff hadn't happened yet. A record made at that moment can't contain it.

Information cutoff

20 Feb
The catalyst lands. Identity and network-security names fall with it: Okta −9.9% and Cloudflare −8.8% on the day, both adjusted for the market.¹Not known at this cutoff
23 Feb, close
CrowdStrike closes −8.8% against the market, a z-score of −3.7. The market-shock gate requires |z| ≥ 2. Pass.¹Not known at this cutoff
23 Feb, after close
Exposure check. CrowdStrike sells endpoint security; the launch was code scanning. Disruption overlap in its profile: 0.15. Pass — with the caveat that this profile was written after the event.²Not known at this cutoff
23 Feb, cutoff
The record is fixed and hashed. Decision: qualified for grading under the event-study rule. Source corroboration and narrative velocity were not reconstructed, so they show as missing.Not known at this cutoff
2 Mar
Five sessions later: +9.1% abnormal drift.¹Not known at this cutoff
23 Mar
Twenty sessions later: +20.9% abnormal drift. Reversion of 2.37 against a threshold of 0.5. The outcome is appended as a new entry.¹Not known at this cutoff

The record

Fixed at the cutoff, with its seal and hash. The outcome below it is a separate entry.

Two inputs are shown as missing because we did not reconstruct them for this replay. Under the strict-call contract that runs live today, a missing input fails closed: this record would have qualified for the event study, but it would not have been a strict call.

CrowdStrike (CRWD)

Thesis: Negative overreaction to an AI product launch with little revenue overlap. Expect partial reversion relative to SPY.
Information cutoff: 23 Feb 2026, 16:00 New York (21:00 UTC). Nothing published later can enter the record.
Method: Event-study rule, pre-registered: day 0 is the largest abnormal session within 5 days of the recorded date; graded only if |z| >= 2; thesis holds if 20-session reversion >= 0.5.
Execution authority: None. A research decision is not permission to trade.

Gates at the cutoff
Gate	Input	Requirement	Result
Market shock	abnormal -8.8%, z -3.7	\|z\| >= 2	Pass
Economic exposure	disruption overlap 0.15	low revenue overlap with the narrative	Pass
Profile written after the event. A prospective call needs a profile dated before the catalyst.
Source corroboration	—	>= 2 independent publishers	Missing
Not reconstructed for this replay.
Narrative velocity	—	velocity z >= 2	Missing
Not reconstructed for this replay.

Decision: qualified for grading

Qualifies under the event-study rule. Would not qualify as a strict call: two gate inputs were not reconstructed.

Recordfh-replay-crwd-2026-02-23SHA-2561149a5b87e710220ed9ae056283a76a950b2705fb4dd7bf084733866861e0df5

Outcome after 20 sessions, to 23 Mar 2026

Abnormal drift after the shock day: +9.1% at 5 sessions, +20.9% at 20 sessions. Reversion 2.37 against a threshold of 0.5, so the thesis held under the event-study rule. The outcome is a new entry that points to the decision record's hash; it does not edit it.

Points to1149a5b87e710220…SHA-25697dd63ac1dd7b891e458a930a0d59bdaa30adc803bc4b028fc364b5b70e2a60e

Recompute both hashes in your browser

What this case does not prove

One event is not a track record.CrowdStrike, Okta and Cloudflare moved on the same catalyst. Under our counting rules they are one catalyst family, not three results.
We chose the events after they happened.The nine events in the study were assembled by us. The rules for grading them were fixed before the results were computed, but the selection itself can carry bias.
Day 0 was chosen within a window.The study uses the largest abnormal session within five days of the recorded date. That is a stated rule, but it is a degree of freedom a live call does not have.
The exposure profile came later.CrowdStrike's overlap profile cites this very sell-off. A prospective call requires a profile dated before the catalyst.
The event study passed, with a flag.Eight of nine events qualified; one showed no real shock. The pass is preliminary and is reported as such.

All nine events and the pre-registered rules

What a live version adds

A live record is created when the gates are evaluated, not reconstructed afterwards.

Every input is present or fails closed. The overlap profile predates the catalyst. The record's hash enters that day's signed manifest before any outcome exists. And the 20-session result is graded by the frozen contract against SPY, with every price stored.

That is what the Signals pipeline does today. The scorecard shows how many such records exist and how many have resolved.

See the scorecard Verify this record

Sources

NarrativeEdge event study, validation report, July 2026. Abnormal returns are measured against the market; day 0 snapped to the largest abnormal session within five days of the recorded date. See Methodology.
NarrativeEdge revenue-overlap knowledge table, seed v0.2, July 2026. The CrowdStrike entry's notes cite the February sell-off.