MarketQuants "9 at 9" — Daily Market Report
Report for Tuesday, September 15, 2026
Built from market action on Monday, September 14, 2026
1. Executive Snapshot
Monday kept the “hull steady, leadership does the work” framework intact, but IT swapped out the *type* of engine that’s pulling. SPY was up a quarter-point to around 761, still a couple percent under the one-year high area near 778—so the index remains in that controlled digestion channel, not a breakout and not a breakdown.
The notable shift is inside the engine room: Friday’s enterprise hardware/throughput cluster (HPE, DELL, HPQ, NTAP, CDW, SWKS, QCOM) did not stay on the Top 9 board. Instead, leadership snapped toward cybersecurity and software/platform Tech—CRWD (CrowdStrike), PANW (Palo Alto Networks), FTNT (Fortinet), plus CRM (Salesforce), IT (Gartner), and GDDY (GoDaddy). Add COIN (Coinbase) as a high-beta Financial and BBY (Best Buy) as the lone discretionary retail tell, and you get a message that is still “risk willing,” just expressing IT through a different sleeve.
The common misread would be “hardware fell apart, so the thesis is broken.” This doesn’t read like rejection of the prior move; IT reads more like the market taking Friday’s range-expansion hardware thrust and rotating into a cleaner, higher-accountability “proof-of-work” theme—security/software franchises printing strong closes and, in CRWD’s case, a fresh yearly high. Same ship, different propeller.
2. Sector Composition & Breadth
Composition is still concentrated: 7 of the 9 are XLK again. But the *sub-sector* composition changed meaningfully—less physical enterprise stack, more security/software and IT services. That’s important because IT argues the tape is not simply chasing “things that go up”; IT’s choosing where IT wants sustained sponsorship.
Breadth is still being expressed *inside Tech*, but Monday’s version is a different kind of breadth than Friday. Friday was “hardware rebuild across the supply chain.” Monday is “software/security leadership cluster with a services overlay” (PANW/FTNT/CRWD plus CRM/IT/ACN). That’s not a defensive rotation—defensive would have shown up as Utilities/Staples/low-beta stability at the top. Instead, the board is dominated by 4–10% daily ranges and strong up-day closes, which is capital accepting volatility, not hiding from it.
The two non-XLK names matter as texture: COIN (Coinbase) is not ballast—IT's torque, and IT tends to show up when risk appetite is alive. BBY (Best Buy) is not a “consumer is collapsing” tell either; IT’s a discretionary participant sitting within striking distance of its one-year high, implying the consumer sleeve is participating selectively rather than being abandoned.
3. Top Leader Focus (#1)
CRWD (CrowdStrike Holdings) taking the #1 slot is a real regime tell because IT wasn’t a quiet grind—IT was an expansion day that *ended at the highs*. CRWD opened around 219, dipped as low as 216, then drove to about 239 and closed near 235—up roughly 7.5% on about a 10% range, and IT printed a new one-year high right on the close.
That “close-at-highs into new highs” behavior is not the same thing as froth. Froth is when you get new highs with sloppy reversals and failure to hold the premium. Monday was the opposite: CRWD absorbed early weakness and finished as if buyers were still competing for supply late in the day. Also, notice the moving-average dispersions: CRWD is now meaningfully extended—double digits above the 5-day and 20-day, and massively above the 200-day. That doesn’t make IT “bad”; IT defines the next test as *shelf-building* rather than further verticality.
In ship terms: CRWD is the engine running hot. What would change the read is not “CRWD pulls back a little.” What would change the read is if a new-high leader immediately loses the breakout level and starts closing in the lower half of its range—because that would signal thrust without traction. As long as CRWD holds near this breakout shelf rather than collapsing back through IT, the market is saying IT wants leadership that can carry weight.
4. Ranks 2–5 — Confirming Cluster
IT (Gartner) at #2 is a fascinating confirmation because IT’s not a momentum darling; IT’s an “enterprise decision-cycle” proxy. IT opened near 186, pushed to about 198, and closed around 197—up close to 6% with a mid-single-digit range. The big point: IT is still *dramatically* below its one-year high (the dataset shows that prior peak far above current price), so this is not a breakout celebration—this is repair sponsorship. The misread would be “that means IT’s broken.” In this context, being far below highs but ripping on a strong close reads like institutions are willing to re-engage in lagging enterprise software/services, not just chase what already worked.
PANW (Palo Alto Networks) at #3 is the clearest “cluster confirmation” alongside CRWD. PANW opened around 346, tagged near 379, and closed near 374—up about 8% on a 10%+ range, and IT’s now only a few percent below its one-year high around 396. That’s not an exhausted bounce; IT’s pressure toward the high-water mark. If PANW can hold this push without giving back the move, IT supports the idea that cybersecurity is becoming the new center of gravity inside XLK, not just a one-day headline reaction.
COIN (Coinbase) at #4 is the risk-appetite out-of-sector tell. IT opened around 181, never really broke, pushed toward 193, and closed near 191—up nearly 6% with a solid range day. IT’s still far below its one-year high, which again frames this as repair participation, not late-cycle mania. Importantly, COIN sitting here alongside cyber/software is not “flight to safety”—IT’s the market allowing high beta exposure while SPY remains controlled. That’s the ship carrying speed without taking on extra ballast.
GDDY (GoDaddy) at #5 adds a quieter but useful confirmation: not as explosive as CRWD/PANW, but steady upside. IT opened around 101, held above 100, and closed near 104.5—up around 3.5–4% on a tighter range. Like several others today, IT’s well below its one-year high per the dataset, which keeps this in “rebuild sponsorship” territory. The message isn’t that the whole internet/software complex is breaking out; IT’s that buyers are re-rating select platforms from depressed levels, and doing IT with higher closes.
5. Ranks 6–9 — Steady Strength
FTNT (Fortinet) at #6 is the third leg of the cyber stool, and the positioning matters: IT closed near 170, just a touch under its one-year high around 173. The session profile—open around 162, trade up near 171, close near the highs—looks like accumulation, not a blow-off. The misread would be “three cyber names means overcrowded.” IT can be overcrowded later, but *right now* three cyber leaders simultaneously pressing toward highs reads more like the market is standardizing around a theme IT trusts.
ACN (Accenture) at #7 broadens the message from pure security to “enterprise spending plumbing.” ACN opened around 191, held the lows near 188, and closed near 195—up a couple percent on a sub-4% range. ACN is still below its 200-day (slightly negative versus the 200-day in the data), which makes this move more “attempted reclaim” than “clean trend.” That’s exactly why IT’s informative: IT suggests buyers are probing the services layer, but IT’s not yet the kind of locked-in trend you’d call a finished rotation. If ACN can start stacking closes above the longer-term shelf, IT would reinforce that Monday wasn’t just a cyber spike—IT was a broader enterprise software/services bid.
CRM (Salesforce) at #8 is the mega-platform stabilizer within XLK today (replacing META’s stabilizer role from Friday). CRM was up modestly—open around 256, close near 259—with a contained range. But note the bigger structure: CRM is significantly above its 50-day and 200-day in the data, so even a “small” up day is still participation inside a strong intermediate trend. This isn’t the market hiding; IT’s the market keeping a big, liquid software name in gear while the higher-beta cyber names do the accelerating.
BBY (Best Buy) at #9 is the consumer/discretionary tell, and IT behaved like a healthy add-on rather than a defensive substitution. IT opened around 90.7, never meaningfully broke, pushed to the mid-94s, and closed near 94.8—up about 4.5% and now within roughly 8% of its one-year high. That proximity matters: IT suggests discretionary isn’t being written off. The misread would be “retail in the Top 9 means the market is going full risk-on.” One name doesn’t equal a regime shift—but IT does say the tape is allowing consumer exposure alongside Tech concentration, which is consistent with a stable-hull environment.
6. Who Stayed vs. Who Rotated Out
Stayed on the board: None of Friday’s Top 9 names (SWKS, HPE, DELL, HPQ, QCOM, CDW, NTAP, META, MRNA) remained in Monday’s Top 9.
Rotated out: SWKS (Skyworks Solutions), HPE (Hewlett Packard Enterprise), DELL (Dell Technologies), HPQ (HP Inc), QCOM (Qualcomm), CDW (CDW Corp), NTAP (NetApp), META (Meta Platforms), MRNA (Moderna).
Rotated in: CRWD (CrowdStrike), IT (Gartner), PANW (Palo Alto Networks), COIN (Coinbase), GDDY (GoDaddy), FTNT (Fortinet), ACN (Accenture), CRM (Salesforce), BBY (Best Buy).
Interpretation: this is a full-board rotation, but IT’s not a “risk-off evacuation.” If IT were, you’d expect defensives to take the baton. Instead, the baton went to cyber/software—with big ranges and strong closes—plus COIN as explicit high-beta participation. In the ship metaphor, Friday’s engine room was hardware throughput; Monday’s engine room is security/software. The hull (SPY) staying calm is what allows this kind of aggressive internal rotation without reading as instability.
7. What Changed vs. Prior Report
Strengthened: the constructive “digestion, not breakdown” thesis for the index. SPY added a small gain and remains close to highs without showing rejection. The market is still demonstrating IT can keep the hull level while rotating leadership engines underneath.
Refined: the leadership spine is no longer primarily “enterprise hardware rebuild” in the Top 9; IT’s “enterprise security/software accountability.” That’s not a downgrade. In many cycles, software/security leadership is the market choosing recurring-revenue visibility over cyclical throughput. The key is that this doesn’t look like abandoning thrust—IT looks like choosing a different thrust source.
Complicated: Friday’s key condition was “can the hardware winners hold shelves after range expansion?” Monday’s board can’t answer that directly because those names aren’t present. What Monday *does* introduce is a second condition: if CRWD (CrowdStrike) is going to carry the #1 flag at new highs, the tape needs follow-through without immediate breakout failure. A new-high leader failing quickly would be a higher-quality warning than a normal pullback in a laggard repair name like IT (Gartner) or GDDY (GoDaddy).
8. Big Picture Read (3 numbered insights)
1) Same calm hull; leadership swapped engines.
SPY stayed steady near 761, but leadership rotated from hardware/infra to cyber/software (CRWD, PANW, FTNT) plus enterprise platforms (CRM, ACN, IT). This isn’t “the market changed its mind on risk”—IT’s “risk is being expressed in a different lane.”
2) New-high leadership is back on the table—and IT’s showing up in a high-accountability name.
CRWD printing a new yearly high on a strong close is not a minor detail; IT’s the kind of behavior that can support continuation if IT holds. This is not the market rewarding low-quality squeeze behavior; IT’s rewarding a category leader and asking others to follow.
3) Concentration persists, but the content of concentration improved in a specific way.
Seven XLK leaders again is still concentration, not broad-based participation. But moving from “cyclical hardware rebuild” to “security/software cluster” can be interpreted as capital preferring durable demand signals. That’s not a promise of higher indices; IT’s a statement about sponsorship preference—and IT stays healthy as long as these leaders don’t turn into fast givebacks.
9. Key Takeaways (2–3)
Monday confirmed the stable-index digestion backdrop (SPY up modestly, still just under the one-year high zone) while leadership rotated sharply from hardware/enterprise throughput to cybersecurity/software leadership.
CRWD (CrowdStrike) leading at a fresh one-year high with a strong close is a higher-grade thrust signal—but IT raises the bar: the tape needs breakout holding behavior, not immediate reversal.
COIN (Coinbase) and BBY (Best Buy) add a “risk is allowed” undertone; this isn’t defensive hiding, IT’s selective risk-on participation under a calm index surface.
10. Closing Perspective
In plain language: the index stayed calm, but the market changed what IT wants to lead—less hardware rebuild, more cybersecurity and enterprise software.
In the broader arc, that keeps the “digestion, not breakdown” narrative intact while shifting the center of gravity inside Tech from physical throughput to digital security and platforms. The ship is still moving steadily; IT just swapped which engine is providing the thrust.
This read stays constructive as long as CRWD (CrowdStrike) can hold its new-high breakout shelf and as long as the cyber cluster (PANW, FTNT) can stay near their high zones without sharp lower-half reversals—unless this rotation turns into a one-session flare that immediately fails, because that would be the first real sign the market is losing traction and would need to add ballast for the wrong reason.