The Setup

Uber burned through its entire 2026 AI budget in four months. An anonymous enterprise disclosed a $500 million AI spend overrun. Microsoft reportedly began cutting internal Claude Code licenses in May. Sam Altman acknowledged on the record that AI cost management “went from an issue that never came up to all of a sudden a huge issue.”

None of that means the AI trade is over. It means the meter just flipped.

For two years, the market priced AI infrastructure like compute was the only binding constraint: GPUs, HBM, data centers, power, networking. Those constraints are real and remain. But the newest binding constraint is showing up somewhere more prosaic — on the enterprise software bill.

GitHub moved Copilot to usage-based billing on June 1. OpenAI moved Codex to token pricing in April. Google moved Gemini subscriptions to a compute-consumed model in May. The pattern is unmistakable: AI vendors are moving from subsidized access to metered consumption. They had no choice — the fundraising grew faster than the revenue, and eventually the customers have to pick up the tab.

Where the Money Moves Next

If AI usage is expensive enough to frighten CFOs, the next winners are not the companies raising prices. They are the companies that answer the three questions every CFO is now asking:

What are we actually spending?  Observability. Datadog and Dynatrace are the telemetry layer that makes the invoice comprehensible. Non-AI enterprise adoption is running at 25% growth for DDOG — not because the AI story is over, but because companies pulling AI in-house need instrumentation to run it. The irony of this earnings season: firms announce AI insourcing plans, then renew observability contracts anyway.

Who authorized it?  Identity. SailPoint already governs a base where 11% of SaaS identities are non-human — and that percentage is compounding. Every deployed agent is a new credential event: access rights, privilege scope, audit trail. IAM businesses get paid per identity managed, not per employee headcount. Agentic sprawl is a direct revenue driver for SailPoint in a way it is a headwind for every seat-based SaaS vendor.

Can we optimize and route it securely?  Compute delivery and access control. Akamai locked in a seven-year, $1.8 billion commitment from a leading frontier lab for its edge compute business. Fastly’s contracted backlog exploded 63%. Palo Alto’s Idira integration is running 3–6 months ahead of plan. These are not defensive businesses waiting for the AI wave to reach them. They are already processing the traffic.

The Agentic Identity Thesis in Detail

The most underappreciated dynamic in this rotation is identity. The conventional framing treats AI as a threat to IAM businesses — if agents replace humans, and IAM products charge per human, then fewer humans means less revenue. That logic is wrong.

SailPoint’s fiscal Q4 earnings call revealed that 11% of all SaaS identities under governance are already non-human. Okta’s Todd McKinnon noted that most large enterprises will eventually have more agentic identities than human ones. Each of those agentic identities carries credentials, access privileges, and the ability to act on a user’s behalf — often across multiple systems simultaneously.

The attack surface that opens when agents proliferate is not theoretical. An attacker who compromises an agent credential gains a vector that operates 24 hours a day, does not get tired, does not second-guess unusual requests, and can access every system the agent has been provisioned to touch. The governance burden is not smaller than human identity management. It is larger, faster-moving, and more automated.

Palo Alto’s response is Idira: Zero Standing Privilege by default, credentials provisioned for the duration of a session and revoked on exit, with AI-native analysis surfacing hidden entitlements and unmanaged accounts. The integration of the CyberArk PAM suite into PANW’s platform is running 3–6 months ahead of the original profitability timeline. That is a meaningful signal — platform integrations rarely run ahead of plan.

Observability: You Cannot Cut What You Cannot See

The observability thesis arrived with an unusual observation: the first use case that made us bullish on Datadog was the global water industry. When usage-based pricing creates billing opacity, the infrastructure that makes consumption legible becomes essential. Token-based AI pricing is the most extreme version of that dynamic the software industry has ever produced.

Datadog’s non-AI segment is growing 25%. That figure matters because it reflects traditional enterprises — not hyperscaler-adjacent early adopters — pulling AI into internal workflows and discovering they cannot operate it without telemetry. JFrog reported that 93% of the Fortune 100 rely on its DevSecOps platform for software delivery. Even if AI generates the code, someone has to deploy it across thousands of devices with near-zero fault tolerance. JFrog owns that deployment layer.

The bear case for observability has always been: what if the AI labs build native monitoring into their own platforms and disintermediate the third-party vendors? The evidence from this earnings season suggests the opposite is happening. Frontier labs are signing multi-year compute and observability contracts with external vendors, not replacing them. Fault tolerance demands that companies do not want a single point of failure — including an LLM that could hallucinate its own utilization metrics.

Compute Delivery: The CDN Trade Is Not Dead, It Evolved

The legacy CDN business model is a race to the bottom. Nobody pays a premium to deliver a static web page. But the traffic composition of the internet in 2026 looks nothing like the internet the CDN business model was built for.

Agentic traffic — machine-to-machine requests, dynamic content generation, real-time voice synthesis, automated checkout flows — generates traffic patterns indistinguishable from sophisticated bot attacks. The security layer that distinguishes legitimate agentic traffic from malicious bots is not a commodity. It is a premium product. Akamai protected a leading US retailer from unwanted bots during the holiday shopping season in a contract worth $24 million. Fastly management explicitly described “co-innovating with customers to secure and scale AI use cases and manage a massive new wave of automated traffic.”

Cloudflare had the strongest quarterly print of the three — a material beat with lifted profit guidance and a headcount reduction that should improve margins — and fell 25% anyway. The market penalized the optics of the workforce cut while ignoring the business improvement. That is a sentiment error. The compute delivery thesis at Cloudflare is intact. The stock is in the air pocket, not the thesis.

Winners

Structural Losers

Pressure Points / Air Pockets

Credibility Firewall

Bear Case

Five Takeaways

1.  The bottleneck rotated to the bill.  Phase 1 AI was about building infrastructure. Phase 2 is about making it legible. The marginal alpha has moved from GPU makers to the vendors that answer three CFO questions: What did we spend? Who authorized it? Can we optimize it?

2.  Agentic identity is the sleeper trade of the rotation.  11% of enterprise SaaS identities are already non-human and compounding. IAM businesses charge per identity managed. Agentic sprawl is a direct revenue driver — the opposite of a headwind.

3.  Observability is structurally insulated from LLM disruption.  The fault tolerance requirements of financial and operational systems are near-zero. No enterprise will trust an LLM to hallucinate its own utilization metrics. The telemetry layer stays human-supervised regardless of how capable the models become.

4.  The CDN selloffs are sentiment errors, not verdicts.  Cloudflare down 25% on a beat. Fastly volatile despite 63% RPO growth. The market is mispricing the compute-delivery evolution because it is anchored to the legacy CDN narrative. The traffic composition has changed; the business models are changing with it.

5.  The short-squeeze rally in AI losers is a trap.  Some of these names will prove to be legitimate call options. Most will not. The market cannot distinguish between a genuine recovery and a crowded short getting squeezed. Do not mistake price momentum for thesis repair.

Catalyst Watchlist

Many of today’s data centers are still using copper wiring. The same metal we’ve been using for a hundred years.

At the speeds AI demands with data moving between thousands of GPUs, billions of times a second, copper doesn’t just slow down.

It turns that data into heat. The more you push through it, the worse it gets. There’s no software for fix for that.

So what’s the answer?

Explore the Photonics Layer…..

Warsh’s first Fed meeting went off without a hitch. The Fed kept rates steady, his statement was much shorter than what Powell usually did, and the Fed removed language that showed a bias towards easing. They also removed language talking about a dual mandate of price stability and maximum employment, and replaced it with “The committee will deliver price stability”. The Fed also raised it’s core inflation outlook for 2026-8 and lowered it’s GDP growth outlook for 2026-7. Kinda sounds stagflationish to me. 9 of the 18 members see at least one hike this year.

On this news the 2 year interest rates spiked and the market sold off. Of course, since investors are conditioned to by any dip it seems to be retracing most, if not all, of those losses today.

Citadel had a note this morning with a September hike as a base case, but the July meeting as “live”, meaning anything is possible in July. They also see 3 hikes, 25bps each. I continue to see higher rates as the biggest risk to this rally.

Speaking of inflation, I’m not sure we fully understand the impact of things like this…..

When capital chases a tech theme, it tends to pile into the most obvious
layer and miss the one underneath. AI spending is now bumping hard
against memory. Hyperscalers — the big cloud builders like Amazon,
Google, and Microsoft — have shifted memory from 8% of their build
budgets to an estimated 30% in a single cycle. That capital has to go
somewhere. If the constraint is memory, and the build can't move without
it, shouldn't an investor own the layer AI runs on?

View HBMX fund holdings →

Distributor: Foreside Fund Services | Investing involves risk including
possible loss of principal.

<Link = http://www.hbmxetf.com/>

$WOLF ( ▲ 17.91% )

Held this one for a while in $MEMY ( ▲ 2.78% ). Undercut and rally at the 50 day moving average the other day and has held a couple of times. Like this chart here.

Great conversation on wide ranging topics with Kenny Polcari…

The H.E.A.T. (Hedge, Edge, Asymmetry and Theme) Formula is designed to empower investors to spot opportunities, think independently, make smarter (often contrarian) moves, and build real wealth.

The views and opinions expressed herein are those of the Chief Executive Officer and Portfolio Manager for Tuttle Capital Management (TCM) and are subject to change without notice. The data and information provided is derived from sources deemed to be reliable but we cannot guarantee its accuracy. Investing in securities is subject to risk including the possible loss of principal. Trade notifications are for informational purposes only. TCM offers fully transparent ETFs and provides trade information for all actively managed ETFs. TCM's statements are not an endorsement of any company or a recommendation to buy, sell or hold any security. Trade notification files are not provided until full trade execution at the end of a trading day. The time stamp of the email is the time of file upload and not necessarily the exact time of the trades. TCM is not a commodity trading advisor and content provided regarding commodity interests is for informational purposes only and should not be construed as a recommendation. Investment recommendations for any securities or product may be made only after a comprehensive suitability review of the investor’s financial situation.© 2026 Tuttle Capital Management, LLC (TCM). TCM is a SEC-Registered Investment Adviser. All rights reserved.