The Signal

It did not come from an analyst upgrade. It did not show up in a press release. It arrived quietly in the options market, the way the most interesting things usually do.

On July 17, 2026, traders bought 13,904 call options on Check Point Software Technologies (NASDAQ: CHKP), representing roughly 18 times average daily call volume and a 3-to-1 call-to-put ratio. According to data from the Schwab daily options update, nearly all the flow concentrated in the December 18, 2026, expiration, anchored by a 6,000-lot 140/190 call vertical that traded across multiple blocks totaling 12,000 contracts. Traders paid an average of $10.90 for the spread. Simultaneously, 4,000 December 130 puts were sold at $12.05 to partially fund the structure.

Open interest at those strikes confirmed this was new positioning, not a roll of existing exposure. That matters. When volume dramatically exceeds open interest at a given strike, it signals new capital entering the trade with a specific directional thesis, not a routine adjustment.

Separately, on July 17, a different flow report confirmed that traders bought 11,718 call options on CHKP in a single session, an increase of approximately 595% compared to the typical daily call volume of 1,685 contracts. That is not noise. That is a message.

Why It Matters

Check Point Software reports Q2 2026 results before the market opens on July 30. That is 11 days away. The timing of this options flow is not coincidental. Traders who buy call spreads and sell puts simultaneously are constructing a structure that profits if the stock moves higher while defining their downside. Selling puts to fund long call exposure is a capital-efficient way to express a bullish view, but it also implies the trader is comfortable owning the stock at the put strike if the trade moves against them. That is not speculation for its own sake. That is a considered position with a clear thesis.

The December 2026 expiration gives this trade more room than a typical earnings play. These traders are not simply betting on a one-day pop. They appear to be positioning for a sustained recovery over the next five to six months, using the earnings catalyst as a potential inflection point.

Slight tangent, but it is worth noting: CHKP’s 30-day implied volatility currently sits at 49, compared to its 52-week range of 22 to 54. That means IV is elevated relative to its own history, sitting near the upper end of its annual range. The call-to-put ratio running at 2.7-to-1 as of the pre-market IV report on July 17 suggests directional conviction on the call side is outpacing hedging activity. Options pricing in this environment is not cheap, but the size and structure of the block trades suggests the participants behind this flow are not discouraged by elevated premiums.

The Company Behind the Signal

Check Point Software Technologies (CHKP) is a Tel Aviv-based cybersecurity company that protects more than 100,000 organizations globally across network, cloud, endpoint, and mobile environments. Its revenue model leans heavily on recurring subscriptions, and that recurring base has proven resilient even as the broader business hit turbulence in 2025 and early 2026.

Here is the fundamental context that gives this options activity its backdrop.

Q1 2026 results, reported April 30, were a study in contrasts. Non-GAAP EPS came in at $2.50, representing 13% year-over-year growth and beating the top end of the company’s own guidance. Adjusted free cash flow hit $457 million, up 11% and $70 million above the midpoint of guidance. Deferred revenue grew 8% to $2.06 billion, and performance obligations reached $2.59 billion, up 7%. These are healthy signals from the subscription engine.

But total revenue of $668 million, up 5% year-over-year, missed the midpoint of guidance by $2 million and fell short of analyst estimates of approximately $672.5 million. The culprit was the firewall appliance business, which was disrupted by a go-to-market restructuring the company implemented at the start of the quarter. When that news hit, the stock dropped roughly 18% in a single session.

Subscription revenue, however, told a different story: $323 million, up 11%, supported by emerging technologies including email security, SASE, and Continuous Threat Exposure Management (CTEM). Notably, CTEM achieved 96% ARR growth, and emerging technology billings as a category grew 45% in calculated billings. These are not the numbers of a company in structural decline. They look more like a company mid-transition, with short-term execution friction masking longer-term platform momentum.

The stock has reflected that friction aggressively. As of today, July 19, 2026, CHKP trades at approximately $137.10 per share. Its 52-week high is $225.23. That represents a decline of roughly 39% from the peak, against a backdrop where most cybersecurity peers have held up better. The P/E ratio now sits around 14x trailing earnings, well below the historical average for a company with this margin profile. Gross margin is running near 88%, operating margin near 40%. These are not the metrics of a company in distress.

On the strategic side, Check Point has been methodically building its AI security positioning. In June 2026, the company joined OpenAI’s Trusted Access for Cyber program, gaining access to GPT-5.5 for defensive security operations. It expanded its partnership with Illumio to combine perimeter defense with AI-era breach containment. It became an AWS European Sovereign Cloud partner. And it increased its share repurchase authorization by $2 billion to a total of $14.5 billion, extending a program in place since 2016 that has significantly reduced the share count over time.

Scotiabank recently upgraded CHKP to Outperform with a $185 price target, viewing the company as an AI beneficiary as enterprise cybersecurity spending increases. Guggenheim also upgraded to Buy with a $188 target. Barclays raised its target to $145 on July 13. The analyst community is not uniformly bullish, but upgrades are now beginning to appear after a long period of target reductions.

What the Market Is Pricing In

For Q2 2026, analysts currently estimate EPS of approximately $2.35 to $2.45 and revenue of approximately $675 million. The company’s own Q2 guidance called for revenue of $660 to $690 million and non-GAAP EPS of $2.40 to $2.50. That midpoint implies roughly $675 million in revenue and approximately $2.45 in EPS.

The company has beaten EPS estimates in six consecutive quarters. In Q1 2026, EPS beat by 8 cents on the non-GAAP line, even as revenue narrowly missed. The average EPS surprise over the trailing four quarters is positive. That history matters when evaluating whether the current call buying activity reflects informed positioning or simply momentum chasing.

Here is the part people often skip. The stock already fell 18% after Q1 on a modest revenue miss. That reset was severe. For traders looking six months out through December 2026 expirations, the question is not whether Q2 will be perfect. The question is whether the firewall appliance headwind will show signs of stabilization, and whether the emerging tech segment, which is growing at a dramatically faster rate, will begin to offset the legacy product softness visibly enough to shift sentiment.

Oppenheimer, which rates the stock Perform, projected on July 13 that Q2 revenue would fall in line with or slightly above the midpoint of guidance while full-year targets would be maintained. That is not a bullish projection. It is a floor projection. The options flow is betting on something above the floor.

With implied volatility at 49 against a 52-week range of 22 to 54, the options market is pricing in meaningful movement around earnings. A rough estimate of the expected move, derived from at-the-money options pricing, suggests the market is expecting approximately a 7% to 10% move in either direction following the July 30 report. Given the 18% decline after Q1, the current implied move seems somewhat muted relative to recent history, which either reflects a view that the worst is priced in, or that the market does not anticipate another dramatic miss.

Strategic Considerations

The structure observed in the flow, a long call vertical funded by a short put, warrants some dissection before considering any framework around it.

A long 140/190 call spread in December 2026 purchased for approximately $10.90 per spread requires the stock to close above $140 at expiration to generate any profit, and achieves maximum value near $190. At today’s price of $137.10, the stock needs to move roughly 2% to reach the lower strike and roughly 39% to reach the upper bound. The maximum gain on the spread is $50 minus the $10.90 paid, or approximately $39.10 per spread. The maximum loss is the $10.90 premium paid.

The short 130 put at $12.05 obligates the trader to buy the stock at $130 if assigned, but collects $12.05 to partially offset the cost of the call spread. Net premium received from the put partially funds the long spread. This is a risk-defined structure on the call side but creates downside exposure below $130 on the put leg.

For traders evaluating this situation independently, three frameworks apply based on different views of the outcome.

• Bullish case: If you believe Q2 results show stabilization in appliance revenue and continued acceleration in subscriptions and emerging technology, a defined-risk structure such as a bull call spread using December or January 2027 expirations offers leveraged exposure with a capped loss. The 140/175 or 140/180 call vertical limits maximum risk to the premium paid while providing significant upside capture if the stock works toward analyst price targets in the $147 to $185 range. The caveat is that with IV near the upper end of its range at 49, options are not inexpensive. Premium paid reflects elevated expectations for movement.
• Neutral to mildly bullish case: A cash-secured put at a strike below current price, for example the 125 or 120 put in a September or October expiration, collects elevated premium while expressing a willingness to own the stock at a discount to today’s price. This is appropriate for a trader who believes the stock is unlikely to revisit its 52-week low of $112.23 but is not yet ready to commit to a directional long. With IV elevated, put premium is richer than it would be in a low-volatility environment, which benefits the seller. The risk is a resumption of selling if Q2 results disappoint.
• Bearish or hedging case: The put diagonal observed in GDX earlier this week is a useful reminder that rolling bearish exposure down and out to lower strikes is a common institutional risk management technique. For a trader who holds CHKP and is concerned about another earnings-driven selloff, buying a protective put at a near-the-money strike in July or August while selling a lower-strike put at a further expiration locks in a floor while collecting some premium. The cost of the trade is reduced by the put sold, but protection is incomplete below the lower strike.

None of these structures is appropriate for every account or risk tolerance. The key variable across all of them is the direction of Q2 results and, more importantly, the tone of management guidance. If management signals that the go-to-market disruption in appliances is resolving, and that the emerging technology segment is on track to reach the scale needed to offset legacy product softness, the stock has significant room to recover. If the disruption continues and full-year guidance is lowered further, elevated IV will deflate and the stock could revisit lows.

Risk Factors Worth Taking Seriously

The bullish options activity is real. But the risks are also real, and they deserve equal weight in any analytical framework.

• Insider activity has been net selling. Insiders sold approximately $9.6 million in stock over the trailing three months with no reported buying activity. This does not disqualify a bullish thesis, but it deserves acknowledgment.
• Competitive pressure from Palo Alto Networks, Fortinet, and CrowdStrike remains intense. Several firms have flagged that Check Point’s execution may lag cybersecurity peers in the near term.
• The go-to-market restructuring created measurable disruption in Q1. If that disruption persists into Q2, another revenue miss is possible even if EPS holds up due to disciplined expense management.
• Full-year 2026 revenue guidance was revised downward after Q1 to approximately $2.77 to $2.85 billion. Another revision lower would likely trigger a renewed selloff.
• The December 2026 call spread structure observed in the flow does not produce value unless the stock recovers meaningfully from current levels. The breakeven on the spread is approximately $150.90, roughly 10% above today’s price. That is achievable, but it requires a visible fundamental turn.

What to Watch

The July 30 earnings call is the central event. But the details inside the report matter more than the headline numbers.

• Appliance revenue trend: Did the firewall appliance disruption from go-to-market changes stabilize in Q2, or did it deepen? Management explicitly guided for continued near-term headwinds in this segment after Q1. Any sign of recovery here would be a significant positive surprise relative to current expectations.
• Subscription and emerging tech growth rates: Subscription revenue grew 11% in Q1, and emerging technology billings grew 45%. If those rates hold or accelerate in Q2, the subscription engine is proving capable of carrying the business through the appliance transition. Watch CTEM ARR growth in particular, which was 96% in Q1.
• Deferred revenue and billings: Deferred revenue of $2.06 billion and performance obligations of $2.59 billion are forward indicators of future recognized revenue. Growth here signals customer commitment regardless of near-term appliance dynamics.
• Full-year guidance revision: The market will pay close attention to whether management maintains, raises, or lowers its full-year 2026 revenue outlook. Another downward revision would be the most damaging outcome for the stock and would likely invalidate the bullish thesis behind the December call spread activity.
• Tone on the competitive environment: How management characterizes its positioning against Palo Alto, Fortinet, and CrowdStrike in the AI-security transition will matter as much as any single revenue number. Confidence in the platform consolidation strategy will be scrutinized.

The options market has placed a sizeable bet that the worst of Check Point’s story is already reflected in a $137 stock price that sits nearly 40% below its 52-week high. Whether that bet is right depends entirely on whether July 30 provides the first credible evidence of a turn.

Eleven days to find out.

Tactical Checklist

• Confirmed: 13,904 CHKP calls traded July 17, roughly 18x average volume. Flow concentrated in December 2026 expiration via 140/190 call vertical. New positioning confirmed by open interest comparison.
• IV context: 30-day IV at 49, versus 52-week range of 22-54. Near the upper end. Options are not cheap. Premium paid reflects above-average expected movement.
• Earnings date: July 30, 2026, before market open. Q2 2026 revenue consensus near $675 million. EPS consensus approximately $2.35 to $2.45.
• Historical beat rate: Six consecutive quarters of EPS beats. Average EPS surprise is positive over trailing four quarters.
• Key metrics to monitor in Q2 report: appliance revenue trajectory, subscription growth rate, deferred revenue, and full-year guidance revision direction.
• Bullish framework: Defined-risk bull call spread in December or January 2027 expiration captures upside if stock recovers toward analyst price targets. Maximum loss is premium paid.
• Neutral framework: Cash-secured put at 120-125 strike in September or October expiration collects elevated premium at the upper end of IV range. Requires willingness to own stock at that strike.
• Primary risk to bullish thesis: Another revenue miss or second guidance reduction on July 30 would likely trigger renewed selling and IV compression, unfavorable for long call positions.
• Watch: Insider selling activity ($9.6 million over trailing three months, no buying). Not disqualifying, but worth monitoring alongside the options positioning.

Options Trading Report is published for informational and analytical purposes only. Nothing in this publication constitutes investment advice, a recommendation to buy or sell any security, or a solicitation of any kind. All options strategies discussed involve meaningful risk, including the potential loss of the entire premium paid. Consult a licensed financial professional before making any trading decisions.