The Signal

On July 17, call activity in Check Point Software (CHKP) exploded to 18 times its average daily volume. That is not a rounding error. According to Charles Schwab’s daily options market update, 13,904 calls traded that session against just a fraction of the put activity, producing a call-to-put ratio of roughly 3-to-1.

The structure of the trade is what makes it interesting.

Nearly all of the flow concentrated in the December 18, 2026 expiration. The dominant position was a 6,000-lot 140/190 call vertical spread, traded across multiple blocks totaling 12,000 contracts. Traders paid an average of $10.90 for the spread and simultaneously sold 4,000 December 130 puts at $12.05 to help fund the position. Given that open interest in those strikes was minimal heading into the session, this appears to represent fresh positioning rather than the closing of an existing trade.

Someone wanted to be long CHKP calls through December, and they were willing to pay for it.

Why It Matters

Check Point’s 30-day implied volatility was sitting at 49 as of July 17, near the upper end of its 52-week range of 22 to 54. That tells you options premiums are elevated. Buying into elevated IV is not something you do carelessly. Whoever put on this position was not trying to pick up cheap premium on a slow name. They were making a considered bet that the stock moves meaningfully higher between now and December, and they structured it as a defined-risk spread rather than an outright call purchase.

There is also the matter of where CHKP has been recently. The stock’s 52-week range spans from $112.23 to $225.23. At last trade near $134-$137, it is sitting well off its highs and close to the low end of that range. The 200-day moving average has crossed significantly above the current price. That compression, combined with a large, new, long-dated call spread, is a classic footprint of a participant who believes the risk-reward tilts toward a recovery.

Worth noting: a Guggenheim upgrade to Buy with a $188 price target arrived on July 1. The December 190 call strike in this spread aligns almost precisely with that target. That may or may not be coincidence.

The Company Behind the Signal

Check Point is a 33-year-old cybersecurity company headquartered in Tel Aviv. It protects more than 100,000 organizations globally across network, cloud, endpoint, and mobile security. The product lineup includes Quantum (network security), CloudGuard (cloud), Harmony (workspace), and its newer AI-focused offerings built around what the company calls the Infinity Platform.

The business is genuinely profitable, with a net margin above 38% and a return on equity near 39% in its most recent quarter. Revenue for Q1 2026 came in at $668.4 million, up about 4.8% year over year. The company beat EPS estimates for six consecutive quarters as of Q1 2026, delivering $2.50 against a $2.42 consensus. That is a consistent execution record, even if the growth rate is modest by cybersecurity sector standards.

Here is the tension that makes this interesting: Check Point is cheap by its own history. The stock trades at a P/E of roughly 14, well below historical averages for a profitable software security business. Analyst price targets range from $120 on the low end to $188 from the most recently upgraded firm, with a consensus around $147-$148 — still above current levels.

At the same time, the bears have their points. The core firewall business, which represents about 72% of revenue, grows at roughly 6%, trailing faster-moving peers like Palo Alto Networks and Fortinet. Insider selling over the past three months totaled $9.6 million with no purchases on the other side. Repeated price target cuts from JPMorgan, Goldman Sachs, Cantor Fitzgerald and others reflect a broad recalibration of growth expectations following the leadership transition and ongoing product cycle concerns.

Brief tangent worth mentioning: Check Point has been unusually active on the product announcement front in recent months. It launched an AI Defense Plane at RSA Conference 2026, joined OpenAI’s Daybreak Cyber Partner Program to embed frontier AI models directly into customer-facing security products, expanded its partnership with Illumio to address AI-powered cyber threats, and received GovRAMP Authorization for its Infinity Platform. It also increased its share repurchase authorization by $2 billion, bringing the total program to $14.5 billion. None of these moves alone changes the growth picture. Together, they suggest a company trying hard to close the gap between its valuation and the story it wants to tell.

What the Market Is Pricing In

Check Point reports Q2 2026 results on July 30, before the market opens, followed by a conference call at 8:30 AM ET. Analysts are expecting EPS of approximately $2.35 to $2.45 on revenue near $675 million. The company’s own guidance for Q2 called for revenue of $660 million to $690 million.

With a 30-day IV of 49 and earnings 11 days away, options are pricing in meaningful uncertainty. The stock has historically made modest moves on earnings — CHKP is known as a low-beta name with a five-year monthly beta of 0.49 — which means the current elevated IV might actually be overdone relative to what the company typically delivers post-earnings.

That is an important distinction. The call spread positioned through December extends well beyond the earnings event. The buyer is not simply wagering on a one-day pop after July 30. They appear to be expressing a view that the stock recovers materially over the next five months, possibly driven by a combination of earnings execution, ongoing AI security monetization, and valuation re-expansion as rate and macro conditions evolve.

For that view to pay off, the stock needs to move from roughly $137 through the $140 breakeven and toward the $190 upper strike — a move of nearly 39% from current levels. That is not a small ask, but it is what the December spread is structured around.

Strategic Considerations

The call vertical spread (buying the 140 call, selling the 190 call in December) is a sensible structure for this environment. It limits the cost of entering a high-IV name while defining both the maximum gain and maximum loss. The spread buyer profits if CHKP closes above $140 at December expiration and achieves maximum profit at $190. The risk is the premium paid, which at $10.90 average represents a defined, known loss if the thesis fails.

The sale of the December 130 puts alongside this position adds another layer to consider. Selling puts at $130 while the stock is near $137 creates meaningful downside exposure if the stock falls further. This is not a pure long volatility play. The overall position behaves more like a risk reversal embedded inside a call spread — bullish, with the put sale effectively reducing the net cost of the call spread while accepting defined downside risk below $130.

For readers who agree with the basic direction but want a simpler approach, a long call spread with strikes set around current levels and a multi-month expiration captures the same directional thesis with clearly defined risk. A long call debit spread into December — buying a strike near or slightly above the money and selling a higher strike — allows participation in a move higher while limiting the impact of elevated IV on premium cost. Time decay becomes a factor as the trade ages, so the intended holding period matters.

What this type of strategy does not protect against: a continued grind lower in the stock, a disappointing earnings report that resets expectations further downward, or an extended period of elevated IV that inflates the cost of managing the position.

What to Watch

July 30 is the obvious near-term inflection point. Watch whether Check Point delivers Q2 revenue at the midpoint or above of its $660-$690 million guidance range, and whether management raises or tightens full-year guidance. Any commentary around AI security adoption rates within the Infinity Platform, subscription growth metrics, and progress on reducing the gap with SASE-focused peers will matter to how the stock trades in the days following the report.

Also watch implied volatility after earnings. The current IV near the top of its 52-week range is partly earnings-driven. Once the report passes, a volatility crush is likely, which could reduce option premiums even if the stock itself moves higher. That dynamic is worth considering when sizing any options position into the event.

Longer term, the thesis here rests on whether Check Point’s pivot toward AI-native security products gains real traction with enterprise customers, or whether it remains a credible but slower-moving alternative to peers who are growing faster and commanding higher multiples.

The options market just voted for the recovery scenario. Whether that vote was informed or premature is what the next few months will answer.