Invesaro

Invesaro publishes investment theses and settles them against the market in public: with a date, a basket of companies and a verdict.

Investment thesis

AI writes the exploits, Brussels writes the rules, and the certification labs write the invoices

LivePublished August 28, 2026180-day horizonregulation
Watch this thesis

In short

  1. What is happening
    OpenAI and more than 100 companies warn of a coming surge in AI-powered cyberattacks and call for a global defense push
  2. Why it matters
    The EU Cyber Resilience Act starts biting on 11 September 2026, turning product cybersecurity into a recurring audit fee collected by the TIC oligopoly.
  3. Who benefits
    UL Solutions Inc., Bureau Veritas SA, SGS SA, Intertek Group plc
  4. What must hold
    Assumptions are statements that must stay true for the thesis to make sense.
    Assumptions: 5. See the assumptions
  5. When is the verdict
    The horizon is the time we give a thesis. That many days after publication we settle it: we compare the basket of companies with the market benchmark and give a verdict.
    February 24, 2027, 180 days after publication
  6. Our score at publication
    A score from 0 to 100 given on the day of publication, before the market has verified anything. On the results page we check in public whether higher-scored theses do better.
    60 out of 100
Basket return
-2.6%
equal weight, since publication
The market over the same window
-1.9%
benchmark for this basket
Edge over the market
-0.7%
in percentage points

Companies in the basket

ULSUL Solutions Inc.BVIBureau Veritas SASGSNSGS SAITRKIntertek Group plc

The argument

The date nobody in the market has circled

A hundred technology companies spent this week warning that AI is about to compress the time between a vulnerability being disclosed and a working exploit existing from weeks to hours. The market reflex is to buy cybersecurity software. That reflex misses the more mechanical consequence, which arrives on a fixed calendar date: on 11 September 2026, two weeks from now, the EU Cyber Resilience Act's reporting obligations switch on. From that day, any manufacturer placing a product with digital elements on the EU market must send an early warning to ENISA and the relevant national CSIRT within 24 hours of learning that a vulnerability in its product is being actively exploited, with a fuller notification inside 72 hours.

What this thesis rests on

Each one is a statement that has to be true. We go back to every live thesis on a schedule and check these against public sources, so each leg carries either what we found or the date we look next.

Archive: reviews of this thesis are paused. Last review September 26, 2026.

  1. The EU does not postpone the Cyber Resilience Act's vulnerability reporting obligation beyond its 11 September 2026 start date.

    regulatory · Supported

    A source confirms this · September 26, 2026

    Help Net Security, 14 September 2026: ENISA "switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day the law's reporting obligations started binding manufacturers," with early warning due in 24 hours and fuller notification in 72 hours via portal.cra-srp.enisa.europa.eu. No postponement.

    See the source

  2. The Commission does not remove smart home devices, VPNs, password managers or network management systems from the Cyber Resilience Act's important product classes before 30 June 2027.

    regulatory · Open

    Checked September 26, 2026, nothing published either way

  3. At least 10 notified bodies are designated for the Cyber Resilience Act in the EU NANDO database before 30 June 2027.

    operational · Open

    Checked September 26, 2026, nothing published either way

  4. At least two of UL Solutions, Bureau Veritas, SGS and Intertek publicly launch a dedicated Cyber Resilience Act conformity or readiness service before 30 April 2027.

    competitive · Open

    Checked September 26, 2026, nothing published either way

  5. UL Solutions reports organic revenue growth of at least 5% year over year in each of the two quarterly results published after this thesis.

    financial · Open

    Checked September 26, 2026, nothing published either way

Show the causal chain step by step
  1. AI cuts exploit development from weeks to hours
  2. EU Cyber Resilience Act reporting starts 11 Sep 2026
  3. Every connected product sold in the EU needs SBOM, vulnerability handling and a cyber CE m
  4. Important and critical classes require third party conformity assessment
  5. Notified body capacity is scarce, so audit slots are rationed and priced up
  6. Certification becomes a recurring per product, per update fee
  7. Testing and certification oligopoly collects the fee

This thesis, over time

What has happened since publication. Every entry is computed as of its own date, from price history.

October 12, 2026

Day 45 of 180: basket -2.6%

The first quarter of the horizon is behind this thesis. The equal-weight basket stands at -2.6% since publication day. The benchmark (S&P 500) returned -1.9% over the same window, so the basket trails its market by 0.7 percentage points. The strongest contributor is BVI (+2.0%), the weakest is ULS (-13.0%). 135 days remain until the verdict.

September 26, 2026

Review: 1 of 5 assumptions confirmed

We went back to this thesis on day 29 of 180 and checked each of its 5 assumptions against public sources. Confirmed by the sources: 1. No news either way: 4. The equal-weight basket stands at -2.6% since publication day. The benchmark (.INX) returned -1.9% over the same window, so the basket trails its market by 0.7 percentage points. 151 days remain until the verdict.

September 12, 2026

Review: 1 of 5 assumptions confirmed

We went back to this thesis on day 15 of 180 and checked each of its 5 assumptions against public sources. Confirmed by the sources: 1. No news either way: 4. The equal-weight basket stands at -1.2% since publication day. The benchmark (.INX) returned -1.0% over the same window, so the basket trails its market by 0.2 percentage points. 165 days remain until the verdict.

New theses straight to your inbox

Subscribe and we will send you every new thesis and every verdict. No spam, one-click unsubscribe.

This is analysis, not investment advice and not a recommendation to buy or sell anything. We publish it and track it in public, mistakes included. Any decision is yours and yours alone.