Palo Alto Networks
Subscription-and-support-led platform model (~80% of revenue recurring; FY2025: $7.42B subscription/support vs $1.80B product) layered on a firewall hardware/software estate; land-and-expand 'platformization' consolidates point products onto Strata, Prisma/Cortex Cloud, Cortex XSIAM, and now CyberArk identity, monetized as multi-year ARR contracts
Earnings, margins, COGS & capex
FY2025 (ended 2025-07-31): revenue $9.22B (+15%), GAAP net income $1.13B, non-GAAP net income $2.34B ($3.34 EPS), NGS ARR $5.6B (+32%), RPO $15.8B (+24%); management claimed a fifth consecutive 'Rule of 50' year. FY2026 transformed by M&A: CyberArk ($21.1B consideration, closed 2026-02-11) and Chronosphere ($3.35B announced deal, ~$3.0B purchase consideration, closed 2026-01-29) push FQ3 2026 revenue to $3.0B (+31%) and NGS ARR to $8.1B (+60%, $1.6B acquired). GAAP swung to a $177M quarterly net loss (-$0.22/sh) on deal charges while non-GAAP EPS of $0.85 beat; cash generation remains elite (TTM adjusted FCF margin 38.5%).
Income statement — where each revenue dollar goes
% of revenueOf every $1 of revenue, ~27¢ is cost of goods and ~45¢ operating expense, leaving ~29¢ of operating profit.
Revenue trend
Margins
stable; near-term drag from acquired-intangible amortization
was guided 29.2-29.7% pre-deal (Aug 2025); modestly reset by CyberArk/Chronosphere integration
deal-charge driven; GAAP was solidly positive in FY2025 ($1.13B net income)
TTM improving, +430bps YoY; full-year guide trimmed from pre-deal 38.0-39.0%
COGS structure
COGS is dominated by subscription/support delivery — cloud hosting (heavy Google Cloud usage for Cortex/Prisma, plus AWS/Azure), customer support, and third-party threat-intel/data costs — plus hardware costs on the ~20% product line (outsourced manufacturing, components). Amortization of acquired intangibles from CyberArk/Chronosphere ($6.3B + $0.6B identified intangibles) now inflates GAAP COGS.
Capex
Capital-light (~2% of revenue, approx.): data-center/lab equipment, office build-outs; primary infrastructure scaling is via hyperscaler opex, not owned capex. M&A is the real capital-deployment channel ($21.1B CyberArk consideration; $3.35B announced Chronosphere deal).
Latest earnings
Beat: revenue $3.00B vs ~$2.94B consensus; non-GAAP EPS $0.85 vs ~$0.79 (~7.6% surprise); stock fell ~5% after the print (shares had run ~60%+ YTD into it) before rallying to an all-time high by early July 2026
FQ4 2026: revenue $3.345-3.355B (+32%), non-GAAP EPS $0.96-0.98 (on 830-840M diluted shares). FY2026: revenue $11.415-11.425B (+24%), NGS ARR $8.90-8.95B (+59-60%), RPO $20.9-21.0B (+32-33%), non-GAAP op margin 28.9-29.2%, non-GAAP EPS $3.77-3.79, adjusted FCF margin 37.5%
- NGS ARR
- $8.1B, +60% YoY ($1.6B from acquisitions) at FQ3 2026
- RPO
- $18.4B, +36% YoY ($1.8B from acquisitions) at FQ3 2026
- TTM adjusted FCF margin
- 38.5% at FQ3 2026, +430bps YoY
- Acquired revenue in quarter
- $388M (CyberArk + Chronosphere) in FQ3 2026
Growth drivers
- Platformization — consolidating multiple point vendors per customer onto Strata/Cortex platforms with multi-year commitments
- Cortex XSIAM AI-driven SecOps displacing legacy SIEM (Splunk/QRadar estates)
- Identity security via CyberArk — privileged access plus machine/AI-agent identity, a new TAM pillar
- SASE/Prisma Access secure-network transformation and firewall software refresh
- Securing enterprise AI deployments (AI Runtime Security, AgentiX, plus Chronosphere observability for AI-native workloads)
- Federal/sovereign and large-enterprise share gains as security budgets consolidate
Reported financials — SEC EDGAR
Audited GAAP figures pulled from SEC filings · latest filing 2026-09-10. The audited primary-source spine — not financial advice.
Revenue — annual (GAAP)
Margins & balance sheet — FY’26
Bull & bear
PANW is becoming the definitive security platform of the AI era: the only vendor spanning network, cloud, SOC, and identity, with management-reported accelerating organic bookings, an $18.4B RPO war chest, 38%+ TTM FCF margins, and a multi-year platformization runway as CISOs consolidate and every AI agent needs an identity and a security perimeter.
- CyberArk adds the identity pillar competitors lack and was acquired mostly in stock ($2.3B cash + 112M shares) while preserving a net-cash balance sheet (~$5.6B at 2026-04-30)
- XSIAM is among the fastest-growing products in security software history, displacing legacy SIEM at scale
- AI adoption is a structural demand multiplier: securing models, agents, and machine identities is greenfield TAM where PANW has assembled the most complete portfolio (AI Runtime Security, AgentiX, Chronosphere)
- FQ3 2026 double beat with management citing accelerating organic bookings alongside the acquired boost — the platform bet is converting, and the stock made a new all-time high in early July 2026
- Rule-of-50 economics five consecutive years per management; ~$4.3B/yr guided adjusted FCF funds integration and further tuck-ins without net leverage
The bear case is that PANW is paying up — in shares, GAAP losses, and integration risk — to buy growth optics: strip out $1.6B of acquired ARR and organic growth is roughly mid-20s in a maturing market, while ~23-24x sales and ~90x forward earnings price in flawless execution of two of the largest integrations in security history against Microsoft and CrowdStrike.
- 112M CyberArk shares raised shares outstanding from 668M to 813M; GAAP swung to losses and non-GAAP EPS growth (~13% FY26 guided) badly lags the 24% revenue growth
- Inorganic ARR flatters headline metrics; comps get brutal in FY2027 when CyberArk and Chronosphere lap
- CyberArk's on-prem PAM heritage and separate GTM culture make this a genuinely hard integration; Chronosphere runs concurrently
- Microsoft's E5 bundle and Google/Wiz's cloud-native attack erode pricing at both the commodity and innovation ends
- Stock fell ~5% on an FQ3 2026 double beat (after a ~60% YTD run) — expectations already demand acceleration; any billings/FCF-duration wobble (financing-assisted deals, deferred payment plans) gets punished at this multiple
- Firewall refresh tailwind is cyclical and the hardware-attached base decays as workloads shift to clouds where hyperscalers control the native controls
What it is worth
EV/Sales and EV/adjusted-FCF cross-check against high-growth security peers (CRWD, ZS, FTNT), sanity-checked on forward non-GAAP P/E
~$180-210B (~25-35% downside from July 2026 levels): CyberArk integration friction or organic deceleration to high-teens compresses the multiple toward ~15x sales; GAAP losses persist longer than expected and FCF-quality questions (billings duration, financed deals) surface
~$260-300B
FY2026 guidance delivered, integration proceeds without major churn, multiple holds ~20-23x forward sales as growth normalizes to low-20s organic-plus-synergy
~$350B+ market cap
if organic NGS ARR sustains ~30%+, XSIAM/identity cross-sell compounds, and FY2027 revenue exits toward $14B+ with adjusted FCF margin held ~38% — re-rating justified by durable platform dominance
At ~$275B market cap (813M shares x ~$337, 2026-07-09; ~$300B at the 2026-07-06 all-time high) with ~$5.6B net cash ($7.0B cash/investments less $1.35B assumed CyberArk 2030 converts): EV ~$270B is ~23-24x FY2026 guided revenue ($11.42B), ~62-65x FY2026 guided adjusted FCF (~$4.3B at 37.5% margin), ~89-90x FY2026 non-GAAP EPS ($3.77-3.79). Premium to FTNT/CSCO, comparable on a growth-adjusted basis to CRWD. The multiple embeds successful CyberArk integration and organic reacceleration; dilution (112M new shares; 668M to 813M outstanding) means per-share value creation lags headline growth near-term. Figures vintage 2026-07.
SWOT
Strengths
- Broadest platform in cybersecurity post-CyberArk: network, cloud, SecOps, identity under one vendor
- Elite cash economics: 38.5% TTM adjusted FCF margin at $11B+ revenue run-rate, net cash balance sheet (~$5.6B)
- $18.4B RPO gives multi-year revenue visibility; ~80% recurring revenue
- Proven M&A machine (20+ acquisitions integrated over a decade) with strong GTM cross-sell
- Leadership continuity under CEO Nikesh Arora, with management-stated 2030 NGS ARR ambitions expanded by the CyberArk identity pillar
Weaknesses
- GAAP profitability collapsed near-term — FQ3 2026 net loss of $177M on deal charges, heavy stock comp, and 112M new shares (~17% increase on the 668M pre-deal base) from CyberArk
- Headline 60% NGS ARR growth is heavily inorganic ($1.6B acquired); organic growth is materially slower (roughly mid-20s%)
- Integration risk at unprecedented scale — CyberArk is the largest cybersecurity acquisition to date, executed nearly simultaneously with Chronosphere (closed 13 days apart)
- Legacy firewall/hardware product line (~20% of revenue) is a low-growth anchor and cyclical refresh business
- Premium valuation (~23-24x FY2026 guided sales, ~90x forward non-GAAP EPS at July 2026 prices) leaves little room for execution slips
Opportunities
- AI-agent identity security: machine identities and autonomous agents multiply the CyberArk PAM TAM
- SIEM displacement — XSIAM taking share from Splunk (Cisco) and legacy SOC tooling
- Observability + security convergence via Chronosphere for AI-native infrastructure
- Vendor consolidation cycle: CISOs actively reducing multi-vendor tool sprawl toward platform vendors
- Federal/sovereign cyber spend and hardening regulatory disclosure regimes (SEC cyber rules) expand mandatory demand
Threats
- Microsoft bundling security (Defender, Sentinel, Entra) into E5 at effectively marginal cost
- CrowdStrike's rival consolidation platform and strong brand in endpoint/SecOps
- Wiz under Google amplifies hyperscaler competition in cloud security (CNAPP)
- Free-cash-flow model depends on billings duration and customer financing programs; rate or budget scrutiny can pressure it
- A major breach or product failure at PANW itself would be disproportionately damaging to a trust-based franchise
Moats, dependencies & bottlenecks
Moats
Multi-product, multi-year platformization deals embed PANW across network, cloud, SOC, and identity; ripping out an integrated XSIAM+Strata+CyberArk estate is a multi-year project
Telemetry from tens of thousands of customers (company has cited 80,000+) feeds Unit 42 and Precision AI models; more sensors lead to better detection and more customers
Security purchases are risk-aversion purchases; incumbency with Global 2000 and federal certifications (FedRAMP High) is hard to replicate
Multi-billion-dollar combined R&D+S&M outspends pure-play rivals, but Microsoft and Google outscale PANW in absolute terms
CyberArk was the clear PAM category leader; privileged-access vaults are among the stickiest assets in enterprise software
Dependencies
infrastructure supplier Cortex/Prisma data plane runs largely on GCP with AWS/Azure exposure; cloud COGS concentration, and the same hyperscalers are becoming security competitors (Google-Wiz)
hardware supplier Firewall appliances depend on ODM/EMS partners and network silicon; the 2021-23 shortage era showed backlog sensitivity, since normalized
distributors and GSIs (TD SYNNEX SNX, Ingram Micro INGM, Accenture ACN, Deloitte) Overwhelmingly channel-fulfilled; concentration in top distributors is typical for the industry
technology partner AI security co-development and GPU-dependent Precision AI/XSIAM inference costs
Strategy, M&A cadence, and Street credibility are closely tied to the CEO; CyberArk/Chronosphere integration is leadership-intensive
Advantages
- Only vendor with credible leadership across all four consolidation pillars (network, cloud, SecOps, identity) after CyberArk
- Best-in-class cash conversion (38.5% TTM adjusted FCF margin) funds competition without net leverage
- $18.4B RPO and rolling multi-year platform deals give rare revenue visibility for a 24%-growth company
- Precision AI + Unit 42 threat-intel flywheel across the industry's largest pure-play sensor network
- Net-cash balance sheet (~$5.6B) post the largest security acquisition ever — strategic flexibility rivals lack
Weaknesses
- Non-GAAP-to-GAAP gap is wide: stock comp plus deal amortization means GAAP earnings are currently negative
- Headline growth quality: $1.6B of the $8.1B NGS ARR is acquired, and FY2027 organic comps will be scrutinized
- Hardware-attached legacy base (~20% of revenue) grows slowly and is cyclical
- Two mega-integrations at once is an unforced concentration of execution risk
- Valuation embeds sustained acceleration — the ~5% drop on an FQ3 beat shows how demanding expectations are, even though shares hit an all-time high a month later
Bottlenecks
- Integration bandwidth — absorbing CyberArk (112M shares issued) plus Chronosphere simultaneously constrains product and GTM velocity through FY2027
- Sales-force capacity to cross-sell identity into the installed base without disrupting CyberArk's existing motion
- GAAP margin recovery gated by amortization of ~$6.9B of acquired identified intangibles (CyberArk $6.3B + Chronosphere $0.6B; goodwill now $21.9B) and elevated stock comp
- Organic new-logo growth in a penetrated large-enterprise market — growth increasingly depends on wallet share, not new seats
Top signals & trends
Top signals
Reported 2026-06-02
Initial sell-the-news after a ~60% YTD run; sentiment recovered within weeks — expectations remain demanding
Strategic pillar secured but heavy dilution; watch retention of CyberArk customers and talent
$1.6B of ARR and $1.8B of RPO are acquired; organic ARR growth roughly mid-20s-30s%
Cash economics improving through the M&A digestion
Deal-charge driven and expected, but prolonged GAAP losses would pressure the multiple
Trends
CISOs cutting tool sprawl structurally favors the broadest platforms; PANW is the primary pure-play beneficiary
Directly monetized via CyberArk machine identity, AI Runtime Security, AgentiX; core of the bull thesis
Compresses pricing in commodity layers and contests cloud security
XSIAM displacing Splunk/QRadar estates is PANW's fastest organic growth engine
Prisma Access rides branch-firewall-to-cloud migration, though it cannibalizes some appliance revenue
Rising breach costs and SEC disclosure rules make security spend non-discretionary
Ecosystem & competitor graph
Suppliers feed the company; customers pull from it. Line thickness shows the strength of each tie (supply-chain dependency, customer earnings contribution). Hover to isolate a tie.
Primary cloud infrastructure for Cortex/Prisma data plane
Cloud infrastructure and marketplace channel
Cloud infrastructure and marketplace channel (also chief competitor)
GPU compute for Precision AI plus AI-security co-development partnership
x86 silicon in firewall appliances
Outsourced appliance manufacturing (capital-light hardware model)
Company has cited 80,000+ customers incl. the majority of the Fortune 100; no single-customer concentration
FedRAMP High footprint; growing sovereign-security demand
Chronosphere's observability base (AI/cloud-native firms, $160M+ ARR at acquisition) is a new customer wedge
Rival consolidation platform from the endpoint/SecOps side; Falcon vs XSIAM is the marquee SOC battle
Largest security vendor by revenue; bundles Defender/Sentinel/Entra into E5, competing across every PANW pillar including identity
Closest firewall/SASE rival with a price-performance (custom ASIC) angle, strong in mid-market and OT
Pure-play SSE/SASE leader competing directly with Prisma Access
Wiz acquisition makes Google a top CNAPP competitor to Cortex Cloud; also a PANW infrastructure supplier
Networking incumbent with Splunk SIEM — both a firewall rival and the estate XSIAM most often displaces
Identity/IAM leader now squarely competitive post-CyberArk (workforce identity, privileged access ambitions)
Legacy firewall peer, slower growth but entrenched installed base
AI-native endpoint/SecOps challenger
Observability leader — now a direct competitor after PANW's Chronosphere acquisition
Zero-trust/SASE challenger from the edge-network side
SSE pure-play (IPO'd on Nasdaq in 2025) competing in SASE