Palo Alto Networks
A maker of firewalls, the machines that inspect every connection in and out of a company's network, now buying its way into identity and monitoring software.
Our viewUnattractive Medium conviction
The scores
The profile · 1-4
Growth3/4 →
Fast, but the pro forma table and the platform guide both put the underlying rate near 15%. Growth that was bought scores 3.
Business quality3/4 →
Standardisation makes the next product a setting rather than a purchase, and rivals lose contracts. But Microsoft bundles the newest half away.
Financial position4/4 →
Net cash, an undrawn facility, no maturity inside the horizon, and the only borrowing is a zero-coupon note that turns into shares.
Execution record3/4 →
Revenue expectations beaten eight quarters running; synergies said to be early. Capital allocation is untested: CyberArk's price is audited, its allocation still provisional.
Per share capture2/4 ↓
152 million shares issued in nine months against 7 million retired. Cash flow per share still rises, which is why this is not 1.
Potential2/4 →
The 2030 recurring-revenue target needs about $11 billion nobody has signed, and Microsoft controls part of whether the identity half happens.
Risk profile3/4 ↓
No end-customer above 10%, but two distributors carry 30% of revenue and China opened a formal review of the products in August.
Valuation2/4 ↓
The price assumes the plan works and the per-share line re-accelerates beyond it. Little is left if the share count keeps rising.
Evidence quality3/4 →
Central figures are in the audited 10-K and cross-checked against four rivals' own filings. The platform split and the synergy claims are management's alone.
The bet · 2-3 years
Priced for success0.5×
If it works 0.5× · if it fails you keep about 51%.
The Verdict
We rate Palo Alto Networks unattractive. It sells the firewalls that check a company's network traffic plus security software, and it is a solid business. But much of its growth is bought: it paid for CyberArk mostly with new shares, so sales are guided to grow much faster than each share's slice of the cash. The price is full: it is set by the fast sales growth, while a shareholder owns only the slower growth per share. As a bet it is priced for success: even if its security for AI agents grows as hoped, the shares are worth about half of today's price.
The long caseIf every company runs fleets of AI agents, each one needs guarding, and the firm already inspecting their traffic can sell that protection on top.
The evidence under this - 9 claims
C06facthigh confidence
Palo Alto closed six acquisitions in and immediately after fiscal 2026: CyberArk, Chronosphere, Koi Security, Portkey, Embrace and Console.
sourceQ4 and full-year fiscal 2026 results release (Form 8-K,…primaryQ4 fiscal 2026 earnings call transcriptprimaryForm 10-Q, quarter ended 30 April 2026primaryForm 10-K for the fiscal year ended 31 July 2026primary
- 2026-09-26editedRe-sourced to the fiscal 2026 10-K, which states Portkey's closing date the earlier sources left out.
C04facthigh confidence
Palo Alto acquired CyberArk on 11 February 2026 for $21,061m - $2,308m of cash, 112 million shares worth $18,488m, and $265m of replacement awards.
C01facthigh confidence
Fiscal 2026 revenue was $11,480m, up 24.5% from $9,221m in fiscal 2025.
C03facthigh confidence
Counting Chronosphere and CyberArk in both years, revenue for the nine months to 30 April 2026 grew 17.4%, to $8,917m from $7,598m, and grew 16.1% in Q3 2026.
C10estimatehigh confidence
The fiscal 2027 guide implies earnings per share growing about 8.7% on revenue growing about 23.3%, with the diluted share count growing about 10.7%.
derivedMidpoints of C09 against the fiscal 2026 actuals in C08: $4.175 against $3.84; $14.15B against $11.48B; 845.5 million shares against 764 million.
against this
- The implied non-GAAP net income grows about 20.4%, so the business's profit is compounding close to its revenue; only the per-share line is not.
- Fiscal 2027 carries a full year of CyberArk against about five and a half months in fiscal 2026, so part of the share-count rise buys profit that was not in the base.
C31estimatemedium confidence
At $393.30 the market pays about 62 times the adjusted free cash flow per share the company guides for fiscal 2027, for a figure it guides to grow about 10% a share.
against this
- Adjusted free cash flow has been guided conservatively and beaten each of the last four years, so $6.36 may prove low.
- Free cash flow is flattered by deferred revenue on a growing subscription book, and by the fact that a seventh of the workforce's pay is settled in shares rather than cash - the same shares that make the per-share denominator rise.
- 2026-09-24editedRe-struck at the 2026-09-23 close; the shares rose about 18% since the thesis.
C29estimatemedium confidence
Weighted by their fiscal 2026 revenue, those platform guides imply about 15% growth on a like-for-like base, against a headline revenue guide of 23% to 24%.
derivedC27 and C28: $8.35B growing 10% to 12%, $1.92B growing 30% and $1.26B growing 19%, over a combined base of $11.53B, gives 14% to 16%. The headline guide compares against a fiscal 2026 that contained about five and a half months of CyberArk rather than twelve.
against this
- The calculation excludes the 'Other' category, chiefly professional services, which management reports separately and did not size in the modelling points.
- 'Low double digits' is a band, and at 12% rather than 10% the answer is nearer 16%. The band is management's own word and the arithmetic inherits its vagueness.
- The independent route - the 10-Q pro forma table - puts the same underlying rate at 16% to 17%, one to two points higher.
C26management claimlow confidence
Cortex XSIAM ended fiscal 2026 above $700m of annual recurring revenue growing 70%, observability passed $500m and Prisma AIRS passed $100m within four quarters of general availability.
against this
- The observability figure does not reconcile inside the same call: the chief financial officer said it had more than doubled since the acquisition closed, while the chief executive said Chronosphere was bought at $85m of annual recurring revenue and has passed $500m, which is roughly six times rather than a doubling.
- At least $100m of the observability figure is the single large language model customer migration management separately disclosed.
C09management claimhigh confidence
Fiscal 2027 guidance is revenue of $14.10B to $14.20B, non-GAAP diluted earnings per share of $4.16 to $4.19 on 844 to 847 million shares, non-GAAP operating margin of 29.5% and an adjusted free cash flow margin of 38.0%.
against this
- Revenue guidance has been beaten in each of the last eight reported quarters, so the revenue line is more likely a floor than a ceiling.
- The share count is the half of the guide most within management's control and least likely to be beaten downwards, since six acquisitions closed in the year just ended.
The company
A firewall sits where a company's network meets the internet and inspects every connection, deciding by application and user what may pass. Palo Alto sells it as a box or as cloud software, then sells subscriptions against the same rules: remote access, threat detection, cloud security. It has more than 70,000 customers.
Since this year it also sells a vault for a company's most powerful logins, through CyberArk, and software monitoring, through Chronosphere.
The evidence under this - 2 claims
C60management claimlow confidence
Palo Alto had more than 70,000 customers at the end of fiscal 2026.
- 2026-09-26editedChecked against the fiscal 2026 10-K, which gives no customer count; the claim stays the release's alone.
C34facthigh confidence
Palo Alto's fiscal 2026 annual report names Alphabet, Cisco and Microsoft; Check Point, CrowdStrike, Delinea, Fortinet, Okta, SailPoint and Zscaler; and Datadog, Dynatrace and Elastic as its main competitors - adding three identity and three observability rivals, and no longer naming Wiz.
- 2026-09-24editedThe fiscal 2026 10-K, the first written after CyberArk and Chronosphere closed, names a different set.
How it makes money
Mostly by subscription. Its recurring revenue reached $9.10B a year by July 2026, and customers had signed $21.2B of contracts not yet delivered. It keeps about 70 cents of each sales dollar after direct costs, but after stock pay and deal costs only about 6 cents is operating profit, the least of its listed rivals.
The evidence under this - 5 claims
C21facthigh confidence
Next-generation security annual recurring revenue reached $9.10B at 31 July 2026, up 63%, with nearly $1B added in Q4 2026 alone.
C40facthigh confidence
Remaining performance obligations were $21.2B at 31 July 2026, up 34%, of which $9.3B is expected to convert within twelve months.
C59facthigh confidence
Fiscal 2026 gross margin was 70.4% on the reported accounts against 73.4% a year earlier, while management quoted 75.8% against 76.4% on its own adjusted basis.
C15facthigh confidence
Fortinet earned a 32.4% operating margin and Check Point 29.0% on a trailing twelve-month basis, against Palo Alto's 6.1%.
sourceResearch pack, frozen at content/PANW/research-pack.jsonprimaryFortinet Form 10-K for the year ended 31 December 2025primaryCheck Point Form 20-F for the year ended 31 December 2025primary
against this
- Palo Alto's non-GAAP operating margin was 29.2% in fiscal 2026, so the two figures are struck on different definitions and the gap is what Palo Alto adds back.
- Neither Fortinet nor Check Point has acquired anything remotely the size of CyberArk, so neither carries a comparable acquired-intangible amortisation charge in cost of sales or operating expenses.
C16facthigh confidence
Palo Alto keeps the least of each dollar sold of the five companies in its own filed competitor cohort.
sourceResearch pack, frozen at content/PANW/research-pack.jsonprimaryFortinet Form 10-K for the year ended 31 December 2025primaryCheck Point Form 20-F for the year ended 31 December 2025primaryCrowdStrike Form 10-K for the year ended 31 January 2026primaryZscaler Form 10-K for the year ended 31 July 2026primary
against this
- Management quoted a non-GAAP gross margin of 75.8% for fiscal 2026, which would place it in the middle of the cohort rather than last; the cohort figure is struck on the reported line, which carries acquired-intangible amortisation.
- Palo Alto is the only one of the five that sells a material amount of hardware - about 10% of revenue - and hardware carries a lower gross margin than subscription by construction.
Where the money comes from, stream by stream
| Stream | Share of sales (fiscal 2026) | How it earns it |
|---|---|---|
| Subscription | 54.3% | Cloud-delivered security, secure access, Cortex security operations, Prisma Cloud, identity security and observability, billed over the contract term. |
| Support | 25.8% | Maintenance and technical support contracts attached to firewalls and software, recognised over the support period. |
| Product | 19.9% | Hardware and software firewalls and perpetual software licences, recognised when delivered, sold mostly through distributors and resellers. |
Who runs it
Nikesh Arora has run Palo Alto Networks since 2018, with Dipak Golechha as finance chief since 2021. Under him sales have more than doubled, more and more through buying other companies. Insiders own very little, about 1% between them. Their bonus pays on sales and on a profit margin that leaves out the year's deals; their shares pay on recurring sales, adjusted profit per share and the stock against the market. Nothing pays on keeping the share count down.
The evidence under this - 3 claims
C67facthigh confidence
Nikesh Arora has been chair and chief executive since June 2018, Dipak Golechha chief financial officer since March 2021, William Jenkins president since August 2021, and Lee Klarich, head of product since 2006, chief product and technology officer since August 2025.
C65facthigh confidence
As of 15 September 2025 the 14 directors and executive officers as a group beneficially owned 1.4% of the company; Nikesh Arora held 3,065,694 shares and founder Nir Zuk 3,293,136, each under 1%; Vanguard at 8.2% and BlackRock at 7.3% were the only holders above 5%.
C66facthigh confidence
The fiscal 2025 cash bonus paid on revenue and on an organic operating margin that excludes the year's acquisitions, and paid 120% of target; all named officers' equity was PSUs, paying equally on next-generation security recurring revenue and non-GAAP earnings per share, with a three-year return modifier against the S&P 500, capped at 400%; the fiscal 2025 tranche paid 216%.
against this
- The PSU earnings measure excludes acquisitions closed in the year and adds back stock pay, and the recurring-revenue measure's definition names no exclusion for revenue that was bought, so the plan does not charge executives for the dilution C11 records.
- The board answered shareholder feedback by cutting the PSU maximum from 600% to 400% and raising the return modifier's 1.0x point to the 55th percentile for fiscal 2026 awards.
Why it wins, and who could beat it
Why customers come back
Once a company runs its firewall rules, user directory and security data through one Palo Alto console, the next product is a licence and a setting, and leaving means rewriting every rule.
It shows in who stays and who arrives. Customers on the whole platform spent over 120% of what they spent a year earlier, and in fiscal 2026 it took about $400M of contracts from rivals in nearly 100 accounts, by its own count.
The evidence under this - 3 claims
C52inferencemedium confidence
Once an estate standardises on Palo Alto, the next product is a licence and a setting rather than a procurement, because the policies, keys, directory, agent and telemetry already sit in one console and one data lake.
derivedC24, C25, C26 and C27: retention above 120% on the standardised cohort, rivals losing about 100 accounts, three separate products reaching material scale inside the same base within four quarters of launch, and management's own description of the mechanism on the call.
against this
- Every evidence point is the company's own and none of the four rivals discloses anything comparable, so the mechanism is asserted from one origin.
- Palo Alto has had to buy each of the adjacent products rather than build them, which is what a weaker platform pull looks like: if standardisation sold the next product on its own, a $21.1B acquisition to enter identity would not have been necessary.
- It keeps the least of each dollar sold of the five in its own cohort, which is not what an unassailable position usually looks like.
C24management claimmedium confidence
Net revenue retention exceeded 120% for the platformized customer cohort in Q4 2026.
against this
- It is a self-selected cohort - customers who have already standardised - so it measures the customers who did not leave rather than the whole base, and no company-wide retention figure is given.
- None of the four rivals in the filed cohort discloses a comparable figure, so it cannot be read against anything.
C25management claimmedium confidence
In fiscal 2026 Palo Alto displaced legacy incumbents in nearly 100 accounts representing over $400m of total contract value, close to double the prior year, and secure access bookings grew 40%.
against this
- Total contract value spans several years, so $400m is not $400m of annual revenue and the release does not say over how many years it is spread.
- The figure was corrected live on the call - the analyst asked about $450m, the chief executive said 400 and then 54 - so the precise number was not settled on the record.
The threat
Each rival attacks one piece. Microsoft bundles identity and threat detection into subscriptions companies already pay for. Zscaler's annual report argues firewalls expose companies to needless risk, and routes traffic through its cloud instead. CrowdStrike gathers the same security data through the agent already on every laptop. None of them sells the firewall box itself.
The evidence under this - 4 claims
C36facthigh confidence
Microsoft reports three segments, none of them security, and discloses no security revenue line at all.
C35facthigh confidence
Zscaler's own annual report states that firewalls and VPNs force enterprises to trust traffic, exposing them to unnecessary risk.
against this
- It is a competitor's marketing inside a filing, and Zscaler earned no operating profit in the year it wrote it.
- Palo Alto's own secure access bookings grew 40% in the same fiscal year and it took contracts off incumbents in about 100 accounts, so the buyer is not obviously choosing the architecture over the vendor.
C37facthigh confidence
CrowdStrike sells a subscription security platform built on one endpoint sensor and names network security vendors and legacy SIEM vendors among its competitors.
C34facthigh confidence
Palo Alto's fiscal 2026 annual report names Alphabet, Cisco and Microsoft; Check Point, CrowdStrike, Delinea, Fortinet, Okta, SailPoint and Zscaler; and Datadog, Dynatrace and Elastic as its main competitors - adding three identity and three observability rivals, and no longer naming Wiz.
- 2026-09-24editedThe fiscal 2026 10-K, the first written after CyberArk and Chronosphere closed, names a different set.
The rivals: MSFT, ZS, ZS, CRWD, GOOGL, CHKP, FTNT, CSCO, OKTA, SAIL, DDOG, DT, ESTC.
Who else does this, rival by rival
| Ticker | Rival | Where it competes | How far along | Priced against it |
|---|---|---|---|---|
| MSFT | Microsoft Entra ID and Microsoft DefenderPriced against it: One segment only | Network security, Cortex and Idira | On sale | One segment only |
| ZS | Zscaler Zero Trust ExchangePriced against it: Yes | Network security, Cortex and Idira | On sale | Yes |
| Zscaler Security for AI | Security for AI agents | On sale | ||
| CRWD | CrowdStrike Falcon and its next-generation SIEM modulesPriced against it: Yes | Network security, Cortex and Idira | On sale | Yes |
| GOOGL | Wiz, now owned by AlphabetPriced against it: One segment only | Network security, Cortex and Idira | On sale | One segment only |
| CHKP | Check Point Software TechnologiesPriced against it: Yes | - | On sale | Yes |
| FTNT | FortinetPriced against it: Yes | - | On sale | Yes |
| CSCO | Cisco SystemsPriced against it: One segment only | - | On sale | One segment only |
| OKTA | OktaPriced against it: One segment only | - | On sale | One segment only |
| SAIL | SailPointPriced against it: One segment only | - | On sale | One segment only |
| DDOG | DatadogPriced against it: One segment only | - | On sale | One segment only |
| DT | DynatracePriced against it: One segment only | - | On sale | One segment only |
| ESTC | ElasticPriced against it: One segment only | - | On sale | One segment only |
How big it could get
How big this could get
The four listed rivals Palo Alto names took in $17.69B in their latest years, against Palo Alto's own $11.48B. Only $9.53B of that sits at rivals earning an operating profit. The pool moves slowly: its best year of winning accounts took about $400M of contracts. Microsoft, Cisco and Alphabet report no security revenue, so their share cannot be counted.
The evidence under this - 4 claims
C38facthigh confidence
The four listed rivals Palo Alto names had combined latest-filed annual revenue of $17.69B, of which the two that earn an operating profit - Fortinet and Check Point - produced $2.92B of it on $9.53B of sales.
C01facthigh confidence
Fiscal 2026 revenue was $11,480m, up 24.5% from $9,221m in fiscal 2025.
C53facthigh confidence
Zscaler and CrowdStrike, two of the four listed rivals Palo Alto names, earned no operating profit in their latest filed fiscal years.
C25management claimmedium confidence
In fiscal 2026 Palo Alto displaced legacy incumbents in nearly 100 accounts representing over $400m of total contract value, close to double the prior year, and secure access bookings grew 40%.
against this
- Total contract value spans several years, so $400m is not $400m of annual revenue and the release does not say over how many years it is spread.
- The figure was corrected live on the call - the analyst asked about $450m, the chief executive said 400 and then 54 - so the precise number was not settled on the record.
Where the growth is coming from, business by business
Where the growth is coming from
| Business | Share of revenue | Growth: last quarter | Last half-year | Last year | Share in 3 years at its half-year rate |
|---|---|---|---|---|---|
| Subscription | 54% | +32.2% | +23.0% | +20.4% | 54% |
| Support | 26% | +28.9% | +20.5% | +15.7% | 24% |
| Product | 20% | +31.2% | +26.7% | +22.3% | 22% |
| Whole company | 100% | +31.1% | +23.1% | +19.5% | 100% |
On the filed split through 2026-04-30, if each business keeps its last half-year's growth, the company grows about 23% next year and 23% in year 3, against 24.5% over the last twelve months. A scenario, not a forecast: no business holds its rate.
The results
The numbers
Is it growing?Steady
Sales grew 24% in the year to Jul 2026, faster than the 15% in the year before.
Is it profitable?Thin
Operating margin is 6.1%, about where it was (5.6%) in the year to Jul 2023.
Does growth pay off?Pays off
Running costs take 64¢ of each sales dollar, down from 72¢ in the year to Jul 2022.
Does it earn good returns?Low
Each dollar put into the business earns 2.3% a year after tax, down from 7.9% in the year to Jul 2023.
Is it making cash?Strong
It turned 36% of sales into free cash, $4.11B over the year.
How steady is it?Steady
Yearly sales growth has ranged from +15% to +29% over the last 5 years.
Are shares being diluted?Diluting
The share count rose 158% in 4.0 years, and pay in shares costs 16% of sales.
All the numbers
Filed figures from the company's 10-K and 10-Q, read 2026-10-04. Fiscal years end in July.
| Jul 2022 | Jul 2023 | Jul 2024 | Jul 2025 | Jul 2026 | |
|---|---|---|---|---|---|
| Size and growth | |||||
| Sales | $5.50B | $6.89B | $8.03B | $9.22B | $11.5B |
| Sales growth | +29% | +25% | +16% | +15% | +24% |
| Profit | |||||
| Gross margin | 69% | 72% | 74% | 73% | 70% |
| Operating margin | −3.4% | 5.6% | 8.5% | 13% | 6.1% |
| Net margin | −4.9% | 6.4% | 32% | 12% | 2.7% |
| What growth costs, per sales dollar | |||||
| Research and development | 26% | 23% | 23% | 22% | 22% |
| Sales and marketing | 39% | 37% | 35% | 34% | 34% |
| General and admin | 7.4% | 6.5% | 8.5% | 4.8% | 7.8% |
| Pay in shares | 18% | 16% | 13% | 14% | 16% |
| Capital spending | 3.5% | 2.1% | 2.0% | 2.7% | 3.8% |
| Cash | |||||
| Cash from operations | $1.98B | $2.78B | $3.26B | $3.72B | $4.55B |
| Free cash flow | $1.79B | $2.63B | $3.10B | $3.47B | $4.11B |
| Balance sheet | |||||
| Cash and short-term investments | $3.63B | $2.39B | $2.58B | $2.90B | $3.07B |
| Debt | $3.68B | $1.99B | - | - | - |
| Net cash | −$42.3M | $398M | - | - | - |
| Returns and shares | |||||
| Return on capital | - | 7.9% | 15% | 14% | 2.3% |
| Shares (diluted) | 296M | 684M | 708M | 709M | 764M |
What growth costs
While the company grew on its own, each new dollar of sales cost less to win, and the profit margin widened year after year. The latest year reversed that: the companies it bought brought losses, severance and deal costs, and the reported margin fell back. Management's adjusted margin, which leaves those out, barely moved.
The evidence under this - 2 claims
C69facthigh confidence
Per sales dollar, sales and marketing fell from 41.2 cents in fiscal 2021 to 33.6 in fiscal 2025, research and development from 26.8 to 21.5 and stock pay from 21.8 to 14.1, while operating margin rose from -7.1% to 13.5%; in fiscal 2026 general and administrative rose from 4.8 to 7.8 cents and operating margin fell to 6.1%.
sourceForm 10-K for the fiscal year ended 31 July 2026primaryForm 10-K for the fiscal year ended 31 July 2025primaryForm 10-K for the fiscal year ended 31 July 2023primary
against this
- The 10-K puts fiscal 2026's general and administrative rise on accelerated vesting tied to the acquisitions, CyberArk severance and deal costs, and the acquired businesses ran at an operating loss (C57), so the reversal is the purchases rather than the organic cost base.
- On management's adjusted basis the margin is close to flat: 29.2% in fiscal 2026 against 29.5% guided for fiscal 2027 (C09).
C57facthigh confidence
Between their acquisition dates and 30 April 2026 the Chronosphere and CyberArk acquisitions added $388m of revenue and a $523m operating loss in Q3 2026 as reported.
The last report (1 Sep)
Quarter ended July 2026, filed figures.
34%
Sales growth
against the same quarter a year earlier
13.6%
Growth from the quarter before
against 15.7% the quarter before that
5¢
Operating profit
per dollar of sales
The fourth quarter of fiscal 2026, to July, looked strong: revenue up 34% and recurring revenue up 63%, with nearly $1B added in three months. Much of it arrived with the companies it bought, and a nine-figure slice came from one large AI customer moving to Chronosphere, which management says fades after the next quarter.
For the full year, adjusted earnings per share landed at $3.84, inside the range set before any of the buying. Next quarter's revenue is guided below this one's.
What it did to the thesisIt backed our view that the growth is mostly bought. Strip out the purchased companies and one large customer, and the business grows more slowly, while new shares keep diluting each owner. The price pays for headline growth that per-share earnings do not match.
The quarter in detail
Sales growth from the previous quarter, filed figures. The company has restated its own history, so a quarter either side of the restatement may describe a different business; n/c marks one that does not compare.
Earnings per share $1.02 against $0.98 expected.
The evidence under this - 7 claims
C02facthigh confidence
Q4 2026 revenue was $3,410m, up 34% year on year, and next-generation security annual recurring revenue reached $9.10B, up 63%.
C21facthigh confidence
Next-generation security annual recurring revenue reached $9.10B at 31 July 2026, up 63%, with nearly $1B added in Q4 2026 alone.
C61facthigh confidence
The Q3 2026 results release states that $1.6B of the $8.1B of next-generation security recurring revenue came from CyberArk and Chronosphere, along with $1.8B of the $18.4B of remaining performance obligations and $388m of the quarter's $3.0B of revenue.
C22management claimmedium confidence
Fiscal 2026 net new next-generation security annual recurring revenue included a nine-figure benefit from one large language model customer migrating to Chronosphere from an incumbent vendor, with the tail running through Q1 2027 and then contributing less.
against this
- Management volunteered this rather than being asked, which is the disclosure a company makes when it expects the comparison to be raised later.
- Nine figures is at least $100m of a Q4 total of about $1B, so one customer is at least a tenth of the record quarter, and the customer is an artificial-intelligence laboratory buying consumption-based observability - the least contractually sticky revenue in the portfolio.
C08facthigh confidence
Fiscal 2026 delivered revenue of $11,480m and non-GAAP diluted earnings per share of $3.84 on 764 million diluted shares.
C07facthigh confidence
The fiscal 2026 guidance issued on 18 August 2025, before CyberArk was acquired, was revenue of $10.475B to $10.525B and non-GAAP diluted earnings per share of $3.75 to $3.85 on 710 to 716 million shares.
C51facthigh confidence
Q1 fiscal 2027 revenue is guided to $3.300B to $3.310B, below the $3.410B just reported, and remaining performance obligations to $20.8B to $20.9B, below the $21.2B just reported.
What management did with the money
It paid in shares. Shares outstanding rose from 668M to 813M in nine months, most of them for CyberArk, and 27 million settled old warrants and brought in no cash. The chief executive bought 68,085 shares in March, at about $147.
Insiders in 2026Q2: 0 purchases and 41 sales, from their Form 4 filings.
The evidence under this - 4 claims
C11facthigh confidence
Shares outstanding rose from 668 million at 31 July 2025 to 813 million at 30 April 2026: 152 million issued and 7 million retired for $1,000m.
C12facthigh confidence
27 million of those shares settled the 2025 Warrants and brought in no cash; the 10-Q states their fair value was $5.6B.
C04facthigh confidence
Palo Alto acquired CyberArk on 11 February 2026 for $21,061m - $2,308m of cash, 112 million shares worth $18,488m, and $265m of replacement awards.
C58facthigh confidence
The chief executive bought 68,085 shares on the open market on 27 March 2026 at about $147, against 93 open-market sales by insiders across the year.
The price, and where we disagree
In short. Full. A strong business, priced for its headline sales growth. But an owner gets each share's slice of the cash, and that grows at less than half the rate, because new shares keep being issued.
Share price
$393.30
close,
Price for each $1 of spare cash
72.8
rivals' middle 41.5
Spare cash as a share of the price
1.4%
its 6-year normal 3.2%
The shares have climbed to about 62 times next year's guided cash per share, roughly twice their own normal against sales. The next check is the first-quarter results on 18 November: whether new recurring revenue holds up without the one large migration, and whether the share count guide stays at 844 to 847 million.
The evidence under this - 4 claims
C31estimatemedium confidence
At $393.30 the market pays about 62 times the adjusted free cash flow per share the company guides for fiscal 2027, for a figure it guides to grow about 10% a share.
against this
- Adjusted free cash flow has been guided conservatively and beaten each of the last four years, so $6.36 may prove low.
- Free cash flow is flattered by deferred revenue on a growing subscription book, and by the fact that a seventh of the workforce's pay is settled in shares rather than cash - the same shares that make the per-share denominator rise.
- 2026-09-24editedRe-struck at the 2026-09-23 close; the shares rose about 18% since the thesis.
C56facthigh confidence
Palo Alto costs about twice as much for each dollar of sales as its own six-year median, and its free cash flow yield is about half its own six-year median.
sourceResearch pack, frozen at content/PANW/research-pack.jsonprimaryQ4 and full-year fiscal 2026 results release (Form 8-K,…primary
against this
- The company is a materially different one from the six-year average: it now sells identity and observability, which it did not, and its recurring revenue mix is higher.
- Much of the multiple expansion happened alongside a real re-rating of the whole group - the shares are up about 72% over 252 sessions against a cohort median return that was slightly negative.
C22management claimmedium confidence
Fiscal 2026 net new next-generation security annual recurring revenue included a nine-figure benefit from one large language model customer migrating to Chronosphere from an incumbent vendor, with the tail running through Q1 2027 and then contributing less.
against this
- Management volunteered this rather than being asked, which is the disclosure a company makes when it expects the comparison to be raised later.
- Nine figures is at least $100m of a Q4 total of about $1B, so one customer is at least a tenth of the record quarter, and the customer is an artificial-intelligence laboratory buying consumption-based observability - the least contractually sticky revenue in the portfolio.
C09management claimhigh confidence
Fiscal 2027 guidance is revenue of $14.10B to $14.20B, non-GAAP diluted earnings per share of $4.16 to $4.19 on 844 to 847 million shares, non-GAAP operating margin of 29.5% and an adjusted free cash flow margin of 38.0%.
against this
- Revenue guidance has been beaten in each of the last eight reported quarters, so the revenue line is more likely a floor than a ceiling.
- The share count is the half of the guide most within management's control and least likely to be beaten downwards, since six acquisitions closed in the year just ended.
The betPriced for success
If it works
0.5×
from today's value, at the stated multiple
If it fails
keep 51%
of today's market value: the rest of the company, less its debt
How we read the multiple
Buyers pay about 73 times last year's spare cash, and about 62 times what the company forecasts per share for fiscal 2027. But:
- Sales are forecast to grow about 23%.
- Cash per share, only about 10%: the share count keeps rising, by about 11%.
- Count share pay to staff as a cost and last year's cash falls to about $2.4B; the price is about 113 times that.
- To be worth today's price, cash per share must grow as fast as sales, and new shares must stop.
Against its own history. Much dearer than its own normal against sales and cash, just as the growth each share receives has slowed.
The evidence under this - 6 claims
C31estimatemedium confidence
At $393.30 the market pays about 62 times the adjusted free cash flow per share the company guides for fiscal 2027, for a figure it guides to grow about 10% a share.
against this
- Adjusted free cash flow has been guided conservatively and beaten each of the last four years, so $6.36 may prove low.
- Free cash flow is flattered by deferred revenue on a growing subscription book, and by the fact that a seventh of the workforce's pay is settled in shares rather than cash - the same shares that make the per-share denominator rise.
- 2026-09-24editedRe-struck at the 2026-09-23 close; the shares rose about 18% since the thesis.
C10estimatehigh confidence
The fiscal 2027 guide implies earnings per share growing about 8.7% on revenue growing about 23.3%, with the diluted share count growing about 10.7%.
derivedMidpoints of C09 against the fiscal 2026 actuals in C08: $4.175 against $3.84; $14.15B against $11.48B; 845.5 million shares against 764 million.
against this
- The implied non-GAAP net income grows about 20.4%, so the business's profit is compounding close to its revenue; only the per-share line is not.
- Fiscal 2027 carries a full year of CyberArk against about five and a half months in fiscal 2026, so part of the share-count rise buys profit that was not in the base.
C32estimatemedium confidence
Charging fiscal 2026's $1,712m of share-based compensation against free cash flow leaves about $2,401m, roughly 113 times the market value.
derivedC14 and C30 against the pack's market value of $272.0B on 8 September 2026: $4,113m less $1,712m.
against this
- Every listed software company of this size settles a large part of pay in shares, so charging it against cash penalises Palo Alto against a peer group scored the same way - the cohort's price-to-free-cash-flow figures are all struck before it.
- Share-based compensation is partly a recruiting cost that would otherwise be cash salary, so the whole of it is not incremental dilution.
C56facthigh confidence
Palo Alto costs about twice as much for each dollar of sales as its own six-year median, and its free cash flow yield is about half its own six-year median.
sourceResearch pack, frozen at content/PANW/research-pack.jsonprimaryQ4 and full-year fiscal 2026 results release (Form 8-K,…primary
against this
- The company is a materially different one from the six-year average: it now sells identity and observability, which it did not, and its recurring revenue mix is higher.
- Much of the multiple expansion happened alongside a real re-rating of the whole group - the shares are up about 72% over 252 sessions against a cohort median return that was slightly negative.
C33facthigh confidence
Palo Alto costs more for each dollar of free cash flow than every rival its own annual report names except CrowdStrike.
sourceResearch pack, frozen at content/PANW/research-pack.jsonprimaryQ4 and full-year fiscal 2026 results release (Form 8-K,…primary
against this
- The cohort median is dragged down by Check Point, which grew revenue 4.6% in its last filed year - a fifth of Palo Alto's rate - so the median mixes businesses with very different growth.
- The two members growing near Palo Alto's rate, CrowdStrike and Zscaler, earned no operating profit at all in their latest filed years.
- The rivals the annual report names changed with the fiscal 2026 10-K - Okta, SailPoint, Delinea, Datadog, Dynatrace and Elastic added, Wiz dropped - so the comparison was drawn against the fiscal 2025 list and has to be re-drawn.
- 2026-09-24editedCounter-evidence added: the named rival set changed with the fiscal 2026 10-K.
C54inferencehigh confidence
Palo Alto is the only company in its own filed cohort that both grew above 20% and earned a positive operating profit in the latest filed year.
derivedC01, C13, C38 and C53 read against the pack's cohort table: Fortinet grew 18.8% at a 32.4% margin, Check Point 4.6% at 29.0%, CrowdStrike 24.3% and Zscaler 25.4% both at a negative margin, Palo Alto 24.5% at 6.1%.
against this
- Palo Alto's 24.5% growth is itself largely bought, so the comparison flatters it against two rivals that grew at a similar rate without a $21.1B acquisition.
- A 6.1% operating margin is a positive number and not much more; on the measure that matters to a buyer of the shares, cash generation, all four rivals are profitable.
Priced against its rivals
The competitors its own annual report names, each confirmed against the rival's filing. Measured on price for each $1 of spare cash, cheapest first:
| Ticker | Company | price for each $1 of spare cash |
|---|---|---|
| CHKP | Check Point Software Technologies | 12.4× |
| ZS | Zscaler | 40.7× |
| FTNT | Fortinet | 42.3× |
| PANW | Palo Alto Networks | 72.8× |
| CRWD | CrowdStrike Holdings | 169.9× |
The middle of the other 4 is 41.5. Palo Alto Networks, Inc. is 2nd dearest of 5.
Rivals' figures come from a data provider, so read the spread of the group rather than any single pair.
Dearer than every named rival but one on cash, though it is the only one growing fast with a profit, so part of the gap is earned.
Private or foreign rivals that cannot be priced: Delinea Inc.
The bet: what it pays if it works
The bet is on Palo Alto's security for AI agents: Prisma AIRS and the agent tools it bought this year. The rest of the company is counted apart, at the price this thesis would call attractive.
If AI security keeps growing the way its best product does, the shares are still worth about half of today's price, because the price already pays far more for it than that is worth. If it never earns, shareholders keep the rest, about half of today's value.
| Security for AI agents revenue in two to three years | Customers at today's average AI security spend needed | At the stated multiple |
|---|---|---|
| $250.00M | about 2.0K at 100% kept | 0.5× |
| $500.00M (the big win) | about 4.0K at 100% kept | 0.5× |
| $800.00M | about 6.4K at 100% kept | 0.5× |
To pay 2× (a Fair bet) it would need about $39.74B of Security for AI agents revenue (about 317.9K customers at today's average AI security spend); to pay 5× (a Cheap bet), about $119.51B of Security for AI agents revenue (about 956.0K customers at today's average AI security spend), at the same multiple.
Each row is Security for AI agents alone, plus the rest of the company (Network security, Cortex and Idira) counted at about $161.31B.
The steps it has to take
- Done Prisma AIRS generally available and past $100M of recurring revenue
- Done Koi and Portkey bought for agent security on laptops and at an AI gateway
- Not started Prisma AIRS reaches about $250M of recurring revenue due 2027-07
- Not started AI security revenue disclosed apart from the platforms due 2027-09
- Not started AI security reaches about $500M a year due 2029-07
The detail behind the label
Rating
Expensive
the big win's payoff against the 2× and 5× lines
Cheap bet at about
$41.25
90% below the price (close, )
The option
0.0×
what Security for AI agents is worth if it works, against what the price pays for it
The evidence under this - 5 claims
C26management claimlow confidence
Cortex XSIAM ended fiscal 2026 above $700m of annual recurring revenue growing 70%, observability passed $500m and Prisma AIRS passed $100m within four quarters of general availability.
against this
- The observability figure does not reconcile inside the same call: the chief financial officer said it had more than doubled since the acquisition closed, while the chief executive said Chronosphere was bought at $85m of annual recurring revenue and has passed $500m, which is roughly six times rather than a doubling.
- At least $100m of the observability figure is the single large language model customer migration management separately disclosed.
C70management claimlow confidence
On the Q4 fiscal 2026 call management said Prisma AIRS has more than 800 customers, that most of the largest Q4 deals bought several of its modules, that a payments platform committed high seven figures to it inside a $53 million platform deal, and that the Koi agentic-endpoint product has over 100 customers, 2.5 times as many as when its integration finished.
against this
None of these counts is filed: the 10-K reports one segment and splits revenue only into subscription, support and product (C64, C72).
C72facthigh confidence
Palo Alto's fiscal 2026 10-K describes Prisma AIRS as an AI security platform that discovers, assesses and protects AI agents, applications, models and data, combining an AI gateway, agent security, red teaming, runtime and model security; Koi, bought in April 2026, adds agentic endpoint security. The 10-K states no revenue for any of them.
C09management claimhigh confidence
Fiscal 2027 guidance is revenue of $14.10B to $14.20B, non-GAAP diluted earnings per share of $4.16 to $4.19 on 844 to 847 million shares, non-GAAP operating margin of 29.5% and an adjusted free cash flow margin of 38.0%.
against this
- Revenue guidance has been beaten in each of the last eight reported quarters, so the revenue line is more likely a floor than a ceiling.
- The share count is the half of the guide most within management's control and least likely to be beaten downwards, since six acquisitions closed in the year just ended.
C31estimatemedium confidence
At $393.30 the market pays about 62 times the adjusted free cash flow per share the company guides for fiscal 2027, for a figure it guides to grow about 10% a share.
against this
- Adjusted free cash flow has been guided conservatively and beaten each of the last four years, so $6.36 may prove low.
- Free cash flow is flattered by deferred revenue on a growing subscription book, and by the fact that a seventh of the workforce's pay is settled in shares rather than cash - the same shares that make the per-share denominator rise.
- 2026-09-24editedRe-struck at the 2026-09-23 close; the shares rose about 18% since the thesis.
Where we disagree with the market
The market believes
Artificial-intelligence spending is speeding up a security leader; 65 of 89 analysts say buy.
We believe
The headline growth is bought. Underlying growth is about 15%, and per share about 9%.
The disclosures that show it sit outside the headline numbers: a table in the quarterly filing counting the bought companies in both years, and the growth management guides for each business, which weighted together comes to about 15%.
The case against us: if identity and security-operations sales keep growing above 20% once CyberArk is in both years, and the share count stops rising, cash per share would speed up and the market would be right.
What analysts say, and the evidence
Analysts positive
76%
of 58, 1 Sep
Four months earlier
79%
of 57, 1 May
The evidence under this - 5 claims
C03facthigh confidence
Counting Chronosphere and CyberArk in both years, revenue for the nine months to 30 April 2026 grew 17.4%, to $8,917m from $7,598m, and grew 16.1% in Q3 2026.
C29estimatemedium confidence
Weighted by their fiscal 2026 revenue, those platform guides imply about 15% growth on a like-for-like base, against a headline revenue guide of 23% to 24%.
derivedC27 and C28: $8.35B growing 10% to 12%, $1.92B growing 30% and $1.26B growing 19%, over a combined base of $11.53B, gives 14% to 16%. The headline guide compares against a fiscal 2026 that contained about five and a half months of CyberArk rather than twelve.
against this
- The calculation excludes the 'Other' category, chiefly professional services, which management reports separately and did not size in the modelling points.
- 'Low double digits' is a band, and at 12% rather than 10% the answer is nearer 16%. The band is management's own word and the arithmetic inherits its vagueness.
- The independent route - the 10-Q pro forma table - puts the same underlying rate at 16% to 17%, one to two points higher.
C10estimatehigh confidence
The fiscal 2027 guide implies earnings per share growing about 8.7% on revenue growing about 23.3%, with the diluted share count growing about 10.7%.
derivedMidpoints of C09 against the fiscal 2026 actuals in C08: $4.175 against $3.84; $14.15B against $11.48B; 845.5 million shares against 764 million.
against this
- The implied non-GAAP net income grows about 20.4%, so the business's profit is compounding close to its revenue; only the per-share line is not.
- Fiscal 2027 carries a full year of CyberArk against about five and a half months in fiscal 2026, so part of the share-count rise buys profit that was not in the base.
C27management claimmedium confidence
Revenue by platform in fiscal 2026 was $8.35B for Network and AI Security, up 17%; $1.92B for Cortex, up 25%; and $1.26B on a pro forma basis for Idira, up 21%.
against this
- The split exists only on an earnings call and in a slide appendix. The Q3 2026 10-Q's XBRL instance carries no business-segment axis, and the fiscal 2026 10-K disaggregates revenue only into product, subscription and support, so no filing corroborates the $8.35B, $1.92B and $1.26B and no auditor has seen them.
- Management chose the perimeter, and it flatters the largest platform: the certificate-lifecycle business acquired with CyberArk was placed inside Network and AI Security rather than Idira, contributing about $85m to the platform whose 17% growth the argument then reads as organic.
- The Idira figure is stated pro forma for a full year of a business Palo Alto owned for about five and a half months.
- 2026-09-26editedChecked against the fiscal 2026 10-K, which splits revenue only by product, subscription and support; the platform split is still unfiled.
C28management claimmedium confidence
For fiscal 2027 management guides Network and AI Security to low-double-digit growth, Cortex to about 30%, and Idira to about $1.5B at high-teens to 20% growth on a pro forma basis.
against this
- Network and AI Security grew 17% in fiscal 2026, so the guide implies its largest business decelerates by roughly a third - which management framed as continued above-market growth rather than as a slowdown.
- These were offered as modelling points rather than guidance, and management said explicitly it does not intend to guide revenue by platform, so nothing binds them.
What could go wrong, and how we would know
The risks
- Profit that depends on add-backs. Official operating profit was $695M in fiscal 2026; the adjusted figure adds back $1.71B of stock pay among other items.
- The next deal. Six acquisitions in one year; another paid in shares would push the count higher again.
- More bought than owned. Goodwill of $22.0B and acquired intangibles of $7.0B leave it with negative tangible net worth.
- A review in China. China's cyberspace regulator opened a security review of its products in August 2026.
- A softer next quarter. First-quarter revenue and signed contracts are both guided below the quarter just reported.
The evidence under this - 7 claims
C13facthigh confidence
Fiscal 2026 GAAP operating income was $695m against $1,243m in fiscal 2025, and GAAP diluted earnings per share were $0.40 against $1.60.
C14facthigh confidence
The fiscal 2026 non-GAAP bridge adds back $1,712m of share-based compensation, $638m of acquired-intangible amortisation, $295m of acquisition costs, $16m of litigation charges and $562m of convertible-note and capped-call fair value change.
C06facthigh confidence
Palo Alto closed six acquisitions in and immediately after fiscal 2026: CyberArk, Chronosphere, Koi Security, Portkey, Embrace and Console.
sourceQ4 and full-year fiscal 2026 results release (Form 8-K,…primaryQ4 fiscal 2026 earnings call transcriptprimaryForm 10-Q, quarter ended 30 April 2026primaryForm 10-K for the fiscal year ended 31 July 2026primary
- 2026-09-26editedRe-sourced to the fiscal 2026 10-K, which states Portkey's closing date the earlier sources left out.
C19facthigh confidence
At 31 July 2026 goodwill was $22,010m and intangible assets $7,017m, against total stockholders' equity of $27,492m.
sourceQ4 and full-year fiscal 2026 results release (Form 8-K,…primaryForm 10-K for the fiscal year ended 31 July 2026primary
- 2026-09-24editedConfirmed by the audited balance sheet in the fiscal 2026 10-K.
C20estimatehigh confidence
What Palo Alto owns minus what it owes and minus goodwill and intangibles is negative $1,535m, so it has no positive tangible net worth.
derivedC19: $27,492m of equity less $22,010m of goodwill and $7,017m of intangibles. The research pack independently reports price to tangible book as unavailable for the subject while computing it for all four peers.
against this
- Tangible net worth is close to meaningless for a subscription software company whose assets are contracts and code rather than plant; Zscaler and CrowdStrike both trade at large multiples of a small tangible book.
- The same balance sheet holds $7.91B of cash and investments against $1.77B of debt, so the company is nowhere near financial difficulty.
- 2026-09-24editedIts inputs confirmed by the audited balance sheet.
C43factmedium confidence
On 6 August 2026 the Cyberspace Administration of China opened a cybersecurity review of Palo Alto Networks products sold in China, under the National Security Law and the Cybersecurity Law.
against this
- Palo Alto does not separately report China revenue in any filing, so the exposure cannot be sized from a primary document at all.
- The measured share-price reaction in the session after the report printed was about minus 1%, which is not what a market pricing a material revenue loss looks like.
- The fiscal 2026 10-K, filed five weeks after the review opened, names China only in a general risk factor - its products 'may be subject to network security review' - and does not mention the August review or size China revenue.
- 2026-09-26editedChecked against the fiscal 2026 10-K risk factors, which name China only in general terms and do not mention the review.
C51facthigh confidence
Q1 fiscal 2027 revenue is guided to $3.300B to $3.310B, below the $3.410B just reported, and remaining performance obligations to $20.8B to $20.9B, below the $21.2B just reported.
What we still do not know
- What CyberArk is really worth: $3.5B of its value is renewals spread over 12 to 14 years, on estimates even the audited annual report calls preliminary until February 2027.
- How much recurring growth is left once the large AI customer's migration ends.
- Whether Microsoft is winning share in security. It reports no security revenue at all.
The evidence under this - 5 claims
C17facthigh confidence
Of the $6,279m assigned to CyberArk's identified intangibles, $3,500m is a 'platform renewals' asset amortised over 12 to 14 years.
sourceForm 10-Q, quarter ended 30 April 2026primaryForm 10-K for the fiscal year ended 31 July 2026primary
- 2026-09-26editedRe-sourced to the audited fiscal 2026 10-K, which repeats the intangible table unchanged and names the platform renewals valuation a critical audit matter.
C18facthigh confidence
The audited fiscal 2026 Form 10-K still describes the CyberArk purchase price allocation as based on preliminary estimated fair values, within a measurement period of up to twelve months from the 11 February 2026 close.
sourceForm 10-Q, quarter ended 30 April 2026primaryForm 10-K for the fiscal year ended 31 July 2026primary
- 2026-09-26editedThe fiscal 2026 10-K was filed on 10 September 2026; it keeps the allocation preliminary, so the claim now rests on the audited report rather than on its absence.
C22management claimmedium confidence
Fiscal 2026 net new next-generation security annual recurring revenue included a nine-figure benefit from one large language model customer migrating to Chronosphere from an incumbent vendor, with the tail running through Q1 2027 and then contributing less.
against this
- Management volunteered this rather than being asked, which is the disclosure a company makes when it expects the comparison to be raised later.
- Nine figures is at least $100m of a Q4 total of about $1B, so one customer is at least a tenth of the record quarter, and the customer is an artificial-intelligence laboratory buying consumption-based observability - the least contractually sticky revenue in the portfolio.
C23estimatehigh confidence
Fiscal 2027 guidance implies about $2.0B of net new next-generation security annual recurring revenue for the whole year, against $3.5B added in fiscal 2026 and nearly $1B in Q4 2026 alone.
derivedC21, C61 and C09: fiscal 2026 added $3.52B of next-generation security recurring revenue, of which at least $1.6B arrived with CyberArk and Chronosphere; the fiscal 2027 midpoint guide of $11.125B against the $9.10B exit implies about $2.0B for the whole year. Management adds that 60% to 61% of it falls in the second half and that Q1 is larger than normal because of the migration tail.
against this
- The $1.6B acquired figure is measured at 30 April 2026, so the acquired base at the 31 July exit was larger and the organic figure correspondingly smaller - which makes $1.9B an upper bound on what was sold, not an estimate of it.
- Palo Alto has guided this metric conservatively before: the fiscal 2026 guide of $7.00B to $7.10B was exceeded by $2.0B, though most of the excess is the acquisitions.
C36facthigh confidence
Microsoft reports three segments, none of them security, and discloses no security revenue line at all.
What would change our view
- Unattractive→AttractivePer-share cash catches the revenue line, at a lower multiple
It needs all of:
- ○Cash generated per share grows within a few points of revenue, with the share count flat or falling rather than heading for 900 million.checked at the next results, due by 18 Nov
- ○The price falls to about 30 times the cash per share guided for fiscal 2027.about $190.92 today, 51% below the last close
- Reopens the researchThe CyberArk purchase proves itself
It needs:
- ○The CyberArk identity business, now called Idira, reaches the $1.5B guided for fiscal 2027, with no write-down of what was paid for it.checked at the next results, due by 18 Nov
What is coming
- 18 November 2026 Q1 fiscal 2027 results: Net new recurring revenue outside the Chronosphere migration, revenue against the $3.300B to $3.310B guide, and whether the 844 to 847 million share-count guide holds.
Every dated event ahead
- 18 November 2026 Q1 fiscal 2027 results: Net new recurring revenue outside the Chronosphere migration, revenue against the $3.300B to $3.310B guide, and whether the 844 to 847 million share-count guide holds.
- December 2026 2026 proxy statement and annual meeting: Insider ownership after the CyberArk shares, and how the fiscal 2026 bonus and PSUs paid when the year's acquisitions are excluded from the measures.
- 31 December 2026 Share repurchase authorisation expires: Whether the board renews and enlarges it, the only lever that could make buybacks outrun stock pay and deal issuance.
- 11 February 2027 CyberArk purchase price allocation becomes final: Whether the $3.5B renewal asset and its 12 to 14 year life survive the measurement period, which sets how much amortisation the reported margin carries.
Since we wrote this
Written
8 Sep
Price the thesis read
$393.30
23 Sep
- 11 OctThesis reviewAI agent security declared an early business, with a bet on itThe owner asked every thesis to name its product lines; Prisma AIRS's revenue is management's word and the filing states none.
- 5 OctThesis reviewThe long case now sits under the verdictAfter the five-name pilot, the owner asked for the long case on every thesis.
- 4 OctThesis reviewOwner's checklist: revenue streams, cost of growth, management, catalystsThe owner's checklist found the method silent on who runs the company, what growth costs, where the money comes from and what is dated ahead; this pass fills those four blocks from the proxy and filings.
- 26 SepThesis reviewYear now audited; CyberArk valuation still provisional. View heldThe annual report confirmed the year but still calls $3.5B of CyberArk renewal value preliminary until February 2027. Two distributors now carry 30% of revenue, down from three carrying 44%.
- 24 SepEarningsAudited year matched; named rivals changed. View heldThe annual report confirmed every figure. It now names identity and monitoring rivals, and the shares rose to about 62 times guided cash per share, which widens the gap.
- 8 SepThesis writtenUnattractive, medium convictionSix acquisitions in a year lifted revenue, but earnings per share landed inside the guidance set before any of them, and the share count kept rising.
Also checked 3 times with nothing new to act on.
Sources 22
Where this came from
Sources - 22
Every claim above cites one of these, or states the reasoning that derived it. The quote is frozen at the date it was read: a link can rot, and an agent fetch returns a reading of a page rather than the page. Backs counts the whole claim ledger, so it can name a claim this page does not surface.
- S01primarycompany filing2026-09-01the fiscal 2026 income statement, balance sheet, GAAP-to-non-GAAP reconciliation, adjusted free cash flow, the ARR and RPO metrics and the whole fiscal 2027 guide. Marked Preliminary and unauditedbacksC01C02C06C08C09C13C14C19C21C30C33C40C45C46C48C51C56C59C60
- S02primarytranscript2026-09-01the new revenue split by platform and the fiscal 2027 modelling points per platform; the one large language model customer behind part of Q4 net new ARR; retention, displacement and product ARR figures with no filed home; nine analyst questions
We successfully displaced legacy incumbents in nearly 100 accounts representing over $400 million in total contract value, nearly double the volume of displacement from a year ago.
backsC06C22C24C25C26C27C28C40C42C50C59C70 - S03primarycompany filing2026-06-03the CyberArk and Chronosphere purchase price allocations, the pro forma revenue table, the statement of stockholders' equity share-by-share, the assumed convertible notes, unrecognised share-based compensation and the buyback authorisationbacksC03C04C05C06C11C12C17C18C45C47C49C57
- S04primarycompany filing2025-08-29the Item 1 Competition section naming eight rivals, distributor and end-customer concentration, purchase commitments, and the risk factorsbacksC39C68C69
- S05primarycompany filing2025-08-18the original fiscal 2026 guidance, issued before CyberArk was acquired - revenue, earnings per share and the share count it was struck onbacksC07C46
- S06primarycompany filing2026-02-25a rival's own description of the same product and buyer, its in-house silicon, and its filed revenue and operating profitbacksC15C16C38
- S07primarycompany filing2026-03-31a rival's own description of a unified security architecture sold to enterprises, and its filed revenue and operating profitbacksC15C16C38
- S08primarycompany filing2026-03-05the single-sensor platform description, a Competition section listing the classes Palo Alto sits in, and its filed revenue and operating lossbacksC16C37C38C53
- S09primarycompany filing2026-09-03the Zero Trust Exchange description and, in the same Item 1, a direct attack on the product category Palo Alto earns most of its revenue inbacksC16C35C38C53C71
- S10primarycompany filing2026-07-29three reportable segments, none of them security and no security revenue line at all; and quarterly capital spending, read from the filer's own XBRL tagsbacksC36C41
- S11primarycompany filing2026-02-05the two Google segments, confirming security is not disclosed separatelyread, but no claim rests on it
- S12primaryvendor data2026-09-08Research pack, frozen at content/PANW/research-pack.jsoncontent/PANW/research-pack.jsonprice and market value, the 20-day range and 252-day returns, the analyst split, FINRA short interest, Form 4 activity with transaction codes, and the filed-competitor cohort multiplesbacksC15C16C33C46C55C56C58
- S13secondarynews2026-02-12original reporting that executives ordered an attribution removed from a threat report covering 37 countries, and the company's own denial
the original Unit 42 report said that the prolific hackers were connected to Beijing, but the finished version described them more vaguely as a state-aligned group that operates out of Asia
backsC44 - S14tertiarynews2026-08-06Security Affairs: Palo Alto Networks faces China cybersecurity review amid rising tech tensions Security Affairsthe Cyberspace Administration's own wording, quoted; and the note that Palo Alto does not separately report China revenue
in accordance with the National Security Law of the People's Republic of China and the Cybersecurity Law of the People's Republic of China, the Cybersecurity Review Office, following the Cybersecurity Review Measures, has conducted a cybersecurity review of Palo Alto Networks' products sold in China
backsC43 - S15primarycompany filing2026-09-02three geographic reportable segments with Security as one of four product categories - why a named rival is not a valuation peerread, but no claim rests on it
- S16primarycompany filing2026-07-23quarterly capital spending, read from the filer's own XBRL company facts through scripts/api/sec_xbrl.pybacksC41
- S17primarycompany filing2026-06-02the one disclosure that separates bought recurring revenue from sold: $1.6B of the $8.1B of next-generation security ARR, $1.8B of the $18.4B of obligations and $388m of the quarter's revenue, each attributed to CyberArk and Chronosphere. Also the fiscal 2026 earnings-per-share guide re-issued with CyberArk already consolidatedbacksC46C61C63
- S18primarycompany filing2026-08-21nothing the argument uses: a routine severance and change-of-control policy for the chief executive, executive vice presidents and senior vice presidents, effective 20 August 2026. Opened because the source audit named it, and recorded so that a later reader knows it was read and found immaterialread, but no claim rests on it
- S19primarycompany filing2026-09-10The audited fiscal 2026 statements, the purchase price allocations, remaining performance obligations, the cover-page share count and the competition section written after CyberArk and Chronosphere closed.backsC06C17C18C19C34C39C45C47C48C49C64C67C68C69C72
- S20secondaryvendor data2026-09-24PANW research pack, refreshed 2026-09-24 (2026-09-23 close)Last completed-session close of $393.3 on 2026-09-23.backsC31
- S21primarycompany filing2025-11-07Beneficial ownership as of 15 September 2025, executive biographies and tenure, the fiscal 2025 cash incentive plan's measures and payout, the PSU measures, their acquisition adjustments, the relative TSR modifier and the fiscal 2025 achievement.backsC65C66C67
- S22primarycompany filing2023-09-01The fiscal 2021 to 2023 income statements and share-based compensation by line, read through the frozen numbers card.backsC69