NetScout Systems, Inc. (NTCT) | The Buildout — AI Infrastructure
The Verdict
NetScout instruments a customer's network, captures packet-level data, and turns it into software for network monitoring, observability, and DDoS defense. Its tools are used by service providers, enterprises, and government agencies to keep networks running and to block attacks. In the AI buildout it is an adjacent player: it does not build AI infrastructure, but it sells observability and security software into the networks AI workloads run on, and it markets its packet data as input for AI operations and agentic workflows.
| Market Cap | — |
| Revenue (TTM) | $883M |
| Revenue Growth | +5.8% |
| EBITDA Margin (TTM) | 21.2% |
| Net Cash | $589M |
| Earnings Beats | 6 of 7 |
| P/E (TTM) | — |
| EV/EBITDA (TTM) | — |
What We Like
- Service Assurance revenue grew 19.7% y/y in Q1 FY2027 and was 67% of total revenue, helped by government orders received earlier than expected and by Omnis Sensor/Streamer products.
- FY2026 non-GAAP operating margin was 25.4%, up 1.7 points; Q1 FY2027 operating margin was 20.8%, up 660 bps y/y on favorable product mix and disciplined costs.
- Free cash flow was $285.4M in FY2026 and $44.3M in Q1 FY2027.
- Deferred revenue and customer deposits were $498.9M at March 31, 2026, with 66% expected to be recognized within 12 months.
- Arbor Cloud's DDoS mitigation capacity doubled to 33 Tbps after NetScout brought the back-end infrastructure in-house through the DigiCert asset acquisition, which closed May 1, 2026.
What We’re Watching
- Cybersecurity grew 0.6% y/y in Q1 FY2027 against a prior-year quarter that grew about 18%; a second soft quarter would test management's 'difficult comparison' framing.
- Federal revenue ran at mid-teens as a percent of total revenue in Q1 FY2027, versus a normal mid-to-high single-digit mix; management is watching for normalization.
- Product backlog fell to about $33M ($28M fulfillable) from roughly $50M ($45.8M fulfillable) at FY2026 year-end, with no explanation on the call.
- Omnis Sensor/Streamer had fewer than 10 customers as of the Q1 FY2027 call; management flagged uncertainty over how long these 'big AI projects' take to close.
The thesis is intact but not strengthening. The enterprise rotation, high margins, and cash generation are real, and the DigiCert buy adds recurring cloud-DDoS revenue alongside a 33 Tbps capacity milestone. Against that, the headline growth was timing, Cybersecurity's near-flat quarter is not explained by demand, and the backlog reversed with no call commentary. The open question is whether Cybersecurity's +0.6% was a difficult comparison or a real pause — the next quarter should begin to answer it.
Earnings Beat
NetScout reported Q1 FY2027 revenue of $210.4M, up 12.7% y/y, with gross margin of 78.9% and product revenue of $86M, up 17.8%. Management credited government orders received earlier than expected and Omnis Sensor/Streamer products, but said $10–15M of orders were pulled forward and that normalized growth would have been mid-single-digits.
| Metric | Q1 FY2027 | Q4 FY2026 | Q1 FY2026 | YoY |
|---|---|---|---|---|
| Revenue | $210M | $203M | $187M | +12.7% |
| Gross margin | 78.9% | 72.9% | 76.7% | +220bps |
| EBITDA | $29M | $34M | $10M | +177.9% |
| EPS | $0.29 | $0.25 | $-0.05 | −666.3% |
| Product backlog (total) | ~$33M | ~$50M | n/a | — |
If I were to normalize the quarter, it would have grown in the mid-single-digits, which would be consistent with where we see the first half of the fiscal year and consistent with where -- our full year outlook.— Tony Piazza, CFO, 2026-08-06
Management tone: Management was direct on the quarter's timing, quantifying the $10–15M pull-forward and normalizing growth to mid-single-digits when asked. Their tone on supply chain shifted from 'minimal' impact a quarter earlier to a proactive $7M inventory build tied to AI data-center scarcity. On whether AI is changing cybersecurity deal cycles, they redirected to product priorities. They disclosed the buyback pause plainly.
Management Guidance
For FY2027, management reaffirmed revenue of $885–915M and non-GAAP EPS of $2.65–2.80, a non-GAAP tax rate near 20%, and weighted average diluted shares of roughly 74–75M. Service revenue is expected to grow low-single-digits. For Q2 FY2027, revenue is guided 'broadly consistent with the prior-year period,' with first-half revenue growth in the mid-single-digits and Q2 EPS growing high-single-digits, helped by the ENGAGE conference shifting from Q2 to Q3. The DigiCert acquisition was assumed to add about $20M in initial annualized revenue with a partial FY2027 benefit; that figure was not updated on the latest call.
Trajectory
Revenue is lumpy by quarter — $219M, $251M, $203M, then $210.4M through FY2026 and into Q1 FY2027 — with the underlying growth rate in the mid-single-digits on management's own normalized basis. Margins expanded: Q1 FY2027 operating margin rose 660 bps to 20.8% on favorable product mix and disciplined costs, while gross margin came in at 78.9%. The mix shifted sharply, with Service Assurance up 19.7% and Cybersecurity up 0.6%, inverting FY2026, when Cybersecurity led at +7.8% and Service Assurance grew 2.6%. Product backlog declined sequentially to about $33M.
The Model
The model projects FY+1 revenue of $910.0M and EBITDA of $197M — a 21.7% margin — rising to FY+2 revenue of $950.0M and EBITDA of $214M, a 22.5% margin. The near-term figure sits inside management's reaffirmed FY2027 revenue range of $885–915M. The second year assumes the enterprise rotation, the DigiCert cloud-DDoS business, and a mid-single-digit core add modestly on top.
| Metric | FY2026 | Next FY (E) | Following FY (E) |
|---|---|---|---|
| Revenue | $859M | $910M | $950M |
| YoY Growth | — | +5.9% | +4.4% |
| EBITDA | $169M | $197M | $214M |
| EBITDA Margin | 19.7% | 21.7% | 22.5% |
Projections are the median of 5 independent model runs. The model’s revenue sits 1.8% above analyst consensus.
For FY2027, management reaffirmed revenue of $885–915M and non-GAAP EPS of $2.65–2.80, a non-GAAP tax rate near 20%, and weighted average diluted shares of roughly 74–75M. Service revenue is expected to grow low-single-digits. For Q2 FY2027, revenue is guided 'broadly consistent with the prior-year period,' with first-half revenue growth in the mid-single-digits and Q2 EPS growing high-single-digits, helped by the ENGAGE conference shifting from Q2 to Q3. The DigiCert acquisition was assumed to add about $20M in initial annualized revenue with a partial FY2027 benefit; that figure was not updated on the latest call.
What Could Go Right — and Wrong
- Cybersecurity reaccelerates back toward its FY2026 growth rate once the difficult comparison passes.
- Omnis Sensor/Streamer scales beyond fewer than 10 customers and management quantifies the revenue contribution.
- DigiCert delivers its ~$20M initial annualized revenue run rate with a visible margin path.
- Arbor Cloud's 33 Tbps capacity converts into net-new cloud-DDoS contracts.
- The federal pipeline holds at elevated levels, or guidance is raised rather than reaffirmed.
- The mid-single-digit underlying growth is the whole story, and the second half does not deliver after the Q1 pull-forward.
- A second soft Cybersecurity quarter makes the deceleration look structural rather than comparative.
- Federal revenue normalizes back toward its mid-to-high single-digit historical mix.
- Supply-chain tightness hits software demand — customers cannot source hardware and change their buying behavior.
- The backlog decline reflects lighter new bookings rather than conversion of prior orders to revenue.
Looking Ahead
The next four quarters turn on a few scheduled checkpoints. Q2 FY2027 earnings should show whether Cybersecurity reaccelerates and how much of the year rests on the second half. ENGAGE 2026, moved to October in Texas, features nGenius Copilot, evidence-driven incident response, and adaptive DDoS. Management has said it will keep updating investors on Omnis as the year goes on. The DigiCert run-rate, any resumption of buybacks, and whether federal spending stays elevated are the other things to watch.
- September 10, 2026B. Riley TMT conference — CFO Tony Piazza hosts investor meetings in New York.
- October 2026ENGAGE 2026 user summit — Texas event features nGenius Copilot, incident response, adaptive DDoS.
- Late October/early November 2026Q2 FY2027 earnings — Tests whether Cybersecurity reaccelerates and whether H2 carries the year.
- FY2027DigiCert run-rate proof — Whether the ~$20M annualized cloud-DDoS revenue materializes.
Financials
Annual Summary
| Metric | FY2025 | FY2026 | TTM | YoY |
|---|---|---|---|---|
| Revenue | $823M | $859M | $883M | +4.5% |
| Gross Margin | 78.0% | 77.8% | 78.6% | 12bps |
| EBITDA | −$296M | $169M | $188M | +157.1% |
| EBITDA Margin | -36.0% | 19.7% | 21.2% | +5,564bps |
| Net Income | −$367M | $95M | $121M | +126.0% |
| Free Cash Flow | $212M | $286M | $258M | — |
| Net Cash | — | — | — | — |
Key Ratios (Trailing)
- P/E TTM—
- EV/EBITDA TTM—
- EV/Revenue TTM—
- Price/FCF TTM—
- Gross Margin (TTM)78.6%
- EBITDA Margin (TTM)21.2%
- Net Margin (TTM)13.7%
- ROIC9.6%
- FCF Conversion137.7%
- SBC / Revenue6.6%
The Company
NetScout sells network observability, service assurance, and cybersecurity software built on proprietary deep packet inspection, which captures and curates the data flowing across a customer's network. Its products help service providers, enterprises, and government agencies monitor performance, resolve problems, and defend against distributed denial-of-service, or DDoS, attacks. The company describes itself in its FY2026 10-K as 'an industry leader with over four decades of experience' in these areas.
NetScout is primarily a software vendor with a hardware component, run from a single named facility in Westford, Massachusetts — about 175,000 square feet under a lease expiring September 2030 that houses both the corporate headquarters and U.S. manufacturing. It presents two segments on its calls, Service Assurance and Cybersecurity, even though the 10-K states the company operates as a single reportable segment. It sells to a long tail of customers, with no customer above 10% of revenue.
Business Segments
Competitive Landscape
NetScout competes across several crowded arenas at once — enterprise observability, service-provider assurance, DDoS and network security, and network packet brokering. Its FY2026 10-K lists a long set of competitors, including larger and faster-growing names such as Cisco, Dynatrace, Datadog, Cloudflare, and Fortinet, and it says it 'both compete[s] with and partner[s] with large enterprise management vendors, such as HP and IBM.' Its stated edge is the packet-level data its deep packet inspection produces, which it markets as AI-ready smart data, plus a patent estate that reached 750 patents in June 2026.
- Named in the 10-K as a competitor in both enterprise and service-provider markets; also owns Splunk, listed as a service-provider competitor.
- DynatraceListed in the 10-K among enterprise observability and application-performance competitors.
- DatadogListed in the 10-K among enterprise observability and application-performance competitors.
- CloudflareListed in the 10-K as a cybersecurity competitor under the NetScout Arbor brand.
- FortinetListed in the 10-K as a cybersecurity competitor under the NetScout Arbor brand.
Supply Chain
NetScout sits near the end of the hardware chain: it sells software that runs on appliances and sensors, and it buys some components — such as network interface cards — from a single unnamed supplier. No data-center, colocation, or power partner is named in the source material.
More on NTCT: Earnings recap