NetScout Systems, Inc. (NTCT) | The Buildout — AI Infrastructure
The Verdict
NetScout builds network observability, service assurance, cybersecurity, and DDoS protection software powered by deep packet inspection at scale. Its tools give enterprises, carriers, and government agencies visibility into network performance and end-user experience, and they protect networks from attacks. In the AI infrastructure buildout, the role is indirect: NetScout supplies the packet-level data foundation for customers' AIOps and observability workflows, and it applies AI-enabled automation in DDoS defense, rather than selling compute or foundation models.
| Market Cap | — |
| Revenue (TTM) | $859M |
| Revenue Growth | +4.5% |
| EBITDA Margin (TTM) | 19.7% |
| Net Cash | $628M |
| Earnings Beats | 6 of 7 |
| P/E (TTM) | — |
| EV/EBITDA (TTM) | — |
What We Like
- FY26 revenue of $859.5M and non-GAAP diluted EPS of $2.48 exceeded the high end of management's prior guidance range.
- Deferred revenue and customer deposits totaled $498.9M at March 31, 2026, with $330.6M expected to convert to revenue within 12 months.
- Arbor Cloud mitigation capacity doubled to 33 Tbps after the DigiCert DDoS asset acquisition, which carries about $20M in expected annualized revenue.
- FY26 product gross margin rose to 86% from 84% in FY25 on a shift toward software licensing.
- No customer accounted for more than 10% of Q1 FY27 revenue.
What We’re Watching
- Cybersecurity grew only +0.6% in Q1 FY27 against a +18.3% prior-year comparison; reacceleration is unproven.
- Management disclosed $10M–$15M of government orders pulled into Q1 FY27; normalized growth was mid-single-digits.
- Auditor change disclosed in a June 3, 2026 8-K, flagged material/negative in the watch feed and not discussed on the Q1 FY27 call.
- No share repurchases in Q1 FY27 despite prior intent to be active in FY27; management says it remains committed.
The operating thesis is intact but not strengthening. The strong fiscal first quarter was flattered by pulled-forward government demand, and management guided the next quarter broadly flat; the structural positives remain the software mix shift, the in-house Arbor Cloud capacity, and the DPI-based installed base. The open question is whether cybersecurity can reaccelerate after its +0.6% Q1 FY27 result.
Earnings Beat
NetScout reported Q1 FY27 revenue of $210.4M, up 12.7% year over year, with gross margin of 80.6%, up 190 basis points, and non-GAAP diluted EPS of $0.52 versus $0.34 a year earlier. Management said results included $10M–$15M of government orders pulled into the quarter and that normalized growth would have been mid-single-digits.
| Metric | Q4 FY2026 | Q3 FY2026 | Q4 FY2025 | YoY |
|---|---|---|---|---|
| Revenue | $203M | $251M | $205M | −1.0% |
| Gross margin | 72.9% | 81.6% | 77.7% | -480bps |
| EBITDA | $34M | $76M | $36M | −4.8% |
| EPS | $0.25 | $0.77 | $0.26 | −0.9% |
| Total product backlog | $33M total ($28M fulfillable) | $50M total ($45.8M fulfillable) | n/a | — |
The orders that were pulled in were $10 million to $15 million, primarily government related. If I were to normalize the quarter, it would have grown in the mid-single-digits, which would be consistent with where we see the first half of the fiscal year and consistent with where — our full year outlook.— Tony Piazza, EVP & CFO, 2026-08-06
Management tone: Management's tone shifted from reporting a strong headline to immediately deflating it: the CFO disclosed the government pull-forward, gave a mid-single-digit normalized growth view, and guided Q2 broadly flat. The overall style remained conservative and timing-conscious.
Management Guidance
Management reaffirmed FY27 revenue of $885M–$915M and non-GAAP diluted EPS of $2.65–$2.80, with an effective tax rate of about 20% and weighted average diluted shares of about 74M–75M. For Q2 FY27, revenue is expected to be broadly consistent with the prior-year period and EPS to grow high-single-digits, helped by ENGAGE shifting from Q2 to Q3, while first-half revenue growth is guided to mid-single-digits. Full-year service revenue growth is guided to low-single-digits.
Trajectory
Reported revenue is lumpy: Q2 FY26 was $219.0M, Q3 FY26 $250.7M, Q4 FY26 $203.0M, and Q1 FY27 rebounded to $210.4M. Management said the rebound was helped by pulled-forward government orders and that normalized growth would have been mid-single-digits. Q1 FY27 gross margin was 80.6%, up 190 basis points year over year.
The Model
The model projects FY+1 revenue of $912M and EBITDA of $206M, a 22.6% EBITDA margin, and FY+2 revenue of $965M and EBITDA of $230M, a 23.8% EBITDA margin. The near-term projection is anchored by management's FY27 revenue guide of $885M–$915M and low-single-digit service revenue growth; FY+2 reflects continued software mix improvement and the DigiCert–Arbor Cloud integration.
| Metric | FY2026 | Next FY (E) | Following FY (E) |
|---|---|---|---|
| Revenue | $859M | $912M | $965M |
| YoY Growth | — | +6.1% | +5.8% |
| EBITDA | $169M | $206M | $230M |
| EBITDA Margin | 19.7% | 22.6% | 23.8% |
Projections are the median of 5 independent model runs. The model’s revenue sits 3.4% above analyst consensus.
Management reaffirmed FY27 revenue of $885M–$915M and non-GAAP diluted EPS of $2.65–$2.80, with an effective tax rate of about 20% and weighted average diluted shares of about 74M–75M. For Q2 FY27, revenue is expected to be broadly consistent with the prior-year period and EPS to grow high-single-digits, helped by ENGAGE shifting from Q2 to Q3, while first-half revenue growth is guided to mid-single-digits. Full-year service revenue growth is guided to low-single-digits.
What Could Go Right — and Wrong
- Omnis customer count grows well beyond the current less-than-10 base and revenue becomes a disclosed, material line.
- Cybersecurity reaccelerates above company average after the +0.6% Q1 FY27 comparison.
- Federal strength proves more durable than expected, with modernization and Zero Trust budgets keeping federal above its normal mid-to-high single-digit share.
- Arbor Cloud vertical integration converts into larger DDoS wins and improved cloud economics, building on 33 Tbps capacity.
- Service provider spending inflects and the 37%-of-revenue vertical reaccelerates.
- Normalized growth proves lower than mid-single-digit if Q2 is weak and full-year guidance relies on the strong Q1.
- Cybersecurity fails to reaccelerate, exposing dependence on large-project timing.
- Federal pull-forward becomes a multi-quarter air pocket, pressuring service assurance and total revenue.
- Observability competitors such as Datadog and Palo Alto Networks outrun NETSCOUT's Omnis adoption.
- Supply-chain or governance issues escalate: sole-source NIC exposure, AI build-out component shortages, or the unaddressed auditor change.
Looking Ahead
The next 12 months hinge on whether Q2 FY27 absorbs the government pull-forward as guided and whether cybersecurity reaccelerates. October's ENGAGE 2026 showcase for nGenius Copilot and AI-powered DDoS protection offers product visibility, while DigiCert integration, Arbor Cloud capacity, and Omnis customer-count growth beyond 'less than 10' will show whether the newer revenue streams scale.
- Q2 FY27 (Sept 2026 quarter)Earnings check — Tests revenue broadly consistent y/y and cybersecurity reacceleration after tough comp.
- Oct 2026ENGAGE 2026 product showcase — nGenius Copilot and AI-powered DDoS demos; post-event adoption signals matter.
- Q2–Q4 FY27Omnis ramp and buyback disclosures — Tests customer count beyond less-than-10 and whether repurchases resume.
Financials
Annual Summary
| Metric | FY2025 | FY2026 | TTM | YoY |
|---|---|---|---|---|
| Revenue | $823M | $859M | $859M | +4.5% |
| Gross Margin | 78.0% | 77.8% | 78.1% | 12bps |
| EBITDA | −$296M | $169M | $654M | +157.1% |
| EBITDA Margin | -36.0% | 19.7% | 19.7% | +5,564bps |
| Net Income | −$367M | $95M | $95M | +126.0% |
| Free Cash Flow | $212M | $286M | $1.9B | — |
| Net Cash | — | — | — | — |
Key Ratios (Trailing)
- P/E TTM—
- EV/EBITDA TTM—
- EV/Revenue TTM—
- Price/FCF TTM—
- Gross Margin (TTM)78.1%
- EBITDA Margin (TTM)19.7%
- Net Margin (TTM)11.1%
- ROIC8.5%
- FCF Conversion168.9%
- SBC / Revenue7.0%
The Company
NetScout provides enterprise network observability, carrier service assurance, cybersecurity, and DDoS protection built on deep packet inspection at scale. Its platform is powered by high-fidelity packet-level data that management calls Smart Data, used by enterprises, service providers, and government agencies to understand network performance, end-user experience, and attacks.
NetScout operates as a single reportable segment but presents two product-line views: Service Assurance and Cybersecurity. Its headquarters and U.S. manufacturing are in Westford, Massachusetts, spanning about 175,000 square feet under a lease expiring September 2030. The company primarily sells software but uses a COTS hardware model, and the May 2026 DigiCert DDoS asset acquisition brought the Arbor Cloud back-end infrastructure fully in-house.
Business Segments
Competitive Landscape
NetScout's 10-K lists competitor sets across enterprise observability, service-provider assurance, and DDoS protection. The supply-chain intelligence adds that observability is high-growth and contested, with Datadog growing revenue +32% and Palo Alto Networks entering through the Chronosphere acquisition; no large peer mentioned NetScout by name.
- DatadogNamed in the 10-K as an enterprise competitor; supply-chain read-through says Datadog grew revenue +32% y/y and is taking share.
- Palo Alto NetworksSupply-chain intelligence names it entering observability via the Chronosphere acquisition.
- RadwareNamed in the 10-K as a cybersecurity/DDoS competitor under the Arbor brand; not discussed in detail.
- Named in the 10-K as a cybersecurity/DDoS competitor.
- Named in the 10-K as a cybersecurity/DDoS competitor.
Supply Chain
NetScout sits between hardware component suppliers and enterprise, carrier, and government buyers. Its software depends on COTS hardware availability, and across twelve neighbor transcripts no company mentioned NetScout by name.
More on NTCT: Earnings recap