Palo Alto Networks, Inc. (PANW) | The Buildout — AI Infrastructure
The Verdict
Palo Alto Networks sells the inspection and enforcement layer for enterprise security: firewalls and software firewalls, cloud-delivered secure access, security operations, observability and identity controls. Its strategy is consolidation, replacing separate point products with one platform so that data and policy sit in a single place. As AI data centers are built and software agents generate machine-speed traffic, management argues that every byte still requires inspection and every request still requires enforcement. That is the company's stated thesis rather than a certainty, and its own pure-play AI security product is small relative to the rest of the portfolio.
| Market Cap | — |
| Revenue (TTM) | $11.5B |
| Revenue Growth | +24.5% |
| EBITDA Margin (TTM) | 17.1% |
| Net Cash | $571M |
| Earnings Beats | 6 of 7 |
| P/E (TTM) | — |
| EV/EBITDA (TTM) | — |
What We Like
- NGS ARR ended FY2026 at $9.1 billion, up 63% year over year, and net new NGS ARR in Q4 was nearly $1 billion, almost double the prior year.
- RPO reached $21.2 billion, up 34% and above $20 billion for the first time; current RPO was $9.3 billion, also up 34%, with contract durations described as steady year over year.
- The platformized cohort's net revenue retention exceeded 120% in Q4.
- FY2026 adjusted free cash flow was $4.41 billion, a 38.4% margin.
- FY2026 non-GAAP operating margin was 29.2%, up 40 basis points year over year, which management said is notable given a partial year of the company's largest acquisitions.
What We’re Watching
- FY2027 NGS ARR is guided to 22-23% growth and RPO to 19-20%, against FY2026's reported 63% and 34%; Q4 carried no organic restate.
- Q4 net new NGS ARR included a nine-figure benefit from one large LLM customer migrating to Chronosphere, and that migration tail runs through Q1 FY2027.
- Reported gross margin fell from 74.2% in Q1 FY2026 to 67.6% in Q4 FY2026, and management expects cloud hosting costs to grow faster than total revenue in FY2027.
- Memory and storage costs are expected to persist in the hardware business, which is about 10% of revenue.
The reported business is bigger and faster-growing, but the composition is now a blend of organic momentum and acquired ARR, and management's FY2027 guide resets the visible growth rate lower than FY2026's reported figures. Integration of the two largest acquisitions is running ahead of plan, which supports management's case that the platform strategy works at scale. The open question is how much of the FY2027 NGS ARR guide depends on the single large LLM customer migration completing in Q1 and what replaces it for the rest of the year.
Earnings Beat
Palo Alto Networks reported Q4 FY2026 revenue of $3.41 billion, up 34% year over year, and said it exceeded guidance across every financial metric. RPO crossed $20 billion for the first time at $21.2 billion, and net new NGS ARR was nearly $1 billion in the quarter, almost double the prior year. Gross margin declined year over year as revenue mix shifted toward cloud and SaaS offerings.
| Metric | Q4 FY2026 | Q3 FY2026 | Q4 FY2025 | YoY |
|---|---|---|---|---|
| Revenue | $3.4B | $3.0B | $2.5B | +34.4% |
| Gross margin | 67.6% | 67.6% | 73.2% | -560bps |
| EBITDA | $642M | $300M | $581M | +10.5% |
| EPS | $-0.37 | $-0.24 | $0.36 | −203.1% |
| NGS ARR | $9.1B | $8.13B | n/a | +63% y/y |
| RPO | $21.2B | n/a | n/a | +34% y/y |
This decline reflects a mix shift towards our faster growing SaaS offerings, which continue to scale with our platforms and have yet to reach their gross margin maturity. Looking ahead, the growing majority of revenue is cloud and SaaS, and we anticipate that mix shift will drive our cloud hosting costs faster than total revenue. In fiscal year 27.— Dipak Golechha, 2026-09-01
Management tone: Management escalated its AI framing across the three calls in the window: the Q3 call said a frontier model had "increased the terminal value of the entire cybersecurity industry," and the Q4 call said Q4 was the first quarter that showed the implications of cyber-capable models. On the Q4 call they were candid about cost headwinds and customers' slow deployment cycles, and they warned against modeling an immediate windfall.
Management Guidance
For FY2027 management guided NGS ARR of $11.075 billion-$11.175 billion (22-23% growth), RPO of $25.2 billion-$25.4 billion (19-20%), revenue of $14.1 billion-$14.2 billion (23-24%), operating margin of 29.5%, non-GAAP EPS of $4.16-$4.19 and adjusted free cash flow margin of 38%. Platform modeling points for FY2027: Network and AI Security growing low double digits, Cortex up approximately 30%, and Idira at approximately $1.5 billion on a pro forma high-teens-to-20% growth rate. Management said it expects 60-61% of net new NGS ARR in the second half of FY2027, with Q1 larger than normal because of the tail of the large LLM customer migration to Chronosphere, and said Console and Embrace are immaterial to FY2027.
Trajectory
Revenue stepped up through fiscal 2026, from $2.474 billion in Q1 to $3.41 billion in Q4, with Q4 up 34% year over year. A meaningful part of that step-up is acquired: Q3 revenue of $3.002 billion included $388 million from CyberArk and Chronosphere, and Q3 organic NGS ARR grew 28% against 60% reported. Reported gross margin moved the other way over the same four quarters, from 74.2% in Q1 FY2026 to 67.6% in Q4, and management expects the mix shift toward cloud and SaaS to push cloud hosting costs up faster than total revenue in FY2027.
The Model
The model's locked projections are FY+1 revenue of $14,400M with EBITDA of $3,038M (a 21.1% margin), and FY+2 revenue of $17,416M with EBITDA of $3,971M (a 22.8% margin). The near-term figure sits alongside management's own FY2027 revenue guide of $14.1 billion-$14.2 billion and the platform mix it describes, with Cortex guided up about 30% and Network and AI Security guided to low double digits. FY+2 assumes the newer platforms carry more of the growth and that the margin recovery management has targeted through M&A synergies and operating leverage continues.
| Metric | FY2026 | Next FY (E) | Following FY (E) |
|---|---|---|---|
| Revenue | $11.5B | $14.4B | $17.4B |
| YoY Growth | — | +25.4% | +20.9% |
| EBITDA | $2.0B | $3.0B | $4.0B |
| EBITDA Margin | 17.1% | 21.1% | 22.8% |
Projections are the median of 5 independent model runs. The model’s revenue sits 6.6% above analyst consensus.
For FY2027 management guided NGS ARR of $11.075 billion-$11.175 billion (22-23% growth), RPO of $25.2 billion-$25.4 billion (19-20%), revenue of $14.1 billion-$14.2 billion (23-24%), operating margin of 29.5%, non-GAAP EPS of $4.16-$4.19 and adjusted free cash flow margin of 38%. Platform modeling points for FY2027: Network and AI Security growing low double digits, Cortex up approximately 30%, and Idira at approximately $1.5 billion on a pro forma high-teens-to-20% growth rate. Management said it expects 60-61% of net new NGS ARR in the second half of FY2027, with Q1 larger than normal because of the tail of the large LLM customer migration to Chronosphere, and said Console and Embrace are immaterial to FY2027.
What Could Go Right — and Wrong
- Cortex revenue grows by roughly 30% in FY2027 as guided, rotating the growth mix toward the newer platforms as Network and AI Security grows low double digits.
- Prisma AIRS moves beyond $100 million in ARR and 800 customers, with multi-module adoption continuing in the largest transactions.
- Observability ARR above $500 million continues to scale within Cortex after Chronosphere more than doubled since the acquisition closed.
- Idira cross-sell keeps running at the Q4 pace of more than 200 net new logos and 400 shared leads, with Modern PAM upgrades converting the traditional PAM base.
- FY2027 adjusted free cash flow margin of 38% is delivered, keeping the FY2028 40%+ target within reach inclusive of CyberArk and Chronosphere.
- FY2027 organic NGS ARR growth lands below the FY2026 organic figure of 28%, confirming that reported acceleration was acquisition-assisted.
- The large LLM customer migration is not replaced by other large AI-native observability wins, leaving net new ARR concentrated in a few relationships.
- Gross margin keeps falling as SaaS mix and cloud hosting costs outrun operating leverage and acquisition synergies.
- Memory and storage cost inflation persists, and further hardware pricing actions do not fully offset it in a product line that is about 10% of revenue.
- Integration slips on CyberArk back-end system migrations, Console or Embrace absorption, or SBC normalization, after six acquisitions closed in roughly a year.
Looking Ahead
The next twelve months test whether the FY2027 guide is conservative or reflects a slower core. One item carries a date in the source: the large LLM migration tail running through Q1 FY2027. Further out sit the FY2028 40%+ adjusted free cash flow margin target and the FY2030 goal of $20 billion in ARR.
- Q1 FY2027Q1 FY2027 results — Tests NGS ARR guide and the large LLM migration tail.
- FY2027Platform-level disclosure — Segment revenue across network security, Cortex and identity.
- FY202840%+ FCF margin target — Reaffirmed inclusive of CyberArk and Chronosphere.
Financials
Annual Summary
| Metric | FY2025 | FY2026 | TTM | YoY |
|---|---|---|---|---|
| Revenue | $9.2B | $11.5B | $11.5B | +24.5% |
| Gross Margin | 73.4% | 70.8% | 70.4% | 267bps |
| EBITDA | $1.6B | $2.0B | $2.0B | +24.0% |
| EBITDA Margin | 17.2% | 17.1% | 17.1% | 7bps |
| Net Income | $1.1B | $307M | $307M | -72.9% |
| Free Cash Flow | $3.7B | $4.4B | $4.4B | — |
| Net Cash | — | — | — | — |
Key Ratios (Trailing)
- P/E TTM—
- EV/EBITDA TTM—
- EV/Revenue TTM—
- Price/FCF TTM—
- Gross Margin (TTM)70.4%
- EBITDA Margin (TTM)17.1%
- Net Margin (TTM)2.7%
- ROIC2.0%
- FCF Conversion223.1%
- SBC / Revenue6.6%
The Company
Palo Alto Networks is a global cybersecurity provider. The FY2025 10-K says its platforms and services help secure enterprise users, networks, clouds and endpoints with cybersecurity backed by artificial intelligence and automation, and that a key element of the strategy is helping customers simplify their security architectures by consolidating disparate point products. Its product lines span next-generation firewalls and software firewalls, cloud-delivered secure access, cloud-delivered security services such as threat prevention and DNS security, the Cortex security operations stack, Unit 42 threat intelligence and incident response, and — after a year of acquisitions — identity security and observability. Roughly a quarter of the way into that list, the company says its clean AI-security product, Prisma AIRS, passed $100 million in ARR within four quarters of general availability.
The company operates asset-light on manufacturing and heavier on cloud. The 10-K states that all hardware products are assembled in the United States and that it relies on an electronics manufacturing services provider, named as Flextronics International, Ltd. (Flex), to assemble most products to Palo Alto Networks' specifications and to procure components against its demand forecasts. The 10-K also discloses reliance on sole-source component suppliers for certain components and warns that supply shortages have in some cases disrupted or delayed scheduled deliveries and increased costs. Corporate headquarters is in Santa Clara, California, leased at approximately 941,000 square feet under three leases expiring July 2028.
Business Segments
Competitive Landscape
The FY2025 10-K separates competitors into two groups: large companies that incorporate security features into their products, and independent security vendors. Management's own framing is that consolidation favors platforms — it says platformization is the only viable strategy for real time defense, that willingness to buy best-of-breed has subsided compared with eight years ago, and that the company has ascended to the number 2 position in SASE with a stated trajectory to become the leader in five to seven years. The company also says it continues to gain share in SASE, with bookings growing ahead of the overall market.
- Named in the 10-K among large companies that incorporate security features in their products.
- Named in the 10-K among large companies that incorporate security features in their products.
- Named in the 10-K among large companies that incorporate security features in their products.
- Named in the 10-K among independent security vendors.
- CrowdStrikeNamed in the 10-K among independent security vendors.
Supply Chain
Palo Alto Networks is asset-light on manufacturing. It relies on one electronics manufacturing services provider to assemble most products and sources certain components from sole-source suppliers.
More on PANW: Earnings recap