Network and cloud-delivered security. NET / PANW. Run 29 September 2026. Built from Cloudflare's FY2023 to FY2025 10-Ks, Q2 FY2026 10-Q, Q2 FY2026 release and 2026 8-Ks, and earnings-call transcripts through 6 August 2026; Palo Alto Networks' FY2017, FY2018, FY2024 to FY2026 10-Ks, Q4 FY2026 release (1 September 2026) and 2025 to 2026 8-Ks; industry data and the PANW Q4 FY2026 call from cited web sources. Events swept through 29 September 2026; most recent events checked: PANW's Console acquisition (1 September 2026) and Gartner Hybrid Mesh Firewall MQ (September 2026); Cloudflare's $2.5bn 0% convertible notes due 2031 (issued 13 August 2026). Figures in US dollars as reported; no FX conversion. Not a valuation and not a recommendation.
Three Cloudflare cells carry the next five years, and each has a structural driver PANW lacks. Application security and delivery rides agent traffic: more than half of the traffic on Cloudflare's network was non-human in Q2 2026 (Q2 FY2026 call), and Cloudflare fronts 85.2% of reverse-proxied websites (W3Techs, September 2026), so every new AI crawler or agent lands on its network first. Developer and AI compute (Workers) is the fastest-growing act and is sold increasingly through multi-product pool-of-funds contracts, about 20% of Q4 2025 new contract value (Q4 FY2025 and Q2 FY2026 calls). SASE is the third engine, now pushed through channel partners, who sold 31% of revenue in Q2 2026 against 16% in FY2023 (Q2 FY2026 10-Q; FY2025 10-K).
PANW's organic engines are real but smaller relative to its base: XSIAM ARR about $700m (+70%), SASE bookings +40%, Prisma AIRS past $100m ARR (Q4 FY2026 call, web). They sit on an organic company growing about 14% and slowing, and the FY2027 guide of $14.10 to 14.20bn implies about 15% growth over pro forma FY2026 revenue of $12,312m (FY2026 10-K pro forma; inferred). Growth above that line is bought: CyberArk ($21.1bn), Chronosphere, Koi, Portkey and Console in twelve months (FY2026 10-K; web). Cloudflare also grows faster in every region, including APAC at +48% in FY2025 (FY2025 10-K).
PANW converts better, through its selling model rather than its product cost. It sells additional platforms into an installed base that already covers almost all of the Fortune 100, through distributors, on one- to five-year contracts that are often prepaid; that keeps sales and marketing at 34% of revenue and puts 1.85 years of revenue under contract (RPO $21.2bn; FY2026 10-K). Cloudflare spends 42.5% of revenue on sales and marketing and 18% on G&A, and its gross margin is falling: GAAP 71.8% in Q2 2026 against 74.9% a year earlier, as lower-margin Workers grows and more network cost moves from free to paid traffic (Q2 FY2026 10-Q and call). It also has to fund network capex of 14 to 15% of revenue, against about 4% at PANW (Q2 FY2026 call; FY2026 10-K, capex inferred from FCF).
This is the tension of the run: the growth winner is not the margin winner. Cloudflare is a compounder whose engine is still average at converting revenue to profit; PANW is a fortress whose organic growth has slowed to the low teens. The call weights growth more because the same-scale test in the Cost Engine tab shows PANW ran the same 50%-plus sales-and-marketing load and a minus 10% operating margin at $1.8bn of revenue (FY2017 10-K). The one thing that would break that reading is if Cloudflare's gross margin keeps sliding as Workers scales, because then the cost gap would sit in the product, not in the salesforce.
Cloudflare's exposure is revenue that flexes with usage. Only about 1.1 years of revenue sits under contract (RPO $2.73bn against $2.51bn trailing revenue; Q2 FY2026 call, ratio inferred), pool-of-funds and Workers revenue is consumed rather than fixed, and 27% of revenue comes from accounts below $100k a year (Q2 FY2026 call). The last slowdown showed the mechanism: net retention fell from 127% (Q1 2022) to 110% (Q3 2024) and growth from 54% to 27% (call transcripts). Revenue never shrank, but with a GAAP operating loss and capex of 14 to 15% of revenue already committed, Cloudflare has less room to absorb a slowdown than PANW does.
PANW's exposure is slower-burning and sits on the balance sheet. Hardware, about 10% of revenue (Q4 FY2026 call, web), is at a refresh peak (firewall market +18% in Q2 2026, Dell'Oro, web). $14.8bn of CyberArk goodwill and a $3.5bn "platform renewals" intangible depend on forecast identity renewals and were flagged as a critical audit matter (FY2026 10-K). Two distributors carry 30% of revenue (FY2026 10-K). With 36% FCF margin and 1.85 years of revenue contracted, PANW's reported results hold up through a downturn, so on this lens Cloudflare breaks first.
Neither company discloses revenue by product and region together, so these six offering-by-region cells are built from the two axes each does disclose (region, revenue type) plus platform metrics from the calls; together they cover substantially all of both companies' revenue. Only one cell, SASE, is truly contested.
| Cell (offering x region) | Cloudflare | PANW | Why (one clause, sourced) |
|---|---|---|---|
| Network firewall x Americas | 1 | 5 | PANW co-number-one in security appliances at 18.7% (IDC 4Q24, web), Gartner Hybrid Mesh Firewall Leader 2026 (web); Cloudflare sells no appliance. |
| SASE / Zero Trust x Americas | 3 | 4 | PANW: Gartner SASE Leader, 6,800+ Prisma SASE customers, bookings +40% (web); Cloudflare: Gartner Visionary, wins such as a $5.2m Fortune 100 full-SASE deal (Q2 FY2026 call). |
| SASE / Zero Trust x EMEA + APAC | 3 | 3 | Cloudflare's 330-city network and data-localization suite vs PANW EMEA +27% and APAC +25% reported, organic split not disclosed (FY2025 and FY2026 10-Ks). |
| Application security and delivery x global | 5 | 1 | Cloudflare on 26.1% of all websites and 85.2% of reverse-proxy sites (W3Techs, web); PANW has no CDN or edge WAF line in its 10-K product list. |
| Developer and AI compute x global | 4 | 0 | Workers is Cloudflare's fastest-growing act, developer additions in Q2 2026 exceeded all of 2025 (Q2 FY2026 call); PANW has no offering. |
| Security ops, identity, observability x Americas-led | 0 | 4 | XSIAM ARR ~$700m +70%, Idira revenue $1.26bn +21% pro forma (Q4 FY2026 call, web); Gartner SIEM Challenger, not Leader (web). Cloudflare absent. |
Scores are anchored to the exhibits in the three tabs and are not summed. The pattern is the finding: each company scores 4 or 5 in the cells the other barely enters, and the one shared cell (SASE) leans PANW today. The three lenses get their verdicts in the Three Answers, not here.
Normalization: both companies report revenue by billing region. PANW splits Americas into the US and Other Americas; Cloudflare reports the US, EMEA, APAC and "Other", so the last row is not like-for-like. Cloudflare reports "substantially all" revenue as subscription and support and does not break out revenue by product act (FY2025 10-K; Q2 FY2026 call). PANW splits revenue into product, subscription and support and gives platform-level ARR only on calls. Offering families are therefore normalized as: network firewall, SASE and Zero Trust, application security and delivery, developer and AI compute, and security operations with identity and observability.
Because PANW is 4.6 times larger, the chart plots each region as a share of its own company's revenue. The contrast is in the growth labels. Cloudflare's slowest region grew 26% in FY2025. PANW's fastest region grew 36% in FY2026, but every PANW region includes the $930m of acquired revenue that lifted the total from 14.4% organic to 24.5% reported.
| Region cell | NET rev $m (%) | NET growth FY25 / Q2'26 | PANW rev $m (%) | PANW growth FY26 / 2y CAGR | Leader |
|---|---|---|---|---|---|
| US | 1,073 (49.5%) | +26.3% / +40.7% | 7,108 (61.9%) | +22.8% / +17.7% | PANW on scale; Cloudflare on organic growth, accelerating |
| EMEA | 599 (27.6%) | +28.3% / +30.4% | 2,428 (21.1%) | +26.7% / +23.1% | Cloudflare, organic |
| APAC | 330 (15.2%) | +47.7% / +32.3% | 1,373 (12.0%) | +24.9% / +20.7% | Cloudflare, fastest cell in the duel |
| Rest (definitions differ) | 167 (7.7%) | +27.7% / +31.8% | 571 (5.0%) | +36.3% / ND | Not comparable |
Sources: NET FY2025 10-K and Q2 FY2026 10-Q (region notes); PANW FY2026 10-K. PANW 2-year CAGR FY2024 to FY2026 includes acquisitions; US-only CAGR uses FY2024 US revenue of $5,134m.
| Offering family | Cloudflare evidence | PANW evidence | Driver and durability |
|---|---|---|---|
| SASE / Zero Trust (contested) | Second-fastest act; partners 31% of revenue, focused on SASE; Gartner Visionary 2025 and 2026 (Q2 FY2026 call and 10-Q; web) | Gartner Leader four times; 6,800+ Prisma SASE customers; bookings +40%; ~100 legacy displacements worth >$400m TCV (web) | Market ~$3.5bn a quarter, growing >20% (Dell'Oro 2Q26, web). PANW leads; Cloudflare gaining from a small base (inferred; no share data). |
| App security and delivery | 85.2% of reverse-proxy sites; >50% non-human traffic Q2 2026; pay-per-crawl and agent payments (W3Techs; Q2 FY2026 call) | No offering | Agentic traffic volume. Durable: new agent traffic lands on the network by default. |
| Developer and AI compute | Fastest act; $7.5m and $4m one-year Workers pool-of-funds deals; lower gross margin than corporate average (Q1 and Q2 FY2026 calls) | No offering | Agent workloads on Workers. High growth, margin-dilutive near term. |
| Network firewall | No appliance; argues hardware is losing (Q1 FY2026 call) | Hardware ~10% of revenue; product revenue +27% on new hardware and CyberArk licences (Q4 FY2026 call, web; FY2026 10-K) | Refresh cycle, market +18% in 2Q26 (Dell'Oro, web). Cyclical. |
| SecOps, identity, observability | Absent | XSIAM ARR ~$700m +70%, >1,000 customers; Idira $1.26bn +21% pro forma; observability ARR >$500m (Q4 FY2026 call, web) | Cross-sell into installed base. Largely acquired: CyberArk $21.1bn, Chronosphere (FY2026 10-K). |
| Lever | Cloudflare | PANW |
|---|---|---|
| Channel | 69% direct, 31% partners (Q2 2026); self-serve plans paid by card | Two-tier distribution; two distributors 30% of revenue (15% each); >8,700 partners |
| Contract form | Monthly self-serve; enterprise 1 to 3 years; pool-of-funds drawn down on usage | 1 to 5 year subscriptions and support, invoiced upfront or annually |
| Revenue under contract | RPO $2.73bn, ~1.1x LTM revenue | RPO $21.2bn, 1.85x revenue |
| Price stance | Disruptor: free tier, zero egress fees on storage | Premium enterprise vendor |
Sources: NET FY2025 10-K, Q2 FY2026 10-Q and call; PANW FY2026 10-K. Ratios inferred.
| Dimension | Cloudflare | PANW |
|---|---|---|
| Footprint | Own servers in 330+ cities, 125+ countries, in co-location and ISP sites | Flex builds hardware, mainly in the US; cloud products hosted by third-party clouds |
| Concentration | Limited suppliers for server components | Sole-source chips, Asia-concentrated |
| Current shock | Memory and storage shortages; capex guided 14 to 15% of revenue for 2026 | Memory costs cut product gross margin to 75.1% from 77.1% |
| Capital intensity | 15.8% of revenue (FY2025) | 3.8% of revenue (FY2026, inferred) |
Sources: NET FY2025 10-K and Q2 FY2026 call; PANW FY2026 10-K (capex = operating cash flow $4,553m less FCF $4,113m).
Firewall: Fortinet 19.0%, PANW 18.7%, Cisco 11.4%, Check Point 7.5% of security appliances (IDC 4Q24, web); PANW holds share. SASE: Zscaler first at 21% (Dell'Oro 3Q24, web), then Cisco and PANW; in Gartner's 2026 SASE Magic Quadrant, PANW and Zscaler are Leaders and Cloudflare a Visionary (web). Reverse proxy: Cloudflare 85.2% of sites, CloudFront 5.5%, Fastly 3.0%, Akamai 2.1% (W3Techs, web). SIEM: Microsoft, Splunk and Google lead; PANW is a Challenger and gaining (Gartner October 2025, web). No direct head-to-head disclosure between the two companies was found.
Network firewall (PANW): the refresh that lifted the market 18% in Q2 2026 reverses, hitting a line PANW prices at a premium. SASE (both): Microsoft and Cisco bundle Zero Trust into existing agreements; Cloudflare is more exposed on enterprise trust after its 18 November 2025 and 20 February 2026 outages (Cloudflare blog, web), PANW on price. Application security and delivery (Cloudflare): reliability is the product, and a repeat global outage would test renewal rates. Developer compute (Cloudflare): consumption falls fast in a downturn and dilutes gross margin on the way up. Security operations and identity (PANW): identity renewals under the $3.5bn platform-renewals intangible fall short of forecast, forcing an impairment.
Traffic scale that earns network terms (High). 26.1% of all websites and 85.2% of reverse-proxy sites (W3Techs, web); interconnection and peering arrangements with ISPs described as mutually beneficial (FY2025 10-K). An entrant can buy servers, not the traffic.
One stack on every server (High). Every service runs on every server in 330+ cities (FY2025 10-K), so a new product is a software release, not a new build.
Developer habit (Medium). Developer additions in Q2 2026 exceeded all of 2025 (Q2 FY2026 call); hyperscalers compete here.
Installed firewall base and policy lock-in (High, tied to appliances). Almost all of the Fortune 100 and most of the Global 2000 (FY2026 10-K); co-number-one appliance share (IDC, web).
Platform breadth (Medium). Network, SecOps, cloud, identity, observability under one contract; platformized customers retain above 120% (Q4 FY2026 call, web). Much of it was bought (CyberArk $21.1bn), so part is money-buyable.
Channel reach (Medium to High). More than 8,700 partners (FY2026 10-K).
| Lever | Cloudflare | PANW |
|---|---|---|
| Concentration | No customer above 10%; large customers 73% of Q2 2026 revenue | No end-customer above 10%; two distributors 30%, one holds 19% of receivables |
| Expansion | Net retention 120% (Q2 2026), range 110% to 127% since 2022 | Platformized NRR above 120% (company-selected cohort) |
| Lock-in | RPO ~1.1x revenue | RPO 1.85x revenue |
| Pricing power exercised | Wins on price and performance; consumption optimized in 2023 to 2024 | Premium pricing held; ~100 SASE displacements |
Sources: NET FY2025 10-K, Q2 FY2026 10-Q and call transcripts 2022 to 2026; PANW FY2026 10-K, Q4 FY2026 call (web).
Cloudflare owns the servers and depends on co-location and ISP partners plus a limited set of component suppliers; pass-through is partial, because usage pricing moves with volume, not cost (FY2025 10-K). PANW depends on Flex and on sole-source chips for hardware, and its cloud-delivered products run on third-party clouds whose owners it names as competitors; memory costs already cut product gross margin by 2 points in FY2026 and subscription and support gross margin fell 3.3 points as cloud hosting rose (FY2026 10-K). Cloudflare has more capex to fund, but PANW's fastest-growing products rent their infrastructure from rivals.
| Cell | Route control | Pocket price | Continuity | Outcome (share / margin) | Confirming KPI |
|---|---|---|---|---|---|
| SASE / Zero Trust | PANW: channel + field; Cloudflare: direct, partners focused here | Cloudflare below PANW (inferred) | Cloudflare own network; PANW rented clouds | PANW share flat to up, margin flat; Cloudflare share up from small base, margin up (SASE margins "extraordinarily high", Q3 FY2025 call) | Gartner SASE MQ 2027; Cloudflare channel share of revenue |
| App security and delivery | Cloudflare direct and self-serve | Cloudflare sets it | Cloudflare own network | Cloudflare share flat at dominance, margin up if agent monetization lands | W3Techs share; net retention |
| Network firewall x Americas | PANW via distributors | PANW premium (inferred) | Flex + sole-source chips | PANW share flat, margin down near term (memory) | PANW product gross margin vs 75% |
The tension: Cloudflare grows fastest in developer compute, where its gross margin is lowest and pricing is consumption-based; PANW's highest-power cell, the firewall base, is its slowest organic grower.
Three causes explain most of the difference. Contract length (RPO 1.85x vs 1.1x revenue) is Major and favors PANW; Cloudflare's route to close it is pool-of-funds commitments, already about 20% of new contract value, a three- to five-year job. Sales-model weight (sales and marketing 34% vs 42.5%) is Moderate and scale-driven: PANW ran 52% at $1.76bn of revenue (FY2017 10-K), so it is not a PANW moat. Architecture is Major and favors Cloudflare: PANW cannot buy a global network that fronts a quarter of all websites; that would take the better part of a decade (inferred).
Both companies report costs by function under US GAAP, so no by-nature mapping is needed. SG&A is sales and marketing plus G&A; EBIT is GAAP operating income. Windows: Cloudflare FY2023 to FY2025 (December year-ends), PANW FY2024 to FY2026 (July year-ends), a seven-month offset. One classification difference matters: Cloudflare books bandwidth and co-location for free customers in sales and marketing, not cost of revenue (FY2025 10-K), which flatters its gross margin and inflates its S&M. No restructuring falls in either window; Cloudflare's $150.7m charge is in Q2 2026.
| % of sales, 3y avg | Cloudflare | PANW | Gap | What drives it |
|---|---|---|---|---|
| COGS | 23.9 | 27.3 | -3.4 | PANW hardware (~10% of revenue) and $418m of acquired-intangible amortization in FY2026 COGS; Cloudflare's free-user network cost sits in S&M |
| R&D | 25.5 | 22.1 | +3.4 | Cloudflare still investing ahead of scale; falling from 27.6 to 23.6 |
| SG&A | 61.6 | 41.3 | +20.3 | S&M 44.4 vs 34.2 (direct selling, free tier cost) and G&A 17.1 vs 7.0 |
| Gross margin | 76.1 | 72.7 | +3.4 | Mirror of COGS; Cloudflare's lead shrinking (74.5 in FY2025, 71.8 in Q2 2026) |
| EBIT margin | -11.0 | 9.4 | -20.4 | SG&A gap; SBC 20.7% vs 14.5% of revenue |
Sources: NET FY2025 10-K; PANW FY2026 10-K. Simple averages of annual ratios. Gap = Cloudflare minus PANW, percentage points.
| % of revenue | NET FY23 | NET FY24 | NET FY25 | PANW FY24 | PANW FY25 | PANW FY26 |
|---|---|---|---|---|---|---|
| Revenue $m | 1,296.7 | 1,669.6 | 2,167.9 | 8,027 | 9,221 | 11,480 |
| COGS | 23.7 | 22.7 | 25.5 | 25.7 | 26.6 | 29.6 |
| R&D | 27.6 | 25.2 | 23.6 | 22.5 | 21.5 | 22.2 |
| SG&A | 63.0 | 61.3 | 60.4 | 43.3 | 38.4 | 42.1 |
| Gross margin | 76.3 | 77.3 | 74.5 | 74.3 | 73.4 | 70.4 |
| EBIT margin | -14.3 | -9.3 | -9.6 | 8.5 | 13.5 | 6.1 |
| Non-GAAP op. margin | 9 | 14 | 14 | ND | 28.8 | 29.2 |
| SBC | 21.1 | 20.3 | 20.8 | 13.4 | 14.1 | 15.8 |
PANW FY2025 G&A (4.8%) was lowered by a net acquisition-related credit of $110m (Q4 FY2026 release reconciliation); FY2026 G&A and COGS carry CyberArk costs and amortization. PANW FY2024 non-GAAP margin not in the documents read (ND). Cloudflare non-GAAP margins as rounded in its FY2025 10-K.
| % of revenue | Cloudflare FY2025 ($2,168m) | PANW FY2017 ($1,762m) | PANW FY2018 ($2,273m) |
|---|---|---|---|
| Sales and marketing | 42.5 | 52.2 | 48.3 |
| R&D | 23.6 | 19.7 | 17.6 |
| G&A | 18.0 | 11.3 | 11.3 |
| Gross margin | 74.5 | 72.9 | 71.6 |
| GAAP operating margin | -9.6 | -10.2 | -5.7 |
| SBC | 20.8 | 27.0 | 22.2 |
Sources: NET FY2025 10-K; PANW FY2017 and FY2018 10-Ks. PANW FY2017 to FY2018 were reported under ASC 605 (ASC 606 adopted FY2019), so revenue timing is not fully comparable.
The most persistent difference is SG&A: about 20 points in every year of the window (Cloudflare 63.0, 61.3, 60.4; PANW 43.3, 38.4, 42.1). Part of it is mechanism: Cloudflare pays for free-tier traffic inside S&M, sells mostly direct, and carries G&A of 18% of revenue including $154m of stock pay. Part is scale: PANW itself ran sales and marketing above 48% at the same size. The cross-check against the power map cuts both ways. PANW's customer power shows up in selling efficiency (S&M 34%), which confirms it. It does not show up in gross margin, where Cloudflare leads by 3.4 points despite giving service away, which confirms Cloudflare's architectural cost advantage and weakens any reading of PANW pricing power as a margin premium. The fixable part of Cloudflare's gap is G&A, and the May 2026 cut of more than 1,100 roles (Q1 FY2026 call) is aimed at it; the risk is that gross margin, not SG&A, becomes the new gap as Workers scales.
| Metric | Threshold | By when | If it hits, it favors | Where published |
|---|---|---|---|---|
| Cloudflare revenue growth | 30% or more each quarter | Through Q2 FY2027 (Aug 2027) | Cloudflare | Quarterly release and 10-Q |
| Cloudflare non-GAAP operating margin | 17% or more for FY2027 (14% or less favors PANW) | Q4 FY2027 release (Feb 2028) | Cloudflare | Quarterly release |
| Cloudflare GAAP gross margin | 72% or more (below 70% favors PANW) | Q4 FY2026 (Feb 2027) | Cloudflare | 10-K / release |
| PANW organic revenue growth | 17% or more in any quarter | FY2027 (Aug 2026 to Jul 2027) | PANW | 10-Q acquisition note; release |
| PANW RPO growth vs revenue growth | RPO growth at or above revenue growth (guide RPO +19 to 20%) | FY2027 10-K (Sep 2027) | PANW | 10-K key metrics |