29 September 2026 · Built from PANW 10-Ks FY2016–FY2026, the Q4 FY2026 release (1 Sep 2026), 8-Ks and the 2025 proxy; industry data and the Q4 FY2026 call from the web (labelled). Not a valuation and not a recommendation.
The unit is one enterprise customer’s security contract: about $164k of revenue a year on average, 80% of it recurring and paid before it is recognised, converting about 36% to free cash flow. Roughly 16 points of revenue go back to employees in stock, and together with acquisition amortisation that is why GAAP operating margin is 6% while free-cash-flow margin is 36%.
| What the business is | Palo Alto Networks sells enterprise cybersecurity to large organisations, mostly through distributors and resellers. The range covers firewalls in hardware, software and cloud-delivered form, security-operations and cloud-security software and, since February 2026, identity security. Most of the money comes from multi-year subscriptions attached to a firewall estate or a software platform. FY2026 revenue was $11.48bn, earned with 21,921 employees (FY2026 10-K). |
| Industry | Enterprise cybersecurity. Gartner puts 2026 end-user security spending at $239.8bn. Network security, PANW's historical core, is only $25.8bn of that and the slowest-growing segment (Gartner, July 2025). |
| How it makes money | Customers pay upfront or annually for two things. Hardware and software licences are recognised on delivery (20% of revenue). Subscriptions and support run one to five years and are recognised ratably (80%). Because customers pay before revenue is recognised, $14.8bn of deferred revenue has built up. Revenue is reported net of sales taxes; the treatment of channel margins is not disclosed (unknown). Some customers are financed over two to five years, leaving $1.5bn of receivables (FY2026 10-K). |
| Unit of economics | The unit is one enterprise customer's security contract. PANW has 'more than 70,000' customers (Q4 FY2026 release). That averages at most about $164k of revenue and $59k of free cash flow per customer a year (inferred: FY2026 totals divided by 70,000), heavily skewed to large enterprises. The recurring part is tracked as NGS ARR, which stood at $9.1bn. |
| What protects it | A large installed base of firewalls. Switching vendor means rewriting years of security policy, which customers usually do only at a roughly five-year hardware refresh. More than 8,700 channel partners resell it (FY2026 10-K). Increasingly, PANW is also both the security-operations data layer (XSIAM) and the privileged-identity system (CyberArk). A network-only or endpoint-only rival cannot sell all of these in one contract. |
| What drives earnings | Selling more platforms into existing customers; buying ARR (CyberArk, Chronosphere); the firewall hardware refresh cycle; share-based pay and amortisation of acquired intangibles, which are the gap between a 29% non-GAAP operating margin and a 6% GAAP one. |
| What to watch | Organic revenue growth excluding acquired contributions (13.2% in Q4 FY2026 and decelerating, inferred); NGS ARR growth and the part of it that was acquired; the diluted share count against the FY2027 guide of 844–847m. |
| Cycle exposure | Subscriptions and support (80% of revenue): low. Hardware (inside the 20% product line): medium to high, and currently in a refresh upswing (Dell'Oro: firewall market +18% in 2Q26). Usage-priced observability: medium. Overall exposure is low to medium. Hardware sits near a cyclical high while organic growth is slowing. |
US dollars. Fiscal years end 31 July; latest reported period is FY2026 (Q4 FY2026, reported 1 September 2026). '(inferred)' marks a conclusion reasoned from sourced figures, not a disclosed number. Items tagged 'web' come from outside the research folder.
Every large organisation runs traffic, users, cloud workloads and now AI agents that an attacker can exploit. Security teams need to inspect that traffic, detect intrusions and control who can reach what. Historically they bought a separate product for each job. Palo Alto Networks, incorporated in 2005, started with one answer: a firewall that classifies traffic 'by application, user, and content' rather than by port (FY2016 and FY2026 10-Ks). Its strategy since 2023 has been to become the single vendor for most of the security estate, which it calls 'platformization' (FY2026 10-K).
The unit of economics is one enterprise customer's security contract. A typical contract starts with firewalls: a PA-series appliance, a VM-Series or CN-Series software firewall, or cloud-delivered SASE. Flex manufactures the hardware in the U.S. and PANW recognises it as revenue on shipment (FY2026 10-K).
Attached to the firewall are one- to five-year subscriptions (threat prevention, URL and DNS filtering, SASE) plus support. These are recognised ratably but invoiced upfront or annually on 30–75 day terms, or financed over two to five years for qualified customers (FY2026 10-K).
Cash therefore arrives before revenue is recognised, which is why deferred revenue ($14.8bn) and remaining performance obligations ($21.2bn, 1.85 times annual revenue) exceed a year of sales. Over later years the same customer is sold further platforms, and each one adds recurring revenue on top of the existing relationship.
FY2026 revenue splits three ways. Product is $2,280m (19.9%): hardware plus on-premise software licences, including CyberArk's. Subscription is $6,239m (54.3%) and support $2,961m (25.8%) (FY2026 10-K). The portfolio is now packaged as four offers:
PANW sells through a two-tier channel of distributors and more than 8,700 resellers (FY2026 10-K). Two distributors each accounted for 15% of FY2026 revenue. That is down from three that together made up 44% in FY2025 (FY2026 and FY2025 10-Ks). No end-customer exceeds 10% of revenue.
The mix has moved decisively away from the box. Product was 48.7% of revenue in FY2016 and 19.9% in FY2026 (FY2018 and FY2026 10-Ks). Product revenue stalled twice:
Growth came instead from software firewalls, SASE, security operations (Demisto, Expanse, IBM QRadar SaaS), cloud security (RedLock, Twistlock, Bridgecrew), identity (CyberArk) and observability (Chronosphere). These businesses recur, so each dollar sold is collected again at renewal. A hardware sale is collected once.
Sources: FY2018–FY2026 10-Ks (latest filing reporting each year). FY2016 on ASC 605; later years on ASC 606. FY2026 includes CyberArk and Chronosphere from early 2026.
Management runs the business on Next-Generation Security ARR: the annualised value of active contracts, excluding hardware, legacy attached subscriptions, support and services (Q4 FY2026 release). NGS ARR is also half of the executive PSU formula (2025 proxy).
Two features of the metric matter:
NGS ARR therefore tells you which way the business is moving. It is not a like-for-like organic series.
The industry sells risk reduction: products and services that stop attackers reaching data, systems and money. Gartner puts 2026 end-user spending at $239.8bn. Software ($121.2bn) is the largest and fastest-growing segment, services are $92.8bn, and network security only $25.8bn (Gartner, July 2025). The pool therefore grows low double digits, but PANW's origin market is the smallest and slowest part of it. That explains why the company has spent a decade buying its way into cloud, security operations, identity and observability.
Most of the profit pool sits with vendors that own the software IP. Leading vendors earn 70–87% GAAP gross margins, and the scaled ones convert 23–44% of revenue to free cash flow (competitor filings, web).
Contract manufacturers build the hardware (Flex for PANW; Taiwanese contract manufacturers for Fortinet). Distributors and resellers carry the logistics and the customer relationship. Their margins were not researched (unknown). The market is global, not local: the same product ships to more than 180 countries (FY2026 10-K).
| Company (FY) | Revenue | Growth | Gross margin | Op. margin | FCF margin |
|---|---|---|---|---|---|
| Palo Alto Networks (Jul-26) | $11.48bn | +24%* | 70.4% | 6.1% | 35.8% |
| Fortinet (CY25) | $6.80bn | +14% | 80.5% | 30.7% | 32.5% |
| CrowdStrike (Jan-26) | $4.81bn | +22% | 74.7% | -6.1% | 25.8% |
| Zscaler (Jul-26) | $3.35bn | +25% | 76.8% | -4.0% | 23.2% |
| Okta (Jan-26) | $2.92bn | +12% | 77% | 5.1% | 29.6% |
| Check Point (CY25) | $2.73bn | +6% | 86.7% | 30.5% | ~44% |
Sources: company FY2026 10-K (PANW); competitors' fiscal-year earnings releases (web). *PANW growth includes $930m of acquired revenue; organic growth was about 14% (see Section 4).
The firewall market is concentrated, and becoming more so. IDC's latest public data (4Q24) has Fortinet at 18.95% and PANW at 18.71% of security-appliance revenue: a statistical tie. Cisco follows at 11.4% and Check Point at 7.5%. The rest of the market is shrinking 5.2% a year (IDC, web).
Fortinet claims more than 50% of units, but those skew to small branch devices. In SSE, the cloud-delivered part of SASE, Zscaler led with 34% share in 3Q24 and PANW was second (Dell'Oro, web). In endpoint, Microsoft is first with 28.6% (IDC via Microsoft, web).
PANW's claim to be the largest pure-play security company holds on revenue: $11.48bn against Fortinet's $6.80bn and CrowdStrike's $4.81bn. Its claim to be the number-one firewall vendor depends on the metric, and is not supported on units.
Not every barrier binds. Features do not: PANW itself has bought about 30 start-ups since 2017 because new point products keep appearing (FY2017–FY2026 10-Ks). Four barriers do bind:
PANW's specific position combines a large firewall installed base, the control point where most enterprise traffic is inspected, with a security-operations platform and now privileged identity. That combination is what a well-funded rival would find hardest to reproduce.
There is independent evidence that buyers reward single-vendor stacks. Single-vendor SASE grew 77% in 2024 while multi-vendor SASE fell 56%, and the top six vendors' share rose from 64% to 71% (Dell'Oro, web). PANW's own evidence is weaker because it is self-selected: platformized customers show net revenue retention above 120% (Q4 FY2026 call, web).
Differentiation shows up in growth and breadth, not in GAAP profitability. Fortinet, which designs its own ASICs and sells cheaper hardware, earns an 80.5% gross margin and a 30.7% GAAP operating margin. The comparable PANW figures are 70.4% and 6.1% (web; FY2026 10-K).
The position can be weakened from two directions. Bundlers with distribution are the first: Microsoft's endpoint share rose to 28.6%, Google bought Wiz for $32bn, and the 10-K now warns that cloud providers may bundle native security 'at low or no incremental cost to customers' and names 'frontier or foundational AI model providers' as entrants (FY2026 10-K). Fortinet's price-led firewall is the second.
“The major public cloud infrastructure providers increasingly offer native security, identity, and observability capabilities that compete with our products and subscriptions. These providers have significant resources and may bundle native capabilities with their cloud infrastructure services at low or no incremental cost to customers.”Palo Alto Networks, FY2026 10-K, risk factors
Winners in this industry own a high-frequency control point, own the data and workflow layer, generate enough cash to fund R&D and M&A, and have distribution. PANW fits that profile more completely than any other pure-play. It is not the low-cost producer, however, and it is smaller than the bundlers.
Reported FY2026 revenue grew 24%, from $9,221m to $11,480m. CyberArk (closed 11 February 2026) and Chronosphere (closed 29 January 2026) contributed $930m after closing (FY2026 10-K). Excluding them, revenue grew about 14.4% to $10,550m (inferred), in line with the pre-deal guide of about 14% (Q4 FY2025 release).
Organic growth slowed through the year: 15.7%, 14.8%, 14.2% and 13.2% by quarter (inferred from quarterly releases and the 10-K acquisition note). On a pro forma basis, with both deals owned for two full years, revenue grew 17.4% (FY2026 10-K). The headline rate is therefore mostly a statement about acquisitions. The organic business is growing in the low teens and decelerating.
| Measure | FY2025 | FY2026 | Growth |
|---|---|---|---|
| Reported revenue ($m) | 9,221 | 11,480 | +24.5% |
| Acquired revenue, CyberArk + Chronosphere ($m) | — | 930 | — |
| Organic revenue ($m, inferred) | 9,221 | 10,550 | +14.4% |
| Pro forma revenue, both deals owned all period ($m) | 10,486 | 12,312 | +17.4% |
| NGS ARR, reported ($bn) | 5.6 | 9.1 | +63% |
| NGS ARR, organic at Q3 FY2026 (inferred) | — | ~6.5 | ~+27–28% |
Sources: FY2026 10-K (acquisition note, pro forma); Q3 and Q4 FY2026 releases. At Q3, $1.6bn of the $8.1bn NGS ARR came from the two acquisitions; the year-end split is not disclosed.
By component:
Organic NGS ARR grew about 27–28% at Q3 against organic revenue growth of about 14% (inferred). New ARR is coming mainly from existing customers adopting security operations, SASE and cloud. XSIAM ended FY2026 above $700m ARR, up 70%, with more than 1,000 customers (Q4 FY2026 call, web). This is the engine the moat analysis supports.
About 30 deals since FY2017, culminating in CyberArk ($21.1bn booked) and Chronosphere ($2.95bn) (FY2026 10-K). They added $930m of revenue in FY2026 and will add more in FY2027 as the deals annualise. Idira revenue was $1.26bn in FY2026, up 21%, and observability ARR exceeded $500m (Q4 FY2026 call, web).
Product revenue rose on 'increased demand for our new generation of hardware products' (FY2026 10-K). The firewall market grew 18% in 2Q26, which Dell'Oro calls a targeted rather than estate-wide refresh (web). It will not persist through the cycle.
Prisma AIRS passed $100m ARR within its first year (Q4 FY2026 call, web). Gartner sizes securing AI at $2.8bn in 2026, growing about 69% in 2027 (web). The market is real but still small against an $11bn revenue base.
In 2024 PANW gave consolidating customers free product periods and financed deals. The FY2024 cash-flow line for financing receivables was -$866m (FY2026 10-K). The incentives pull ARR forward at the expense of recognised revenue and near-term cash. Financing receivables have been shrinking since, to $1.5bn.
The FY2027 guide calls for revenue of $14.10–14.20bn (+23–24%) and NGS ARR of $11.08–11.18bn (+22–23%) (Q4 FY2026 release). Against pro forma FY2026 revenue of $12.31bn, the revenue midpoint implies about 15% growth (inferred). Organic growth is therefore guided flat to slightly up, not accelerating.
FY2026 GAAP gross margin was 70.4%, down from 73.4% (FY2026 10-K). Three things drove the decline:
Subscription and support gross margin (69.2%) is now below product gross margin (75.1%). Security delivered from the cloud carries data-centre costs that an appliance subscription did not. The largest cost is selling: sales and marketing took 34.3% of revenue, R&D 22.2% and G&A 7.8% (FY2026 10-K).
The gap between the two margin measures is large and structural. Non-GAAP operating margin was 29.2% and GAAP 6.1% (Q4 FY2026 release; FY2026 10-K). About 23 points separate them:
Scheduled amortisation rises to $1,081m in FY2027 (FY2026 10-K), so GAAP margins will stay depressed for several years regardless of how the business performs.
Cash conversion runs well above GAAP profit. FY2026 operating cash flow was $4,553m, capex $440m and free cash flow $4,113m, a 35.8% margin (FY2026 10-K). Three mechanisms explain it:
The more demanding measure is FCF after share-based pay. It was $2.3bn, or 20% of revenue (inferred). Capex is light at 3.8% of revenue, including a headquarters land purchase.
Sources: FY2018–FY2026 10-Ks; FCF = operating cash flow − capex (matches company definition). Convertible-note accounting changed in FY2022 without restatement.
| Metric | FY2016 | FY2021 | FY2025 | FY2026 |
|---|---|---|---|---|
| Revenue ($m) | 1,379 | 4,256 | 9,221 | 11,480 |
| Subscription & support, % of revenue | 51.3% | 73.7% | 80.5% | 80.1% |
| GAAP operating margin | -11.4% | -7.1% | 13.5% | 6.1% |
| Free cash flow margin | 42.5% | 32.6% | 37.6% | 35.8% |
| Share-based compensation, % of revenue | 28.5% | 21.8% | 14.1% | 15.8% |
| Diluted shares (m, split-adjusted) | 523 | 578 | 709 | 764 |
Sources: FY2018, FY2023, FY2026 10-Ks (latest filing reporting each year). Comparability: FY2016 is on ASC 605 and was never restated for ASC 606 (adopted FY2019). FY2016 was restated in FY2017 for commission capitalisation. Convertible-note accounting changed in FY2022 without restatement. Share counts are adjusted for the 2022 (3:1) and 2024 (2:1) splits (computed). FY2026 includes CyberArk and Chronosphere from their early-2026 closings.
Capital allocation, FY2016–FY2026, ranked by amount (inferred, sums of 10-K cash-flow lines):
Convertible notes were issued and retired in cycles; the only debt left is $1.1bn of assumed CyberArk 0% notes due 2030. Against that sit $7.9bn of cash and investments, leaving net cash of about $6.8bn (FY2026 10-K; net figure inferred).
Buybacks have not offset equity issuance. Cumulative share-based pay of $9.85bn exceeded buybacks. Shares outstanding rose about 23% from FY2016 to FY2025 on a split-adjusted basis, before CyberArk added 112m shares and warrant settlement another 27m (FY2016, FY2025 and FY2026 10-Ks).
The behaviour reveals a management team that buys categories rather than building them. It uses stock for the largest deals and treats buybacks as dilution management. Just after issuing 112m shares for CyberArk, it spent $1.0bn buying 6.8m shares back at about $147.70 (FY2026 10-K).
Deal terms and events after the FY2026 figures:
Exposure differs by line:
| Line or region | Revenue ($m) | Share | Growth |
|---|---|---|---|
| Product (hardware + software licences) | 2,280 | 19.9% | +27% |
| Subscription | 6,239 | 54.3% | +25% |
| Support | 2,961 | 25.8% | +21% |
| Americas (U.S. $7,108m) | 7,679 | 66.9% | +24% |
| EMEA | 2,428 | 21.2% | +27% |
| Asia-Pacific | 1,373 | 12.0% | +25% |
Source: FY2026 10-K revenue note. Growth includes acquisitions. No end-market (industry vertical) split is disclosed.
The industry record is benign. Security software grew 7% in 2009. Total security spending grew more than 6% in 2020 while network-security equipment was forecast to fall 12.6%. In 2022–23 vendors reported longer sales cycles rather than cuts (Gartner; vendor releases, web).
On inputs, hardware depends on one contract manufacturer (Flex) and sole-source components. Memory costs rose in Q4 FY2026, management expects the pressure to persist, and tariffs may force further hardware price increases (FY2026 10-K; Q4 FY2026 call, web). Operationally, the CyberArk deal deepened an Israeli R&D footprint exposed to reserve-duty call-ups (FY2026 10-K).
Measured against its own history, the business sits at different points in its cycle on each dimension:
In short, hardware is at a peak while the subscription engine is decelerating. The downside mechanism would work as follows. The refresh ends while memory costs stay high, so product revenue and product gross margin fall together. Customers again ask for deferred payments, as they did in FY2024, which moves cash flow down before ARR shows anything.
| Indicator | Why it matters | Where published |
|---|---|---|
| Acquired revenue contribution | Separates organic from bought growth | 10-Q/10-K acquisition note; quarterly release |
| NGS ARR and acquired component | Management's growth metric and a PSU input | Quarterly release |
| Current RPO (next 12 months) | Revenue visibility; was $9.3bn | 10-Q/10-K revenue note |
| Product revenue and product gross margin | Refresh cycle and memory-cost pass-through | 10-Q/10-K |
| Financing receivables | Signals customers asking to defer payment | 10-Q balance sheet and credit-quality note |
| Diluted share count and SBC | Per-share value versus business value | Quarterly release; 10-Q |
| Firewall and SASE market growth and share | Independent check on refresh and position | Dell'Oro and IDC quarterly press releases |
The sources could not answer the following, and each needs resolving before a thesis can be formed: