Palo Alto Networks, Inc. PANW

Key data

The business

Palo Alto sells cybersecurity to large enterprises and governments three ways. The oldest is network security: the firewalls that sit at the edge of a company's network, now sold increasingly as a cloud subscription. The second is cloud security, Prisma, which watches the applications companies run on Amazon and Microsoft. The third is security operations, Cortex, the software a security team stares at all day to catch attacks. In January it bought Chronosphere, and it has now closed CyberArk, issuing $18.5 billion in stock to add identity management, the software deciding who is allowed to log into what. Arora's pitch is simple: stop stitching together forty vendors, put it all on us, and it gets cheaper and works better together. That is platformization, and the whole thesis rests on it. The moat is switching costs. Once a security team runs its network, cloud, and alerts through Palo Alto, ripping it out is a year-long project nobody volunteers for.

The numbers

Two figures matter more than revenue here, and the company leads with both. Next-Generation Security ARR, the annual value of the recurring subscriptions, hit $9.10 billion in the July quarter, up 63%. Remaining performance obligations, revenue already under signed contract, reached $21.2 billion, up 34%. The forward book is full.

The quarters show the tension. Revenue climbed every period, from $2.5 billion to about $3.4 billion, but GAAP earnings fell off a cliff into losses of $177 million and $282 million as CyberArk and Chronosphere accounting, deal costs and amortization of acquired intangibles, hit the income statement. Non-GAAP earnings, which strip those out, were fine: $1.02 in Q4 against $0.95 a year earlier and a $0.98 consensus.

Across five years revenue compounds near 20% a year, roughly doubling since 2022, while GAAP net income lurches: a $2.6 billion print in 2024 from a one-time tax benefit, then around $307 million in 2026. This is exactly why the stock is valued on sales and cash, not GAAP earnings. Operating cash flow ran about $4.3 billion over the last twelve months, a 37% margin, though roughly $1 billion of annual stock compensation and a rising share count mean the owner keeps less than that headline.

At $333 you pay about 24 times sales. That is not just above the 8 to 11 times Palo Alto usually fetched over the last decade, it is above the 16 times that was its previous ceiling, and about five times the multiple of other security names. What the market may not fully price is that the 63% ARR growth is heavily inorganic. The company's own FY2027 guide calls for NGS ARR of about $11.1 billion, only 22% to 23% growth. The print that settles it is what organic ARR does once CyberArk sits in the base.

Management

Arora has run this since 2018 and turned a box company into a platform. The insider tape cuts both ways. Officers sold about $87 million over the past year against $10 million bought, and President Lee Klarich sold roughly $21 million in December and January, plan status not disclosed. But Arora himself bought almost $10 million of stock in the open market in March 2026, a real purchase, not an option exercise, and chief executives rarely do that unless they mean it. The company resumed buybacks with a $1 billion repurchase in the April quarter, a rounding error against the 112 million shares, about $18.5 billion in stock, issued to close CyberArk. Dilution, not return of capital, is this year's story.

How it fails or surprises you

CyberArk cross-sell compounds (right tail). If identity attaches to the base the way network and cloud did, NGS ARR beats the conservative 22% to 23% FY2027 guide and revenue re-accelerates while the multiple holds. Watch quarterly NGS ARR against the $11.075-to-$11.175 billion full-year target. A first-quarter run-rate above it is the tell it is landing.

The growth is bought, not organic. The headline 63% includes CyberArk and Chronosphere. Strip them and organic growth is likely low-20s, which is what the FY2027 guide implies. If organic net-new ARR adds shrink as deals get larger and lumpier, 24 times sales cannot hold. The print: sequential net-new NGS ARR, and the guide itself.

Two GAAP losses and 112 million new shares. Palo Alto issued $18.5 billion in stock for CyberArk and posted back-to-back GAAP losses absorbing it. If the deal does not lift growth and margins within a year, it overpaid at a peak multiple with a peak-multiple currency. Watch GAAP operating margin turning positive again and non-GAAP operating margin holding near 28% as integration costs run off.

Closing thoughts

Not much about the next quarter is a mystery. The forward book is disclosed, the guide is on the table, and the only real question is whether NGS ARR can clear a bar the company itself set low. That makes this a contest of your read against the guide. I think 22% to 23% is sandbagged and the true organic rate plus CyberArk attach lands higher, but if it does not, a stock at 24 times sales has a long way to fall toward its own 6.8 to 16.3 times history, and that asymmetry, more room down in the multiple than up, is the risk you carry. The left tail is not the business failing, it is paying an all-time-high multiple for growth that turns out ordinary.

The bet is still that large corporations and governments keep consolidating all of their cybersecurity under one vendor, and keep choosing Palo Alto Networks to be that vendor. What breaks it is organic growth slowing while the price is set for the opposite. The one pair to watch: quarterly NGS ARR growth once CyberArk is in the base, against the 22% to 23% the company guided, and GAAP operating margin climbing back above zero. If organic ARR settles in the low 20s and margins stay pinned by integration, the bet is wrong no matter how good the platform is.