Palo Alto Networks (PANW)

Investment Review After Q3 FY2026 Earnings (stock price as of 2026.06.02)

TL;DR

Palo Alto Networks is the largest pure-play cybersecurity vendor, consolidating network, cloud, SOC, identity (CyberArk) and observability (Chronosphere) onto one AI-driven platform. Just reported: record Q3 FY2026 revenue $3.0B (+31% YoY), NGS ARR $8.13B (+60% YoY), non-GAAP EPS $0.85 ($0.05 above high end) — beat every guided metric. Q4 FY2026 guide is revenue $3.345-3.355B (+32%), EPS $0.96-0.98, and FY2026 was raised to $11.42B (+24%) revenue, EPS $3.77-3.79 — strong and accelerating. Stock at $297 on 87x P/E(ttm), +85% post last quarter end from $160, re-rated on the CyberArk and AI-cyber terminal-value thesis — an extreme multiple that prices in flawless integration.

Summary

Finding	Assessment
5-Year Stock Return	Stock currently $297, up ~370% from $62 (5 years ago). TTM OP swung from a loss to +$3,113M. NGS ARR grew from ~$1B to $8.13B. P/E volatile (SBC-driven GAAP distortions), now 87x(ttm).
Business Model	STRONG. #1 cybersecurity platform: Network Security (SASE $1.6B ARR), Cortex (XSIAM $600M ARR), Cloud Security, plus Identity (CyberArk) and Observability (Chronosphere $300M ARR). $8.13B NGS ARR, $18.4B RPO, ~80% recurring revenue.
Competitive Moat	NARROW Platformization + in-line scale (125M+ sensors, 17PB/day telemetry) create distribution lock-in and a data advantage. But general-purpose AI is narrowing the detection moat, and AI-native competitors (CrowdStrike, Wiz) are maturing. Moat trending toward distribution and platform breadth.
Past 5-YR Drivers	Platformization consolidating 7+ vendor spending, subscription/recurring mix shift (~80% of revenue), XSIAM $0→$600M ARR, SASE $0→$1.6B ARR, Prisma AIRS fastest-growing product ever, FCF margin scaling toward 40%.
Recent Stock Move	Stock currently $297, up 85% post last quarter end from $160 (Q3 close). Re-rated on CyberArk integration ahead of plan and AI-cyber terminal-value thesis. TTM OP $3,113M; NGS ARR +60% reported, +28% organic.
Revenue Trend	ACCELERATING Rev YoY: 31% (Q3 2026) → 32% (Q4 2026E).
Margin Trend	FLAT OM%: 27% (Q3 2026) → 27% (Q4 2026E).
TTM OP Trajectory	DECELERATING TTM OP QoQ: 6% (Q3 2026) → 5% (Q4 2026E). TTM OP $3,113M.
Key Opportunities	CyberArk + Chronosphere (+$1.63B NGS ARR) add identity and observability; Prisma AIRS fastest-growing product ever (300+ customers, $100M ARR in sight); XSIAM $600M ARR (+100%). AI-driven NGFW demand (+40% bookings); $20B NGS ARR by FY2030.
Key Risks	87x P/E(ttm) prices in flawless CyberArk integration; GAAP still a net loss on deal charges; SBC elevated at 17% of revenue; Debt/EBITDA up to 0.39x on acquisition debt; reported +31% growth is acquisition-inflated (organic ~14-17%); hardware (~10% of revenue) exposed to component-cost/tariff pressure.
Catalysts	Q4 FY2026 guide (revenue +32%, EPS $0.96-0.98); CyberArk synergy/Idira adoption; Prisma AIRS path to $100M ARR; FY2027 segment disclosure (Network Security, Cortex, Identity); 40% FCF margin path to FY2028.
P/E(ttm) Valuation	EXTREME at 87x(ttm). Re-rated from ~47x (Q3 close) on the CyberArk + AI-cyber thesis, well above the recent ~50-62x range. The GAAP multiple is distorted by deal charges and 17%-of-revenue SBC; on ~$3.78 non-GAAP FY2026 EPS, forward multiple is ~79x — rich either way, and dependent on the FY2030/FY2028 targets being met.

Q3 FY2026 Key Data (Feb-Apr 2026), reported 2026.06.02

Revenue $3.0B (+31% YoY). Product $594M (+31%), Services $2.4B (+31%). Non-GAAP OM 21.3% (flat YoY); non-GAAP EPS $0.85, $0.05 above high end; GAAP net loss $(0.22)/sh on deal charges.
NGS ARR $8.13B (+60% YoY). Includes $1.63B from CyberArk/Chronosphere; organic $6.5B (+28%). RPO $18.4B (+36%); current RPO $8.3B (+34%, organic +17% accel from 15%). Adjusted FCF $910M (+57%).
Q4 FY2026 guided $3.345-3.355B revenue (+32%). NGS ARR $8.9-8.95B (+59-60%); EPS $0.96-0.98. FY2026 raised: revenue $11.42B (+24%), OM 28.9-29.2%, EPS $3.77-3.79.

Key Takeaways from Earnings Call

Record quarter that beat every guided metric, driven by acquisitions plus organic acceleration. CyberArk and Chronosphere — both "exceeding expectations" post-close — added $1.63B NGS ARR, while organic bookings accelerated (current RPO organic +17% vs +15% in Q2). 110 net-new platformizations; ~2,280 total, 120% net retention, targeting 4,000 by FY2030 toward $20B NGS ARR.
AI security is the fastest-scaling story: Prisma AIRS is the fastest-growing product ever. AIRS tripled to 300+ customers (from 100 in Q2), >2T tokens/month, with line of sight to $100M ARR within a couple quarters. XSIAM passed $600M ARR (+100% YoY, 740 customers, sub-10-minute response); SASE ARR $1.6B (+40%, ~2x market); software firewall ARR +25%; Chronosphere observability >$300M ARR (+50%+ QoQ, two of top-5 frontier labs).
CyberArk integration is running 3-6 months ahead of plan, reinforcing the 40% FCF margin target for FY2028. First quarter post-close surpassed internal benchmarks; launched Idira (next-gen PAM + agentic identity); ~1,000 cross-org GTM engagements. Capital: $1B buyback (6.8M shares at $147.69), $1B remaining. SBC rose to 17% of revenue on acquisitions but is expected to normalize in 12-18 months.
The "Mythos" thesis: frontier AI is now cyber-capable, raising the terminal value of cybersecurity. Unit 42 simulated an end-to-end ransomware campaign in 25 minutes; PANW launched Unit 42 Frontier AI Defense (1,200+ meeting requests, 800 completed in 6 weeks). Only an in-line platform that gets smarter with scale (125M+ sensors, 17PB/day) can defend at machine speed; AI "increased the terminal value of the entire cybersecurity industry."

Key Segments and Revenue Mix (FY2025)

Revenue Type	Revenue	% of Total	Key Details
Subscription	$4,974M	54%	SASE ($1.6B ARR), XSIAM ($600M ARR), Prisma Cloud, Prisma AIRS. Highest margin, most recurring.
Support	$2,445M	27%	Maintenance contracts on hardware/software. Stable, recurring base. ~80% of total revenue is recurring.
Product	$1,802M	19%	Hardware firewalls (~10% of total revenue) + software. 46% of TTM product revenue is now recurring software. Gen 5 firewalls; best HW quarter in a decade.

Business Model

SUPPLIERS

Cloud infrastructure (GCP, AWS, Azure)
Hardware contract manufacturers
Threat intelligence feeds
AI/ML compute (Anthropic partnership)
Acquired tech: CyberArk, Chronosphere, Koi, Portkey

Technology / Intelligence →

PALO ALTO NETWORKS

Network Security (SASE, NGFWs)
Cortex (XSIAM AI SOC, XDR)
Cloud Security (Prisma Cloud / AIRS)
Identity (CyberArk) & Observability
$8.13B NGS ARR, $18.4B RPO, 17PB/day telemetry

Subscriptions / Platforms / HW → $ Revenue

CUSTOMERS

1/3 of Fortune 500 (SASE customers)
Global 2000 enterprises
Government, sovereign & AI-lab buyers
~2,280 platformized customers
Two of top-5 frontier AI labs

Moat Assessment: NARROW

Platformization creates distribution lock-in; in-line scale is becoming the AI-era moat. 125M+ sensors and 17PB/day telemetry create stickiness and a data advantage: "the advantage shifts from model to the data fuel" in-line sensors provide.
Trust and compliance provide near-term defense, not permanent immunity. FedRAMP, SOC 2 and HIPAA certifications take years to obtain. But AI-native competitors (CrowdStrike, Wiz) are obtaining the same certs — the trust moat is eroding.
The risk is AI-native competition building superior detection from the ground up. PANW's edge came from proprietary threat intelligence. If large AI models democratize detection quality, the moat narrows toward distribution and platform breadth.

Stock vs. Earnings — 5-Year Performance

Stock currently $297, up ~370% from $62 (5 years ago); TTM OP swung from a loss to +$3,113M. PANW transformed from a money-losing firewall vendor into the dominant cybersecurity platform as platformization consolidated 7+ point vendors.
The stock re-rated violently: from $160 (Q3 close) to $297, +85% post last quarter end. The move reflects CyberArk integration ahead of plan plus the AI-cyber terminal-value thesis — offsetting a GAAP net loss on deal charges.
NGS ARR grew from ~$1B to $8.13B (+60% YoY) — the leading indicator of revenue. Organic is $6.5B (+28%); CyberArk and Chronosphere add $1.63B. The $20B FY2030 target implies sustained platformization plus integration.

PANW Stock Price vs TTM Operating Income, 5-year

Past 5-Year Key Drivers

Platformization consolidates security spending onto PANW's platforms: Enterprises replace 7+ point vendors with integrated suites. ~2,280 customers have platformized, with 120% net retention; more data improves AI detection, driving consolidation.
Prisma AIRS is the fastest-growing product in PANW history: 300+ customers, tripling QoQ, with line of sight to $100M ARR for a product that did not exist a year ago. XSIAM ($600M ARR, +100% YoY) replaces legacy SIEM/SOAR with sub-10-minute response.
FCF conversion (~38.5% TTM margin) funds M&A and buybacks: $4.08B TTM adjusted FCF supports CyberArk, Chronosphere, Koi and Portkey. The FCF base enables rapid integration while management targets a 40% FCF margin by FY2028.

Quarterly Key Metrics

USD	Q3'24	Q4'24	Q1'25	Q2'25	Q3'25	Q4'25	Q1'26	Q2'26	Q3'26	Q4'26E
Quarter End	Apr 24	Jul 24	Oct 24	Jan 25	Apr 25	Jul 25	Oct 25	Jan 26	Apr 26	Jul 26
Stock Price	$140	$170	$171	$182	$171	$205	$204	$184	$160	$297
Stock QoQ	-3%	+22%	+0%	+6%	-6%	+20%	+0%	-10%	-13%	+85%
Rev YoY	+15%	+12%	+14%	+14%	+15%	+16%	+16%	+15%	+31%	+32%
OM%	26%	27%	29%	28%	27%	30%	30%	30%	27%	27%
R40 (Rev YoY + OM%)	41%	39%	43%	43%	43%	46%	46%	45%	58%	59%
TTM OP ($M) non-GAAP	2,155	2,190	2,277	2,353	2,472	2,652	2,782	2,926	3,113	3,254
TTM OP QoQ	+5%	+2%	+4%	+3%	+5%	+7%	+5%	+5%	+6%	+5%
FCF/OP ttm	140%	142%	135%	125%	121%	131%	133%	122%	122%	123%
Debt/EBITDA	0.4x	0.3x	0.2x	0.2x	0.2x	0.1x	0.1x	0.1x	0.4x	0.4x
P/E(ttm)	52x	62x	60x	62x	55x	62x	59x	50x	47x	87x

Recent Stock Performance & Drivers

Stock currently $297, up 85% post last quarter end from $160 (Q3 close). The re-rate reflects CyberArk integration ahead of plan, Prisma AIRS tripling to 300+ customers, and the AI-cyber terminal-value thesis — despite a GAAP $(0.22) net loss.
TTM OP reached $3,113M, +6% QoQ; TTM adjusted FCF $4.08B (38.5% margin, +430bps YoY). Reported revenue growth jumped to +31% as CyberArk/Chronosphere consolidated; organic is ~14-17%. Non-GAAP OM held flat at 21.3%.
P/E(ttm) re-expanded from ~47x (Q3 close) to 87x — top of its multi-year range. The GAAP multiple is elevated by deal charges and 17%-of-revenue SBC; the bull case rests on the FY2030 and FY2028 targets being met.

Opportunities

CyberArk + Chronosphere add identity and observability as new platform pillars. Both exceeded internal benchmarks ($1.63B combined NGS ARR). Idira (PAM + agentic identity) launched; ~1,000 GTM engagements seed cross-sell toward the $20B target.
AI security is the next accelerator; Prisma AIRS is the fastest-growing product ever. 300+ customers (tripled QoQ), >2T tokens/month, line of sight to $100M ARR. Frontier AI Defense drew 1,200+ requests; Portkey adds an agent enforcement point.
AI-driven network demand: best hardware quarter in a decade, NGFW bookings +40% YoY. AI data centers, sovereigns and AI labs are new buyers. SASE ARR $1.6B (+40%, ~2x market); software firewall ARR +25%; a ~50% industry-demand tailwind is multi-year.

Challenges

P/E(ttm) of 87x is extreme and prices in flawless CyberArk integration. The multiple sits well above its recent ~50-62x range, with GAAP still a net loss ($(0.22)/sh) on deal charges. Any stumble or organic deceleration would compress it quickly.
SBC at 17% of revenue and rising leverage dilute the GAAP picture. Acquisition SBC won't normalize for 12-18 months; Debt/EBITDA rose to 0.39x (from ~0.07x). Reported +31% growth is acquisition-inflated — organic is ~14-17%.
AI commoditization of detection plus hardware cost pressure are real headwinds. General-purpose frontier models are narrowing the detection moat. Hardware (~10% of revenue) faces rising memory/storage costs; PANW raised prices 10% in April.

Next 12 Months

Q4 FY2026 guided $3.345-3.355B revenue (+32%), EPS $0.96-0.98. NGS ARR $8.9-8.95B (+59-60%); RPO $20.9-21B (+32-33%). The market will watch whether organic momentum (current RPO +17%) holds as acquisition contribution annualizes.
CyberArk integration milestones are the key swing factor. Synergies are 3-6 months ahead of plan, profitability convergence in 12-18 months. Cross-sell from ~1,000 GTM engagements and Idira adoption signal whether identity becomes a fourth pillar.
Prisma AIRS and XSIAM are the leading AI-security indicators. AIRS reaching $100M ARR and XSIAM extending beyond $600M ARR (740 customers) would validate the AI-security lead. Any slowdown in platformization (~110/quarter) would signal a plateau.

Next 12-24 Months

$20B NGS ARR by FY2030 and 4,000 platformizations imply sustained ~30% growth. From $8.13B today, this requires successful integration plus continued AI-security adoption. If achieved, PANW becomes a multi-billion FCF company — the bull thesis.
40% FCF margin by FY2028, now reinforced by faster synergies. TTM adjusted FCF margin is 38.5% (+430bps YoY); CyberArk convergence 3-6 months early supports the path. A full year of acquisition costs in FY2027 is the offsetting drag to watch.
Segment disclosure (Network Security, Cortex, Identity) begins FY2027. Moving to total-company guidance now, then segment revenue next year, lets investors test the platform thesis. AI as a catalyst for traffic inspection is the long-term frame.

Core Metrics Scorecard

	Q1'22	Q2'22	Q3'22	Q4'22	Q1'23	Q2'23	Q3'23	Q4'23	Q1'24	Q2'24	Q3'24	Q4'24	Q1'25	Q2'25	Q3'25	Q4'25	Q1'26	Q2'26	Q3'26	Q4'26E
Quarter End	Oct 21	Jan 22	Apr 22	Jul 22	Oct 22	Jan 23	Apr 23	Jul 23	Oct 23	Jan 24	Apr 24	Jul 24	Oct 24	Jan 25	Apr 25	Jul 25	Oct 25	Jan 26	Apr 26	Jul 26
R40 > 40%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅		✅	✅	✅	✅	✅	✅	✅	✅
R40 accelerate	✅					✅		✅					✅		✅	✅			✅	✅
TTM OP QoQ > 10%				✅			✅	✅	✅	✅
TTM OP QoQ accelerate		✅	✅	✅		✅	✅	✅					✅		✅	✅		✅	✅
TTM FCF/OP > 60%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
Debt/EBITDA < 3.5	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
Total Passes	4	4	4	5	3	5	5	6	4	4	3	2	5	3	5	5	3	4	5	4
Stock QoQ	+29%	+16%	+12%	-21%	-1%	-15%	+44%	+28%	-7%	+22%	-3%	+22%	+0%	+6%	-6%	+20%	+0%	-10%	-13%	+85%
P/E(ttm)	75x	83x	87x	69x	60x	44x	57x	63x	50x	57x	52x	62x	60x	62x	55x	62x	59x	50x	47x	87x

Q3 FY2026 scores 5/6 passes — near the top of PANW's range (best ever was 6 in Q4'23). R40 clears 40% (now 58%), FCF/OP and Debt/EBITDA pass comfortably, and R40 is accelerating. The lone miss is TTM OP QoQ >10% (just +6%) — steady, not explosive, OP growth.
Q4'26E rolls to 4/6 as R40-acceleration drops off — a normal post-peak fade. Historically 5-pass quarters clustered around the stock's stronger periods, but the link is loose — PANW trades far more on NGS ARR narratives and P/E sentiment than on the GAAP scorecard.
FCF/OP runs 120-140% because FCF includes the non-cash SBC addback while GAAP OP deducts it. This keeps the criterion passing every quarter and makes it a weak signal for PANW — the company has never had a genuine cash-conversion problem.

Chart: R40 vs Stock Price (Since 2020)

Chart: Scorecard Total Passes vs Stock Price (Since 2020)

PANW Scorecard Total Passes vs Stock Price since 2020

Q2 FY2026 Key Data, reported 2026.02.17

Revenue +15% YoY, OM 15%, TTM OP $1.47B (+110% over 8 quarters). R40 +30%; FCF/OP 242%, Debt/EBITDA 0.1x. Non-GAAP OM 30%+ vs GAAP 15% — gap driven by $1.3B annual SBC.
Platformization at 1,550+ customers with 110 net new in Q2 (quarterly record ex-Q4). XSIAM passing $500M ARR; 119% NRR. $20B NGS ARR target by FY2030 depends on integration of CyberArk + Chronosphere.
Q3-Q4 FY2026E rev +28% YoY (M&A boost from CyberArk + Chronosphere). Non-GAAP OM guided down to 28.5-29% as M&A costs are absorbed. Near-zero debt (0.1x Debt/EBITDA).

Key Takeaways from Earnings Call

Acquisitions reshape the TAM. CyberArk ($1.2B NGS ARR; 112M-share deal) makes PANW the largest identity security player, covering human, machine, and AI agent identities — the #1 attack vector. Chronosphere ($200M ARR, triple-digit growth) adds AI-era observability. Together they expand TAM by $30B+ with cross-sell across 1,550+ platformized customers; $20B NGS ARR target by FY2030.
AI security is the next growth accelerator. AI expands the attack surface with 4x faster attacks and agentic AI endpoint vulnerabilities. Prisma AIRS tripled customers Q1→Q2 FY2026 with a nine-figure pipeline. AgentiX (autonomous AI remediation agents) is live with 200 XSIAM customers. Koi (agentic endpoint security for AI/MCP servers) addresses a market that didn't exist 12 months ago.
SBC, integration risk, and AI commoditization are the bear case. $1.3B annual SBC (14% of revenue) plus 112M shares for CyberArk = significant dilution; GAAP P/E 105x vs non-GAAP ~38x confuses investors. Integrating CyberArk + Chronosphere + Koi simultaneously is high execution risk. AI tools (Claude Code Security, Mythos) commoditizing the detection moat that justifies premium pricing.

Source: SEC EDGAR annual and quarterly filings, company earnings conference calls and presentations.

Disclaimer: This report is for educational purposes only. NO investment advice.