Palo Alto Networks, Inc. (PANW) FY2026 10-K and 10-Q Summary: Business, Risk Factors, MD&A

Business

From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.

Palo Alto Networks was incorporated in 2005 and is headquartered in Santa Clara, California. It sells cybersecurity, and, since fiscal 2026, observability, to enterprises, governments and service providers. The stated strategy is "platformization": consolidating what customers otherwise buy as disparate point products into a small number of tightly integrated platforms. As of July 31, 2026 the company had end-customers in over 180 countries, spanning education, energy, financial services, government, healthcare, internet and media, manufacturing, public sector and telecommunications, and including almost all of the Fortune 100 and a majority of the Global 2000.

The company operates as a single operating and reportable segment, with sales managed on a geographic theater basis and consolidated net income used as the measure of segment profit, so no segment-level profitability is broken out; it describes its portfolio as four platform groupings plus advisory services.

Network & AI Security. The legacy core and still the largest business.

• Secure Access Service Edge (SASE), Prisma Access (cloud-delivered security across more than 100 locations worldwide) combined with Prisma SD-WAN, extended to the browser by Prisma Browser and the Prisma Access Browser.
• Next-Generation Firewalls, ML-powered hardware appliances running the PAN-OS operating system, ranging from the PA-400 for branch offices to the PA-7500 for large data centers, plus VM-Series virtual firewalls, CN-Series container firewalls, and Cloud NGFW as a managed offering on AWS and Azure.
• Cloud-Delivered Security Services (CDSS), add-on subscriptions attached to SASE and NGFW: Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Device Security, Quantum Security, Next-Gen Trust Protection, GlobalProtect, Prisma Access Agent, Enterprise DLP, SaaS Security (API and Inline) and AI Access Security.
• Prisma AIRS, the AI-security platform, bundling AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security, AI Model Security and AI Posture Management.
• Strata Cloud Manager, unified cloud management for NGFW and SASE estates, including the Strata Copilot natural-language interface and Autonomous Digital Experience Monitoring. Panorama remains the management tool for many existing deployments.

Cortex. Security operations, cloud security and, new this year, observability.

• Security operations, Cortex XSIAM (AI-driven replacement for traditional SIEM), Cortex XDR (XDR Prevent and XDR Pro tiers), Cortex XSOAR (orchestration and automation), Cortex Xpanse (attack surface management), and Koi agentic endpoint security.
• Cloud security, Cortex Cloud, the successor to Prisma Cloud, combining CNAPP with cloud detection and response across the code-to-cloud-to-SOC lifecycle.
• Observability, the Chronosphere platform and the Chronosphere Telemetry Pipeline, which filters, transforms and routes telemetry to reduce data volumes. The telemetry pipeline also feeds Cortex XSIAM.

Idira. The identity security platform formed out of the CyberArk acquisition, covering workforce identity (adaptive MFA, SSO, workforce password management), privileged access management with just-in-time elevation and zero standing privilege, endpoint privilege management, identity governance and administration, machine identity (secrets management, Secrets Hub, credential providers, certificate lifecycle), vendor privileged access, and Secure AI Agents.

Unit 42 and services. Threat research, incident response and security consulting, plus managed detection and response and managed threat hunting. In April 2026 the company launched a suite of Unit 42 Frontier AI Defense services. Professional services, education and tiered customer support (Standard, Premium, Platinum, plus Focused Services) round out the offering.

How the money comes in. Revenue splits into product (hardware and on-premise software licenses, including certain identity security licenses since the CyberArk deal) and subscription and support, which was 80% of fiscal 2026 revenue. Contracts for subscriptions and support are typically one to five years and are recognized over the service period. Distribution is predominantly a two-tier indirect model: sales to distributors, who sell to resellers, who sell to end-customers. In fiscal 2026 two distributors each individually represented 10% or more of total revenue and together represented 30% of it; as of July 31, 2026 one distributor represented 19% of gross accounts receivable.

Hardware is built by manufacturing partners, principally the EMS provider Flex, primarily in the United States, with some components sourced abroad.

Headcount rose from 16,068 at the end of fiscal 2025 to 21,921 at the end of fiscal 2026, of which roughly 4,223 came with CyberArk.

Risk factors

From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.

Acquisition integration is now the dominant operating risk. Fiscal 2026 added four businesses, two of them very large, with two more closing within weeks of the year-end. Management flags that the CyberArk acquisition "substantially changed" the scope and size of the business, creating uncertainty for employees, partners and customers, diverting senior management attention, and requiring the combination of systems and management controls. The expected benefits and synergies from CyberArk and Chronosphere may not be realized as expected, within the anticipated time frame, or at all. Contingent consideration obligations, the company carried a $206 million obligation from the IBM QRadar asset purchase as of July 31, 2026, are remeasured quarterly and can swing results either way.

New competitive fronts opened by the same acquisitions. Entry into identity security brings increased competition in a category the filing says "lacks a universally accepted definition," which could lead to mischaracterization of the company's offerings by analysts whose rankings materially influence purchasing. Named competitors now span large platform vendors (Alphabet, Cisco, Microsoft), security and observability specialists (Check Point, CrowdStrike, Delinea, Fortinet, Okta, SailPoint, Zscaler; Datadog, Dynatrace, elasticsearch), point-product startups, and public cloud vendors. Two competitive risks are new in substance: public cloud providers increasingly bundle native security, identity and observability at low or no incremental cost; and frontier AI model providers, with substantial capital and compute, may enter the category directly or enable third parties to build competing security applications on their models.

Consumption-based revenue volatility. A growing share of revenue, notably observability and AI-related offerings, is priced on consumption or usage. The filing warns explicitly that this creates exposure to "customer optimization behavior," where customers who scale usage rapidly then reduce or reconfigure it to cut cost, a dynamic already observed with cloud-native and, more recently, AI-native customers. Certain cohorts may represent a meaningful portion of consumption-based growth, so optimization by a few could produce revenue volatility.

AI cuts both ways. Beyond the opportunity, the 10-K raises the possibility that if customers, investors or other market participants come to believe AI can automate or commoditize cybersecurity functions, the perceived value of security solutions could diminish and demand could be adversely affected, and that these perceptions could hurt the stock "even if these perceptions do not reflect actual changes in our business." AI systems also introduce their own vulnerability, IP-ownership and regulatory exposure, and AI agents are described as a new class of identity the company's identity products must learn to secure.

Product defects and vulnerabilities. A vendor of security products is an attractive target and its own defects are reputationally acute. The filing discloses that in May 2026 the company became aware of an authentication bypass vulnerability in certain versions of PAN-OS, published a security advisory, issued software updates and engaged in customer outreach and remediation.

Supply chain and gross margin. Hardware depends on Flex and on a limited number of component suppliers, some sole-source, with manufacturing operations concentrated in Asia. The filing states that the company "experienced supply chain disruption and inflationary pressures during our fourth quarter of fiscal 2026, resulting in increased costs for memory and other components, which have negatively affected our gross margin and could continue to affect our gross margin," and notes a current global shortage of memory-related components at a time when its appliances require higher memory content. U.S. and Chinese import tariffs have already raised component costs.

Concentration and channel dependence. Two distributors at 30% of revenue in aggregate, and one at 19% of gross receivables, is meaningful concentration; channel agreements are generally terminable on notice before each annual renewal.

Geopolitical and Israel exposure. Operations in Israel expanded meaningfully with CyberArk. Many Israeli employees are subject to military reserve duty and have been called to active duty during regional hostilities. The Russia-Ukraine war, sanctions and export controls, and U.S.–China and China–Taiwan tensions are all cited as live exposures.

Results variability and seasonality. A substantial portion of orders and revenue arrives in the last few weeks of each fiscal quarter, and seasonal factors mean the second and fourth fiscal quarters tend to record sequentially greater revenue than the first and third.

Revenue growth may not persist. The filing notes growth rates of 24% in fiscal 2026 and 15% in fiscal 2025 and cautions that neither should be relied upon as an indication of future periods. Because subscription and support revenue is recognized over one-to-five-year terms, a downturn in bookings would not show up fully in the quarter it occurs.

Tax and capital structure. Exposure to transfer-pricing challenges, the One Big Beautiful Bill Act, and the OECD's Pillar Two 15% global minimum tax (with a January 5, 2026 "side-by-side" package that would generally exempt U.S. multinationals, subject to domestic implementation). Effective tax rates are also sensitive to fair-value movements in the assumed CyberArk convertible notes and capped calls. Separately, the company may lack the funds to settle conversions of, or repay, the 2030 Notes in cash.

Litigation. In Centripetal Networks v. Palo Alto Networks (E.D. Va., filed March 2021), a January 31, 2024 jury verdict of non-willful infringement carried a lump sum of $152 million plus statutory interest; after post-trial motions, an October 3, 2024 judgment affirmed infringement on three patents, reversed the fourth, and reduced damages to $114 million. A surety bond prevents execution while appeals are pending. The accrual was $151 million as of July 31, 2026 (versus $146 million a year earlier), producing a $5 million charge in fiscal 2026 after a $39 million release in fiscal 2025. Related Centripetal contentions are pending before the European Patent Office and the Unified Patent Court in Germany. In Finjan v. Palo Alto Networks (N.D. Cal., filed 2014), the judge granted summary judgment of non-infringement on all remaining patents on March 21, 2025; the matter is on appeal. Eire OG Innovations (E.D. Tex., filed April 2024) was resolved in December 2025 for an amount that was not material.

No dividends. The company has never paid a dividend and does not anticipate doing so.

Management's discussion and analysis, fiscal 2026

From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.

The shape of the year

Fiscal 2026 was a year in which Palo Alto Networks bought its way into two new markets and absorbed the cost of doing so. Total revenue reached $11,480 million, up 24% from $9,221 million in fiscal 2025 (fiscal 2024: $8,027 million). But GAAP operating income fell to $695 million, a 6.1% margin, from $1,243 million and 13.5% a year earlier, and net income fell to $307 million ($0.40 per diluted share) from $1,134 million ($1.60). Cash generation, by contrast, improved: operating cash flow was $4,553 million, up $837 million, and free cash flow (non-GAAP, operating cash flow less $440 million of property and equipment purchases) was $4,113 million versus $3,469 million.

The gap between top-line acceleration and bottom-line compression is almost entirely acquisition accounting and acquisition-related compensation. Chronosphere and CyberArk together contributed $930 million of revenue since their acquisition dates and an operating loss of $797 million over the same stub periods. Total share-based compensation expense, the amount charged to cost of revenue and operating expenses, which is larger than the equity-award compensation added back in the cash flow statement, rose to $1,815 million from $1,300 million.

Key metrics

Fiscal 2024 net income of $2,578 million, and the $3.64 of diluted earnings per share that goes with it, are not comparable with the later years: both include a large benefit from income taxes on the release of valuation allowances against U.S. federal, U.S. state (other than California) and U.K. deferred tax assets. Next-Generation Security annualized recurring revenue was $9.1 billion at July 31, 2026, against $5.6 billion a year earlier. Remaining performance obligations were $21.2 billion, against $15.8 billion.

Revenue

Product revenue was $2,280 million, 19.9% of total, up 27% ($478 million). The increase came from software licenses, including licenses acquired with CyberArk, and from demand for the new generation of hardware.

Subscription and support revenue was $9,200 million, 80.1% of total, up 24% ($1,781 million). Within it, subscription revenue was $6,239 million (up 25%) and support revenue $2,961 million (up 21%). CyberArk and Chronosphere both contributed.

By theater: Americas $7,679 million (up 24%), EMEA $2,428 million (up 27%), APAC $1,373 million (up 25%). The Americas contributed the largest absolute increase by virtue of its scale.

Costs and margin

Total cost of revenue rose to $3,403 million from $2,451 million, and gross margin fell 300 basis points to 70.4%.

• Product gross margin fell to 75.1% from 77.1%, on lower hardware margin (supply chain challenges among the causes) and higher intangible amortization, partly offset by higher-margin CyberArk software license revenue and a decrease in inventory excess and obsolescence charges.
• Subscription and support gross margin fell to 69.2% from 72.5%, on intangible amortization from the year's acquisitions and higher cloud-based delivery costs.

Operating expenses

Research and development was $2,552 million (22.2% of revenue), up 29%, with personnel costs alone up $429 million on headcount growth including acquired employees. Sales and marketing was $3,931 million (34.3% of revenue). General and administrative was $899 million (7.8% of revenue) versus $443 million, an increase driven by $253 million of higher personnel cost, accelerated vesting of equity awards tied to the acquisitions, severance in connection with CyberArk, and acquired headcount, plus higher acquisition-related costs. Total operating expenses were $7,382 million, 64.3% of revenue, versus 59.9% a year earlier.

As of July 31, 2026 approximately $3.3 billion of share-based compensation expense remained to be recognized over a weighted-average period of roughly 2.5 years.

In March 2026 the Knesset Finance Committee approved Israel's Law for the Encouragement and Incentivization of Research and Development, providing a qualified refundable tax credit for qualifying R&D spend incurred in Israel on or after January 1, 2026. Its fiscal 2026 impact was not material.

Below the line

Other income (expense), net swung to a $(159) million expense from $353 million of income, mainly a loss from the change in fair value of the assumed 2030 Notes, partly offset by gains on the capped calls and gains on investment sales made to fund acquisitions. Income before taxes was $536 million; the provision for income taxes was $229 million. The effective rate rose year over year on non-deductible fair-value changes in the 2030 Notes and capped calls and on share-based compensation, partly offset by an intercompany legal entity restructuring in fiscal 2026 and by the prior-year effect of adopting the One Big Beautiful Bill Act.

The fiscal 2026 acquisitions

CyberArk shareholders received $45.00 in cash and 2.2005 Palo Alto Networks shares per CyberArk share. The purchase price allocation recorded $14,800 million of goodwill and $6,279 million of identified intangibles (developed technology $2,537 million over 5–7 years; platform renewals $3,500 million over 12–14 years; customer contracts $219 million over 2 years; trade name $23 million over 1 year), and assumed $1,303 million of convertible senior notes and $776 million of deferred revenue. Transaction costs were $56 million. A workforce optimization plan for the combined entity carries an estimated total cost of $60 million, expected to be substantially complete by the end of fiscal 2027; $49 million of severance charges were recognized in fiscal 2026, $18 million was paid in cash, and $14 million remained accrued at July 31, 2026.

Chronosphere's allocation recorded $2,364 million of goodwill and $565 million of intangibles (developed technology $300 million; customer relationships $255 million; trade name and trademarks $10 million). Koi added $169 million of goodwill and a $35 million developed-technology intangible; Portkey added $110 million of goodwill and a $15 million developed-technology intangible.

On a pro forma basis, as if Palo Alto Networks, Chronosphere and CyberArk had been combined from the start of fiscal 2025, total revenue would have been $12,312 million in fiscal 2026 and $10,486 million in fiscal 2025, with a net loss of $114 million and $37 million respectively. The pro forma figures exclude approximately $562 million of net losses on fair-value changes in the acquired convertible notes and capped calls that are reflected in the reported results.

Management excluded CyberArk from its assessment of internal control over financial reporting for fiscal 2026, as permitted for a first-year acquisition; CyberArk represented 2% of consolidated assets, under 1% of consolidated net assets, and 6% of consolidated revenue. Internal control over financial reporting was concluded effective as of July 31, 2026, with an Ernst & Young LLP attestation.

New and upgraded offerings introduced during fiscal 2026 included PAN-OS 12.1 Orion, Prisma AIRS 2.0, Next-Gen Trust Protection and Prisma AIRS 3.0. On July 16, 2026 the company announced general availability of Prisma AIRS Gateway, incorporating the AI gateway technology acquired with Portkey.

Liquidity and capital resources

Cash, cash equivalents and investments totalled $7.9 billion at July 31, 2026, held for general corporate purposes. As part of the CyberArk acquisition the company executed an intercompany transaction to repatriate $3.5 billion of foreign earnings, with immaterial income tax expense on state and other taxes; remaining unremitted earnings are indefinitely reinvested.

Debt. Through a February 2026 supplemental indenture entered in connection with the CyberArk acquisition, CyberArk's $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due June 15, 2030 became exchangeable into Palo Alto Networks common stock and cash. During fiscal 2026 holders surrendered $153 million principal for conversion, settled for $160 million in cash, leaving $1.1 billion outstanding. The sale price condition was not met in the calendar quarter ended June 30, 2026, so the notes are not convertible on that basis during the quarter ending September 30, 2026; if the condition is met in that quarter and all holders convert in the quarter ending December 31, 2026, the company would have to settle the $1.1 billion principal, and any excess conversion obligation, in cash. A $400 million unsecured revolving credit facility entered in April 2023 (expandable by up to $350 million) was undrawn at July 31, 2026, with no default.

Capital return. The share repurchase program authorized in February 2019 and subsequently increased totals $5.1 billion; $1.0 billion remained available at July 31, 2026 and the authorization expires December 31, 2026.

Commitments. Operating lease obligations of $793 million are recorded on the balance sheet, with lease terms running through fiscal 2040 and the most significant relating to the Santa Clara headquarters. Commitments to purchase products, components, cloud hosting and other services totalled $8.3 billion. The contingent consideration obligation from the August 31, 2024 purchase of certain IBM QRadar assets stood at $206 million, with potential payments running through the quarter ending October 31, 2028.

Cash flows. Operating activities provided $4,553 million (up $837 million on higher collections, partly offset by higher cash expenditure). Investing activities used $3,104 million (up $899 million, chiefly higher net cash paid for acquisitions, partly offset by higher proceeds from sales and maturities of investments). Financing activities used $1,202 million (up $423 million, on share repurchases and contingent consideration payments, partly offset by less cash used for convertible note repayments and conversion settlements).

Market risk. Outstanding foreign currency forward contracts had a notional amount of $2.2 billion at July 31, 2026. A hypothetical 100 basis point rise in interest rates across all maturities would cut the investment portfolio's fair value by $128 million; a 100 basis point fall would raise it by $131 million.

The most recent reported period: fiscal fourth quarter 2026

Fourth-quarter figures from the earnings release furnished as Exhibit 99.1 to the Form 8-K of September 1, 2026, accession 0001327567-26-000019; full-year figures as reported in the fiscal 2026 Form 10-K, accession 0001327567-26-000023.

The fourth quarter, which ran May 1 to July 31, 2026, was the first full quarter with CyberArk inside the results.

• Total revenue of $3.41 billion, up 34% year over year (product $738 million, subscription and support $2,672 million).
• Next-Generation Security ARR of $9.10 billion, up 63%; management characterised the quarter as adding "nearly $1 billion of Net New NGS ARR in a single quarter."
• Remaining performance obligations of $21.2 billion, up 34%.
• GAAP operating income of $172 million, against $497 million in the fourth quarter of fiscal 2025. Non-GAAP operating income of $1.0 billion, against $768 million.
• A GAAP net loss of $282 million, or $(0.35) per diluted share, against GAAP net income of $254 million, or $0.36 per diluted share, a year earlier. Non-GAAP net income of $853 million, or $1.02 per diluted share, against $673 million and $0.95.
• Operating cash flow of $1.4 billion (prior-year quarter: $1.0 billion) and adjusted free cash flow of $1.3 billion (prior-year quarter: $954 million). Adjusted free cash flow margin for the full fiscal year was 38.4%.

Management stated a $20 billion NGS ARR target for fiscal 2030 and a 40% adjusted free cash flow margin target for fiscal 2028.

Guidance issued September 1, 2026. For the first quarter of fiscal 2027: NGS ARR of $9.54–9.56 billion (63% growth); remaining performance obligations of $20.8–20.9 billion (34–35% growth); revenue of $3.300–3.310 billion (33–34% growth); diluted non-GAAP earnings per share of $0.96–0.98 on 837–844 million shares. For full fiscal 2027: NGS ARR of $11.075–11.175 billion (22–23% growth); remaining performance obligations of $25.2–25.4 billion (19–20% growth); revenue of $14.10–14.20 billion (23–24% growth); non-GAAP operating margin of 29.5%; diluted non-GAAP earnings per share of $4.16–4.19 on 844–847 million shares; adjusted free cash flow margin of 38.0%. The company does not provide GAAP guidance for these measures and has not reconciled them.

Interim context. The third quarter of fiscal 2026, the three months ended April 30, 2026, was reported on Form 10-Q under accession 0001327567-26-000015. It was the first quarter to carry CyberArk, from February 11, and showed revenue of $3,002 million (up 31% year over year), a net loss of $177 million or $(0.22) per diluted share, and NGS ARR of $8.1 billion. Those figures are not restated by the annual report; the third quarter sits inside the audited fiscal 2026 results above.

Subsequent events

Events after July 31, 2026, from the fiscal 2026 Form 10-K, accession 0001327567-26-000023, and the Form 8-K of August 21, 2026, accession 0001193125-26-361122.

Acquisition of Embrace Mobile, Inc., completed August 27, 2026. Embrace is a privately held user-focused observability company. The definitive agreement, signed July 20, 2026, provides for total consideration of $325 million in cash, subject to adjustments. The company expects the deal to add high-fidelity Real User Monitoring capability to its observability platform. It will be accounted for as a business combination in the first quarter of fiscal 2027.

Acquisition of Console Systems, Inc., completed September 1, 2026. Console is a privately held company providing an AI-native platform enabling agentic workflows across enterprise operations. The definitive agreement, signed July 29, 2026, provides for total consideration of $500 million in cash, subject to adjustments. The company expects the deal to deepen its agentic capabilities in Cortex and to expand the Cortex platform's role across enterprise agentic transformation. It will be accounted for as a business combination in the first quarter of fiscal 2027.

Governance actions of August 20, 2026. The Board approved an Executive Change in Control and Severance Policy covering employees at Senior Vice President level and above who sign a participation agreement, and adopted amended and restated bylaws effective immediately.

No other material post-period acquisitions, divestitures, financings or litigation outcomes were disclosed. The share repurchase authorization had $1.0 billion remaining as of July 31, 2026 and expires December 31, 2026.