narrative.md

Published August 31, 2026

# Palo Alto Networks (PANW) — Business, Risks and Management's Discussion

Palo Alto Networks, Inc. reports on a fiscal year ending July 31. This narrative draws on the
Annual Report on Form 10-K for fiscal year 2025 (accession 0001327567-25-000027) for the
standing business description, risk profile and full-year results, and on the Quarterly Report
on Form 10-Q for the quarter ended April 30, 2026 (accession 0001327567-26-000015) for the
current-period picture. Where a three-month cash flow or non-GAAP figure is quoted, it comes
from the fiscal third quarter 2026 results release furnished on Form 8-K (accession
0001327567-26-000012), because the quarterly report presents cash flows on a nine-month basis
only.

**One important framing point.** The fiscal 2025 annual report describes the company as it
stood on July 31, 2025 — before it closed the four acquisitions that reshaped it during fiscal
2026. The business section below is therefore presented in two parts: the platform architecture
as the annual report described it, and the two entirely new platform categories the company
added afterwards.

---

## Business

*From the FY2025 Form 10-K, accession 0001327567-25-000027, and updated where noted from the
Form 10-Q for the quarter ended April 30, 2026, accession 0001327567-26-000015.*

Palo Alto Networks was incorporated in 2005 and is headquartered in Santa Clara, California. It
sells cybersecurity platforms and services that secure enterprise users, networks, clouds and
endpoints. The organising idea management calls "platformization": rather than sell point
products, consolidate a customer's disparate security tools into a small number of tightly
integrated platforms, on the argument that consolidation produces better security outcomes at
lower total cost. The company operates as **one operating and reportable segment**; the chief
operating decision maker reviews consolidated results with revenue broken out by geographic
theatre.

### The platforms as of the fiscal 2025 annual report

**Network security.** Built to deliver zero-trust architectures. It comprises Prisma Access
combined with Prisma SD-WAN as a single-vendor Secure Access Service Edge (SASE) offering, plus
Prisma Access Browser, which extends protection to unmanaged devices; hardware and software
ML-powered Next-Generation Firewalls (NGFWs) running the common PAN-OS operating system,
spanning the PA-400 for branch offices to the PA-7500 for large data centres, with VM-Series
virtual and CN-Series container form factors and a managed Cloud NGFW on AWS and Azure; a suite
of Cloud-Delivered Security Services (Advanced Threat Prevention, Advanced WildFire, Advanced
URL Filtering, Advanced DNS Security, IoT/OT Security, GlobalProtect, Enterprise DLP, AIOps,
SaaS Security and AI Access Security) sold as add-on subscriptions; Prisma AIRS, an AI-security
platform covering model scanning, posture management, red teaming, runtime security and AI
agent security; and Strata Cloud Manager, the AI-driven management plane (Panorama remains in
use in many installed deployments).

**Security operations.** The Cortex platform. Cortex XSIAM is the AI-powered security
operations platform intended to displace traditional SIEM; Cortex XDR handles prevention,
detection and response across endpoint, network, identity and cloud telemetry; Cortex XSOAR
provides orchestration and automation; Cortex Xpanse provides attack surface management. Cortex
Cloud — the successor to Prisma Cloud — combines a Cloud Native Application Protection Platform
with cloud detection and response across the code-to-cloud lifecycle.

**Threat intelligence and advisory services.** Unit 42 provides threat research, incident
response and security consulting, plus managed detection and response and managed threat
hunting. Global Customer Success delivers Standard, Premium and Platinum support tiers,
professional services and education.

### What the company added after the annual report

The Form 10-Q for the quarter ended April 30, 2026 describes two platform categories that did
not exist in the fiscal 2025 annual report:

- **Identity security — Idira.** Formed on the February 11, 2026 completion of the CyberArk
  acquisition, for which total purchase consideration was **$21.1 billion**. It unifies identity
  access management, privileged access management and identity governance and
  administration, covering workforce identity security, IT and developer
  privileged access management, machine identity security (secrets, certificates, workload
  identity, code signing), identity governance, and AI agent security.
- **Observability — Chronosphere.** Closed January 29, 2026 for total purchase consideration of
  **$3.0 billion**. A cloud-native observability platform plus a telemetry pipeline that filters,
  transforms and routes data; the pipeline is integrated with Cortex XSIAM to reduce ingest
  volumes.

Two smaller additions extended existing platforms: Koi Security Ltd. (closed April 14, 2026 for
$231 million) added agentic endpoint security to Cortex and Prisma AIRS, and Portkey, Inc.
(closed May 29, 2026) added AI gateway capability to Prisma AIRS. The company also launched
Unit 42 Frontier AI Defense services in April 2026, Next-Generation Trust Security for
certificate lifecycle management, and Prisma AIRS 3.0.

### How the company makes money

Revenue splits into two lines. **Product revenue** is hardware firewalls plus software licences
(SD-WAN, VM-Series, Panorama, and since February 2026 certain on-premises identity security
licences), recognised on shipment or licence delivery. **Subscription and support revenue** —
roughly four-fifths of the total — is recognised over the service term on contracts that
typically run one to five years. In fiscal 2025 product revenue was 19.5% of total revenue and
subscription and support 80.5%.

Management's headline operating metric is **Next-Generation Security Annualized Recurring
Revenue (NGS ARR)**: annualised allocated revenue of all active contracts related to product,
subscription and support offerings, excluding hardware and legacy attached subscriptions,
support and professional services. It is an operating metric, not a GAAP figure, and it expands
mechanically as the company acquires new offerings.

### Route to market, customers and supply

Sales run through a **two-tier indirect fulfilment model**: the company sells to distributors,
which sell to resellers, which sell to end-customers, supported by a direct-touch field sales
force and pre-sales engineers. The NextWave Channel Partner programme covered more than 8,500
partners as of July 31, 2025. VM-Series and Cloud NGFW are also sold through the AWS, Azure,
Google Cloud and Oracle Cloud marketplaces on usage-based licensing.

Customer concentration sits at the distributor rather than the end-customer level: no single
end-customer accounted for more than 10% of revenue in fiscal 2025, 2024 or 2023, but **three
distributors together represented 44.2% of fiscal 2025 revenue** and 44.8% of gross accounts
receivable at year end. End-customers spanned more than 180 countries and included almost all
of the Fortune 100.

Hardware manufacturing is outsourced. Flextronics International, Ltd. is the electronics
manufacturing services provider, assembling all hardware products in the United States;
manufacturing and supply contracts generally do not guarantee supply levels or fixed pricing.

**Competition** falls into four buckets the company names explicitly: large platform vendors
that bundle security (Cisco, Microsoft, Alphabet); independent security vendors (Check Point,
Fortinet, CrowdStrike, Zscaler, Wiz); startups and point-product vendors; and public cloud
vendors offering cloud security. The quarterly report adds that the identity security industry
entered through CyberArk brings its own set of competitors.

**Seasonality.** Fiscal second and fourth quarters typically show the strongest sequential
revenue — the second quarter because calendar-year-end customers spend down discretionary
budgets, the fourth because sales compensation plans carry annual quotas and commission
accelerators. The third fiscal quarter is typically the weakest, as calendar-year budget
planning delays spending.

**People.** Global headcount was 16,068 at July 31, 2025. By April 30, 2026 it had reached
**21,491**, including approximately 4,166 people added through the CyberArk acquisition.

**Facilities.** Corporate headquarters is roughly 941,000 square feet in Santa Clara under three
leases; the company also owns 10.4 acres adjacent to the headquarters for future development,
and leases space worldwide including in Israel and India.

---

## Risk factors

*Condensed from Part I, Item 1A of the FY2025 Form 10-K (accession 0001327567-25-000027), with
the revisions made in Part II, Item 1A of the Form 10-Q for the quarter ended April 30, 2026
(accession 0001327567-26-000015) noted where the risk changed materially.*

**Integration and scale of the acquisitions.** In the annual report this was framed
prospectively — whether the CyberArk deal would close, and a $1.0 billion reverse termination
fee payable in specified circumstances if it failed on regulatory grounds. In the quarterly
report the risk is restated in the past tense: the acquisition has substantially changed the
scope and size of the business, and the risk is now execution. Management attention may be
diverted from day-to-day operations to integration; systems and management controls must be
combined; employee, partner and customer relationships may be disrupted. Anticipated synergies
may not be realised, or not in the anticipated timeframe. Entering identity security also means
entering a new competitive field, which could produce price reductions and lower margins for the
combined company. Acquisition accounting adds a further exposure: the amounts and useful lives
assigned to purchased intangibles determine future amortisation, and goodwill and intangibles
recognised on acquisitions can be impaired.

**The assumed convertible notes.** This risk did not exist in the annual report. The company has
guaranteed CyberArk's 2030 Notes and may need to make cash payments on conversion, on a
fundamental change repurchase, or at maturity. If operating cash flow, existing cash and
investments and existing financing sources prove inadequate, third-party financing may not be
available on reasonable terms. A failure to pay when required would be a default under the
indenture and could cross-default other indebtedness. A related risk concerns the assumed capped
call transactions: dealer hedging activity in the company's shares could move the price of the
notes or the stock, and could affect the consideration a holder receives on conversion.

**Growth may not be sustained and profitability is not assured.** Revenue growth was 14.9% in
fiscal 2025 and 16.5% in fiscal 2024; the quarterly report restates the comparison as 21% for
the nine months ended April 30, 2026 against 15% a year earlier. The company incurred losses in
years prior to fiscal 2023 and expects operating expenses to keep rising. It has entered
substantial operating lease and purchase commitments that must be serviced regardless.

**Results are lumpy and hard to predict.** A substantial portion of orders and revenue lands in
the final weeks of each fiscal quarter. Delayed purchase orders, shipping constraints, inventory
mismatches or trade-compliance holds can push revenue past quarter end.

**Deferred revenue recognition cuts both ways.** Because subscription and support revenue —
80.5% of fiscal 2025 revenue, 80.0% in fiscal 2024, 77.1% in fiscal 2023 — is recognised over
one-to-five-year terms, a decline in bookings in any quarter is not fully reflected in that
quarter's revenue but depresses later periods. Customers have no contractual obligation to
renew, and may renew for shorter terms or on worse economics.

**Channel dependence and distributor concentration.** Substantially all revenue is generated
through channel partners. Three distributors individually exceeded 10% of fiscal 2025 revenue
and together represented 44.2% of it. Channel agreements are generally terminable by either
party with notice before annual renewal, partners may promote competitors' products, and new
partners take months to become productive.

**Customer credit.** Most sales are on open credit, and the company also offers customer
financing and deferred payment arrangements that push receipts into later periods and create
non-payment exposure, including from insolvency.

**Competition.** Larger competitors may have greater resources, broader distribution, more
mature intellectual property portfolios and the ability to bundle security into existing
products, sell at zero or negative margins, or offer closed technology stacks. Vendor
consolidation by customers can cut either way. Entrenched legacy vendors benefit from customers'
sunk investment in existing architectures.

**Product defects and vulnerabilities.** Products are complex and have contained defects
discovered after release. The annual report gives a concrete example: in November 2024 the
company became aware of an authentication bypass vulnerability in the management web interface
of certain PAN-OS versions, which required a security advisory, software updates and customer
remediation outreach. A failure of the products to block an attack, or a defect that disables a
customer's network, carries reputational and liability consequences that are heavier for a
security vendor than for a general technology supplier.

**Being a target.** As a well-known security provider, the company says it may be a more
attractive target for attack itself. A breach of its own networks or those of its service
providers could cause reputational damage, partner and customer loss, regulatory investigation
and litigation.

**AI development and deployment.** AI is embedded across the product portfolio and increasingly
in internal operations. Model flaws, insufficient or biased training data, prompt-level attacks
and the unsettled state of intellectual property and data protection law around AI create
liability and reputational exposure. Emerging AI regulation, including in the E.U., may force
changes in business practice, and the computing cost of AI systems raises the cost profile of
the offerings.

**Israel.** The company has substantial and growing operations in Israel — materially more so
after the CyberArk acquisition. Operations there could be disrupted by hostilities in Israel and
the surrounding region. Many Israeli employees are obligated to perform annual military reserve
duty and can be called to active duty in emergencies, which has occurred; a large-scale call-up
would impair the company's ability to operate at full capacity there.

**Trade controls and export regulation.** Products incorporate encryption technology and are
subject to U.S. export controls; non-compliance carries civil and criminal penalties. Sanctions
regimes, tariffs and import permit requirements in other countries can delay or prevent sales.

**Supply chain.** Reliance on outsourced manufacturing and limited-source components exposes the
company to shortages, delays and price increases; too little inventory costs sales, too much
harms gross margin.

**Tax.** The company may have greater-than-anticipated tax liabilities and continues to maintain
a valuation allowance against California deferred tax assets. It expects future California
research and development credit generation to exceed its ability to use existing credits.

**Capital structure and stockholder matters.** Additional stock issued for financings,
acquisitions, equity plans or convertible note settlement dilutes existing holders. The share
repurchase programme may not be fully consummated or enhance value. The company does not intend
to pay dividends for the foreseeable future. Charter documents and Delaware law could discourage
takeover attempts.

**Litigation.** The most significant disclosed matter is *Centripetal Networks, Inc. v. Palo
Alto Networks*, filed March 12, 2021 in the Eastern District of Virginia. A January 31, 2024
jury verdict of non-willful infringement carried a lump sum of $152 million plus statutory
interest; after post-trial motions, an October 3, 2024 judgment affirmed infringement on three
patents, reversed on a fourth, and reduced damages to **$114 million**. The company posted an
agreed surety bond that prevents execution of the judgment while the appeal is pending.
Centripetal has also filed infringement contentions in the European Patent Office and the
Unified Patent Court in Germany, which remain pending.

**Concentration of catastrophe risk.** Headquarters sits in the seismically active San Francisco
Bay Area.

---

## Management's discussion — fiscal year 2025

*From Part II, Item 7 of the FY2025 Form 10-K, accession 0001327567-25-000027.*

### Results

Total revenue was **$9,221.5 million** in fiscal 2025 against $8,027.5 million in fiscal 2024
and $6,892.7 million in fiscal 2023 — growth of 14.9% and 16.5% respectively. Product revenue
grew 12.4% to $1,801.9 million, driven by higher pricing of and allocation to on-premises
software licences beginning in the second quarter of fiscal 2025 and demand for the new hardware
generation, partly offset by declining demand for the prior generation. Subscription and support
revenue grew 15.5% to $7,419.6 million, split $4,974.4 million subscription (+18.8%) and
$2,445.2 million support (+9.4%).

By theatre: Americas $6,205.1 million (+13.2%), EMEA $1,917.4 million (+19.7%), APAC $1,099.0
million (+16.6%). The Americas contributed the largest absolute increase because of its scale;
EMEA grew fastest.

Gross margin fell to **73.4%** from 74.3%. Product gross margin declined on unfavourable
hardware mix and higher excess and obsolete inventory charges, partly offset by more software
revenue. Subscription and support gross margin declined on cloud-based offering costs — cloud
hosting service costs rose $189.5 million year over year — partly offset by leverage in the
global customer service organisation. Personnel costs in cost of subscription and support grew
$52.9 million on headcount.

Operating expenses were $5,527.0 million, up 4.6%, and fell as a share of revenue from 65.8% to
59.9%. Research and development was $1,984.1 million (21.5% of revenue) and sales and marketing
$3,100.2 million (33.6%). **General and administrative expense fell** to $442.7 million from
$680.5 million: fiscal 2024 carried $204.4 million of litigation-related charges, fiscal 2025
included a $38.8 million partial release of a litigation accrual and a $135.3 million gain from
the change in fair value of the contingent consideration liability on the IBM QRadar
acquisition, partly offset by $153.2 million of higher personnel costs driven largely by
share-based compensation. Total share-based compensation was $1,300.1 million, up from
$1,078.7 million. That acquisition — of certain IBM QRadar assets, comprising intellectual
property rights, customer relationships and software-as-a-service customer contracts — was
completed on August 31, 2024 for total purchase consideration of **$1.1 billion**.

Operating income was **$1,242.9 million (13.5% margin)** against $683.9 million (8.5%). Other
income, net rose to $355.8 million on higher interest income from a larger average cash and
investment balance and gains on non-designated derivatives, partly offset by foreign currency
losses. Interest expense fell to $3.0 million as the 0.375% Convertible Senior Notes due 2025
converted or matured in June 2025.

**Net income was $1,133.9 million, down from $2,577.6 million.** The decline is a tax artefact,
not an operating one: fiscal 2024 carried a **$1,589.3 million benefit** from income taxes
driven by the release of the valuation allowance on U.S. federal, non-California U.S. state and
U.K. deferred tax assets. Fiscal 2025 instead carried a $461.8 million provision — a $2.1
billion swing — which included a $218.5 million deferred tax provision from remeasuring basis
differences on the U.S. tax effects of foreign deferred tax assets following the One Big
Beautiful Bill Act enacted July 4, 2025. Pre-tax income rose from $988.3 million to $1,595.7
million.

### Key metrics and liquidity

NGS ARR reached **$5.6 billion** at July 31, 2025 from $4.2 billion a year earlier; remaining
performance obligations reached $15.8 billion from $12.7 billion.

Cash provided by operating activities was **$3,716.0 million**, up $458.4 million on stronger
collections, partly offset by higher cash expenditure supporting growth. Free cash flow
(non-GAAP; operating cash flow less purchases of property, equipment and other assets of $246.2
million) was $3,469.8 million. Investing used $2,204.7 million, an increase of $694.8 million on
higher net cash payments for acquisitions and investment purchases. Financing used $778.9
million, $564.2 million less than fiscal 2024 because the prior year's share repurchases did not
recur.

Total cash, cash equivalents and investments were **$8.5 billion** at July 31, 2025, held for
general corporate purposes. The $2.0 billion of 2025 Notes issued in June 2020 were fully
retired: $965.6 million of principal was repaid in cash during fiscal 2025 and 14.0 million
shares were issued for conversion value above principal, fully offset by shares received on
exercise of the associated note hedges. The $400.0 million unsecured revolving credit facility
was undrawn and in compliance with all covenants. Operating lease obligations totalled $417.4
million and purchase commitments for products, components and cloud hosting $7.1 billion. The
contingent consideration obligation from the IBM QRadar acquisition, payable through the quarter
ending October 2028, stood at $513.6 million.

### Critical accounting estimates

Management identifies revenue recognition (particularly the estimation of standalone selling
prices when they are not observable, which drives allocation across performance obligations),
income taxes (valuation allowances and uncertain tax positions), loss contingencies, and
business combinations (valuation of purchased intangibles, and the useful lives assigned to
them, which determine the amount and timing of future amortisation).

---

## Current quarter — fiscal third quarter 2026 (quarter ended April 30, 2026)

*From Part I, Item 2 of the Form 10-Q, accession 0001327567-26-000015, except three-month cash
flow and non-GAAP measures, which are from the results release furnished on Form 8-K, accession
0001327567-26-000012.*

This is the first quarter to consolidate both large acquisitions for substantially a full
period, and the reported results cannot be read as a like-for-like comparison with the prior
year.

### Revenue

Total revenue was **$3,002 million, up 31%** from $2,289 million. Product revenue was $594
million (+31%), helped by identity security software licences from CyberArk alongside software
licence growth and demand for the new hardware generation. Subscription and support revenue was
$2,408 million (+31%), of which subscription was $1,632 million (+32%) and support $776 million
(+29%). By theatre: Americas $2,018 million (+32%), EMEA $633 million (+32%), APAC $351 million
(+26%). For the nine months, total revenue was $8,070 million (+21%).

NGS ARR reached **$8.1 billion** at April 30, 2026 from $5.6 billion at July 31, 2025; remaining
performance obligations reached $18.4 billion from $15.8 billion. The results release attributes
$1.6 billion of the NGS ARR and $1.8 billion of the RPO to CyberArk and Chronosphere, and $388
million of the quarter's revenue to the two together.

### Why the quarter shows a loss

The company reported a **GAAP operating loss of $183 million** (a negative 6.1% margin) against
operating income of $219 million (9.6%) a year earlier, and a **GAAP net loss of $177 million**,
or $(0.22) per diluted share, against net income of $262 million, or $0.37. **This swing is
acquisition accounting and integration cost, not deterioration in the underlying operations.**
The reconciliation in the results release identifies the components: $517 million of
share-based compensation-related charges (against $355 million a year earlier), $198 million of
acquisition-related costs (against $7 million) and $280 million of amortisation of acquired
intangible assets (against $43 million), plus $2 million of litigation-related charges. Adding
those back, **non-GAAP operating income was $814 million against $627 million** — up 30%, close
to the rate of revenue growth.

The same drivers show up line by line. Gross margin fell to **67.6% from 72.9%**: product gross
margin to 71.9% from 77.8% on weaker hardware margin and higher intangible amortisation, and
subscription and support gross margin to 66.5% from 71.8%, principally on intangible
amortisation, which rose $117 million in the quarter. Cloud hosting costs rose $75 million and
personnel costs in cost of revenue $71 million. Research and development rose 49% to $734
million and sales and marketing 46% to $1,161 million, both largely on personnel costs from
acquired headcount ($192 million and $254 million of the increases respectively). General and
administrative rose 93% to $316 million, driven by $195 million of higher personnel costs from
accelerated vesting of equity awards on the acquisitions, CyberArk-related severance and
acquired headcount, plus higher acquisition-related costs — partly offset by a **$110 million
gain** on the change in fair value of the contingent consideration liability. Total share-based
compensation in the quarter was $684 million against $326 million.

Below the operating line, other income, net fell to $27 million from $93 million on a
fair-value loss on the assumed convertible notes and lower interest income from smaller average
cash and investment balances. The effective tax rate was **negative 13.5%** against 15.6%, a
consequence of the CyberArk acquisition and lower excess tax benefits from share-based
compensation, applied to a pre-tax loss.

For the nine months the company remained profitable on a GAAP basis: operating income of $523
million (6.5% margin) against $746 million (11.2%), and net income of $589 million against $880
million.

### Cash and balance sheet

Cash generation did not follow reported earnings down. Net cash provided by operating activities
in the quarter was **$871 million against $628 million**, and adjusted free cash flow $910
million against $578 million, giving a trailing twelve-month adjusted free cash flow margin of
38.5%, up 430 basis points year over year. Over nine months, operating cash flow was $3,196
million against $2,695 million, and free cash flow $2,859 million against $2,535 million after
$337 million of capital expenditure (up from $160 million). Investing used $2,098 million,
$656 million more than the prior nine months on cash paid for acquisitions. Financing used
$1,005 million, $600 million more, on share repurchases and contingent consideration payments.

The balance sheet is transformed. Goodwill rose from $4,567 million at July 31, 2025 to
**$21,902 million**, and intangible assets, net from $763 million to **$7,283 million**. Total
assets went from $23,576 million to $46,266 million and total stockholders' equity from $7,824
million to $27,668 million, the latter chiefly because 112 million shares valued at $18,488
million were issued as CyberArk consideration. Total cash, cash equivalents and investments
*fell* to **$7.0 billion from $8.5 billion**, funding the cash portions of the deals; working
capital was a deficit of $1,293 million against a deficit of $465 million.

**On the debt that now appears on the balance sheet.** Convertible senior notes of $160 million
current and $1,192 million long-term sit where there were none at July 31, 2025. These are not
money the company raised. They are CyberArk's existing $1.25 billion of 0.00% Convertible Senior
Notes due June 15, 2030, **assumed in the acquisition**; a supplemental indenture entered in
February 2026 made them exchangeable into Palo Alto Networks common stock and cash and added the
company's guarantee. During the quarter holders surrendered $153 million of principal for
conversion, leaving $1.1 billion outstanding. The sale price condition was not met for the
calendar quarter ended March 31, 2026, so the notes were not convertible on that condition
during the following calendar quarter. The $400 million revolving credit facility remained
**undrawn** and in compliance with all covenants. As part of the acquisition the company
repatriated $3.5 billion of foreign earnings through an intercompany transaction, with
immaterial income tax expense.

Commitments grew with the business: operating lease obligations of $778 million (from $417.4
million), reflecting the twelve-year extension of the Santa Clara headquarters leases, and
purchase commitments of $8.6 billion, of which $8,092 million is cloud hosting running to fiscal
2031 and beyond. The IBM QRadar contingent consideration obligation fell to $240 million from
$513.6 million. Expected future share-based compensation to be recognised rose to approximately
**$3.6 billion over a weighted-average 2.6 years**, from $2.2 billion over 2.5 years at July 31,
2025. Of the $945 million of replacement equity awards issued for CyberArk, only the $265
million attributable to pre-close service entered purchase consideration; the balance is
expensed over future service periods, so this is a cost that persists well beyond the closing
quarter.

The repurchase authorisation was increased to a cumulative $5.1 billion, with $1.0 billion
remaining available at April 30, 2026 and the authorisation running to December 31, 2026.

### Outlook

In the results release accompanying the quarter, management guided fiscal 2026 total revenue to
$11.415 billion to $11.425 billion with diluted non-GAAP net income per share of $3.77 to $3.79
and a non-GAAP operating margin of 28.9% to 29.2%, and reiterated a target of a 40% adjusted
free cash flow margin in fiscal 2028.

### Other current-period matters

In March 2026 the Knesset Finance Committee approved Israel's Law for the Encouragement and
Incentivization of Research and Development, introducing a tax credit for qualifying Israeli
research and development spending incurred after January 1, 2026, with unused credit payable in
cash after a stipulated period. Implementing regulations are still expected. The impact on the
quarter was not material, but given the scale of the company's Israeli operations after the
CyberArk acquisition it is worth tracking.

Management stated there were no significant changes to its critical accounting estimates from
those disclosed in the fiscal 2025 annual report.

---

## Subsequent events

*From Note 17 to the condensed consolidated financial statements and the liquidity discussion in
the Form 10-Q for the quarter ended April 30, 2026, accession 0001327567-26-000015.*

- **Portkey, Inc. acquisition completed May 29, 2026.** Palo Alto Networks entered a definitive
  agreement on April 30, 2026 — the balance sheet date — to acquire Portkey, Inc., a privately
  held AI gateway company, for **total consideration of $140 million in cash and replacement
  awards, subject to adjustments**, to extend the capabilities of Prisma AIRS. The acquisition
  completed on May 29, 2026 and will be accounted for as a business combination in the fourth
  quarter of fiscal 2026.
- **$160 million cash settlement of surrendered 2030 Notes on May 7, 2026.** The $153 million
  aggregate principal amount of the assumed 2030 Notes surrendered for conversion during the
  quarter was settled in cash after the period end.

No other post-period acquisition, divestiture, financing, borrowing or litigation outcome is
disclosed in the quarterly report's subsequent events note.