Published
# Palo Alto Networks, Inc. (PANW) — Business, Risks and Management's Discussion
Fiscal year ended July 31, 2026 ("fiscal 2026").
---
## Business
*From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.*
Palo Alto Networks was incorporated in 2005 and is headquartered in Santa Clara, California. It
sells cybersecurity — and, since fiscal 2026, observability — to enterprises, governments and
service providers. The stated strategy is "platformization": consolidating what customers
otherwise buy as disparate point products into a small number of tightly integrated platforms.
As of July 31, 2026 the company had end-customers in over 180 countries, spanning education,
energy, financial services, government, healthcare, internet and media, manufacturing, public
sector and telecommunications, and including almost all of the Fortune 100 and a majority of the
Global 2000.
The company operates as a single operating and reportable segment, with sales managed on a
geographic theater basis and consolidated net income used as the measure of segment profit, so no
segment-level profitability is broken out; it describes its portfolio as four platform groupings
plus advisory services.
**Network & AI Security.** The legacy core and still the largest business.
- *Secure Access Service Edge (SASE)* — Prisma Access (cloud-delivered security across more than
100 locations worldwide) combined with Prisma SD-WAN, extended to the browser by Prisma Browser
and the Prisma Access Browser.
- *Next-Generation Firewalls* — ML-powered hardware appliances running the PAN-OS operating
system, ranging from the PA-400 for branch offices to the PA-7500 for large data centers, plus
VM-Series virtual firewalls, CN-Series container firewalls, and Cloud NGFW as a managed offering
on AWS and Azure.
- *Cloud-Delivered Security Services (CDSS)* — add-on subscriptions attached to SASE and NGFW:
Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security,
Device Security, Quantum Security, Next-Gen Trust Protection, GlobalProtect, Prisma Access Agent,
Enterprise DLP, SaaS Security (API and Inline) and AI Access Security.
- *Prisma AIRS* — the AI-security platform, bundling AI Gateway, Agent Security, AI Red Teaming,
AI Runtime Security, AI Model Security and AI Posture Management.
- *Strata Cloud Manager* — unified cloud management for NGFW and SASE estates, including the
Strata Copilot natural-language interface and Autonomous Digital Experience Monitoring. Panorama
remains the management tool for many existing deployments.
**Cortex.** Security operations, cloud security and, new this year, observability.
- *Security operations* — Cortex XSIAM (AI-driven replacement for traditional SIEM), Cortex XDR
(XDR Prevent and XDR Pro tiers), Cortex XSOAR (orchestration and automation), Cortex Xpanse
(attack surface management), and Koi agentic endpoint security.
- *Cloud security* — Cortex Cloud, the successor to Prisma Cloud, combining CNAPP with cloud
detection and response across the code-to-cloud-to-SOC lifecycle.
- *Observability* — the Chronosphere platform and the Chronosphere Telemetry Pipeline, which
filters, transforms and routes telemetry to reduce data volumes. The telemetry pipeline also
feeds Cortex XSIAM.
**Idira.** The identity security platform formed out of the CyberArk acquisition, covering
workforce identity (adaptive MFA, SSO, workforce password management), privileged access
management with just-in-time elevation and zero standing privilege, endpoint privilege management,
identity governance and administration, machine identity (secrets management, Secrets Hub,
credential providers, certificate lifecycle), vendor privileged access, and Secure AI Agents.
**Unit 42 and services.** Threat research, incident response and security consulting, plus managed
detection and response and managed threat hunting. In April 2026 the company launched a suite of
Unit 42 Frontier AI Defense services. Professional services, education and tiered customer support
(Standard, Premium, Platinum, plus Focused Services) round out the offering.
**How the money comes in.** Revenue splits into *product* (hardware and on-premise software
licenses, including certain identity security licenses since the CyberArk deal) and *subscription
and support*, which was 80% of fiscal 2026 revenue. Contracts for subscriptions and support are
typically one to five years and are recognized over the service period. Distribution is
predominantly a two-tier indirect model: sales to distributors, who sell to resellers, who sell to
end-customers. In fiscal 2026 two distributors each individually represented 10% or more of total
revenue and together represented 30% of it; as of July 31, 2026 one distributor represented 19% of
gross accounts receivable.
Hardware is built by manufacturing partners, principally the EMS provider Flex, primarily in the
United States, with some components sourced abroad.
Headcount rose from 16,068 at the end of fiscal 2025 to 21,921 at the end of fiscal 2026, of which
roughly 4,223 came with CyberArk.
---
## Risk factors
*From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.*
**Acquisition integration is now the dominant operating risk.** Fiscal 2026 added four businesses,
two of them very large, with two more closing within weeks of the year-end. Management flags that the CyberArk acquisition "substantially changed" the
scope and size of the business, creating uncertainty for employees, partners and customers,
diverting senior management attention, and requiring the combination of systems and management
controls. The expected benefits and synergies from CyberArk and Chronosphere may not be realized
as expected, within the anticipated time frame, or at all. Contingent consideration obligations —
the company carried a $206 million obligation from the IBM QRadar asset purchase as of July 31,
2026 — are remeasured quarterly and can swing results either way.
**New competitive fronts opened by the same acquisitions.** Entry into identity security brings
increased competition in a category the filing says "lacks a universally accepted definition,"
which could lead to mischaracterization of the company's offerings by analysts whose rankings
materially influence purchasing. Named competitors now span large platform vendors (Alphabet,
Cisco, Microsoft), security and observability specialists (Check Point, CrowdStrike, Delinea,
Fortinet, Okta, SailPoint, Zscaler; Datadog, Dynatrace, elasticsearch), point-product startups,
and public cloud vendors. Two competitive risks are new in substance: public cloud providers
increasingly bundle native security, identity and observability at low or no incremental cost; and
frontier AI model providers, with substantial capital and compute, may enter the category directly
or enable third parties to build competing security applications on their models.
**Consumption-based revenue volatility.** A growing share of revenue — notably observability and
AI-related offerings — is priced on consumption or usage. The filing warns explicitly that this
creates exposure to "customer optimization behavior," where customers who scale usage rapidly then
reduce or reconfigure it to cut cost, a dynamic already observed with cloud-native and, more
recently, AI-native customers. Certain cohorts may represent a meaningful portion of
consumption-based growth, so optimization by a few could produce revenue volatility.
**AI cuts both ways.** Beyond the opportunity, the 10-K raises the possibility that if customers,
investors or other market participants come to believe AI can automate or commoditize
cybersecurity functions, the perceived value of security solutions could diminish and demand could
be adversely affected — and that these perceptions could hurt the stock "even if these perceptions
do not reflect actual changes in our business." AI systems also introduce their own vulnerability,
IP-ownership and regulatory exposure, and AI agents are described as a new class of identity the
company's identity products must learn to secure.
**Product defects and vulnerabilities.** A vendor of security products is an attractive target and
its own defects are reputationally acute. The filing discloses that in May 2026 the company became
aware of an authentication bypass vulnerability in certain versions of PAN-OS, published a
security advisory, issued software updates and engaged in customer outreach and remediation.
**Supply chain and gross margin.** Hardware depends on Flex and on a limited number of component
suppliers, some sole-source, with manufacturing operations concentrated in Asia. The filing states
that the company "experienced supply chain disruption and inflationary pressures during our fourth
quarter of fiscal 2026, resulting in increased costs for memory and other components, which have
negatively affected our gross margin and could continue to affect our gross margin," and notes a
current global shortage of memory-related components at a time when its appliances require higher
memory content. U.S. and Chinese import tariffs have already raised component costs.
**Concentration and channel dependence.** Two distributors at 30% of revenue in aggregate, and one
at 19% of gross receivables, is meaningful concentration; channel agreements are generally
terminable on notice before each annual renewal.
**Geopolitical and Israel exposure.** Operations in Israel expanded meaningfully with CyberArk.
Many Israeli employees are subject to military reserve duty and have been called to active duty
during regional hostilities. The Russia-Ukraine war, sanctions and export controls, and
U.S.–China and China–Taiwan tensions are all cited as live exposures.
**Results variability and seasonality.** A substantial portion of orders and revenue arrives in
the last few weeks of each fiscal quarter, and seasonal factors mean the second and fourth fiscal
quarters tend to record sequentially greater revenue than the first and third.
**Revenue growth may not persist.** The filing notes growth rates of 24% in fiscal 2026 and 15% in
fiscal 2025 and cautions that neither should be relied upon as an indication of future periods.
Because subscription and support revenue is recognized over one-to-five-year terms, a downturn in
bookings would not show up fully in the quarter it occurs.
**Tax and capital structure.** Exposure to transfer-pricing challenges, the One Big Beautiful Bill
Act, and the OECD's Pillar Two 15% global minimum tax (with a January 5, 2026 "side-by-side"
package that would generally exempt U.S. multinationals, subject to domestic implementation).
Effective tax rates are also sensitive to fair-value movements in the assumed CyberArk convertible
notes and capped calls. Separately, the company may lack the funds to settle conversions of, or
repay, the 2030 Notes in cash.
**Litigation.** In *Centripetal Networks v. Palo Alto Networks* (E.D. Va., filed March 2021), a
January 31, 2024 jury verdict of non-willful infringement carried a lump sum of $152 million plus
statutory interest; after post-trial motions, an October 3, 2024 judgment affirmed infringement on
three patents, reversed the fourth, and reduced damages to $114 million. A surety bond prevents
execution while appeals are pending. The accrual was $151 million as of July 31, 2026 (versus $146
million a year earlier), producing a $5 million charge in fiscal 2026 after a $39 million release
in fiscal 2025. Related Centripetal contentions are pending before the European Patent Office and
the Unified Patent Court in Germany. In *Finjan v. Palo Alto Networks* (N.D. Cal., filed 2014),
the judge granted summary judgment of non-infringement on all remaining patents on March 21, 2025;
the matter is on appeal. *Eire OG Innovations* (E.D. Tex., filed April 2024) was resolved in
December 2025 for an amount that was not material.
**No dividends.** The company has never paid a dividend and does not anticipate doing so.
---
## Management's discussion and analysis — fiscal 2026
*From the fiscal 2026 Form 10-K, accession 0001327567-26-000023.*
### The shape of the year
Fiscal 2026 was a year in which Palo Alto Networks bought its way into two new markets and
absorbed the cost of doing so. Total revenue reached $11,480 million, up 24% from $9,221 million
in fiscal 2025 (fiscal 2024: $8,027 million). But GAAP operating income fell to $695 million, a
6.1% margin, from $1,243 million and 13.5% a year earlier, and net income fell to $307 million
($0.40 per diluted share) from $1,134 million ($1.60). Cash generation, by contrast, improved:
operating cash flow was $4,553 million, up $837 million, and free cash flow (non-GAAP, operating
cash flow less $440 million of property and equipment purchases) was $4,113 million versus $3,469
million.
The gap between top-line acceleration and bottom-line compression is almost entirely acquisition
accounting and acquisition-related compensation. Chronosphere and CyberArk together contributed
$930 million of revenue since their acquisition dates and an operating loss of $797 million over
the same stub periods. Total share-based compensation expense — the amount charged to cost of
revenue and operating expenses, which is larger than the equity-award compensation added back in
the cash flow statement — rose to $1,815 million from $1,300 million.
### Key metrics
| | FY2026 | FY2025 | FY2024 |
|---|---|---|---|
| Total revenue ($M) | 11,480 | 9,221 | 8,027 |
| Revenue growth | 24% | 15% | 16% |
| Gross margin | 70.4% | 73.4% | 74.3% |
| Operating income ($M) | 695 | 1,243 | 684 |
| Operating margin | 6.1% | 13.5% | 8.5% |
| Net income ($M) | 307 | 1,134 | 2,578 |
| Diluted EPS | $0.40 | $1.60 | $3.64 |
| Operating cash flow ($M) | 4,553 | 3,716 | 3,258 |
| Free cash flow, non-GAAP ($M) | 4,113 | 3,469 | 3,101 |
Fiscal 2024 net income of $2,578 million, and the $3.64 of diluted earnings per share that goes
with it, are not comparable with the later years: both include a large benefit from income taxes on
the release of valuation allowances against U.S. federal, U.S. state (other than California) and
U.K. deferred tax assets. Next-Generation Security annualized recurring revenue was $9.1 billion at
July 31, 2026, against $5.6 billion a year earlier. Remaining performance obligations were $21.2
billion, against $15.8 billion.
### Revenue
Product revenue was $2,280 million, 19.9% of total, up 27% ($478 million). The increase came from
software licenses — including licenses acquired with CyberArk — and from demand for the new
generation of hardware.
Subscription and support revenue was $9,200 million, 80.1% of total, up 24% ($1,781 million).
Within it, subscription revenue was $6,239 million (up 25%) and support revenue $2,961 million (up
21%). CyberArk and Chronosphere both contributed.
By theater: Americas $7,679 million (up 24%), EMEA $2,428 million (up 27%), APAC $1,373 million
(up 25%). The Americas contributed the largest absolute increase by virtue of its scale.
### Costs and margin
Total cost of revenue rose to $3,403 million from $2,451 million, and gross margin fell 300 basis
points to 70.4%.
- Product gross margin fell to 75.1% from 77.1%, on lower hardware margin (supply chain
challenges among the causes) and higher intangible amortization, partly offset by higher-margin
CyberArk software license revenue and a decrease in inventory excess and obsolescence charges.
- Subscription and support gross margin fell to 69.2% from 72.5%, on intangible amortization from
the year's acquisitions and higher cloud-based delivery costs.
### Operating expenses
Research and development was $2,552 million (22.2% of revenue), up 29%, with personnel costs alone
up $429 million on headcount growth including acquired employees. Sales and marketing was $3,931
million (34.3% of revenue). General and administrative was $899 million (7.8% of revenue) versus
$443 million, an increase driven by $253 million of higher personnel cost — accelerated vesting of
equity awards tied to the acquisitions, severance in connection with CyberArk, and acquired
headcount — plus higher acquisition-related costs. Total operating expenses were $7,382 million,
64.3% of revenue, versus 59.9% a year earlier.
As of July 31, 2026 approximately $3.3 billion of share-based compensation expense remained to be
recognized over a weighted-average period of roughly 2.5 years.
In March 2026 the Knesset Finance Committee approved Israel's Law for the Encouragement and
Incentivization of Research and Development, providing a qualified refundable tax credit for
qualifying R&D spend incurred in Israel on or after January 1, 2026. Its fiscal 2026 impact was
not material.
### Below the line
Other income (expense), net swung to a $(159) million expense from $353 million of income, mainly
a loss from the change in fair value of the assumed 2030 Notes, partly offset by gains on the
capped calls and gains on investment sales made to fund acquisitions. Income before taxes was $536
million; the provision for income taxes was $229 million. The effective rate rose year over year
on non-deductible fair-value changes in the 2030 Notes and capped calls and on share-based
compensation, partly offset by an intercompany legal entity restructuring in fiscal 2026 and by
the prior-year effect of adopting the One Big Beautiful Bill Act.
### The fiscal 2026 acquisitions
| Target | Closed | Consideration | What it added |
|---|---|---|---|
| Chronosphere, Inc. | Jan 29, 2026 | $2,951M ($2,842M cash + $109M replacement awards) | Next-generation observability platform |
| CyberArk Software Ltd. | Feb 11, 2026 | $21,061M ($2,308M cash + 112M shares valued $18,488M + $265M replacement awards) | Identity security platform (Idira) |
| Koi Security Ltd. | Apr 14, 2026 | $231M, substantially all cash | Agentic endpoint security for Cortex; enhances Prisma AIRS |
| Portkey, Inc. | May 29, 2026 | $117M, substantially all cash | AI Gateway capability for Prisma AIRS |
CyberArk shareholders received $45.00 in cash and 2.2005 Palo Alto Networks shares per CyberArk
share. The purchase price allocation recorded $14,800 million of goodwill and $6,279 million of
identified intangibles (developed technology $2,537 million over 5–7 years; platform renewals
$3,500 million over 12–14 years; customer contracts $219 million over 2 years; trade name $23
million over 1 year), and assumed $1,303 million of convertible senior notes and $776 million of
deferred revenue. Transaction costs were $56 million. A workforce optimization plan for the
combined entity carries an estimated total cost of $60 million, expected to be substantially
complete by the end of fiscal 2027; $49 million of severance charges were recognized in fiscal
2026, $18 million was paid in cash, and $14 million remained accrued at July 31, 2026.
Chronosphere's allocation recorded $2,364 million of goodwill and $565 million of intangibles
(developed technology $300 million; customer relationships $255 million; trade name and trademarks
$10 million). Koi added $169 million of goodwill and a $35 million developed-technology intangible;
Portkey added $110 million of goodwill and a $15 million developed-technology intangible.
On a pro forma basis, as if Palo Alto Networks, Chronosphere and CyberArk had been combined from
the start of fiscal 2025, total revenue would have been $12,312 million in fiscal 2026 and $10,486
million in fiscal 2025, with a net loss of $114 million and $37 million respectively. The pro
forma figures exclude approximately $562 million of net losses on fair-value changes in the
acquired convertible notes and capped calls that are reflected in the reported results.
Management excluded CyberArk from its assessment of internal control over financial reporting for
fiscal 2026, as permitted for a first-year acquisition; CyberArk represented 2% of consolidated
assets, under 1% of consolidated net assets, and 6% of consolidated revenue. Internal control over
financial reporting was concluded effective as of July 31, 2026, with an Ernst & Young LLP
attestation.
New and upgraded offerings introduced during fiscal 2026 included PAN-OS 12.1 Orion, Prisma AIRS
2.0, Next-Gen Trust Protection and Prisma AIRS 3.0. On July 16, 2026 the company announced general
availability of Prisma AIRS Gateway, incorporating the AI gateway technology acquired with Portkey.
### Liquidity and capital resources
Cash, cash equivalents and investments totalled $7.9 billion at July 31, 2026, held for general
corporate purposes. As part of the CyberArk acquisition the company executed an intercompany
transaction to repatriate $3.5 billion of foreign earnings, with immaterial income tax expense on
state and other taxes; remaining unremitted earnings are indefinitely reinvested.
*Debt.* Through a February 2026 supplemental indenture entered in connection with the CyberArk
acquisition, CyberArk's $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes
due June 15, 2030 became exchangeable into Palo Alto Networks common stock and cash. During fiscal
2026 holders surrendered $153 million principal for conversion, settled for $160 million in cash,
leaving $1.1 billion outstanding. The sale price condition was not met in the calendar quarter
ended June 30, 2026, so the notes are not convertible on that basis during the quarter ending
September 30, 2026; if the condition is met in that quarter and all holders convert in the quarter
ending December 31, 2026, the company would have to settle the $1.1 billion principal, and any
excess conversion obligation, in cash. A $400 million unsecured revolving credit facility entered
in April 2023 (expandable by up to $350 million) was undrawn at July 31, 2026, with no default.
*Capital return.* The share repurchase program authorized in February 2019 and subsequently
increased totals $5.1 billion; $1.0 billion remained available at July 31, 2026 and the
authorization expires December 31, 2026.
*Commitments.* Operating lease obligations of $793 million are recorded on the balance sheet, with
lease terms running through fiscal 2040 and the most significant relating to the Santa Clara
headquarters. Commitments to purchase products, components, cloud hosting and other services
totalled $8.3 billion. The contingent consideration obligation from the August 31, 2024 purchase
of certain IBM QRadar assets stood at $206 million, with potential payments running through the
quarter ending October 31, 2028.
*Cash flows.* Operating activities provided $4,553 million (up $837 million on higher collections,
partly offset by higher cash expenditure). Investing activities used $3,104 million (up $899
million, chiefly higher net cash paid for acquisitions, partly offset by higher proceeds from sales
and maturities of investments). Financing activities used $1,202 million (up $423 million, on share
repurchases and contingent consideration payments, partly offset by less cash used for convertible
note repayments and conversion settlements).
*Market risk.* Outstanding foreign currency forward contracts had a notional amount of $2.2 billion
at July 31, 2026. A hypothetical 100 basis point rise in interest rates across all maturities would
cut the investment portfolio's fair value by $128 million; a 100 basis point fall would raise it by
$131 million.
---
## The most recent reported period: fiscal fourth quarter 2026
*Fourth-quarter figures from the earnings release furnished as Exhibit 99.1 to the Form 8-K of
September 1, 2026, accession 0001327567-26-000019; full-year figures as reported in the fiscal
2026 Form 10-K, accession 0001327567-26-000023.*
The fourth quarter, which ran May 1 to July 31, 2026, was the first full quarter with CyberArk
inside the results.
- Total revenue of $3.41 billion, up 34% year over year (product $738 million, subscription and
support $2,672 million).
- Next-Generation Security ARR of $9.10 billion, up 63%; management characterised the quarter as
adding "nearly $1 billion of Net New NGS ARR in a single quarter."
- Remaining performance obligations of $21.2 billion, up 34%.
- GAAP operating income of $172 million, against $497 million in the fourth quarter of fiscal
2025. Non-GAAP operating income of $1.0 billion, against $768 million.
- A GAAP net loss of $282 million, or $(0.35) per diluted share, against GAAP net income of $254
million, or $0.36 per diluted share, a year earlier. Non-GAAP net income of $853 million, or
$1.02 per diluted share, against $673 million and $0.95.
- Operating cash flow of $1.4 billion (prior-year quarter: $1.0 billion) and adjusted free cash
flow of $1.3 billion (prior-year quarter: $954 million). Adjusted free cash flow margin for the
full fiscal year was 38.4%.
Management stated a $20 billion NGS ARR target for fiscal 2030 and a 40% adjusted free cash flow
margin target for fiscal 2028.
**Guidance issued September 1, 2026.** For the first quarter of fiscal 2027: NGS ARR of $9.54–9.56
billion (63% growth); remaining performance obligations of $20.8–20.9 billion (34–35% growth);
revenue of $3.300–3.310 billion (33–34% growth); diluted non-GAAP earnings per share of $0.96–0.98
on 837–844 million shares. For full fiscal 2027: NGS ARR of $11.075–11.175 billion (22–23%
growth); remaining performance obligations of $25.2–25.4 billion (19–20% growth); revenue of
$14.10–14.20 billion (23–24% growth); non-GAAP operating margin of 29.5%; diluted non-GAAP
earnings per share of $4.16–4.19 on 844–847 million shares; adjusted free cash flow margin of
38.0%. The company does not provide GAAP guidance for these measures and has not reconciled them.
**Interim context.** The third quarter of fiscal 2026, the three months ended April 30, 2026, was
reported on Form 10-Q under accession 0001327567-26-000015. It was the first quarter to carry
CyberArk, from February 11, and showed revenue of $3,002 million (up 31% year over year), a net
loss of $177 million or $(0.22) per diluted share, and NGS ARR of $8.1 billion. Those figures are
not restated by the annual report; the third quarter sits inside the audited fiscal 2026 results
above.
---
## Subsequent events
*Events after July 31, 2026, from the fiscal 2026 Form 10-K, accession 0001327567-26-000023, and
the Form 8-K of August 21, 2026, accession 0001193125-26-361122.*
**Acquisition of Embrace Mobile, Inc. — completed August 27, 2026.** Embrace is a privately held
user-focused observability company. The definitive agreement, signed July 20, 2026, provides for
total consideration of **$325 million in cash, subject to adjustments**. The company expects the
deal to add high-fidelity Real User Monitoring capability to its observability platform. It will
be accounted for as a business combination in the first quarter of fiscal 2027.
**Acquisition of Console Systems, Inc. — completed September 1, 2026.** Console is a privately
held company providing an AI-native platform enabling agentic workflows across enterprise
operations. The definitive agreement, signed July 29, 2026, provides for total consideration of
**$500 million in cash, subject to adjustments**. The company expects the deal to deepen its
agentic capabilities in Cortex and to expand the Cortex platform's role across enterprise agentic
transformation. It will be accounted for as a business combination in the first quarter of fiscal
2027.
**Governance actions of August 20, 2026.** The Board approved an Executive Change in Control and
Severance Policy covering employees at Senior Vice President level and above who sign a
participation agreement, and adopted amended and restated bylaws effective immediately.
No other material post-period acquisitions, divestitures, financings or litigation outcomes were
disclosed. The share repurchase authorization had $1.0 billion remaining as of July 31, 2026 and
expires December 31, 2026.