Part 2: Palo Alto Networks ARR Growth Without the Deals
Palo Alto Networks just reported 63% growth in its headline recurring-revenue metric. Most of the jump came from what it bought this year, not from its existing business. By the company's own Q3 disclosure, the business it already owned was growing at about 28%, and FY27 guidance shows growth settling at 22–23% once the deals are a year old. This is Part 2 of Cybersecurity Stocks, Five Ways.
KEY TAKEAWAYS
1. Next-Generation Security (NGS) ARR reached $9.10 billion at the end of fiscal Q4 2026 (May–July), up 63% year over year, per the company's Sep 1, 2026 results.
2. In Q3, $1.6 billion of the $8.1 billion NGS ARR came from CyberArk and Chronosphere. Strip that out and the existing business grew about 28%, by my calculation from the company's figures.
3. Company guidance has NGS ARR at $11.075–11.175 billion by the end of FY27, or 22–23% growth, as the acquisitions roll into the comparison base.
What the Q4 print showed
According to the fiscal Q4 2026 earnings release (8-K, Sep 1, 2026), revenue rose 34% to $3.41 billion and remaining performance obligations rose 34% to $21.2 billion. Non-GAAP operating income was $1.01 billion, about 29.6% of revenue by my calculation. For the full fiscal year ended July 31, revenue was $11.48 billion, up 24%, and adjusted free cash flow was $4.41 billion, a 38.4% margin.
Two deals sit behind the step change. Observability company Chronosphere, announced at $3.35 billion in November 2025, closed in January. Identity security company CyberArk closed on Feb 11, 2026. The stock closed at $406.76 on Oct 5, 2026, which works out to roughly $330 billion in market value on the 818 million shares the 10-K reports as outstanding at Aug 31.
Four platforms, two gaps filled by M&A
The FY26 10-K organizes the business into Network & AI Security (firewalls, SASE, Prisma AIRS), Cortex (security operations, cloud security and now observability), Idira (identity) and Unit 42 (threat intelligence and incident response). The strategy is platformization: sell a firewall customer the security operations center and identity layer under one contract, so the customer runs fewer vendors and Palo Alto collects more per account.
CyberArk filled identity, covering human, machine and AI agent credentials. Chronosphere filled observability inside Cortex. Portkey, an AI gateway closed in May, now sits under Prisma AIRS. The bet is visible in the wording: as AI agents multiply, controlling who and what can access a system becomes the center of security.
On the Q4 call, management cited 220 net new platformizations in the quarter and kept its goal of more than 4,000 by fiscal 2030. It also said Idira revenue reached $1.26 billion in FY26, up 21% on a pro forma basis that includes pre-acquisition periods, and that Prisma AIRS passed $100 million in ARR. Those figures come from the call, not the filings.
Taking the acquisitions out
The cleanest disclosure is from Q3 (February–April). The Jun 2, 2026 release says NGS ARR grew 60% to $8.1 billion and that this "includes $1.6 billion in NGS ARR from CyberArk and Chronosphere." Q3 revenue of $3.0 billion likewise included $388 million from the two companies.
The arithmetic is short. The 60% growth implies a prior-year base of about $5.06 billion. Remove the $1.6 billion and the existing business is about $6.5 billion, roughly 28% higher than a year earlier. Twenty-eight percent at this scale is a solid number. It is just less than half of the headline.
Q4 did not come with a split, so I don't back one out. Acquired ARR almost certainly moved after Q3, and Portkey and Console were added, so applying the Q3 figure to Q4 would be a guess.
The deal was paid largely in stock. CyberArk holders received $45 in cash plus 2.2005 Palo Alto shares per share. The Q3 10-Q shows about $2.3 billion in cash and 112 million new shares, for $21.1 billion of total purchase consideration. Against the 709 million diluted shares in the year-earlier quarter, that is roughly 16% more shares (my calculation). GAAP diluted shares hit 817 million in Q4.
The firewall business and memory prices
This is where cybersecurity meets the chip cycle. Product revenue, mainly next-generation firewall appliances plus some software licenses, was $2.28 billion in FY26, 19.9% of revenue and up 27%, per the 10-K. Q4 product revenue was $738 million against $574 million a year earlier.
The 10-K is unusually direct about components. It says the company saw supply chain disruption and inflation in fiscal Q4, "resulting in increased costs for memory and other components," which hurt gross margin. It also notes a global shortage of memory-related components, and that some appliances need more memory. On the call, the CFO said memory and storage costs should stay elevated and pointed to "selective pricing actions." Non-GAAP gross margin was 74.8% in Q4, down 100 basis points year over year, which management tied mostly to the shift toward SaaS products.
One step further: growth after the anniversary
Acquisition-driven growth expires after twelve months, because the prior-year base starts to include the acquired business too. The guidance shows that clearly. FY27 Q1 NGS ARR is guided to $9.54–9.56 billion, still 63% growth, since CyberArk wasn't in the base yet. By the end of FY27, the guide is 22–23%. Revenue follows the same path: 33–34% in Q1, 23–24% ($14.10–14.20 billion) for the year.
I read 22–23% as the business returning to its organic pace, a few points under the Q3 ex-deal rate, not as a sign of deterioration. The open question is which number the market is pricing. At about $330 billion, the stock trades near 23x the midpoint of FY27 revenue guidance (my calculation). The accounting gap is wide too: FY26 diluted EPS was $0.40 on a GAAP basis and $3.84 non-GAAP, with $1.71 billion of share-based compensation charges and $638 million of acquired-intangible amortization in between. Cash is steadier. FY27 guidance calls for a 38% adjusted free cash flow margin.
What I actually watch
| Checkpoint | Why it matters |
|---|---|
| FY27 Q1 NGS ARR vs. $9.54–9.56bn guide | First print of the new year |
| Any acquired vs. organic ARR split | Shows if ~28% is holding |
| Net new platformizations | Pace toward 4,000+ by FY30 |
| Product gross margin after price moves | Memory cost pass-through |
Value chain read-through
| Area | FY26 signal | Metric to watch |
|---|---|---|
| Firewall hardware | Product revenue +27% | Product gross margin |
| Identity security | CyberArk folded in | Idira growth |
| Memory and storage | Component costs up | Appliance pricing |
Risks to this view
• Integration: the 10-K says that as a result of the CyberArk acquisition, "the scope and size of our business have substantially changed." The deal added about 4,223 employees. Key-staff attrition and integration costs are real variables.
• Normalization: how the market treats the drop toward 22–23% growth in the second half of FY27 is unknown.
• Dilution and accounting: about 112 million new shares were issued, and GAAP earnings are a fraction of non-GAAP.
• Channel concentration: per the 10-K, two distributors accounted for 30% of FY26 revenue.
• My ~28% figure rests on Q3 disclosures only. The Q4 split was not published.
Bottom line: the 63% is real but mostly bought. The number to anchor on is the 22–23% the company itself guides to once the deals lap. Next in the series: Fortinet, and why a firewall company designs its own chips.
Sources: Palo Alto Networks fiscal Q4 and FY2026 earnings release, 8-K (Sep 1, 2026); FY2026 Form 10-K (filed Sep 2026); fiscal Q3 2026 earnings release, 8-K (Jun 2, 2026) and Q3 10-Q; fiscal Q1 and Q2 2026 earnings releases (Nov 19, 2025; Feb 17, 2026); CyberArk acquisition completion release (Feb 11, 2026); Chronosphere acquisition announcement (Nov 19, 2025); Portkey acquisition announcement (2026); Q4 FY2026 earnings call transcript (Sep 1, 2026); share price per market data (Oct 5, 2026 close).
Comments
Post a Comment