Palo Alto Networks Q2: Cybersecurity’s AI Arms Race Is Heating Up (Part 2)
PANW’s 10B Goal, The CYBR Acquisition & Fortinet Being Left Behind
At The Pragmatic Optimist, we help hundreds of investors navigate the evolving AI innovation landscape, identify rock-solid businesses with strong growth trajectories and operational grit, and make long-term investments in the space with proven alpha generating returns.
Become a paid subscriber today
🎥 Let’s Set The Stage
Palo Alto Networks PANW 0.00%↑ never had it easy as it walked into its Q4 earnings yesterday.
Concerns about slowing growth through its fiscal year 2025 got exacerbated when the company announced its blockbuster $25B M&A with CyberArk CYBR 0.00%↑ leading to speculations that its organic growth was stalling and that demand for the California-based cybersecurity firm’s products was waning.
So when PANW announced its full-year FY25 results yesterday, it surprised everybody when their management’s projections for the upcoming FY26 were well above analysts’ expectations. The cherry on top of management’s projections was that the planned M&A with CYBR would accelerate free cash flow margins, the exact opposite of what markets were expecting.
Earlier this month, we had issued a Buy rating on PANW, notifying investors that we were initiating a position in the company’s shares, and reiterated our bullish view just yesterday.
Heading into the Q4 ER, our conviction score on the stock had sizably moved up, indicating a higher probability of future outperformance. (You’ll be surprised to learn what our conviction scores indicate about PANW now!)
In this post, we have outlined some of the key takeaways from Palo Alto Network’s Q4 performance with updated price targets and conviction ratings that can be found on the AI Stock Rec Tracker below. 👇
(Bonus: We have also added our views on how this impacts Fortinet and other cybersecurity players)
PANW: The First Cybersec Company To Reach $10B
Palo Alto Networks’ Q4 FY25 report showed the company delivered a top and bottom-line beat with Q4 sales of $2.54B, up 15.5%, accelerating above analysts’ expectations of $2.5B, while Q4 EPS came in at 95 cents, above consensus estimates of 89 cents. This marks the fourth quarter of successive growth accelerations in PANW’s quarterly revenue.
For the full year, PANW’s FY25 revenues have now grown by 14.4% YoY to $9.2B.
The fourth quarter particularly stood out for us because we observed the return
of the confident tone in sales deals by management that has been lacking for a few quarters now.
During the Q4 FY25 earnings call, management discussed that activity in their sales deals and customer engagements was at a 30-month high, with the company closing several multi-million dollar deals.
One deal in particular was worth $100M, their largest ever (and also quite large for the cybersecurity landscape). This particular customer is already active on PANW’s cybersecurity platform and is alone, contributing >$50M in PANW’s NGS ARR. (NGS stands for Next Gen Security, which we’ll explain below.)
PANW’s subscription-based products, like its Cortex and Prisma platforms, were seeing a spike in activity that pushed up its NGS ARR by 39% to $5.8B. For the first time ever, PANW revealed that the AI-native portion of their ARR, which includes AI-only threat detection and management products, came in at $545M, up 2.5x YoY.
For FY26, management guided for revenues of $10.5B and NGS ARR of $7B, above expectations of $10.4B revenue and $6.9B ARR, respectively.
While we would have been happier to see a slightly stronger guide in Palo Alto’s ARR given the pickup in deal activity, Nikesh Arora and team usually tend to be conservative with their projections and prefer to beat-and-raise through the year, so we do think there is room for guiding up ARR in the coming quarters.
Remember, Palo Alto Networks’ FY26 revenue guidance is based on their own organic growth and does not include any revenues coming in from the planned CYBR acquisition.
On that note, we do have some updates about PANW’s CYBR acquisition.
PANW’s CYBR Acquisition Is Creating Value—Not Diminishing It.
In the last 5 years, Palo Alto Networks made a concerted push to rapidly invest into emerging growth areas of the cybersecurity market such as SASE (Secure Access Service Edge), MSS (Managed Security), EDR (Endpoint Threat Detection & Response), SIEM (Security Information and Event Management), etc.
Most of the pickup in PANW’s sales deal activity in Q4 FY25 that we noted in the previous section was in these emerging areas. Due to the high degree of fragmented cybersecurity offerings, PANW adopted the platformization approach to bundle up services into one platform called Cortex XSIAM, which they launched in 2021.
The company recently launched v3.0 of their XSIAM platform that includes offerings from PANW’s Q-Radar acquisition. PANW’s Cortex security products and Prisma cloud offerings are part of the company’s Next Generation Security products, which are subscription-based offerings and are tracked by ARR.
But as the fabric of technology is being rewoven by AI, creating a vast, new, and complex attack surface, PANW management is constantly looking for ways to expand their TAM (total addressable market), especially as organizations are consolidating their cybersecurity spend on fully integrated platforms.
Enter the $25B CyberArk acquisition—Palo Alto Networks’ biggest takeover to date.
Among all the offerings PANW has, identity security is the one area that PANW never focused on. That was until CyberArk, a company founded even before Palo Alto Networks, started posting ultra-impressive signs of business inflection. CYBR is currently on track to grow its FY25 revenues this year by ~33%, slightly outpacing the growth in its massive $80B TAM (slide 31 of CYBR’s 2025 Investor Day).
Also, CYBR has been growing faster than one of its direct peers, Okta OKTA 0.00%↑, which has yet to see its revenue start to reaccelerate since the Lapsus$ security breach in 2022.
So it makes complete sense to us as to why PANW decided to acquire CYBR. The access to CYBR’s 10,000+ customers creates a compelling opportunity for Palo Alto Networks to cross-sell to.
Also, it should be relatively easy for Palo Alto Networks to cross-sell to CYBR’s customer base and to sell CYBR’s identity solutions to PANW’s customer base as well.
The biggest standout point about the acquisition—investors will see that CYBR boasts one of the lowest CAC payback periods, not just in the cybersecurity space but in the entire software industry. The implication of CYBR’s payback period of just 16.6 is that it takes the Israeli cybersecurity company just 16.6 months to recover the cost of acquiring a new customer!
When PANW’s planned CYBR acquisition goes through, it will actually give PANW a sizable boost in margins due to the impressive efficiency in CYBR’s customer acquisition and lifecycle management.
And this is exactly what we saw in Palo Alto’s margin outlook for the coming year and years ahead.
For the next year, Palo Alto’s management projects a 70 bp expansion to its operating margins to a midpoint of 29.5%, on an adjusted basis.
On the cash flow front, markets were expecting PANW’s cash flow outlook to deteriorate after the 100 bp contraction that markets witnessed in FY25. However, adj. FCF margins are projected to expand in FY26 to 38.5%, marking a bottom for FCF margins of 37.6% seen in FY25.
Note that all margin projections we discussed in the previous paragraph are based on PANW’s organic growth and don't include any inorganic bump ups from CYBR’s business in FY26.
The CYBR M&A is expected to close sometime in H1 of next calendar year, and management expects the CYBR acquisition to single-handedly expand PANW’s free cash margins by ~75 bp per year from FY27 onwards, which, by our estimates, gets PANW to 40% free cash margins sometime in FY28.
This will mark the first time PANW will be able to deliver a +40% free cash margin to investors since pre-FY17. We strongly believe in the strength of PANW’s takeover deal for CYBR and have aligned our expectations with PANW’s management to see this deal get completed sometime early next year.
For now, we will continue to model PANW’s outlook over the next year based on its organic growth, excluding CYBR’s business.
PANW Might Look Expensive, but the Premium Is Worth It
Before PANW reported Q4 earnings, the company’s shares exchanged hands at a forward valuation of 47.6x with expectations that its FY26 earnings would grow 10.8% YoY while revenue growth would slow to 13% YoY next year.
However, as noted earlier in this post, management surprised markets by projecting FY26 earnings to grow 13.8% next year, meaningfully ahead of analysts’ estimates. For the projected earnings growth, we continue to believe that PANW’s shares justify a forward valuation of ~56x, and we reiterate our PT of ~$214 per share.
Assuming PANW is able to sustain its 6% post-earnings gain after markets open, we will be up over 10% on our holdings. But, given that our Conviction Score on the stock has expanded to 15 (from 10), we will be looking to increase our position size in the stock.
Competitive Risks & PANW’s Peers
At the moment, we believe cybersecurity will continue to be a resilient segment of the market and expect competition to be the single biggest threat to PANW.
It is important that PANW continues to navigate the rapidly evolving changes of the market and deliver growth-driven margin expansion to warrant the high forward earnings multiple it commands today. Else it may face re-ratings like how some of its peers recently did, like Fortinet FTNT 0.00%↑.
As we detailed in an earlier note on Fortinet, the cybersecurity company did not anticipate the backlash from markets after Fortinet’s management disclosed that the company’s firewall hardware refresh cycles were running ahead of management’s 2026-2027 timelines.
In Fortinet’s latest earnings call, the company noted that ~45% of the 2026 firewall refresh cycle was complete. However, investors were quick to notice that despite the sooner-than-expected upgrade activity, management was still projecting growth in its Services segment (Services encompasses all the subscription-based products like SASE) to slow to 14% YoY in FY25.
Fortinet has a large installed base of >890,000 global customers, so while management’s strategy of attaching subscription-based products to customers who wanted to upgrade their firewall hardware devices made sense, its unchanged guidance for the Services segment dampened investor sentiment, and the stock slid.
In a previous note to investors, we pointed out that Fortinet’s forward price-to-earnings multiple has compressed to 30x, which could present an entry point, with a potential upside of 12% to a price target of $90 per share.
But, given our depressed conviction score on the stock, we would highly recommend PANW over FTNT at this point in time.
Meanwhile, when it comes to CrowdStrike CRWD 0.00%↑, we believe that the stock continues to remain a “buy” as well.
Aside from its primary positioning as the “most advanced” cloud-native platform for protecting endpoints, cloud workloads, identity, and data, it has also been fortifying its footprint in the identity market with its Falcon Identity Protection solution. At the same time, it has been expanding its strategic partnership with Zscaler and Cloudflare to build a fully integrated cybersecurity platform.
While we will be watching how the competitive landscape evolves in the coming quarters, one thing is clear.
As we enter the second wave of the AI Revolution, which is centered on Agentic AI, enterprises are waking up to the fact that they need to consolidate their cybersecurity spend away from single-point solutions towards fully integrated platforms in order to boost their security posture for AI deployment at scale.
This means that the cybersecurity AI arms race is only going to get fiercer, as companies fight for dominance in enterprise cybersecurity spending.
Uttam & Amrita
Disclaimer: I/we have a beneficial long position in the shares of PANW, CRWD, ZS, NET either through stock ownership, options, or other derivatives. I wrote this article myself, and it expresses my own opinions, based on my observations and interpretations of events and should not be construed as personal investment advice. I am not receiving compensation for it. I have no business relationship with any company whose stock is mentioned in this article.