Palo Alto Earnings | The AI Security Boom Is HerePalo Alto Networks wrapped up Q4 FY26, ending in July, with revenue up 34% year over year to $3.4 billion, beating estimates by $60 million. NonGAAP EPS came in at $1.02, $0.04 above expectations
The headline growth numbers are still somewhat distorted by acquisitions, but the underlying demand was strong.. Palo Alto added a record $970 million in net new Next Gen Security ARR and completed roughly 220 net new platformizations, up 44% year over year and roughly double Q3. In simple terms, more customers are choosing to buy multiple Palo Alto products instead of individual security tools
The company ended FY26 with a 38% adjusted free cash flow margin, maintaining its high 30% profitability even after absorbing two major acquisitions, CyberArk and Chronosphere
GAAP results looked much worse, with Palo Alto reporting a $282 million net loss. However, much of that was driven by accounting items rather than the underlying business. The quarter included a $524 million mark to market loss tied to CyberArk convertible notes, $281 million in acquired intangible amortization, and $487 million in stock based compensation
For FY27, Palo Alto expects revenue of $14.1 billion to $14.2 billion, implying roughly 23% to 24% growth and coming in above consensus. Management expects NGS ARR to grow 22% to 23% to around $11.1 billion, while maintaining its 38% adjusted FCF margin target
Management also reaffirmed its goal of reaching a 40%+ adjusted free cash flow margin in FY28 and $20 billion in NGS ARR by FY30
For investors, the biggest question is whether Palo Alto's aggressive M&A strategy can create meaningful synergies rather than simply adding revenue. So far, the early cross-selling data is encouraging.
Platformization Is Accelerating
Next Gen Security ARR reached $9.1 billion, up 63% year over year, while remaining performance obligations climbed 34% to a record $21.2 billion
Those figures still benefit significantly from the CyberArk and Chronosphere acquisitions, so they shouldn't be treated as purely organic growth. But Palo Alto also provided a clearer look at how its individual platforms are performing:
Network & AI Security revenue: +17% Y/Y
Cortex revenue: +25%
Idira, the rebranded CyberArk business: +21% on a pro forma basis
Each major platform is therefore still growing at a healthy double digit rate
More importantly, customers are consolidating more of their security spending with Palo Alto. Net retention among platformized customers remained above 120%, and more than 65% of NGS ARR now comes from platformized customers
The company's largest customers are also spending more. Customers generating more than $5 million in NGS ARR increased 45% year over year to 223, while those spending more than $10 million rose 50% to 78
One Q4 telecom deal alone was worth $126 million and included firewalls, SASE, Idira, and Cortex XSIAM. That's exactly the type of multi-product adoption Palo Alto is trying to build its platform around.
The AI Security Stack Is Coming Together
AI agents are creating a completely new security challenge. They generate machine-to-machine traffic, use credentials, access internal data, and increasingly perform tasks without direct human involvement
Palo Alto says agentic traffic across SASE has increased more than 9x in just nine months. That makes AI a growing attack surface, but it also creates a strong reason for companies to upgrade older security infrastructure
Palo Alto is positioning its platform around three major layers
Prisma AIRS: Secure the AI. ARR reached roughly $120 million just one year after launch, making AIRS the company's fastest-scaling product. Customers increased from more than 300 in Q3 to over 800 in Q4. The platform now covers runtime security, agent identities, red teaming, observability, and agent gateways
Cortex: Detect and respond. XSIAM ARR passed $700 million, up roughly 70% year over year, with nearly 1,000 customers. Chronosphere's observability ARR also exceeded $500 million, more than 2.5x its level just two quarters earlier. Even more interesting, half of Chronosphere's Q4 new logos included an XSIAM cross-sell, suggesting Palo Alto is already integrating the acquisition into its wider platform
Idira: Control identity and access. The $25 billion CyberArk acquisition gives Palo Alto control over the credentials and permissions used by humans, machines, and AI agents. Early results are promising. CyberArk ACV grew 27% year over year, Palo Alto won more than 200 new CyberArk customers from its existing installed base, and shared leads between the two sales teams have increased roughly 50% since May.
Put together, the strategy is relatively straightforward: AIRS secures AI applications and agents, Cortex detects and responds to threats, and Idira controls what those users and agents are allowed to access
And there's another piece to the puzzle: autonomous action
Alongside its earnings report, Palo Alto announced the acquisition of Console, an AI-native platform that allows users to create agentic workflows using natural language. The broader goal is to push Cortex beyond simply identifying security problems and toward AI agents that can investigate and remediate those problems automatically.
CEO Nikesh Arora described this evolution as the move toward "software as an agent."
Palo Alto is beginning to show that its acquisition strategy could create something more valuable than the individual businesses it has bought
Platformization is accelerating, AIRS is scaling quickly, and both CyberArk and Chronosphere are already showing signs of cross-selling into Palo Alto's existing customer base. At the same time, AI isn't just creating a new security threat. It's becoming a meaningful source of demand and revenue.
