Palo Alto Networks

Palo Alto reported fourth-quarter earnings, with sales up 34% to $3.41 billion and adjusted operating margins flat at 30%. The firm's next-generation security annual recurring revenue grew 63% to $9.10 billion, with artificial intelligence being an incremental driver.

Why it matters: Palo Alto's business is well-positioned to benefit from multiple secular tailwinds. First, we are seeing robust demand for cyber solutions as companies invest in cyber defense to stave off AI model cyberattacks. Two, this robust demand is driving further vendor consolidation, which benefits larger vendors like Palo Alto. Multiproduct customers represent more than 65% of the firm's NGS ARR, with a net retention rate above 120%, signaling that customers are buying more security from fewer vendors. Three, emerging product segments such as agentic identity and agentic security operations are doing well, as is Palo Alto's core firewall business, which is benefiting from increased data center demand for firewalls. 2026 firewall bookings grew 17%, up from 13% in fiscal 2025.

The bottom line: We raise our fair value estimate for wide-moat Palo Alto to $300 from $285 primarily due to an increase in our near-to-medium term top-line forecast. We believe that AI-induced cyber spending will continue to increase cybersecurity's share of enterprise wallets. A clear beneficiary of this AI-induced cyber spending is the firm's automated security operations offering, XSIAM, which doubled its customer count to 1,000 and increased ARR by 70% to above $700 million in the fiscal year.

Big picture: Cyber stocks have performed exceedingly well in 2026, with a 50% median return on our cyber coverage this year. We see the market's newfound optimism as mostly in line with our view that cyber is a clear AI beneficiary, with these tailwinds set to persist as AI adoption continues to grow.

Palo Alto's top-line guidance for fiscal 2027 was ahead of our prior estimates, with the firm projecting sales for the upcoming year of $14.15 billion at the midpoint of the guidance range. This outlook implies 23% sales growth.

Along with quarterly results, we also got a first look at GAAP revenue for various Palo Alto platforms. We were encouraged to see strong growth across all platforms, with the core network platform also growing in the high-teens, driven by strength in areas such as software firewalls that are seeing strong AI datacenter demand.

Our fair value estimate is $300 per share, implying a 2027 enterprise value/sales multiple of 17 times.

We forecast Palo Alto’s revenue growing at a 18% compound annual growth rate over the next five years. We believe that Palo Alto has strong secular tailwinds. We see massive greenfield opportunities for the firm to capitalize on and expand its business. Additionally, we think Palo Alto’s land-and-expand model will continue to bear fruit. The firm has shown great success in upselling its existing customers by either offering additional modules within a platform or additional platforms. We project continued upselling and cross-selling activity.

Palo Alto’s gross margins have hovered in the low 70s since its IPO. However, as the company grows and software becomes a larger part of its top line, we expect gross margin expansion. We see this phenomenon across our coverage, as software firms can spread their costs over an increasing revenue base, reducing the cost of sales as a fraction of sales. As a result, we model GAAP gross margins to expand to the high 70s over our 10-year explicit forecast.

Palo Alto has spent heavily on research and sales in the past. However, as the company scales, we expect these line items to decrease as a percentage of sales. With 2023 marking the return to GAAP profitability, we model Palo Alto to materially expand GAAP operating margins over our 10-year explicit forecast as it seeks to balance profitability with growth.

We also model a bull-case scenario in which firewall demand and growth in identity and agentic security operations are materially stronger than in our base case.

The better-than-expected firewall demand in our bull case is driven by robust software and hardware firewall penetration in AI data centers, with product growth over the next five years being 18%, much higher than our existing 11% forecast.

Similarly, the strong identity and security operations platforms demand in the bull case is driven by strong agentic deployments across organizations, leading to more security dollars flowing to Palo Alto than our base case estimates. Subscriptions and support sales' five-year growth rate in our bull case is 20%, much higher than our existing 13% estimate.

In this bull case, which investors can conceptualize as one that relies on rapid adoption and operationalization of AI, we see Palo Alto's fair value estimate at $370.

We assign Palo Alto Networks a Wide Morningstar Economic Moat Rating owing primarily to strong customer switching costs, and second to a network effect associated with its offerings. We view Palo Alto as a leader in multiple categories spanning network security, cloud security, and security operations. Its three platforms spanning these verticals have resonated exceptionally well in the enterprise market, with the firm selling into all the Fortune 100 and more than three-fourths of the Global 2000 firms. The firm’s platform approach to cybersecurity has also enabled it to increase its wallet share among existing clients while adding new ones at a fast clip. We expect this dominance to persist, and we expect Palo Alto’s land-and-expand model to allow the firm to gain operating leverage and produce excess returns for the foreseeable future.

Palo Alto offers its clients three platforms: Strata, Prisma, and Cortex. Strata is the firm’s network security offering that helps secure a client’s network via next-generation firewalls. Prisma is Palo Alto’s cloud security platform that focuses on securing processes running on the cloud. Cortex, the latest of Palo Alto’s platforms, is geared toward security operations and includes endpoint security and automated security responses, among other modules. Put together, Palo Alto’s platforms enable it to cover multiple attack vectors spanning critical areas of a modern enterprise. From a client’s perspective, having one vendor managing key parts of its cybersecurity helps to alleviate challenges associated with having disparate security solutions for various parts of the overall IT stack.

When examining the competitive dynamics of the three verticals Palo Alto operates in, we view all three as conducive to the presence of economic moats, as enterprise spending in these spaces is sticky, with significant risks and upheaval required to switch away from existing vendors.

As we look at the broader cybersecurity space, we believe the complexity and intensity of threats are ever-increasing. As enterprises continue to adopt software-as-a-service solutions, undergo digital transformations, and migrate to the cloud, we see the number of attack vectors (or entry points for nefarious players) growing rapidly. A modern enterprise has to maintain robust security while maintaining resources on the cloud and on-premises. To further magnify the complexity, we suspect that most enterprises will adopt a hybrid model with employees working remotely for at least a couple of days a week—thereby strengthening the need for securing workforces beyond the office. The intensity of digital threats is also on the rise, with higher costs of a data breach, including punitive fines for any customer data theft.

As a result of this dramatic shift in how enterprises run, a trend exacerbated by the pandemic, there has been a similarly dramatic increase in the number of software tools enterprises deploy to secure their infrastructures. However, such a sprawling toolkit comes at a cost—primarily the creation of silos in which individual portions of an enterprise’s IT stack are secured by disparate solutions that do not work together effectively. We see this approach as untenable for the future, as rising IT threat complexity and intensity will force enterprises to opt for platforms that offer to secure key cybersecurity areas.

Based on various industry reports, we estimate that enterprises currently use 60-80 different security solutions but wish to narrow that number to 15-20 key solutions. In this changing landscape, we see an opportunity for platform-based cybersecurity vendors, such as Palo Alto, to help enterprises consolidate their digital footprints while maintaining a secure ecosystem. Additionally, while we do not see cybersecurity as a winner-take-all market, we believe that platform vendors stand to become dominant players as the cybersecurity vendor list shrinks for enterprises. Due to the sheer expanse of the market, estimated to be north of $130 billion, we think multiple platform vendors can carve out wide economic moats while facing competition between each other.

Across our coverage, we see high switching costs for enterprise-focused cybersecurity vendors, such as Palo Alto. We believe security-related IT decisions are driven by security analysts and engineers, not accountants. Put another way, we do not think that a company will nickel-and-dime its way to picking security vendors, especially in the network security segment. Customers who adopt security solutions do so to take uncertainty off the table—switching vendors often brings uncertainty back into play. Additionally, entrenched platform vendors, such as Palo Alto, also have an expansive footprint across an enterprise. To uproot such a vendor requires not only a competitive offering from another vendor, but often retraining staff to use the new platform, a period of increased vulnerability.

As we think of Strata, Palo Alto’s network security platform, we see evidence of strong customer switching costs. Network security spending, of which firewalls are a significant portion, is sticky. Palo Alto has firewalls that can be deployed via hardware and software form factors. Additionally, the firm has been a pioneer in the secure access service edge segment—a novel concept regarding the convergence between networking and security. By remaining agnostic to form factor and deployment, Palo Alto is able to land customers with varying network security needs. Following initially getting customers, Palo Alto has shown excellence in upselling customers by adopting additional modules within the network security platform. This upselling not only contributes to Palo Alto’s top-line growth but also expands its presence in a client’s enterprise, which in turn entrenches Palo Alto further into a client’s security apparatus and makes churn less likely.

A similar argument for high customer switching costs can be constructed for Prisma and Cortex, Palo Alto’s cloud security and security operations platforms. Across both platforms, we have seen strong upselling and cross-selling activity by Palo Alto, with more than half of the Global 2000 firms adopting all three platforms. With increased adoption of the more nascent Prisma and Cortex platforms, we expect Palo Alto to continually expand its footprint in its clients’ security systems.

Along with high switching costs, we believe a network effect reinforces Palo Alto’s wide moat. Cybersecurity, in its essence, is a data problem, as nefarious activity is data streaming into an enterprise’s ecosystem and latching onto, and exploiting, valuable resources. With the exponential increase in data, we are past the point of manual intervention in cybersecurity to detect, prevent, or mitigate a cyberattack. As a result, cybersecurity vendors have invested a great deal of capital and talent into developing AI solutions to automate processes and pick up threats (especially never-seen-before, zero-day attacks). However, artificial intelligence and ML solutions are only as good as the data that is fed to them. This need for good-quality data is where we see entrenched platform vendors, such as Palo Alto, having an edge, as they have data streaming into their security solutions from across the enterprise.

By collecting and analyzing this rich data coming into its platforms, a platform vendor such as Palo Alto can uncover threats and new threat signatures that can then be used to update its entire client base’s security posture. As more data comes in, Palo Alto’s platforms become better at detecting and mitigating cyber threats. As a result, more customers join Palo Alto’s platforms due to superior products, which leads to more data, and the flywheel spins faster. We see this network effect as reinforcing switching costs as well; customers are hesitant to leave Palo Alto, as it’d entail losing the latest threat updates essential to maintaining a secure IT infrastructure.

When we look at Palo Alto’s business as a whole, we see an entrenched platform vendor with sticky products, impressive enterprise penetration, and a long runway for growth. We believe that Palo Alto has built a powerful economic moat around its business, consisting of high customer switching costs bolstered by a powerful network effect. With that in mind, we believe that Palo Alto will continue to generate excess returns over the long term.

Palo Alto has strong secular tailwinds as security operations, cloud security, and the convergence of networking and security are projected to grow rapidly.

Palo Alto’s strength in the high-margin firewall space should allow the firm to generate substantial free cash flow.

The company stands to benefit as clients consolidate vendors and opt for a platform-based cybersecurity approach.

Large public cloud vendors often offer their own cybersecurity solutions, which could hamper Palo Alto’s growth opportunities.

Palo Alto’s competitors also utilize a platform approach, thereby entrenching them in their clients’ ecosystems and making them harder to displace.

Integrating the CyberArk acquisition introduces execution risk, potentially disturbing the solid growth the firm has seen in other verticals.