Palo Alto Networks (PANW)

Executive Summary & Action Plan

Verdict

SELL (Reduce) — The platformization machine works: organic bookings genuinely re-accelerated and the $25B CyberArk deal bought the one control point rivals don't own. But the headline +31% is half acquisition accounting over ~14% organic growth, and at 74x free cash flow — with the Street's mean target sitting AT the price — the equity capitalizes the 40% FY28 cash-margin target as if stock comp were free and integration were riskless.

Price $325.91 | Market cap $265.6B | Target $189 | Upside -42.0% IWANNAVY Fair Value · price as of 2026-07-11 close · Street consensus $324.14 (reference; n=49, AT spot, 83.5% dispersion) — third security name priced past its own consensus; the reverse-DCF needs ~19–20% revenue CAGR for a decade against Gartner's $244B total market

Abstract

The first full CyberArk quarter shows both truths at once. Operationally, the flywheel turns: organic NGS ARR grew 28%, organic current-RPO accelerated to +17%, NGFW bookings rose ~40% on AI-datacenter demand (best hardware quarter in a decade), XSIAM doubled to >$600M ARR, and Prisma AIRS went 100→300+ customers in one quarter. Optically, the P&L is acquisition accounting: $388M of acquired revenue turned +14% organic into +31% headline, while $280M of intangible amortization plus $198M of deal costs flipped GAAP operating margin to −6.1% (non-GAAP held 27.1%). The bet underneath is Idira — privileged access for AI agents that already outnumber humans 109:1 — bought at ~19x ARR, with FY27's new three-segment disclosure about to make CyberArk's organic growth publicly visible every quarter. Our $189 fair value is the log-median of an SBC-expensed DCF ($124), 30x forward plain FCF ($189), and forward growth-adjusted sales ($201); spot trades 51.5x FY27E FCF, ~70% above the warranted multiple. Rating: SELL/reduce into the 8/24 print; re-enter $201/$150.

Action Plan

PANW reports first of the security trio (8/24E → CRWD ~9/2 → ZS 9/8) — its FY27 guide sets the group tone. Reduce now and into Black Hat strength; re-enter $201 (bull FV) and $150.

• New-money R/R: negative — spot exceeds bull FV ($201) by 62% | Prob-weighted 12M return −47.1% (Bull 25% × −38.3% + Base 45% × −42.0% + Bear 30% × −62.0%) | Confidence: Medium

---

Last Four Quarters

Fiscal quarters (FYE July). Through FY26 Q2 the model was steady: ~73–74% gross margin, mid-teens GAAP operating margin, FCF lumpy on the October-quarter collections cycle (68% fiscal-Q1 margin). FY26 Q3 — the first full CyberArk quarter — breaks every GAAP line on purpose: GM −600bp (amortization in COGS), OM to −6.1% ($478M of deal amortization + costs, 2.6x the operating loss itself). Judge the business on organic ARR and adjusted FCF (37.5% FY26 guide, 40% FY28 target); judge the price on what that costs.

Session note (−3.67% on 7/10): sector-wide de-rate (CRWD −5.7%, ZS −5.3%) with no company news; the week's trigger was Evercore's 7/8 target cut to $320 (kept Outperform) after the ~120% run since April.

---

Revenue & Profit Mix

80% subscription/support; hardware ~10% but in its best quarter in a decade with record backlog. Acquired revenue ($388M: CyberArk ~$300M+ (E), Chronosphere >$300M ARR) is ~13% of the quarter. FY26 Q3 per the 6/2 release.

---

Business Lines

• Network security (~65–70% of revenue (E)): Firewall base with 4+ attached subs, SASE $1.6B ARR +40%. Must know — the "mature" core re-accelerated on AI-datacenter buildout; record hardware backlog is also tomorrow's tough comp, and SASE is a four-way price war.
• Cortex (XSIAM >$600M +100% · Chronosphere >$300M): The SIEM-displacement engine. Must know — Chronosphere's +50% QoQ jump leaned on one LLM customer's consumption — real AI demand, but concentrated and re-negotiable.
• Cloud & AI security (Prisma AIRS ~$100M path): Must know — AIRS (100→300+ customers in a quarter, "fastest-growing product in company history") is PANW's answer to Google-owned Wiz; its trajectory is the best read on whether PANW wins AI-era workloads or just consolidates legacy budgets.
• Identity (CyberArk → Idira, ~$1.3B ARR (E)): Must know — the whole thesis leans here: agent identities outnumber humans 109:1, PANW paid ~19x ARR for the tollbooth, and from FY27 a new three-segment disclosure makes its organic growth visible quarterly — the scorecard vs CRWD's $740M SGNL.

---

IWANNAVY Fair Value

Log-median lands at $189. The EV/FCF leg (30x plain ≈ 50x SBC-adjusted) already grants best-in-security cash margins; the DCF ($124) charges 15.7%-of-revenue SBC (CyberArk replacement awards inflate it near-term) at a 9.3% WACC. Spot at 51.5x FY27E plain FCF prices perpetual platform-winner status — the same discipline that cut CRWD to SELL at 45x applies here at 30x because organic growth is half CRWD's.

• Thesis breaker (for the SELL): an 8/24 print with FY27 guided at organic NGS ARR ≥ mid-20s%, CyberArk ARR compounding near its standalone ~30% through the transition, and adjusted-FCF margin stepping toward 40% early — platform-winner proof at the identity control point would push our multiple legs above $201 (bull DCF $180 corroborates).

---

Catalysts & Risks

---

References

• PANW FQ3'26 results — NGS ARR $8.13B +60%, FY26 guide raised (IR, 2026-06-02) · FQ3'26 10-Q (SEC) — $280M acquired-intangible amortization, $198M deal costs · Idira launch (2026-05-12)
• TipRanks — Evercore cuts PT to $320, sector drop trigger (2026-07-08) · Seeking Alpha — downgrade to Hold, "extreme exuberance" (2026-07-07) · TradingKey — 7/10 sector session (2026-07-10)