Palo Alto Networks Q4 FY26 Earnings: Platform Growth Accelerates, but Margin Mix Shifts Toward SaaS

Palo Alto Networks closed fiscal 2026 with revenue growth of 34%, record remaining performance obligations, and nearly $1B of net new next-generation security ARR in the fourth quarter. The quarter reinforced the company’s platformization strategy, with strength in network security, SASE, XSIAM, identity security and observability following the CyberArk and Chronosphere acquisitions.

The central investment question is increasingly less about whether Palo Alto can expand into adjacent security markets and more about whether it can sustain elevated growth while managing the margin effects of a larger cloud and SaaS mix. Management’s FY27 outlook calls for 23% to 24% revenue growth and continued operating-margin expansion, despite higher cloud-hosting and hardware-component costs.

As Reported on the Call

The Bigger Story

Palo Alto’s fourth quarter showed how much its business model has changed from its firewall-centric origins. Network security remains the largest platform, but the company is now pairing it with security operations, observability and identity security products that increase its potential share of customer spending.

The acquisitions of CyberArk, now referred to as Idira, and Chronosphere were central to that shift. Management said both businesses are scaling faster inside Palo Alto than they had as standalone companies, with CyberArk-related cost synergies running three to six months ahead of plan and Chronosphere ARR more than doubling since its acquisition closed in fiscal Q2.

Still, the reported growth figures should be viewed in the context of those acquisitions. Palo Alto’s FY26 revenue rose 24%, while its new platform disclosures show 17% growth in Network and AI Security, 25% growth in Cortex, and 21% pro forma growth in Idira. The company is demonstrating that acquired businesses are contributing to growth, but sustained organic execution and cross-selling will determine whether the broader platform strategy creates durable operating leverage.

Management also sees AI as a major demand driver, arguing that autonomous AI agents, AI infrastructure and faster cyberattacks require more unified security architectures. That thesis is strategically plausible, but most of the AI-related opportunity remains forward-looking. Investors should distinguish the company’s early product momentum from management’s longer-term projections about AI-driven cybersecurity spending.

Revenue and Operating Performance

Fourth-quarter revenue increased 34% to $3.41B, while RPO reached $21.2B, up 34%. Current RPO, which represents the portion expected to be recognized over the next 12 months, rose at the same rate to $9.3B. Management said contract durations remained steady, suggesting the RPO increase was driven by booking volume rather than longer contract terms.

NGS ARR reached $9.1B, up 63%, supported by nearly $1B of net new ARR in the quarter. The scale of the ARR addition was notable, although it included a significant contribution from a large language model customer migrating its observability workload to Chronosphere from an incumbent provider. Management described that contribution as a nine-figure benefit to net new ARR in Q4.

Network and AI Security generated $8.35B of FY26 revenue, up 17%. The company cited demand across hardware firewalls, software firewalls and SASE. Software firewall ARR grew 29% in Q4, while SASE bookings increased 40% for the full year.

Palo Alto also said it displaced legacy SASE providers in nearly 100 accounts, representing more than $400M in total contract value. Management attributed the gains to its ability to combine SASE, SD-WAN, hardware firewalls and software firewalls into a common platform. The company’s argument is that customers using its firewall products face less deployment friction when adopting its SASE offering.

Cortex revenue rose 25% to $1.92B in FY26. XSIAM, the company’s security operations platform, finished the year with more than $700M in ARR, up 70%, and exceeded 1,000 customers. The company said the majority of XSIAM customers are using multiple modules, including exposure management and cloud security, which supports the cross-sell rationale behind the broader platform strategy.

Chronosphere added another growth vector. Observability ARR surpassed $500M and more than doubled since Palo Alto acquired the company in fiscal Q2. Management said the business is currently strongest among AI-native and cloud-first customers, but expects additions such as real-user monitoring from the Embrace acquisition and internally developed synthetic monitoring to broaden its enterprise appeal.

Profitability and Margins

Palo Alto delivered a Q4 non-GAAP operating margin of 29.6% and FY26 non-GAAP operating margin of 29.2%, up 40 basis points from the prior year. The annual expansion is notable given that CyberArk and Chronosphere entered the company with lower standalone margins, according to management.

Non-GAAP EPS was $1.02, exceeding the high end of management’s guided range by $0.04. That outperformance is measured on a non-GAAP basis.

Gross margin moved in the other direction. Q4 gross margin declined 100 basis points to 74.8%, while FY26 gross margin declined 60 basis points to 75.8%. Management attributed the pressure primarily to a higher mix of cloud and SaaS products, which are growing faster but have not yet reached mature gross-margin levels.

The company expects cloud-hosting costs to grow faster than total revenue in FY27 as SaaS becomes a larger share of the business. Hardware is a smaller issue, representing about 10% of total revenue, but management also expects higher memory and storage costs. Palo Alto said it plans to mitigate those costs through supplier relationships and selective hardware pricing actions.

This creates an important financial-model tension: operating expenses and acquisition synergies are supporting operating-margin expansion, while product mix is creating a continuing gross-margin headwind.

Demand, Customers and Pricing

Management highlighted 22 net new platformizations in Q4, a quarterly record and more than twice the level when the company began tracking the metric two years ago. The platformized customer cohort had net revenue retention above 120% in the quarter, according to management, suggesting that customers adopting multiple products are expanding their spend over time.

Large deal activity was also strong. Palo Alto cited a $126M agreement with a global telecom company, a $72M transaction with an IT service provider, and a $53M platformization deal with a global payments company. The payments-platform deal included a high-seven-figure commitment to Prisma AIRS, Palo Alto’s AI security product.

Prisma AIRS surpassed $100M in ARR in its first four quarters of general availability and had more than 800 customers. Management called it the fastest-scaling product in company history. The product’s adoption is an early indicator that enterprises are spending on AI security controls, though its ARR remains small relative to Palo Alto’s $11.5B revenue base.

CyberArk integration is also beginning to show commercial benefits. Palo Alto said joint go-to-market efforts generated more than 400 shared leads and more than 200 net new logos from its installed base. Transactions with total contract value above $5M increased 50% year over year in Q4. Management also introduced a “Modern PAM” product intended to expand beyond traditional privileged-access management.

What is Palo Alto Networks’ guidance and outlook?

For Q1 FY27, Palo Alto guided for:

• ·NGS ARR of $9.54B to $9.56B, up 63%
• ·RPO of $20.8B to $20.9B, up 34% to 35%
• ·Revenue of $3.30B to $3.31B, up 33% to 34%
• ·Non-GAAP EPS of $0.96 to $0.98

For FY27, management expects:

• ·NGS ARR of $11.075B to $11.175B, up 22% to 23%
• ·RPO of $25.2B to $25.4B, up 19% to 20%
• ·Revenue of $14.1B to $14.2B, up 23% to 24%
• ·Non-GAAP operating margin of 29.5%
• ·Non-GAAP EPS of $4.16 to $4.19
• ·Adjusted free-cash-flow margin of 38%

The FY27 outlook implies slower growth than the reported Q4 result, particularly for NGS ARR. Part of that moderation reflects a difficult comparison following the large Chronosphere migration in Q4. Management expects the tail end of that migration to continue through Q1, but to contribute less net new ARR than it did in Q4.

Management expects 60% to 61% of FY27 net new NGS ARR to be generated in the second half of the fiscal year. That back-half weighting raises the importance of booking conversion, sales execution and the pace at which customers complete broader platform deployments.

By platform, Palo Alto expects low-double-digit revenue growth in Network and AI Security, approximately 30% growth in Cortex, and Idira revenue of about $1.5B, representing pro forma growth in the high teens to 20% range.

Balance Sheet, Cash Flow and Capital

Palo Alto ended FY26 with $7.9B in cash, cash equivalents and short-term investments. The company generated $1.29B in adjusted free cash flow in Q4 and $4.41B for the full year, equal to a 38.4% free-cash-flow margin.

Management said annual billing represented about 30% of bookings in FY26, up from 27% in FY25. It characterized the shift toward annual billing as largely stabilized and said this should improve free-cash-flow visibility. Palo Alto continues to target a 40% adjusted free-cash-flow margin in fiscal 2028.

The company closed its acquisition of Console after the quarter, while Embrace was also acquired around quarter-end. Management said both acquisitions are immaterial to FY27 guidance. The continued use of acquisitions remains a strategic consideration, however, as management views M&A as a way to fill product gaps created by fast-moving AI and cybersecurity trends.

What Investors Should Watch

1. Cortex and Observability Growth

Cortex is expected to grow about 30% in FY27, making it one of the company’s most important growth engines. Investors should monitor whether XSIAM expansion, Chronosphere cross-selling and enterprise observability adoption can sustain that trajectory after the large LLM migration benefit rolls off.

2. Gross Margin Versus Operating Leverage

Gross margin declined in FY26 because cloud and SaaS products are becoming a larger part of the mix. Continued operating-margin expansion would show that sales productivity, scale and acquisition synergies are more than offsetting higher hosting and component costs.

3. CyberArk Integration and Idira Cross-Sell

Idira is expected to produce approximately $1.5B of FY27 revenue. Progress in converting Palo Alto’s installed base into identity-security customers, especially through larger platform deals, will be a direct test of the CyberArk acquisition’s revenue-synergy case.

4. Platformization and SASE Displacements

The company’s platformization count and SASE displacement activity are useful indicators of consolidation demand. Continued growth in multi-product adoption would support management’s claim that customers are standardizing on fewer security vendors rather than purchasing isolated AI-security tools.

5. AI Security Monetization

Prisma AIRS has reached $100M in ARR quickly, but it remains early in its development. Investors should watch customer expansion, multi-module adoption and the extent to which AI security becomes a meaningful contributor to overall ARR growth rather than a promising but relatively small product category.

AlgovestIQ Takeaway

Palo Alto Networks delivered a strong close to FY26. Revenue, RPO, NGS ARR and free cash flow all expanded at substantial rates, while non-GAAP operating margin improved despite the addition of lower-margin acquired businesses. The company also appears to be executing effectively on its early CyberArk and Chronosphere integrations.

The quality of growth is mixed in the constructive sense. Palo Alto is showing broad demand across firewalls, SASE, XSIAM, observability and identity security, rather than relying on a single product category. However, the exceptionally large Q4 net new ARR result also benefited from a major Chronosphere customer migration, which management expects to continue at a lower level into Q1 FY27.

Margins are the main financial issue to monitor. The company’s cloud and SaaS transition is helping it address larger markets and recurring revenue opportunities, but it is also reducing gross margin and increasing hosting costs. Palo Alto expects operating leverage and acquisition synergies to offset that pressure, an assumption that will need to be validated through FY27 results.

The investment case now rests on whether Palo Alto can convert its expanded platform into sustained cross-selling, larger customer commitments and durable mid-20% growth without sacrificing profitability. Evidence of continued XSIAM and observability expansion, successful Idira cross-selling, and stable operating margins would strengthen that case. A sharper-than-expected slowdown after the large Chronosphere migration, or persistent gross-margin pressure that exceeds operating leverage, would weaken it.