Platform growth beats expectations but gross margins tighten
- Q4 FY26 revenue grew 24% year over year for the full year, driven by strong platformization momentum.
- Next-Generation Security ARR surged to $9.1 billion, adding nearly $1 billion in the fourth quarter alone.
- CyberArk and Chronosphere integration efforts are running three to six months ahead of schedule.
- Gross margin faces pressure from a shift toward SaaS products and rising hardware commodity costs.
- New consumption-based pricing models introduce potential revenue volatility if customers optimize usage.
Massive platform growth meets a margin squeeze
Palo Alto Networks is successfully becoming the single security platform for large enterprises. The company groups its offerings into four pillars: Network Security, Security Operations, Observability, and Identity Security. This structure gives customers a clear path to consolidate their security spending with one vendor.
The growth case accelerated dramatically in Q4 FY26. Next-Generation Security ARR, the yearly recurring run-rate from newer security products, reached $9.1 billion. The company achieved roughly 22 net new platformizations in the quarter, more than double its historical rate. Furthermore, management confirmed that the integrations of massive acquisitions like CyberArk and Chronosphere are three to six months ahead of plan.
However, the cost of this growth is showing up in margins. Gross margins fell 100 basis points year over year to 74.8% in Q4 FY26. The company attributes this to a structural mix shift toward faster-growing SaaS offerings that have not yet reached maturity, compounded by rising hardware costs for memory and storage.
The open question is whether the company can offset gross margin compression with operating leverage. The FY26 10-K also introduced new risks around revenue volatility from consumption-based offerings. The market will want proof that new SaaS cohorts can achieve higher margins as they mature.
Selling more tools to the same buyers
Palo Alto Networks operates on a platformization strategy. The goal is to land a customer with one product and expand the relationship over time to cover the entire platform. As customers add more products, they share data across tools and use AI to spot threats faster. This creates a unified security fabric that is incredibly sticky.
The company formally tracks its revenue across three primary platform buckets: Network and AI Security, Cortex, and Idira. In FY26, Network and AI Security generated $8.35 billion, Cortex brought in $1.92 billion, and Idira contributed $1.26 billion on a pro forma basis. This structure highlights a transition from traditional firewall sales to a modern software subscriptions model.
A significant new driver for the business is securing machine identities and autonomous workflows. With the rise of agentic AI traffic, products like Prisma AIRS have rapidly scaled past $100 million in ARR.
The model faces challenges if buyers refuse to consolidate. If large enterprises prefer to assemble specialized tools from Microsoft, Cisco, Datadog, or Zscaler, Palo Alto will struggle to maintain its 120% net revenue retention for platform customers.
The four security pillars
Network Security
The traditional core of the business includes next-generation firewalls, Prisma Access, and Prisma SD-WAN. It also houses the fast-growing Prisma AIRS for AI security.
Security Operations
The Cortex platform uses AI to detect and respond to threats. It includes XSIAM, which replaces older SIEM tools, and was recently expanded by the Console acquisition.
Observability
Driven by the Chronosphere acquisition, this platform provides real-time visibility for cloud infrastructure. The recent Embrace deal adds real user monitoring.
Identity Security
The Idira platform is built around the CyberArk acquisition. It secures human and machine identities, and features a new Modern PAM offering.
Unit 42
Unit 42 offers threat research, incident response, and security consulting. It helps clients during active attacks and improves the core product intelligence.
Revenue mix by platform
Palo Alto Networks reports as one segment but discloses revenue across three platform buckets. This mix uses FY26 platform revenue totals.
What could break the story
Gross margin compression
High impact · High oddsGross margins declined 100 basis points year over year in Q4 FY26 to 74.8%. A shift toward SaaS offerings and higher memory and storage costs are pressuring profitability. If SaaS margins do not mature, cash flow targets will be at risk.
Consumption-based revenue volatility
Medium impact · Medium oddsA growing portion of revenue is generated from offerings priced on a consumption basis, particularly in observability and AI. This exposes the company to near-term revenue drops if customers actively optimize their usage to cut costs.
Acquisition indigestion
High impact · Medium oddsWhile early integration of CyberArk and Chronosphere is ahead of schedule, the company continues to acquire businesses like Console and Embrace. Pushing too many new products into the sales channel at once could confuse customers and slow deal cycles.
Fierce market competition
Medium impact · High oddsPalo Alto competes with Microsoft, Cisco, Fortinet, and Zscaler in network security, and with Datadog and Dynatrace in observability. Public cloud hyperscalers and frontier AI providers are also increasingly offering native security tools.
Observability adoption delays
Medium impact · Medium oddsThe thesis relies on customers agreeing that security and observability should live in the same platform. Buyers might prefer keeping their development tools separate from their security tools, which would slow the return on the Chronosphere investment.
In one breath
What does Palo Alto Networks do?
Palo Alto Networks sells cybersecurity products and services. Its tools help protect networks, cloud apps, endpoints, security teams, and identities from attacks.
Why does NGS ARR matter for PANW?
Next-Generation Security ARR tracks annual recurring revenue from newer software products. It shows whether customers are buying into the broader platform strategy beyond traditional firewalls.
What is the biggest risk for Palo Alto Networks stock?
The biggest risk is that gross margins continue to shrink as the company sells more SaaS products and faces higher hardware costs. Investors need the new software products to become highly profitable as they mature.
How is the CyberArk integration going?
Management reported in Q4 FY26 that integration synergies for CyberArk are running three to six months ahead of schedule, which is a very positive sign.
Sources and research notes
This page combines Finn's company research with public filings and other cited materials. The thesis is reviewed when material company information changes; Finn Scores use the latest available scoring data.
- Thesis reviewed
- September 20, 2026
- Score data
- September 27, 2026
- Reviewed by
- Shivam Bharuka
Comparable Software - Infrastructure companies
Companies near Palo Alto Networks, Inc. in Finn's Software - Infrastructure industry ranking.
