To The Moon

$Palo Alto Networks(PANW)$ The overall performance of the Q4 fiscal year 2025 earnings report was favorable: both revenue and non-GAAP EPS achieved double-digit growth, with EPS significantly exceeding expectations; subscription-based business momentum was strong, with NGS ARR and RPO showing high year-over-year growth and signs of acceleration, and improved operational efficiency drove non-GAAP operating margin to historically exceed 30%. The downside lies in the year-over-year decline in GAAP net profit and the still-moderate hardware market conditions; however, management's FY26 and Q1 guidance both exceed market consensus expectations, coupled with the "platformization + AI security" strategy and the proposed CyberArk acquisition to address identity security gaps, which elevate mid-term growth certainty.

We believe that PANW delivered a better-than-expected performance this quarter, balancing quality and certainty: platform-driven ARR/RPO and profit/cash flow both strengthened, and FY26 and Q1 guidance also leaned toward optimism. If platform-driven orders continue to accelerate, AI security products achieve visible commercialization, and mergers and acquisitions proceed smoothly, there remains upside potential for revaluation; conversely, if identity integration and hardware recovery fall short of expectations, volatility under high expectations must be guarded against.

Key information from the financial report

Revenue and EPS

• Data: Q4 revenue was approximately $2.5 billion, up 16% year-over-year; non-GAAP EPS was $0.95 (vs. $0.75 last year). EPS exceeded consensus estimates ($0.95 vs. $0.88), while revenue was largely in line with expectations.

• Drivers: Large-scale "platform-based" orders, SASE and software-based firewalls, and improved cost efficiency.

• Above/below expectations: EPS exceeded expectations, revenue was basically in line with expectations.

Subscription and Scalability Metrics (Quality)

• Data: NGS ARR was $5.6 billion, up 32% year-over-year; RPO at the end of FY25 was $15.8 billion, up 24% year-over-year, representing high growth rates over the past few quarters.

• Drivers: Increase in platform-based transaction volume/scale, renewal and additional purchases.

• Above/below expectations: The company's key indicators showed strong growth, reflecting improved operating quality and increased visibility.

Operating leverage and cash flow

• Data and statements: Management stated in a conference call that "operating margin exceeded 30% for the first time" and achieved a free cash flow margin of approximately 38%+ for the third consecutive year (the company's FY26 outlook continues to be 38–39%).

• Drivers: Economies of scale + cost efficiency, the "Rule of 50" continues.

• Over/Under: Profitability and cash flow performance are stronger than most of its peers in the security software industry.

Outlook and Pace

• Data: FY26 revenue guidance of $10.475–10.525 billion (approximately +14%), non-GAAP EPS of $3.75–3.85, NGS ARR of $7.0–7.1 billion (+26–27%), and RPO of $18.6–18.7 billion (+17–18%) ; Q1 revenue of $24.5–24.7 billion, non-GAAP EPS of $0.88–0.90. Both slightly above consensus estimates.

• Structure: Continue to focus on high-quality incremental growth (ARR/RPO) driven by platformization as the core KPI.

Organization and Strategic Events

• Event: Founder and CTO Nir Zuk retires; Senior Product Manager Lee Klarich takes over as CTO and joins the board of directors.

• Impact: Continuity and execution of product and platform roadmaps are key focus areas.

Performance guidance and management statements

• Guidance interpretation: The company has provided a range that is "slightly stronger than the market" for FY26 and Q1 revenue, EPS, ARR/RPO, with a style that is "realistically optimistic," emphasizing the demand upgrade and efficiency improvements brought about by platformization and AI. (Reuters)

• Management's original statement (earnings call):

  • CEO： “We are proud to be the first dedicated cybersecurity company to surpass a $10 billion revenue run rate.”

  • CFO: "Operating margins above 30% for the first time." (Conveying to investors that the profit margin curve is still rising and cash flow is resilient.)

• Rhetorical logic: The tone is optimistic but focuses on quantifiable indicators (ARR, RPO, profit margin, and FCF), and continues to constrain expectations in the outlook using ranges, which is considered "verifiable optimism."

Key Investment Points

From the perspective of the "structure-disagreement-strategy-variable" framework, this season's information adds another point to the mid-term logic:

1) Structural perspective: The long-term track of platform security continues to deliver results.

Platformization (Network + SASE + Cloud + SecOps) and AI-driven automation are the long-term main themes. The high growth and acceleration of NGS ARR and RPO reflect simultaneous improvements in large deals and renewal quality. Such revenue visibility and stickiness are significantly better than one-time hardware shipments. In contrast, while demand for traditional hardware firewalls has shown marginal improvement, management still expects FY26 to maintain mid-single-digit growth, aligning more closely with "short-cycle/cyclical" attributes, contributing limited growth to the overall rate.

2) Disagreement and valuation: Expectations shift from "growth rate" to "quality"

The market's core expectations for PANW have shifted from "purely high growth" to "high-quality growth + high cash flow" (Rule-of-50). FY26 guidance is significantly above consensus estimates, supporting a "high-quality premium." However, whether this premium can be sustained depends on whether NGS ARR can maintain annual growth of 25–30% and FCF rates remain stable at high levels (≈38–39%).

Comparable reference:

• $CrowdStrike Holdings, Inc. (CRWD)$ More like a deep cultivator of "endpoint + data platform";

• $Zscaler Inc. (ZS)$ Higher "cloud-native" purity on the SSE/SASE side;

• $Fortinet (FTNT)$ Strong hardware foundation, but transition to platform and subscription model is more gradual.

  In terms of platform breadth, cross-domain integration, and large order capabilities, PANW has a relative advantage, but the market also places a higher premium on its "platform realization speed." If the pace of platformization slows down or mergers and acquisitions fail to meet expectations, valuation flexibility will also be pressured.

3) Strategic judgment: Platform + identity security, a key leap in horizontal expansion

Plans to acquire $CyberArk(CYBR)$ (identity and privileged access) for approximately $25 billion — if successful, this will significantly address the "identity" shortfall, forming a closed loop of "network + cloud + security operations + identity," potentially amplifying the volume and duration of cross-selling and platform-based transactions. However, this is a "highly complex integration" that requires addressing product line coupling, channel overlap, and cultural integration.

AI Security Stack: The company has repeatedly mentioned AI-driven products (such as protection capabilities and automated SecOps for AI applications) in conference calls and media interviews. Together with SASE and software firewalls, these products form an incremental growth curve. In the medium to long term, this direction is expected to increase product penetration and monetizable data assets per customer.

4) Key variables and tracking points (potential catalysts/warnings)

• NGS ARR net increase and RPO growth rate: Will the 25%+ growth rate and "quarter-on-quarter acceleration" continue? This is the best indicator of the health of platform-based orders.

• Number/proportion of large orders on the platform: Management has repeatedly emphasized the "record level of platform-based transactions." Subsequent disclosures (in investment materials and post-meeting exchanges) are worth tracking.

• SASE and software firewall penetration: Win rate in projects with Zscaler and Fortinet in large enterprises and the public sector.

• Commercialization and customer numbers for AI security products (such as Prisma-related AI protection/AIRS): If the implementation path is clear, this could become a trigger for a second round of valuation increases.

• CyberArk merger and acquisition progress and integration milestones: regulatory approvals, product roadmap alignment, cross-selling KPIs. Any delays or lack of expected synergy may trigger a periodic reassessment.

• Cash Flow and Operating Profit Margin: FY26 targets a non-GAAP OPM of 29.2–29.7% and an FCF margin of 38–39%. If these targets are consistently met, the "high-quality premium" will become sticky.

• Product rhythm after management changes: Nir Zuk retires, Lee Klarich takes over as CTO, focusing on whether the product rhythm and platform roadmap will continue seamlessly.