Platform growth meets an acquisition bill
- Q3 FY26 revenue grew 31% year over year to $3.0 billion, helped by recent CyberArk and Chronosphere deals.
- Subscription and support made up 80.2% of Q3 FY26 revenue, keeping the model mostly recurring.
- Next-Generation Security ARR reached $8.1 billion as of April 30, 2026, but investors need to know how much is organic.
- The main bear case is now margin pressure, with Q3 FY26 GAAP operating margin at negative 6.1%.
- Finn's low valuation score means the stock needs strong execution to justify the price.
A bigger platform, a thinner margin
Palo Alto Networks is trying to become the one security platform a large company can use instead of many smaller tools. Its story is now built around four pillars: Network Security, Security Operations, Observability, and Identity Security. That gives customers a clear reason to buy more from one vendor.
The growth case improved in Q3 FY26. Revenue rose 31% year over year to $3.0 billion. Next-Generation Security ARR, or yearly recurring run-rate from newer security products, reached $8.1 billion as of April 30, 2026. Remaining performance obligation, which is contracted revenue not yet recognized, reached $18.4 billion.
The hard part is profit. Q3 FY26 GAAP operating margin was negative 6.1%, and gross margin fell from 72.9% to 67.6% year over year. The company also posted a GAAP operating loss of $183 million. Acquisition costs, including amortization of purchased intangible assets, explain much of the hit, but the market will still want proof that margins can recover.
The open question is quality of growth. CyberArk and Chronosphere added scale fast, and management said integration is ahead of plan. Still, investors need to see organic NGS ARR growth, early cross-selling of Idira and Chronosphere, and a path back to positive GAAP operating margins.
Selling fewer tools to bigger customers
Palo Alto Networks makes money from products, subscriptions, and support. Product revenue includes firewalls and, after the CyberArk deal, some on-premise identity software licenses. Subscription and support revenue includes security services, software updates, threat intelligence, and customer support.
The company reports one operating segment, but the business is best watched through revenue mix and NGS ARR. In Q3 FY26, subscription and support was 80.2% of revenue, while product was 19.8%. That mix matters because recurring revenue can make the business more predictable.
The strategy is called platformization. In plain English, Palo Alto wants a customer to start with one product, then add more security tools from the same company. If the products share data and use AI to find threats faster, the platform becomes harder to replace.
Where it can break is also clear. If buyers keep using many best-of-breed tools, or if Microsoft, Cisco, Fortinet, Zscaler, Datadog, and Dynatrace slow Palo Alto's push into new markets, the platform pitch may not turn into enough profitable growth.
The four-pillar security stack
Network Security
This is the older core of the company. It includes next-generation firewalls, SASE products like Prisma Access and Prisma SD-WAN, cloud-delivered security services, Prisma AIRS for AI security, and Strata Cloud Manager.
Security Operations
Cortex is the AI-led security operations platform. XSIAM aims to replace older SIEM tools, while XDR, XSOAR, and Cortex Cloud help customers detect attacks, automate responses, and secure cloud workloads.
Observability
Chronosphere gives customers real-time visibility into cloud-native apps and infrastructure. The bet is that security and observability data can work together to find and fix problems faster.
Identity Security
Idira is built on the CyberArk acquisition. It protects human, machine, and agentic identities, including privileged access management, machine identity security, and identity governance.
Unit 42
Unit 42 provides threat research, incident response, security consulting, and managed detection and response. It helps customers during attacks and feeds threat knowledge back into the product set.
Revenue mix to watch
Palo Alto Networks reports as one operating segment. The mix below uses Q3 FY26 revenue categories: subscription and support at 80.2% and product at 19.8%.
What could break the story
Margins stay under pressure
High impact · Medium oddsQ3 FY26 GAAP operating margin was negative 6.1%, and gross margin fell to 67.6% from 72.9% a year earlier. The company says acquisition-related costs are a big reason. If those costs do not fade, revenue growth may not turn into better earnings.
Acquisitions prove harder than planned
High impact · Medium oddsCyberArk and Chronosphere added important products, but they also made the company larger and more complex. Management said integration is ahead of plan, which lowers the near-term worry. The risk is that product roadmaps, sales teams, and customer support take longer to combine than expected.
NGS ARR growth is less organic than it looks
High impact · Medium oddsNGS ARR grew 60% year over year to about $8.1 billion. Recent acquisitions added a large amount to that figure. If the core business slows once acquired revenue is separated out, investors may question the true growth rate.
Competition attacks every new pillar
Medium impact · High oddsPalo Alto competes with Microsoft, Cisco, Fortinet, Zscaler, and many focused security vendors. Its push into identity and observability adds competitors such as Datadog and Dynatrace. These rivals can pressure pricing, slow deal wins, or force higher sales spending.
Observability convergence comes too slowly
Medium impact · Medium oddsChronosphere is tied to a future where security and observability work together with AI-led fixes. Customers may agree with the idea but still buy observability tools from separate vendors. If adoption is slow, the return on the Chronosphere deal could take longer.
Regulation and geopolitics add friction
Medium impact · Medium oddsThe company serves global enterprises and government customers, so budgets, data laws, and politics matter. The U.K. Data (Use and Access) Act 2025 adds compliance questions around data transfers between the U.K. and the EU. Palo Alto also has significant operations in Israel, which creates operational exposure to regional instability.
In one breath
What does Palo Alto Networks do?
Palo Alto Networks sells cybersecurity products and services. Its tools help protect networks, cloud apps, endpoints, security teams, and identities from attacks.
Why does NGS ARR matter for PANW?
NGS ARR tracks annual recurring revenue from newer security products. It is a key way to judge whether the platform strategy is working beyond the older firewall business.
What is the biggest risk for Palo Alto Networks stock?
The biggest risk is that growth from CyberArk and Chronosphere comes with too much margin pressure. Investors need to see that the company can integrate those deals and return to stronger profitability.
Is Palo Alto Networks mostly a subscription business?
Yes, based on Q3 FY26 revenue mix. Subscription and support made up 80.2% of revenue, while product revenue made up 19.8%.