Palo Alto Networks, Inc.
Loading chart...
Item 1. Business
General
Palo Alto Networks, Inc. is a global artificial intelligence (“AI”) cybersecurity provider and our vision is a world where each day is safer and more secure than the one before. We were incorporated in 2005 and are headquartered in Santa Clara, California.
Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. Our platforms and services help secure enterprise users, networks, clouds, endpoints, AI apps and agents, and identities by delivering comprehensive cybersecurity backed by AI and automation, and provide real-time visibility and monitoring across cloud infrastructure, applications and AI workloads. A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products. We execute on this strategy by developing our capabilities and packaging our offerings into platforms, which are able to cover many of our customers’ needs in the markets in which we operate. Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster, and cost-effective outcomes.
Network & AI Security
Our Network & AI Security platform is designed to deliver complete zero trust solutions to our customers. The platform includes:
•Secure Access Service Edge (“SASE”). Prisma® Access, when combined with Prisma SD-WAN, provides a comprehensive AI-powered SASE solution that secures users, branches, data, AI apps and agents from the most evasive threats in the new AI landscape. Our Prisma Browser™ further extends zero-trust security and data protection to the browser, where the majority of work is done today, providing users with the freedom to work securely using our secure browser from any device.
•Next-Generation Firewalls. Our ML-Powered Next-Generation Firewalls (“NGFWs”) secure on-premises environments including campus locations and data centers. Our software NGFWs secure virtual and cloud networks.
•Cloud-Delivered Security Services (“CDSS”). Our network security platform integrates a suite of Precision AI powered security capabilities that complements our SASE and NGFW solutions. These include Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, Advanced DNS Security, Device Security, Quantum Security, Next-Gen Trust Protection (“NGTS”), GlobalProtect®, Prisma Access Agent, Enterprise Data Loss Prevention (“Enterprise DLP”), Software as a Service (“SaaS”) Security, and AI Access Security™. Through these add-on services, our customers are able to secure their content, applications, users, devices, and connection across their entire organization.
•Prisma AIRS. Prisma AIRS™ is our comprehensive AI security platform designed to help organizations discover, assess, and protect AI agents, applications, models and data across the AI lifecycle. It supports key enterprise use cases, including securing AI-assisted software development, protecting custom AI applications from development through runtime, and governing autonomous AI agents. Prisma AIRS™ brings together AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security™, AI Model Security, and AI Posture Management in a unified platform. These capabilities provide visibility into AI assets and activity, assess risks before deployment, and enforce security controls during live AI interactions and agent actions.
•Strata Cloud Manager (“SCM”). SCM is our AI-powered unified network security management and operations solution. It enables customers to manage and monitor their NGFW and SASE environments through a single, streamlined interface. SCM helps customers centrally manage configurations and security policies, assess security posture and network health, and streamline troubleshooting and remediation. It includes Strata Copilot, which offers a natural language interface for actionable insights and guided remediation, and integrates Autonomous Digital Experience Monitoring (“ADEM”) to help customers monitor and improve end-user performance across the enterprise.
Cortex
Our AI-powered Cortex® platform transforms end-to-end security operations and observability with unified data, AI, and automation for more secure, faster, and cost effective outcomes.
•Security Operations. We deliver the next generation of security operations capabilities that unifies standalone Security Information and Event Management (“SIEM”) tools, endpoint security, security automation, cloud detection and response (“CDR”), as well as attack surface management (“ASM”) capabilities on our Cortex platform. These include Cortex XSIAM®, for AI-powered security operations replacing traditional SIEM tools; Cortex XDR®, for the prevention, detection, and response to complex cybersecurity attacks; Cortex XSOAR®, for security orchestration, automation, and response (“SOAR”); Cortex Xpanse®, for ASM; and Koi Agentic Endpoint Security. Additionally, Cortex XSIAM integrates with the Chronosphere Telemetry Pipeline to ingest and optimize massive data volumes, promoting cost-effective scaling of autonomous operations.
- 4 -
•Cloud Security. We deliver comprehensive security across the cloud application development lifecycle through Cortex Cloud®, delivered as a scalable SaaS offering. As a comprehensive Cloud Native Application Protection Platform (“CNAPP”) combined with CDR, Cortex Cloud secures multi- and hybrid-cloud environments for applications, data, generative AI (“GenAI”) ecosystem, and the cloud native technology stack across the full development lifecycle, from code to cloud to security operations. As part of the Cortex Cloud platform, customers can expand from Cortex Cloud to our security operations offerings available on a single user experience and unified agent. We also offer our VM-Series and CN-Series virtual firewalls for inline network security on multi- and hybrid-cloud environments.
•Observability. Chronosphere, our next-generation observability platform, delivers real-time visibility and monitoring across cloud-native infrastructure, applications, and AI workloads. Purpose-built to handle the massive data volumes of the AI era, Chronosphere enables organizations to maintain system resilience and uptime with high cost-efficiency and reliability. Our observability platform provides comprehensive visibility into complex digital environments and automated troubleshooting of issues. It allows customers to transition from passive monitoring to proactive management of their entire digital estate. Our telemetry pipeline acts as an intelligent control layer that filters, transforms, and routes data. This helps reduce data volumes, enabling customers to cost-effectively scale their security and observability posture.
Idira
Idira™, our next-generation identity security platform, is designed to secure human, agentic, and machine identities across the enterprise with intelligent privilege controls and continuous threat prevention. By unifying identity access management, privilege access management, and identity governance and administration, organizations can continuously discover and protect against identity risk throughout the end-to-end identity lifecycle. The platform includes:
•Workforce Identity Security. Our solutions apply identity assurance and modern access controls for the entire workforce, including through adaptive multi-factor authentication (“MFA”), single sign-on (“SSO”), secure browsing, web session protection, workforce password management, and automated identity lifecycle management. Our approach enforces least privilege by elevating access only when required.
•Information Technology (“IT”) and Developer Identity Security (Modern Privilege Access Management). Our solutions secure high-risk access for IT administrators, third-party vendors, developers, and cloud operations teams across hybrid and multi-cloud environments, delivering just-in-time privileged access, session isolation, credential protection, and zero standing privileges, while providing native, secure access to cloud services, workloads, and development and operations pipelines. Organizations can eliminate excessive permissions, automate access to dynamic cloud resources, and maintain developer velocity while strengthening identity controls across infrastructure and application environments.
•Machine Identity Security. Our solutions secure the growing volume of non-human identities—such as workloads, applications, containers, service accounts, certificates, and keys, including through centralized discovery and management of secrets, certificate lifecycle automation, workload identity issuance, public key infrastructure-as-a-service, Kubernetes certificate management, and secure code signing.
•Identity Governance and Administration (“IGA”). IGA enables visibility into entitlements, automated joiner–mover–leaver processes, access certification, and ongoing identity compliance. AI-supported policy automation helps organizations govern access at scale and enforce a zero-trust model across all identities.
•AI Agents Security. Our solution discovers AI agents, assigns identity attributes, and restricts their access to task-specific resources. It helps monitor and record agent activity for audit purposes, allows organizations to suspend or revoke access if behavior deviates from expected norms, and governs the lifecycle of the agent and the actions taken to support compliance.
Threat Intelligence and Advisory Services
•Unit 42® brings together world-renowned expertise across threat research, incident response, and security consulting to deliver intelligence-driven, response-ready outcomes that help customers reduce cyber risk. Our elite consultants serve as trusted advisors to our customers by assessing and testing their security controls against sophisticated threats, including Frontier AI, transforming their security strategy with a threat-informed approach, and responding to security incidents on behalf of our clients. Additionally, Unit 42 offers managed detection and response (“MDR”) and managed threat hunting services. In April 2026, we launched a new suite of Unit 42 Frontier AI Defense services to help customers proactively discover and neutralize threats introduced by next-generation AI models.
- 5 -
Products and Services
NETWORK & AI SECURITY
Secure Access Service Edge
•Prisma Access. Prisma Access is a cloud-delivered security offering that helps organizations deliver consistent AI-driven security to remote networks and mobile users. With more than 100 locations around the world, Prisma Access offers global coverage, consistently inspecting all traffic across all ports and providing bidirectional networking to enable branch-to-branch and branch-to-headquarter traffic. Prisma Access consolidates point products into a single cloud-delivered solution, transforming network security and allowing organizations to enable secure hybrid work. Prisma Access protects all application traffic with complete, best-in-class security while also delivering a seamless user experience with industry-leading service-level agreements (“SLAs”). With native SASE integration, our Prisma Access Browser extends zero-trust security to any device—managed or unmanaged—in minutes. Prisma Access delivers seamless user experience with a combination of application acceleration—up to 5x faster than direct-to-internet—and Autonomous Digital Experience Management.
•Prisma SD-WAN. Our Prisma SD-WAN solution is a next-generation SD-WAN solution that makes the secure cloud-delivered branch possible. Prisma SD-WAN enables organizations to replace traditional wide area network (“WAN”) architectures with affordable broadband and internet transport types that promote improved bandwidth availability, redundancy, and performance. Prisma SD-WAN leverages real-time application performance SLAs and visibility to control and intelligently steer application traffic to deliver a powerful user experience. Prisma SD-WAN also provides the flexibility of deploying with an on-premises controller to help businesses meet their industry-specific security compliance requirements and manage deployments with application-defined policies. Our Prisma SD-WAN simplifies network and security operations using AI and automation.
Next-Generation Firewalls. Our hardware and software ML-Powered NGFWs use AI—including machine learning and deep learning—to stop zero-day threats in real time, and detect and secure the entire enterprise including Internet of Things (“IoT”). All of our hardware and software firewalls incorporate the PAN-OS® operating system and include the same rich set of features, ensuring consistent operation across our entire product line. This includes SD-WAN capabilities to intelligently steer traffic to data centers, branches, and the cloud, natively integrated into our NGFWs. Enterprise data, applications, users, and devices become integral components of an organization’s security policy. Our hardware and software are designed for different performance requirements throughout an organization—with the ability to secure everything from small businesses and branch offices, to large-scale data centers and service providers. Our firewalls come in hardware form factors, containerized form factors, called CN-Series, as well as virtual form factors, called VM-Series, available on all major cloud hosting service providers. We also offer Cloud NGFW, a managed NGFW offering, to secure customers’ applications on Amazon Web Services (“AWS”) and Microsoft Azure (“Azure”).
Cloud-Delivered Security Services
Loading financial statements...
Financial statements
data from SEC XBRL filings. Values are as-reported; restatements supersede originals. Values reported in .
| Line item |
|---|
| Period ending |
Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. The following discussion and analysis contains forward-looking statements based on current expectations and assumptions that are subject to risks and uncertainties, which could cause our actual results to differ materially from those anticipated or implied by any forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Annual Report on Form 10-K, and in particular, the risks discussed under the caption “Risk Factors” in Part I, Item 1A of this report.
Our Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) is organized as follows:
•Overview. A discussion of our business and overall analysis of financial and other highlights in order to provide context for the remainder of MD&A.
•Key Financial Metrics. A summary of our U.S. GAAP and non-GAAP key financial metrics, which management monitors to evaluate our performance.
•Results of Operations. A discussion of the nature and trends in our financial results and an analysis of our financial results comparing fiscal 2026 to fiscal 2025. For discussion and analysis related to our financial results comparing fiscal 2025 to 2024, refer to Part II, Item 7 Management’s Discussion and Analysis of Financial Condition and Results of Operations in our Annual Report on Form 10-K for fiscal 2025, which was filed with the Securities and Exchange Commission on August 29, 2025.
•Liquidity and Capital Resources. An analysis of changes on our balance sheets and cash flows, and a discussion of our financial condition and our ability to meet cash needs.
•Critical Accounting Estimates. A discussion of our accounting policies that require critical estimates, assumptions, and judgments.
•Recent Accounting Pronouncements. A discussion of expected impacts of impending accounting changes on financial information to be reported in the future.
Overview
Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. Our platforms and services help secure enterprise users, networks, clouds, endpoints, AI apps and agents, and identities by delivering comprehensive cybersecurity backed by AI and automation, and provide real-time visibility and monitoring across cloud infrastructure, applications and AI workloads. A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products. We execute on this strategy by developing our capabilities and packaging our offerings into platforms, which are able to cover many of our customers’ needs in the markets in which we operate. Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster, and cost-effective outcomes.
Network & AI Security
Our Network & AI Security platform is designed to deliver complete zero trust solutions to our customers. The platform includes:
•Secure Access Service Edge. Prisma® Access, when combined with Prisma SD-WAN, provides a comprehensive AI-powered SASE solution that secures users, branches, data, AI apps and agents from the most evasive threats in the new AI landscape. Our Prisma Browser™ further extends zero-trust security and data protection to the browser, where the majority of work is done today, providing users with the freedom to work securely using our secure browser from any device.
•Next-Generation Firewalls. Our ML-Powered NGFWs secure on-premises environments including campus locations and data centers. Our software NGFWs secure virtual and cloud networks.
•Cloud-Delivered Security Services. Our network security platform integrates a suite of Precision AI powered security capabilities that complements our SASE and NGFW solutions. These include Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, Advanced DNS Security, Device Security, Quantum Security, NGTS, GlobalProtect®, Prisma Access Agent, Enterprise DLP, SaaS Security, and AI Access Security™. Through these add-on services, our customers are able to secure their content, applications, users, devices, and connection across their entire organization.
- 42 -
•Prisma AIRS. Prisma AIRS™ is our comprehensive AI security platform designed to help organizations discover, assess, and protect AI agents, applications, models and data across the AI lifecycle. It supports key enterprise use cases, including securing AI-assisted software development, protecting custom AI applications from development through runtime, and governing autonomous AI agents. Prisma AIRS™ brings together AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security™, AI Model Security, and AI Posture Management in a unified platform. These capabilities provide visibility into AI assets and activity, assess risks before deployment, and enforce security controls during live AI interactions and agent actions.
•Strata Cloud Manager. SCM, is our AI-powered unified network security management and operations solution. It enables customers to manage and monitor their NGFW and SASE environments through a single, streamlined interface. SCM helps customers centrally manage configurations and security policies, assess security posture and network health, and streamline troubleshooting and remediation. It includes Strata Copilot, which offers a natural language interface for actionable insights and guided remediation, and integrates ADEM to help customers monitor and improve end-user performance across the enterprise.
Cortex
Our AI-powered Cortex® platform transforms end-to-end security operations and observability with unified data, AI, and automation for more secure, faster, and cost effective outcomes.
•Security Operations. We deliver the next generation of security operations capabilities that unifies standalone SIEM tools, endpoint security, security automation, CDR, as well as ASM capabilities on our Cortex platform. These include Cortex XSIAM®, for AI-powered security operations replacing traditional SIEM tools; Cortex XDR®, for the prevention, detection, and response to complex cybersecurity attacks; Cortex XSOAR®, for SOAR; Cortex Xpanse®, for ASM; and Koi Agentic Endpoint Security. Additionally, Cortex XSIAM integrates with the Chronosphere Telemetry Pipeline to ingest and optimize massive data volumes, promoting cost-effective scaling of autonomous operations.
•Cloud Security. We deliver comprehensive security across the cloud application development lifecycle through Cortex Cloud®, delivered as a scalable SaaS offering. As a comprehensive CNAPP combined with CDR, Cortex Cloud secures multi- and hybrid-cloud environments for applications, data, GenAI ecosystem, and the cloud native technology stack across the full development lifecycle, from code to cloud to security operations. As part of the Cortex Cloud platform, customers can expand from Cortex Cloud to our security operations offerings available on a single user experience and unified agent. We also offer our VM-Series and CN-Series virtual firewalls for inline network security on multi- and hybrid-cloud environments.
•Observability. Chronosphere, our next-generation observability platform, delivers real-time visibility and monitoring across cloud-native infrastructure, applications, and AI workloads. Purpose-built to handle the massive data volumes of the AI era, Chronosphere enables organizations to maintain system resilience and uptime with high cost-efficiency and reliability. Our observability platform provides comprehensive visibility into complex digital environments and automated troubleshooting of issues. It allows customers to transition from passive monitoring to proactive management of their entire digital estate. Our telemetry pipeline acts as an intelligent control layer that filters, transforms, and routes data. This helps reduce data volumes, enabling customers to cost-effectively scale their security and observability posture.
Idira
Idira™, our next-generation identity security platform, is designed to secure human, agentic, and machine identities across the enterprise with intelligent privilege controls and continuous threat prevention. By unifying identity access management, privilege access management, and identity governance and administration, organizations can continuously discover and protect against identity risk throughout the end-to-end identity lifecycle. The platform includes:
•Workforce Identity Security. Our solutions apply identity assurance and modern access controls for the entire workforce, including through adaptive MFA, SSO, secure browsing, web session protection, workforce password management, and automated identity lifecycle management. Our approach enforces least privilege by elevating access only when required.
•IT and Developer Identity Security (Modern Privilege Access Management). Our solutions secure high-risk access for IT administrators, third-party vendors, developers, and cloud operations teams across hybrid and multi-cloud environments, delivering just-in-time privileged access, session isolation, credential protection, and zero standing privileges, while providing native, secure access to cloud services, workloads, and development and operations pipelines. Organizations can eliminate excessive permissions, automate access to dynamic cloud resources, and maintain developer velocity while strengthening identity controls across infrastructure and application environments.
•Machine Identity Security. Our solutions secure the growing volume of non-human identities—such as workloads, applications, containers, service accounts, certificates, and keys, including through centralized discovery and management of secrets, certificate lifecycle automation, workload identity issuance, public key infrastructure-as-a-service, Kubernetes certificate management, and secure code signing.
- 43 -
•Identity Governance and Administration. IGA enables visibility into entitlements, automated joiner–mover–leaver processes, access certification, and ongoing identity compliance. AI-supported policy automation helps organizations govern access at scale and enforce a zero-trust model across all identities.
•AI Agents Security. Our solution discovers AI agents, assigns identity attributes, and restricts their access to task-specific resources. It helps monitor and record agent activity for audit purposes, allows organizations to suspend or revoke access if behavior deviates from expected norms, and governs the lifecycle of the agent and the actions taken to support compliance.
Threat Intelligence and Advisory Services
•Unit 42® brings together world-renowned expertise across threat research, incident response, and security consulting to deliver intelligence-driven, response-ready outcomes that help customers reduce cyber risk. Our elite consultants serve as trusted advisors to our customers by assessing and testing their security controls against sophisticated threats, including Frontier AI, transforming their security strategy with a threat-informed approach, and responding to security incidents on behalf of our clients. Additionally, Unit 42 offers MDR and managed threat hunting services. In April 2026, we launched a new suite of Unit 42 Frontier AI Defense services to help customers proactively discover and neutralize threats introduced by next-generation AI models.
For fiscal 2026 and 2025, total revenue was $11.5 billion and $9.2 billion, respectively, representing year-over-year growth of 24%. Our growth reflects the increased adoption of our portfolio, which consists of product, subscriptions, and support, and the contributions from our acquisitions in our current fiscal year. We believe our portfolio will enable us to benefit from recurring revenues and new revenues as we continue to grow our end-customer base. As of July 31, 2026, we had end-customers in over 180 countries. Our end-customers represent a broad range of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications, and include almost all of the Fortune 100 companies and a majority of the Global 2000 companies. We maintain a field sales force that works closely with our channel partners in developing sales opportunities. We primarily use a two-tiered, indirect fulfillment model whereby we sell our products, subscriptions, and support to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers.
Our product revenue grew to $2.3 billion, or 19.9% of total revenue for fiscal 2026, representing year-over-year growth of 27%. Product revenue is derived from sales of hardware products, primarily our ML-Powered NGFW, and software licenses, including SD-WAN, VM-Series, and Panorama®. In connection with the acquisition of CyberArk in February 2026, our product revenue also includes on-premise software licenses of certain identity security offerings. Our ML-Powered NGFW incorporates our PAN-OS® operating system, which provides a consistent set of capabilities across our entire network security product line. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. Our products are designed for different performance requirements throughout an organization, ranging from our PA-400, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7500, which is designed for large-scale data centers and service provider use. The same firewall functionality that is delivered in our hardware products is also available in our VM-Series virtual firewalls, which secure virtualized and cloud-based computing environments, and in our CN-Series container firewalls, which secure container environments and traffic.
Our subscription and support revenue grew to $9.2 billion, or 80.1% of total revenue for fiscal 2026, representing year-over-year growth of 24%. Our subscriptions provide our end-customers with near real-time access to the latest intrusion prevention, web security, modern malware prevention, data loss prevention, cloud security access broker, and AI security capabilities across the network, endpoints, and the cloud. Our subscriptions also include security operations, which enable customers to leverage the AI-powered Cortex platform for advanced capabilities such as security information and event management, next-generation antivirus, endpoint detection and response, extended detection and response, identity threat detection and response, cloud detection and response, SOAR, ASM, and CNAPP for comprehensive cloud security. In connection with our acquisition of Chronosphere in January 2026, our subscriptions also include a next-generation observability platform for cloud-native infrastructure and applications as well as telemetry pipeline management that is designed to handle vast cloud data volumes with cost-efficiency and reliability. With the acquisition of CyberArk, our subscriptions include a next-generation identity security platform designed to secure human, AI, and machine identity across the enterprise with intelligent privilege controls and continuous threat prevention. Additionally, we offer MDR for Cortex subscriptions, powered by Unit 42’s elite expertise. When customers purchase our physical, virtual, or container firewalls, or certain cloud offerings, they typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs. In addition to the subscriptions purchased with these firewalls, customers may also purchase other subscriptions on a per-user, per-endpoint, or capacity-based basis. We also offer professional services, including incident response, risk management, digital forensic services, and technical account management.
- 44 -
We continue to invest in innovation as we evolve and further extend the capabilities of our portfolio, as we believe that innovation and timely development of, and investment in, new features and products are essential to meeting the needs of our end-customers and improving our competitive position. During fiscal 2026, we introduced several upgrades and new offerings, including: PAN-OS 12.1 Orion, Prisma AIRS 2.0, NGTS, and Prisma AIRS 3.0. Additionally, we evaluate opportunities to acquire complementary businesses, technologies, services, and intellectual property to complement our organic innovation and research and development efforts, advance the development of our platforms, and enable further investment in our key priority areas. For example, on January 29, 2026, we completed the acquisition of Chronosphere, forming our observability platform; on February 11, 2026, we completed the acquisition of CyberArk, forming our next-generation identity security platform; on April 14, 2026, we completed the acquisition of Koi, adding agentic endpoint security capabilities to our security operations platform and enhancing Prisma AIRS; on May 29, 2026, we completed the acquisition of Portkey, enhancing our Prisma AIRS capabilities; on August 27, 2026, we completed the acquisition of Embrace, which we expect will add RUM capabilities to our observability platform; and on September 1, 2026, we completed the acquisition of Console, which we expect will deepen our agentic capabilities in Cortex. On July 16, 2026, we announced the general availability of Prisma AIRS Gateway, which incorporates AI gateway capabilities acquired through Portkey into Prisma AIRS.
We believe that the growth of our business and our short-term and long-term success are dependent upon many factors, including our ability to extend our technology leadership, grow our base of end-customers, expand deployment of our portfolio and support offerings within existing end-customers, focus on end-customer satisfaction, and address any product vulnerabilities. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner. While these areas present significant opportunities for us, they also pose challenges and risks that we must successfully address in order to sustain the growth of our business and improve our operating results. For additional information regarding the challenges and risks we face, see the “Risk Factors” section in Part I, Item 1A of this Annual Report on Form 10-K.
IMPACT OF MACROECONOMIC DEVELOPMENTS AND OTHER FACTORS ON OUR BUSINESS
Our overall performance depends in part on worldwide economic and geopolitical conditions and their impact on customer behavior. Changes in legislation or regulations and actions by regulators, including changes in enforcement and administration policies, may have an impact on our financial condition and operating results. Significant changes in U.S. or global trade policy, including further expansion of U.S. export/imports controls and tariffs, as well as retaliatory actions by other countries, may materially and adversely affect our business. Further, economic conditions, including inflation, high interest rates, slow growth, fluctuations in foreign exchange rates, supply chain disruptions, including increased memory, storage, or other component shortages and costs, impacts of trade regulations or international trade disputes, and other conditions, may materially and adversely affect our financial condition and operating results.
The hostilities in Israel, Iran, and the surrounding region have continued to result in economic and political uncertainty. While we have business operations in Israel, and intend to continue growing our presence in Israel, we currently do not expect significant business disruption. We are actively monitoring, evaluating, and responding to the situation.
We are also monitoring the impact of inflationary pressures and the tensions between China and Taiwan, and between the U.S. and China, which have increased our costs and could have an adverse impact on our business or results of operations in future periods.
Key Financial Metrics
We monitor the key financial metrics set forth in the tables below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts, and assess operational efficiencies. We discuss revenue, gross margin, and the components of operating income and margin below under “Results of Operations.”
| July 31, | |||||||||||
| 2026 | 2025 | ||||||||||
(in billions) | |||||||||||
Next-Generation Security Annualized Recurring Revenue | $ | 9.1 | $ | 5.6 | |||||||
Remaining performance obligations | $ | 21.2 | $ | 15.8 | |||||||
- 45 -
| Year Ended July 31, | |||||||||||||||||
| 2026 | 2025 | 2024 | |||||||||||||||
| (dollars in millions) | |||||||||||||||||
| Total revenue | $ | 11,480 | $ | 9,221 | $ | 8,027 | |||||||||||
| Total revenue year-over-year percentage increase | 24 | % | 15 | % | 16 | % | |||||||||||
| Gross margin | 70.4 | % | 73.4 | % | 74.3 | % | |||||||||||
Operating income | $ | 695 | $ | 1,243 | $ | 684 | |||||||||||
| Operating margin | 6.1 | % | 13.5 | % | 8.5 | % | |||||||||||
| Net cash provided by operating activities | $ | 4,553 | $ | 3,716 | $ | 3,258 | |||||||||||
| Free cash flow (non-GAAP) | $ | 4,113 | $ | 3,469 | $ | 3,101 | |||||||||||
•Next-Generation Security Annualized Recurring Revenue (“NGS ARR”). Our NGS ARR represents the annualized allocated revenue of all active contracts as of the final day of the reporting period related to all product, subscription, and support offerings, excluding revenue from hardware products, and legacy attached subscriptions, support offerings, and professional services. NGS ARR is an operating metric that we use to assess the strength and trajectory of our business. NGS ARR should be viewed independently of revenue, deferred revenue, and remaining performance obligations and does not represent our revenue under U.S. GAAP on an annualized basis, as it is an operating metric that can be impacted by contract start and end dates and renewal rates. NGS ARR is not intended to be a replacement for forecasts of revenue. The scope of products, subscriptions, and support offerings that contribute to NGS ARR will generally increase over time as we introduce or acquire new next-generation products, subscriptions, and support offerings.
•Net Cash Provided by Operating Activities. We monitor net cash provided by operating activities as a measure of our overall business performance. Our net cash provided by operating activities is driven in large part by sales of our products and from up-front payments for subscription and support offerings. Monitoring net cash provided by operating activities enables us to analyze our financial performance without the non-cash effects of certain items such as share-based compensation costs, depreciation, and amortization, thereby allowing us to better understand and manage the cash needs of our business.
•Free Cash Flow (non-GAAP). We define free cash flow, a non-GAAP financial measure, as net cash provided by operating activities less purchases of property, equipment, and other assets. We consider free cash flow to be an operating metric as well as a liquidity measure that provides useful information to management and investors about the amount of cash generated by the business after necessary capital expenditures. A limitation of the utility of free cash flow as a measure of our liquidity is that it does not represent the total increase or decrease in our cash balance for the period. In addition, it is important to note that other companies, including companies in our industry, may not use free cash flow, may calculate free cash flow in a different manner than we do, or may use other financial measures to evaluate their liquidity, all of which could reduce the usefulness of free cash flow as a comparative measure. A reconciliation of free cash flow to net cash provided by operating activities, the most directly comparable financial measure calculated and presented in accordance with U.S. GAAP, is provided below:
| Year Ended July 31, | |||||||||||||||||
| 2026 | 2025 | 2024 | |||||||||||||||
| (in millions) | |||||||||||||||||
| Free cash flow (non-GAAP): | |||||||||||||||||
| Net cash provided by operating activities | $ | 4,553 | $ | 3,716 | $ | 3,258 | |||||||||||
| Less: purchases of property, equipment, and other assets | 440 | 247 | 157 | ||||||||||||||
| Free cash flow (non-GAAP) | $ | 4,113 | $ | 3,469 | $ | 3,101 | |||||||||||
| Net cash used in investing activities | $ | (3,104) | $ | (2,205) | $ | (1,510) | |||||||||||
| Net cash used in financing activities | $ | (1,202) | $ | (779) | $ | (1,343) | |||||||||||
- 46 -
Results of Operations
The following table summarizes our results of operations for the periods presented and as a percentage of our total revenue for those periods based on our consolidated statements of operations data. The period-to-period comparison of results is not necessarily indicative of results for future periods.
| Year Ended July 31, | |||||||||||||||||||||||||||||||||||
| 2026 | 2025 | 2024 | |||||||||||||||||||||||||||||||||
| Amount | % of Revenue | Amount | % of Revenue | Amount | % of Revenue | ||||||||||||||||||||||||||||||
| (dollars in millions) | |||||||||||||||||||||||||||||||||||
| Revenue: | |||||||||||||||||||||||||||||||||||
| Product | $ | 2,280 | 19.9 | % | $ | 1,802 | 19.5 | % | $ | 1,603 | 20.0 | % | |||||||||||||||||||||||
| Subscription and support | 9,200 | 80.1 | % | 7,419 | 80.5 | % | 6,424 | 80.0 | % | ||||||||||||||||||||||||||
| Total revenue | 11,480 | 100.0 | % | 9,221 | 100.0 | % | 8,027 | 100.0 | % | ||||||||||||||||||||||||||
| Cost of revenue: | |||||||||||||||||||||||||||||||||||
| Product | 568 | 4.9 | % | 413 | 4.5 | % | 348 | 4.3 | % | ||||||||||||||||||||||||||
| Subscription and support | 2,835 | 24.7 | % | 2,038 | 22.1 | % | 1,711 | 21.4 | % | ||||||||||||||||||||||||||
Total cost of revenue(1) | 3,403 | 29.6 | % | 2,451 | 26.6 | % | 2,059 | 25.7 | % | ||||||||||||||||||||||||||
| Total gross profit | 8,077 | 70.4 | % | 6,770 | 73.4 | % | 5,968 | 74.3 | % | ||||||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||||||||||||||
| Research and development | 2,552 | 22.2 | % | 1,984 | 21.5 | % | 1,810 | 22.5 | % | ||||||||||||||||||||||||||
| Sales and marketing | 3,931 | 34.3 | % | 3,100 | 33.6 | % | 2,794 | 34.8 | % | ||||||||||||||||||||||||||
| General and administrative | 899 | 7.8 | % | 443 | 4.8 | % | 680 | 8.5 | % | ||||||||||||||||||||||||||
Total operating expenses(1) | 7,382 | 64.3 | % | 5,527 | 59.9 | % | 5,284 | 65.8 | % | ||||||||||||||||||||||||||
Operating income | 695 | 6.1 | % | 1,243 | 13.5 | % | 684 | 8.5 | % | ||||||||||||||||||||||||||
| Other income (expense), net | (159) | (1.4) | % | 353 | 3.8 | % | 304 | 3.8 | % | ||||||||||||||||||||||||||
Income before income taxes | 536 | 4.7 | % | 1,596 | 17.3 | % | 988 | 12.3 | % | ||||||||||||||||||||||||||
Provision for (benefit from) income taxes | 229 | 2.0 | % | 462 | 5.0 | % | (1,590) | (19.8) | % | ||||||||||||||||||||||||||
Net income | $ | 307 | 2.7 | % | $ | 1,134 | 12.3 | % | $ | 2,578 | 32.1 | % | |||||||||||||||||||||||
(1)Includes share-based compensation as follows:
| Year Ended July 31, | |||||||||||||||||
| 2026 | 2025 | 2024 | |||||||||||||||
| (in millions) | |||||||||||||||||
| Cost of product revenue | $ | 5 | $ | 5 | $ | 7 | |||||||||||
| Cost of subscription and support revenue | 161 | 127 | 121 | ||||||||||||||
| Research and development | 688 | 551 | 526 | ||||||||||||||
| Sales and marketing | 513 | 359 | 301 | ||||||||||||||
| General and administrative | 448 | 258 | 124 | ||||||||||||||
| Total share-based compensation | $ | 1,815 | $ | 1,300 | $ | 1,079 | |||||||||||
- 47 -
IMPACT OF ACQUISITIONS
Our operating results were impacted by our acquisitions. In discussions of our results of operations, we may qualitatively or quantitatively disclose the impact of our acquisitions on revenue, costs, and expenses for the one year period subsequent to the acquisition date where such discussions would be meaningful.
REVENUE
Our revenue consists of product revenue and subscription and support revenue. Revenue is recognized upon transfer of control of the corresponding promised products and subscriptions and support to our customers in an amount that reflects the consideration we expect to be entitled to in exchange for those products and subscriptions and support. We expect our revenue to vary from quarter to quarter based on seasonal and cyclical factors and business acquisitions.
PRODUCT REVENUE
Product revenue is derived from sales of hardware products, primarily our ML-Powered NGFW, software licenses, including SD-WAN, VM-Series, Panorama, and certain identity security offerings. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. We recognize product revenue at the time of hardware shipment or delivery of software license. As a percentage of product revenue, we expect our revenue from software licenses to vary from quarter to quarter and increase over the long term as we improve features and capabilities of our on-premise software, renew our software license contracts, and expand our installed end-customer base.
| Year Ended July 31, | Year Ended July 31, | ||||||||||||||||||||||||||||||||||||||||||||||
| 2026 | 2025 | Change | 2025 | 2024 | Change | ||||||||||||||||||||||||||||||||||||||||||
| Amount | Amount | Amount | % | Amount | Amount | Amount | % | ||||||||||||||||||||||||||||||||||||||||
| (dollars in millions) | |||||||||||||||||||||||||||||||||||||||||||||||
| Product | $ | 2,280 | $ | 1,802 | $ | 478 | 27 | % | $ | 1,802 | $ | 1,603 | $ | 199 | 12 | % | |||||||||||||||||||||||||||||||
Product revenue increased for fiscal 2026 compared to fiscal 2025 driven by increased revenue from software licenses, including from our CyberArk acquisition, and increased demand for our new generation of hardware products.
SUBSCRIPTION AND SUPPORT REVENUE
Subscription and support revenue is derived primarily from sales of our subscription and support offerings. Our subscription and support contracts are typically one to five years. We recognize revenue from subscriptions and support over time as the services are performed. As a percentage of total revenue, we expect our subscription and support revenue to vary from quarter to quarter and increase over the long term as we introduce new subscriptions, renew existing subscription and support contracts, and expand our installed end-customer base.
| Year Ended July 31, | Year Ended July 31, | ||||||||||||||||||||||||||||||||||||||||||||||
| 2026 | 2025 | Change | 2025 | 2024 | Change | ||||||||||||||||||||||||||||||||||||||||||
| Amount | Amount | Amount | % | Amount | Amount | Amount | % | ||||||||||||||||||||||||||||||||||||||||
| (dollars in millions) | |||||||||||||||||||||||||||||||||||||||||||||||
| Subscription | $ | 6,239 | $ | 4,974 | $ | 1,265 | 25 | % | $ | 4,974 | $ | 4,188 | $ | 786 | 19 | % | |||||||||||||||||||||||||||||||
| Support | 2,961 | 2,445 | 516 | 21 | % | 2,445 | 2,236 | 209 | 9 | % | |||||||||||||||||||||||||||||||||||||
| Total subscription and support | $ | 9,200 | $ | 7,419 | $ | 1,781 | 24 | % | |||||||||||||||||||||||||||||||||||||||
Recent insider activity
| Date | Insider | Role | Action | Shares | Price | Value |
|---|---|---|---|---|---|---|
| 2026-09-01 | Paul Josh D. | Chief Accounting Officer | Sell | -900 | $373.68 | -$336,312 |
| 2026-08-25 | Paul Josh D. | Chief Accounting Officer | Sell | -900 | $353.77 | -$318,393 |
| 2026-07-07 | Thorning-Schmidt Helle | Director | Sell | -700 | $346.85 | -$242,795 |
| 2026-07-01 | Paul Josh D. | Chief Accounting Officer | Sell | -900 | $345.00 | -$310,500 |
| 2026-07-01 | Bawa Aparna indirect | Director | Sell | -290 | $348.74 | -$101,135 |
| 2026-06-29 | Bawa Aparna indirect | Director | Sell | -632 ×2 | $318.67 | -$201,397 |
| 2026-06-23 | Golechha Dipak | EVP, Chief Financial Officer | Sell | -5,000 ×6 | $289.56 | -$1,447,825 |
| 2026-06-22 | Bawa Aparna indirect | Director | Sell | -345 | $290.17 | -$100,109 |
Source: SEC Form 4 filings.
Next expected filings
- ~2026-11-19 10-Q expected by 2026-12-08 (in 67 days)
- ~2027-02-17 10-Q expected by 2027-03-08 (in 157 days)
- ~2027-06-02 10-Q expected by 2027-06-21 (in 262 days)
- ~2027-09-09 10-K expected by 2027-10-06 (in 361 days)
Predicted from historical filing cadence; not an SEC commitment.
Recent SEC filings
- 2026-09-10 10-K Annual Report
- 2026-09-01 8-K Earnings Release; Financial Statements and Exhibits
- 2026-08-21 8-K Officer/Director Change; Bylaws/Articles Amended; Financial Statements and Exhibits
- 2026-06-03 10-Q Quarterly Report
- 2026-06-02 8-K Earnings Release; Financial Statements and Exhibits
- 2026-04-13 8-K Material Agreement Entered; Material Financial Obligation; Financial Statements and Exhibits
- 2026-03-23 8-K Other Events
- 2026-03-11 8-K Other Events; Financial Statements and Exhibits
- 2026-02-18 10-Q Quarterly Report
- 2026-02-17 8-K Earnings Release; Financial Statements and Exhibits
- 2026-02-11 8-K Material Agreement Entered; Material Financial Obligation; Other Events; Financial Statements and Exhibits
- 2025-12-11 8-K Officer/Director Change; Shareholder Vote Results; Financial Statements and Exhibits
- 2025-11-21 8-K Other Events
- 2025-11-20 10-Q Quarterly Report
- 2025-11-19 8-K Officer/Director Change; Financial Statements and Exhibits