How are customers evaluating Prisma AIRS's ability to improve speed of detection and response in the elevated threat environment from Mythos and other AI developments?

Nikesh explained that native VM capability in hyperscalers allows inspection of AI traffic. Lee added that Prisma AIRS covers end-to-end security from shift-left (model scanning, red teaming) to runtime prevention, feeding data into XSIAM for AI automation and rapid remediation. The ability to achieve MTTR in minutes is a powerful proof point for customers. “That ability to prove to customers of all the rest that have already been deployed that we can achieve MTTR in minutes is a very powerful proof point for them of believing that they will be able to achieve the same outcomes as well.”

How are observability and security converging, and how does Palo Alto Networks' position with best-in-class XSIAM and Chronosphere allow it to take share against observability-first competitors?

Lee emphasized that both observability and security require specialized, best-in-class platforms independently. The convergence will happen through cross-pollination of data (observability data as a sensor for security, and vice versa) and leveraging AgentiX as a foundation for AI-driven automated response across platforms. “The first part is the data that is collected for each of these independent use cases starts to cross-pollinate to the other. The second part is really related to AgentiX. And what you're seeing across these spaces is a need for AI-driven automated response.”

How does the $200M opportunity with frontier labs change the thinking about AI native opportunities, and what was the breadth of the platform purchased in that deal?

Nikesh stated that Chronosphere excels with AI-native platforms, including frontier AI labs and modern SaaS companies. He noted that the observability market is maturing, and Chronosphere offers similar capabilities at approximately half the cost of competitors, making it attractive for companies realizing DIY solutions are insufficient as volume scales. “And what Chronosphere has done has been able to deliver that same capability at approximately half the cost of what the industry charges. So it starts to meet the number at which you're better off not building your own or using open source with some enterprise capabilities, you're better off using platforms like Chronosphere.”

PANW

Palo Alto Networks (PANW) Q3 FY26 earnings call: guidance and Q&A

Earnings call· Apr 2026 (Q3 FY26)· Information Technology· Jun 2, 2026

Source: earnings call transcript

Executive summary

Palo Alto Networks Q3 FY26 — Exceptional Performance Driven by AI-fueled Demand and Platformization

Palo Alto Networks delivered an exceptional Q3 FY26, surpassing all guided metrics, driven by accelerated organic bookings and its strategic platformization vision. The company is capitalizing on surging cybersecurity needs as AI transitions to enterprise-wide production, with strong performance in network security, XSIAM, and Prisma AIRS. While managing integration costs and component price increases, the company remains confident in its long-term profitability targets, fueled by AI-driven demand and platform consolidation.

Highlights

Next-Generation Security (NGS) ARR grew 60% year-over-year to $8.13 billion, significantly surpassing guidance.
Remaining Performance Obligation (RPO) reached $18.4 billion, up 36% year-over-year, with organic RPO up 22%.
Network security delivered its strongest Q3 in years, with next-generation firewall bookings rising nearly 40% year-over-year.
Prisma AIRS reached over 300 customers, tripling its Q2 count, and is on track for $100 million in ARR within a few quarters.
Adjusted free cash flow increased 57% year-over-year to $910 million, with a trailing 12-month margin of 38.5%.

Concerns

Stock-based compensation increased sequentially to 17% of revenue in Q3, primarily due to recent acquisitions.
The company reported a GAAP net loss per share of $0.22 for the quarter, reflecting transaction and integration costs.
Rising component costs, particularly in memory and storage, are being monitored, leading to a 10% hardware price increase in early April.
Migration of Prisma Cloud customers to Cortex Cloud is still ahead, not yet contributing as strongly as other products.

Guidance & targets

Category	Target	Timeline	Confidence
NGS ARR	$8.9 billion to $8.95 billion high materiality	Q4 · FY26	High
NGS ARR Growth	59% to 60% high materiality	Q4 · FY26	High
RPO	$20.9 billion to $21 billion high materiality	Q4 · FY26	High
RPO Growth	32% to 33% high materiality	Q4 · FY26	High
Revenue	$3.345 billion to $3.355 billion high materiality	Q4 · FY26	High
Revenue Growth	32% high materiality	Q4 · FY26	High
Diluted non-GAAP EPS	$0.96 to $0.98 high materiality	Q4 · FY26	High
NGS ARR	$8.90 billion to $8.95 billion high materiality	FY26	High
NGS ARR Growth	59% to 60% high materiality	FY26	High
RPO	$20.9 billion to $21 billion high materiality	FY26	High
RPO Growth	32% to 33% high materiality	FY26	High
Revenue	$11.415 billion to $11.425 billion high materiality	FY26	High
Revenue Growth	24% high materiality	FY26	High
Operating margins	28.9% to 29.2% high materiality	FY26	High
Diluted non-GAAP EPS	$3.77 to $3.79 high materiality	FY26	High
Adjusted free cash flow margin	37.5% high materiality	FY26	High
Stock-based compensation as % of revenue	return to preacquisition levels medium materiality	Run rate	Medium
CyberArk synergy targets	3 to 6 months ahead of original timeline medium materiality	Ongoing	High
CyberArk profitability convergence	within the next 12 to 18 months medium materiality	Ongoing	High
Free cash flow margin	40% high materiality	FY28	High
Platformizations	surpassing 4,000 high materiality	FY30	High
NGS ARR Target	$20 billion high materiality	FY30	High
Prisma AIRS ARR	$100 million medium materiality	Next couple of quarters	High
Prisma Cloud migration to Cortex Cloud	most Prisma customers migrated low materiality	End of fiscal year · FY26	Medium
Segment-level revenue disclosures	across network security, Cortex, and identity low materiality	Beginning in FY27	High

Segment performance

Segment	Revenue	YoY	QoQ	Margin
Network Security Largest segment, accounting for approximately 70% of total revenue. Delivered its most robust third-quarter performance in years, driven by strong growth in hardware, SASE, and software firewalls. Fueled by strong demand for next-generation firewalls and early AI data center wins. Next-generation firewall bookings growth: nearly 40% YoYSubscription attach: >4 subscriptions per device in installed base	—	—	—	—
SASE Fastest-growing provider in the SASE market, with ARR reaching $1.6 billion, growing 40% year-over-year, more than 2x the overall market growth rate. Strong performance in net new logos and displacement wins. Secure browser scaled to 11 million licenses. ARR: $1.6 billionNet new NGS ARR increase: nearly 50% over TTMDisplacement wins: nearly 50 wins totaling $200 million in contract value YTDSecure browser licenses: 11 million	—	40%	—	—
Software Firewall ARR rose 25% in Q3, accelerating as organizations expand capacity to inspect growing traffic between cloud and AI workloads. Driven in part by the increase in Prisma AIRS and Firewall Flex deals. ARR: up 25% YoY	—	25%	—	—
Americas Saw broad-based growth across all major theaters.	—	32%	—	—
EMEA Saw broad-based growth across all major theaters.	—	32%	—	—
JPAC Saw broad-based growth across all major theaters.	—	26%	—	—

PANW operating KPIs by quarter

PANW operating KPIs stated on its earnings calls, by fiscal quarter
KPI	Jan 2025 Q2 FY25	Apr 2025 Q3 FY25	Jul 2025 Q4 FY25	Oct 2025 Q1 FY26	Jan 2026 Q2 FY26	This call Apr 2026 Q3 FY26	Jul 2026 Q4 FY26	Change vs prior quarter
Customers SASE	5,600+ We now have over 5,600 SASE customers and over 23 million individual seats across our SASE base as well as our GP customers. Source: earnings call transcript	~6,000 We now have approximately 6,000 SASE customers, up 22% year-over-year. Source: earnings call transcript	6,300+ We now have over 6,300 SASE customers and account for 1/3 of the Fortune 500. Source: earnings call transcript	~6,800 We now have approximately 6,800 SASE customers, including 1/3 of the Fortune 500, including leading technology companies like IBM and Oracle. Source: earnings call transcript	—	—	—	—
Remaining performance obligation (RPO)	$13B Total RPO grew 21% to $13 billion at the high end of our guided range. Source: earnings call transcript	$13.5B Our remaining performance obligation, or RPO, grew 19% to $13.5 billion. Source: earnings call transcript	$15.8B Remaining performance obligation, or RPO, grew 24% to $15.8 billion. Source: earnings call transcript	$15.5B Remaining performance obligation, or RPO, grew 24% to $15.5 billion. Source: earnings call transcript	$16B Our remaining performance obligation, or RPO, grew 23% to $16.0 billion. Source: earnings call transcript	$18.4B Our RPO reached $18.4 billion, up 36% compared to last year when adjusting for recent CyberArk and Chronosphere acquisitions, both of which are exceeding expectations in the first quarter postclose. Source: earnings call transcript	$21.2B We achieved record RPO, surpassing the $20 billion threshold for the first time to close the year at $21.2 billion, representing a growth rate of 34%. Source: earnings call transcript	+15.2%
Remaining performance obligation (RPO) Current	$6.1B Our current RPO grew 17% to $6.1 billion. Source: earnings call transcript	$6.2B Our current RPO was $6.2 billion, growing 16% year-on-year. Source: earnings call transcript	$7B Our current RPO was $7.0 billion, growing 17% year-over-year. Source: earnings call transcript	$6.9B Our current RPO, which reflects near-term revenue realization stood at $6.9 billion, representing 16% growth. Source: earnings call transcript	$7.1B Our current RPO, which represents a near-term revenue realization was $7.1 billion, representing 18% growth. Source: earnings call transcript	$8.3B Current RPO was $8.3 billion, up 34% year-over-year. Source: earnings call transcript	$9.3B Current RPO reached $9.3 billion, also up 34% as contract durations remained steady year-over-year. Source: earnings call transcript	+12%
Annual recurring revenue (ARR) Next-Generation Security (NGS)	$4.78B Our NGS ARR again delivered strong growth growing 37%, finishing Q2 at $4.78 billion. Source: earnings call transcript	—	$5.58B We ended the quarter at $5.58 billion in NGS ARR, which grew 32%. Source: earnings call transcript	$5.85B NGS ARR ended the quarter at $5.85 billion, achieving 29% growth and exceeding the high end of our guidance. Source: earnings call transcript	$6.33B The increasing adoption of our platforms is most evident in our next-generation security ARR, which grew 33% to $6.33 billion. Source: earnings call transcript	$8.13B Altogether, we delivered $8.13 billion in NGS ARR during the third quarter, representing 60% year-over-year growth. Source: earnings call transcript	$9.1B NGS ARR reached $9.1 billion, up 63%, enabling us to report one of our most substantial Next-Generation Security outperformances to date. Source: earnings call transcript	+11.9%
Customers XSIAM	—	~270 We now have approximately 270 customers in XSIAM and the average ARR per customer is over $1 million. Source: earnings call transcript	~400 We ended Q4 with approximately 400 customers on XSIAM and the average ARR per customer continues to be over $1 million. Source: earnings call transcript	~470 We now have approximately 470 customers with the average customer paying over $1 million in ARR. Source: earnings call transcript	600+ We welcomed almost 150 new customers, bringing our total base to over 600, paying an average of nearly $1 million in ARR. Source: earnings call transcript	740 We ended the third quarter with more than $600 million in ARR, representing a 100% year-over-year increase across a growing base of 740 customers. Source: earnings call transcript	—	—
Paid seats Prisma Access Browser	—	~3M In just 18 months since our talent acquisition, we have now sold approximately 3 million licensed seats on Prisma Access browser, up more than 10x from a year ago. Source: earnings call transcript	—	7.5M+ In Q1, we crossed 7.5 million browsers sold, while our bookings nearly quadrupled year-over-year. Source: earnings call transcript	—	—	—	—
Annual recurring revenue (ARR) AI	—	~$400M Within NGS ARR, we continue to see significant momentum around our Cortex platform and our AI ARR is now approximately $400 million in Q3, up over 2.5x year-over-year. Source: earnings call transcript	~$545M AI ARR is now approximately $545 million in Q4, up over 2.5x year-over-year. Source: earnings call transcript	—	—	—	—	—
Net revenue retention rate Platformized customers	—	—	—	—	119% The success of this strategy is also reflected in our best-in-class net retention rate amongst platformized customers, which stands at 119% with low single-digit churn. Source: earnings call transcript	120% This is reflected in our 120% net retention and single-digit churn rates amongst this cohort. Source: earnings call transcript	120%+ Beyond initial adoption, standardizing our platform yields superior retention and expansion, with NRR or net revenue retention exceeding 120% for our platformized cohort in Q4. Source: earnings call transcript	—

Operating figures the company stated on at least two of the calls shown, checked against each call's transcript. Click a figure to read the sentence. A dash means it was not stated that quarter.

Orderbook & backlog

Total RPO $18.4 billion Q3 FY26

36% YoY growth

Includes $1.8 billion from CyberArk and Chronosphere.

Organic RPO $16.6 billion Q3 FY26

22% YoY growth

Excludes $1.8 billion from CyberArk and Chronosphere.

Current RPO $8.3 billion Q3 FY26

34% YoY growth

Organic Current RPO $7.2 billion Q3 FY26

17% YoY growth

Excludes impact from CyberArk and Chronosphere; an acceleration versus 15% in Q2.

Hardware backlog record levels Q3 FY26

Record levels for a Q3 quarter, contributing to NGS ARR.

Product announcements

Product	Type	Timeline	Details
Unit 42 frontier AI Defense	launch	Q3 FY26
Idira	launch	Last month (May 2026)

Deals & partnerships

CyberArk acquisition

Acquisition exceeding expectations in the first quarter post-close. Integration efforts are driving tangible results, including the launch of Idira and streamlining operations.

Chronosphere acquisition

Acquisition exceeding expectations in the first quarter post-close. Observability ARR nearly doubled since acquisition announcement.

Koi acquisition

Acquisition to expand agentic endpoint security as AI tools proliferate across the edge.

PortKey acquisition

Acquisition of a leading AI gateway processing trillions of tokens monthly, providing a critical enforcement point to monitor requests and apply real-time policy to agent-to-agent interactions.

Risks & headwinds

Rising component costs (memory and storage) Q4 and fiscal 2026 outlook

10% price increase on hardware in early April

Mitigation:Higher recurring revenue mix acts as a natural hedge; vendors view as critical infrastructure provider; evaluating alternative sources of supply, extending purchase commitments; further pricing actions.

Stock-based compensation (SBC) Next 12 to 18 months

17% of revenue in Q3

Mitigation:Expect SBC as a percentage of revenue to return to preacquisition levels on a run rate basis in approximately 12 to 18 months.

GAAP net loss due to acquisition-related costs Q3 FY26

GAAP net loss per share of $0.22

Mitigation:Non-GAAP results adjust for SBC and one-time items; integration efforts are ahead of schedule for profitability convergence.

Prisma Cloud migration to Cortex Cloud Next 6 months; by end of fiscal year

not contributing as well as some of the other products

Mitigation:Making steady progress; anticipate most Prisma customers will be migrated to Cortex Cloud by the end of the fiscal year.

Q&A highlights

How much is AI data center demand contributing to network security, and how are other customers adapting their network security for AI traffic growth?

Nikesh highlighted that increased traffic inspection needs due to AI data centers and frontier labs are driving multi-year tailwinds for hardware, which is the cheapest and fastest throughput mechanism. He noted a 50% increase in demand for the industry, expecting the trend to continue for several quarters or years.

“I think the multiyear tailwind will come from the fact that more and more data needs to be stored both by organizations, needs to be used for training all these frontier labs out there. And you can see the explosion of data centers being built, whether it's by hyperscalers, frontier labs, or neoclouds out there.”

asked by Saket Kalia · answered by Nikesh Arora

3 min read 7 chapters

Detailed narrative

AI's Impact on Cybersecurity Landscape

The emergence of 'Mythos' and agentic AI systems fundamentally redefines cybersecurity, compressing attack timelines from months to minutes. This necessitates a shift from legacy query-based tools to AI-driven, real-time defensive platforms. Palo Alto Networks is positioning itself as a leader in this new era, leveraging its extensive sensor network of over 125 million sensors and platformization strategy to counter machine-speed threats.

The company believes this shift has increased the terminal value of the entire cybersecurity industry.

Platformization Strategy and Customer Adoption

The company's platformization strategy is gaining significant traction, securing 110 net new platformizations in Q3, including 20 from recent acquisitions like CyberArk and Chronosphere. With approximately 2,280 total platformized customers, these engagements demonstrate deep architectural commitments, leading to superior long-term retention and expansion, reflected in 120% net retention and single-digit churn rates among this cohort.

Palo Alto Networks remains confident in surpassing 4,000 platformizations by fiscal 2030, which is expected to drive momentum towards its $20 billion NGS ARR target.

Network Security Resurgence

Network security, the largest business unit accounting for approximately 70% of total revenue, delivered its most robust third-quarter performance in years. This momentum was driven by strong growth in hardware, SASE, and software firewalls. Next-generation firewall bookings rose nearly 40% year-over-year, fueled by early AI data center build-outs and new classes of buyers, including sovereign infrastructure providers and AI labs.

The company's subscription attach rate remains strong, averaging more than 4 subscriptions per device within its installed base.

Prisma AIRS and AI Security Platformization

Prisma AIRS is the fastest-growing product in the company's history, tripling its customer count to over 300 in Q3, with clear visibility towards $100 million in ARR over the next couple of quarters. The company is building an end-to-end AI security platform, integrating identity security to govern agent access, observability to trace agent behavior, and agentic endpoint security (via the Koi acquisition) to protect AI tools proliferating at the edge.

The recent acquisition of PortKey further enhances real-time policy enforcement for agent-to-agent interactions.

XSIAM and Observability Leadership

XSIAM remains the primary response to emerging frontier model threats, ending Q3 with over $600 million in ARR, representing a 100% year-over-year increase across a growing base of 740 customers. It processes more than 17 petabytes of daily telemetry, enabling the majority of customers to respond to threats in under 10 minutes.

Chronosphere, the observability platform, surpassed $300 million in ARR, nearly doubling since its acquisition announcement, validating its ability to scale alongside AI workloads and attracting leading AI natives, including two of the top five frontier labs.

CyberArk Integration and Identity Security

In its inaugural quarter post-close, CyberArk surpassed internal benchmarks, with joint go-to-market efforts initiating approximately 1,000 cross-organizational engagements. The company launched Idira, a next-generation identity platform, which democratizes modern PAM controls and extends protection to agentic identities, addressing a critical future attack vector.

The integration is progressing 3 to 6 months ahead of the original timeline for profitability convergence, which is now expected within the next 12 to 18 months, reinforcing the path towards a 40% free cash flow margin in fiscal 2028.

Financial Strength and Capital Allocation

Palo Alto Networks demonstrated strong financial performance, with a Q3 non-GAAP operating margin of 21.3% and adjusted free cash flow of $910 million, a 57% increase year-over-year. The trailing 12-month adjusted non-GAAP free cash flow margin reached 38.5%, a 430 basis point improvement year-over-year, even with recent acquisitions.

This robust cash generation supports an opportunistic share repurchase program, with $1 billion used to buy back 6.8 million shares in Q3, and $1 billion remaining under the existing authorization.

Summary of the company's earnings call; see how call summaries are prepared. Not investment advice.