Palo Alto Networks Q3 FY26 earnings call PANW

The emergence of 'Mythos' and agentic AI systems fundamentally redefines cybersecurity, compressing attack timelines from months to minutes. This necessitates a shift from legacy query-based tools to AI-driven, real-time defensive platforms. Palo Alto Networks is positioning itself as a leader in this new era, leveraging its extensive sensor network of over 125 million sensors and platformization strategy to counter machine-speed threats. The company believes this shift has increased the terminal value of the entire cybersecurity industry.

The company's platformization strategy is gaining significant traction, securing 110 net new platformizations in Q3, including 20 from recent acquisitions like CyberArk and Chronosphere. With approximately 2,280 total platformized customers, these engagements demonstrate deep architectural commitments, leading to superior long-term retention and expansion, reflected in 120% net retention and single-digit churn rates among this cohort. Palo Alto Networks remains confident in surpassing 4,000 platformizations by fiscal 2030, which is expected to drive momentum towards its $20 billion NGS ARR target.

Network security, the largest business unit accounting for approximately 70% of total revenue, delivered its most robust third-quarter performance in years. This momentum was driven by strong growth in hardware, SASE, and software firewalls. Next-generation firewall bookings rose nearly 40% year-over-year, fueled by early AI data center build-outs and new classes of buyers, including sovereign infrastructure providers and AI labs. The company's subscription attach rate remains strong, averaging more than 4 subscriptions per device within its installed base.

Prisma AIRS is the fastest-growing product in the company's history, tripling its customer count to over 300 in Q3, with clear visibility towards $100 million in ARR over the next couple of quarters. The company is building an end-to-end AI security platform, integrating identity security to govern agent access, observability to trace agent behavior, and agentic endpoint security (via the Koi acquisition) to protect AI tools proliferating at the edge. The recent acquisition of PortKey further enhances real-time policy enforcement for agent-to-agent interactions.

XSIAM remains the primary response to emerging frontier model threats, ending Q3 with over $600 million in ARR, representing a 100% year-over-year increase across a growing base of 740 customers. It processes more than 17 petabytes of daily telemetry, enabling the majority of customers to respond to threats in under 10 minutes. Chronosphere, the observability platform, surpassed $300 million in ARR, nearly doubling since its acquisition announcement, validating its ability to scale alongside AI workloads and attracting leading AI natives, including two of the top five frontier labs.

In its inaugural quarter post-close, CyberArk surpassed internal benchmarks, with joint go-to-market efforts initiating approximately 1,000 cross-organizational engagements. The company launched Idira, a next-generation identity platform, which democratizes modern PAM controls and extends protection to agentic identities, addressing a critical future attack vector. The integration is progressing 3 to 6 months ahead of the original timeline for profitability convergence, which is now expected within the next 12 to 18 months, reinforcing the path towards a 40% free cash flow margin in fiscal 2028.

Palo Alto Networks demonstrated strong financial performance, with a Q3 non-GAAP operating margin of 21.3% and adjusted free cash flow of $910 million, a 57% increase year-over-year. The trailing 12-month adjusted non-GAAP free cash flow margin reached 38.5%, a 430 basis point improvement year-over-year, even with recent acquisitions. This robust cash generation supports an opportunistic share repurchase program, with $1 billion used to buy back 6.8 million shares in Q3, and $1 billion remaining under the existing authorization.