PANW
Earnings call · Oct 2025 (Q1 FY26)

Palo Alto Networks Q1 FY26 earnings call PANW

Nov 19, 2025 Source

Executive summary

Palo Alto Networks Q1 FY26 — Strong Start with Platformization and Strategic Acquisitions

Palo Alto Networks delivered a strong Q1 FY26, surpassing expectations across all key metrics driven by robust demand and continued customer platformization. The company is strategically expanding its market opportunity through the acquisitions of CyberArk and Chronosphere, aiming to address critical inflection points in identity and observability, particularly in the AI era. Management reiterated its long-term financial model, targeting 40%+ free cash flow margins by FY28.

Highlights

5

  • Remaining Performance Obligation (RPO) grew 24% year-over-year to $15.5 billion.

  • Next-Generation Security (NGS) ARR grew 29% year-over-year to $5.85 billion, exceeding the high end of guidance.

  • Total revenue reached $2.47 billion, representing 16% growth and exceeding the high end of the guided range.

  • Non-GAAP operating margin expanded 140 basis points year-over-year to 30.2%, marking the second consecutive quarter above 30%.

  • Adjusted free cash flow came in at $1.7 billion, up 17%.

Concerns

4

  • AI-driven cyberattacks

  • Enterprise AI security gap

  • Quantum computing breaking current encryption

  • Insider threat from AI agents

Guidance & targets

CategoryTargetConfidence
NGS ARR
$6.11B to $6.14B
high materiality
High
Remaining Performance Obligation (RPO)
$15.75B to $15.85B
high materiality
High
Revenue
$2.57B to $2.59B
high materiality
High
Diluted non-GAAP EPS
$0.93 to $0.95
high materiality
High
NGS ARR
$7B to $7.1B
high materiality
High
Remaining Performance Obligation (RPO)
$18.6B to $18.7B
high materiality
High
Revenue
$10.50B to $10.54B
high materiality
High
Operating Margin
29.5% to 30%
medium materiality
High
Diluted non-GAAP EPS
$3.80 to $3.90
high materiality
High
Adjusted Free Cash Flow Margin
38% to 39%
high materiality
High
Adjusted Free Cash Flow Margin
40%+
high materiality
High
Adjusted Free Cash Flow Margin (inclusive of acquisitions)
at least 37%
high materiality
High
ARR Target
$20B
high materiality
High
Product Revenue Growth
approximately 17% to 18%
medium materiality
High
Capital Expenditure (CapEx)
$130M to $140M
medium materiality
High

Operational metrics

NGS ARR
$5.85B 29% YoY
Q1 FY26

Exceeded the high end of guidance.

Net New NGS ARR (adjusted for QRadar)
20% YoY
Q1 FY26

Adjusting for $74 million contribution from QRadar acquisition in comparable prior period.

SASE ARR
$1.3B 34% YoY
Q1 FY26

Fastest-growing SASE provider at scale.

SASE Customers
6,800
Q1 FY26

Includes leading technology companies like IBM and Oracle.

Secure Browsers Sold
7.5M
Q1 FY26

Crossed 7.5 million browsers sold.

Secure Browser Bookings
nearly quadrupled YoY
Q1 FY26

Strong momentum in secure browsers.

Product Revenue Growth
23% YoY
Q1 FY26

Fueled by growth in software firewalls and PAN-OS SD-WAN.

Product Revenue from Software Form Factors
44% up from 38% TTM Q1 FY25
TTM Q1 FY26

Nearly half of product revenues are driven by software form factors.

Software Firewall Customers
12,500
Q1 FY26

Maintains leading market position in software firewalls.

AI Deals
more than doubled vs last quarter
Q1 FY26

Early customer traction is strong, reflecting genuine market needs.

XSIAM Customers
470
Q1 FY26

Includes large referenceable customers in every major industry.

XSIAM Average Customer ARR
$1M
Q1 FY26

Average customer paying over $1 million in ARR.

XSIAM Telemetry Processed
15 petabytes
daily

Processing 15 petabytes of telemetry on a daily basis.

XSIAM MTTR Reduction
>60%
Q1 FY26

Over 60% of deployed XSIAM customers have reduced their median time to respond.

Net New Platformizations
60
Q1 FY26

Momentum driven by strength in XSIAM.

XSIAM Platformizations
more than doubled YoY
Q1 FY26

Affirming customers are actively moving towards simplicity and integration.

Customers with NGS ARR over $5M
170 about 50% YoY growth
Q1 FY26

Reinforces target of $20 billion in NGS ARR by FY30.

Customers with NGS ARR over $10M
50 about 50% YoY growth
Q1 FY26

Reinforces target of $20 billion in NGS ARR by FY30.

Total Gross Margin
76.9%
Q1 FY26

Reflects disciplined focus on profitability.

Product Gross Margin
80.2% 50 bps YoY increase
Q1 FY26

Reflected significant sequential improvement.

Services Gross Margin
76.2% 70 bps sequential increase
Q1 FY26

Demonstrated positive margin trajectory.

Operating Margin
30.2% 140 bps YoY expansion
Q1 FY26

Second consecutive quarter above 30%.

Cash and Investments Balance
over $10B
end of Q1 FY26

Cash and cash equivalents at the end of the first quarter.

Share Repurchase Authorization Remaining
$1B
through December 2026

Buyback strategy remains opportunistic; no shares repurchased in Q1.

Americas Revenue Growth
14% YoY
Q1 FY26

Broad-based strength across all major theaters.

EMEA Revenue Growth
18% YoY
Q1 FY26

Broad-based strength across all major theaters.

JAPAC Revenue Growth
22% YoY
Q1 FY26

Broad-based strength across all major theaters.

Customer Support Case Volume Reduction
3 consecutive quarters
Q1 FY26

Driven by AI deployment in global customer support organization.

Customer Support Time to Resolve Reduction
11 consecutive quarters
Q1 FY26

Driven by AI deployment in global customer support organization.

Industry KPIs

MetricValueDetails
Capacity CAPEX$130M-$140M USD
Revenue growth$2.47B USD
Arr net new arr$5.85B USD
Rpo current rpo$15.5B USD
Bookings billingsnearly quadrupled
Customer account count6,800 customers
Large deal new logo metrics170 customers
Operating FCF margin rule of 4030.2% %
Ai product adoption monetizationmore than doubled

Orderbook & backlog

Remaining Performance Obligation (RPO) $15.5B end of Q1 FY26

24% YoY growth

Key indicator of long-term revenue predictability and scale of committed business.

Current Remaining Performance Obligation (cRPO) $6.9B end of Q1 FY26

16% YoY growth

Reflects near-term revenue realization.

Product announcements

ProductTypeDetails
Prisma AIRS 2.0launch
PAN-OS 12.1 Orionlaunch
Fifth generation of firewallslaunch
AgentiXlaunch

Deals & partnerships

Protect AI Acquisition of AI security platform.

Acquisition of Protect AI is now fully integrated into Prisma AIRS 2.0, enhancing AI security capabilities.

CyberArk Acquisition for identity security.

Integration plans remain fully on track, with overwhelming shareholder support received. Aims to democratize identity security and make identity the next platform for Palo Alto Networks.

Chronosphere Acquisition for observability solution. $3.35B

Total consideration of $3.35 billion in cash and replacement equity awards. Co-founders and employees will join Palo Alto Networks. Chronosphere is expected to remain largely stand-alone post-close. Acquisition includes Calyptia, a data pipeline provider, which will integrate with XSIAM.

NVIDIA Collaboration to secure AI factory.

Collaboration with NVIDIA to secure the AI factory with Prisma AIRS on BlueField.

Glean, IBM, Factory, ServiceNow Integrations for securing AI workflows.

Tight integrations with platforms like Glean, IBM, Factory, and ServiceNow in securing the exploding number of agentic AI workflows.

IBM Deepening partnership for Quantum-safe readiness and remediation service.

To deliver a complete end-to-end solution for Post-Quantum Cryptography (PQC) migration.

U.S. cabinet agency SASE deal. $33M

Displaced a major SASE incumbent as the agency needed a platform to provide unified visibility across both their firewall estate and remote endpoints.

large U.S. telecom provider XSIAM deal. $100M

Customer chose Palo Alto Networks to consolidate their disparate point products based on the platform's ability to deliver materially faster mean time to respond.

Risks & headwinds

AI-driven cyberattacks current

First reported case of an AI agent autonomously conducting a large-scale nation-state cyber attack.

Mitigation:Platformization, real-time visibility and security, Prisma AIRS, AgentiX.

Enterprise AI security gap current

94% of organizations embracing AI transformation still lack necessary security guardrails.

Mitigation:Prisma AIRS 2.0, identity security (CyberArk integration) to provide essential privilege controls.

Quantum computing breaking current encryption by 2029

Enterprises have less than 5 years to get their states to quantum readiness; quantum computing expected to be commercialized by 2029.

Mitigation:Comprehensive quantum-safe strategy (PAN-OS Orion, Gen 5 firewalls, cipher translation), IBM partnership for PQC migration.

Insider threat from AI agents current/future

AI agents will become a problematic insider threat if not secured.

Mitigation:Prisma AIRS as essential circuit breaker layer, CyberArk integration for identity security to prevent agent identity impersonation.

What to watch in Q2 FY26

CyberArk acquisition close

fiscal Q3 FY26
Current Integration planning on track, shareholder support received.
Target Acquisition closes.

Why it matters

Critical for PANW's expansion into identity security and achieving long-term financial targets.

I am pleased to announce our CyberArk integration plans remain fully on track, and we're proud to have received overwhelming shareholder support for the acquisition, which is now expected to close in fiscal Q3.

Q&A highlights

How will Palo Alto Networks disrupt itself to remain a winner in the AI and quantum future, beyond just smart M&A?

Nikesh highlighted that network inspection remains critical as AI drives more data volume. He pointed to XSIAM's success in data-driven security and the proactive quantum-safe strategy. He emphasized that the company aims to be an 'evergreen' technology company by positioning products in key technology trends, noting that the need for bit inspection technologies will not go away.

“I don't think I know any company in recent history in cybersecurity, which has an average ARR per customer of $1 million on a product category.”

asked by Brad Zelnick · answered by Nikesh Arora

2 min read 5 chapters

Detailed narrative

AI Threat Landscape and Platformization

The threat landscape is rapidly evolving due to AI, with autonomous AI agents already conducting cyberattacks, as evidenced by a recent nation-state attack. This reality necessitates a paradigm shift from fragmented security to platformization, as AI exposes architectural cracks and demands real-time visibility and security. Palo Alto Networks' platform approach aims to provide a seamless cyber data strategy, reducing latency in detection and remediation, which is critical against fast-moving AI attackers.

Strategic Acquisitions and Market Expansion

The company is making strategic acquisitions, including CyberArk for identity security and Chronosphere for observability, to expand its total addressable market (TAM) and address AI-driven inflection points. These acquisitions are expected to contribute to the raised FY30 ARR target of $20 billion, up from $15 billion, by leveraging Palo Alto Networks' go-to-market scale and integrating best-in-class technologies. Chronosphere, with over $160 million in ARR and triple-digit growth, is seen as a key entry into the observability market, which is crucial for AI-era compute at gigawatt scale.

Quantum Security Initiative

Palo Alto Networks has launched a comprehensive quantum-safe strategy to address the threat of quantum computing breaking current encryption. This includes PAN-OS 12.1 Orion for automated cryptographic risk inventory, new fifth-generation firewalls optimized for quantum security, and unique cipher translation capabilities to make legacy systems quantum-safe immediately. A deepened partnership with IBM will deliver an end-to-end Post-Quantum Cryptography (PQC) migration service, highlighting the urgency for enterprises to achieve quantum readiness within five years.

XSIAM and AgentiX Momentum

Cortex's XSIAM continued its strong trajectory in Q1, now serving approximately 470 customers with an average ARR of over $1 million per customer, processing 15 petabytes of telemetry daily. Over 60% of deployed XSIAM customers have reduced their mean time to respond (MTTR) from days/weeks to minutes. The company also announced AgentiX, which brings powerful AI agents directly to enterprise security challenges, aiming to transform security operations by deploying autonomous AI agents for enhanced speed, efficiency, and control, addressing alert fatigue and talent shortages.

Software Firewalls and SASE Growth

Software firewalls are emerging as a 'hidden gem,' now accounting for 44% of trailing 12-month product revenues, up from 38% in Q1 FY25, and growing 23% year-over-year. This growth is driven by increasing cloud workloads and AI transformation, with over 12,500 software firewall customers. SASE also had a phenomenal quarter, with ARR growing 34% year-over-year to surpass $1.3 billion, making Palo Alto Networks the fastest-growing SASE provider at scale with approximately 6,800 customers, including one-third of the Fortune 500.

AI-generated summary of the company's earnings call. Not investment advice.