CrowdStrike & Palo Alto Earnings Reviews

1. Palo Alto (PANW) – Earnings Review

Throughout this article I am going to be using a lot of acronyms that describe various Palo Alto products. Definitions for all of them, and a brief overview of the business, can be found in my company introduction (the 101) here. 

a. Key Points

• Nice organic acceleration for remaining performance obligations.
• CyberArk integration is ahead of schedule.
• Expects operating leverage to resume soon.
• Best quarter for network security in years.

b. Demand

• Beat revenue estimate & guidance by 2% each. Organic revenue growth was 14% compared to 15% last year.
• Beat Remaining Performance Obligation (RPO) estimate & guidance by 2.7% each.
  • Organic bookings growth was 22% compared to 19% last year.
• Beat next-gen security annual recurring revenue (NGS ARR) estimate by 3.7% & beat guidance by 2.3%.
  • Organic NGS ARR growth was 28% compared to 34% last year.

It’s worth noting that PANW’s product revenue is high quality. It features software firewalls and its AI runtime security offering that are both strong structural growth contributors. 46% of product revenue is from software compared to 22% 3 years ago as this bucket gets more compelling.

c. Profitability

• Missed 76.2% GPM estimate by 40 basis points (bps; 1 basis point = 0.01%).
• Beat EBIT estimate by 4.9%.
• Beat $0.79 estimate & guidance by $0.06 each.
• Beat FCF estimate by 17%.
• GAAP margins were heavily impacted by M&A-related costs (comp and integration costs).

They blamed some of the Y/Y margin softness on memory inflation but feel they’re well positioned to drive renewed operating leverage going forward. Hardware (where memory inflation has an impact) is only 10% of total revenue and they have been able to implement price hikes as well as finding different sources of supply.

d. Balance Sheet

• $3.1B cash & equivalents.
• $3.9B long-term investments.
• $1.3B convertible senior notes.
• 13.3% Y/Y dilution (M&A). Stock comp was 17% of revenue and will remain elevated before normalizing over the next 6 quarters. They bought back $1B in stock during the quarter and have another $1B in buybacks remaining ($227B market cap).

e. Q4 Guidance & Valuation

• Raised revenue guidance by 2.1%, which beat estimates by 2%.
• Raised RPO guidance by 2.1%, which beat estimates by 3.5%. This was thanks to “accelerated organic bookings growth, early M&A integration progress and a strong pipeline.”
• Raised $0.935 EPS guidance by $0.035, which beat by $0.03.

PANW trades for 74x forward EPS and 47x forward FCF. EPS is expected to grow by 13% this year and by 9% next year. FCF is expected to grow by 25% this year and by 20% next year.

f. Call & Investor Materials

AI Disruption Risk:

Palo Alto leadership feels well insulated from AI-native disruption risk. In the world of cybersecurity, getting as close to perfection as possible is especially important. Small mistakes can lead to global outages or stolen assets that can quickly cripple an organization. These mistakes become unacceptably frequent when relying solely on model-based solutions to protect within complex and weird edge cases. The best models frequently hallucinate and have 25% false positive rates on their own, meaning they’re finding vulnerabilities that aren’t there and missing ones that are. Like so many other software platforms this season, Palo Alto discussed how its vast base of data and experience are needed ingredients to pair with promising models and turn their potential into reliable value. Everyone will have access to the same models, but not everyone will have access to the same data and context to customize and more effectively train these models. That’s where PANW can sustainably stand out, thanks to its sector-leading scale for daily petabytes of data ingested. Models need to be a piece of the equation to bolster automation, detection speed, remediation efficiency and more. But they cannot be the only piece. Palo Alto’s presence is a guiding force needed to ensure favorable outcomes where things matter most.

All of this relies on massive scale and platform-wide adoption, which PANW is effectively delivering. It’s this interoperable, cross-use case presence – throughout endpoint, cloud, network and identity – that tears down product and data silos and makes everything work better. During the quarter, Palo Alto completed 120 new platformizations (20 were from CyberArk and Chronosphere M&A). 

• Chronosphere is the observability platform that Palo Alto purchased. CyberArk is the identity platform that Palo Alto purchased.

Platformizations refer to customers fully opting into one of the firm’s various product pillars (identity, network, endpoint, cloud). They’re higher-quality customer relationships with better retention, larger ARR contributions and a 120% net revenue retention rate for the cohort. Palo Alto remains well on track to complete 4K Platformizations by fiscal year 2030, which helped them reiterate their $20B NGS ARR by fiscal year 2030 guidance. Large deals during the quarter include a $200M+ ARR (and rising) expansion with a “leading frontier AI lab” for Chronosphere’s observability offering and an $80M deal with a “leading utility company powering the AI data center buildout.” All in all, $5M NGS ARR customers rose 51% Y/Y to 195 and $10M NGS ARR customers rose 49% Y/Y to 67.

Palo Alto sees Anthropic’s highly anticipated new Mythos model as great for the industry for a few reasons. First, it’s going to have a dramatic impact on lowering the bar to conduct sophisticated, rapid attacks. Hacks that took months of manual labor to construct can now be formed in minutes while asset and data traffic explode and create a vastly larger overall attack surface. That’s the perfect storm for trusted, high-quality security products in the areas where Palo Alto is a leader. Furthermore, PANW can also use this to vastly bolster its own speediness in breach prevention and clean-up, which will be a pre-requisite in this new age. And considering they’ll have these models long before potential adversaries, they have a good chance to always be staying one step ahead – as long as they continue to sprint.

As part of the Mythos limited release under Project Glasswing, PANW debuted Unit 42 as a new team of incident response specialists and researchers to help organizations with their security hygiene. Interest in this new initiative was called very strong, with 1,200 customer meeting requests in the weeks following the announcement.

Network Security Strength:

Leadership called this Palo Alto’s best network security quarter in years, which is especially notable after a rather lackluster quarter from Zscaler. Security Access Service Edge (SASE) ARR accelerated from 36% Y/Y in last year’s Q3 to 40% this quarter to reach $1.6B. Competitive displacements also rose 56% Y/Y, with $200M in year-to-date contract value won from competition. Its Secure Browser (from the Talon acquisition) offering within SASE was highlighted as a standout, as it added another 2 million licenses sequentially after adding 1.5M last quarter. Great momentum here.

The firewall business, both for hardware and software, is also performing extremely well. On the software side, ARR rose by 25% Y/Y just like last quarter. On the hardware side, leadership called this the best performance in a decade. This is being helped by hardware refresh cycles, but it is still impressive nevertheless. And while cycle timing isn’t a structural tailwind, the explosion in agentic traffic from AI is leading to a lot of hardware-based demand as customers seek to control data inspection costs. Furthermore, their hardware contracts include 4 subscriptions on average, which naturally improves stickiness and recurring revenue dynamics. All of this alongside software strength led to overall firewall bookings growth moving to 19% Y/Y this year up from 9% last year and 11% last quarter.

Cortex (Endpoint Security):

XSIAM has been killing it for the company and that was again true this quarter. ARR for the product rose 100% Y/Y to $600M, while customers rose 150% Y/Y and daily data ingestion rates rose by 50% Y/Y. As that last metric continues to compound, the important information network effect PANW will rely on to differentiate in a world where everyone has the same models will strengthen. It will also spin an enticing flywheel by motivating more customers to join the ecosystem thanks to naturally better PANW products and more 3rd party data to use.

Palo Alto has positioned Cortex to safeguard core endpoint infrastructure from emerging AI threats. This capability was undoubtedly bolstered by another acquisition of a company called Koi. As discussed last quarter, Koi is a specialist at ensuring agents (another form of endpoint) can honor Model Context Protocol (MCP; standardized means for agentic interaction with data and apps) rules. This was a talent missing from Palo Alto’s XDR (already defined in the 101) offering and was an important gap to plug. Early on, interest in this acquired capability was called strong, with a pipeline of 150+ customers.

And now, Palo Alto has a high-quality observability tool that can help scalably ingest and use mountains of telemetry (continuous stream of operational data) to improve Cortex’s endpoint capabilities. PANW’s XDR product relies on an ability to tap into vast quantities of diverse 1st- and 3rd-party data, which is where Chronosphere will come into play. Impressively, observability added $100M in net new ARR during the quarter to move from $200M to $300M total. This performance was materially better than PANW was hoping for internally, thanks to a lot of incremental consumption from an AI model customer migrating to its platform. It now has 2 of the top 5 AI labs in its customer base. The need for sound observability inherently rises as AI fosters a boom in app creation, data processing traffic, and permission requests. All of these things need monitoring, organization, iterating and optimizing, with Chronosphere an emerging leader in this regard. Just like for CyberArk (which we’ll get to in a moment), there is a giant customer roster ripe for cross-selling and every reason to believe the demand will be there. This is looking like an awesome purchase for a company with a long track record of effective M&A.

Palo Alto spoke about the need for separate security and observability offerings that are each elite on their own. They think most competitors that do both are very good at one, but feel Chronosphere will allow them to be best-in-class for both pillars. They have big plans for observability and security roadmaps to ensure neither part of this formula falls behind.

• Cortex AgentiX (its platform for building, managing and deploying security agents) will soon be extended to its Observability offering. 
• Chronosphere’s ongoing ability to cut observability costs in half for clients is motivating many to replace home-grown solutions they thought they’d never cut.

Identity Security:

The large CyberArk acquisition is off to a great start. The business is performing very well, with 27% Y/Y ARR growth ($1.3B total) and Palo Alto has already had 1,000 cross-company client engagements. PANW already knows cross-sell interest would be high, but it’s always good to see those hopes coincide with promising leading indicators. Furthermore, integration efforts have been smooth, with expected synergies now set to come 1-2 quarters earlier than previously assumed. They’ve identified 300 3rd-party vendors to displace (20% through the process) and 40 CyberArk facilities that it no longer thinks it will need.

In terms of a roadmap, the combined organization debuted “Idira” last month as its identity platform. It features privileged asset management (PAM) and leading agentic identity security offerings thanks to CyberArk. It also pulls directly from Prisma AI Runtime Security (more later) to enhance the acquired technology with more telemetry and coverage. This supports leadership's view that its identity offering more completely serves both human and machine identities than competing offerings. They expect (and so do most) identity to be an important piece of the security equation, as again, enterprise agents are just another form of identity and are expected to exponentially grow in size from here.

Prisma AI Runtime Security (AIRS):

Prisma AIRS has emerged as a leading platform for protecting AI assets. It spans networks, endpoints and cloud environments, but with a specific focus on these next-generation assets, rather than the core endpoints and network traffic that its other pillars handle. The product is about a year old while several important features like AI model scanning and agent observability were added more recently. Despite that, the product is already six months away from reaching $100M in ARR. Palo Alto is seeing enterprise AI mature from project to commercial deployment, which will directly support more growth for this product. An entirely new asset class for PANW to protect.

g. Take