Table of Contents

1. Datadog (DDOG) – Q3 2025 Earnings Review

a. Datadog 101

Core Product Niche:

This is a dominant player in the data observability space. Observability simply refers to monitoring an entire digital ecosystem to track issues, vulnerabilities and performance. Other players within this area include the hyper-scalers, Splunk, Elastic, CrowdStrike (through M&A) and many more. Datadog splits its observability niche into various buckets.

Bucket #1 – Infrastructure monitoring: provides a holistic view of assets like servers and networks to automate insight collection. Knowledge is power, and so this organized surveillance has a way of expediting the uncovering and fixing of issues. It helps optimize usage of compute and eliminate hardware performance bottlenecks. Optimization routinely means lower total cost of ownership for DDOG customers.

Bucket #2 – Log management: collects and manages logs or “timestamped records of events.” This also facilitates faster issue remediation and performance optimization. This product routinely complements infrastructure-based monitoring with its event-based support for things like customer service interactions.

  • Flex Logs: A cost-effective means to store and retain large batches of logs by separating storage and query usage. Separation makes compliance & storage more efficient, while augmenting data scalability and query breadth. Conversely, flex log querying is slow. That makes this better for lower priority data and where latency is not a crippling bottleneck. They recently added “Flex Frozen” logs with 7 years of storage.

Bucket #3 – Application Performance Monitoring (APM): Tracks app performance and uncovers/prioritizes performance issues to be remediated. The firm is rounding out developer tools to help them customize existing DDOG apps and models with their own data and work. It recently added a “Latency Investigator” to automate forensic investigations and expedite root cause analysis and “Proactive App Recommendations” to turn insights into actionable plans.

Bucket #4 – Digital Experience Monitoring: This is exactly what it sounds like. This product includes real-time user monitoring (RUM) to track precise, observed interactions, and Datadog Synthetics, which provides a simulation of expected observed interactions. Here, Datadog delivers detailed churn analysis, engagement metrics, feature testing, user journey reports etc. It also recently introduced mobile app testing. Users can now conduct this testing right from their actual mobile phones. Finally, this segment features product analytics that allow clients to directly trace application behavior such as feature adoption, engagement and retention to see how tweaking an experience directly impacts the overall business. This includes split testing capabilities to experiment before deploying changes. It helps turn RUM and Datadog Synthetics work into tangible business insights.

These four product categories, which frequently work together, form its “unified platform.”

Other Product Categories – Security:

Because Datadog already handles network viability, security is a very relevant growth adjacency. Here are some important security products to know:

  • Cloud Infrastructure Entitlement Management (CIEM) sets strict, minimum access identity controls, cutting risk of identity attacks in the cloud.

  • Security Information and Event Management (SIEM) product enables “long-term data log visualization for security investigations.” It’s helpful for broad threat management use cases. This can be done without dedicated staff, making cloud migration and usage easier. 

  • Application security and code security offerings cater to use cases across the development, security and operations (DevSecOps) lifecycle. Datadog has been a large player in the Ops section (and increasingly Sec too). Code security is moving into the Dev section more meaningfully, or moving “further left” towards developers.

  • It also has some data loss prevention scanning to flag, monitor and protect sensitive data. This supports every other security product. Most recently, it added agentless environment scanning (no security agent installation needed) to match with its agent-based product.

    • They’ve retrofitted these data scanners for large language models (LLMs) and agents.

Other Product Categories – AI:

Toto is the name of its large language model (LLM) and Bits AI is its suite of agentic tools. This includes the Bits AI Agents for software development, security and data analytics that all automate manual work within their respective categories. It also includes the site reliability engineer (SRE) agents (in limited access). These fully handle alert response, triaging and remediation, while offering fixes to and actionably resolving code bugs. It streamlines work within DDOG’s core product pillars to extract more productivity gains. It also added dedicated security agents to investigate, propose remediation plans and fix vulnerabilities in apps and source code. Developers can implement these fixes right from their mobile devices. 

Its Model Context Protocol (MCP) ensures autonomous agents can fetch the data they need from a wide array of sources across the web. This helps broaden available context to expedite root cause analysis of various issues. Early integration partners include Cursor, OpenAI and Anthropic. With Cursor and OpenAI specifically, the new integrations allow DDOG products to be used within the integrated developer environments (IDEs) of each form. It’s available for some customers, but not yet fully released. It can summarize incidents and conversationally field questions. It’s also rolling out autonomous investigations to remove the manual work from uncovering issues with infrastructure, large language models, apps, usage patterns etc.

And unsurprisingly, it also tweaked and configured its core products to cater to LLM observability. New offerings for this asset class include prompt injection protection and data poisoning prevention.  The first guards against hackers inundating models with poor data to lower output quality; the second insulates companies from adversaries attempting to actually manipulate training data.

Other Product Categories – Incident Management:

Finally, Datadog offers an incident management suite. This includes Datadog On-Call, which alerts (or pages) engineers about various issues and Incident Management to actually orchestrate remediation and learn from what went wrong. It seamlessly integrates DDOG’s holistic observability suite to not only provide an end-to-end, bird’s-eye-view of operations, but to also actionably and quickly fix issues as they appear.

b. Key Points

  • Large outperformance was broad in nature.

  • Renewed its large OpenAI contract.

  • 15 AI-native customers are now contributing $1M+ in ARR.

  • The security is meaningfully accelerating.

c. Demand

  • Datadog revenue beat estimates by 3.9% & beat guidance by 4.1%. 

  • Beat billings estimates by 2.2%

  • It was nice to see a 2-point Q/Q rise in the % of clients using 8+ products. That hasn’t happened in over 2 years.

  • Beat remaining performance obligation (RPO) estimates by 9%.

d. Profits & Margins

  • Slightly beat GPM estimates.

  • Beat EBIT estimates by 15.6% and beat guidance by 16.3%. 

  • Beat $0.46 EPS estimates by $0.09 and beat guidance by $0.10.

  • Beat FCF estimates by 14.6%.

Gross margin was helped by engineering and cloud cost efficiencies. OpEx rose by 32% Y/Y to outpace revenue growth as they keep aggressively investing in long-term growth. These investments come in the forms of both product and sales.

e. Balance Sheet

  • $4.1B in cash & equivalents.

  • $982M in convertible senior notes.

  • No traditional debt

  • 1.2% Y/Y diluted share count growth.

f. Guidance & Valuation

  • Raised Q4 revenue guidance by 4.1%, which beat estimates by 3.1%.

    • They feel “good about Q4 pipeline.”

  • Raised Q4 EBIT guidance by 21%, which beat estimates by 19%.

  • Raised Q4 EPS guidance by $0.105, which beat estimates by $0.10.

  • These Q4 raises are especially notable considering DataDog generally bakes in an extra degree of prudence into its forward guidance. Their revenue is based on consumption. Consumption is inherently more volatile than subscription-based revenue. It’s smart to guide prudently.

  • They now expect CapEx to be 4% of revenue vs. 4.5% previously.

“Our guidance philosophy overall remains unchanged. As a reminder, we based our guidance on trends observed in recent months and imply conservatism on these growth trends.” – CFO David Obstler

“There is no change to our overall view that digital transformation and cloud migration are long-term secular growth drivers of our business.” – CEO Olivier Pomel

DDOG trades for 79x forward EPS and 62x forward FCF. EPS is expected to grow by 11% this year, 16% next year and 23% the year after. FCF is expected to grow by 14% this year, 24% next year and 29% the year after. They’re in the midst of an investment cycle right now.

g. Call Notes

Broad-Based Strength:

Everywhere you look, momentum was strong for Datadog. Momentum from AI customers accelerated and broadened. DDOG now has 15 AI customers spending $1M or more annually and 100 spending $100K+. That’s important. There has been considerable noise and concern surrounding its large business with OpenAI and fears of that giant displacing DDOG with internally built tools. DDOG showing its AI customers span well beyond OpenAI is good news for concentration risk. To diminish that risk even further (for now at least), OpenAI renewed their contract with DDOG in a 9-figure/year expansion. This deal entails much higher usage limits, which always means lower prices for customers (volume-based discounts). For that reason, it was especially encouraging to see GPM expand on a Q/Q and Y/Y basis regardless of the headwind. Several analysts were noticeably excited about that, and rightfully so. We don’t have an exact number in terms of percent of Datadog revenue from OpenAI, but estimates from sell-side firms like Guggenheim put that right around 5% of total vs. about 12% of total for the AI cohort as a whole. 

The non-AI cohort was arguably even better. They saw an acceleration across small and large non-AI native enterprises, with Q/Q growth setting a 3-year high. Contributions from new and expanding customers were both very healthy, as retention rates remained stable and bookings from new customers doubled Y/Y thanks to rising deal values. These new customers generated 25% of DDOG’s total revenue growth this quarter vs. 20% sequentially.

There’s no single or temporary source of this success, as it’s encouragingly broad-based in nature. DDOG views it as a balanced mix of its product suite resonating, its incremental go-to-market investments bearing fruit and the demand environment remaining rather stable if not moderately positive. Those first two tailwinds should be structural in nature compared to fluctuating market conditions.

  • Sales productivity was called “good” but it’s impacted by the rising number of new hires they have in the company.

  • There are more go-to-market changes coming in 2026 that should bolster momentum further.

Wins:

Nothing illustrates momentum like some large customer wins:

  • 7-figure/year deal with a telecom company in the EU for its largest deal ever in that region. The customer replaced expensive and ineffective tools with DDOG’s to lower overall costs by millions annually. They’re using 11 DDOG products in a contract that displaced 10 vendors. Nice platform-level win.

  • 7-figure/year deal with a financial services company. They’re displacing 14 open-source tools and hyperscaler observability services with 11 Datadog products. These products include Bits AI limited release usage, On-Call and some security tools.

  • 7-figure/year expansion deal with a Fortune 500 financial services company. They’re using 15 Datadog products across every pillar to replace the need to run 93 different cloud instances to power their jumbled open-source tools.

  • 7-figure/year expansion deal with a Fortune 500 heavy equipment company. They’re replacing open-source log management tools for Flex logs and will add LLM Observability to cut overall costs as well.

  • 7-figure/year deal for a customer that returned to Datadog thanks to the company’s improved product offering, breadth and execution.

  • 7-figure/year expansion deal with an American carmaker. This company used up consumption commitments faster than expected and came back for more.

Digital Experience Monitoring:

This category is turning into a material financial driver for the business. It crossed $300M in ARR and delivered great momentum across all products, with especially strong growth enjoyed within the newer Product Analytics tool. This now has 1,000 total customers a few quarters into its amplified push into the segment. To help keep traction buzzing, for a second consecutive year, Datadog’s Digital Experience Monitoring was named the leader in Gartner’s Magic Quadrant.

Security:

Security ARR growth accelerated sequentially from around 45% Y/Y to 55% Y/Y. Really good. This success was facilitated by an acceleration in every single cloud security tool it offers, including Cloud SIEM, which is enjoying much more inclusion in larger deals.

AI Product Work:

Interest in its Bits AI agents was called strong, with thousands of customers now previewing its SRE agent and others within the overall suite. Early on, SRE customers are cutting mean-time-to-resolution (MTTR) for performance bottlenecks and security issues and automating the majority of investigations for analyst teams, cutting time and resources without sacrificing enterprise hygiene. Its Bits AI security agent is also getting “very positive feedback” for its vulnerability management, triaging, investigating and resolving. It’s quite early for all of these products, so the commentary on adoption was understandably vague.

“Bits AI is differentiating… It works significantly better than anything else we've seen or heard of in the market, and we are doubling down on it.” – CEO Olivier Pomel

Within AI Observability, it launched LLM experiments and playgrounds, which give developers a safe environment to build, iterate and test AI-powered apps and agents. This pushes them closer to initial source code generation or “further left” in the development, security and operations (DevSecOps) space (towards “Dev). For an idea of the interest in LLM Observability (within overall AI Observability), LLM spans (unit of AI operation) 4X’d in the last few months. That’s from a very small base, but this is the kind of growth we need to see from that small base to gain confidence in LLM Observability moving the needle in the future. AI Observability overall now has 5,000 customers sending DDOG data or using an integration, marking another quarter of adding 500 new clients sequentially. They think their 1,000+ AI integration menu is “unparalleled,” which means their ability to drive vendor and data interoperability is too. And that interoperability directly leads to more business, considering there’s a highly positive correlation between integrations used and revenue generated.

  • They’re seeing MCP adoption translating to higher usage of other DDOG products.

  • The Toto time-series forecasting model their research team created has been among the most popular downloads on Hugging Face in recent months.

More on AI Demand:

While it’s impressive that the AI cohort is already 12% of revenue, that’s really just those companies using existing DDOG tools. Its business is based on general compute CPU architecture, rather than the GPU-based architecture that powers Bits AI, AI Observability, Toto etc. DDOG’s observability niche is highly relevant for infrastructure, models, apps and agentic operations. They should absolutely be able to monetize the explosion in GPU-based assets stemming from AI, and that opportunity is still almost entirely in front of them. I’m surprised that hasn’t happened more meaningfully within its infrastructure monitoring business already, but they’re confident that the time will come.

Leadership was also asked about independent software vendors including observability in their overall AI product suites. Do they consider this a pressing competitive threat? The short answer is no. DDOG is an observability platform spanning all assets and workloads a customer needs to monitor and optimize. These customers, as leadership argued, do not want 15 different vendors and a web of disparate, clunky integrations to manage observability in frustrating siloes. They want one interface… one platform… one data repository… and one record of truth. That consolidates vendors, cuts costs and improves outcomes… just like it does for every other enterprise software platform. This is also why it’s encouraging to see the deals highlighted above that include 10+ DDOG products. More products will mean higher retention, increasingly loyal customers and higher lifetime value.

h. Take

Great quarter. The company’s go-to-market fixes are clearly working while their product traction is fantastic in security and good in AI (despite being very early there still). It was great to see them renew the OpenAI contract amid all of that noise as clearly using Datadog is a better option than that disruptor building their own tools. It's also great to see that occur while GPM still expanded on a Y/Y and Q/Q basis. That’s impressive and goes to show how effective they’ve been with trimming cloud and engineering costs. I thought the sharp Q/Q acceleration in security growth and the large roster of AI clients with $100K+ in ARR were both impressive items from a long list of highlights.

This is a great company. It’s a clear platform play in observability with ramping momentum across a few other product categories as well. I view this in the same high-quality light as companies such as Zscaler, Palantir, CrowdStrike and Cloudflare. But like most of those, I find the valuation to be too rich for the level of multi-year profit growth it's delivering. I don't consider risk/reward compelling enough to own this company, as I’d rather own shares of other world-class enterprise software names trading at lower multiples.

None of that changes how good the quarter was, how steady financial momentum is, how compelling the runway is and how pleased shareholders should specifically be with these numbers.

2. Palo Alto (PANW) – Q1 2026 Earnings Review

a. Palo Alto 101

Palo Alto is a cybersecurity company competing across endpoint, cloud and network (and now identity). They’re hard at work on selling larger deals that involve more products and standardizing customers on their various product pillars. They call this process “platformization.”

Platform #1 – Cortex

Cortex includes its endpoint and security information and event management (SIEM) products. SIEM aggregates context to make sure decision-making is better informed. Extended Security Information and Event Management (XSIAM) combines endpoint security and SIEM to power Palo Alto’s Security Operations Center (SOC). The SOC is the central security monitoring engine. It uses holistic data (1P & 3P) to give companies a bird’s-eye view of their businesses.

The practice of PANW (and others) tying the SOC into information technology (IT) operations is called SecOps. Effectively doing this is not only good for cross-selling and product utility but also market expansion. It makes security players like PANW a bigger part of day-to-day IT.

Other main endpoint security products to know:

  • XDR is a major endpoint part of XSIAM. It infuses non-endpoint data sources into breach protection to extend coverage beyond strictly that endpoint. Adding more data without sacrificing cost and latency performance is where SIEM shines.

  • XSOAR helps automate and guide best practices for incident response while ranking severity of threats. It relies on SIEM for its scaled, complete data ingestion to actually understand the optimal workflows. 

Platform #2 – Network Security

Network security is where Palo Alto is supplanting legacy firewall vendors by offering software-enabled firewalls alongside a suite of network security software (and some hardware-based firewalls too). It deploys software-defined wide area networks (SD-WANs) within firewall environments. SD-WANs are virtual network securers. 

Palo Alto protects networks using a “zero trust” architecture. Zero trust means a bad actor cannot penetrate the most vulnerable part of a digital ecosystem and move freely within it thereafter. Zero trust ensures consistent and complex validation of these permissions at every turn. It ends the game of “everyone within a firewall environment getting perpetual, unconditional access.” Palo Alto splits network into two major segments:

First is hardware. PANW provides “next-gen firewalls” with tools like contextual app inspection, intrusion prevention, URL filtering, data loss prevention (DLP) and more.

Second, it offers network security software. Secure Access Service Edge (SASE) is the overarching software offering that ties its network platformization approach together. It is built on the aforementioned zero trust foundation. SASE integrates tools that help prevent unauthorized access to data, network abuse (like phishing attacks to overwhelm networks with traffic) and broad visibility into network health and performance. Prisma Access Platform (PAP) is a key part of SASE. It’s a cloud/network product hybrid and includes SD-WANs, its secure web gateway (SWG) and a cloud access security broker (CASB) to decide who gets access to what. PAP also includes its Secure Browser, which encrypts and fortifies remote network connections.

Platform #3 – Cloud Security

Cortex Cloud: Like XSIAM and SASE are the platformization pillars in endpoint and network, in cloud it’s the Cloud Native Application Protection Platform (CNAPP). CNAPP includes:

  • Cloud Security Posture Management (CSPM) organizes compliance, provides cloud visibility, and proactively blocks misconfigurations. They have a dedicated posture management offering for applications (ASPM) and data (DSPM).

  • Cloud detection and response (CDR) proactively hunts and protects customers from cloud-based threats with run-time support. 

  • Cloud Workload Protection Platform (CWPP) is very similar to CDR, but for cloud workloads specifically, rather than identities, API calls etc.

  • Cloud Discovery & Exposure Management (CDEM) “evaluates internet exposure risks and discovers unknown internet-exposed cloud assets.”

Cortex Cloud ties very closely to both Cortex and Strata. Products like CASB extend cloud security talents to network use cases and are a direct piece of its SASE network offering. Endpoint products like XDR rely heavily on cloud tools as well. 

AI:

AI security involves Cortex, the network suite and the cloud suite. It touches everything. Prisma AI Runtime Security (AIRS) is their platform for AI security. It’s purpose-built for protecting all AI assets – models, agents & apps – from initial development to scaled deployment. PANW also uses this product internally to give it a full look at all AI assets, with seamless ability to scan and test them. Posture management and configuration analysis products are quite common; effectively protecting cloud environments in actual runtime products is not. It also features AI Access Security, which monitors and protects against sensitive or improper employee usage of 3rd-party AI.

b. Key Points

  • Purchasing Chronosphere to enter the observability space.

  • Modest demand outperformance for the quarter.

  • Prisma AIRS momentum is fantastic. 

  • Pace of platform-wide adoption remains healthy.

  • Raised 2030 ARR target (mainly via M&A).

c. Demand

Palo Alto slightly beat guidance & estimates for remaining performance obligations (RPO), next-gen security (NGS) annual recurring revenue (ARR) and overall revenue. By segment, subscription revenue was very slightly ahead of expectations. Product revenue beat estimates by 2.5%. 

  • Contract duration was relatively stable Y/Y. 

  • Y/Y Net new ARR growth was affected by lapping a $74M contribution via buying QRadar from IBM. Excluding this, net new ARR growth would have been 19.5% Y/Y.

d. Profits 

  • Slightly beat gross profit margin (GPM) estimates. GPM was helped by cloud cost efficiency gains.

  • Beat EBIT estimates by 4%. Missed GAAP EBIT estimates by 8.3%.

    • OpEx rose by 17.5% Y/Y.

  • Beat $0.90 EPS estimate by $0.03 & beat guidance by $0.04. EPS rose by 19% Y/Y.

e. Balance Sheet

  • $4.2B in cash & equivalents.

  • $6B in LT investments.

  • No debt. Stock compensation rose 23% Y/Y.

  • Share count was flat Y/Y. They didn’t repurchase any shares this quarter and have $1B left in buyback capacity under the current program.

f. Guidance & Valuation

  • Reiterated annual next-gen security ARR and RPO guides, which both slightly missed estimates.

  • Slightly raised annual revenue guide, meeting estimates.

  • Raised annual 29.4% EBIT margin guidance to 29.7%, beating 29.5% margin estimates.

  • Raised $3.80 EPS guidance to $3.85, beating estimates by $0.05.

  • Reiterated 38.5% FCF margin guide, missing 38.7% margin estimates.

  • They also raised FY 2030 ARR guidance from $15B to $20B. The core business is performing well vs. their expectations, but this is driven by the two big pieces of M&A recently announced.

    • CYBR is expected to do around $3.2B in 2030 revenue. Palo Alto surely thinks it can help those growth estimates, thanks to its large base of existing customers to cross-sell.

    • Chronosphere (other M&A) is currently doing $160M in ARR with 100%+ Y/Y growth. If we assume rate of growth compounds at a 50% clip for the next 5 years, it will add another $1.2B in revenue.

PANW trades for 52x forward EPS. EPS is expected to grow by 13% this year and by 14% next year. It trades for 33x forward FCF as well. FCF is expected to grow by 17% this year and by 14% next year.

g. Call & Presentation

Platform Play:

Palo Alto continues to win bigger, broader deals across its 3 major product pillars. As a reminder, they call one complete purchase of a platform (Cortex, Network or Cloud) a “platformization.” If they purchase all 3 platforms, it counts as 3. This quarter, they added 60 net new platformized customers, vs. 100-150 in each of the last three quarters. That was XSIAM-driven, as they doubled platformizations Y/Y for that product.

Large platform-wide wins included a $39M NGS ARR deal with a U.S. telecom provider thanks to faster resolution times with PANW vs. the displaced competitor. They were already a network platform customer, and they added Cortex this quarter in a deal that included $85M in overall XSIAM bookings. That’s XSIAM’s largest win to date. They also won a $16M NGS ARR network platformization with a U.S. Cabinet Agency. This includes 60,000 SASE seats, with PANW’s “unified visibility across firewalls and remote endpoints” a deciding factor. Finally, they added a 3rd platformization for an EU defense company with an $8M NGS ARR up-sell. To leadership, all three wins are emblematic of customers wanting more from Palo Alto. Just like it does for CrowdStrike, Zscaler and other security titans, cross-selling drives retention, lifetime value, and margin expansion. It makes these companies even more mission critical and raises their already high-quality revenue streams still further. All in all, $5M+ and $10M+ NGS ARR customers rose 54% Y/Y and 49% Y/Y respectively, as the combination of product breadth and “better security outcomes” resonates.

There are good arguments to be made that players like CrowdStrike and SentinelOne in endpoint, or Zscaler and Cloudflare in network might have the slight edge in terms of product efficacy. All of these companies also compete in cloud security alongside other capable players like Wiz/Alphabet and many, many more. But? None of them combine the ability to cross-sell tightly integrated offerings across all of endpoint, SecOps, network and cloud. That added bundling is a powerful selling point in terms of both cost and interoperability… and this is all before PANW closes on deals to enter identity security and observability. Much more on that later.

Network Security:

SASE was again a standout for PANW as network remains PANW’s most dominant category. ARR rose 34% Y/Y, with 18% customer growth and excellent momentum for its newer Secure Browser offering. They view this as a necessary security layer for whatever new operating systems and networks emerge with AI’s proliferation. 25% of the 24M seats it added in SASE were from this product, as it jumped from 1M to 7M seats Y/Y. Bookings also nearly 4X’d Y/Y as agentic traffic exploded. These agents pull needed information from various places and so must come with sound security. Otherwise, they can be easily manipulated into accessing (or stealing really) information they’re not allowed to use.

They’re also highly encouraged by momentum in the software portion of their firewall business. That now represents 44% of total trailing 12-month product revenue vs. 38% Y/Y. This powered the 23% Y/Y product revenue growth, which is encouraging. As product revenue is less driven by antiquated hardware-based firewall technology, this shift to software-enabled products makes the revenue category a lot more sustainable and compelling.

“As AI transformation accelerates, growth in software firewall provides essential runtime protection with a new AI data center, and with its recent ability to step up and protect AI, we expect continued momentum.” – CEO Nikesh Arora

They’re also taking quantum seriously. They think this could be commercially viable in some capacity in 4 years and they do not think most are prepared. They’ve proactively launched a new iteration of their operating system (PanOS 12.1 Orion) that provides a “quantum readiness solution and automated inventory of their cryptographic risk.” They partner with IBM to collaborate in the realm of quantum readiness as well. Beyond this, they added a translation tool to ease the burden of making current systems quantum-safe and a new firewall built for the quantum era. None of this will lead to any revenue or scaled product utility for at least a few years, but they want to be ready if technology advances to a point of being real.

  • Hardware firewall demand was called stable.

Prisma AIRS:

With their recent Project AI M&A recently closed, PANW now feels it has the most “comprehensive and end-to-end” AI security platform; they call it Prisma AIRS 2.0. From agents, to models, accelerated data processing, data pipelines and apps… and from source code to posture management and runtime… they have customers covered. 

Prisma Airs also features algorithms trained on a richer data set than most competitors, considering PANW’s immensely broad, integrated and scaled product suite. That’s a key piece of why they think they’re ahead in AI security. Better data leads to better context and better AI. This is also why Prisma AIRS deal volume rose 100% Q/Q.

  • AIRS Services like model inspection, prompt injection coverage and AI red-teaming (simulated attacks to test weak spots) have all proven popular.

Leadership is confident that the explosion in AI assets will need protecting just like all other digital assets. They’ll probably need a lot more protection too, considering we’re asking these autonomous machines to do a lot more and access a lot more than humans can. The whole point of AI is to make everything more efficient and increase productivity bandwidth. It means we can ingest, process and share data far more rapidly while using it to build bigger and better models and agents. That incremental work all needs securing, and that is why AI will support core network, endpoint and cloud security demand for PANW. Furthermore, the AI-driven cyberattack originating from Chinese state actors that Anthropic reported is seen as a watershed moment by this company. It makes everyone much more respectful of the risk autonomous cyberattacks represent today. Adversaries no longer need a well-seasoned skillset to conduct these attacks, as they can just tell AI to do it. That lower barrier to entry will naturally invite more hacks and Prisma AIRS is well-positioned to help. 

Cortex and more on AI Security:

Agentix was the main portion of the Cortex conversation. This is PANW’s set of pre-built security agents and suite of tools to help customers customize, build, deploy and maintain their own agents. This will greatly help clients expand 1st-party coverage without adding large teams of security analysts, while automating and triaging alert management to greatly help with false positive-based fatigue. They’re excited about this path to better outcomes with lower costs and more Palo Alto revenue. Agents will be built and used for all current PANW product categories and use cases, with a CDR agent already augmenting cloud workload protection efficiency by 50%.

  • XSIAM customers rose 150% Y/Y thanks to things like helping 60% of its customers lower median-time-to-respond from days to minutes.

M&A and Market Expansion:

Two pieces of M&A news to discuss. First, the large CyberArk acquisition is on track to close during Q3. The company just posted record net new ARR on their own, and PANW is increasingly excited about joint opportunities. They also remain confident in a 40% FY 2028 free cash flow margin and a 37%+ margin from now to then. It will give PANW a 4th major product pillar, amplifying its ability to more deeply and diversely collect data to train algorithms, offer AI agents better context and improve overall outcomes. It’s also worth pointing out that agents will all need identities to ensure they all have proper minimum permissions. That makes this purchase pretty well-timed in my mind. Many people close to this industry see a resurgence in identity-based attention and investment because of agentic AI.

“In our view, Identity Access Management (IAM) is not identity security. It's hygiene and IT… I have a badge to enter Palo Alto. That's not security. That keeps track of the fact that I'm in the building. It doesn't stop me from doing anything. We believe true security in the world of identity happens with privileged access type controls across identities… CyberArk is the best platform from our perspective and asset in the industry to be able to leverage those capabilities.” – CEO Nikesh Arora

Second, they’re purchasing Chronosphere in a $3+ billion deal. Considering they’re still working on closing the $25B CyberArk acquisition, this felt a bit aggressive. Furthermore, stitching together M&A hasn’t historically worked as well as organically developing products internally. On the other hand, PANW has gotten to this point mainly from M&A. The NGS ARR business is the byproduct of integrating a ton of purchases in a way that created cohesion rather than chaos. That’s not an easy thing to do, and makes me more comfortable with them juggling two sizable purchases at once.

So why Chronosphere? This is currently a darling disruptor in the observability space and specifically AI observability. They’re the newest Gartner leader and have $160M in ARR growing at a triple-digit clip. Chronosphere scales with massive AI infrastructure projects at 33% of the cost of competing vendors thanks to a mix of open-source tools and better architecture. And? It’s proven. 2 of the top 5 frontier model builders are already their customers and they are deployed with “demonstrated scale across workloads” at one of these customers. They give PANW a strong foothold in the $24B AI observability market, with more affordable observability, rapid root cause analysis and data storage capabilities Palo Alto views as differentiated. This will make PANW a direct competitor to companies like Datadog. As the world gears up to lay $1.5T in AI infrastructure in the coming years and features observability tools mainly built for the pre-AI era, Chronosphere is how PANW plans to capture its piece of that opportunity.

Three more things on this piece of M&A:

  • PANW is enthusiastic about integrating Chronosphere with Agentix. Chronosphere will offer a bird’s-eye view of AI asset hygiene, performance and security and Agentix will provide the army of AI agents to take this context and turn it into appropriate action.

  • Chronosphere also just bought a company called Calyptea, which provides data pipelines to optimally feed AI algorithms and agents. The clean, secure, scalable data pipeline tools will help greatly in feeding Chronosphere the needed context to make more informed decisions. This will help XSIAM too, as it relies on broad, bottleneck-free data ingestion from a diverse array of 3rd-party sources to unlock differentiated value.

  • The Chronosphere founders will join PANW and keep running this business. For now, it will be operated on a standalone basis until the CyberArk integration is complete.

“As you can tell from our Q1 results, we're pursuing these acquisitions from a position of strength.” – CFO Dipak Golechha

Between identity and observability, PANW is again greatly expanding its TAM. Time and time again, they have shown an ability to successfully move from network to endpoint, cloud and SOC. I think it will be more of the same for these two categories.

h. Take

Fine quarter. I would have liked to see the slight outperformance for next-gen security (ARR) and RPO flow through to modest annual guidance raises, but they still continue to grow at healthy clips with improving margins. I think CyberArk and Chronosphere are both great decisions and place PANW right at the center of two exciting themes in security and operations. I get why some may be worried about integration execution risk, but this team is as battle-tested as any in terms of effectively integrating M&A in a way that creates true platform interoperability. This is a great company with a great team that just delivered another good performance. The net income growth multiple is deservedly lofty at 3.5x, which leads me to prefer other names in the enterprise software space, but it’s pretty clear that this is going to be a reliable compounder for many years to come.

3. PayPal (PYPL) – CEO Alex Chriss Interviews with Citi

This week’s conversation was disappointing. There was nothing glaringly new, just reiterations that make slower Q4 growth more likely, a slower checkout modernization more likely and their timeline to meeting investor day targets probably delayed. Chriss continued to talk about ongoing consumer weakness in the USA that has “persisted into Q4.” It’s the same thing they talked about on the last earnings call, but the excuse doesn’t really work when other competitors like Shopify are doing so well. Macro doesn’t seem to be holding them back… just the fundamentally weaker companies. 

He reiterated that modernizing checkout is taking longer than he wants. Although banded experience growth accelerated to 10% Y/Y thanks to Venmo and BNPL, that’s so frustrating. The old team talked about painfully fixing old checkout integrations slowly and manually over the course of years. They moved at a snail’s pace and the new team came in with a promise to fix that. Chriss joined with palpable enthusiasm about greatly speeding up that checkout modernization pace. 

But now? It’s taking him longer than he thought and he “didn’t fully appreciate” the amount of manual, antiquated integrations to fix. For someone who so frequently talked about the importance of “getting points on the board” to rebuild analyst trust through meeting promises, this will not help.

These integrations are expensive, greatly slow PayPal’s velocity of innovation and create bad experiences for end customers. This is PayPal’s largest product and the UI/UX still needs improvement. If PayPal is clunky, they’ll use one of the other 10 checkout options without missing it at all  It’s great that Venmo is looking so much better and that Braintree has turned a corner, but PayPal’s bread-and-butter online checkout niche is the most important thing to fix and it is going to take longer than expected.

They also seem to be backing away from the schedule to investor day targets set earlier in the year. The “framework is intact” but the “schedule will flex based on how we lean into agentic and BNPL. Not dramatically, but we’re not going to miss [Agentic].” They’re willing to modestly push back the timeline to their high-single-digit transaction margin dollar growth target to embrace customer incentives that count against near-term profit but drive long-term lifetime value. This is entirely related to branded, as Braintree remains on schedule for profit growth.

That’s nice. It’s an exciting opportunity. I understand why they want to invest in it and I think they’re right. It’s just a very hard sell right now. PayPal has been a dog of a stock during a massive bull market. Regardless of these investments probably being the correct decision, they will still leave a bad taste considering how the old team failed to meet promises. They set these targets 9 months ago. I realize agentic AI and commerce is a new opportunity, but still. There’s now more proving to do… more execution risk to overcome… and wildly patient shareholders will need to stay more patient.

“This is an opportunity for us to lean in and win in agentic, to win in Buy Now Pay Later and invest to be able to then set us up for the long term… I think the timing and how we invest to win in the short term will be impacted.” – CEO Alex Chriss

So where does this leave me? My tone and mindset with this company are changing a bit. It’s no longer “they’re doing all of the right things and so I will stay patient.” They’re doing a lot of the right things, but branded checkout is the most important thing and it’s still materially lagging. That’s uncomfortably similar to the old leadership team, although I still think Chriss is a much better CEO. They need to move faster and they need to ask for help from others like Palantir or ServiceNow if they can’t on their own. I now need to see branded checkout showing real signs of stabilizing for me to have confidence in buying this dip. For today, I am placing PayPal on my do not add list. The emotional person in me wants to say good riddance right now, but I think that would be impulsive and I think I need to see how their 2026 starts to shape up to know if this is a name still worth holding.

There are so many reasons why this should work. Dirt cheap multiple… double-digit buyback yield… Braintree growth profitably accelerating… Venmo growth setting 3-year highs… omni-channel taking hold… ads finally building scale… and branded checkout metrics for those with access to the latest integration convincingly improving. All of that is great… but again… they need to get 100% of their customers and merchants on the latest and greatest integration ASAP. Not 15%. Maybe I’m being unfair, but this is priority one and a priority I need to see them making more progress on before I resume adding. If more capital could help accelerate these migrations (I don’t know if that’s the case) then that capital should come from reducing buybacks in my opinion. It’s nice to use that as a lever to accelerate EPS growth. But durable, several year EPS growth will be far more reliant on their most important product being competitive in a crowded market. Priority. One. Not Fastlane… not ads… not a Will Ferrell marketing campaign… not buybacks… this. It is time for them to figure this out or it will be time for me to move on.

Other PayPal news:

  • Another sale of EU BNPL PayPal receivables to KKR. Gets to keep the customer relationship, data and popular checkout mechanism. Sheds the balance sheet bloat.

  • Will debut their agentic commerce partnership with Perplexity next week. This will allow customers to shop and pay with PayPal or Venmo right from Perplexity’s interface. I’m more excited about the OpenAI arrangement, but this is notable too.

  • Relaunched an updated app experience in the UK.

4. Alphabet Gemini (GOOGL)– New Model(s)

Hello Gemini 3. The highly anticipated model launch surely did not disappoint. As you can see below, it topped the scores of other top models across every major benchmark besides 1 and also vastly bolstered performance on a gross basis and also on a performance vs. cost basis vs. models from ChatGPT and others that were released just a few months or weeks ago. There will be more models. OpenAI, xAI, Anthropic and others will keep making rapid progress. But? This is truly a massive leap forward that deeply excited industry experts who understand these things more completely than any of us. The initial Bard and Gemini launches were laughed at. And now? Google has not only caught other industry leaders but greatly surpassed their latest models. They are making progress faster than the field and, thanks to their current lead, ubiquitous distribution and elite research team, have a great chance to stay ahead.

“Gemini 1’s breakthroughs in native multimodality and long context window expanded the kinds of information that could be processed — and how much of it. Gemini 2 laid the foundation for agentic capabilities and pushed the frontiers on reasoning and thinking, helping with more complex tasks and ideas, leading to Gemini 2.5 Pro topping LMArena for over six months… And now we’re introducing Gemini 3, our most intelligent model, that combines all of Gemini’s capabilities together so you can bring any idea to life.” – CEO Sundar Pichai

Gemini 3 specializes in reasoning, translating context and “subtle clues” and understanding the actual intent behind a query. That understanding naturally uplifts output relevance, lowers hallucination rates and helps it match PhD-level reasoning for certain topics. Interestingly, it’s also embracing a more stern and serious tone, eliminating quirky and folksy comments in favor of blunt, streamlined information. Music to my ears. Its Deep Think Mode takes thinking and reasoning a step further, by allowing the model to take longer to field questions in exchange for better answers.

But wait, there’s more. Alphabet also released the second version of their Nano Banana Image generation model. I did not have typing “nano banana” on my 2025 bingo card, but I digress. The important thing here is that this model also topped LMArena and briefly surpassed ChatGPT on app store rankings due to enormous popularity. This looks like a big hit just like the original Nano Banana was.

Furthermore, this model was again trained only on Alphabet’s own TPUs. It did not use any Nvidia GPUs. This isn’t notable because it’s shocking. All Gemini models to date have been run on Alphabet’s TPUs. It is notable because it shows they can create the best models on the planet without Nvidia GPUs. Nvidia’s generalist GPUs are better suited for many workloads and their deeply integrated software and developer ecosystems extract more useful life from chips than any competitor. Those things will remain popular with customers and Nvidia is obviously not going anywhere. Still… This does give Alphabet a great chance to take a bigger piece of the pie as it ramps up the focus on commercialization.

Other relevant information from the launch:

  • They introduced Google Antigravity as its new agentic developer platform for building with this model (and many others). Users can also tap into existing developer platforms including Google AI Studio and Vertex AI.

5. Mercado Libre (MELI) – Competitive Landscape

Citi put Mercado Libre on their 90-day negative short-term list. This coincided with a reiterated buy rating as they continue to view the company positively over longer time horizons. They think Brazilian competitive pressures from Sea Limited and Amazon could lead to modest downward pressure on EPS estimates for the company. For context, 2026 EPS estimates are down 6% since that call. MELI trades for 31x those current estimates with 53% EPS growth next year, the current expectation. My views are unchanged. Brazil is a massive e-commerce market with a rare combination of a tech-savvy, relatively affluent population and low e-commerce penetration. I expect MELI, SE and Amazon to keep fiercely battling for market share in the region and I expect all three to continue doing well. Nobody was ever going own close to 100% of this market.

Finally, MELI announced a shelf offering that allows it to raise equity or debt in the future.

6. Uber (UBER) – AV Landscape

Waymo announced expansions into several new cities this week without Uber named as a launch partner. That fed negative sentiment, but it’s not surprising. Waymo and Uber explicitly say quite frequently that they expect to experiment with many business models before selecting the best one(s). Uber must demonstrate superior value to be that partner, and its unmatched scale and experience gives it a great chance.

My views about this competitive backdrop and risk are unchanged. I think Uber’s main value proposition is its network effect as the premier demand aggregator. It has great data and fleet management assets and it’s building on those things as we speak. But still, network effect will be the main selling point as that’s what leads to higher utilization rates and gets everyone paid. Uber’s ability to sell to a larger base of customers than anyone else means it can promise higher utilization rates to fleets than anyone else and profitably justify paying them more than competitors for access.

The only thing standing in the way of Uber being a dominant part of autonomy is an AV manufacturer monopoly or duopoly forming. If there are 1-2 dominant winners, those winners likely won’t need a network effect from a partner like Uber, as they’ll have an unmatched product that wins over customers without it. With this in mind, Uber is reliant on more winners emerging and competition forcing these fleets to seek optimal monetization through a platform like Uber. This is why the stock reacts negatively to news that Tesla and Waymo are perhaps accelerating progress and positively to news pointing to disappointing progress. The longer the 2 leaders take, the more time everyone else has to scale.

Healthy competition is looking pretty good right now, with several deployments planned for 2026. Furthermore, Uber and Nvidia are each making it a lot easier for more companies to compete. Uber provides the warehousing, compute and charging infrastructure while providing revenue guarantees that greatly lower financial risk. Nvidia provides the software to effectively train algorithms and help legacy automakers sidestep the need to have great technology on their own. They’ll just need to keep building cars, and lean on these two companies to help with the rest. That makes me optimistic that more than 2 companies will win in this space, which to me means Uber will win too.

I don't think this conversation on AV positioning will be relevant for Uber's financial results for a few years. Still, as markets are forward-looking, signs of its role in the evolution being less compelling will pressure the forward multiple and shrink the growth runway.

One more note/reminder here. While we get to a point of more fragmented supply, Uber’s decision to use its balance sheet to finance some of the global fleet buildouts makes a lot of sense. It guarantees supply for their network and deepens relationships with key partners such as Nuro. And? They’re confident in their ability to sell these cars down the road to free up capital. Their balance sheet gives them the luxury to make this decision and raise the probability of their durable success. It’s the right move.

  • Uber partnered with Starship for autonomous food delivery in a few cities across Europe. They’ll expand to the USA in 2027.

  • Uber added a new Uber Eats integration with Global Payments point of sale (POS).

  • Amazon’s Zoox is offering free rides in San Francisco. That decision will probably make some worry Amazon is going to be very aggressive on price as they roll this out across the globe over the coming years/decades.

7. Headlines

Amazon raised $15B in new debt. Morgan Stanley thinks AWS can grow at a 20% clip next year. That has become a very popular opinion. Redburn downgraded Amazon and Microsoft due to AI cycle and funding concerns. Amazon’s Zoox is offering free rides in San Francisco.

There was also more noise surrounding institutional Sea Limited meetings that led many to think they’ll stay aggressive with growth spend across most of their markets. I saw some mumblings about them slashing take rates in certain countries, but there’s nothing on Bloomberg besides them raising seller fees in Taiwan this week. They boosted processing fees, commissions and cut some seller subsidies as well. That should be good news for Coupang, as it tries to aggressively expand into that market (which Sea Limited currently dominates).

Alphabet CEO Sundar Pichai does think there’s an AI bubble right now but also thinks there will be profoundly impactful products that stem from it.

Berenberg started coverage of SentinelOne with an outperform rating and a $25 price target. They think the company is mispriced by investors “awaiting better execution” that they expect to come.

Duolingo social data, which I am tracking very closely to gauge whether or not their fundamental changes are working, has not meaningfully improved from the lows. The aggregated tracker is from a data provider called Ticker Trends. They have a good product with data analysis that has been pretty reliable over the last several quarters. The information they provide (especially for companies like this one) is useful and I am a fan of theirs. Social media is what powers their entire growth engine. This data matters and it’s not good enough right now to justify buying shares.  It bottomed a few weeks ago, but the improvements thus far have been quite subtle.

Rubric integrated its Agent Cloud and data recovery tools into Microsoft 365 and GitHub.

ServiceNow also added new integrations for AI Control Tower with Copilot Studio and Microsoft Foundry (its agent-building products) for centralized agentic command. ServiceNow will also soon integrate its Now Assist sidekick with Microsoft 365 Copilot.

8. Macro

Gap, Walmart and Ross all posted solid earnings and forecasts. They are overcoming whatever consumer headwinds are out there.

Generally speaking, the week’s volatility felt normal & all but inevitable. Markets don’t go up in a straight line and multiples don’t endlessly expand. This mainly unwound some of the parabolic gains we’ve seen high fliers enjoy this year, with some added volatility in the AI trade. Wednesday and Thursday represent the times to thoughtfully & dispassionately evaluate deals as forward multiples contract... determine if we want to slowly & carefully take advantage... & leave more flexibility to keep taking advantage if things get worse before they get better.

I decided to leave more room for flexibility to hopefully take advantage of better deals in the future (if they come). I do not think this past week was the time for me to aggressively deploy the cash pile. While there are surely pockets of more severe volatility, it's important to keep in mind that the S&P was still less than 5% from all-times at this week’s lows and the forward P/E sits at a lofty 23x. 

My cash position is low enough right now that I don’t feel a strong sense of urgency as we gear up for coordinated 2026 monetary/fiscal accommodation and as employment still remains reasonably healthy (nothing scary about a 4.3% unemployment rate). I do not want to be sitting on a large cash pile as these tailwinds emerge, and I don’t think I am. At the same time, I think I have enough cash to give me enough flexibility to take advantage of more deals. I like that balance right now. I like the idea of deploying cash as deals get better and accepting the risk of missing a bottom if I don’t get a chance to invest it all.

Output Data:

  • The New York Empire State Manufacturing Index for November was 18.7 vs. 6.1 expected and 10.7 last month.

  • The Philadelphia Fed Manufacturing Index for November was -1.7 vs. 1.0 expected and -12.8 last month.

  • The Services Purchasing Managers Index (PMI) for September was 55.0 vs. 54.6 expected and 54.8 last month.

  • The Manufacturing PMI for November was 51.9 vs. 52.0 expected and 52.5 last month.

Consumer & Employment Data:

  • The Unemployment Rate for September was 4.4% vs. 4.3% expected and 4.3% for August.

  • Initial Jobless Claims were 232,000 vs. 223,000 expected and 219,000 last report.

  • Continuing Jobless Claims were 1.947M vs. 1.930M expected and 1.916M last report.

  • Nonfarm Payrolls for September came in at 119,000 vs. 53,000 expected and -4,000 in August.

  • Private Nonfarm Payrolls for September were 97,000 vs. 62,000 expected and 18,000 last month.

  • The Labor Force Participation Rate for September was 62.4 vs. 62.3 in August. 

Inflation Data:

  • Average Hourly Earnings M/M for September rose by 0.2% vs. 0.3% expected and 0.4% last month.

Reply

Avatar

or to participate