Palo Alto Networks: Cybersecurity Leader with Massive Growth Potential
Deep Dive into $PANW: Valuation, Segment Growth, Key Metrics, Profitability, Expenses, Product Launches, Customer Acquisition, Financial Stability, SBC/Revenue, and Shareholder Dilution.
Palo Alto: Company overview
About Palo Alto
Palo Alto Networks is a global cybersecurity leader founded in 2005. The company provides advanced firewalls and cloud-based offerings that extend those firewalls to cover various aspects of security. PANW serves over 85,000 organizations in over 150 countries, including 85% of the Fortune 100. In fiscal year 2024, the company generated $8.03 billion in revenue and $2.58 billion in net income.
Mission
PANW's mission is to prevent successful cyberattacks and enable digital transformation for global organizations. The company focuses on continuous innovation in cloud security, AI-powered threat prevention, and zero trust architecture to achieve this goal.
Sector
PANW operates in the cybersecurity sector, specifically in network security, cloud security, and security operations. The company competes in three main markets: network security (Strata & Prisma SASE), cloud security (Prisma Cloud), and security operations (Cortex).
Competitive Advantage
PANW's competitive advantage lies in its unified control plane across hardware and software, and broad coverage of network, security operations center, applications, and cloud. The company's App-ID technology provides greater visibility into application communication on networks, offering a level of control competitors struggle to match. PANW's understanding of containerization allows its Next-Generation Firewall to be deployed physically, virtually, in a container, or via cloud, providing additional edge.
Total Addressable Market (TAM)
Palo Alto Networks operates within a substantial total addressable market (TAM) estimated at $110 billion, with a projected growth rate of 14% CAGR. This represents a significant opportunity across the company’s core security segments.
In network security, from 2021 to 2024, the overall TAM is growing at 9% CAGR, with the software firewalls segment growing at 13% CAGR, and the SASE (Secure Access Service Edge) segment expanding at a remarkable 36% CAGR.
In cloud security, the TAM was $10 billion in 2021 and is expected to grow at a 30% CAGR through 2024.
The broader cybersecurity landscape presents even more potential. McKinsey estimates a total addressable market of $1.5 trillion to $2.0 trillion, nearly ten times larger than the current vended market.
As of February 2025, PANW is on track with its growth targets, having raised its full-year revenue guidance to a range of $9.14 billion to $9.19 billion, which represents 14% YoY growth at the midpoint.
Valuation
$PANW Palo Alto is trading at a Forward EV/Sales multiple of 12.2, above the median of 7.1. The company's Forward EV/Sales multiple is near its historical highs.
$PANW Palo Alto trades at a Forward P/E of 54.4, with a revenue growth of 14% YoY in the last quarter.
The EPS growth forecast for 2026 is 13.4%, with a 2026 PEG ratio of 4.1.
The EPS growth forecast for 2027 is 15.9% and P/E of 49.0, with a 2027 PEG ratio of 3.1.
The PEG (Price/Earnings to Growth) ratio is a key tool for evaluating growth stocks, introduced by Peter Lynch.
PEG < 1: Undervalued – A ratio below 1 suggests the stock is undervalued. For example, if the P/E is 15 and earnings are expected to grow by 20%, the PEG would be 0.75, indicating a good buying opportunity.
PEG = 1: Fair Value – A PEG of 1 means the stock price matches its growth expectations, representing fair value.
PEG > 1: Overvalued – A PEG above 1 indicates the stock may be overvalued, as its price is higher than its projected growth rate, making it riskier.
Valuation comparison
Analysts' revenue growth forecast for $PANW in 2026 is +15.0%. Considering this forecast, the valuation based on the PS multiple appears fair when compared to other companies in the cybersecurity sector.
Analysts expect solid revenue growth, so let's examine the key metrics to determine whether these expectations are justified.
We'll evaluate the company's economic moat, which supports long-term revenue growth, analyze revenue trends and the forecast for next quarter, and identify key factors that could help the company exceed expectations and sustain future growth.
We'll assess the performance of key segments, the launch of new products and updates, customer acquisition growth, key financial metrics, financial stability, and margin trends.
Additionally, we'll review the SBC/Revenue ratio, shareholder dilution, and finally, draw conclusions on the company's outlook.
Economic Moat
Economic Moats enable companies to remain stable during crises and support long-term revenue growth.
Economies of Scale
Palo Alto Networks demonstrates strong economies of scale as it grows. The company’s non-GAAP gross margin recently rebounded to 76.6%, signaling improved operational efficiency. As PANW expands its footprint—now serving over 85,000 organizations globally—it spreads fixed costs across a larger revenue base. This scale enables PANW to invest $1.9 billion in R&D in 2024 while maintaining profitability.
Network Effect
PANW benefits from a powerful network effect, particularly in threat detection. Its AI-powered solutions process over 1.5 trillion network events daily, achieving a 99.7% threat detection accuracy rate. The more customers that join PANW’s ecosystem, the more effective its system becomes—enhancing value for all users and creating a significant barrier to entry.
Brand
PANW has built a strong brand reputation in cybersecurity. The company is a Leader in Gartner’s Magic Quadrant for Network Firewalls and holds a Net Promoter Score of 67. Its innovation and reliability have helped PANW secure 85% of Fortune 100 companies as customers, reinforcing its brand strength.
Intellectual Property
IP forms a key part of PANW’s moat. The company holds over 1,200 active patents and files approximately 300 new patent applications annually. This deep portfolio protects its innovations and sustains its technological edge in a competitive market.
Switching Costs
PANW creates high switching costs for enterprise customers. The average enterprise contract value was $456,000 in 2023, while the cost to migrate away ranges from $1.2 million to $3.5 million, with implementation taking 4–6 months. The potential downtime risk of $5,600 per minute further incentivizes customers to stay, reinforcing platform stickiness.
Palo Alto Networks' economic moat is built on economies of scale, network effects, brand strength, intellectual property, and high switching costs. These factors secure its leadership in the cybersecurity market and support long-term growth as demand for advanced security solutions increases amid rising cyber threats.
Revenue growth
$PANW's revenue growth has slightly accelerated over the past two quarters, reaching +14.3% YoY in Q4. Based on the forecast for the next quarter, if the company exceeds its guidance by 0.3%, as it did in Q4, Q1 growth would reach 15.8%, indicating further acceleration.
RPO growth in Q4 was 20.4% YoY, outpacing revenue growth.
Billings grew +15.7% YoY, accelerating compared to the previous quarter and exceeding the revenue growth rate.
Segments and Main Products.
Palo Alto Networks operates in three main market segments: Network Security (Strata & Prisma SASE), Cloud Security (Prisma Cloud), and Security Operations (Cortex). The company generated $8.03 billion in revenue for fiscal year 2024, with subscription services accounting for 52.18% of total revenue.
Network Security
Network Security focuses on securing network environments through next-generation firewall solutions. Products include hardware firewalls, virtual firewalls, and cloud firewalls designed to provide deep visibility into network traffic and protection against various attacks. This segment's revenue share has been declining, representing 19.97% of total revenue in 2024.
Cloud Security
Cloud Security addresses challenges associated with securing cloud infrastructures through Prisma Cloud. The platform offers Cloud Security Posture Management, Workload Protection, Cloud Network Security, and Cloud Infrastructure Entitlement Management. Prisma Cloud pricing ranges from $2,000 to $10,000+ per year based on features and deployment size.
Cortex
Security Operations is delivered through Cortex products, including Cortex XDR (Extended Detection and Response) and Cortex XSOAR (Security Orchestration, Automation, and Response). Cortex XDR provides AI-driven threat detection across endpoints, networks, and cloud environments at approximately $81 per endpoint per year. Cortex XSOAR automates security operations and incident response.
Prisma SASE
Prisma SASE (Secure Access Service Edge) combines cloud-delivered security and networking capabilities for distributed workforces. The solution integrates secure web gateway, cloud access security broker, zero trust network access, and firewall-as-a-service into a single platform, with pricing between $1,000 and $10,000+ per year depending on user count and features.
Support services represent 27.85% of PANW's total revenue in 2024, providing continuous monitoring, professional services, training, and threat intelligence to complement technology offerings.
Main Products Performance in the Last Quarter
$PANW Revenue by Segment: 81% of the company’s revenue comes from Subscription and Support, while 19% is from Product Revenue.
Subscription and Support revenue growth continues to slow, reaching +15.9% YoY in Q4, with a gross margin of 76.6%.
Product Revenue growth showed a recovery at +7.9% YoY after a decline in Q2 2024, though the gross margin declined to 76.7%.
Network Security (Strata & Prisma SASE)
Network Security bookings grew 21% YoY, led by strong demand for software firewalls and SASE. The transition to software continues to accelerate, with software and SaaS now representing ~two-thirds of firewall bookings, growing 1.5x faster than the overall firewall platform business.
SASE remains the fastest-growing form factor. Bookings grew 50%+, and customer count rose 20% YoY, now exceeding 5,600 customers with over 23 million seats. Prisma Access Browser delivered $30M+ in bookings, with 95% QoQ seat growth. A new mobile version of the secure browser was released, enhancing protection on phones and tablets.
Within appliances, demand is stable. Appliance bookings grew in the mid-single digits, supported by refresh cycles across the industry. Management continues to expect appliance market growth of 0–5%.
The company reported 74 accounts over $5M and 32 deals over $10M, showing strong traction in large enterprise accounts.
Cortex
Cortex posted ~50% bookings growth in Q2. XSIAM surpassed $1B in cumulative bookings, making it one of the fastest-growing platforms in cybersecurity. XDR added hundreds of new customers, and QRadar-related bookings contributed $100M+, with a strong pipeline ahead.
Platform adoption accelerated: two-platform customers grew 50% YoY, and three-platform customers tripled. Cortex adoption rose 3x YoY, reflecting customer confidence in AI-driven SecOps transformation. Frost & Sullivan and Omdia recognized Cortex as a SIEM category leader.
Cortex Copilot AI tools now support 85% of support cases in network security and cut case resolution time by ~50%, improving cost efficiency and experience.
Prisma Cloud
Prisma Cloud merged with Cortex and CDR to launch Cortex Cloud, the industry's first end-to-end cloud security platform integrated with SecOps. This enables AI-powered prioritization, automation, and real-time protection across the cloud lifecycle—from code to runtime to SOC.
Prisma Cloud bookings grew ~50% YoY, driven by demand from major SaaS providers and Fortune companies. DSPM adoption was one of the fastest ramps for a new cloud security product, now integrated into the broader Cortex Cloud offering.
70% of software firewall deployments now run in public cloud environments, reinforcing demand for hybrid protection.
Strata Network Security
Strata remains the core driver of ~80% of bookings. The transition from hardware to advanced cloud-delivered subscriptions continues. Advanced subscriptions are now used across all form factors and help differentiate Palo Alto's offering. Zero Trust architecture and harmonized control planes across data centers, SaaS, and remote environments are becoming requirements.
AI-powered firewall innovation drove the company’s first 7-figure AI-specific software firewall deal, with an 8-figure pipeline forming. One customer signed a $10M+ deal for Prisma Access Browser, further validating demand.
XSIAM and AI-Driven SOC
XSIAM passed $1B cumulative bookings, now deployed in 200+ customer environments, including several large-scale platformization wins. XSIAM unifies data for AI-powered detection and remediation, reducing mean time to respond.
Integration with Cortex Cloud enables unified visibility from runtime to SOC, positioning Palo Alto to lead in securing both enterprise and cloud environments.
Platformized customers now exceed 1,150 of the top 5,000 accounts, up from ~45 a year ago. Goal remains 2,500–3,500 by FY30.
Product Innovation & AI Capabilities
AI is being embedded across all products. Cortex Cloud now unifies cloud security with AI-based SecOps. AI Access provides real-time visibility into 1,800+ AI apps, up from 500 six months ago, with 300+ customers using the new capability. AI firewalls and agent-based runtime protection were added to Prisma and network security.
AI-enabled developer Copilot tools rolled out company-wide, early signs show improved code efficiency and productivity. Support Copilot used in 85% of cases, delivering ~50% faster resolution.
FedRAMP High authorization was granted across network, cloud, and SecOps platforms—enhancing positioning in the U.S. federal market.
Manufacturing transition to a new Texas facility to support appliance innovation and cost optimization was completed.
Revenue by Region
The Americas region accounts for 67% of total revenue, making it $PANW Palo Alto’s largest market, with revenue growing +13% YoY in Q4.
The EMEA region contributes 21% of total revenue and is growing more slowly at +18% YoY.
The APAC region is the smallest by revenue, with a growth rate of +17% YoY.
Revenue growth in both EMEA and APAC exceeds the company's overall revenue growth rate.
Market Leader
Palo Alto Networks has been recognized as a Leader in the 2024 Gartner Magic Quadrant for Endpoint Protection Platforms, reflecting the technical performance and maturity of its Cortex XDR solution.
Cortex XDR achieved 100% prevention and detection in the 2023 MITRE ATT&CK Evaluations, with no configuration changes required. The platform, built on Precision AI, integrates endpoint, identity, network, and cloud telemetry to support real-time threat detection. Operational efficiency in security operations centers (SOC) is significantly enhanced, with Cortex XDR enabling a 98% reduction in alerts and 8x faster investigation times.
The architecture is based on a single agent and unified console, streamlining SOC workflows and consolidating previously fragmented security tools. In addition to its Gartner recognition, the platform was named a 2024 Gartner Peer Insights Customers’ Choice for Endpoint Protection Platforms, signaling alignment between technical outcomes and customer experience.
Customers
Customer Success Stories
A major Asian bank signed a $65M+ transaction, platformizing with Cortex for the first time. The customer, a long-time XDR and network security user, consolidated a fragmented SOC environment. The result was a 5x increase in NGSA ARR, now exceeding $12M. The deployment included a significant rollout of XSIAM, addressing compliance concerns and remediation delays.
A U.S. municipality executed a $60M+ deal, renewing its entire network security stack. Already platformized in network security, the customer expanded into Cortex and Prisma Cloud. Over the past 12 months, its GSARR rose 40%+ to over $11M. The deal positions Palo Alto for deeper platformization across the full suite.
A European automotive manufacturer completed a $25M+ transaction, renewing firewall infrastructure including IoT, SASE, and virtual firewalls. The customer expanded Cortex usage with XDR, XSOAR, and Expanse. Prisma Cloud capabilities were also adopted. NGSA ARR grew 50% YoY to $9M, driven by broader coverage and hybrid deployments.
An enterprise closed a $10M+ secure browser deal, contributing to $30M+ in total Prisma Access Browser bookings. Browser seats rose 95% quarter-over-quarter, reflecting traction in endpoint browser security adoption.
Across cloud security, several of the top 10 non-cybersecurity SaaS companies purchased Prisma Cloud to secure their customers' environments. Strong early adoption of data security posture management and runtime protection observed.
Large Customer Wins
Palo Alto reported 74 customers with deals exceeding $5M in Q2, up 25% YoY. 32 customers signed deals over $10M, an increase of 50% YoY, confirming strength in enterprise and global accounts.
Largest deals ever were signed in both EMEA and JPAC regions, each exceeding $50M. International momentum is now complementing U.S. large deal success.
QRadar-related wins generated $100M+ in bookings. The IBM partnership contributed to several seven- and eight-figure deals, including strategic public sector wins. The Home Office deal in the UK is a prime example of synergy between IBM’s system integrator role and Palo Alto’s security stack.
XSIAM deployments passed 200 cumulative customers in 24 months, fueling expansion in AI-driven SecOps. Cortex customer count increased ~20% YoY, driven by adoption of XDR and XSIAM in large-scale environments.
SASE deals over $1M increased 2.5x, supporting broader cloud-delivered network security adoption. Prisma Cloud and Cortex both delivered ~50% bookings growth, reflecting broad appeal among Fortune 500 and large SaaS players.
The growing number of customers using two or more platforms increased 50%, and three-platform customers tripled YoY. Platformization is gaining momentum, with over 1,150 of the top 5,000 customers now engaged.
ARR Growth
Palo Alto $PANW NGS ARR growth is slowing, reaching +37% YoY in Q4, which is above the company’s revenue growth.
Net new ARR
Palo Alto $PANW added $260 million in net new NGS ARR in Q4 2024, the same amount as in Q4 of the previous year.
CAC Payback Period and RDI Score
$PANW's return on S&M spending is 9.3. The CAC Payback Period has slightly worsened compared to the previous quarter but remains better than the average for SaaS companies (the median among those I track is 20.8 months).
The R&D Index (RDI Score) has significantly declined over the past two years and currently stands at 0.92 for Q4, which is below the median of 1.2 for the SaaS companies I monitor but above the industry median of 0.7.
An RDI Score above 1.4 is considered indicative of best-in-class performance. The low industry median of 0.7 highlights the importance of efficient R&D investment.
Profitability
Over the past year, $PANW Palo Alto margins has changed:
Gross Margin decreased from 78.0% to 76.6%.
Operating Margin slightly decreased from 28.6% to 28.4%.
Free Cash Flow (FCF) Margin decreased from 33.1% to 22.6%.
Operating expenses
$PANW's non-GAAP operating expenses have decreased, primarily due to reduced Sales & Marketing (S&M) spending, which declined from 32% two years ago to 29%.
R&D expenses remain high at 16%, as the company continues to invest in future growth through product enhancements and updates.
General & Administrative (G&A) expenses have slightly decreased and are now at a relatively low level of 4%.
Balance Sheet
$PANW Balance Sheet: Total debt stands at $970M, while Palo Alto holds $3,233M in cash and cash equivalents, exceeding total debt and ensuring a healthy balance sheet.
Dilution
$PANW Shareholder Dilution: Palo Alto's stock-based compensation (SBC) expenses have slightly increased over the past two quarters, reaching 15% of revenue in the last quarter, which is relatively low for SaaS companies.
Shareholder dilution also remains elevated—despite a slight decline, the weighted-average number of basic common shares outstanding is still relatively high, having increased by 3.1% YoY.
Conclusion
$PANW Palo Alto is pursuing a platformization strategy by offering some of its products for free for a limited time. It is also worth noting that revenue growth has slightly accelerated over the past two quarters.
Leading Indicators
• RPO growth of +20.4% outpaced revenue growth
• Billings grew +15.7%, higher than revenue growth
• Net new ARR additions were flat YoY, while NGS ARR grew +27% YoY, outpacing total revenue growth
Key Indicators
• CAC Payback Period slightly worsened to 9.3 months, which is above average
• RDI Score increased slightly to 0.92, but remains below the median of other SaaS companies I track
The forecast indicates further acceleration in revenue growth, supported by leading indicators such as RPO and billings growth outpacing revenue. Improvements in CAC Payback Period and RDI Score suggest progress, and it's likely that the lowest point of revenue growth (+12.1% YoY in Q2 2024) is now behind, as the platformization strategy is beginning to show results.
The company is trading at a Forward EV/Sales multiple significantly above its historical average, but valuation appears fair relative to competitors, considering its growth outlook.
Analysts expect revenue growth to accelerate over the next two years. By focusing on platformization and temporarily offering some products for free, Palo Alto aims to boost customer retention and drive future growth, while deferring some current revenue. This strategy has led to a noticeable slowdown in revenue growth over the past year.
However, concerns remain around the slowing growth in subscription revenue and flat Net New ARR additions, which were 0% YoY in Q4. Whether the company can reverse this trend in Net New ARR will be a key factor in determining whether revenue growth truly accelerates going forward.