PANW · Q1 2026 Earnings

Bullish

Palo Alto Networks

Reported November 19, 2025

30-second summary

Palo Alto opened FY26 with $2.47B revenue (+16% YoY) and Non-GAAP EPS of $0.93, both exceeding the high end of the prior guide. NGS ARR hit $5.85B (+29% YoY) — above the high end of the prior guide. Adjusting for the $74M QRadar contribution in the comparable prior period, net new ARR grew over 20%. Management issued initial FY26 revenue guidance of $10.50–10.54B (+14% YoY), layered in the Chronosphere acquisition alongside CyberArk, and raised the FY30 NGS ARR target to $20B with a clearer product bridge.

Headline numbers

EPS

Q1 FY2026

$0.93

Revenue

Q1 FY2026

$2.47B

+15.7% YoY

Gross margin

Q1 FY2026

74.2%

Operating margin

Q1 FY2026

12.5%

Key financials

Q1 FY2026

Metric	Q1 FY2026	YoY	Q3 FY2025	QoQ
Revenue	$2.47B	+15.7%	$2.29B	+8.1%
EPS	$0.93	—	$0.80	+16.3%
Gross margin	74.2%	—	72.9%	+130bps
Operating margin	12.5%	—	9.6%	+290bps

Guidance

Guidance is issued for both next quarter and the full year. Both may appear below.

Actuals vs prior guidance

Metric	Period	Prior guide	Actual	Δ	Result
Revenue	Q1 FY2026	$2.49 billion to $2.51 billion	$2.474 billion	in-line	Beat
Non-GAAP EPS	Q1 FY2026	$0.87 to $0.89	$0.93	+$0.04-0.06 above guide	Beat
Next-Generation Security ARR	Q1 FY2026	$5.52 billion to $5.57 billion (31% to 32% YoY growth)	$5.9 billion (29% YoY growth)	+$0.33-0.38B above guide; YoY growth 3pts below prior guidance range	Beat
Remaining Performance Obligation	Q1 FY2026	$15.2 billion to $15.3 billion (19% to 20% YoY growth)	$15.5 billion (24% YoY growth)	+$0.2-0.3B above guide; YoY growth 4-5pts above prior guidance range	Beat
Non-GAAP Operating Margin	Q1 FY2026	28.2% to 28.5%	30.2%	+1.7-2.0pts above guide	Beat

Changes to prior guidance

Metric	Period	Prior guide	New guide	Δ	Result
Revenue	FY2026	$9.17 billion to $9.19 billion	$10.50 billion to $10.54 billion	+$1.31-1.37B (+14.3% to +14.9% midpoint)	Raised
Non-GAAP EPS	FY2026	$3.26 to $3.28	$3.80 to $3.90	+$0.52-0.64 (+15.9% to +19.6%)	Raised
Next-Generation Security ARR	FY2026	$5.52 billion to $5.57 billion (31% to 32% YoY growth)	$7.00 billion to $7.10 billion (26% to 27% YoY growth)	+$1.43-1.58B; YoY growth guidance lowered 4-6pts to 26-27%	Raised
Remaining Performance Obligation	FY2026	$15.2 billion to $15.3 billion (19% to 20% YoY growth)	$18.6 billion to $18.7 billion (17% to 18% YoY growth)	+$3.3-3.5B; YoY growth guidance lowered 1-3pts to 17-18%	Raised
Non-GAAP Operating Margin	FY2026	28.2% to 28.5%	29.5% to 30.0%	+1.0-1.8pts	Raised

Segment performance

Q1 FY2026

Segment	Q1 FY2026	YoY
Next-Generation Security ARR	$5.9B	+29.0%
Product Revenue	$0.434B	+22.6%
Subscription and Support Revenue	$2.04B	+14.3%

Platform metrics

Q1 FY2026

Segment	Q1 FY2026
Next-Generation Security ARR	$5.9B
Next-Generation Security ARR YoY Growth	29%
Remaining Performance Obligation	$15.5B
Remaining Performance Obligation YoY Growth	24%
Total Revenue YoY Growth	15.7%

Profitability

Q1 FY2026

Segment	Q1 FY2026
Non-GAAP Operating Margin	30.2%
Gross Margin	74.2%
Adjusted Free Cash Flow Margin FY2026 Guidance	38-39%

Management tone

Q3 FY25 platformization-as-thesis → Q1 FY26 platform-plus-observability-plus-identity

Last quarter the platformization narrative leaned on XSIAM-as-AI-data-lake and the Protect.AI tuck-in. This quarter Nikesh expanded the architecture twice: CyberArk extends Palo Alto into identity, and Chronosphere — announced on the call — extends it into observability. The framing has shifted from "consolidate security SKUs" to "be the data and security partner of choice in the AI era." From the call: "Our robust innovation engine, paired with the strategic acquisitions of CyberArk and Chronosphere, positions us as the data and security partner of choice in the AI era." The signal is that management now thinks the firewall-anchored TAM is too small to support the FY30 $20B target on its own — hence the willingness to spend on observability, a category Palo Alto has never been in.

Last quarter the FY30 NGS ARR target was newly set at $15B; this quarter it was raised to $20B, with a clear product bridge from Nikesh: core FY26 NGS ARR target ~$7B, plus CyberArk, plus Chronosphere, plus tuck-ins. The pace of target-raising (a 33% lift to a five-year target one quarter after setting it) is itself a tone shift — management is signalling that the M&A pipeline is more developed than they've previously implied. From RBC's question: "three categories (core, identity, observability) plus small tuck-ins expected to reach $20B." The risk this creates: investors now have to underwrite three integrations (Protect.AI, CyberArk, Chronosphere) over the next 18 months, and the FCF margin glide path is the cleanest place that risk will show up.

The FCF margin disclosure pattern hardened. The FY26 guide is 38–39% inclusive of both acquisitions, with Dipak Golechha in prepared remarks explicitly defending a 37% floor for FY26 and reiterating the 40%+ FY28 target. Management is preempting the dilution question rather than letting analysts ask it. That preemption itself is a confidence signal — they would not be putting an FY28 floor in writing unless deal models supported it.

Recurring themes management leaned on this quarter:

Platform consolidation executionFinancial results accelerationCybersecurity threat environmentProduct and technology innovation

Q&A highlights

Brad Zelnick · Deutsche Bank

How is Palo Alto Networks ensuring success in the AI and quantum future beyond smart M&A, given that winners in one technology generation rarely remain winners in the next?

Nikesh emphasized that multiple technology waves can be sustained by the same company (citing multi-trillion dollar companies operating for decades). He argued that network inspection demand won't diminish—AI and quantum will drive more volume and data inspection needs. He highlighted existing positions in SASE (1.3B ARR), XIM (470 customers with ~1M ARR each), software firewalls (44%+ of product revenue), and quantum security. He predicted Chronosphere would be a smart move in hindsight, positioning Palo Alto as the platform for security and observability.

SASE ARR: $1.3 billion, growing faster than independent SASE companiesXIM: 470 customers with ~$1 million average ARR per customerSoftware firewalls: 44%+ of product revenue from software form factorCore business ($7B target for FY26) + CyberArk + Chronosphere + tuck-ins = $20B FY30 target

Rob Owens · Piper Sandler

What is the perspective on security-observability convergence happening now, and what elements from Chronosphere's success with top-five frontier AI models are applicable to other rapidly growing AI-native companies?

Nikesh explained that Chronosphere was discovered while looking at data pipelining needs, but the team found exceptional engineering talent and breakthrough capabilities in scaling observability at petabyte scale with cost efficiency (one-third of competitors). He noted Chronosphere's success comes from combination of open-source and techniques enabling cost-effective scale. Target customers include born-in-cloud and 24/7-dependent businesses. Predicted Chronosphere will become a billion-dollar ARR business similar to XIM trajectory.

Chronosphere: $160M+ ARR with triple-digit growthScales observability at petabyte-data ingestion rates at one-third cost of competitors250 employees, customer base focused on large AI and born-in-cloud enterprisesExpected to remain largely standalone post-close, closing H2 FY26

Soka Kalia · Barclays

Do XIM deals capture at least what customers were spending on incumbents, or is there opportunity to capture more through faster mean time to respond?

Nikesh confirmed that Palo Alto captures at least incumbent SIM spending while consolidating surrounding products (UEBA, SOAR, ITDR, email security, exposure management) onto a single platform. This allows customers to save money while expanding Palo Alto's footprint. The dynamic is: gain incumbent share + consolidate adjacent categories.

XIM captures incumbent SIM spending plus consolidates UEBA, SOAR, ITDR, email security, exposure managementCustomer saves money + Palo Alto expands footprintPlatformization trend driving customer consolidation decisions

Matt Hebert · RBC

What are the biggest moving pieces that give confidence to raise the FY30 NGS ARR target from prior guidance to $20 billion, announced just last quarter?

Nikesh attributed confidence increase to: (1) Core business strength—SASE at $1.3B ARR continuing to outgrow independent SASE vendors; (2) Software firewalls as 'hidden gem' with 44%+ of product revenue and potential to become billion-dollar business; (3) CyberArk expected to continue transforming and absorbing more identity categories; (4) Chronosphere adding observability capability. Three categories (core, identity, observability) plus small tuck-ins expected to reach $20B target.

FY30 target raised from prior guidance to $20 billion NGS ARRSASE at $1.3B, growing faster than independent public SASE vendorsSoftware firewalls: 44%+ of product revenue; expects continued growth as cloud workloads expandCore business targets ~$7B for FY26; identity and observability acquisitions expected to provide remaining growth to $20B

Tal Liani · Bank of America

What is the impact on dilution, margins, and free cash flow margins during the transitory integration period for the two acquisitions, and how long until synergies are visible?

Nikesh noted Chronosphere will run independently with minimal integration disruption (company will provide HR, finance, marketing support). For CyberArk, rational synergies exist on day one (eliminating duplicates), with further alignment of sales quotas and territories by end of FY26. Deepak added that Palo Alto expects to maintain at least 37% adjusted free cash flow margin in FY26 inclusive of both acquisitions, with path back to 40%+ by FY28.

Chronosphere: Run independently; low integration overhead; receives support functions from Palo AltoCyberArk: Integration planning on track for Q3 close; rational synergies on day one; sales alignment by end of FY26FY26 guidance: At least 37% adjusted free cash flow margin inclusive of both acquisitionsFY28 target: 40%+ adjusted free cash flow margin inclusive of both acquisitions

Answers to last quarter's watch list

NGS ARR Q4 net add inside $5.52–5.57B exit range — Q1 FY26 prints $5.85B, above the high end of the prior guide. Adjusted for $74M of QRadar in the prior-year comparable, net new ARR grew over 20%. Status: Resolved positively

XSIAM customer count above 350 and average ARR holding above $1M — XSIAM disclosed at ~470 customers with ~$1M average ARR per customer, well above both thresholds. Status: Resolved positively

Non-GAAP operating margin step-up to land in FY guide range — Q1 FY26 printed 30.2%, above the prior FY25 guide range of 28.2–28.5% and at the high end of the new FY26 guide of 29.5–30.0%. Second consecutive quarter above 30%. Status: Resolved positively

Software form factor growth acceleration — software form factors now 44% of trailing-12-month product revenue per Dipak Golechha, up from 38% a year ago, with product revenue overall growing +23% YoY. The AI-forces-cloud-migration thesis is playing out. Status: Resolved positively

Protect.AI close and initial integration commentary — Protect.AI is now fully integrated and Prisma AIRS 2.0 launched in Q1. Status: Resolved positively

What to watch into next quarter

NGS ARR organic growth ex-acquisitions — Q2 FY26 guide of $6.11–6.14B (+28% YoY) is set before CyberArk and Chronosphere close. Watch whether organic growth stabilises around this level or decelerates further as the base scales.

Chronosphere standalone disclosure — management committed to keeping it standalone post-close in H2 FY26. Watch whether they disclose Chronosphere ARR separately (the $160M+ baseline is the bar) and whether triple-digit growth holds.

CyberArk close timing and day-one synergy specifics — targeted Q3 FY26 close with sales territory alignment by end of FY26. Watch for explicit accretion timeline on the next print.

Non-GAAP operating margin holding 30%+ — FY26 guide caps at 30.0% inclusive of acquisitions. Watch whether Q2 prints above 30% (suggesting upside to the FY raise) or pulls back toward 29% (suggesting the acquisitions are dilutive sooner than guided).

Adjusted FCF margin trajectory toward 37% floor — Dipak Golechha put a 37% floor in writing for FY26. Q2 is when integration costs typically begin to bite. Watch whether the floor is reaffirmed or softened.

Sources

Palo Alto Networks Q1 FY2026 earnings press release, filed via SEC EDGAR, November 19, 2025 — https://www.sec.gov/Archives/edgar/data/1327567/000132756725000032/ex991q126earningsrelease.htm
Palo Alto Networks Q1 FY2026 earnings call prepared remarks and Q&A (transcript excerpts as supplied)

Get the next brief, free.

We publish analyst-grade earnings briefs the same day or morning after every call — headline numbers, segment KPIs, Q&A highlights, and tone analysis. Free during beta.

This is not investment advice.