Palo Alto Networks, Inc. (PANW)

News Summary

• Prisma AIRS, PANW's AI security platform, tripled its customer count from 100 to 300+ in a single quarter and is on track for $100M in ARR within the next couple of quarters, now processing over 2 trillion tokens per month for a single global consulting customer — the fastest product ramp in company history; PANW also acquired Portkey, an AI gateway processing trillions of tokens monthly, to enforce real-time policy on agent-to-agent interactions at scale.
• Next-gen firewall bookings grew nearly 40% YoY — the strongest hardware quarter in a decade — driven by AI data center build-outs and a new buyer class including sovereign infrastructure providers and frontier AI labs; CEO Arora warned of a 3-to-6 month window before frontier AI models become autonomous hacking entities capable of orchestrating end-to-end attack campaigns at machine speed, framing this as the structural demand catalyst for the entire platform.
• XSIAM surpassed $600M in ARR, up 100% YoY across 740 customers, with most customers now achieving threat response in under 10 minutes; over 1,200 customers reached out following the emergence of Anthropic's Mythos model and PANW held 800 customer meetings in six weeks, signaling rapid enterprise urgency around agentic AI threats.
• Q3 FY2026 revenue grew 31% YoY to $3.0B (vs. $2.94B consensus), non-GAAP EPS of $0.85 beat the $0.80 LSEG consensus, NGS ARR hit $8.1B (+60% YoY), adjusted FCF was $910M with a trailing 12-month FCF margin of 38.5% (+430bps YoY); full-year FY26 guidance raised to $11.42-$11.43B revenue and $3.77-$3.79 non-GAAP EPS, both above prior consensus.
• Shares initially surged up to 12% after-hours but reversed to close down roughly 6-7% the next session despite the beat and raised guidance, with Raymond James flagging M&A-driven disclosure changes and a coming FY27 re-segmentation as obscuring core business trends; Truist raised its price target to $375 from $275, calling PANW a 'core cyber holding,' while Morgan Stanley cited rising demand for AI-driven cybersecurity platforms — sentiment broadly constructive but stock reaction reflected 'priced in' dynamics on a stock already up 60%+ YTD.

Financial Highlights

Earnings Call Highlights

Palo Alto Networks delivered a blowout quarter that management framed as a structural inflection point for cybersecurity demand, driven by the emergence of autonomous AI attack capabilities like 'Mythos' that compress attack timelines to minutes. Nikesh Arora was unusually assertive in tone, explicitly declaring the 'terminal value of cybersecurity' restored and dismissing the prior narrative that AI would commoditize security vendors. Analysts were broadly constructive, with questions focused on validating the durability of demand across network security, SASE, Prisma AIRS, and the newly integrated CyberArk rather than probing for weaknesses. The dominant theme was platformization as the only viable defense architecture in an agentic AI world, with management positioning every product line — hardware, SASE, XSIAM, Prisma AIRS, observability, and identity — as a beneficiary of the same AI-driven traffic and threat surge.

• Prisma AIRS, PANW's AI security platform, tripled its customer count from 100 to over 300 in a single quarter and management guided to $100 million in ARR 'within the next couple of quarters' for a product that did not exist a year ago — the fastest product ramp in company history, now processing over 2 trillion tokens per month for a single global consulting customer.
• Next-generation firewall bookings grew nearly 40% year-over-year, the strongest hardware quarter in a decade, with management citing AI data center build-outs and a new class of buyers including sovereign infrastructure providers and frontier AI labs as incremental demand sources beyond traditional hyperscalers.
• XSIAM surpassed $600 million in ARR, up 100% year-over-year across 740 customers, with the majority of customers now achieving threat response in under 10 minutes — management positioned this as the primary defensive answer to machine-speed AI attacks and the core data aggregation layer for the agentic SOC.
• Arora described a 3-to-6 month window before frontier AI models evolve into 'sophisticated hacking entities' capable of scanning environments, generating exploits, and orchestrating attack campaigns autonomously at machine speed without human intervention, framing this as the structural demand catalyst underpinning the entire platform.
• The acquisition of Portkey, an AI gateway processing trillions of tokens monthly, was disclosed as a new enforcement point for monitoring and applying real-time policy to agent-to-agent interactions at scale, extending Prisma AIRS further into the agentic infrastructure stack.

Sources

• Palo Alto Networks tops earnings as AI fuels cybersecurity urgency
• Palo Alto Networks Reports Fiscal Third Quarter 2026 Financial ...
• Palo Alto Networks Q3 Earnings and Revenues Surpass Estimates