Palo Alto Networks, Inc. — Blitz Index 61 (B)

Palo Alto Networks scores 61 — a platform-completing consolidator whose $11.5B scale and $21.2B RPO are real, while GAAP margin and dilution cap the score.

Last re-scored: October 26, 2026.

Score breakdown

Think we scored it wrong? Score it yourself →

Radar axes (0–100): Moat 63.3 · Speed 76 · Creative 73.3.

Watch item

Gates: G1 ✓ (confirmed — 5 straight years of double-digit growth) · G2 ✓ (borderline estimate — narrow wedge $147.0B vs bar $114.8B, only 1.28×). 4 points below the threshold — first score.

Strengths

• Revenue $11,480M (+24.5%), NGS ARR $9.1B (+63%), RPO $21.2B (+34%) — three growth engines running together
• FCF $4,113M (35.8%) + net-cash structure — the blitz fuel is generated internally
• Platformization: large deals directly displacing legacy products, ~220 new platform deals in Q4 (record)
• Subscriptions + support 80.1% of revenue; deferred revenue $14,756M — contracted visibility
• No single end customer above 10% — end-demand diversification

Concerns

• GAAP operating margin 13.5% → 6.1%, net income −72.9% — SBC $1,815M (15.8%) + acquisition amortization weigh
• Shares outstanding +22% (CyberArk consideration) — per-share dilution
• Two distributors at 30% of revenue — channel concentration
• $151M patent reserve (Centripetal, on appeal) + PAN-OS CVE-2026-0257 exploitation reported (Oct 2026)
• G2 pass margin is thin (1.06× on software alone) — the verdict is scope-sensitive

Research notes

1. Current Position: A Large Company Running Well, Not Exploding

Palo Alto Networks enters this scoring period as a first-time scored company in the BlitzLab system, and the first thing the assessment establishes is a distinction that governs everything that follows. This is a company that is plainly still growing fast, and just as plainly no longer exploding. Revenue of $11,480 million in fiscal 2026, up 24.5 percent year on year on confirmed figures in the fiscal 2026 Form 10-K filed on September 10, 2026, is the headline. But the score file is careful to separate that headline from its composition, and the separation matters. Acquisitions contributed $930 million to fiscal 2026 revenue, so the underlying growth rate, excluding that contribution, is calculated at approximately 14.4 percent. That is still double-digit growth, sustained, and it is the reason Gate 1 passes. It is not, however, the kind of growth that earns the top of the scale, and the score reflects the difference rather than smoothing it away. The company's own summary in the score file puts it plainly: a score of 61 describes a company running well at large scale, not a company in the middle of an explosion.

The gates frame the assessment before any item is scored. Gate 1, which asks whether growth continues or a second growth curve exists, passes on confirmed figures. The five-year sequence runs from 29.3 percent growth in fiscal 2022, to 25.3 percent in fiscal 2023, to 16.5 percent in fiscal 2024, to 14.9 percent in fiscal 2025, and back up to 24.5 percent in fiscal 2026, a five-year compound annual growth rate of 21.9 percent, all confirmed in SEC filings. The dip in the middle of that sequence and the rebound at the end are both visible, and the rebound is the part that requires the acquisition adjustment described above. Even after that adjustment, the underlying rate remains in the mid-teens, so the gate passes on the first curve — continued growth — rather than on any promise about a second one. Gate 2, which asks whether the ten-year ceiling of the new market is at least ten times current revenue, passes on an estimate, and passes thinly. Ten times trailing revenue of $11,480 million sets a bar of approximately $114.8 billion. Against that bar, the narrowly defined market used in the score file — Gartner's information-security spending categories of Security Software and Network Security, forecast at $121,154 million and $25,825 million respectively for 2026, for a combined $146,979 million — stands at 1.28 times the bar. The score file is explicit that this is a range-sensitive pass: Security Software alone, at $121,154 million, would stand at only 1.06 times the bar, leaving almost no margin. Observability and general information-technology spending were deliberately not included in the range. The gate therefore passes, but the quality of the two passes differs sharply — confirmed operating history on one side, a forecast-based market definition with a thin margin on the other — and that difference in evidence quality runs through the whole score.

The fiscal calendar matters for what this assessment does and does not cover. Fiscal 2026 is the year ended July 31, 2026, and the latest results available at T are the fiscal 2026 Form 10-K. The first quarter of fiscal 2027, which ended October 31, 2026, falls after T and is therefore excluded from this assessment. No earnings date for that quarter is stated in the score file, and none is asserted here. The confidence level recorded in the score file is high, resting on direct review of the full text of the fiscal 2026 Form 10-K on SEC EDGAR, with some items resting on earnings-call and press-reported material, and those items are labeled as such wherever they appear below.

The shape of the total is worth stating at the outset because it explains the grade. Speed contributes 19 of 25 points, moat 38 of 60, and creative destruction 11 of 15, for 76 points before deductions; demerits of 7 bring the total to 61, four points short of the 65-point line BlitzLab treats as success. No flag applies, since demerits of 7 sit well below the 15-point flag threshold. Converted to the radar-chart axes the model uses, moat stands at 63.3 out of 100, speed at 76.0, and creative destruction at 73.3. Speed is therefore the strongest axis in relative terms, moat the weakest, and that ordering is itself informative: this is a company whose engine still runs faster than its defensive walls are thick, at least as the model measures walls. The rest of this assessment works through why.

2. Speed: Sustained Double-Digit Growth, With an Acquisition Footnote That Cannot Be Ignored

Speed scores 19 out of 25, and its composition describes a company that is genuinely fast for its size while falling short of the explosive tier on every item. Growth itself earns 8 out of 10, the strongest speed item, and the reasoning turns on the distinction already drawn between headline and underlying growth. The confirmed five-year arc — 29.3 percent, 25.3 percent, 16.5 percent, 14.9 percent, 24.5 percent — shows a company that never stopped growing at double-digit rates, even through the deceleration in fiscal 2024 and fiscal 2025. The fiscal 2026 rebound to 24.5 percent restores the appearance of acceleration, but the $930 million acquisition contribution means the underlying rate of approximately 14.4 percent is closer to a continuation of the mid-teens trend than to a return to the high twenties of the early part of the sequence. The two points withheld from the maximum record exactly that: this is sustained double-digit growth, not hypergrowth, and the model does not award its top marks for a growth rate in the mid-teens, however durable. The durability itself deserves emphasis, though. Five consecutive years of double-digit growth at a revenue scale rising to $11.5 billion is a record that few companies sustain, and the score file treats it as such while refusing to let the acquisition-assisted headline stand in for the underlying rate.

Capital velocity earns 4 out of 5, and the reasoning turns on a balance sheet that is, on the funding side, about as clean as a company of this scale gets. Cash plus investments stood at $7,906 million, bank borrowing was zero, and a $400 million revolving facility was undrawn, all confirmed in the Form 10-K. Free cash flow of $4,113 million, a margin of 35.8 percent, means the fuel for continued expansion is generated internally rather than raised externally. The offset, and the reason the item stops at 4 rather than 5, is dilution: shares outstanding rose from 668 million to 815 million, an increase of 22 percent, as consideration for the CyberArk acquisition. Capital access is therefore at the highest level — a company with nearly $8 billion in cash and investments, no bank debt, and free cash flow above $4 billion does not face a funding constraint — but that access was partly bought with equity, and the model records the cost of that purchase rather than ignoring it. A company that can fund its own blitz from operations is in a different position from one that must return to the market for every step, and Palo Alto Networks is in the former position; the share-count increase is the price it paid to get there faster by acquisition.

Hiring and productivity earn 3 out of 5, the most modest speed item, and the modesty is again a matter of composition rather than of direction. Headcount stood at 21,921 employees, an increase of 4,223 attributable to CyberArk, confirmed in the Form 10-K. Revenue per employee, calculated from those figures, is approximately $0.52 million per person. Hiring and expansion are plainly in blitz mode — more than four thousand people arriving through a single acquisition is expansion at a pace few companies attempt — but because the headcount figure includes the acquired workforce, the productivity indicator cannot be read as a clean measure of organic efficiency, and the score file scores the item conservatively at 3 for that reason. The withheld points are a reserve for measurement clarity, not a judgment that the company is hiring slowly. If anything, the opposite is true: the hiring is so acquisition-driven that the underlying productivity trend is obscured, and the model prefers to mark the obscurity rather than pretend it away.

Share velocity earns 4 out of 5, and here the evidence is at its strongest within the speed axis. Next-generation security annual recurring revenue reached $9.1 billion, up 63 percent, and remaining performance obligations reached $21.2 billion, up 34 percent, both confirmed in the Form 10-K. The fourth quarter added approximately 220 new platformization deals, described on an earnings-call basis as the largest such quarterly number on record, and large deals in which legacy proxy and legacy security-information-and-event-management products were displaced are disclosed. What keeps the item at 4 rather than 5 is a measurement gap: no quantified market-share figure has been confirmed, so the model cannot verify the company's share of its market as a number, and it refuses to infer one from deal counts and growth rates. The pattern across the speed axis is therefore consistent. Growth is confirmed and durable but acquisition-assisted. Capital is abundant but dilution-accompanied. Hiring is rapid but acquisition-obscured. Market momentum is demonstrated in contracted revenue and deal flow but not yet quantified as share. Speed of 19 out of 25 is the score of a company running hard with its footnotes attached.

3. Moat: A Platform Being Assembled, With Distribution Ahead of Network Effects

Moat scores 38 out of 60, the largest subscore in absolute terms, and its internal pattern is the most instructive part of this assessment. Distribution is strong, market size is substantial but partly already occupied, gross margin is high but falling, and the classic network effect is structurally absent. The moat, in other words, is being built by assembly and by selling, not by the self-reinforcing user dynamics that the top of the moat scale describes — and the score file is candid about that.

Network effects earn 8 out of 18. The score file states the position plainly: there is no genuine user network effect. What exists instead is a set of partial substitutes. The platform now integrates Prisma, Cortex, Idira, and Chronosphere, bringing network security, security operations, identity security, and observability under one roof. Threat intelligence accumulates through Unit 42 and WildFire, so the company's view of the threat landscape deepens as its footprint widens. And the platformization cohort shows net revenue retention above 120 percent on an earnings-call basis, meaning customers who adopt the platform expand their spending with it. The score file rates this item above the comparable NBIS mark of 7 precisely because the integration has revenue evidence behind it — remaining performance obligations of $21.2 billion are contracted proof that customers are buying the integrated platform, not merely being offered it. But 8 out of 18 remains a low absolute mark, and the reason is structural: a customer joining the platform does not make the product more valuable to other customers in the way a user joining a network does. Switching costs, data accumulation, and integration depth are real defenses, and they are scored elsewhere in the moat, but they are not network effects, and the model does not relabel them as such. Ten points are withheld because the mechanism the item measures is, by the score file's own account, not present in its genuine form.

Distribution scalability earns 13 out of 18, the strongest moat item, and here the evidence is at its firmest. Customers span more than 180 countries, most of the Fortune 100 are customers, subscription plus support revenue accounts for 80.1 percent of total revenue, deferred revenue stands at $14,756 million, and remaining performance obligations stand at $21.2 billion, all confirmed in the Form 10-K. That combination — global reach, penetration of the largest enterprises, a revenue base four-fifths recurring, and more than $21 billion already contracted — is what distribution scalability looks like when it is measured rather than asserted. A customer base that has already contracted $21.2 billion of future revenue does not need to be re-won each quarter, and a subscription share above 80 percent means the revenue engine compounds from its existing base rather than restarting from zero. The discount, and the reason the item stops at 13 rather than higher, is channel concentration: two distributors account for 30 percent of revenue, 15 percent each. That concentration is not a criticism of the distributors themselves, and the score file records that no single end customer exceeds 10 percent of revenue, so final demand is dispersed. But the route to that dispersed demand runs through two concentrated channels, and a disruption in either channel would reach a disproportionate share of revenue. Distribution that is broad at the customer end and narrow at the channel end is strong but not unqualified, and the score holds both halves of that sentence at once.

Market size earns 9 out of 12, following directly from Gate 2. The narrowly defined market of $147.0 billion is large in absolute terms, and the gate passes against it. What keeps the item below the maximum is occupancy: the company already holds 7.8 percent of that narrowly defined market, so the headroom within the defined ceiling is not as large as the absolute figure suggests. A market that is already nearly one-twelfth occupied by the company being scored is a different opportunity from an untouched market of the same size, and the model marks the difference. The thinness of the Gate 2 pass reappears here as a constraint on the moat: the ceiling is high, but the company is already standing partway up the wall, and the range definition itself is sensitive, as the software-only figure of 1.06 times the bar shows. Gross margin earns 8 out of 12, completing the moat with a characteristic split between level and trend. The gross margin level of 70.4 percent is high, and the free cash flow margin of 35.8 percent is, in the score file's words, top-class cash economics. But the gross margin fell from 73.4 percent in the prior year, and the generally accepted accounting principles picture moved adversely alongside it: the operating margin fell from 13.5 percent to 6.1 percent, and net income fell from $1,134 million to $307 million, a decline of 72.9 percent, attributed to stock-based compensation of $1,815 million, intangible-asset amortization, and convertible-note fair-value losses. A margin that is high in level but falling in trend, with a widening gap between cash generation and reported profit, earns 8 rather than more: the level is genuinely strong, the direction is genuinely adverse, and the score refuses to let either fact cancel the other.

4. Creative Destruction: Replacing the Point Product With the Platform

Creative destruction scores 11 out of 15, and its three items trace a displacement that is well underway and a behavior change that is already contracted, with a cost-structure claim that remains unmeasured. The order being displaced earns 4 out of 5, the strongest creative-destruction item. The old order is the point solution: separate products for separate security problems, legacy security-information-and-event-management systems, and legacy proxy products, each bought and operated on its own. The new order is the platform: a single integrated stack into which those functions collapse. The evidence is not merely architectural but transactional. XSIAM, the company's security-operations platform, is displacing legacy SIEM products, and large deals are disclosed in which legacy proxy products were directly replaced. That is displacement measured in won deals rather than described in strategy documents, and it is why the item earns 4. The withheld point is a scope reserve: relative to the entire security stack, the displacement so far covers only part of the territory, and the model keeps the distinction between a clear direction and a completed substitution visible.

Irreversible behavior change earns 4 out of 5, on evidence that is contractual rather than rhetorical. Subscription contracts run one to five years, deferred revenue stands at $14,756 million, and remaining performance obligations stand at $21.2 billion, all confirmed. Once a customer has consolidated its security stack onto an integrated platform, returning to a collection of point products carries a real cost — re-integration, re-training, and the loss of the unified threat view — and the contracted revenue figures are the financial footprint of that lock-in. A customer that has committed $21.2 billion in aggregate future obligations across the base has, in practical terms, already changed how it buys security, and the model scores that commitment as behavior change rather than as mere revenue. Cost-structure change earns 3 out of 5, the most modest creative-destruction item, and the modesty is a measurement gap rather than a doubt about direction. XSIAM's artificial-intelligence security-operations automation and Prisma AIRS, the company's artificial-intelligence security offering, are presented as changing customers' security-operations-center cost structures — automating work that previously required human analysts at greater scale. But no measured figure for customer cost savings has been disclosed, so the magnitude of the change cannot be verified, and the score file records the item on a press-reported basis at 3. The pattern across the three items is therefore consistent: displacement demonstrated in deals, behavior change demonstrated in contracts, cost change claimed in product design but not yet measured in customer results. A score of 11 out of 15 describes a company well into its creative destruction, with the final points reserved for completion and measurement.

5. Deductions and Risks: A Light Bill, Dominated by What the Acquisitions Left Behind

Demerits total 7 points, and their composition explains why a company with 76 points before deductions finishes at 61 rather than higher — and why, at the same time, no flag applies. Every deduction is small, and every one traces back, directly or indirectly, to the acquisition strategy that also drives the growth story. Debt earns a deduction of 2 points. On the funding side, the position is, as noted above, a net-cash one: bank borrowing of zero, with the remaining convertible notes being the CyberArk 2030 notes at $1.1 billion of principal, carried at $1,774 million on a fair-value-option basis, set against cash plus investments of $7,906 million. A company in that position does not face a funding risk in any ordinary sense. The deduction comes from what sits alongside the funding position: goodwill plus intangible assets of $29,027 million, equal to 59.9 percent of total assets, purchase commitments of $8.3 billion, and the volatility of convertible-note fair values, which produced a $562 million loss in fiscal 2026. Nearly three-fifths of the balance sheet is, in effect, the capitalized record of acquisitions past, and that concentration is a real claim on future performance: the goodwill must be justified by the cash flows of the acquired businesses, and the fair-value volatility means reported earnings will continue to move with market prices regardless of operating performance. A deduction of 2 records that the funding is comfortable while the acquisition balance sheet is heavy, and the model scores both facts.

Revenue quality earns a deduction of 2 points, and the small size of the deduction is itself a positive finding. There has been no restatement, no auditor change, and no audit-opinion issue, and internal controls are recorded as effective, with the permitted exclusion of CyberArk in its first year. The deduction is for complexity rather than for misconduct: the non-organic character of acquisition-contributed growth, the gap between generally accepted accounting principles and non-GAAP results — the fourth quarter showed a GAAP net loss against a non-GAAP profit — and stock-based compensation of 15.8 percent of revenue. None of those is an accounting irregularity, and the score file is explicit that this is not a finding of misstatement. But complexity has a cost for a reader of the accounts: when headline growth includes a large acquired component, when quarterly GAAP and non-GAAP results point in opposite directions, and when stock-based compensation absorbs nearly a sixth of revenue, the reported numbers require more interpretation than a simpler company's would. A deduction of 2 prices that interpretive burden without overstating it.

Governance earns a deduction of 1 point, the smallest demerit, and its smallness is informative. There are no differential voting rights; the company has a single class of common stock, confirmed in the Form 10-K. The deduction rests on a single reported event: a chief-executive prepaid forward transaction covering 500,000 shares, reported on October 14, 2026, in a Form 4 report as covered in the press. A prepaid forward is not a direct sale, and the score file records it as governance noise rather than as an exit. The restraint in the item is equally notable for what it excludes: press reports of executive sales in September are recorded in the score file as unconfirmed in primary sources and are therefore not reflected in the score at all. A model that declined to score an unconfirmed report, while scoring a confirmed filing-based report at only 1 point, is exercising exactly the discipline the rest of this assessment has shown — marking what is evidenced, and only what is evidenced. Regulation and social cost earn a deduction of 2 points, on two concrete items. A patent-litigation provision of $151 million stands against Centripetal, where a judgment of $114 million was reduced on appeal and remains under appeal. Separately, a PAN-OS vulnerability, CVE-2026-0257, was identified in May 2026 and patched, with exploitation reported in October 2026 according to a Unit 42 report dated October 19, 2026. No enforcement action is recorded. The deduction of 2 records that litigation and vulnerability-response costs are real and present, without treating either as an existential threat to a company of this scale. Taken together, the four deductions — 2 for the acquisition-heavy balance sheet, 2 for accounting complexity, 1 for a governance event, 2 for litigation and vulnerability costs — total 7, and the arithmetic of the shortfall follows directly: without them, the company would stand at 68, above the 65-point line; with them, it stands at 61. The gap between this score and success is therefore not a story about a failing business. It is a story about the bills attached to a successful acquisition strategy.

6. The Blitzscaling Fit: Buying Speed, Then Having to Prove the Purchase

Stepping back from the item scores, the score file's blitzscaling analysis places Palo Alto Networks in a recognizable type: a mature blitzer in the late phase of its blitz, now in the platform-completion stretch, whose main lever is platform integration combined with capital, whose secondary levers are distribution through its channel network and data through its threat intelligence, and whose weak lever is the network effect. That typing is consistent with every item score above. The platform is the strategy: point products are bought or built into a single stack, and customers are moved onto the stack as a whole. The capital is the accelerant: a $21.1 billion acquisition of CyberArk, as recorded in the score file's key drivers, bought identity security in a single transaction rather than building it over years, and Chronosphere added observability alongside it. The distribution network of more than 180 countries and the threat-intelligence data of Unit 42 and WildFire are the supporting levers that make the platform sellable and defensible. And the network effect, the classic blitzscaling lever, is the one that is structurally absent — the moat here is integration and switching cost, not user-to-user reinforcement.

The trade-off this company has made between speed and efficiency is unusually legible, and it is best understood as a bargain struck in a single decision: to acquire speed rather than build it. CyberArk and Chronosphere delivered identity security and observability immediately, and the fiscal 2026 growth rebound to 24.5 percent, the next-generation security recurring revenue growth of 63 percent, and the record quarterly platformization deal count are the visible returns on that purchase. The price is equally visible, and it appears in every part of the score: the share count up 22 percent, goodwill and intangibles at 59.9 percent of total assets, the GAAP operating margin compressed from 13.5 percent to 6.1 percent, net income down 72.9 percent, and an acquisition-contributed operating loss of $797 million weighing on reported profitability. Free cash flow of $4,113 million at a 35.8 percent margin shows that the engine itself has not run dry — the fuel for the blitz is still generated internally — but the reported profit has absorbed the full cost of the purchase while the cash flow has not. That divergence between cash economics and reported profit is the central financial fact of this scoring period, and it is why the gross-margin and revenue-quality items both record a split verdict: strong in cash terms, compressed in accounting terms.

The stage judgment follows from that bargain. At $11.5 billion of revenue, with subscription plus support at 80.1 percent and remaining performance obligations of $21.2 billion, this is not a company in the explosive phase of its first blitz. It is a company in the consolidation phase that follows one: the platform is being completed, the acquired pieces are being integrated, and the question for the coming periods is whether the assembled platform expands faster than the sum of its acquired parts. The score file names the single largest risk in a sentence that captures the whole position: if acquisition becomes the strategy, integration becomes destiny. With $29 billion of goodwill and intangibles on the balance sheet, the next two years will be decided less by new product launches than by whether the CyberArk integration succeeds — whether identity security cross-sells into the existing base, whether the platformization cohort's retention above 120 percent extends to the acquired customer base, and whether the acquisition-contributed losses narrow as amortization and integration costs are absorbed. If integration falters, the score file warns, margin, retention, and market confidence would move together, because they are now tied to the same event. That concentration of fate in a single integration is the deepest risk in this assessment, deeper than any single deduction, because it is the risk that the deductions are all pointing at from different directions.

The path to 65 points, four points away, is also legible from the item scores, and the score file names its two most plausible routes. The first runs through the network-effect item: if platformization-cohort retention and expansion were disclosed as company-wide net dollar retention, converting a cohort observation into a company-wide measurement, the integration's revenue evidence would harden from a cohort claim into a company fact, and the weakest moat item could rise. The second runs through the gross-margin item: if the GAAP margin recovers as stock-based compensation and amortization are absorbed, the split verdict between cash economics and reported profit would narrow, and the moat's profit item could rise with it. The counterweights are equally named: the two-distributor concentration at 30 percent of revenue, and the patent litigation, are the downside variables that could move the score the other way. A four-point gap with two named upside routes and two named downside variables is a genuinely open position, not a foregone conclusion in either direction, and the next scoring period will be decided by which of those four variables moves first and by how much.

7. What to Watch

Several observable markers will determine whether this 61/B rises, stays level, or falls, and each of them is already named in the score file's evidence. The first is the integration itself, and its most direct measurement will be the acquired businesses' contribution to the platform metrics: whether next-generation security annual recurring revenue continues its 63 percent trajectory, whether remaining performance obligations continue to grow from $21.2 billion, and whether the platformization deal count remains near the record quarterly level of approximately 220. A second, subtler measurement is the disclosure the score file identifies as the key to the network-effect item: any company-wide net dollar retention figure, as distinct from the platformization cohort's above-120 percent retention reported on an earnings-call basis, would convert the integration's strongest anecdotal evidence into a company-wide fact. Until such a figure appears, the cohort number should be read as what it is — evidence about the customers who have adopted the platform, not about the whole base.

The second marker is the margin split. The gross margin of 70.4 percent, down from 73.4 percent, the GAAP operating margin of 6.1 percent, down from 13.5 percent, and net income of $307 million, down 72.9 percent from $1,134 million, will show in the next results whether the acquisition costs are being absorbed or are becoming structural. The components to watch separately are stock-based compensation, at $1,815 million or 15.8 percent of revenue, intangible amortization, and convertible-note fair-value movements, which produced a $562 million loss in fiscal 2026 and will continue to move reported earnings with market prices. If the GAAP margin recovers toward its prior level while free cash flow holds near its 35.8 percent margin, the split verdict narrows in the company's favor. If the GAAP margin stays compressed while the free cash flow margin also softens, the compression is becoming the story rather than a transitional cost. The third marker is the balance sheet left behind by the acquisitions: goodwill plus intangibles at $29,027 million, purchase commitments of $8.3 billion, and the CyberArk 2030 notes at $1.1 billion of principal against cash plus investments of $7,906 million. None of those figures is threatening on its own against a cash position of that size, but their direction matters — whether goodwill grows further through additional acquisitions, whether purchase commitments are drawn down or extended, and whether the convertible-note fair value continues to inject volatility into reported results.

Two further markers sit at the boundary between the scored business and the unscored future. One is the channel concentration: whether the two distributors' combined 30 percent share of revenue diversifies, and whether any single end customer approaches the 10 percent threshold that none currently exceeds. The other is the regulatory and security docket: the progress of the Centripetal appeal, where a $151 million provision stands against a judgment reduced to $114 million, and any further exploitation reports or disclosures relating to the PAN-OS vulnerability CVE-2026-0257, identified in May 2026 and patched before exploitation was reported in October 2026. Either docket could move the regulation item in either direction, and both are matters of public record to be checked rather than assumed. Finally, the outlook figures that the model deliberately excludes from the score are recorded here, labeled as outlook only: fiscal 2027 guidance of revenue of $14.10 billion to $14.20 billion and next-generation security annual recurring revenue of $11.075 billion to $11.175 billion. Those figures are a forecast, not a scoring input, and they are included only so that a reader can compare the company's own expectations against the next period's reported results when they arrive. The business score does not look at price, following the lesson of BlitzLab's earlier testing that a business score and a market price measure different things, and no price, target, or return expectation appears in this assessment for that reason.

Palo Alto Networks at 61/B is, in the end, a portrait of a large company that has bought its way into the next phase of its own story and is now living with the purchase. Five years of double-digit growth, next-generation security recurring revenue of $9.1 billion growing at 63 percent, contracted revenue of $21.2 billion, a subscription share above 80 percent, free cash flow of $4,113 million, and a net-cash funding position — that is the business, and it scores 76 before deductions. A share count up 22 percent, goodwill and intangibles at nearly 60 percent of total assets, a GAAP operating margin compressed from 13.5 percent to 6.1 percent, net income down 72.9 percent, a 30 percent channel concentration, a $151 million patent provision, and a patched vulnerability with reported exploitation — that is the bill, and it costs seven points, with four more points separating the result from the 65-point line. Whether the next period closes that gap will depend less on whether the company keeps growing, which it has done for five consecutive years, than on whether the CyberArk integration — the purchase on which the whole platform bet now rests — turns acquired revenue into platform retention, acquired costs into absorbed costs, and an assembled stack into a single company.

More Platforms companies

Other Platforms names on the Blitz Index, highest score first: Alphabet (83/A), Meta (78/B), Airbnb (76/B).

Next earnings

Nov 18, 2026 · After close · Confirmed

Coverage

Palo Alto Networks, Inc. · Q1 FY2027 earnings date unconfirmed · Score 61 · Grade B

Embed this score

Copy the HTML below to show this score on your site. The badge links back to this page and updates automatically when the score changes.

<a href="https://blitzlab.app/companies/panw/"><img src="https://blitzlab.app/badge/panw.svg" alt="Palo Alto Networks, Inc. Blitz Index 61/B — BlitzLab"></a> Copy HTML

Preview:

BlitzLab scores businesses against a scholar’s standard — not investment advice. No price targets, no buy/sell recommendations. Figures are from SEC filings (XBRL) as labeled in the source scorecard.