# How Palo Alto Networks makes money

CXProWealth Business Lens · Palo Alto Networks (PANW) · FY2026

Read from the 10-K for the period 2025-08-01 to 2026-07-31, filed 2026-09-10 with the SEC (accession 0001327567-26-000023): https://www.sec.gov/Archives/edgar/data/1327567/000132756726000023/

Business Lens explains how a company earns, spends and keeps its money, from its own filings. It is insight and context, never a view on the shares, a target, or advice. Figures are raw units as filed; percentages are percentage points.

## Headline figures

- Revenue: $11.5B (+24.5% on the year)
- Operating income: $695.0M (operating margin 6.1%)
- Net income: $307.0M (net margin 2.7%)
- Gross margin: 70.4%
- Free cash flow: $4.1B (35.8% of revenue)
- Cash conversion (operating cash flow / net income): 14.83x
- Capital expenditure: 3.8% of revenue

## Where the money goes (FY2026)

- Product → Revenue: $2.3B
- Subscription and support → Revenue: $9.2B
- Revenue → Cost of revenue: $3.4B
- Revenue → Total gross profit: $8.1B
- Total gross profit → Total operating expenses: $7.4B
- Total operating expenses → Research and development: $2.6B
- Total operating expenses → Sales and marketing: $3.9B
- Total operating expenses → General and administrative: $899.0M
- Total gross profit → Operating income: $695.0M
- Operating income → Other income (expense), net: $159.0M
- Operating income → Income before income taxes: $536.0M
- Income before income taxes → Provision for (benefit from) income taxes: $229.0M
- Income before income taxes → Net income: $307.0M

## Where the revenue comes from

### Products and services (CONSOLIDATED STATEMENTS OF OPERATIONS)

| Member | Value | Share |
|---|---:|---:|
| Subscription and support | $9.2B | 80.1% |
| Product | $2.3B | 19.9% |

The members sum to total revenue.

### Regions (Revenue (Disaggregation of Revenue - Geographic Theater) (Details))

| Member | Value | Share |
|---|---:|---:|
| Total Americas | $7.7B | 66.9% |
| Europe, the Middle East, and Africa (“EMEA”) | $2.4B | 21.1% |
| Asia Pacific and Japan (“APAC”) | $1.4B | 12.0% |
| Other Americas | $571.0M | 5.0% |

The members do not sum to total revenue.

## Income statement, as filed

| Line | FY2026 | Of revenue |
|---|---:|---:|
| Revenue | $11.5B | 100% |
|   Product | $2.3B | 19.9% |
|   Subscription and support | $9.2B | 80.1% |
| Cost of revenue | $3.4B | 29.6% |
|   Product | $568.0M | 4.9% |
|   Subscription and support | $2.8B | 24.7% |
| **Total gross profit** | $8.1B | 70.4% |
| Research and development | $2.6B | 22.2% |
| Sales and marketing | $3.9B | 34.2% |
| General and administrative | $899.0M | 7.8% |
| **Total operating expenses** | $7.4B | 64.3% |
| **Operating income** | $695.0M | 6.1% |
| Other income (expense), net | -$159.0M | 1.4% |
| **Income before income taxes** | $536.0M | 4.7% |
| Provision for (benefit from) income taxes | $229.0M | 2.0% |
| **Net income** | $307.0M | 2.7% |
| Net income per share, basic (in usd per share) | $0 | 0.0% |
| Net income per share, diluted (in usd per share) | $0 | 0.0% |
| Weighted-average shares used to compute net income per share, basic (in shares) | 749,000,000 |  |
| Weighted-average shares used to compute net income per share, diluted (in shares) | 764,000,000 |  |

## History

| Period | Revenue | Operating income | Net income | Operating cash flow | Capital expenditure | Free cash flow |
|---|---:|---:|---:|---:|---:|---:|
| FY2011 | $118.6M | -$10.4M | -$12.5M | $32.1M | $13.0M | $19.1M |
| FY2012 | $255.1M | $3.9M | $737.0K | $77.4M | $14.6M | $62.8M |
| FY2013 | $396.1M | -$18.6M | -$29.2M | $114.5M | $22.4M | $92.1M |
| FY2014 | $598.2M | -$215.3M | -$226.5M | $88.4M | $36.1M | $52.3M |
| FY2015 | $928.1M | -$99.8M | -$131.3M | $352.8M | $33.8M | $319.0M |
| FY2016 | $1.4B | -$157.3M | -$192.7M | $658.6M | $72.5M | $586.1M |
| FY2017 | $1.8B | -$165.8M | -$203.0M | $868.8M | $163.4M | $705.4M |
| FY2018 | $2.3B | -$104.2M | -$122.2M | $1.0B | $112.0M | $926.1M |
| FY2019 | $2.9B | -$54.1M | -$81.9M | $1.1B | $131.2M | $924.4M |
| FY2020 | $3.4B | -$179.0M | -$267.0M | $1.0B | $214.4M | $821.3M |
| FY2021 | $4.3B | -$304.1M | -$498.9M | $1.5B | $116.0M | $1.4B |
| FY2022 | $5.5B | -$188.8M | -$267.0M | $2.0B | $192.8M | $1.8B |
| FY2023 | $6.9B | $387.3M | $439.7M | $2.8B | $146.3M | $2.6B |
| FY2024 | $8.0B | $684.0M | $2.6B | $3.3B | $157.0M | $3.1B |
| FY2025 | $9.2B | $1.2B | $1.1B | $3.7B | $247.0M | $3.5B |
| FY2026 | $11.5B | $695.0M | $307.0M | $4.6B | $440.0M | $4.1B |

Latest trend (the newest full year against the year before; a reading, not a forecast):

- Revenue: +24.5% (year before +14.9%): accelerating
- Operating income: -44.1% (year before +81.7%): slowing
- Net income: -72.9% (year before -56.0%): slowing
- Free cash flow: +18.6% (year before +11.9%): accelerating

## Operating figures stated in the filing

- Global workforce: 21,921 employees (as of 2026-07-31). "With a global workforce of 21,921 as of July 31, 2026" (Item 1. Business)
- Channel partners: 8,700 partners (as of 2026-07-31). "As of July 31, 2026, we had more than 8,700 channel partners." (Item 1. Business)
- Countries with end-customers: 180 countries (as of 2026-07-31). "As of July 31, 2026, we had end-customers in over 180 countries." (Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations)
- Share of revenue through two distributors: 30.0% (as of 2026-07-31). "For fiscal 2026, 30% of our total revenue was derived from sales to two distributors." (Item 1. Business)
- Prisma Access locations: 100 locations (as of 2026-07-31). "With more than 100 locations around the world, Prisma Access offers global coverage, consistently inspecting all traffic across all ports and providing bidirectional networking to enable branch-to-branch and branch-to-headquarter traffic." (Item 1. Business)

## Key insights

### Free cash flow rose while net income fell

Free cash flow reached $4.11B, 35.8% of revenue, while net income fell 72.9% to $307 million: cash and reported profit moved apart.

Operating cash flow was $4.55B against net income of $307 million, 14.8 times as much. After $440 million of capital spending, free cash flow was $4.11B, up from $3.47B a year earlier. The filing says operating cash flow is driven in large part by product sales and "up-front payments for subscription and support offerings", and that it looks at cash "without the non-cash effects of certain items such as share-based compensation costs, depreciation, and amortization." _(from the filing)_
The gap is not new. From FY2019 to FY2022 the company reported an operating loss every year, including $304.1 million in FY2021, while free cash flow stayed positive, $1.39B in FY2021. Free cash flow has exceeded operating income in every year shown; this year it was $4.11B against operating income of $695 million. _(from the filing)_
Analysis: several of the charges that cut this year's profit do not use cash. Amortization of acquired intangibles and share-based pay reduce net income but are added back to operating cash flow, and up-front billing brings cash in before revenue is recognized. Share-based pay is still a cost, settled in shares rather than cash, which is why the rise in the share count belongs next to the free cash flow figure. _(analysis)_
Free cash flow margin slipped to 35.8% from 37.6% a year earlier. Capital spending rose to $440 million from $247 million, equal to 9.7% of operating cash flow. _(from the filing)_

### Operating margin more than halved as revenue grew 24.5%

Of the 7.43 points of operating margin lost, 3.06 came from a lower gross margin and 4.36 from heavier operating expenses, costs the filing ties in large part to the acquisitions.

Operating margin fell to 6.05% from 13.5%, and operating income fell 44.1% to $695 million, while revenue grew 24.5% to $11.48B. Cost of revenue rose to 29.64% of revenue, taking 3.06 points off gross margin. Operating expenses rose to 64.3% of revenue, 4.36 points more: general and administrative added 3.03 points, research and development 0.71 and sales and marketing 0.62. _(from the filing)_
General and administrative more than doubled, to $899 million from $443 million. The filing ties the rise to "accelerated vesting of certain equity awards in connection with our acquisitions", severance connected with the CyberArk acquisition, headcount growth and higher acquisition-related costs. In cost of revenue it names amortization of intangible assets from the acquisitions, higher cloud hosting costs and, on hardware, supply chain costs. _(from the filing)_
Operating income of $695 million is close to the $684 million earned in FY2024, but on $11.48B of revenue rather than $8.03B. _(from the filing)_
Analysis: the two kinds of cost behave differently. Severance, accelerated vesting and deal fees sit mostly in general and administrative and are tied to deals already closed, though two more acquisitions, Embrace and Console, closed after year-end. Amortization of acquired intangibles keeps recurring until those assets are written down. How far margin rebuilds depends on the mix between the two, which the annual totals alone do not show. _(analysis)_

### Gross margin stepped down once the deals closed

Gross margin was 73.6% in Q2 FY2026. After CyberArk closed, cost of revenue rose to $974 million in Q3 and $1.11B in Q4: so far a lower level, not a one-quarter dip.

Gross profit was 74.2% of revenue in Q1 FY2026 and 73.6% in Q2 FY2026. Chronosphere closed at the end of January and CyberArk in mid-February, early in Q3 FY2026. Cost of revenue then rose to $974 million in Q3 FY2026 from $685 million in Q2, leaving gross profit of $2.03B on revenue of $3.00B. In Q4 FY2026 cost of revenue was $1.11B and gross profit $2.30B on revenue of $3.41B, so the lower margin held for a second quarter. _(from the filing)_
For the full year, cost of subscription and support rose to $2.84B from $2.04B. The filing attributes it to higher cloud hosting costs for cloud-based offerings, amortization of intangible assets from the year's acquisitions, and personnel costs from headcount growth. Cost of product revenue was $568 million, 24.9% of product revenue of $2.28B, with supply chain costs and amortization named as the pressures. _(from the filing)_
Analysis: this is the part of the margin drop with the longest tail. Amortization of acquired intangibles runs for the assets' useful lives, and cloud hosting grows with cloud-based subscriptions. Gross margin would rebuild only if revenue from the acquired products grows faster than those costs. _(analysis)_
The operating line shows the same step: operating income was $397 million in Q2 FY2026, then a loss of $183 million in Q3 FY2026, and operating income of $172 million in Q4 FY2026. _(from the filing)_

### Per-share earnings fell to a quarter of last year's

Diluted earnings per share fell to $0.40 from $1.60: a convertible-note loss, a 42.7% tax rate and more shares compounded the drop in operating income.

Other income swung to a $159 million expense from $353 million of income. The filing attributes this mainly to a loss on the change in fair value of the convertible notes assumed with CyberArk, partly offset by gains on the related capped calls and on investments sold to fund acquisitions. Income before taxes fell to $536 million from $1.60B. _(from the filing)_
Tax of $229 million on $536 million of pre-tax income is a 42.7% rate, against 28.9% a year earlier ($462 million on $1.60B). The filing says the rate rose on non-deductible changes in the fair value of the notes and capped calls, and on share-based compensation. _(from the filing)_
Basic weighted-average shares rose to 749 million from 663 million, and diluted shares to 764 million from 709 million. Net income fell 72.9% while operating income fell 44.1%. In Q4 FY2026, operating income was $172 million but net income was a loss of $282 million. _(from the filing)_
Analysis: the fair-value swing on the notes moves with the share price, in either direction, and says little about how the business ran. The higher share count is different: it stays unless shares are bought back, so each dollar of future profit is spread over more shares. _(analysis)_

### Competitive edge

- **Four in five revenue dollars come from subscriptions and support** Subscription and support was $9.2B, 80.1% of revenue, on contracts typically running one to five years, often attached to firewalls already in the customer's network.
- **More than 8,700 partners sell into over 180 countries** A two-tier channel of distributors and resellers carries a substantial portion of sales, extending reach into over 180 countries beyond the company's own sales force.
- **Identity and observability widen the one-vendor offer** With CyberArk and Chronosphere, the company sells network security, cloud security, security operations, identity security and observability to buyers trying to cut their vendor count.

### What to watch

- **Two large deals still have to be integrated** The filing warns that integrating CyberArk and Chronosphere may disrupt operations and that the expected synergies may arrive late or not at all.
- **Cloud providers and AI firms may bundle security cheaply** The filing warns cloud providers may bundle security at low or no extra cost and frontier AI firms may enter security, pressuring price and demand.
- **Two distributors carry 30% of revenue** Two distributors accounted for 30% of revenue, and because subscriptions are recognized over their term, a slowdown in new or renewal sales would show late.

## Investor view

**Revenue grew 24.5% as Palo Alto Networks bought into identity and observability, and operating income fell by almost half**

### How it makes money

Palo Alto Networks sells security software, cloud services and firewalls, mostly through a two-tier channel: it sells to distributors, who sell to resellers, who sell to end-customers. Subscription and support brought in $9.2B of the $11.48B in FY2026 revenue, or 80.1%. Product revenue, meaning hardware firewalls and software licenses, was $2.28B, or 19.9%. Subscription and support contracts are "typically one to five years" and are recognized as revenue over that term. _(from the filing)_
The firewall is the entry point. When customers buy a physical, virtual or container firewall, they "typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs", and they can add subscriptions priced per user, per endpoint or by capacity. On the product side, cost of product revenue was $568 million against $2.28B of product revenue, or 24.9%. _(from the filing)_
Customers pay up front for much of what they buy, so cash arrives before revenue is recognized. The filing says operating cash flow is driven in large part by product sales and "up-front payments for subscription and support offerings." Operating cash flow was $4.55B against net income of $307 million. After $440 million of capital spending, free cash flow was $4.11B, or 35.8% of revenue. _(from the filing)_
The channel carries the volume. Two distributors accounted for 30% of total revenue, and the company had more than 8,700 channel partners serving end-customers in over 180 countries. By region, the Americas supplied $7.68B of revenue, 66.9% of the total, EMEA $2.43B and APAC $1.37B. _(from the filing)_

### What shifted

Revenue grew 24.5% to $11.48B from $9.22B, and the filing credits both wider adoption and the year's acquisitions: Chronosphere (observability) closed in January and CyberArk (identity security) in February. Subscription and support grew 24.0% and product revenue 26.5%, the product gain "driven by increased revenue from software licenses, including from our CyberArk acquisition, and increased demand for our new generation of hardware products." _(from the filing)_
Cost of revenue rose 38.8%, faster than revenue, so gross margin fell 3.06 points to 70.4%. Cost of subscription and support rose to $2,835 million from $2,038 million, and cost of product to $568 million from $413 million. The filing names the causes: amortization of intangible assets from the acquisitions, higher cloud hosting costs for cloud-based offerings, and supply chain costs on hardware. _(from the filing)_
Operating expenses rose 33.6% to $7.38B, or 64.3% of revenue, 4.36 points more than a year earlier. General and administrative more than doubled, to $899 million from $443 million, which the filing ties to accelerated vesting of equity awards and severance tied to the acquisitions, plus acquisition costs. Operating income fell 44.1% to $695 million, and operating margin to 6.05% from 13.5%. _(from the filing)_
Below operating income, other income swung to a $159 million expense from $353 million of income, mainly a fair-value loss on the convertible notes assumed with CyberArk. Tax of $229 million on $536 million of pre-tax income is a 42.7% rate, which the filing says rose on non-deductible items. Net income fell 72.9% to $307 million, and diluted earnings per share to $0.40 from $1.60. _(from the filing)_
The deals show in the quarters. Revenue rose from $2.59B in Q2 FY2026 to $3.00B in Q3 FY2026 and $3.41B in Q4 FY2026, while operating income went from $397 million to a loss of $183 million in Q3 FY2026 and back to $172 million in Q4 FY2026. Basic weighted-average shares rose to 749 million from 663 million, spreading a smaller profit over more shares. _(from the filing)_

### Risks in the filing

Integration. The company says integrating CyberArk and Chronosphere "is a complex process that may disrupt our existing operations if not implemented efficiently", and that the expected synergies may come late or not at all. It adds that CyberArk takes it into identity security, a new category with its own competitors, which could bring price cuts and lower margins. _(from the filing)_
New kinds of competitor. Cloud infrastructure providers "may bundle native capabilities with their cloud infrastructure services at low or no incremental cost to customers." Frontier AI model providers may enter security directly or let others build security products on their models. The company also warns that if buyers come to see AI as commoditizing security work, demand could weaken even without a change in its own business. _(from the filing)_
Channel and revenue timing. Two distributors made up 30% of total revenue, and one held a large share of receivables. Because subscriptions are recognized over the contract term, a fall in new or renewal contracts "will not be fully or immediately reflected in that quarter’s revenue", so weakness would show late. A growing share of revenue is priced on usage, which exposes it to customers cutting consumption. _(from the filing)_
Its own security and supply. As a well-known security vendor it is an attractive target, and defects in its products can expose customers. The filing cites an authentication bypass vulnerability found in certain PAN-OS versions during the year, for which it published an advisory and software updates. Hardware is assembled by a contract manufacturer, Flex, and supply contracts generally guarantee neither supply nor fixed prices. _(from the filing)_
Of the named risks, the acquisition costs are the ones the numbers already show: gross margin and operating margin both fell, and the filing ties the drop to the deals. The usage-pricing and AI-competition risks do not appear in the totals yet, since revenue grew in every region and in both product and subscription lines. They are also the risks a single year's figures would be slowest to reveal, because subscription revenue is recognized over the contract term. _(analysis)_

## Founder view: mechanisms

### The device anchors the subscription

A firewall is sold once, but it is only useful while its threat signatures, software and protections stay current. Palo Alto Networks sells the box, then sells the updates, support and add-on security services as subscriptions that renew. The hardware is the foothold; the recurring service is most of the business. Because the device sits in the customer's network, replacing the vendor means replacing the device and retraining the team, which keeps renewals sticky. _(analysis)_

### Up-front billing funds the business

Customers pay for multi-year subscription and support at the start, while revenue is recognized month by month over the term. The company holds the cash long before the accounting profit appears. That timing let it fund growth, research and acquisitions from customer payments even in years when it reported operating losses. _(analysis)_

### Buying categories to sell one platform

Platformization means offering customers one vendor for many security needs, so they can retire point products. Palo Alto Networks builds part of that breadth and buys the rest: this year identity security and observability. The cost is paid up front, in integration expense, amortization of acquired assets and new shares; the payoff, if it comes, is selling several products into each account through one sales relationship. _(analysis)_

### A channel that sells for you

Instead of building a direct sales force in every market, Palo Alto Networks sells through distributors and resellers who already serve the buyer, and keeps its own sellers and sales engineers for large accounts and for training partners. Partners earn margin and program rewards; the company gets reach it could not staff itself, at the cost of concentration in a few large distributors. _(analysis)_

## Member research

Signed-in members read, on the page: what Palo Alto Networks's numbers depend on from here, and the playbook behind each mechanism (what needs scale, what transfers, how to test it, the metric that would show it).

## Sources

- Palo Alto Networks 10-K for the period to 2026-07-31: https://www.sec.gov/Archives/edgar/data/1327567/000132756726000023/ (2026-09-10)

Methodology business-lens-1.0 · schema 1.2.0 · run business-lens-2026-11-02 · as of 2026-11-02