Palo Alto Networks
PANW · NasdaqFree cash flow rose while net income fell
Free cash flow reached $4.11B, 35.8% of revenue, while net income fell 72.9% to $307 million: cash and reported profit moved apart.
FY2026, the fiscal year to Jul 31, 2026 · 10-K filed Sep 10, 2026
- Operating margin
- 6.1%
- Net income
- $307.0M
- Free cash flow
- $4.1B
Largest source of revenue: Subscription and support, 80.1% of the total.
Where Palo Alto Networks's money goes
- 01
Free cash flow rose while net income fell
Free cash flow reached $4.11B, 35.8% of revenue, while net income fell 72.9% to $307 million: cash and reported profit moved apart.
Why it matters
Operating cash flow was $4.55B against net income of $307 million, 14.8 times as much. After $440 million of capital spending, free cash flow was $4.11B, up from $3.47B a year earlier. The filing says operating cash flow is driven in large part by product sales and "up-front payments for subscription and support offerings", and that it looks at cash "without the non-cash effects of certain items such as share-based compensation costs, depreciation, and amortization."1
The gap is not new. From FY2019 to FY2022 the company reported an operating loss every year, including $304.1 million in FY2021, while free cash flow stayed positive, $1.39B in FY2021. Free cash flow has exceeded operating income in every year shown; this year it was $4.11B against operating income of $695 million.1
AnalysisAnalysis: several of the charges that cut this year's profit do not use cash. Amortization of acquired intangibles and share-based pay reduce net income but are added back to operating cash flow, and up-front billing brings cash in before revenue is recognized. Share-based pay is still a cost, settled in shares rather than cash, which is why the rise in the share count belongs next to the free cash flow figure.
Free cash flow margin slipped to 35.8% from 37.6% a year earlier. Capital spending rose to $440 million from $247 million, equal to 9.7% of operating cash flow.1
- 02
Operating margin more than halved as revenue grew 24.5%
Of the 7.43 points of operating margin lost, 3.06 came from a lower gross margin and 4.36 from heavier operating expenses, costs the filing ties in large part to the acquisitions.
Why it matters
Operating margin fell to 6.05% from 13.5%, and operating income fell 44.1% to $695 million, while revenue grew 24.5% to $11.48B. Cost of revenue rose to 29.64% of revenue, taking 3.06 points off gross margin. Operating expenses rose to 64.3% of revenue, 4.36 points more: general and administrative added 3.03 points, research and development 0.71 and sales and marketing 0.62.1
General and administrative more than doubled, to $899 million from $443 million. The filing ties the rise to "accelerated vesting of certain equity awards in connection with our acquisitions", severance connected with the CyberArk acquisition, headcount growth and higher acquisition-related costs. In cost of revenue it names amortization of intangible assets from the acquisitions, higher cloud hosting costs and, on hardware, supply chain costs.1
Operating income of $695 million is close to the $684 million earned in FY2024, but on $11.48B of revenue rather than $8.03B.1
AnalysisAnalysis: the two kinds of cost behave differently. Severance, accelerated vesting and deal fees sit mostly in general and administrative and are tied to deals already closed, though two more acquisitions, Embrace and Console, closed after year-end. Amortization of acquired intangibles keeps recurring until those assets are written down. How far margin rebuilds depends on the mix between the two, which the annual totals alone do not show.
- 03
Gross margin stepped down once the deals closed
Gross margin was 73.6% in Q2 FY2026. After CyberArk closed, cost of revenue rose to $974 million in Q3 and $1.11B in Q4: so far a lower level, not a one-quarter dip.
Why it matters
Gross profit was 74.2% of revenue in Q1 FY2026 and 73.6% in Q2 FY2026. Chronosphere closed at the end of January and CyberArk in mid-February, early in Q3 FY2026. Cost of revenue then rose to $974 million in Q3 FY2026 from $685 million in Q2, leaving gross profit of $2.03B on revenue of $3.00B. In Q4 FY2026 cost of revenue was $1.11B and gross profit $2.30B on revenue of $3.41B, so the lower margin held for a second quarter.1
For the full year, cost of subscription and support rose to $2.84B from $2.04B. The filing attributes it to higher cloud hosting costs for cloud-based offerings, amortization of intangible assets from the year's acquisitions, and personnel costs from headcount growth. Cost of product revenue was $568 million, 24.9% of product revenue of $2.28B, with supply chain costs and amortization named as the pressures.1
AnalysisAnalysis: this is the part of the margin drop with the longest tail. Amortization of acquired intangibles runs for the assets' useful lives, and cloud hosting grows with cloud-based subscriptions. Gross margin would rebuild only if revenue from the acquired products grows faster than those costs.
The operating line shows the same step: operating income was $397 million in Q2 FY2026, then a loss of $183 million in Q3 FY2026, and operating income of $172 million in Q4 FY2026.1
Sources
- 1.Palo Alto Networks 10-K for the period to 2026-07-31 (the filing), Sep 10, 2026, read Nov 2, 2026
Have a question about Palo Alto Networks? Ask CXProWealth on ChatGPT.Free membership required.
Growth, profit and margin
Revenue went from $118.6M in FY2011 to $11.5B in FY2026, the operating margin from -8.8% to 6.1%, over 15 years.
- Revenue$11.5B
- Operating income$695.0M
- Operating margin6.1%
- Period
- FY2026
- Revenue
- $11.5B
- Operating income
- $695.0M
- Operating margin
- 6.1%
- Net income
- $307.0M
- Free cash flow
- $4.1B
Does the profit turn into cash?
FY2026: free cash flow of $4.1B against net income of $307.0M.
- Operating cash flow$4.6B
- Capital expenditure$440.0M
- Free cash flow$4.1B
- Net income$307.0M
Capital expenditure is drawn below the axis as cash out. Cash conversion is operating cash flow over net income, shown in the tooltip for years with a profit.
Financial data and sources
How the revenue mix has shifted
Each breakdown the filing reports, as shares of revenue, for every period it restates.
CONSOLIDATED STATEMENTS OF OPERATIONS. The filing restates this breakdown for 3 periods.
Click a member to isolate it across the years shown.
The figures
Margins, cash and growth for the period, each with what it was computed from.
Where revenue comes from
Every breakdown the filing reports for the period, with each item's share.
Revenue streams
| Subscription and support | $9.2B | 80.1% |
| Product | $2.3B | 19.9% |
Geographic markets
| Total Americas | $7.7B | 66.9% |
| Europe, the Middle East, and Africa (“EMEA”) | $2.4B | 21.1% |
| Asia Pacific and Japan (“APAC”) | $1.4B | 12.0% |
| Other Americas | $571.0M | 5.0% |
These items do not sum to total revenue; the filing states them beside it. Source10-K, us-gaap:RevenueFromContractWithCustomerExcludingAssessedTax, as reported in the 10-K filed 2026-09-10
What it costs
The cost lines beneath operating income, each as a share of revenue, then the operating result.
Costs are reported by function: what it cost to make what was sold, then the expenses of selling, developing and administering.
| Cost line | FY2026 | Of revenue | Source |
|---|---|---|---|
| Cost of revenue | $3.4B | 29.6% | Source10-K, us-gaap:CostOfGoodsAndServicesSold, as reported in the 10-K filed 2026-09-10 |
| Operating income | $695.0M | 6.1% | Source10-K, us-gaap:OperatingIncomeLoss, as reported in the 10-K filed 2026-09-10 |
Operating figures the company states
From the text of the filing rather than its statements, each with the sentence that states it.
View source
As of July 31, 2026, we had more than 8,700 channel partners.
View source
As of July 31, 2026, we had end-customers in over 180 countries.
View source
With a global workforce of 21,921 as of July 31, 2026
View source
With more than 100 locations around the world, Prisma Access offers global coverage, consistently inspecting all traffic across all ports and providing bidirectional networking to enable branch-to-branch and branch-to-headquarter traffic.
View source
For fiscal 2026, 30% of our total revenue was derived from sales to two distributors.
The statements, as filed
The income statement, cash flow statement and balance sheet in the company's own order and words. Every line links to the filing.
Income statement20 lines, as presented in the 10-K
Cash flow statement45 lines, as presented in the 10-K
Balance sheet34 lines, as presented in the 10-K
About this data
- Source
- Palo Alto Networks 10-K, accession 0001327567-26-000023, filed Sep 10, 2026, read on Nov 2, 2026.
- History
- From the SEC's XBRL company facts, the value from the latest filing that stated each period.
- Reading
- Paragraphs marked Analysis are CXProWealth's reading; everything else is the filing's own numbers and words, or a cited source.
- Version
- methodology business-lens-1.0 · schema 1.2.0 · run business-lens-2026-11-02
What holds Palo Alto Networks's model up, and what could bend it
Competitive edge
Four in five revenue dollars come from subscriptions and support
Subscription and support was $9.2B, 80.1% of revenue, on contracts typically running one to five years, often attached to firewalls already in the customer's network.
The detail
When customers buy a physical, virtual or container firewall, they "typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs", and may add subscriptions priced per user, per endpoint or by capacity. Subscription and support grew 24.0% this year and product revenue 26.5%, so the recurring line kept pace with the hardware that anchors it.1
AnalysisAnalysis: a device inside the customer's network is costly to replace, since switching vendors means new hardware, new policies and retraining. That makes renewal the default and gives the company an installed base to sell its acquired identity and observability products into.
The caveat: the filing notes that end-customers "have no contractual obligation to renew" and may renew for shorter terms, on less favorable terms, or not at all.1
More than 8,700 partners sell into over 180 countries
A two-tier channel of distributors and resellers carries a substantial portion of sales, extending reach into over 180 countries beyond the company's own sales force.
The detail
The company sells to distributors, which sell to resellers, which sell to end-customers. Its own sellers focus on large accounts, partner management and pre-sales engineering. At year-end it had more than 8,700 channel partners and end-customers in over 180 countries. The Americas supplied 66.9% of revenue, EMEA 21.1% and APAC 12.0%.1
Sales and marketing remains the largest expense, $3.93B or 34.2% of revenue. Partners running authorized support centers typically deliver level-one and level-two support, and professional services are delivered both directly and through authorized partners.1
AnalysisAnalysis: the channel gives scale the company would otherwise have to staff itself, and lets one sales relationship carry several platforms. The price is concentration in a few large distributors.
Identity and observability widen the one-vendor offer
With CyberArk and Chronosphere, the company sells network security, cloud security, security operations, identity security and observability to buyers trying to cut their vendor count.
The detail
The filing describes its strategy as helping customers "simplify their security architectures through consolidating disparate point products." This year CyberArk formed its identity platform, Idira, and Chronosphere its observability platform, alongside the Network & AI Security and Cortex platforms. Smaller deals, Koi and Portkey, added agentic endpoint security and AI gateway capabilities.1
AnalysisAnalysis: breadth is an edge only while buyers prefer one integrated vendor to the best tool in each category. The filing itself warns that consolidation "may also create opportunities for competitors" offering broader suites. The test is whether existing firewall and Cortex customers add the acquired modules, rather than the acquired customer bases simply being carried over.
What to watch
Two large deals still have to be integrated
The filing warns that integrating CyberArk and Chronosphere may disrupt operations and that the expected synergies may arrive late or not at all.
The detail
The company says integrating CyberArk and Chronosphere "is a complex process that may disrupt our existing operations if not implemented efficiently." CyberArk also takes it into identity security, a new category with its own competitors, which it says could bring "decreased sales, price reductions, increased operating costs, and lower revenues, margins, and net income." The global workforce reached 21,921.1
AnalysisAnalysis: the cost side has already arrived, with operating margin at 6.05% and the filing tying much of the drop to the deals. The benefit side, selling the acquired products into the combined customer base, does not show in one year's figures. Embrace and Console closed after year-end, adding further integration work.
Cloud providers and AI firms may bundle security cheaply
The filing warns cloud providers may bundle security at low or no extra cost and frontier AI firms may enter security, pressuring price and demand.
The detail
Cloud infrastructure providers "may bundle native capabilities with their cloud infrastructure services at low or no incremental cost to customers." Frontier AI model providers may enter security directly or let others build security products on their models. The company also warns that a perception that AI commoditizes security work could weaken demand "even if these perceptions do not reflect actual changes in our business."1
AnalysisAnalysis: the totals do not show this pressure yet. Revenue grew 24.5%, with product up 26.5% and subscription and support up 24.0%. It is also the kind of risk one year's figures would be slow to reveal, since subscription revenue is recognized over the contract term.
Two distributors carry 30% of revenue
Two distributors accounted for 30% of revenue, and because subscriptions are recognized over their term, a slowdown in new or renewal sales would show late.
The detail
Two distributors together represented 30% of total revenue. Distributor agreements run for one year, renew annually and can be ended with notice before the renewal date, and the filing says partners may have incentives to promote competitors' products.1
Subscription and support is recognized over contracts of typically one to five years, so a decline in sales "will not be fully or immediately reflected in that quarter’s revenue but will negatively affect future fiscal quarters." A growing share of revenue, including observability and AI offerings, is priced on usage, which the filing says exposes it to customers optimizing their consumption.1
Sources
- 1.Palo Alto Networks 10-K for the period to 2026-07-31 (the filing), Sep 10, 2026, read Nov 2, 2026
Palo Alto Networks, further in
Member research, then your own questions on ChatGPT.
What could change the outlook
What Palo Alto Networks's numbers depend on from here, read from the filing: the conditions behind this period's margins and growth, and where a change would show first.
- What has to happen for operating margin to rebuild
Which of this year's costs fade and which recur, and what the acquired products would need to deliver for reported profit to catch up with cash.
- How durable is a cash engine built on up-front billing?
What sustains free cash flow when reported profit falls, and which signals would show collections slowing before revenue does.
Loading…
Have a question about Palo Alto Networks?
Explore its profit drivers, competitive edge, risks, or your own investment and business questions with CXProWealth on ChatGPT.
- How much of Palo Alto Networks' FY2026 operating margin drop came from one-off deal costs rather than recurring amortization?
- Why did Palo Alto Networks' free cash flow rise to $4.11B while its net income fell 72.9%?
- What does it mean for Palo Alto Networks that two distributors account for 30% of its revenue?
Business Lens describes Palo Alto Networks from its own filings with the SEC. It is not a view on its shares, a target, or advice to buy, sell or hold anything; figures are as filed and may be restated by the company later. The filing, the dates and the version are under the financial data above.