Palo Alto is buying growth faster than it earns it

Palo Alto Networks disclosed four growth rates in its fiscal third quarter, and the company deserves credit for how it disclosed them. Next-Generation Security ARR grew 60% to $8.1 billion. Total revenue grew 31% to $3.0 billion. Remaining performance obligation grew 36% to $18.4 billion. In each case, in the same sentence, the company said how much came from CyberArk and Chronosphere: $1.6 billion of the ARR, $388 million of the revenue, $1.8 billion of the RPO.

That is better disclosure than most acquirers offer. It is also almost never carried into the coverage, which quotes 60% and stops.

There is a fifth number that puts the other four in proportion. Non-GAAP earnings per share went from $0.80 to $0.85. That is growth of 6%.

And there is a sixth, which is the one that makes the shape of this unmistakable. For two years the weighted-average diluted share count sat between 707 and 711 million, quarter after quarter, barely moving. This quarter it was 801 million.

The growth rate that was already slowing

Before the acquisition, Next-Generation Security ARR growth had been decelerating steadily for two years. The company states this figure and its growth rate in every quarterly release, so the series is its own.

Four consecutive quarters of decline from 43% to 34%, a trough at 29%, a modest recovery to 33%, and then the number doubles.

CyberArk closed on February 11, 2026. Palo Alto's fiscal third quarter runs February through April. The 60% print is the first quarter that contains the acquisition, and the company itself says $1.6 billion of the $8.1 billion came from CyberArk and Chronosphere.

The fiscal fourth quarter of 2025 is missing from that table. The results release for it is not among the Forms 8-K carrying an Item 2.02 in the window we searched, so rather than infer the figure we have left the row out. The trend across the seven quarters shown is not sensitive to it.

This is the context the 60% needs. It is not an acceleration in the business. It is an acquisition landing on a decelerating base.

The headline rates, with the acquisitions taken out

The company gives both halves of each number, so this arithmetic is straightforward. It is still ours rather than the company's, and it is approximate for a reason stated below.

Each headline roughly halves. That is not a scandal: the company bought two businesses, said so, and disclosed their contribution in the same breath as the growth rate.

Note also where ~28% sits in the series above. It is between the 29% trough and the 33% recovery. Strip the acquisition and the underlying business is doing roughly what it was doing before the acquisition, which is the most useful single sentence in this note.

The company publishes this figure itself, and it matches. On the earnings call, Nikesh Arora said: "When adjusting for recent CyberArk and Chronosphere acquisitions, both of which are exceeding expectations in their first quarter post-close, our organic NGS ARR and RPO rose 28% and 22% respectively."

Our subtraction produced about 28% and about 23%. The company's own organic figures are 28% and 22%. We are noting the agreement rather than claiming credit for it: the point is that the arithmetic any reader can do on the release lands where the company itself lands, which means the halving is not an artifact of a crude method.

It also means Palo Alto deserves more credit than most acquirers on this. It discloses the acquired contribution inside each headline metric, and then separately states the organic rate on the call. The 60% figure that dominates the coverage is not the company hiding the 28%. It is the coverage stopping at the first number.

The acquisitions are holding the growth rate, not raising it

Step back from ARR for a moment and look at revenue, which is the metric that cannot be defined into a better shape.

Our arithmetic on those figures: revenue compounded at about 21% a year across the six years to fiscal 2025, almost entirely organically. Fiscal 2026 is guided to $11.415 billion to $11.425 billion, which is growth of about 24% and which includes CyberArk, Chronosphere and Koi.

Three acquisitions, one of them a roughly $25 billion transaction, move the consolidated revenue growth rate about three points above a six-year trend the company was already achieving without them. That is the clearest way to see what the 60% ARR headline is and is not telling you.

There is a fair rebuttal, and it is the same one that applies to any acquisition: revenue recognition lags, purchase accounting suppresses acquired revenue in the first year through the deferred revenue fair value adjustment, and ARR is the leading indicator precisely because revenue is the lagging one. All true. It is also true that a reader looking only at the top line would not know a $25 billion deal had happened.

What the company actually sells

Palo Alto was founded in 2005 by Nir Zuk, who had previously worked at Check Point, around the idea of a firewall that understood applications rather than ports. That product became the company, and everything since has been an attempt to sell more things to the customers it won with it.

The portfolio now runs in three lines, which is also how the company will begin reporting revenue in fiscal 2027:

Network security is the original business, the firewalls and the software and cloud-delivered versions of them. It is the installed base everything else is sold into.

Cortex is the security operations platform, of which XSIAM is the centrepiece. Management describes it as the response to machine-speed attacks, replacing what it calls "legacy query-based tools that wait for human reaction." Prisma AI, aimed at securing AI usage inside enterprises, was described on the call as the fastest-scaling product in the company's history.

Identity is CyberArk, the privileged access management business acquired in February 2026, plus what Palo Alto had before it.

Chronosphere sits slightly outside that as observability, and Koi adds agentic endpoint security.

The strategy binding them is what the company calls platformization: persuading customers to consolidate multiple security functions onto one vendor rather than assembling best-of-breed point products. The disclosed evidence for it is real. The company reported 110 net new platformizations in the quarter, of which 20 came from the acquired businesses, ending with roughly 2,280 total platformized customers, and said 80% of new customer acquisitions this year adopted multiple products.

Nikesh Arora also articulated why the acquisitions are strategic rather than financial, in a line worth quoting because it is the actual thesis:

As frontier models become available to everyone, the real competitive advantage shifts from model to the data fuel. That is why having sensors that sit in line with live traffic is so vital.

The argument is that owning more points of telemetry across a customer's estate compounds, because each sensor improves detection everywhere else. If that is right, buying identity and observability is not buying revenue, it is buying data surface, and the ARR contribution is close to beside the point.

That is a coherent case. It is also unfalsifiable on a one-year view, which is why the per-share arithmetic below still matters: the strategy may well be correct and existing holders are still paying for it in dilution while it plays out.

Two lines that moved in one quarter after two years of not moving

The acquisition's fingerprint is visible in the filed quarterly figures more clearly than in any commentary. Here are seven quarters of Palo Alto's own numbers, with the margin and share columns as filed.

Gross margin sat in a band between 73.0% and 74.2% for six consecutive quarters. Then it was 67.6%.

The share count sat between 707 and 711 million for six consecutive quarters. Then it was 801 million.

Operating income ranged between $177 million and $397 million, always positive. Then it was negative $183 million.

Three lines, each stable for two years, each discontinuous in the same quarter, and the quarter is the one the acquisition closed in. None of that is hidden and none of it is improper. It is simply what buying a $25 billion company with stock does to an income statement, and it is far more legible in a series than in a year-over-year comparison.

What it cost per share

CyberArk closed on February 11, 2026 for $2.3 billion in cash and 112 million shares, an equity value of roughly $25 billion at announcement, on terms of $45.00 in cash and 2.2005 Palo Alto shares for each CyberArk share.

Non-GAAP net income grew 22%. Non-GAAP earnings per share grew 6%. The 16-point gap is dilution, and it is the single most useful number in the release, because it converts a company-level growth rate into the one that belongs to an existing holder.

The nine-month figures say the same thing without the quarter's noise. Over the first three quarters of fiscal 2026 against the same period a year earlier, revenue grew 20.7%, to $8,070 million from $6,685 million. GAAP operating income fell 29.9%, to $523 million from $746 million. GAAP diluted earnings per share fell 36.3%, to $0.79 from $1.24. All three of those are our arithmetic on figures printed in the release.

The GAAP picture is not a rounding artifact. Share-based compensation-related charges of $517 million, up from $355 million, and acquisition-related charges account for the swing. Those are real costs of the strategy, and excluding them is precisely what a non-GAAP presentation is for. That is a legitimate presentation. It is also why the per-share line is worth checking on both bases rather than one.

The margin came down too

Gross margin fell 540 basis points, by our arithmetic on the two lines above. Operating expenses grew 52% against revenue growth of 31%. General and administrative expense nearly doubled, from $164 million to $316 million.

Integration costs are transitory and some of that reverses. The direction, though, is the ordinary consequence of buying revenue: acquired businesses arrive with their own cost structures and with purchase accounting attached, and it takes time before they resemble the acquirer.

The genuine counterweight is cash. Net cash from operating activities was $871 million against $628 million, adjusted free cash flow was $910 million against $578 million, and trailing twelve-month adjusted free cash flow margin was 38.5%, up 430 basis points year over year. The CFO said the company is "executing ahead of our M&A integration plans" and reaffirmed a target of a 40% adjusted free cash flow margin in fiscal 2028. Cash conversion is the strongest number in the release and it is the best argument against everything above it.

What the CyberArk deal actually cost

The consideration is worth laying out, because the per-share arithmetic is downstream of it.

CyberArk closed on February 11, 2026. Palo Alto paid $2.3 billion in cash and issued 112 million shares, on terms of $45.00 in cash and 2.2005 Palo Alto shares for each CyberArk share, an equity value of roughly $25 billion at announcement. Regulatory clearances came from the United States, the European Union, the United Kingdom and Israel.

Two features of that structure decide everything in this note.

It was paid mostly in stock. Cash consideration was $2.3 billion against a roughly $25 billion total, so more than 90% of the price was equity. That is a rational choice when your own shares trade at a high multiple, and it is precisely why the share count moved 94 million in a quarter after two years of not moving at all.

It was priced off both companies' multiples. Paying a high multiple with a high-multiple currency is not obviously dilutive to value even when it is heavily dilutive to share count. Whether it was a good trade depends on whether the combined platform grows faster than the two would have separately, which is the fiscal 2028 question and not answerable now.

And here the arithmetic cuts against this note's own framing, so it is worth doing carefully rather than skipping.

The acquisitions added roughly $1.63 billion of ARR and 94 million shares. Our arithmetic: that is about $17.34 of acquired ARR for each new share issued. Before the deal, Palo Alto's organic ARR of roughly $6.5 billion sat on about 707 million shares, or about $9.19 of ARR per share.

So on an ARR-per-share basis the acquisitions are accretive, and substantially so: each new share brought nearly twice the ARR that an existing share carried. That is the opposite of what a dilution narrative would predict, and any honest version of this argument has to concede it.

The reconciliation between that and the 6% earnings per share growth is margin and timing, not ARR. Acquired ARR arrives with an acquired cost structure attached, purchase accounting suppresses the revenue it converts into in year one, and the integration costs hit immediately while the cross-sell arrives later. So the deal buys more ARR per share than it dilutes, and still produces less profit per share today.

Which of those is the durable fact depends entirely on whether the acquired margin structure converges on Palo Alto's. That is the fiscal 2028 question, and it is the one to hold management to.

What the guidance implies

The fiscal fourth quarter guide is for Next-Generation Security ARR of $8.90 billion to $8.95 billion, revenue of $3.345 billion to $3.355 billion, and non-GAAP diluted earnings per share of $0.96 to $0.98, using 830 million to 840 million shares.

That last clause is the one to read twice. The full-year guide uses 763 million to 766 million shares, because the year averages in quarters before the acquisition closed. The exit share count is 830 million to 840 million. Against 707 million in the year-ago third quarter, that is an increase of roughly 18% in the denominator, by our arithmetic on the company's own guidance figures.

So the fourth quarter is guided to grow ARR 59% to 60% and earnings per share to $0.97 at the midpoint. Whether that is a good quarter depends entirely on which of those two numbers a holder is being paid in.

For the full year the company guides revenue of $11.415 billion to $11.425 billion, growth of 24%, a non-GAAP operating margin of 28.9% to 29.2%, non-GAAP diluted earnings per share of $3.77 to $3.79, and an adjusted free cash flow margin of 37.5%.

A third acquisition, in the same quarter

The two acquisitions inside the headline are not the whole of it. On the same call the company noted a third: Koi, an agentic endpoint security business, which closed later in the quarter and whose financial impact was described as immaterial to the third quarter. Management said it had already generated interest from over 150 customers.

So within roughly one fiscal year Palo Alto absorbed CyberArk, Chronosphere and Koi. That is the strategy working as designed, and it is also why the per-share question is not a one-quarter artifact. A company acquiring at this cadence is repeatedly issuing the currency that the per-share line divides by.

Chronosphere is the one to watch on the upside. Management said its observability ARR surpassed $300 million, nearly doubling since the acquisition was announced, and attributed a more than 50% sequential increase to "an existing LLM customer increasing consumption as they continue to migrate from an incumbent." It also said the world's leading AI natives, "including two of the top five frontier labs," have adopted it.

That is a genuinely strong result and it complicates any simple reading of these deals as growth-buying. It also quietly gives Palo Alto the same exposure the rest of this week's names carry: a fast-growing product line whose acceleration is attributed to frontier AI labs.

What changes in fiscal 2027

One disclosure change announced on the call matters more than it sounds.

The CFO said the company will move to total company guidance going forward, and that beginning in fiscal 2027 it intends to provide segment-level revenue disclosures across Network Security, Cortex and Identity.

Both halves of that are consequential for anyone doing the arithmetic in this note. Moving to total company guidance reduces the number of forward metrics to hold management against. Adding segment revenue increases what can be checked historically. On balance it is a real improvement in disclosure, and it will make the organic question much easier to answer, because Identity is essentially CyberArk. Once that segment reports on its own, the acquired contribution stops needing to be estimated at all.

It also means this note's method has a shelf life. The subtraction we performed here becomes unnecessary in about two quarters.

The measure that is hardest to buy

Of the four growth rates the company reports, remaining performance obligation is the one worth the most attention, and it is the one least discussed.

RPO is contracted revenue not yet recognized. Unlike ARR, which is an annualized snapshot of active contracts and can be lifted immediately by acquiring a book of them, RPO reflects the duration and the size of what customers have actually committed to. It grew 36% to $18.4 billion, including $1.8 billion from the acquisitions, which leaves about 23% ex-acquired by our arithmetic.

Two things make that the most informative of the four.

It is the largest relative to revenue. At $18.4 billion against a full-year revenue guide of about $11.4 billion, RPO is more than a year and a half of revenue already under contract. For a business whose bear case is that growth is bought rather than earned, a large and growing contracted backlog is the strongest available counterargument.

Its growth is closest to the underlying rate. ARR ex-acquired grew about 28%, revenue about 14%, RPO about 23%. Revenue is the slowest because it recognizes ratably and lags bookings; ARR is the fastest because it annualizes a point-in-time snapshot. RPO sits between them and is the least flattering to present and the least easy to flatter.

The thing to watch in the fourth quarter is not the RPO number itself, which is guided to $20.9 billion to $21.0 billion, but its duration. A backlog growing because customers are signing longer contracts is a different fact from one growing because they are signing bigger ones, and only the Form 10-K breaks out what portion is expected to be recognized within twelve months. That split is where a platform consolidation thesis either shows up or does not.

What the acquisition actually bought

It is worth being fair about the strategic case, because a note that only counts shares misses it.

Identity is a genuinely adjacent market to network and cloud security, CyberArk is a leader in privileged access management rather than a marginal asset, and the platform argument, that customers would rather buy one vendor's integrated stack than assemble six, is the argument Palo Alto has been making and winning with for years. If that consolidation thesis is right, then paying in stock at a high multiple to acquire a high-multiple asset is a reasonable trade, and per-share dilution now is the price of a larger, stickier platform later.

The test of that is not this quarter. It is whether NGS ARR growth on the combined base, two or three years out, is materially better than the 29% to 33% the standalone business was producing. Nothing in the fiscal third quarter answers it, in either direction.

The cash case, which is the strongest thing here

A note that counts shares should be equally careful about the number that argues the other way.

Adjusted free cash flow in the quarter was $910 million, up 57% year over year. On a trailing twelve-month basis the company generated $4.08 billion, a margin of 38.5%, up 430 basis points, and that is with CyberArk and Chronosphere included rather than excluded. Management said its confidence in reaching a 40% free cash flow margin in fiscal 2028 had been reinforced, and that visibility on the integration arrived "three to six months earlier than we initially anticipated."

Set that against everything above. The GAAP loss is real and the dilution is real, but a business converting 38.5% of revenue into free cash while absorbing three acquisitions is not one whose economics are breaking. It is one paying an accounting price now for a base it expects to compound later.

The platform evidence points the same way: 110 net new platformizations in the quarter, of which 20 came from the acquisitions, and 80% of new customer acquisitions this year adopting multiple products. If consolidation onto one vendor is genuinely what enterprises want, the acquisitions are buying the right thing.

The honest position is that the two arguments are not in conflict. Palo Alto is building something coherent, and existing holders are funding it through dilution while they wait. Whether that is a good trade depends on a fiscal 2028 outcome, not on this quarter.

Why the strategy is defensible even if the arithmetic stings

One argument deserves stating properly before the falsifiers, because it is the reason a rational board approves this.

Enterprise security buying is consolidating. Chief information security officers who once assembled thirty point products are under budget and headcount pressure to reduce vendors, and the operational case for one console over thirty is strong. If that consolidation is real, then the winner is whoever has the broadest credible platform at the moment customers decide, and the cost of getting there is worth paying because the position is defensible afterwards.

Palo Alto is buying to be that vendor, in identity and observability, before Microsoft and CrowdStrike close the same gaps. Bought with stock at a high multiple, the deals cost existing holders dilution now for a position that, if the thesis holds, compounds later.

The evidence is genuinely mixed rather than damning. Organic growth of 28% is good and decelerating. Free cash flow conversion is excellent and improving. Platformization counts are rising. Per-share earnings growth is 6%. All of those are true simultaneously, and which one dominates depends on a fiscal 2028 outcome nobody can observe yet.

One more disclosure worth carrying forward. Management said visibility on the integration arrived "three to six months earlier than we initially anticipated," which is why it reiterated the fiscal 2028 free cash flow margin target rather than merely maintaining it. Integration running ahead of plan is the single best leading indicator available on whether the acquired margin structure converges, and it is the thing to track between now and then.

What would prove this wrong

• Organic growth reaccelerates. The company's own organic figure is 28%, so the level is settled. What is not settled is the direction: if organic NGS ARR climbs back toward the low forties it ran at two years ago, the deceleration series below stops being the relevant frame and the acquisitions look like an accelerant rather than a substitute.
• Dilution stops. The share count steps up when a deal closes and then flattens. If the fourth quarter is the peak and the count holds near 835 million, per-share growth reconverges with company growth from here, and this note describes a one-time step rather than a pattern. The two flat years before this quarter are evidence that Palo Alto does not habitually dilute.
• The integration math works. A 40% adjusted free cash flow margin in fiscal 2028, on a much larger revenue base, would mean the acquisitions were bought well regardless of the near-term per-share optics. The cash flow line is already moving that way.
• GAAP recovers quickly. If the operating loss is a two-quarter purchase-accounting artifact and GAAP profitability returns at scale, the starkest number here stops being informative.
• The platform thesis compounds. If cross-selling identity into the installed base lifts combined ARR growth above what either company was doing alone, the deceleration series above becomes the wrong baseline entirely.

Palo Alto Networks reports its fiscal fourth quarter after the close on September 1, 2026, and its Form 10-K follows. The lines worth finding first are the acquired contribution to ARR and whether it is still broken out at all, the weighted-average diluted share count against the 830 to 840 million guided, and the deferred revenue fair value adjustment in the 10-K, which suppresses reported acquired revenue and is the technical reason acquisition arithmetic misleads in both directions.

Primary sources

• 8-KPalo Alto Networks Q3 fiscal 2026 earnings release, Exhibit 99.1The ARR, revenue and RPO disclosures with their acquired portions, the income statement, share counts, cash flow and guidanceJun 2, 2026
• CallPalo Alto Networks Q3 fiscal 2026 earnings call transcriptThe organic NGS ARR and RPO growth rates of 28% and 22%, the precise $8.13 billion and $1.63 billion figures, the Koi acquisition, Chronosphere ARR above $300 million, the platformization counts, the free cash flow figures, and the fiscal 2027 segment disclosure change. Held June 2, 2026, the same day as the releaseJun 2, 2026
• 10-QPalo Alto Networks quarterly report for the period ended April 30, 2026Purchase accounting, the deferred revenue fair value adjustment, and segment detail behind the releaseJun 3, 2026
• XBRLPalo Alto Networks quarterly revenue, margin and share counts as filedThe seven-quarter series in the table above, taken from the company facts API rather than retyped from releases
• PressPalo Alto Networks completes acquisition of CyberArkClosing date and consideration: $2.3 billion cash and 112 million sharesFeb 11, 2026
• PressPalo Alto Networks announces agreement to acquire CyberArkOriginal announcement and the per-share exchange terms
• EDGARPalo Alto Networks filing indexFor the prior-quarter releases carrying the earlier NGS ARR growth rates, and for the fiscal fourth quarter release expected after the close on September 1, 2026