Palo Alto guided its run rate in half

Palo Alto Networks closed its fiscal year with the best headline in its history. Next-Generation Security ARR reached $9.10 billion, up 63%. Chief executive Nikesh Arora opened by noting the company had added nearly $1 billion of net new security ARR in a single quarter, which is a genuinely remarkable sentence for a business of this size.

Four paragraphs later, in the outlook section of the same release, the company guided the first quarter of fiscal 2027 to Next-Generation Security ARR of $9.54 billion to $9.56 billion.

That is $440 million to $460 million of net new ARR, by our arithmetic on the two figures. Against nearly a billion in the quarter just reported.

The whole of fiscal 2027 is guided to $11.075 billion to $11.175 billion, which is $1.97 billion to $2.08 billion of net new ARR across four quarters. The year ahead is guided to add roughly twice what the quarter just past added, and the average quarter inside it is guided at about half.

We published a note on the morning of September 1 arguing that Palo Alto buys growth faster than it earns it. The print did not contradict that. The guidance states it more plainly than the note managed to.

The quarter itself was strong

None of what follows is an argument that the quarter was bad. Revenue was $3.41 billion, up 34%, against consensus nearer $3.35 billion. Remaining performance obligations reached $21.2 billion, up 34%. Net cash from operating activities was $1.4 billion in the quarter, with adjusted free cash flow of $1.3 billion. Non-GAAP operating margin was 29.6% for the quarter and 29.2% for the year.

Chief financial officer Dipak Golechha said the company exceeded its guidance across the board, and pointed to strength across the Network and AI Security, Cortex and Idira platforms. On the evidence of the reported lines, that is accurate.

The disagreement is not about the quarter. It is about what the quarter was made of, and the company's own guidance is the best available evidence on that question.

What the guidance implies

Two numbers do most of the work here, and both are the company's.

The first is the first-quarter ARR guide of $9.54 billion to $9.56 billion against a $9.10 billion close. The second is the full-year guide of $11.075 billion to $11.175 billion. Growth of 22% to 23%, stated in the release.

Set those against the reported 63% and the shape becomes clear. The company is not guiding to a gradual fade from 63% toward the low forties. It is guiding to less than half the reported rate immediately, in the very next quarter, and to hold roughly there for the year.

That pattern has one obvious explanation and it is not a demand problem. An acquisition adds its entire ARR book to the comparison in the quarter it closes, and keeps inflating the year-over-year figure for four quarters until it laps. When the lapping happens, the growth rate falls to whatever the underlying business is doing, without anything having changed about the underlying business. A deceleration from 63% to 22% concentrated in a single step is the signature of arithmetic rather than of deterioration.

Our earlier note argued exactly this, using the organic figure of 28% the company had itself given on the prior quarter's call. What is new is that the company's forward guidance is now below that organic figure, not above it.

The contracted book tells the same story

Annual recurring revenue is a company-defined measure. Remaining performance obligations are not: they are contracted revenue not yet recognised, disclosed under an accounting standard, and they are the closest thing in a software company's filings to a hard forward order book.

Palo Alto's RPO closed the year at $21.2 billion, up 34%. That implies roughly $15.8 billion a year earlier, so the book grew by about $5.4 billion during fiscal 2026, on our arithmetic from the disclosed growth rate.

Fiscal 2027 is guided to $25.2 billion to $25.4 billion, which is growth of 19% to 20% and an addition of $4.0 billion to $4.2 billion.

The contracted book is guided to grow by less in absolute dollars next year than it grew this year. Not more slowly in percentage terms, which would be arithmetic on a larger base and unremarkable. Less money.

The first quarter shows the same back-loaded shape as ARR: RPO is guided to $20.8 billion to $20.9 billion, growth of 34% to 35%, essentially holding the reported rate for one more quarter before the year lands at 19% to 20%. Whatever is decelerating does so after the first quarter, in both measures, which is what lapping looks like and is not what a demand inflection looks like.

There is a reading of this that is favourable and worth stating. RPO is sensitive to contract duration, and a company that shifted toward shorter terms would show a smaller book on identical business. Palo Alto has been pushing multi-year platform deals, which works the other way, but the release does not disclose average duration and the 10-K's disclosure of when RPO is expected to convert is the place to check.

The four-year target is the decelerated rate

The most useful number on the call was not about next year.

Golechha confirmed the company remains on track toward $20 billion of Next-Generation Security ARR by fiscal 2030. That target has been public for some time and is usually cited as evidence of ambition.

Run the arithmetic. From $9.10 billion at the close of fiscal 2026 to $20 billion at the close of fiscal 2030 is four years, and it compounds at 21.8% by our calculation. Fiscal 2027 is guided at 22% to 23%.

The four-year target is a continuation of the guided rate, not the reported one. It requires no reacceleration at all. If Palo Alto simply does what it has told the market it will do next year, and then does that again three more times, it arrives at $20 billion.

This is not a criticism of the target, which is achievable and large. It is an observation about which of the two growth rates the company is planning around. A business that expected to keep compounding at anything close to 63% would have a very different number pencilled in for 2030, because 63% for four years from $9.10 billion is over $64 billion.

What the GAAP statements show

The non-GAAP presentation is where the discussion happens, and on that basis the year was good: operating margin of 29.2%, earnings per share of $3.84 against $3.34.

The GAAP statements say something else.

Revenue for the year grew 24.5%, to $11,480 million from $9,221 million. GAAP operating income fell 44.1%, to $695 million from $1,243 million. Operating margin went from 13.5% of revenue to 6.1%. Those are the filed figures; the percentages and the change are our arithmetic on them.

Total gross profit was $8,077 million on that revenue, a gross margin of 70.4%, against 73.4% the year before. Three hundred and six basis points of gross margin, by our calculation, gone in a year at a software company. Acquired revenue arrives with amortization of acquired intangibles inside cost of revenue and with a deferred revenue fair value adjustment that suppresses the revenue itself, so some of this is presentational. Not all of it is.

The expense lines are where the acquisitions are most visible. Research and development grew 28.6%. Sales and marketing grew 26.8%. Both are roughly in line with revenue. General and administrative grew 102.9%, from $443 million to $899 million. In the fourth quarter alone it was $226 million against $27 million.

Below the operating line, other income and expense swung by $512 million, from positive $353 million to negative $159 million, which on a company with convertible notes outstanding is largely fair value movement rather than operations. The combination produced a fourth-quarter GAAP net loss of $282 million, against $254 million of GAAP net income a year earlier.

Dilution did not stop

Our earlier note set a specific test. Its second falsifier read: the share count steps up when a deal closes and then flattens, and if the fourth quarter is the peak and the count holds near 835 million, then per-share growth reconverges and the note describes a one-time step rather than a pattern.

The fourth quarter came in at 817 million GAAP diluted shares and 832 million on the non-GAAP basis, against 709 million and 707 million a year earlier.

Fiscal 2027 is guided at 844 million to 847 million.

That is above the 835 million the test named, and it is guided rather than reported, which is the company's own expectation rather than our extrapolation. The first quarter alone is guided at 837 million to 844 million. The count is still climbing.

The consequence is the arithmetic the original note was about. Revenue is guided up 22.8% to 23.7%. Non-GAAP earnings per share are guided up 8.3% to 9.1%, from $3.84 to a range of $4.16 to $4.19. Those percentages are ours, on the company's figures. Roughly a quarter of the top-line growth reaches a shareholder on a per-share basis, and the gap is share count.

The organic figure has gone quiet

The original note ended by naming the lines worth finding first in this release. The first was the acquired contribution to ARR, and whether it was still broken out at all.

It was not. The release does not separate organic from acquired Next-Generation Security ARR, and neither the transcripts nor the coverage we have read record management quantifying it on the call. The 28% organic figure the company gave a quarter earlier has no successor in this disclosure.

We are stating that as an absence rather than as a finding, because an absence in a press release is not necessarily an absence on the call, and we have read published transcripts rather than listened to the webcast. The Form 10-K follows and will carry the acquired revenue disclosure and the deferred revenue fair value adjustment, which is the technical reason acquisition arithmetic misleads in both directions and the place this question actually gets answered.

What can be said is that the company disclosed a rate that flattered the year, guided to a rate less than half of it, and did not publish the figure that reconciles the two.

What the company actually bought

The share count is the price. It is worth being specific about what it purchased, because "acquisitions" as a category tells you nothing.

CyberArk is the large one and the only one that changes the shape of the company. It is privileged access management, which is a genuinely different product line from network security, sold to an overlapping buyer, with its own installed base and its own renewal stream. Whatever one thinks of the price, it is not a feature acquisition.

The others are smaller and more recent. Chronosphere is observability, which sits underneath security operations rather than inside it. Koi is smaller again. Console, which Arora said closed during the quarter, goes into the Cortex organisation to build AI-driven capabilities for IT and security operations, which is the agentic layer every security vendor is currently assembling.

Read together these are coherent. The stated strategy is platformization: sell one platform that replaces several point products, and the way to have a platform is to own the points. Identity, observability, and an agent layer over security operations are three real gaps in that story and the company closed them inside about a year.

The question the numbers raise is not whether the pieces fit. It is whether a platform assembled by purchase compounds the way a platform grown internally does. The organic figure is what would answer that, and it is the figure that has stopped appearing.

The cash case is the strongest argument against this note

If there is a number that makes everything above look like accounting pedantry, it is the free cash flow guide.

Fiscal 2027 is guided to an adjusted free cash flow margin of 38.0%. On guided revenue of $14.10 billion to $14.20 billion, that is roughly $5.4 billion of adjusted free cash flow by our arithmetic on the midpoint. Against fiscal 2026 GAAP operating income of $695 million, it is nearly eight times as large.

That gap is not a trick, or not entirely. A subscription business collects cash ahead of recognising revenue, so deferred revenue growth is real cash in the door that the income statement has not seen yet. Share-based compensation is a genuine cost to shareholders and a genuine non-cost to the cash balance. Amortization of acquired intangibles is a real economic event that already happened, at the moment the cheque cleared, and charging it again over five years tells you about the past rather than the present.

So a reasonable person can look at $5.4 billion of expected cash generation, a 38% margin, and a 29.5% non-GAAP operating margin, and conclude that the GAAP statements are describing purchase accounting rather than the business. That case is available and this note does not refute it.

What the cash case does not do is fix the per-share arithmetic. Cash flow per share is subject to the same denominator as earnings per share, and the denominator is guided up again. A company generating $5.4 billion across 845 million shares is generating about $6.39 a share; the same cash across the 709 million shares of two years ago would be $7.62. That comparison is ours and it is deliberately crude, because it ignores what the extra shares bought. It is the crudeness that makes the point: the growth and the dilution have to be weighed against each other, and the release invites the reader to weigh only one of them.

What this note is not claiming

It is not claiming the acquisitions were bad. CyberArk brought a real identity business, and the deals since, including Chronosphere, Koi and Console, which Arora said closed during the quarter and whose team joins the Cortex organisation, are coherent with a platform strategy rather than scattered. A 38% adjusted free cash flow margin guided for fiscal 2027 on a much larger base would make the purchases look well timed regardless of the per-share optics.

It is not claiming the deceleration is a demand signal. Everything in the reported quarter points the other way: RPO up 34%, nearly a billion of net new ARR, and a CIO priority list that Arora argues is moving toward security because of AI rather than despite it.

It is claiming that a 63% headline and a 22% guide describe the same business, that the difference between them is mostly the accounting treatment of acquired revenue, and that the number the company plans around is the second one. Anyone reading the 63% as the run rate is reading a figure the company's own four-year target does not assume.

Where the earlier note was right, and where it was lucky

The companion note on Dell published the same morning and was falsified by that evening's print. This one was not, and it is worth separating the part that was reasoned from the part that happened to land.

Reasoned: the shape. The note argued that a headline ARR growth rate inflated by acquired books would step down hard when the acquisitions lapped, that per-share growth would run far behind company growth, and that the share count was the mechanism. All three are in this release and in the guidance, and the note named the specific lines to check before it could know them.

Close enough to call reasoned: the magnitudes. It cited ARR growth of 60% against earnings growth of 6%; the print was 63% against 7%.

Lucky, or at least imprecise: the dilution figure. The note put the step-up at 94 million shares. Comparing the fourth quarter's 817 million GAAP diluted shares against 709 million a year earlier gives 108 million, by our arithmetic, so the note understated the effect it was built on. Being wrong in the direction that weakens your own argument is the better failure, but it is still a miss.

Wrong, and corrected before publication: an earlier draft asserted the CyberArk deal diluted ARR per share. Checking it showed roughly $17.34 of acquired ARR per new share against a pre-deal ratio near $9.19, which is accretive by a wide margin. That claim was removed rather than published, and the arithmetic that killed it is the same arithmetic that should be applied to the dilution point above: shares issued are not a cost if what they bought produces more per share than what existed.

Unresolved: the organic rate. The note leaned on the company's own 28% figure as the underlying rate. Fiscal 2027 is guided below it. Either the note treated a good quarter's organic figure as a level, or the guide is conservative, and this release does not settle which.

What would prove this wrong

• The first quarter beats the ARR guide materially. The guide is $9.54 billion to $9.56 billion. A print meaningfully above that would mean the deceleration was conservatism rather than arithmetic, and this note's central reading is wrong.
• The organic figure returns and is above 22%. If the Form 10-K or the next call shows underlying growth in the high twenties or better, then the guided 22% is a floor the company set for itself and the gap is prudence, not lapping.
• The share count peaks where guided. If fiscal 2027 lands at 844 million and fiscal 2028 holds, then this was a two-year acquisition step and per-share growth reconverges with company growth from fiscal 2029, exactly as the original note allowed.
• GAAP recovers on schedule. The 44% decline in operating income is substantially purchase accounting. If GAAP operating margin returns toward the low teens within two years as amortization runs off, the starkest number here stops being informative.
• The FY30 target gets raised. The cleanest possible refutation. A company that raised the 2030 number would be telling the market that the guided rate is not the planning rate, and the arithmetic in this note would be reading a stale target.
• Gross margin recovers. Three hundred basis points is a lot, and most acquisition-driven gross margin compression unwinds as fair value adjustments lapse. If the rate returns to the low seventies, the compression was mechanical.
• Free cash flow does the work. A 38% adjusted free cash flow margin is a very high number. If it is delivered, the cash case can be made without reference to ARR growth at all, and the growth rate becomes a secondary question.

Palo Alto Networks reports its fiscal first quarter on November 18, 2026, and the Form 10-K for fiscal 2026 follows this release within weeks. The lines worth finding first are the acquired revenue disclosure and the deferred revenue fair value adjustment in the 10-K, the first-quarter ARR against the $9.54 billion to $9.56 billion guided, and the weighted average diluted share count against the 837 million to 844 million guided for that quarter.

Primary sources

• 8-KPalo Alto Networks fiscal fourth quarter and fiscal year 2026 results, Exhibit 99.1The income statement for the quarter and the year, the share count reconciliation, the GAAP and non-GAAP operating income figures, the NGS ARR and RPO disclosures, and the fiscal 2027 and first-quarter guidance including the ARR ranges and share counts used throughoutSeptember 1, 2026
• CallPalo Alto Networks Q4 fiscal 2026 earnings callThe management statements used here: Arora on nearly $1 billion of net new NGS ARR in the quarter, on AI elevating cybersecurity on the CIO priority list, and on the Console acquisition closing in the quarter with its team joining Cortex; Golechha on exceeding guidance across Network and AI Security, Cortex and Idira, on full-year non-GAAP operating margin of 29.2%, and on remaining on track for $20 billion of NGS ARR by fiscal 2030. Held September 1, 2026, the same day as the release. Read from published transcripts and coverage rather than the company webcastSeptember 1, 2026
• NoteConvexity: Palo Alto is buying growth faster than it earns itThe note this one follows, published the morning of the report. Its thesis was not contradicted by the print; its dilution falsifier named 835 million shares, and fiscal 2027 is guided above thatSeptember 1, 2026