PANW · Analyze — Financebot

Price at analysis: $382.85 (+12.8% same-day, sympathy move — see Sentiment) | 52wk range $139.57–$398.88 | Mkt cap $312.0B

Held, unscored [—] going into this report. Fiscal year ends July 31. FY26 Q4 and full-year results are scheduled for Tuesday, September 1, 2026, after market close — 5 calendar days from this report's date. Per the standing guard, this verdict is delivered now but the print is flagged as the immediate recheck trigger; treat every figure below labeled "current year" / "FY26" as pre-print and expect the multiple denominators to move within the week.

0. Knowledge-base check

python .mcp/kb.py find PANW → no existing notes or reports on this ticker. This is PANW's first Output/Stocks file. Nothing to cite; everything below is derived fresh. Pitfalls consulted before trusting any vendor figure: pitfall-vendor-forward-eps-is-the-wrong-fiscal-year, pitfall-yahoo-insider-purchases-counts-rsu-grants, pitfall-net-margin-above-operating-margin-is-a-tripwire (pattern), pitfall-yahoo-snapshot-fcf-field-diverges-from-quarter-sum, pitfall-weighted-average-share-count-lags-a-step-change, pitfall-single-quarter-fcf-read-as-ttm. Four of six fired on this name — see Data Traps at the end.

1. General Health (Fundamentals)

The event that dominates every trailing number: the CyberArk acquisition

PANW closed its ~$25B acquisition of CyberArk (identity security) on February 11, 2026 — $2.3B cash + ~112M PANW shares issued to CyberArk holders. This single deal explains nearly every anomaly in the trailing financials below: the share count step-change, the goodwill/intangibles jump, the GAAP net loss in the deal-close quarter, and why TTM per-share metrics read worse than FY25's despite the underlying business accelerating. Read every year-over-year comparison with that filter on.

Revenue & FCF (annual, from `fin.py`, reconciled to quarterly sums)

FY (end Jul 31)	Revenue	YoY	OpInc (GAAP)	FCF	FCF margin
2022	$5.50B	—	-$188.8M	$1.79B	32.5%
2023	$6.89B	+25.3%	$387.3M	$2.63B	38.2%
2024	$8.03B	+16.5%	$683.9M	$3.10B	38.6%
2025	$9.22B	+14.8%	$1.24B	$3.47B	37.6%
TTM (sum of last 4 quarters)	$10.61B	+31.0%	~$1.02B*	~$3.79B	35.7%

TTM operating income is my own sum of the four quarterly "Operating Income" lines (Q4FY25 $497.2M + Q1FY26 $309M + Q2FY26 $397M + Q3FY26 −$183M = $1,020.2M, 9.6% margin). Yahoo's snapshot operatingMargins field reports −2.465% for the same trailing period — net margin (7.95%) sitting above operating margin is the tripwire pattern (pattern-net-margin-above-operating-margin-is-a-tripwire) and it fires here. The vendor field is wrong; use the quarter-summed 9.6% figure. TTM FCF is also a case where my quarter sum ($3,793.5M = $934.5+$1,687+$384+$788) diverges from Yahoo's snapshot freeCashflow field ($3,579M) by ~6%* — confirms pitfall-yahoo-snapshot-fcf-field-diverges-from-quarter-sum. Both corrected figures are used throughout this report.

FCF 3yr CAGR 24.6%, revenue 3yr CAGR 18.8% (fin.py). TTM revenue growth (+31%) is inflated by the CyberArk consolidation; organic growth is closer to the ~24% embedded in FY26 guidance (see Sentiment).

Capital allocation — a pivot from buybacks to M&A, funded mostly with equity

FY25: buybacks $0 (down from $566.7M in FY24 and $892.3M in FY22), acquisitions $1.05B, debt repaid $965.6M, no new debt issuance. Management paused the buyback entirely in the run-up to CyberArk and funded the deal overwhelmingly with stock (112M shares) rather than debt — Total Debt on the latest balance sheet is only $2.07B against $46.3B of assets (Debt/Assets 4.5%), so the deal did not lever the balance sheet. The cost was paid in dilution, not interest expense.

Debt-to-Assets

Pre-deal FY25: 1.43%. Post-deal (Apr-26 quarter): 4.5%. Still very low leverage by any standard — this is a clean balance sheet relative to the size of what it just bought.

Shares outstanding — the real headwind

Period	Diluted shares	Change
FY22	591.0M	—
FY23	684.6M	—
FY24	708.0M	—
FY25	709.3M	6.3% 3yr CAGR (pre-deal, mostly SBC)
Q3 FY26 (post CyberArk close)	801.0M (period average)
Current shares out	815.0M	+38% vs FY22, +15% in a single quarter from the deal

Buybacks funded almost none of the offset — they were $0 in FY25. FCF/share is now lower than a year ago despite FCF dollars growing: TTM FCF/share ≈ $3,793.5M / 815M shares = $4.65, versus FY25's $4.89 (fin.py). Revenue per share is roughly flat (TTM $13.02 vs FY25 $13.00). This is the direct, measurable cost of the CyberArk deal on a per-share basis, and it has not fully hit yet — see the weighted-average-share pitfall note below; the coming quarters will carry a full period of the new share count, not the partial-period average Q3 FY26 shows.

GAAP vs non-GAAP — a wide and temporary gap

Q3 FY26 (the CyberArk close quarter) posted a GAAP net loss of $177M (diluted EPS −$0.22) against $643M of SBC and heavy deal-related amortization/integration costs in that single quarter. TTM GAAP EPS is only $1.15 (trailing P/E 332.9x — nearly meaningless as a valuation anchor right now). Non-GAAP economics are far healthier: FY26 guidance calls for non-GAAP diluted EPS of $3.77–$3.79 and Q4 FY26 non-GAAP EPS of $0.96–$0.98. Separate these two lenses explicitly in any downstream use of this report — GAAP profitability is currently an artifact of purchase accounting, not a read on the operating business, but it is also not free: SBC is a real, recurring cash-adjacent cost the non-GAAP number excludes.

Health scorecard: business is genuinely growing and FCF-generative; per-share economics took a real, measurable hit from the CyberArk deal that has not fully worked through the trailing numbers yet.

2. Moat & Competitive Advantage

Quantitative base

Gross margin has been high and broadly stable through the growth build-out: 68.7% (FY22) → 72.3% (FY23) → 74.3% (FY24) → 73.4% (FY25) → 72.0% (TTM, CyberArk mix pulling it down slightly). No margin-compression moat-erosion signal. ROIC on a pre-deal basis (FY25: NetInc $1.13B / InvCapital $7.82B) was ~14.4% — a real, if not spectacular, return on capital for a platform business mid-build. Post-deal invested capital jumped to ~$29B (Apr-26 quarter) while the same quarter posted a net loss, so ROIC is temporarily unmeasurable/negative and will stay depressed for several quarters while CyberArk integrates and goodwill/intangible amortization runs through the P&L. This is standard for a large stock-funded acquisition and not itself a red flag, but it means ROIC cannot be used as a clean signal again until roughly FY27-28.

Revenue-stream map & platformization progress

NGS (Next-Generation Security) ARR: $8.18B in Q3 FY26, +60% YoY headline, ~30% YoY organic (ex-acquisitions).
RPO: $18.4B, +36% YoY headline, ~22% organic.
Net retention: 120%, with single-digit churn among platformized customers specifically — the strongest evidence for the moat thesis.
Platformized customers: ~2,280, up from ~1,550 a quarter earlier (Q2 FY26) — a jump that is itself mostly the CyberArk customer base being counted in, not pure organic conversion, so treat the sequential jump as a step change from the deal rather than an acceleration in the underlying land-and-expand motion.
FY26 guide (raised at the Q3 print): revenue $11.415–11.425B (+24%), NGS ARR $8.90–8.95B (+59–60%), RPO $20.9–21.0B (+32–33%).

Adversarial stress-test

"You are a well-funded rival — how easily can you attack this platform?" Two live vectors: 1. CrowdStrike expanding outward from a cloud-native, AI-first endpoint core into identity and cloud security — directly contesting the space CyberArk was meant to fortify for PANW, and doing so with a best-of-breed reputation that resonates with CISOs wary of "platform fatigue." 2. Hyperscaler bundling (Microsoft folding security into enterprise agreements) undercuts point-solution economics at the low end and pressures PANW's smaller peers (Qualys, Okta) before it reaches PANW's own accounts directly — but it is a long-run structural threat to the whole sector's pricing power, PANW included.

The counter-argument, and the reason platformization is a real (not just marketed) moat: single-digit churn among platformized accounts is a switching-cost number, not a marketing number — ripping out a standardized architecture across network, cloud, SecOps and (now) identity is expensive and risky for a customer to reverse. That is a genuine, structural moat source (switching costs + intangibles from deep integration), not just brand.

Disruption forecast & evergreen assessment

5–10yr view: cybersecurity spend is close to non-discretionary and the vendor-consolidation trend (from an industry average of 45–75 tools per enterprise) is a real tailwind that both PANW and CrowdStrike are riding from different starting points. The open question the market itself is debating (cited in the April 2026 sector sell-off) is whether a broad platform can keep pace with AI-accelerated attacker tooling as fast as a narrower, cloud-native specialist can — this is a legitimate 5-10yr disruption vector, not resolved by this report. Evergreen but not uncontested — a durable category, an improving competitive position within it, but not a guaranteed winner-take-most outcome yet.

3. Valuation

No dividend (payoutRatio 0, yield 0%) — DYT and DDM are not applicable. Graham and Bogle apply conditionally, with caveats specific to this name's distorted GAAP base.

The vendor forward-P/E trap fires here exactly as flagged

Yahoo's headline forwardPE is 93.1x on forwardEps $4.11. Cross-checking against epsCurrentYear ($3.7746) and priceEpsCurrentYear (101.4x) shows the two map to different fiscal years: epsCurrentYear matches the midpoint of management's own FY26 non-GAAP guide ($3.77–$3.79) — i.e. the year about to close and report in full on September 1. forwardEps ($4.11) is the FY27 consensus estimate, one year further out. The real near-term multiple is ~101x on the fiscal year about to be finalized, not the 93x the vendor's "forward P/E" field implies. This is pitfall-vendor-forward-eps-is-the-wrong-fiscal-year firing exactly as the guard predicted.

Basis	Multiple	Note
TTM GAAP P/E	332.9x	Distorted by CyberArk deal costs in one quarter — not usable
FY26 (current yr) non-GAAP P/E	~101x	The real near-term multiple; print due in 5 days
FY27 non-GAAP P/E ("forward P/E")	93.1x	What the vendor shows by default — one year too far out
P/S (TTM)	29.4x
EV/EBITDA	209.7x	GAAP-EBITDA-suppressed by deal amortization — not a clean read either
P/FCF (TTM, corrected)	~82x ($312B / $3.79B)

Graham's Intrinsic Value

√(22.5 × EPS × BVPS) = √(22.5 × 1.15 × 34.03) = $29.67 vs. price $382.85. Graham is not meaningful here — it runs on GAAP EPS, which this quarter is a purchase-accounting artifact, not an earnings-power read. Flagging per framework rather than pretending it says anything.

Bogle's Expected Return

Zero yield, so the whole expected return has to come from earnings growth and multiple change. Non-GAAP EPS growth from the FY26 guide midpoint ($3.78) to the FY27 consensus ($4.11) is only ~9% — well below the 24% revenue growth guide, because the CyberArk share issuance is diluting EPS growth well below revenue growth. Almost the entire 52-week return (+77.6%) has come from multiple re-rating, not earnings compounding, and the multiple is already historically rich (101x current-year non-GAAP, a name at 96% of its all-time high). Forward return from here depends on the multiple re-rating continuing — a fragile assumption to underwrite fresh capital on.

Fair value range and levels

Given the extreme richness of both GAAP and non-GAAP multiples and the founder's-eye per-share dilution from the deal, a conservative entry anchors to a still-generous-but-disciplined multiple on the FY26 non-GAAP guide ($3.78): 70–80x → $265–$302. That is a real pullback (21–30%) from spot, consistent with "great business, wait for the entry" rather than a bear call on the fundamentals. Trim is set as a forward multiple per house rule: 105x FY27 non-GAAP consensus ($4.11) → ~$432 — roughly the upper cluster of August 2026 analyst price-target raises (RBC $434, Cantor $425, Citizens/Mizuho/Stifel/BMO $415, Truist $435, Wells Fargo $475), so it tracks consensus without chasing the single highest number on the sheet.

4. Sentiment & Intelligence

Today's +12.8% move is not PANW's own print

PANW jumped from $339.31 to $382.85 today (2026-08-27) — but its own Q4/FY26 results are not due until September 1. The move is sector sympathy: CrowdStrike (+13%) and Okta (+22%) both posted large earnings beats today, and analyst commentary (Barron's, 24/7 Wall St.) framed "AI security" broadly as software's largest opportunity — lifting the whole cybersecurity complex, PANW included, ahead of its own print. This means expectations for PANW's Sept 1 result are now bid up on peer read-through, not on PANW-specific news — a setup where an in-line quarter could disappoint relative to the running start.

Analyst tone — broadly bullish and still raising targets through August

20 upgrades/target-raises since June 2026, essentially none lowered (one exception: Evercore ISI cut its target from $375 to $320 on July 8, an outlier against the trend). Representative recent raises: JPMorgan $326→$384, Wells Fargo $420→$475, Truist $375→$435, RBC $330→$434, Cantor $340→$425 — consensus mean target $362.71 (already below today's spot price of $382.85), with averageAnalystRating 1.64 ("Buy"). The sell-side has been chasing the tape upward all August; that is itself a caution flag on chasing further at spot.

Insider activity — routine 10b5-1 selling, one notable buy, no repeat buying at these levels

The last 12 months of Form-4 activity are almost entirely programmatic sales (CEO Arora, CTOs Klarich/Zuk, CFO Golechha, President Paul, several directors) tied to option exercises and RSU vesting — this is the pitfall-yahoo-insider-purchases-counts-rsu-grants trap: the $0.00 "Stock Award(Grant)" rows are RSU grants, not purchases, and must not be read as insider buying. The one genuine open-market cash purchase in the whole window is CEO Arora buying 68,085 shares (~$10M) at $146.87–147.48 on March 27, 2026 — a well-timed buy, since the stock is now up ~160% from that level, but there has been no repeat insider buying since, even as the stock nearly tripled. That is consistent with "insiders think it was cheap at $147, not that it's cheap at $383."

5. Synthesis & Verdict

Tension between agents: Fundamentals + Moat both read PANW as a genuinely improving business — organic NGS ARR growth ~30%, organic RPO growth ~22%, net retention 120%, single-digit churn among platformized accounts, a clean balance sheet, and a platformization strategy that is showing real switching-cost evidence, not just marketing language. Valuation reads the opposite: ~101x the fiscal year about to close, ~93x the year after that, 332x trailing GAAP, and per-share FCF that is lower than a year ago because the CyberArk deal diluted the share count faster than it added earnings power. Sentiment sits on top of both — a +12.8% sympathy pop today, on peer earnings, five days ahead of PANW's own print, with sell-side targets that have been chasing the stock upward all August rather than leading it.

Resolution, per the framework's own first-principles table: this is the "Great company / Expensive price" cell — wait/watch, not buy, not sell. The business case is intact and arguably strengthening (platformization is working); the price already reflects a great deal of that, and then some, heading into a high-expectations print. The held position should stay held — there is no fundamental deterioration case here — but this is not the level to add capital, and the legacy trim on this name ($230+, badly stale against a $383 tape) needs to be replaced with a valuation-disciplined multiple rather than removed, since the growth story is real enough that a fixed dollar trim would force an early exit from a compounder.

Verdict: WATCH | conviction 6.5. Hold the existing position through the September 1 print — nothing here argues for trimming into strength on a name whose fundamentals are improving — but do not add at spot. Revisit immediately after the print; if FY27 guidance confirms non-GAAP EPS growth reaccelerating meaningfully above the ~9% currently implied (i.e., dilution is being digested and per-share economics stop lagging revenue growth), that would be grounds to raise conviction. If GAAP losses persist beyond the deal-close quarter or organic NGS ARR/RPO growth decelerates from the ~22-30% range, that would be grounds to cut it.

6. Key Risks

Valuation risk into a binary event. ~101x current-year non-GAAP earnings, five days before the print that sets FY27 guidance; today's +12.8% sympathy pop raises the bar further before PANW has said a word about its own quarter.
Dilution has not fully hit the trailing numbers yet. The CyberArk shares only entered the weighted average partway through Q3 FY26 (pitfall-weighted-average-share-count-lags-a-step-change); a full quarter of the ~815M share count is still working through future per-share comparisons, meaning further degradation in per-share metrics is baked in even without any new dilution.
GAAP profitability is currently negative and it is not yet clear how many quarters of deal-related amortization/integration cost stand between here and GAAP breakeven again.
Competitive/structural risk from both directions — CrowdStrike attacking the identity/cloud space CyberArk was meant to fortify, and "platform fatigue" skepticism (cited in the April 2026 sector sell-off) about whether a broad platform can keep pace with AI-accelerated threats as well as a narrower cloud-native specialist.
No insider buying confirms the price, not the value — the one meaningful open-market buy was at $147; nothing since, even as the stock nearly tripled.

Data Traps Hit (for orchestrator capture — no Playbook file written by this report)

pitfall-vendor-forward-eps-is-the-wrong-fiscal-year — confirmed, textbook case. Yahoo forwardPE (93.1x) uses forwardEps ($4.11) which is the FY2027 consensus, one year past the fiscal year about to close (FY2026, non-GAAP guide $3.77–3.79, matching Yahoo's own epsCurrentYear/priceEpsCurrentYear fields at 101.4x). The near-term multiple is materially higher than the headline "forward P/E" implies.
pattern-net-margin-above-operating-margin-is-a-tripwire — confirmed. Yahoo's snapshot operatingMargins TTM field reads −2.465%, below profitMargins (net margin) of 7.947% — an accounting impossibility under normal conditions (interest and tax should only subtract from operating to reach net, never let net sit above operating). My own sum of the four quarterly "Operating Income" lines gives a true TTM operating margin of +9.6%, which is what this report uses. The vendor snapshot field should not be trusted for this name's TTM operating margin.
pitfall-yahoo-snapshot-fcf-field-diverges-from-quarter-sum — confirmed. Yahoo's snapshot freeCashflow TTM ($3,579M) undershoots my own sum of the four quarterly FCF lines ($3,793.5M) by ~6%. Used the quarter-sum figure throughout.
pitfall-yahoo-insider-purchases-counts-rsu-grants — confirmed. Numerous $0.00 "Stock Award(Grant)" rows in insider_transactions are RSU grants, not purchases; the only genuine cash purchase in the trailing 12 months is the CEO's March 27, 2026 buy.
pitfall-weighted-average-share-count-lags-a-step-change — relevant, flagged prospectively. The CyberArk share issuance (112M shares, closed Feb 11, 2026) only partially weighted into the Q3 FY26 diluted average (801M vs. the 815M shares actually outstanding today) — expect further downward pressure on trailing per-share metrics as future quarters carry the full new share count, independent of any new dilution.

No new pitfall pattern proposed — all five are existing Playbook entries confirmed on a new name, not novel mechanisms.