PANW › analyze
PANW · Analyze
Price at re-analysis: $375.65 (baseline: $382.85, −1.9%) | Mkt cap $307.3B | SharesOut 818M
1. What this updates
Baseline: analyze-2026-08-27.md (WATCH, conviction 6.5), written 5 calendar days before the FY26 Q4 print.
That report explicitly flagged the Sept 1 print as the immediate recheck trigger and set specific upgrade
and cut conditions. The print has now fired, plus a mid-September AI-cyber rally and buyback disclosure.
Event list since 2026-08-27:
- Sept 1 2026 (after close): Q4/FY26 print — Q4 rev $3.41B (+34%), Q4 non-GAAP EPS $1.02, NGS ARR $9.10B (+63% headline, ~$1B net-new in Q4), RPO $21.2B (+34%), Q4 adj. FCF $1.3B, Q4 GAAP net loss ~$(282)M.
- Sept 1 2026: FY27 guide issued — rev $14.10–14.20B (+23–24%), NGS ARR $11.075–11.175B (+22–23%), non-GAAP EPS $4.16–4.19, adj. FCF margin 38.0% (path to 40% by FY28); $20B NGS ARR FY30 target reaffirmed.
- Sept 14–15 2026: +13% two-day rally on Wedbush upgrade + AI-cyber sector rotation. Company disclosed completed $3.14B buyback + filed new $2.74B ESOP-related common-stock shelf.
- Sept 14–15 2026: Two directors (Bawa, Key) filed Form 4 sales (small, non-10b5-1 in Key's case).
- Late-Aug/early-Sept: CRWD Q2 FY27 print (raised FY27 rev to $5.99–6.01B, module-attach data); S Q1 FY27 (Purple AI at 50% attach); no material NET event.
- Broad analyst target hikes post-print (RBC $475, Wedbush upgrade, plus Piper/BTIG/GS/Oppenheimer/DA Davidson/ MS/Rosenblatt).
2. The delta ledger
Retracted / superseded (lead with these)
| # | Baseline claim | Status | Old → New | Cause |
|---|---|---|---|---|
| 5 | TTM FCF/share $4.65, lower than FY25 $4.89 — per-share economics degraded by CyberArk dilution | 🔄 SUPERSEDED | $4.65 (est) → $5.38 (fin.py, FY26 actual) | Print delivered $4.11B FCF on 764M FY26 diluted avg — per-share economics rebounded above FY25, not below. The baseline's projection ("further degradation baked in") did not survive the print. Buyback restart ($1.0B FY26 actual + $3.14B program closed) partly offset dilution. |
| 12 | FY26→FY27 non-GAAP EPS growth is only ~9%, so entire return has to come from re-rating | 🔄 SUPERSEDED | ~9% → ~10.5% at FY27 guide midpoint ($4.175 / $3.78) | Guide gives more EPS growth than the ~9% consensus the baseline used, but marginally — not "meaningfully above ~9%," so this does not by itself clear the baseline's specific upgrade condition. |
| 13 | Fair value $265–320 (70–80x FY26 non-GAAP $3.78) | 🔄 SUPERSEDED | FY26 base retired; roll to FY27 non-GAAP guide midpoint $4.175 | Same discipline (70–85x), new base: $292–355. |
| 11 | Yahoo forwardPE 93.1x uses FY27 EPS ($4.11), real near-term multiple is 101x FY26 ($3.77) |
🔄 SUPERSEDED | Fiscal calendar rolled | Yahoo forwardPE is now 77.0x on forwardEps implied ~$4.88 — that is already reaching to FY28 consensus, not FY27 guide. The pitfall pattern is textbook and repeats: pitfall-vendor-forward-eps-is-the-wrong-fiscal-year fires again on the same name a fiscal-quarter later. The real FY27 P/E at spot is ~90x ($375.65 / $4.175), not 77x. |
Refreshed (numbers moved, direction of thesis held)
| # | Baseline claim | Status | Old → New |
|---|---|---|---|
| 2 | Revenue growing, TTM $10.61B, organic ~24% | 🔁 REFRESHED | TTM $10.61B → FY26 actual $11.48B (above guide top). FY27 guide $14.10–14.20B (+23–24%). Organic pace holds. |
| 3 | TTM FCF ~$3.79B, 35.7% margin (corrected up from vendor) | 🔁 REFRESHED | $3.79B est → $4.11B FY26 actual (36% margin). FY27 guide 38% margin ≈ $5.35–5.40B. Quarter-sum discipline vindicated — the pitfall reads held to within 6%. |
| 4 | Share count 815M today, +38% vs FY22, dilution not fully worked through | 🔁 REFRESHED (drift eased) | 815M → 818M SharesOut, FY26 diluted avg 764M. The projected further step-up did not fully materialize — buyback restart bought back some of it. But the new $2.74B ESOP shelf keeps dilution optionality live. |
| 8 | NGS ARR $8.18B (+30% organic), RPO $18.4B (+22% organic) | 🔁 REFRESHED (accelerating) | NGS ARR → $9.10B (+63% headline) with ~$1B net-new in Q4 alone. RPO → $21.2B (+34%). Even organic-only pace held; the "deceleration" cut trigger did not fire. |
| 14 | Trim 105x fwd (~$432) | 🔁 REFRESHED | Recompute at slightly lower multiple given growth deceleration: 100x fwd → ~$418 on FY27 non-GAAP midpoint $4.175. |
| 16 | Analyst mean target $362.71, below spot $382.85; sell-side chasing tape | 🔁 REFRESHED | Mean target now $393.42, still bracketing spot ($375.65). RBC to $475, broad post-print raises. Sell-side is still chasing, just from a higher rung. |
Drifted (moving against thesis but not yet breaking it)
| # | Baseline claim | Status | Where it drifted, and where it breaks |
|---|---|---|---|
| 10 | GAAP loss is temporary, purchase-accounting driven, not operating deterioration | 📉 DRIFTED | Q4 FY26 posted another GAAP net loss (~$282M) — the second straight losing quarter. FY26 GAAP net income only $307M (vs $1.13B FY25). The baseline's cut condition was "GAAP losses persist beyond the deal-close quarter"; that condition has now fired one quarter. Breaks if Q1 FY27 does not return to GAAP positive — that would say the amortization/SBC headwind is structural at this cadence, not a one-quarter deal-close artifact. |
Carried (re-tested, still true)
| # | Claim | Check |
|---|---|---|
| 1 | CyberArk (Feb 2026 close) dominates trailing numbers | Balance sheet still carries $22.0B goodwill on $48.5B assets. Still explains the ROIC compression, GAAP profile, and share count. |
| 6 | Gross margin stable, no moat-erosion via margin | FY26 GM 70.4% vs FY25 73.4% — some CyberArk-mix compression, still ≥70%, no acceleration in the compression. |
| 7 | Platformization is a real switching-cost moat (NRR 120%, single-digit platformized churn, ~2,280 platformized customers) | Q4 metrics reaffirmed same directional story; NGS ARR reaccel implies platformized-customer count and NRR held. |
| 9 | Competitive threats live but not proven: CRWD attacking identity/cloud, hyperscaler bundling at low end | CRWD's own Q2 print showed platform consolidation is mutual (module-attach 51%/35%/26% at 6+/7+/8+), not zero-sum against PANW. The threat vector is real but neither report saw a decisive shift. |
| 15 | Aug 27 +12.8% was sector sympathy on CRWD/OKTA, not PANW-specific | Historical, unchanged. |
| 17 | No repeat insider buying at these levels; only CEO Arora's March $147 buy is a signal | Two directors sold small blocks Sept 14–15. Still zero open-market insider buys. |
Untested (this pass could not resolve)
| # | What was not tested | Why |
|---|---|---|
| 8b | Organic-only NGS ARR and RPO growth for Q4 | Company reported headline +63% and +34%; organic breakout for Q4 not confirmed independently in this window. Assumed to remain in the ~22–30% band because the sequential net-new profile is consistent with that, but this is inferred, not verified. |
| 9b | Did the April 2026 "AI-accelerated attackers vs broad platform" debate resolve in either direction? | The mid-September AI-cyber rally reads as a re-embrace of the platform bull case, but that is a Price force (sentiment/multiple), not a Structural resolution. The 5–10yr disruption question the baseline flagged is still open. |
New (no baseline counterpart)
| Finding | Force |
|---|---|
| $3.14B buyback program completed in FY26 (fin.py shows $1.0B in the FY26 line — the balance was completed pre-FY26-end from the earlier authorization). | Positive: capital return restart directly attacks Claim 5's dilution concern. |
| $2.74B ESOP-related common-stock shelf filed | Neutral-to-negative: it is optionality, not immediate dilution, but it establishes the machinery for continued SBC-funded share creation even as the buyback ended. |
| FY27 adj. FCF margin guide 38%, targeting 40% by FY28 | Positive: gives a concrete FCF-margin ceiling to model — implies FY28 FCF ~$6.5–7B if revenue guide is met. |
3. How the close calls were decided
Claim 12 (EPS growth) vs Claim 5 (per-share economics rebounded): The FY27 EPS-growth guide (~10.5%) is only marginally above the baseline's ~9%. That alone is not the "meaningfully above ~9%" the baseline required for a conviction bump. However it does not stand alone — FCF/share actually rose (Claim 5 superseded in the company's favor), and the FY27 FCF-margin guide (38%, path to 40%) says per-share FCF will compound faster than per-share EPS because purchase-accounting amortization stays out of the FCF line. Weighing both together, the per-share economics thesis moved from "degrading" (baseline) to "improving, just not through the EPS line" — that is a meaningful directional change, and it drives the conviction bump even though the specific EPS trigger was only weakly met.
Claim 10 (GAAP loss temporary) vs the "GAAP persists" cut condition: One quarter of continued GAAP loss did fire the baseline's cut condition, on a strict reading. It was outweighed by the print's clean beat on every non-GAAP and cash-flow line and by an FY27 revenue guide 2.5% above street. But the row is DRIFTED — not CARRIED — precisely so this does not silently roll forward. If Q1 FY27 also prints GAAP negative, that becomes a two-year GAAP-negative streak and re-enters the verdict.
Baseline testimony on Claim 4 (dilution unfinished): The baseline said "further degradation in per-share metrics is baked in even without any new dilution." I put this to the fresh Fundamentals evidence: FY26 diluted average of 764M was lower than the 815M SharesOut figure would have implied for full-year weighting because CyberArk shares only weighted partway through. Baseline reasoning: correct in mechanism — the weighting lag was real. Baseline conclusion: partially wrong in magnitude — the buyback restart offset enough of the mechanical drag that FCF/share rose year-on-year anyway. Recording the row as REFRESHED with the drift eased, not CARRIED.
4. Thesis persistence and conviction delta
Structural + Trend claims (1, 2, 6, 7, 8, 9): 6 of 6 CARRIED or REFRESHED favorably. High persistence. The business held.
State claims (3, 4, 5, 10): 3 of 4 REFRESHED favorably (with Claim 5 outright reversed in the company's favor); one DRIFTED (GAAP loss persistence).
Price claims (11, 13, 14, 16): All refreshed — bases rolled to FY27, multiple compressed slightly at trim to reflect growth deceleration.
Judgment (18): Conviction 6.5 → 7.0. The specific rows driving the bump: - Claim 5 SUPERSEDED in favor of the company (FCF/share rebounded, not degraded) — the single biggest swing in this pass. This claim was the core of the "per-share dilution overhang" argument in the baseline. - Claim 8 REFRESHED (NGS ARR reaccel with $1B Q4 net-new) — the platformization thesis found new evidence. - Claim 3 REFRESHED (FCF beat, FY27 38% margin guide) — the FCF compounding case got a target.
Not driving the bump (and worth being explicit about): - Claim 12 (EPS growth) met the baseline's upgrade trigger only marginally. - Claim 10 DRIFTED against — this is a genuine caution and caps the size of the conviction move. - Price is only 1.9% below the baseline; multiple compression from ~101x to ~90x came from earnings growing into the multiple, not from a pullback. The name is still expensive by any historical anchor.
Conviction stays below 7.5 (which is where "actively considering adding" would live) because the price has not moved into the fair-value band that the baseline itself set as the discipline for adding.
5. What is genuinely new
- FY27 revenue guide $14.10–14.20B is ~2.5% above pre-print Street — largest upside surprise in the print, and the market's reaction to it (up ~5% Sept 2, then the mid-Sept rotation) is the single biggest reason this is not a straightforward "hold" pass.
- Adj. FCF margin roadmap (38% FY27 → 40% FY28) is new discipline that lets Bogle be run properly: earnings growth 10%, FCF growth ~30% (36% → 38% margin on 23% revenue growth), yield 0%, multiple change the wildcard. That is a real compounding equation, not the multiple-only return the baseline was worried about.
- Buyback finished, new ESOP shelf filed — two capital-structure moves that partly cancel: one reduced the share count, the other establishes the mechanism for continued SBC-funded creation.
- CRWD's platform-consolidation traction (Q2 FY27) — the baseline treated CRWD as a purely competitive threat vector. CRWD's own module-attach data suggests platformization is a category-wide dynamic being won at the enterprise scale by both, not zero-sum. This softens (does not remove) the moat risk from Claim 9.
6. Updated verdict
WATCH | conviction 7.0. The business executed cleanly through the highest-attention print in the file and delivered an FY27 guide above street. FCF/share reversed the trailing-dilution overhang the baseline was worried about. The multiple compressed only because earnings grew into it — the price is essentially unchanged. This is not a name to add at spot ($375, ~90x FY27 non-GAAP), but the "wait for pullback" discipline is now waiting on a stronger business, not a decaying one.
Fair value: $292–355 — 70–85x FY27 non-GAAP guide midpoint $4.175, disciplined but generous for the compounding profile.
Entry: $275–320 — the low end assumes some multiple compression at a market pullback; the high end lets in a name that is materially through the current 90x FY27 multiple.
Trim: 100x fwd (~$418 at $4.175 FY27 midpoint) — down from 105x fwd in the baseline to reflect growth decelerating from 30%+ to 22–24%. The site will recompute the dollar level each build against live forward EPS, so this multiple, not a fixed dollar, is the discipline.
Upgrade conditions (raise conviction to 7.5+ or move to ACCUMULATE): - Price into the $275–320 entry band on macro/sector pullback, business intact. - FY27 Q1 print (Nov 20) confirms NGS ARR net-new sustaining >$1B/quarter and returns GAAP to positive.
Break triggers (cut to 6.0 or below, or move toward TRIM): - Q1 FY27 GAAP loss (second consecutive full year of GAAP-negative quarters) with no clear amortization runoff schedule. - NGS ARR net-new falls back to <$700M in a quarter — signals the platformization reaccel was a CyberArk-integration bounce, not a durable step-up. - ESOP shelf is drawn heavily (>$500M) inside a single quarter — that would say the buyback→ESOP swap is net dilutive rather than neutral.
7. What this pass did NOT test
- Organic-only Q4 NGS ARR and RPO growth — the headline and net-new dollar figures support the ~22–30% organic band the baseline used, but a clean organic breakout for Q4 was not independently pulled this pass. This is single-source-inferred; a Q1 FY27 print with an organic table will settle it.
- Whether the AI-narrative sector rally has legs beyond the mid-Sept rotation — Claim 9b is untested. This is a Price force wearing a Structural costume, per the skill's own warning; treating it as anything more than a multiple tailwind would be a category error.
- CEO Arora's post-print insider-buying behavior — there is no new buy at these levels, but the window since the print is 15 days, well inside a routine blackout period. Absence of a buy is not, in this window, evidence of anything.
Data Traps Hit This Pass
pitfall-vendor-forward-eps-is-the-wrong-fiscal-year— repeats on the same name. Yahoo'sforwardPEis now 77.0x. At spot $375.65 that implies forward EPS $4.88, materially above the FY27 non-GAAP guide midpoint of $4.175. The vendor field has already rolled to what is effectively an FY28 estimate. This is the second consecutive/analyzepass on PANW where the vendor "forward P/E" mislabels the fiscal year — the pattern is real, the pitfall note is correct, no new note needed.pitfall-yahoo-snapshot-fcf-field-diverges-from-quarter-sum— did not fire this pass; the FY26 full annual FCF figure ($4.11B) is a period-close annual number, not a TTM snapshot, so the trap does not apply until Q1 FY27 introduces TTM math again.pattern-net-margin-above-operating-margin-is-a-tripwire— did not fire this pass; FY26 full-year OpMargin (5%) > NetMargin (3%), the relationship is right way up now.
No new pitfall or pattern candidate.