Summary
Palo Alto Networks opened fiscal 2026 with revenue of $2.47 billion in the first quarter, up 15.7% from the prior-year quarter. Gross profit was $1.84 billion, up 15.8%, and gross margin was 74.2%, up 0.1 percentage points. Operating income was $309 million, up 8.0%, but operating margin slipped to 12.5%, down 0.9 percentage points. Net income was $334 million, down 4.8%, and diluted earnings per share was $0.47, down 4.1%. The GAAP results contrast with the non-GAAP figures: non-GAAP net income was $662 million, or $0.93 per diluted share, compared with $545 million, or $0.78 per diluted share, and non-GAAP operating margin was 30.2%, compared with 28.8%. The gap reflects share-based compensation and other adjustments the company excludes from its non-GAAP measures.
The top-line expansion came with strong recurring metrics. Next-Generation Security ARR reached $5.9 billion, up 29% year over year. Remaining performance obligations were $15.5 billion, up 23.0% from the prior-year quarter. Deferred revenue, current portion only, was $6.13 billion, up 11.3%. Operating cash flow was $1.77 billion, up 17.3%, while capital expenditures were $84 million, up 90.9%. Free cash flow (non-GAAP) was $1,687 million, compared with $1,466 million. The company said its platformization strategy and its acquisitions of CyberArk and Chronosphere position it as a data and security partner for the AI era. Management also pointed to another quarter of 30% plus non-GAAP operating margin.
Guidance sets a clear path for the next quarter and the full fiscal year. For the fiscal second quarter of 2026, the company guides to sales of $2.57 billion to $2.59 billion, representing year-over-year growth of between 14% and 15%. It guides Next-Generation Security ARR of $6.11 billion to $6.14 billion, representing year-over-year growth of 28%, and remaining performance obligations of $15.75 billion to $15.85 billion, representing year-over-year growth of between 21% and 22%. Diluted non-GAAP net income per share is expected in the range of $0.93 to $0.95, using 711 million to 715 million shares outstanding. For the full fiscal year 2026, sales guidance is $10.50 billion to $10.54 billion, representing year-over-year growth of 14%. The company guides Next-Generation Security ARR of $7.00 billion to $7.10 billion and remaining performance obligations of $18.6 billion to $18.7 billion for the full fiscal year. Full-year non-GAAP operating margin is expected in the range of 29.5% to 30.0%, diluted non-GAAP net income per share in the range of $3.80 to $3.90, and adjusted free cash flow margin in the range of 38% to 39%. The CFO expressed confidence in achieving 40% plus adjusted free cash flow margin in FY 28. The guidance uses non-GAAP measures, and the company does not reconcile the non-GAAP operating margin and adjusted free cash flow margin guidance to GAAP.
Strategic moves and risks frame the quarter. Palo Alto Networks announced a definitive agreement to acquire Chronosphere for $3.35 billion in cash and replacement equity awards. Chronosphere reports annual recurring revenue of over $160 million as of the end of September 2025 and is growing that metric triple digits year over year, and the deal is expected to close in the second half of fiscal 2026. The pending CyberArk acquisition is expected to close in the third quarter of fiscal 2026, with CyberArk shareholders set to receive $45.00 in cash and 2.2005 shares of Palo Alto Networks common stock for each share; the equity value is approximately $25 billion based on the unaffected 10-day average daily volume-weighted average trading prices of the company's common stock as of July 25, 2025. The company also appointed Mark Goodburn to its board and announced the retirement of Mary Pat McCarthy effective January 23, 2026. Risks include macroeconomic and geopolitical conditions, tariffs and trade policy, integration of acquisitions, platformization execution, competition, and the potential for customer purchasing delays. The quarter shows healthy recurring revenue and cash generation, but GAAP profitability faced pressure from a higher tax provision and operating expense trends, while the company pursues large acquisitions that carry integration and financing risk.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q1 FY2026 | Q4 FY2025 | QoQ | Q1 FY2025 | YoY |
|---|---|---|---|---|---|
| Revenue | $2.47B | $2.54B | -2.5% | $2.14B | +15.7% |
| Gross profit | $1.84B | $1.86B | -1.1% | $1.58B | +15.9% |
| Gross margin | 74.2% | 73.2% | +1.0 pp | 74.1% | +0.1 pp |
| Research & development | $528.0M | $503.5M | +4.9% | $480.4M | +9.9% |
| Sales & marketing | $820.0M | $829.3M | -1.1% | $720.1M | +13.9% |
| General & administrative | $179.0M | $27.3M | +555.7% | $97.7M | +83.2% |
| Total operating expenses | $1.53B | $1.36B | +12.3% | $1.30B | +17.6% |
| Operating income (loss) | $309.0M | $497.2M | -37.9% | $286.5M | +7.9% |
| Operating margin | 12.5% | 19.6% | -7.1 pp | 13.4% | -0.9 pp |
| Net income (loss) | $334.0M | $253.8M | +31.6% | $350.7M | -4.8% |
| Net margin | 13.5% | 10.0% | +3.5 pp | 16.4% | -2.9 pp |
| Diluted EPS | $0.47 | $0.36 | +$0.11 | $0.99 | -$0.52 |
Risks
Pending acquisition of CyberArk, expected to close in the third quarter of fiscal 2026, may not complete within the anticipated timeframe or at all. Failure to close could trigger a $1.0 billion termination fee, delay expected benefits and synergies, and the deal could disrupt operations, increase competition in identity security, and dilute stockholders through the $45.00 cash plus 2.2005 shares per CyberArk share consideration.
The enterprise security market is intensely competitive, with competitors such as Cisco, Microsoft, Alphabet, CrowdStrike, Zscaler, and Wiz, and new and enhanced technologies including AI and machine learning continue to increase competition. Competitive pressures could result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share.
Substantially all revenue is generated through channel partners, and for the three months ended October 31, 2025, three distributors individually represented 10% or more of total revenue and in the aggregate represented 42% of total revenue. As of October 31, 2025, three distributors represented 45% of gross accounts receivable.
As a well-known security provider, the company may be a more attractive target for cyberattacks, and a network or data security incident could harm reputation, create liability, and adversely impact financial results. In November 2024, the company became aware of an authentication bypass vulnerability through the management web interface of certain PAN-OS software versions.
Defects, errors, or vulnerabilities in products or subscriptions, including the November 2024 PAN-OS authentication bypass vulnerability, could cause outages, fail to secure customer networks, lead to litigation or regulatory inquiries, and harm gross margins through warranty claims.
Operating results may be adversely affected by unfavorable economic and geopolitical conditions, including inflation, high interest rates, tariffs, trade disputes, sanctions on Russia, and hostilities in Israel. These conditions could reduce sales, lengthen sales cycles, and increase costs for chips and components.
The company is incorporating AI into many products and business operations, including Prisma AIRS and Cortex, and AI algorithms may have flaws or training data may be insufficient or biased. Evolving AI regulations in jurisdictions such as the E.U. may create legal liability, reputational harm, and higher computing costs.
A key growth strategy depends on selling additional products and platformization to large enterprise end-customers, which involves longer sales cycles, greater deployment complexity, and increased customer purchasing leverage. Failure to realize sales from large enterprise end-customers could materially and adversely affect business and operating results.
Privacy and data protection compliance, including GDPR, CCPA, and at least 20 U.S. state privacy laws, imposes significant costs and potential enforcement, litigation, and reputational harm. Cross-border data transfer mechanisms such as the E.U.-U.S. Data Privacy Framework may face legal challenges that disrupt data flows.
The company faces patent infringement claims, including the Centripetal Networks lawsuit where a judgment on October 3, 2024 assessed $114 million in lump sum damages plus statutory interest, currently on appeal. A successful claimant could require substantial damages or royalties, or prevent distribution of certain products.
The company must attract, retain, and motivate key technical, sales, and management personnel as headcount increased from 16,068 at the end of fiscal 2025 to 16,413 at the end of the first quarter of fiscal 2026. Failure to do so could harm the business and growth plans.
The company may have exposure to tax liabilities greater than anticipated, including from aggressive interpretations by tax authorities and changes such as the One Big Beautiful Bill Act signed July 4, 2025. The effective tax rate was 18.9% for the three months ended October 31, 2025, up from 4.9% in the prior-year period.
The company depends on manufacturing partners and limited-source key components, including outside the United States, and is susceptible to supply shortages, logistics delays, and pricing fluctuations. Cost of product revenue increased 19% for the three months ended October 31, 2025 compared with the prior-year period, partly driven by higher tariff costs.
Revenue growth rates of 16% and 14% for the three months ended October 31, 2025 and 2024 should not be relied upon as indicative of future performance. Revenue growth may slow or decline due to slowing demand, increasing competition, or failure to capitalize on growth opportunities.
SaaS KPIs
All quarters →Free cash flow (non-GAAP)
Non-GAAP Operating Margin
Remaining Performance Obligations (RPO)
Next-Generation Security ARR
Summary, forecast, risks and KPIs are extracted from Palo Alto Networks Inc's SEC filings for Q1 FY2026 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.