PANW · Forward model · Arora case
The Arora case, 20 quarters out
Each segment is projected from its own operating driver, rolled up into consolidated cash flow, and discounted back to a fair value per share. The assumptions below are editable — change them and every number on this page moves with them.
REPORTING BOUNDARY. PANW is a single operating and reportable segment. Revenue is disaggregated only by type - Product, Subscription, Support - and by geography, and the three-way split reconciles exactly to reported total revenue in all eight disclosed quarters (2024 Q4 through 2026 Q3), which is the vertical shape used here. A Network Security / Cortex / Identity split was deliberately NOT built: management stated on the Q3 FY2026 call that segment-level revenue across those three platforms begins in fiscal 2027, and the only sizing offered today is an approximation on a call that network security is about 70% of revenue. Building three platform verticals from that would have manufactured two of them. Expect this vertical shape to be replaced once FY2027 segment disclosure begins. WHAT IS DISCLOSED. Every historical value in all three verticals is reported, none estimated. NGS ARR, RPO, current RPO, platformizations, net revenue retention and the acquired-versus-organic reconciliations are all disclosed, as are all company-level opex, cash flow, balance sheet and guidance figures. WHAT IS ASSUMED. PANW publishes no opex or operating income by revenue line and no gross margin for Support separately from Subscription, so all three verticals carry the same company-level economics rather than an invented split. The basis EBITDA margin of 44.1% is the disclosed 27.1% non-GAAP operating margin plus the disclosed 17.0%-of-revenue stock-based compensation, i.e. a cash operating margin; the 46.0% terminal is the brief's assumed 33% terminal non-GAAP operating margin plus roughly 13 points of SBC as acquisition awards vest out. The 15% tax rate is derived, not the 22% headline: PANW's long-term non-GAAP rate of 22% applied to non-GAAP pre-tax income is about 6.4% of revenue, which is 15.6% of this model's pre-tax margin. HOW TO READ THE FCF LINE. This model's free cash flow is EBITDA less capex less tax. It does NOT include the deferred-revenue and working-capital inflow that PANW's own adjusted free cash flow measure captures, so it prints roughly three to four points below the company's figure: FY2028 lands at 35.8% here against the reaffirmed 40% adjusted-FCF-margin target, and the terminal four quarters print 36.3%. Read the target as met, not missed. SEASONALITY. PANW's fiscal year ends 31 July, so the spec's Q1 is August-October and Q4 is May-July - the fiscal year-end selling quarter. All three verticals carry seasonality; the derivations, the factors and the window-to-window spreads are stated in each vertical's notes. The first projected quarter, 2026 Q4, prints $3.35B against management's 2 June 2026 guide of $3.345-3.355B, which is the only external check available on this model's shape and it is a guide, not a consensus - no sell-side estimate was used to calibrate any driver. BASIS WARNING. CyberArk closed on 11 February 2026, ten days into fiscal Q3, so the $388M of acquired revenue in the basis quarter is not a full quarter and Q4 FY2026 carries the first full one. Year-over-year comparisons from 2026 Q3 through 2027 Q2 mix acquired revenue on the current side against organic-only on the prior side; clean like-for-like comparisons resume at 2027 Q3.
The maximal case in the chief executive's own frame: that autonomously attack-capable frontier models have permanently repriced the category. The operating claim underneath it is that agentic AI multiplies machine-to-machine traffic which must be inspected in line, cementing network security - roughly 70% of revenue on management's own approximation - as critical infrastructure, while every human, machine and software agent identity becomes an attack surface Idira addresses. In this case the constraint is landing platformizations fast enough rather than demand, and $20B of FY2030 NGS ARR is a floor. It is the only case in this model whose fair value clears the 26 August 2026 close, and it does so on a 15x terminal revenue multiple that is still more than ten turns below the 25.5x trailing revenue the stock trades on today. What it does not achieve: it does not make the FY2028 margin target arrive early, and it does not remove the multiple compression - it only slows it.
Latest: $7.95B (2031Q3E)
| Period | Value |
|---|---|
| 2024Q4 | $2.19B |
| 2025Q1 | $2.14B |
| 2025Q2 | $2.26B |
| 2025Q3 | $2.29B |
| 2025Q4 | $2.54B |
| 2026Q1 | $2.47B |
| 2026Q2 | $2.59B |
| 2026Q3 | $3.00B |
| 2026Q4E | $3.40B |
| 2027Q1E | $3.39B |
| 2027Q2E | $3.64B |
| 2027Q3E | $3.75B |
| 2027Q4E | $4.22B |
| 2028Q1E | $4.19B |
| 2028Q2E | $4.48B |
| 2028Q3E | $4.60B |
| 2028Q4E | $5.15B |
| 2029Q1E | $5.10B |
| 2029Q2E | $5.44B |
| 2029Q3E | $5.56B |
| 2029Q4E | $6.21B |
| 2030Q1E | $6.16B |
| 2030Q2E | $6.54B |
| 2030Q3E | $6.67B |
| 2030Q4E | $7.43B |
| 2031Q1E | $7.37B |
| 2031Q2E | $7.81B |
| 2031Q3E | $7.95B |
What drives each segment
Product
Growth pathThe appliance and self-hosted-software line. Management sizes hardware at roughly 10% of total revenue against 20% in FY2021, and says 46% of trailing-twelve-month product revenue is now recurring software - software firewalls, Prisma AIRS credits, SD-WAN, self-hosted identity subscriptions - against 22% three years ago. Q3 FY2026 was the strongest hardware quarter in a decade: next-generation firewall bookings rose nearly 40% year over year on Gen 5 appliances and AI data-centre build-outs, and a 10% hardware list-price increase took effect in early April 2026.
Latest: $1.35B (2031Q3E)
| Period | Value |
|---|---|
| 2024Q4 | $480M |
| 2025Q1 | $354M |
| 2025Q2 | $421M |
| 2025Q3 | $453M |
| 2025Q4 | $574M |
| 2026Q1 | $434M |
| 2026Q2 | $514M |
| 2026Q3 | $594M |
| 2026Q4E | $763M |
| 2027Q1E | $575M |
| 2027Q2E | $685M |
| 2027Q3E | $739M |
| 2027Q4E | $939M |
| 2028Q1E | $701M |
| 2028Q2E | $828M |
| 2028Q3E | $886M |
| 2028Q4E | $1.12B |
| 2029Q1E | $829M |
| 2029Q2E | $973M |
| 2029Q3E | $1.04B |
| 2029Q4E | $1.30B |
| 2030Q1E | $959M |
| 2030Q2E | $1.12B |
| 2030Q3E | $1.19B |
| 2030Q4E | $1.49B |
| 2031Q1E | $1.09B |
| 2031Q2E | $1.28B |
| 2031Q3E | $1.35B |
Assumptions & reasoning
- SEASONALITY, derived by ratio-to-centred-four-quarter-moving-average on this line's own eight disclosed quarters: Q1 0.852, Q2 0.964, Q3 0.988, Q4 1.196 after normalising to a mean of 1.0. The engine deseasonalises the $594M basis quarter to a $601M trend level before the driver runs, so growthQoQ is a trend rate and the printed sequential path carries the shape.
- SEASONALITY SPREAD: eight quarters give one moving-average window per fiscal quarter, so the window-to-window spread cannot be measured directly. The corroboration is the repeated sequential step: Q4-to-Q1 printed -26.3% and -24.4% (1.9 points apart) and Q1-to-Q2 printed +18.9% and +18.4% (0.5 points apart), against a 34.3-point peak-to-trough factor amplitude. Signal exceeds spread by more than an order of magnitude, which is why this line is seasonal and the other two carry a smaller, jointly-derived shape.
- Product revenue is not the same thing as hardware. Management's own framing puts roughly 10 points of hardware inside a line that is 20% of company revenue and 46% recurring software on a trailing-twelve-month basis. Any model that treats this vertical as pure appliance sales will misread both the growth rate and the margin.
- No unit shipments, average selling price or backlog value is disclosed, so a unit driver cannot be evidenced. The disclosed leading indicators - NGFW bookings up nearly 40%, software firewall ARR up 25%, the April 2026 price increase and roughly one million firewalls in the field - bound the growth rate rather than generate it.
Subscription
Subscribers × ARPUThe recurring software line and the largest single vertical. Its operational constraint is the contracted recurring base the company publishes as Next-Generation Security ARR: $8.13B at 2026 Q3, up 60% year over year, of which $1.63B came from CyberArk and Chronosphere and $6.5B was organic (+28%). Management's long-run frame is $20B of NGS ARR by FY2030 carried by 4,000+ platformizations, with roughly 120% net revenue retention and single-digit churn inside the platformized cohort.
Latest: $4.98B (2031Q3E)
| Period | Value |
|---|---|
| 2024Q4 | $1.13B |
| 2025Q1 | $1.19B |
| 2025Q2 | $1.23B |
| 2025Q3 | $1.23B |
| 2025Q4 | $1.31B |
| 2026Q1 | $1.36B |
| 2026Q2 | $1.40B |
| 2026Q3 | $1.63B |
| 2026Q4E | $1.79B |
| 2027Q1E | $1.92B |
| 2027Q2E | $2.03B |
| 2027Q3E | $2.08B |
| 2027Q4E | $2.28B |
| 2028Q1E | $2.44B |
| 2028Q2E | $2.56B |
| 2028Q3E | $2.62B |
| 2028Q4E | $2.87B |
| 2029Q1E | $3.05B |
| 2029Q2E | $3.21B |
| 2029Q3E | $3.27B |
| 2029Q4E | $3.57B |
| 2030Q1E | $3.80B |
| 2030Q2E | $3.98B |
| 2030Q3E | $4.05B |
| 2030Q4E | $4.41B |
| 2031Q1E | $4.69B |
| 2031Q2E | $4.91B |
| 2031Q3E | $4.98B |
Assumptions & reasoning
- SEASONALITY, derived jointly for Subscription and Support: Q1 1.014, Q2 1.008, Q3 0.973, Q4 1.006. Method - ratio-to-centred-four-quarter-moving-average on the eleven-quarter consolidated revenue series (2024 Q1 to 2026 Q3), which yields company factors of Q1 0.982, Q2 0.999, Q3 0.976, Q4 1.043; Product's own factors are then removed at its FY2025 revenue weight of 19.5% and the residual applied to both recurring lines.
- SEASONALITY SPREAD: the consolidated series gives two clean windows on Q3 (0.9732, 0.9752 - 0.20 points apart) and on Q4 (1.0391, 1.0431 - 0.40 points apart) against a 6.7-point company amplitude, so the company-level shape is reliable. The per-line eight-quarter windows are single observations and are used only as corroboration: Subscription's own moving-average factors are Q1 0.994, Q2 1.016, Q3 0.980, Q4 1.010 and Support's are Q1 1.010, Q2 1.004, Q3 0.972, Q4 1.013, both agreeing with the residual that fiscal Q3 is the trough. One shared residual is carried rather than two per-line shapes, because eight quarters cannot support a distinction between them.
- NGS ARR is the only published volume metric that maps to this line, and its definition spans all product, subscription and support offerings while excluding hardware and legacy attached subscriptions, support and professional services. It therefore straddles the product and subscription revenue lines and excludes part of support. It is used here as the driver of subscribers and ARPU through a disclosed bridge, not as a one-to-one revenue proxy.
- The 60% headline NGS ARR growth and the 28% organic figure describe the same quarter. A model built on the headline over-forecasts; a model built on organic under-forecasts, because the acquired $1.63B is now permanently in the company. The subscriber path here is landed platformizations, which is unaffected by the distinction, and the acquisition arrives through ARPU and the Identity and Observability platformization count instead.
Support
Growth pathAttached maintenance and support on the installed base - roughly a million firewalls in the field with more than four subscriptions attached per device. It is the slowest and steadiest line in the company, $582M to $776M across eight quarters, and the $776M in 2026 Q3 is the first quarter carrying CyberArk and Chronosphere support contracts. It is also the line NGS ARR explicitly excludes, which is why it is modelled off the installed base and its own trend rather than off ARR.
Latest: $1.62B (2031Q3E)
| Period | Value |
|---|---|
| 2024Q4 | $582M |
| 2025Q1 | $593M |
| 2025Q2 | $603M |
| 2025Q3 | $602M |
| 2025Q4 | $647M |
| 2026Q1 | $676M |
| 2026Q2 | $676M |
| 2026Q3 | $776M |
| 2026Q4E | $842M |
| 2027Q1E | $889M |
| 2027Q2E | $924M |
| 2027Q3E | $931M |
| 2027Q4E | $1.00B |
| 2028Q1E | $1.05B |
| 2028Q2E | $1.09B |
| 2028Q3E | $1.09B |
| 2028Q4E | $1.17B |
| 2029Q1E | $1.22B |
| 2029Q2E | $1.26B |
| 2029Q3E | $1.26B |
| 2029Q4E | $1.34B |
| 2030Q1E | $1.40B |
| 2030Q2E | $1.44B |
| 2030Q3E | $1.43B |
| 2030Q4E | $1.53B |
| 2031Q1E | $1.59B |
| 2031Q2E | $1.63B |
| 2031Q3E | $1.62B |
Assumptions & reasoning
- SEASONALITY: this line carries the same jointly-derived recurring shape as Subscription - Q1 1.014, Q2 1.008, Q3 0.973, Q4 1.006 - from the consolidated eleven-quarter ratio-to-centred-moving-average net of Product at its 19.5% weight. Support's own eight-quarter windows give Q1 1.010, Q2 1.004, Q3 0.972, Q4 1.013, which agree closely on the fiscal Q3 trough but rest on one window each.
- SEASONALITY SPREAD: Support's own repeated sequential steps are the weakest evidence in the model - Q4-to-Q1 printed +1.9% and +4.5% (2.6 points apart) and Q1-to-Q2 printed +1.7% and 0.0% (1.7 points apart) against a 4.1-point own-line amplitude. Signal barely clears spread on this line alone, which is exactly why the shared residual with its 0.2 to 0.4 point company-level spread is used instead of Support's own factors.
- Support is disclosed as a revenue line but has no disclosed cost line of its own. PANW publishes only a combined subscription-and-support gross margin (75.1% non-GAAP at 2026 Q3), so every margin figure attached to this vertical is a company-level allocation and is flagged as such.
- The step to 28.9% year-over-year growth in the basis quarter is acquisition arithmetic, not an attach-rate improvement - the three prior quarters printed 11.2%, 14.0% and 12.1%. A model that extrapolated the basis-quarter rate would overstate this line by roughly 16 points of growth, which is why the driver starts at 3.4% a quarter and decays.
Where each case comes from
Bear case — primary sources
The primary sources this case is built from — filings, calls and posts. Where they are claims by an interested party rather than disclosures, every number in the Bear column is what happens if they are taken at face value.
The margin goes backwards before it goes forwards
- Jun 2, 2026 Adjusted free cash flow margin to be 37.5%. - FY2026 outlook, below the 38.5% trailing twelve-month actual reported in the same release.
- Jun 2, 2026 stock-based compensation increased sequentially to 17% of revenue in Q3, primarily driven by SBC related to our recent acquisitions... we expect stock-based compensation as a percentage of revenue to return to pre-acquisition levels on a run rate basis in approximately 12 to 18 months.
- Jun 2, 2026 Excluding the impact of CyberArk and Chronosphere, NGS ARR was $6.5 billion, up 28% year-over-year, and net new NGS ARR was $370 million, up 18% year-over-year.
- Jun 2, 2026 we implemented a 10% price increase on hardware in early April. The impact of pricing and rising component costs are reflected in our Q4 and fiscal 2026 outlook.
Bull case — primary sources
The primary sources this case is built from — filings, calls and posts. Where they are claims by an interested party rather than disclosures, every number in the Bull column is what happens if they are taken at face value.
Two dated targets, reaffirmed in writing
- Jun 2, 2026 We are executing ahead of our M&A integration plans and improving profitability across our businesses, which keeps us firmly on track to achieve 40% adjusted free cash flow margin in FY28.
- Jun 2, 2026 we remain confident in surpassing 4,000 platformizations by fiscal 2030, providing the primary momentum towards our $20 billion target for NGS ARR.
- Jun 2, 2026 we're now three to six months ahead of our original timeline for converging CyberArk's profitability with our own, a milestone we expect to reach within the next 12 to 18 months.
- Jun 2, 2026 Remaining performance obligation grew 36% year over year to $18.4 billion. This includes $1.8 billion from CyberArk and Chronosphere.
Arora case — primary sources
The primary sources this case is built from — filings, calls and posts. Where they are claims by an interested party rather than disclosures, every number in the Arora column is what happens if they are taken at face value.
The chief executive's repricing claim
- Jun 2, 2026 Mark my words, Mythos has increased the terminal value of the entire cybersecurity industry.
- Jun 2, 2026 Our next-generation firewall bookings grew nearly 40% year-over-year in Q3 as we continue to gain share.
- Jun 3, 2026 On February 11, 2026, we completed our acquisition of CyberArk Software Ltd. ... The total purchase consideration for the acquisition of CyberArk was $21.1 billion.
From cash flow to fair value
| Present value of free cash flow, 20 quarters | $31.87B |
| Terminal-year revenue | $30.56B |
| Terminal-year EBITDA | $14.74B |
| Exit multiple, on revenue | 15.0x |
| Terminal value | $458.45B |
| Discounted at 9.5% a year, terminal value becomes | $291.22B |
| Enterprise value | $323.09B |
| Net cash | $5.64B |
| Equity value | $328.73B |
| Shares | 0.81B |
| Fair value per share | $403.36 |
| Against the current price of $382.85 | +5% |
9.5% on a profitable, cash-generative large-cap with $5.6B of net cash, no borrowings beyond CyberArk's assumed convertibles and no financing need. 9x terminal revenue is 24.8x this model's own terminal free cash flow at a 36.3% margin - a mature compounder's multiple. The stock trades at 25.5x trailing revenue today, so the base case is mostly a statement about how far that compresses.
Read the other way round: at $382.85 the market is paying 14.1x terminal-year revenue, holding every other assumption on this page fixed. That is the number to argue about.
The projected path
| Quarter | Product | Subscription | Support | Revenue | YoY | EBITDA | Capex | FCF | R40 | PV of FCF |
|---|---|---|---|---|---|---|---|---|---|---|
| 2026 Q4E | $763M | $1.79B | $842M | $3.40B | +34% | $1.59B | $102M | $1.27B | +71 | $1.24B |
| 2027 Q1E | $575M | $1.92B | $889M | $3.39B | +37% | $1.59B | $102M | $1.27B | +74 | $1.21B |
| 2027 Q2E | $685M | $2.03B | $924M | $3.64B | +40% | $1.71B | $109M | $1.36B | +78 | $1.27B |
| 2027 Q3E | $739M | $2.08B | $931M | $3.75B | +25% | $1.77B | $112M | $1.41B | +62 | $1.29B |
| 2027 Q4E | $939M | $2.28B | $1.00B | $4.22B | +24% | $2.00B | $127M | $1.59B | +62 | $1.42B |
| 2028 Q1E | $701M | $2.44B | $1.05B | $4.19B | +24% | $1.99B | $126M | $1.58B | +62 | $1.38B |
| 2028 Q2E | $828M | $2.56B | $1.09B | $4.48B | +23% | $2.13B | $134M | $1.70B | +61 | $1.45B |
| 2028 Q3E | $886M | $2.62B | $1.09B | $4.60B | +23% | $2.19B | $138M | $1.75B | +61 | $1.46B |
| 2028 Q4E | $1.12B | $2.87B | $1.17B | $5.15B | +22% | $2.46B | $155M | $1.96B | +60 | $1.60B |
| 2029 Q1E | $829M | $3.05B | $1.22B | $5.10B | +22% | $2.44B | $153M | $1.95B | +60 | $1.55B |
| 2029 Q2E | $973M | $3.21B | $1.26B | $5.44B | +21% | $2.61B | $163M | $2.08B | +60 | $1.62B |
| 2029 Q3E | $1.04B | $3.27B | $1.26B | $5.56B | +21% | $2.67B | $167M | $2.13B | +59 | $1.62B |
| 2029 Q4E | $1.30B | $3.57B | $1.34B | $6.21B | +21% | $2.98B | $186M | $2.38B | +59 | $1.77B |
| 2030 Q1E | $959M | $3.80B | $1.40B | $6.16B | +21% | $2.96B | $185M | $2.36B | +59 | $1.72B |
| 2030 Q2E | $1.12B | $3.98B | $1.44B | $6.54B | +20% | $3.15B | $196M | $2.51B | +59 | $1.78B |
| 2030 Q3E | $1.19B | $4.05B | $1.43B | $6.67B | +20% | $3.21B | $200M | $2.56B | +58 | $1.78B |
| 2030 Q4E | $1.49B | $4.41B | $1.53B | $7.43B | +20% | $3.58B | $223M | $2.85B | +58 | $1.94B |
| 2031 Q1E | $1.09B | $4.69B | $1.59B | $7.37B | +20% | $3.55B | $221M | $2.83B | +58 | $1.88B |
| 2031 Q2E | $1.28B | $4.91B | $1.63B | $7.81B | +19% | $3.77B | $234M | $3.00B | +58 | $1.95B |
| 2031 Q3E | $1.35B | $4.98B | $1.62B | $7.95B | +19% | $3.84B | $239M | $3.06B | +58 | $1.94B |
Every row is projected. A year-over-year change is shown only where the quarter it compares against exists — an em dash means there is no comparable quarter, not a flat year.
Model revisions
Assumptions are marked to reality as each quarter prints. Every change is appended here, with the fair value the model produced at the time, so the model's own history stays visible.
| Date | Changed | Fair value then | Note |
|---|---|---|---|
| 2026-08-27 | all | $200.93 | First publication, built on the 2026 Q3 (quarter ended 30 April 2026) basis from the verified research brief. Q4 FY2026 and full-year FY2026 results print on 1 September 2026 and will supersede every FY2026 guidance figure carried here, so a revision on that basis is already scheduled rather than optional. |