← Palo Alto Networks, Inc.

PANW · Forward model · Bear case

The Bear case, 20 quarters out

Each segment is projected from its own operating driver, rolled up into consolidated cash flow, and discounted back to a fair value per share. The assumptions below are editable — change them and every number on this page moves with them.

REPORTING BOUNDARY. PANW is a single operating and reportable segment. Revenue is disaggregated only by type - Product, Subscription, Support - and by geography, and the three-way split reconciles exactly to reported total revenue in all eight disclosed quarters (2024 Q4 through 2026 Q3), which is the vertical shape used here. A Network Security / Cortex / Identity split was deliberately NOT built: management stated on the Q3 FY2026 call that segment-level revenue across those three platforms begins in fiscal 2027, and the only sizing offered today is an approximation on a call that network security is about 70% of revenue. Building three platform verticals from that would have manufactured two of them. Expect this vertical shape to be replaced once FY2027 segment disclosure begins. WHAT IS DISCLOSED. Every historical value in all three verticals is reported, none estimated. NGS ARR, RPO, current RPO, platformizations, net revenue retention and the acquired-versus-organic reconciliations are all disclosed, as are all company-level opex, cash flow, balance sheet and guidance figures. WHAT IS ASSUMED. PANW publishes no opex or operating income by revenue line and no gross margin for Support separately from Subscription, so all three verticals carry the same company-level economics rather than an invented split. The basis EBITDA margin of 44.1% is the disclosed 27.1% non-GAAP operating margin plus the disclosed 17.0%-of-revenue stock-based compensation, i.e. a cash operating margin; the 46.0% terminal is the brief's assumed 33% terminal non-GAAP operating margin plus roughly 13 points of SBC as acquisition awards vest out. The 15% tax rate is derived, not the 22% headline: PANW's long-term non-GAAP rate of 22% applied to non-GAAP pre-tax income is about 6.4% of revenue, which is 15.6% of this model's pre-tax margin. HOW TO READ THE FCF LINE. This model's free cash flow is EBITDA less capex less tax. It does NOT include the deferred-revenue and working-capital inflow that PANW's own adjusted free cash flow measure captures, so it prints roughly three to four points below the company's figure: FY2028 lands at 35.8% here against the reaffirmed 40% adjusted-FCF-margin target, and the terminal four quarters print 36.3%. Read the target as met, not missed. SEASONALITY. PANW's fiscal year ends 31 July, so the spec's Q1 is August-October and Q4 is May-July - the fiscal year-end selling quarter. All three verticals carry seasonality; the derivations, the factors and the window-to-window spreads are stated in each vertical's notes. The first projected quarter, 2026 Q4, prints $3.35B against management's 2 June 2026 guide of $3.345-3.355B, which is the only external check available on this model's shape and it is a guide, not a consensus - no sell-side estimate was used to calibrate any driver. BASIS WARNING. CyberArk closed on 11 February 2026, ten days into fiscal Q3, so the $388M of acquired revenue in the basis quarter is not a full quarter and Q4 FY2026 carries the first full one. Year-over-year comparisons from 2026 Q3 through 2027 Q2 mix acquired revenue on the current side against organic-only on the prior side; clean like-for-like comparisons resume at 2027 Q3.

The acquisition tailwind laps out and the organic business is a high-20s ARR grower, not a 60% one. Organic NGS ARR grew 28% and organic net-new NGS ARR 18%, both slower than the reported base; revenue excluding CyberArk and Chronosphere grew 14%, less than half the 31% headline. On costs a full year of acquired expense is still to come, stock-based compensation runs at 17% of revenue and only returns to pre-acquisition levels in 12 to 18 months, acquired-intangible amortisation runs at $280M a quarter against $7.3B of net intangibles, and memory and storage costs are rising into a hardware line that just took a 10% price increase. FY2026 adjusted free-cash-flow margin was guided to 37.5%, below the 38.5% trailing actual and below the 38-39% guided in November 2025 - the margin is going backwards in the year before a 40% target year.

PANW REVENUE MODEL

Latest: $4.64B (2031Q3E)

Period Value
2024Q4 $2.19B
2025Q1 $2.14B
2025Q2 $2.26B
2025Q3 $2.29B
2025Q4 $2.54B
2026Q1 $2.47B
2026Q2 $2.59B
2026Q3 $3.00B
2026Q4E $3.31B
2027Q1E $3.21B
2027Q2E $3.36B
2027Q3E $3.37B
2027Q4E $3.69B
2028Q1E $3.56B
2028Q2E $3.71B
2028Q3E $3.70B
2028Q4E $4.04B
2029Q1E $3.90B
2029Q2E $4.04B
2029Q3E $4.02B
2029Q4E $4.38B
2030Q1E $4.22B
2030Q2E $4.37B
2030Q3E $4.33B
2030Q4E $4.70B
2031Q1E $4.54B
2031Q2E $4.68B
2031Q3E $4.64B

What drives each segment

Product

Growth path
Basis quarter$594M
Final quarter$787M
Implied CAGR+6%
Share of revenue, final quarter17%
PV of segment cash flow$4.53B

The appliance and self-hosted-software line. Management sizes hardware at roughly 10% of total revenue against 20% in FY2021, and says 46% of trailing-twelve-month product revenue is now recurring software - software firewalls, Prisma AIRS credits, SD-WAN, self-hosted identity subscriptions - against 22% three years ago. Q3 FY2026 was the strongest hardware quarter in a decade: next-generation firewall bookings rose nearly 40% year over year on Gen 5 appliances and AI data-centre build-outs, and a 10% hardware list-price increase took effect in early April 2026.

Last four quarters
2025 Q4 $574M Reported
2026 Q1 $434M Reported
2026 Q2 $514M Reported
2026 Q3 $594M Reported
Next-generation firewall appliances (hardware)Software firewalls, VM-Series and firewall Flex creditsPrisma AIRS credits, SD-WAN and self-hosted identity subscriptions billed through the product line
Sequential growth +4.5%/qtr decaying toward +1.0% Deseasonalised trend, not a printed step: 22.1-22.6% y/y organic in the two clean quarters is 5.1%/qtr, trimmed for component-cost inflation.
Product

Latest: $787M (2031Q3E)

Period Value
2024Q4 $480M
2025Q1 $354M
2025Q2 $421M
2025Q3 $453M
2025Q4 $574M
2026Q1 $434M
2026Q2 $514M
2026Q3 $594M
2026Q4E $742M
2027Q1E $545M
2027Q2E $632M
2027Q3E $664M
2027Q4E $820M
2028Q1E $596M
2028Q2E $686M
2028Q3E $714M
2028Q4E $877M
2029Q1E $633M
2029Q2E $724M
2029Q3E $749M
2029Q4E $915M
2030Q1E $658M
2030Q2E $749M
2030Q3E $772M
2030Q4E $940M
2031Q1E $673M
2031Q2E $764M
2031Q3E $787M

Assumptions & reasoning

  • SEASONALITY, derived by ratio-to-centred-four-quarter-moving-average on this line's own eight disclosed quarters: Q1 0.852, Q2 0.964, Q3 0.988, Q4 1.196 after normalising to a mean of 1.0. The engine deseasonalises the $594M basis quarter to a $601M trend level before the driver runs, so growthQoQ is a trend rate and the printed sequential path carries the shape.
  • SEASONALITY SPREAD: eight quarters give one moving-average window per fiscal quarter, so the window-to-window spread cannot be measured directly. The corroboration is the repeated sequential step: Q4-to-Q1 printed -26.3% and -24.4% (1.9 points apart) and Q1-to-Q2 printed +18.9% and +18.4% (0.5 points apart), against a 34.3-point peak-to-trough factor amplitude. Signal exceeds spread by more than an order of magnitude, which is why this line is seasonal and the other two carry a smaller, jointly-derived shape.
  • Product revenue is not the same thing as hardware. Management's own framing puts roughly 10 points of hardware inside a line that is 20% of company revenue and 46% recurring software on a trailing-twelve-month basis. Any model that treats this vertical as pure appliance sales will misread both the growth rate and the margin.
  • No unit shipments, average selling price or backlog value is disclosed, so a unit driver cannot be evidenced. The disclosed leading indicators - NGFW bookings up nearly 40%, software firewall ARR up 25%, the April 2026 price increase and roughly one million firewalls in the field - bound the growth rate rather than generate it.

Subscription

Subscribers × ARPU
Basis quarter$1.63B
Final quarter$2.91B
Implied CAGR+12%
Share of revenue, final quarter63%
PV of segment cash flow$14.32B

The recurring software line and the largest single vertical. Its operational constraint is the contracted recurring base the company publishes as Next-Generation Security ARR: $8.13B at 2026 Q3, up 60% year over year, of which $1.63B came from CyberArk and Chronosphere and $6.5B was organic (+28%). Management's long-run frame is $20B of NGS ARR by FY2030 carried by 4,000+ platformizations, with roughly 120% net revenue retention and single-digit churn inside the platformized cohort.

Last four quarters
2025 Q4 $1.31B Reported
2026 Q1 $1.36B Reported
2026 Q2 $1.40B Reported
2026 Q3 $1.63B Reported
SASE - Prisma Access, Prisma SD-WAN, SaaS Security, DLPCortex - XSIAM, XDR, XSOARCloud security (Prisma Cloud)Identity security (CyberArk / Idira)Observability (Chronosphere)Prisma AIRS AI securityLegacy attached subscriptions, which sit in this line but are excluded from NGS ARR
Subscribers 2K 9.1% of a 25K addressable base ~2,280 platformizations at Q3 FY2026 (slide 6), of which ~630 are Identity and Observability. Platformizations, not customers.
Addressable subscribers 25K the S-curve ceiling The metric's own footnote caps it: the 5,000 largest customers, at most five platformizations each. 25,000 is the structural ceiling, not a forecast.
Net adds 124/qtr ramping toward 148/qtr, throttled as the base approaches the TAM ~110 net new platformizations printed in Q3; 124 before the saturation damping the engine applies at 9.1% penetration returns that ~110.
Net-add ceiling 148/qtr what supply can deliver at full rate Identity and Observability add a fifth and sixth platform to sell, so the run rate drifts up rather than doubling.
ARPU $159,442.08/mo drifting +1.8% per quarter, floor $0.00 $2.317M NGS ARR per platformization x the 80.3% subscription-revenue bridge, on the deseasonalised basis quarter: $159.4k a month.
Non-subscriber revenue $587M/qtr growing +1.0% per quarter The 35% of the line that is not platformized - legacy attached subscriptions and single-product accounts - on the deseasonalised basis quarter.
Subscription

Latest: $2.91B (2031Q3E)

Period Value
2024Q4 $1.13B
2025Q1 $1.19B
2025Q2 $1.23B
2025Q3 $1.23B
2025Q4 $1.31B
2026Q1 $1.36B
2026Q2 $1.40B
2026Q3 $1.63B
2026Q4E $1.75B
2027Q1E $1.82B
2027Q2E $1.87B
2027Q3E $1.87B
2027Q4E $1.99B
2028Q1E $2.07B
2028Q2E $2.12B
2028Q3E $2.11B
2028Q4E $2.25B
2029Q1E $2.33B
2029Q2E $2.39B
2029Q3E $2.37B
2029Q4E $2.51B
2030Q1E $2.60B
2030Q2E $2.66B
2030Q3E $2.63B
2030Q4E $2.79B
2031Q1E $2.89B
2031Q2E $2.94B
2031Q3E $2.91B

Assumptions & reasoning

  • SEASONALITY, derived jointly for Subscription and Support: Q1 1.014, Q2 1.008, Q3 0.973, Q4 1.006. Method - ratio-to-centred-four-quarter-moving-average on the eleven-quarter consolidated revenue series (2024 Q1 to 2026 Q3), which yields company factors of Q1 0.982, Q2 0.999, Q3 0.976, Q4 1.043; Product's own factors are then removed at its FY2025 revenue weight of 19.5% and the residual applied to both recurring lines.
  • SEASONALITY SPREAD: the consolidated series gives two clean windows on Q3 (0.9732, 0.9752 - 0.20 points apart) and on Q4 (1.0391, 1.0431 - 0.40 points apart) against a 6.7-point company amplitude, so the company-level shape is reliable. The per-line eight-quarter windows are single observations and are used only as corroboration: Subscription's own moving-average factors are Q1 0.994, Q2 1.016, Q3 0.980, Q4 1.010 and Support's are Q1 1.010, Q2 1.004, Q3 0.972, Q4 1.013, both agreeing with the residual that fiscal Q3 is the trough. One shared residual is carried rather than two per-line shapes, because eight quarters cannot support a distinction between them.
  • NGS ARR is the only published volume metric that maps to this line, and its definition spans all product, subscription and support offerings while excluding hardware and legacy attached subscriptions, support and professional services. It therefore straddles the product and subscription revenue lines and excludes part of support. It is used here as the driver of subscribers and ARPU through a disclosed bridge, not as a one-to-one revenue proxy.
  • The 60% headline NGS ARR growth and the 28% organic figure describe the same quarter. A model built on the headline over-forecasts; a model built on organic under-forecasts, because the acquired $1.63B is now permanently in the company. The subscriber path here is landed platformizations, which is unaffected by the distinction, and the acquisition arrives through ARPU and the Identity and Observability platformization count instead.

Support

Growth path
Basis quarter$776M
Final quarter$946M
Implied CAGR+4%
Share of revenue, final quarter20%
PV of segment cash flow$5.65B

Attached maintenance and support on the installed base - roughly a million firewalls in the field with more than four subscriptions attached per device. It is the slowest and steadiest line in the company, $582M to $776M across eight quarters, and the $776M in 2026 Q3 is the first quarter carrying CyberArk and Chronosphere support contracts. It is also the line NGS ARR explicitly excludes, which is why it is modelled off the installed base and its own trend rather than off ARR.

Last four quarters
2025 Q4 $647M Reported
2026 Q1 $676M Reported
2026 Q2 $676M Reported
2026 Q3 $776M Reported
Hardware and software maintenance and support contractsProfessional services
Sequential growth +3.4%/qtr decaying toward +1.3% Organic trend is 12.4% y/y (2.96%/qtr) from the three pre-acquisition quarters; 3.4% adds the acquired support base still annualising in.
Support

Latest: $946M (2031Q3E)

Period Value
2024Q4 $582M
2025Q1 $593M
2025Q2 $603M
2025Q3 $602M
2025Q4 $647M
2026Q1 $676M
2026Q2 $676M
2026Q3 $776M
2026Q4E $820M
2027Q1E $842M
2027Q2E $852M
2027Q3E $836M
2027Q4E $876M
2028Q1E $895M
2028Q2E $900M
2028Q3E $878M
2028Q4E $917M
2029Q1E $933M
2029Q2E $935M
2029Q3E $909M
2029Q4E $946M
2030Q1E $959M
2030Q2E $959M
2030Q3E $930M
2030Q4E $966M
2031Q1E $978M
2031Q2E $976M
2031Q3E $946M

Assumptions & reasoning

  • SEASONALITY: this line carries the same jointly-derived recurring shape as Subscription - Q1 1.014, Q2 1.008, Q3 0.973, Q4 1.006 - from the consolidated eleven-quarter ratio-to-centred-moving-average net of Product at its 19.5% weight. Support's own eight-quarter windows give Q1 1.010, Q2 1.004, Q3 0.972, Q4 1.013, which agree closely on the fiscal Q3 trough but rest on one window each.
  • SEASONALITY SPREAD: Support's own repeated sequential steps are the weakest evidence in the model - Q4-to-Q1 printed +1.9% and +4.5% (2.6 points apart) and Q1-to-Q2 printed +1.7% and 0.0% (1.7 points apart) against a 4.1-point own-line amplitude. Signal barely clears spread on this line alone, which is exactly why the shared residual with its 0.2 to 0.4 point company-level spread is used instead of Support's own factors.
  • Support is disclosed as a revenue line but has no disclosed cost line of its own. PANW publishes only a combined subscription-and-support gross margin (75.1% non-GAAP at 2026 Q3), so every margin figure attached to this vertical is a company-level allocation and is flagged as such.
  • The step to 28.9% year-over-year growth in the basis quarter is acquisition arithmetic, not an attach-rate improvement - the three prior quarters printed 11.2%, 14.0% and 12.1%. A model that extrapolated the basis-quarter rate would overstate this line by roughly 16 points of growth, which is why the driver starts at 3.4% a quarter and decays.
Scenarios

Where each case comes from

Valuation

From cash flow to fair value

Present value of free cash flow, 20 quarters$20.83B
Terminal-year revenue$18.55B
Terminal-year EBITDA$7.93B
Exit multiple, on revenue6.0x
Terminal value$111.31B
Discounted at 9.5% a year, terminal value becomes$70.71B
Enterprise value$91.54B
Net cash$5.64B
Equity value$97.18B
Shares0.81B
Fair value per share$119.23
Against the current price of $382.85-69%

9.5% on a profitable, cash-generative large-cap with $5.6B of net cash, no borrowings beyond CyberArk's assumed convertibles and no financing need. 9x terminal revenue is 24.8x this model's own terminal free cash flow at a 36.3% margin - a mature compounder's multiple. The stock trades at 25.5x trailing revenue today, so the base case is mostly a statement about how far that compresses.

Read the other way round: at $382.85 the market is paying 24.2x terminal-year revenue, holding every other assumption on this page fixed. That is the number to argue about.

Quarter by quarter

The projected path

Quarter ProductSubscriptionSupport Revenue YoY EBITDA Capex FCF R40 PV of FCF
2026 Q4E $742M$1.75B$820M $3.31B +30% $1.37B $99M $1.08B +63 $1.05B
2027 Q1E $545M$1.82B$842M $3.21B +30% $1.33B $96M $1.05B +62 $1.00B
2027 Q2E $632M$1.87B$852M $3.36B +29% $1.40B $101M $1.10B +62 $1.03B
2027 Q3E $664M$1.87B$836M $3.37B +12% $1.41B $101M $1.11B +45 $1.01B
2027 Q4E $820M$1.99B$876M $3.69B +11% $1.54B $111M $1.22B +45 $1.09B
2028 Q1E $596M$2.07B$895M $3.56B +11% $1.50B $107M $1.18B +44 $1.03B
2028 Q2E $686M$2.12B$900M $3.71B +11% $1.56B $111M $1.23B +44 $1.05B
2028 Q3E $714M$2.11B$878M $3.70B +10% $1.56B $111M $1.23B +43 $1.03B
2028 Q4E $877M$2.25B$917M $4.04B +10% $1.71B $121M $1.35B +43 $1.10B
2029 Q1E $633M$2.33B$933M $3.90B +9% $1.65B $117M $1.30B +43 $1.04B
2029 Q2E $724M$2.39B$935M $4.04B +9% $1.71B $121M $1.35B +42 $1.06B
2029 Q3E $749M$2.37B$909M $4.02B +9% $1.71B $121M $1.35B +42 $1.03B
2029 Q4E $915M$2.51B$946M $4.38B +8% $1.86B $131M $1.47B +42 $1.09B
2030 Q1E $658M$2.60B$959M $4.22B +8% $1.80B $127M $1.42B +42 $1.03B
2030 Q2E $749M$2.66B$959M $4.37B +8% $1.86B $131M $1.47B +42 $1.05B
2030 Q3E $772M$2.63B$930M $4.33B +8% $1.85B $130M $1.46B +41 $1.02B
2030 Q4E $940M$2.79B$966M $4.70B +7% $2.00B $141M $1.58B +41 $1.08B
2031 Q1E $673M$2.89B$978M $4.54B +7% $1.94B $136M $1.53B +41 $1.02B
2031 Q2E $764M$2.94B$976M $4.68B +7% $2.00B $140M $1.58B +41 $1.03B
2031 Q3E $787M$2.91B$946M $4.64B +7% $1.98B $139M $1.57B +41 $996M

Every row is projected. A year-over-year change is shown only where the quarter it compares against exists — an em dash means there is no comparable quarter, not a flat year.

Track record

Model revisions

Assumptions are marked to reality as each quarter prints. Every change is appended here, with the fair value the model produced at the time, so the model's own history stays visible.

DateChangedFair value thenNote
2026-08-27 all $200.93 First publication, built on the 2026 Q3 (quarter ended 30 April 2026) basis from the verified research brief. Q4 FY2026 and full-year FY2026 results print on 1 September 2026 and will supersede every FY2026 guidance figure carried here, so a revision on that basis is already scheduled rather than optional.