← PANW forward model

PANW · Forward model · Subscription · Bear case

What has to happen in Subscription

Model as of

This page changes Subscription inside the complete PANW model. Every other vertical, corporate programme and valuation assumption stays in the selected portfolio case.

PANW forward model
Horizon
Consolidated fair value $119.23 all other verticals held in this portfolio case
Final-quarter revenue $2.91B 63% of company revenue
Explicit segment contribution $14.32B EBITDA less segment capex, before corporate items

The acquisition tailwind laps out and the organic business is a high-20s ARR grower, not a 60% one. Organic NGS ARR grew 28% and organic net-new NGS ARR 18%, both slower than the reported base; revenue excluding CyberArk and Chronosphere grew 14%, less than half the 31% headline. On costs a full year of acquired expense is still to come, stock-based compensation runs at 17% of revenue and only returns to pre-acquisition levels in 12 to 18 months, acquired-intangible amortisation runs at $280M a quarter against $7.3B of net intangibles, and memory and storage costs are rising into a hardware line that just took a 10% price increase. FY2026 adjusted free-cash-flow margin was guided to 37.5%, below the 38.5% trailing actual and below the 38-39% guided in November 2025 - the margin is going backwards in the year before a 40% target year.

Subscription

Basis quarter$1.63B
Final quarter$2.91B
Implied CAGR+12%
Final revenue mix63%

The recurring software line and the largest single vertical. Its operational constraint is the contracted recurring base the company publishes as Next-Generation Security ARR: $8.13B at 2026 Q3, up 60% year over year, of which $1.63B came from CyberArk and Chronosphere and $6.5B was organic (+28%). Management's long-run frame is $20B of NGS ARR by FY2030 carried by 4,000+ platformizations, with roughly 120% net revenue retention and single-digit churn inside the platformized cohort.

Last four quarters
2025 Q4 $1.31B Reported
2026 Q1 $1.36B Reported
2026 Q2 $1.40B Reported
2026 Q3 $1.63B Reported
SASE - Prisma Access, Prisma SD-WAN, SaaS Security, DLPCortex - XSIAM, XDR, XSOARCloud security (Prisma Cloud)Identity security (CyberArk / Idira)Observability (Chronosphere)Prisma AIRS AI securityLegacy attached subscriptions, which sit in this line but are excluded from NGS ARR
Subscribers 2K 9.1% of a 25K addressable base ~2,280 platformizations at Q3 FY2026 (slide 6), of which ~630 are Identity and Observability. Platformizations, not customers.
Addressable subscribers 25K the S-curve ceiling The metric's own footnote caps it: the 5,000 largest customers, at most five platformizations each. 25,000 is the structural ceiling, not a forecast.
Net adds 124/qtr ramping toward 148/qtr, throttled as the base approaches the TAM ~110 net new platformizations printed in Q3; 124 before the saturation damping the engine applies at 9.1% penetration returns that ~110.
Net-add ceiling 148/qtr what supply can deliver at full rate Identity and Observability add a fifth and sixth platform to sell, so the run rate drifts up rather than doubling.
ARPU $159,442.08/mo drifting +1.8% per quarter, floor $0.00 $2.317M NGS ARR per platformization x the 80.3% subscription-revenue bridge, on the deseasonalised basis quarter: $159.4k a month.
Non-subscriber revenue $587M/qtr growing +1.0% per quarter The 35% of the line that is not platformized - legacy attached subscriptions and single-product accounts - on the deseasonalised basis quarter.
Subscription

Latest: $2.91B (2031Q3E)

Period Value
2024Q4 $1.13B
2025Q1 $1.19B
2025Q2 $1.23B
2025Q3 $1.23B
2025Q4 $1.31B
2026Q1 $1.36B
2026Q2 $1.40B
2026Q3 $1.63B
2026Q4E $1.75B
2027Q1E $1.82B
2027Q2E $1.87B
2027Q3E $1.87B
2027Q4E $1.99B
2028Q1E $2.07B
2028Q2E $2.12B
2028Q3E $2.11B
2028Q4E $2.25B
2029Q1E $2.33B
2029Q2E $2.39B
2029Q3E $2.37B
2029Q4E $2.51B
2030Q1E $2.60B
2030Q2E $2.66B
2030Q3E $2.63B
2030Q4E $2.79B
2031Q1E $2.89B
2031Q2E $2.94B
2031Q3E $2.91B

Assumptions & reasoning

  • SEASONALITY, derived jointly for Subscription and Support: Q1 1.014, Q2 1.008, Q3 0.973, Q4 1.006. Method - ratio-to-centred-four-quarter-moving-average on the eleven-quarter consolidated revenue series (2024 Q1 to 2026 Q3), which yields company factors of Q1 0.982, Q2 0.999, Q3 0.976, Q4 1.043; Product's own factors are then removed at its FY2025 revenue weight of 19.5% and the residual applied to both recurring lines.
  • SEASONALITY SPREAD: the consolidated series gives two clean windows on Q3 (0.9732, 0.9752 - 0.20 points apart) and on Q4 (1.0391, 1.0431 - 0.40 points apart) against a 6.7-point company amplitude, so the company-level shape is reliable. The per-line eight-quarter windows are single observations and are used only as corroboration: Subscription's own moving-average factors are Q1 0.994, Q2 1.016, Q3 0.980, Q4 1.010 and Support's are Q1 1.010, Q2 1.004, Q3 0.972, Q4 1.013, both agreeing with the residual that fiscal Q3 is the trough. One shared residual is carried rather than two per-line shapes, because eight quarters cannot support a distinction between them.
  • NGS ARR is the only published volume metric that maps to this line, and its definition spans all product, subscription and support offerings while excluding hardware and legacy attached subscriptions, support and professional services. It therefore straddles the product and subscription revenue lines and excludes part of support. It is used here as the driver of subscribers and ARPU through a disclosed bridge, not as a one-to-one revenue proxy.
  • The 60% headline NGS ARR growth and the 28% organic figure describe the same quarter. A model built on the headline over-forecasts; a model built on organic under-forecasts, because the acquired $1.63B is now permanently in the company. The subscriber path here is landed platformizations, which is unaffected by the distinction, and the acquisition arrives through ARPU and the Identity and Observability platformization count instead.
PANW model map

Explore another vertical