PaloAltoNetworks (PANW) Q4 2025 earnings review
Platformization Pays Off: RPO Accelerates and PANW Bets Big on Identity
Palo Alto Networks capped its fiscal year with a strong Q4, beating revenue expectations and posting an impressive acceleration in its key forward-looking metric, Remaining Performance Obligation (RPO), which grew 24% YoY. This resurgence was fueled by record-breaking 'platformization' deals, validating the company's strategy of consolidating security vendors. However, the quarter was headlined by the strategic pivot to acquire identity leader CyberArk, a significant departure from its organic and tuck-in acquisition strategy. While FY26 guidance points to a slight moderation in growth, the strong bookings momentum and bold move into identity signal confidence in sustained long-term expansion.
🐂 Bull Case
The significant acceleration in RPO growth to 24% (from 19% in Q3) is hard evidence that the platform consolidation strategy is resonating with customers, leading to larger and longer-term commitments.
The company reported its strongest large-deal quarter ever, with customers spending over $20M in ARR growing nearly 80% YoY. This demonstrates success in moving upmarket and becoming a strategic security partner.
Product revenue growth re-accelerated to 19% YoY, driven by strength in software firewalls and SASE. Over 60% of network security bookings now come from software form factors, improving revenue quality.
🐻 Bear Case
While still strong at 32%, the growth rate of the key Next-Generation Security (NGS) ARR metric has decelerated for four consecutive quarters (from 40% in Q1). FY26 guidance implies this trend will continue.
The proposed acquisition of CyberArk is a massive strategic bet outside of its core markets. It introduces significant integration risk and a potential distraction from executing on its existing platform strategy.
Guidance for FY26 suggests a deceleration across key metrics, with revenue growth guided to 14% and RPO growth to ~18%, both below the rates achieved in the strong fourth quarter.
⚖️ Verdict: 🟢
Bullish. The sharp acceleration in forward-looking indicators like RPO and bookings is the most important signal, indicating the platform strategy is gaining powerful momentum. This outweighs the slight deceleration in trailing metrics like NGS ARR. The CyberArk acquisition is a bold, high-risk move, but if successful, it dramatically expands their TAM and cements their role as the key consolidator in cybersecurity.
Key Themes
Platformization Drives Record Large Deals
The company's core strategy of convincing customers to consolidate their security spending is clearly paying off. Q4 saw the highest bookings growth in 2.5 years, driven by major platform deals. Management cited a landmark deal creating a $50M ARR customer and noted that the number of customers with $5M and $10M in ARR grew by approximately 50% YoY, while those with $20M+ grew nearly 80%. This indicates the strategy is not just a narrative but a powerful financial driver.
Contradictory Growth Trends: NGS ARR vs. Product Revenue
There is a notable divergence in key growth metrics. Next-Generation Security (NGS) ARR growth, a critical indicator of momentum in new security areas, has steadily decelerated from 40% in Q1 to 32% in Q4. Conversely, Product Revenue growth, once a point of weakness, has sharply accelerated from 4% in Q1 to 19% in Q4, fueled by software firewalls. While the product acceleration is positive, the deceleration in the flagship NGS metric warrants monitoring.
Strategic Pivot: Entering Identity Security via CyberArk Acquisition
The proposed acquisition of CyberArk marks a fundamental strategic shift for Palo Alto Networks. Management's rationale is that identity is becoming a critical real-time security enforcement point, especially in the era of AI agents. They believe security-focused vendors are better positioned than traditional SSO players to win this market. This transforms PANW from a network, cloud, and SOC security player into a fourth pillar of identity, but also introduces substantial M&A integration risk and deviates from their successful organic innovation and tuck-in acquisition model.
XSIAM Continues to Disrupt the SIEM Market
The company's AI-powered SOC platform, XSIAM, remains its fastest-growing product ever. The customer count has reached approximately 400, with an average ARR per customer exceeding $1 million. Nearly a quarter of these customers are in the Global 2000. XSIAM is a key driver of platformization deals, often serving as the anchor for replacing legacy SIEM solutions and expanding into other Palo Alto services.
GAAP Profitability Declines Sharply
While non-GAAP Net Income grew a strong 29% YoY, GAAP Net Income fell from $357.7M to $253.8M. This was primarily driven by a significant swing in tax provisions; the prior-year quarter included a one-time tax benefit of $186M, compared to a tax provision of $148M this quarter. While not an operational issue, the stark difference in GAAP vs. non-GAAP results highlights the impact of tax adjustments and other non-cash items on reported earnings.
Leadership Transition: Founder Nir Zuk Retires
Founder and CTO Nir Zuk announced his retirement after over 20 years. As the visionary behind the next-generation firewall that launched the company, his departure marks the end of an era. Long-time product chief Lee Klarich will assume the CTO role and join the board, ensuring continuity. While the transition appears seamless, the departure of a celebrated founder is a significant event.
Other KPIs
Stable. The company continues to demonstrate significant operating leverage, reaching a record 30% non-GAAP operating margin in the fourth quarter. Full-year margin of 28.8% exceeded initial guidance. This consistent margin expansion provides the fuel for investment in innovation and M&A while supporting strong cash flow generation. FY26 guidance calls for a further increase to 29.2% - 29.7%.
The company delivered $3.5 billion in free cash flow for the full fiscal year, achieving a 38% margin for the third consecutive year. Management expressed high confidence in sustaining this, guiding to 38-39% for FY26 and targeting over 40% for the combined company with CyberArk in FY28. This demonstrates an ability to manage the transition to more annual billings while maintaining best-in-class cash generation.
Guidance
Decelerating. The initial outlook for FY26 implies a moderation from the strong growth rates seen in Q4'25. Revenue growth of 14% is down from 16% this quarter, NGS ARR growth of ~26.5% is down from 32%, and RPO growth of ~17.5% is down from 24%. While still robust, the guidance suggests the hyper-growth phase is tempering as the company scales.
Stable. The midpoint of $2.46B implies 15% YoY growth, roughly in line with the 16% growth reported in Q4'25. This suggests a steady start to the new fiscal year.
Decelerating. The midpoint of the range implies 29% YoY growth. This continues the trend of sequential deceleration from 32% growth in Q4'25 and 34% in Q3'25.