Palo Alto Networks, Inc.

Good day, everyone, and welcome to Palo Alto Network's first fiscal quarter 2026 earnings conference call. I am Hamza Fadawalla, Senior Vice President of Investor Relations and Strategic Finance. Please note that this call is being recorded today, Wednesday, November 19th, 2025 at 1.30 p.m. Pacific time. With me on today's call to discuss our fiscal first quarter results are Nikesh Arora, our Chairman and Chief Executive Officer, and Deepak Galecha, our Chief Financial Officer. Following our prepared remarks, Lee Claridge, our Chief Product and Technology Officer and Board Member, will join us for the question and answer portion. You can find the press release and other key information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the Q126 supplemental information and Q126 earnings presentation. During the course of today's call, we will be making forward-looking statements and projections regarding the company's business operations and financial performance, as well as the company's pending acquisitions. These statements made today are subject to a number of risks and uncertainties that could cause our actual results to differ from these forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentation today. This presentation contains non-GAAP financial measures and key metrics relating to the company's past and future expected performance. Non-GAAP financial measures should not be considered a substitute for financial measures prepared in accordance with GAAP. The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix of the investor presentation. Unless specifically otherwise noted, all results and comparisons are on a fiscal year-over-year basis. We also note that management is scheduled to participate in the UBS conference this quarter. I will now turn the call over to Nikesh.

Thank you, Hamza. Good afternoon and thank you everyone for joining us for our earnings call today. As you can see, we had a strong start to the year in Q1. We exceeded expectations across every guided metric. Demand across our core business remains robust and customers continue to platformize with us. Year over year, RPO grew 24%, and GSAR was up 29%, and total revenue was up 16%. We saw strength across our portfolio in SASE, XIM, software firewalls, and even so early traction in our AI security platform, Prisma Airs. Our top-line growth was complemented by continued improvement in profitability, achieving our second straight quarter of 30-plus percent operating margin. These results are a direct outcome of our strategy too. By delivering better security outcomes, our platform is earning more and more of the trust that used to be fragmented across dozens of point products. At the same time, the threat landscape continues to evolve faster than we expected because of AI. As many of you saw last week, with one of the major AI platforms, AI hackers aren't a future threat, they're here now. This was the first reported case of an AI agent autonomously conducting a large scale nation state cyber attack. The attacker was able to manipulate an agent to take steps on its own with minimal human intervention. This is a turning point. Proof that attackers are already weaponizing AI agents at scale. Even more importantly, they're able to attack fast and will be able to exfiltrate faster. AI is exposing the cracks in our enterprise architectures, which do not have robust security. Patches are incomplete. Platforms are missing. There is a plethora of point products across the enterprise. This gap is exactly where attackers thrive. They're testing how far they can exploit a model. They're running prompt injections, jailbreaks, model manipulation. And now we're seeing the next phase, autonomous AI agents being leveraged into the attack chain. AI is here, and with it, AI attackers are here too. Our message to customers is clear. Real-time visibility and security are essential for infrastructure. This reality necessitates a paradigm shift in the industry. We must move away from today's fragmented security landscape and towards platformization. AI requires a seamless cyber data strategy. This platform approach allows security agents to be utilized effectively by the good guys to detect attacks, protect customers, and immediate security concerns. Fragmentation creates friction, which in turn causes latency. Latency is a critical enemy of real-time cybersecurity. This is the backdrop that informs our strategy as we go forward. Now let's get into the quarter. In Q1, platformization once again drove large deals across multiple industry verticals. This included U.S. Federal, where we had a strong quarter and notable competitive wins. One example was a $33 million SASE deal with a U.S. Cabinet agency securing 60,000 seats. This agency displaced a major SASE incumbent as they needed a platform to provide unified visibility across both their firewall estate and remote endpoints. Another example was a $100 million deal with a large U.S. telecom provider. This included an $85 million commitment to XIM, which is our largest XIM deal ever. This customer chose us to consolidate the disparate point products based on the ability of our platform to deliver materially faster, meantime respond. The common theme across these large transactions is clear. Customers are moving from managing vendor sprawl to demanding superior demonstrable security outcomes for platformization. The natural place for customers to start their journey is network security, which remains our largest business. In Q1, we continue to see strength in our next generation software form factors. SASE had a phenomenal quarter. ARR grew 34% year-over-year and surpassed $1.3 billion in Q1, making us the fastest growing SASE provider at scale. We now have approximately 6,800 SASE customers, including one-third of the Fortune 500, including leading technology companies like IBM and Oracle. Even though it's early days, we continue to see strong momentum with secure browsers. The arrival of AI in agentic browsers will expose security cracks on them and focus the enterprise in ensuring widespread adoption of secure browsers. In Q1, we crossed seven and a half million browsers sold while our bookings nearly quadrupled year over year. One more product which I'm getting more and more excited about recently is a shift I'm observing in our customers deploying more and more software firewalls. And it's beginning to show in our results. Product revenues grew 23% year over year. Today, nearly half of our product revenues are driven by the software form factor. We now have over 12,500 customers and maintain our leading market position in software firewalls. As AI transformation accelerates, growth in cloud workloads, the software parallel provides essential runtime protection for the new AI data center, and with its recent ability to step up and protect AI, we expect continued momentum. Talking about protecting AI, let's talk for a bit about Prisma Airs. As I mentioned earlier, AI is moving faster than expected. This creates a critical moment for enterprise innovation. The reality is that while 78% of organizations are embracing AI transformation, a staggering 94% still lack the necessary security guardrails presenting a massive risk. With our acquisition of Protect AI now fully integrated, we introduced Prisma Airs 2.0 in Q1, the industry's most comprehensive end-to-end platform to secure AI, protecting everything from autonomous agents to models that power them. And I'll predict here that AI agents will become a problematic insider threat if not secured. Prisma Airs is the essential circuit breaker layer to stop them. It unites deep model inspection, real-time agent defense against threats like prompt injection and continuous autonomous AI red teaming in one platform. And once our acquisition of CyberArk closes, the addition of identity security will be critical to this mission, providing the essential privilege controls to govern these new autonomous insider threats and prevent agent identity impersonation. Our commitment to AI security is driving new high-value partnerships, including a collaboration with NVIDIA to secure the AI factory with Prisma Airs on Bluefield and tight integrations with platforms like Glean, IBM, Factory, and ServiceNow in securing the exploding number of agentic AI workflows. Early customer traction is strong, reflecting the general market need and the number of AI deals in Q1 more than doubled versus last quarter. We believe we are the furthest ahead in AI security with marquee customers signing up with Palo Alto Networks. As they move from traditional to AI workloads, we believe we are going to continue to be in the pole position. And the same way AI surprised the world with its pace, I want to talk about something else that is going to become relevant from a technology shift and security perspective. Quantum. Quantum computing has seen significant innovation over the last year. We're getting more and more optimistic on the arrival of quantum and expect it to be commercialized by 2029. As is widely known, quantum computing has the ability to break current encryption across technology stacks. Enterprises have less than five years to get their estates to quantum readiness. There is a fear that some nation states will have quantum compute capability sooner than 2029. Just last month, our partner IBM announced they were able to run a key quantum error correction algorithm on commonly available chips. The U.S. government and many other nations are emphasizing PQC or post-quantum cryptography to drive new cryptographic standards that are resistant to attacks from future large-scale quantum computers. To address this, we have launched and are going to be delivering a complete quantum safe strategy. First, we help you discover. In August, we launched our new version of PanOS 12.1 Orion, which provides a quantum readiness solution to give customers an automated inventory of their cryptographic risk. Second, we help you protect. We launched our new fifth generation firewalls, which are optimized for quantum security. Third, we help you accelerate. Our platform's unique cipher translation capability can make legacy systems quantum safe immediately, even if the application itself cannot be upgraded. Beyond this, we have just announced that we're deepening our partnership with IBM to deliver the quantum safe readiness and remediation service, a complete end-to-end solution for PQC migration. Now moving to Cortex, which is a pillar of our Security Operations Center strategy. Ex-Im continued its incredible trajectory in Q1. We now have approximately 470 customers with the average customer paying over a million dollars in ARR. This includes large, referenceable customers in every major industry. The success is no coincidence. XIOM was built for large-scale data processing, organizing it, normalizing it, and making sense of it in real time. Today, we're processing 15 petabytes of telemetry on a daily basis. The result is demonstrable security outcomes. Over 60% of our deployed XIOM customers have reduced their MTTR, or median time to respond, from days or weeks down to minutes. I am also thrilled to announce the launch of Agentix this quarter. Agentix brings powerful AI agents directly to the core of enterprise security challenges. In the future, the only effective countermeasure against hacker AI will be our own AI agents, purpose-built for advanced security detection and remediation. For years, the industry has struggled with two defining issues, overwhelming alert fatigue and a massive global talent shortage. Agentix is our definitive answer. This is a leap beyond mere automation. This is true autonomy. The ability to use predefined agents or build custom agents to secure enterprise is a step change in how security will work in the future. We are fundamentally transforming security operations and optimization by deploying autonomous AI agents that deliver enhanced speed, superior efficiency, and greater control for security practitioners. Right out of the box, Agentech leverages a broad integration ecosystem connecting with thousands of existing security and IT tools and third-party environments. It provides customers with an intelligent, fully governed, and completely transparent teammate across the enterprise. Ready to operate on day one, Agentech accelerates response, elevates quality, and frees up scarce human talent to focus on higher-order strategic work. Now shifting gears, I am pleased to announce our CyberArk integration plans remain fully on track and we're proud to have received overwhelming shareholder support for the acquisition, which is now expected to close in fiscal Q3. Since our announcements in July, we've spent more time with the CyberArk team. We are even more excited about the growth opportunity in future product roadmap. This includes our vision of democratizing identity security across the enterprise and making identity the next platform for Palo Alto Networks. Anecdotally, our customers share in our enthusiasm and the early feedback has been encouraging. As many of you saw, CyberArk's business continues to execute, achieving record net new ARR in their most recent quarter. And even as we invest ahead of the curve, our long-term financial model remains intact. The scale of our platforms and operating leverage in our business reinforces our confidence in achieving 40 plus percent free cash flow margins by FY28, inclusive of both the pending CyberArk and Chronosphere acquisitions. We are executing from a position of strength, and we see a clear path to drive both innovation and financial discipline. Now let's talk about our new announcement. I'm sure all of you are wondering why Palo Alto Networks, who is in the midst of a large acquisition of CyberArk, would engage in an acquisition at the same time of Chronosphere. I think it's important to understand where we are in the AI cycle. The AI cycle is moving fast. There's never a day that goes by without significant announcements on investments in AI data centers, AI infrastructure. This large surge towards building AI compute is causing a lot of the AI players to think about newer models for software stacks and infrastructure stacks in the future. The 17-year-old observability industry was not designed for the AI era. AI requires always-on comprehensive observability at gigawatt scale. The challenge so far has been that full observability is cost-prohibitive for the customer. Chronosphere is one of the fastest growing software companies in history. The observability solution from Chronosphere has already been deployed and has demonstrated scale at a large frontier model where they continue to move workloads across. Leading board on the cloud consumer platforms are applying full comprehensive observability, offering 99.9 plus percent availability to their customers. Chronosphere is able to deliver this capability at a third of the cost of other industry leading solutions. Yes, a third. With one and a half trillion dollars of compute coming online over the next few years, there will be continued demand for next generation observability led by Chronosphere. We're really excited about the possibility of delivering remediation to the observability category by bringing together capabilities of Chronosphere and our newly announced agentics platform. Chronosphere also recently had acquired a company called Calyptia, a data pipeline provider that was complimenting their focus on observability and ensuring the right data got onto the observability platform. Calyptia integrated with XIM will enable us to offer our XIM customers comprehensive security data pipelining capabilities in line current industry trends. This acquisition perfectly aligns with our strategic playbook. We acquire the best technology at an inflection point in industry. We invest in its development, utilize our go-to-market scale to quickly deliver this game-changing innovation to our customers. Remember, this is barely 2.5% of our market cap, which is consistent with our tuck-in strategy for the last seven years of acquiring companies. To summarize, we had a strong start to the year. Our core business is firing on all cylinders. Platformization continues to take hold and overall demand is strong. Over the last years, we have shown our ability to scale a billion dollar plus ARR business in SASE and Cortex. Looking ahead, we think software firewalls is our hidden gem and possibly the next billion dollar opportunity We maintain a relentless focus on innovation by tackling new challenges in AI security and quantum. Finally, our ambitions continue to grow. This year will be significantly expanding our opportunity in new markets as we close the acquisition of CyberArk and Chronosphere in both categories of identity and observability, which we believe are in the midst of inflection due to AI. We are less than 5% penetrated into a TAM reaching nearly $300 billion in the next three years. As such, we are raising our expectations from $15 billion to $20 billion in ARR for FY30. With that, I will hand over the call to Deepak to review the quarterly results in detail.

Thank you, Nikesh, and good afternoon, everybody. We have an exciting opportunity ahead of us. We continue to execute with excellence, and our time is expanding through the pending acquisitions of two category leaders in CyberArk and Chronosphere. Given that, I would like to provide some additional color around our announced acquisition of Chronosphere, as well as an update on the CyberArk integration planning, before moving into detail on our Q1 financial results and guidance. As Nikesh mentioned, we announced our intent to acquire Chronosphere for a total consideration of $3.35 billion in cash and replacement equity awards. Chronosphere's co-founders, Martin Mao and Rob Skillington, and their employees will join Palo Alto Networks post-close. While Chronosphere does have significant ARR relative to most of our other acquisitions, we view this transaction to be more in line with the tuck-in acquisitions that we have done over the past eight years. The business has just over 250 employees with a customer base focused on large AI and born in the cloud enterprises. The momentum Chronosphere has achieved to reach over 160 million in ARR with triple digit growth has been impressive. For that reason, we expect Chronosphere to remain largely standalone post-close and in the near term, enabling us to balance integration timelines with the pending CyberArk acquisition. We expect this transaction to close in the second half of our fiscal year, 2026. On CyberArk, our integration planning is proceeding exceptionally well, reflecting the strong collaborative spirit between our teams. We've had excellent cross-functional collaboration at multiple levels, including dozens of integration planning workshops across various functions. We are firmly on track to hit the ground running post-deal close, which we expect in fiscal Q3, subject to customary closing conditions. As you can tell from our Q1 results, we're pursuing these acquisitions from a position of strength. With that, let's dive deeper into the quarter. Remaining performance obligation, or RPO, grew 24% to $15.5 billion. This metric is a key indicator of long-term revenue predictability and the scale of our committed business. Note that our RPO from Q1 last year included $68 million acquired from our QRadar acquisition, which took place in that period. Our current RPO, which reflects near-term revenue realization, stood at $6.9 billion, representing 16% growth. Reflecting stability in both the quality of our RPO and customer commitments, the average new contract duration remained consistent at approximately three years. NGS ARR ended the quarter at $5.85 billion, achieving 29% growth and exceeding the high end of our guidance. Adjusting for the $74 million contribution from the QRadar acquisition in the comparable prior period, our net new ARR in Q1 grew over 20%, The momentum was broad-based with strength from Software Firewalls, SASE, and XIAM. It is important to note that our NGS offerings drive all of our revenue line items, including product revenue, nearly half of which is from software over the last year, subscription revenue, and a growing portion of our support revenue. Total revenue reached $2.47 billion, representing 16% growth, which exceeded the high end of our guided range. Product revenue grew 23% year-over-year. 44% of our trailing 12-month product revenue came from software form factors, an increase from 38% in the trailing 12 months ending Q1 25. This acceleration is fueled by growth in our software firewalls and PanOS SD-WAN within product revenue. We continue to see stability in hardware appliances and early interest in our newly launched Gen 5 firewalls. Total services revenue grew 14%. Within this, both subscription and support revenues grew 14%. Geographically, we saw broad-brace strength across all major theaters, with Americas growing 14%, EMEA up 18%, and JPEG growing 22%. Having discussed our top-line strength, I'd like to take a moment to give an update on our platformizations in Q1. As Nikesh highlighted, platformization continues to take hold as customers look for a strategic security partner that can continually adapt and innovate with shifts in the cybersecurity threat landscape. Our ability to deliver best-in-class products through our unified platforms, Prismares and Quantum Security in Q1, for example, is a critical motivation for customers to platformize with us. We completed approximately 60 net new platformizations this quarter. This momentum was driven by strength in XIAM, where platformizations more than doubled year over year, affirming that customers are actively moving towards simplicity and integration to have real-time outcomes. We now have nearly 170 customers with NGS ARR over $5 million and 50 customers with NGS ARR over $10 million, both growing about 50% year over year. These results reinforce our target of $20 billion in NGS ARR by fiscal year 30, inclusive of the pending CyberArt and Chronosphere acquisitions. Moving down the income statement, our discipline focus on profitability and operational leverage is clearly visible in the performance metrics we delivered. Total gross margin for the quarter was 76.9%. We delivered product gross margins of 80.2%, an increase of 50 basis points year over year, and reflected a significant sequential improvement of 340 basis points compared to Q4 25. The services segment also demonstrated positive margin trajectory, reaching 76.2%, which constitutes a sequential increase of 70 basis points. We continue to be pleased by the continued growth of our SaaS offerings and remain actively engaged in executing cloud cost efficiencies. We delivered an operating margin of 30.2%, achieving expansion of 140 basis points year over year, and our second consecutive quarter above 30%. This strong expansion reflects not only improvements in gross margin, but critically, our ability to drive sustained scale and efficiency across all of the OpEx line items. We continue to apply an AI first lens to all of our processes and functions. Notably, we have been able to deploy AI in our global customer support organization to drive three consecutive quarters of case volume reduction and reduce time to resolve for 11 consecutive quarters. As a direct outcome of this discipline leverage, our diluted non-gap EPS reached $0.93, which exceeded the high end of our guidance. This execution provides the basis for strong adjusted free cash flow, which came in at $1.7 billion, up 17%. Our cash and cash equivalents at the end of the first quarter is now over $10 billion. Finally, regarding capital allocation, our approach remains prudent. We did not repurchase any shares in Q1. Our buyback strategy remains opportunistic. we have a billion dollars in share repurchase authorization remaining through December 2026. Ultimately, we remain focused on leveraging this efficiency to maximize long-term shareholder value. With that, I will move on to Q2 and fiscal 26 guidance. For the second fiscal quarter 2026, we expect NGS ARR to be in the range of $6.11 to $6.14 billion, an increase of 28%. remaining performance obligation of $15.75 to $15.85 billion, an increase of 21% to 22%, revenue to be in the range of $2.57 to $2.59 billion, an increase of 14% to 15%, and diluted non-GAAP EPS to be in the range of 0.93 cents or 0.95 cents, an increase of 15% to 17%. For the fiscal year 2026, we expect NGS ARR in the range of $7 to $7.1 billion, an increase of 26% to 27%. Remaining performance obligation of $18.6 to $18.7 billion, an increase of 17% to 18%. Revenue to be in the range of $10.50 to $10.54 billion, an increase of 14%. operating margins to be in the range of 29.5% to 30%, diluted non-GAAP EPS to be in the range of $3.80 to $3.90, an increase of 14% to 17%, and adjusted free cash flow margin in the range of 38% to 39%. As Nikesh mentioned earlier, we are also reiterating our 40% plus adjusted free cash flow margin target for fiscal year 28, inclusive of both CyberArk and Chronosphere. Furthermore, whilst we will provide more detailed guidance after closing the transaction, we expect to maintain an adjusted free cash flow margin of at least 37% for fiscal year 2026, inclusive of both CyberArk and Chronosphere, depending upon timing of close. We've included our typical modeling points in the presentation for your review, but I would like to highlight a few now. One, as we noted last quarter, we continue to expect our net new NGS ARR and revenue to be second half and Q4 weighted as we continue to platformize with our customers. Two, we expect product revenue growth for Q2 to be approximately 17% to 18%. And finally, we expect $130 million to $140 million in CapEx in Q2 26, which is inclusive of a $90 million non-recurring real estate CapEx. This $90 million will be removed from adjusted free cash flow in accordance with our typical treatment for these non-recurring items. With that, I will turn it over to Hamza for Q&A.