Palo Alto Networks (PANW) FY2026 results: revenue $11.5 billion, up 24.5% on the year

Palo Alto Networks is a cybersecurity provider, incorporated in 2005 and headquartered in Santa Clara, California, with a financial year ending on 31 July. Its platforms and services secure enterprise users, networks, clouds, endpoints, AI applications and agents, and identities, and give real-time visibility across cloud infrastructure, applications and AI workloads. The stated strategy is to help customers simplify their security architecture by consolidating separate point products, packaging capabilities into platforms that cover many of a customer's needs at once, which the company calls platformization.

Network and AI security

This platform is built around zero trust. Prisma Access with Prisma SD-WAN forms the secure access service edge offering for users, branches, data and AI applications, with Prisma Browser extending zero trust and data protection into the browser. Machine-learning next-generation firewalls secure campus locations and data centres, and software versions of them secure virtual and cloud networks. A suite of cloud-delivered security services sits on top, including advanced threat prevention, WildFire, URL filtering, DNS security, device security, quantum security, GlobalProtect, enterprise data loss prevention, software as a service security and AI access security. Prisma AIRS is the AI security platform, bringing together an AI gateway, agent security, red teaming, runtime security, model security and posture management to discover, assess and protect AI agents, applications, models and data. Strata Cloud Manager manages the firewall and secure access estate from one interface, with a natural language assistant and digital experience monitoring.

Cortex

The Cortex platform covers security operations and observability. Cortex XSIAM replaces traditional security information and event management tools with AI-powered operations, Cortex XDR handles prevention, detection and response, Cortex XSOAR handles orchestration and automation, Cortex Xpanse handles attack surface management, and Koi adds agentic endpoint security. Cortex XSIAM integrates the Chronosphere telemetry pipeline to ingest and optimise large data volumes. Cortex Cloud is the cloud security offering, a cloud native application protection platform combined with cloud detection and response, securing multi-cloud and hybrid environments from code to cloud to security operations.

Identity and Unit 42

Idira is the identity security platform. Its privileged access management module secures high-risk administrative access across multi-cloud, on-premises and hybrid infrastructure, enforcing zero standing privilege through just-in-time elevation, automating credential rotation, managing SSH keys and recording sessions. Its identity and access management service unifies single sign-on, phishing-resistant multi-factor authentication and automated lifecycle management for a decentralised workforce. Unit 42 is the threat research, incident response and security consulting arm, which tests customers' security controls, responds to incidents on their behalf and sells managed detection and response and managed threat hunting, and in April 2026 it launched a suite of Frontier AI Defense services.

Buying in capability

The company buys businesses, technologies and intellectual property to complement its own development work. In January 2026 it completed the acquisition of Chronosphere, an observability technology company, which became its observability platform. In February 2026 it completed the acquisition of CyberArk, an identity security company, which became its identity security platform. In April 2026 it completed the acquisition of Koi, an endpoint posture management company.

Customers and selling

End-customers are enterprises, service providers and government entities across education, energy, financial services, healthcare, internet and media, manufacturing, the public sector and telecommunications, deploying the products in enterprise networks, data centres, cloud locations, branch and remote sites and on-device agents. No single end-customer was more than 10% of total revenue in fiscal 2026, 2025 or 2024. Most sales go through a two-tier indirect model, to distributors who sell to resellers who sell to end-customers, with 30% of fiscal 2026 revenue coming through two distributors, and virtual firewalls are also sold through cloud marketplaces. The NextWave channel programme had more than 8,700 partners at 31 July 2026. Competitors fall into four groups: large companies that build security or observability into their products, such as Alphabet, Cisco and Microsoft; independent security or observability vendors, including Check Point, CrowdStrike, Fortinet, Okta and Zscaler; startups and point-product vendors; and public cloud vendors. The global workforce was 21,921 at 31 July 2026.

From Palo Alto Networks' annual report on Form 10-K for the year ended 31 July 2026. The filing

Written from the 10-K filed 10 September 2026: read the full 10-K.