Haverhill Financial Research · October 26, 2026
Summary: Haverhill price target $390 (12 months)
Palo Alto Networks has spent the last two years arguing that security buyers want one vendor instead of thirty, and then spent about $25 billion on CyberArk to prove it. The strategy is working on the numbers the company chooses to report: next-generation security annual recurring revenue reached $9.10 billion in the fiscal fourth quarter, up 63%, and remaining performance obligations passed $21 billion. The complication is that roughly a quarter of that growth was purchased rather than grown. Strip the acquisitions out and the company's own guidance for fiscal 2027 points to growth in the low twenties. At $380.55 the shares trade near 60 times the free cash flow we expect next year. Our 12-month price target of $390 is about 2% above the current price, so we rate the shares Hold.
The headline growth rate has an expiry date. Security ARR grew 63% in the fourth quarter. Management guides it to 22% to 23% for fiscal 2027. The gap is CyberArk and Chronosphere, which stop flattering the comparison after February 11, 2027.
Cash generation is the genuine strength. Adjusted free cash flow was $4.41 billion in fiscal 2026, a 38.4% margin, with a 40% target for fiscal 2028. Very few software businesses of this size convert that well.
Our view: a good company executing a coherent plan, priced as though the plan is already finished. We want a cheaper entry or proof that identity is compounding on its own.
Investment thesis in brief
Our thesis: Palo Alto is assembling the most complete security platform in the market, and the market is paying for the finished version today.
What we like. The platform argument is real. Customers who consolidate onto Palo Alto spend more over time, and the company says net revenue retention runs above 120% for that group. Cash conversion is excellent, remaining performance obligations of $21.2 billion give unusual visibility, and the fiscal 2027 guidance is specific enough to be held to.
What the market may be missing. CyberArk is not a bolt-on. It brings privileged access management at the moment when the identities that need governing are increasingly machines and software agents rather than people. If agent-driven work scales the way its customers expect, the number of identities requiring credentials rises by orders of magnitude, and that is a licensing tailwind nobody has modelled properly, including us.
What holds us back. Three things. Reported profitability is thin — the fourth quarter carried a GAAP net loss of $282 million against $853 million of non-GAAP income, the difference being acquisition and integration costs. The share count is climbing, from 764 million weighted in fiscal 2026 to 844 to 847 million guided for fiscal 2027. And the operating margin target for fiscal 2027, 29.5%, is barely above the 29.2% just delivered. A company spending this much should be buying leverage, and for now it is buying revenue.
How does the business actually make money?
Palo Alto sells security in three product families, and increasingly sells them together.
Network and AI security (about $8.35 billion in fiscal 2026, up 17%). The original firewall business, now sold mostly as software and as cloud-delivered access. This is the cash engine and the slowest grower.
Cortex (about $1.92 billion, up 25%). Security operations: detection, response and the XSIAM platform, which the company says passed $700 million of ARR across more than 1,000 customers.
Identity, the former CyberArk (about $1.26 billion, up 21%). Privileged access and secrets management, acquired in February 2026.
How it is sold. Revenue splits into product, $738 million in the fourth quarter, and subscription and support, $2.67 billion. The second is 78% of the total and growing faster, which is the shape you want. The metric management steers by is next-generation security ARR, because it excludes the legacy hardware that is slowly shrinking.
Platformization, in plain terms. The pitch is that a customer replacing several vendors with one Palo Alto platform gets better detection and a lower bill. The company reported about 220 net new platformizations in the fourth quarter and targets more than 4,000 by fiscal 2030. The three largest deals in the quarter were $126 million with a global telecom, $72 million with an IT services provider and $53 million with a payments platform.
What do the numbers say?
Fourth-quarter revenue was $3.41 billion, up 34%, and fiscal 2026 revenue $11.48 billion, up about 24%. Non-GAAP earnings were $1.02 a share in the quarter and $3.84 for the year. Adjusted free cash flow was $1.29 billion in the quarter. The chart below is the one to study, because it shows where the growth came from.
Three things investors should know.
The step-up is dated. Revenue ran at $2.47 billion and $2.59 billion in the two quarters before CyberArk closed, then jumped to $3.00 billion and $3.41 billion after. Fiscal third-quarter results included $388 million of revenue and $1.6 billion of ARR from CyberArk and Chronosphere combined.
Growth is guided to normalise sharply. Fiscal 2027 revenue guidance of $14.10 billion to $14.20 billion is 23% to 24% growth, and security ARR growth drops to 22% to 23%. Management also expects 60% to 61% of the year's new ARR in the second half, which front-loads the risk of a miss.
Margins are the thing to watch. Gross margin fell about 100 basis points in the fourth quarter, and management has flagged rising memory and storage costs plus hosting growing faster than revenue. Hardware is roughly 10% of revenue, so commodity pricing matters more here than at a pure software company.
Competition and moat
Palo Alto's defence is breadth. Its weakness is that every part of that breadth has a specialist attacking it.
Who it competes with. CrowdStrike in endpoint and security operations, where Cortex and XSIAM are the answer. Zscaler in cloud-delivered network access. Fortinet in firewalls, usually on price. Microsoft everywhere, bundling security into agreements customers already sign. Microsoft is the structural threat, because it does not need security to be a profit centre.
Where the moat is real. Once a customer routes network traffic, security operations and privileged credentials through one vendor, replacing it is a multi-year project rather than a procurement decision. That is what net revenue retention above 120% among platformized customers reflects. The company also reported about 100 competitive displacements in cloud-delivered access worth more than $400 million of total contract value, which suggests the consolidation argument wins deals rather than merely sounding good.
Where it is thin. The company bought identity rather than building it, and the integration is a year old. Buyers who want best-of-breed can still assemble a better stack from specialists. And the $25 billion price means the acquisition has to do more than work — it has to earn a return.
What is it worth?
We value Palo Alto Networks at $390 per share over the next 12 months, to October 2027, as a probability-weighted blend of three cases. That is about 2% above today's price, which supports a Hold.
Our method. GAAP earnings are distorted by acquisition accounting, so we value the company on adjusted free cash flow, which is also the measure management targets. By October 2027 investors will be looking at fiscal 2028, the year ending July 2028. We forecast revenue from the fiscal 2027 guidance, apply a free cash flow margin, and divide by roughly 860 million shares to allow for continued dilution. We then apply a multiple and weight the cases 25% bear, 50% base, 25% bull.
Why these numbers. Our base case takes the company at its word: fiscal 2027 lands inside guidance, fiscal 2028 grows about 20% on top, and the free cash flow margin reaches the 40% target management has set for that year. A 50 times multiple on free cash flow is high in absolute terms and roughly where the shares trade today, so the base case is really a statement that nothing re-rates.
What the price implies. At $380.55 the market is paying about 91 times fiscal 2027 non-GAAP earnings and roughly 60 times the free cash flow we expect that year. Those are multiples that require the identity thesis to be right, not merely credible.
What are the real risks?
The anniversary problem. After February 11, 2027 the CyberArk contribution stops inflating growth. Guidance already implies the drop, from 63% to the low twenties, but reported deceleration of that size tends to compress multiples anyway.
Margin leverage is not showing up. A 29.5% fiscal 2027 operating margin target against 29.2% delivered is about 30 basis points of progress for an enormous amount of integration work.
Dilution. Diluted shares rise from 764 million weighted in fiscal 2026 to 844 to 847 million guided for fiscal 2027, and CyberArk's convertible notes are exchangeable into Palo Alto stock.
Second-half weighting. With 60% to 61% of new ARR expected in the second half of fiscal 2027, a soft first half will not be reassuring even if the full year is reaffirmed.
Goodwill. Goodwill rose from $4.6 billion to $22.0 billion, with about $7 billion of intangibles alongside. If identity underdelivers, the writedown is large and public.
Microsoft. Bundled security that is good enough, included in an agreement the customer already signed, is the hardest competitor to price against.
What would change our mind?
Our Hold rests on one idea: the strategy is sound and the price already assumes it works.
Signals that would move us to Buy
Fiscal 2027 security ARR guidance raised above 25% after the CyberArk contribution laps.
Non-GAAP operating margin above 31% in any quarter of fiscal 2027.
Disclosed identity ARR growing faster than 25% as a standalone figure.
The price falls below about $320 with no change in our cash flow view.
Signals that would move us to Sell
Net new ARR in the first half of fiscal 2027 below 38% of the full-year plan.
Adjusted free cash flow margin guided below 37%.
Gross margin below 73% in any quarter.
The price runs above about $450 with no change in our cash flow view.
Catalysts to watch
Mid-to-late November 2026 (Haverhill estimate): fiscal first-quarter results. The company had not confirmed a date at the time of writing. The guidance to measure against is revenue of $3.30 billion to $3.31 billion, security ARR of $9.54 billion to $9.56 billion and non-GAAP earnings of $0.96 to $0.98.
February 11, 2027: the CyberArk anniversary, after which reported growth becomes comparable again.
Through fiscal 2027: progress toward more than 4,000 platformizations by fiscal 2030, and the $20 billion security ARR ambition for the same year.
Fiscal 2028: the 40% adjusted free cash flow margin target, which is the single number our base case leans on hardest.
Sources and disclosures
Every company figure in this report comes from Palo Alto Networks's own filings and results releases, linked below. The analysis, model and price target are Haverhill Financial Research's own work.
Disclosures. Haverhill Financial Research is a publisher of general financial commentary. This report is not personalized investment advice and does not consider any reader's financial situation; readers should do their own research. Price targets are estimates of value, not guarantees. Haverhill ratings follow our published bands: Buy when our 12-month target is at least 15% above the price, Sell when it is at least 15% below, Hold in between. The author of this post does not hold a position in Palo Alto Networks. Price data as of the Nasdaq close on October 23, 2026.
