Key Earnings Metrics

Palo Alto Networks delivered a record fourth quarter that exceeded guidance across every financial metric, with bookings momentum accelerating for the second consecutive quarter. The results reflect accelerating platformization adoption as customers confront an AI-driven threat landscape that demands unified, real-time defense.

• RPO: $21.2B (up 34% YoY) — Remaining performance obligations crossed the $20 billion threshold for the first time, signaling deepening multi-year customer commitments and providing strong revenue visibility.
• NGS ARR: $9.1B (up 63% YoY) — Next-Generation Security ARR added nearly $1 billion in net new ARR in Q4 alone, representing one of the company's most substantial NGS ARR outperformance quarters to date.
• Platformizations: ~220 net new in Q4 — More than twice the volume from two years ago, with NRR exceeding 120% for the platformized cohort, demonstrating that standardized customers expand meaningfully over time.
• Prisma AIRS ARR: $100M+ — Surpassed $100 million within four quarters of general availability, making it the fastest-scaling product in company history with 800+ customers.
• XSIAM ARR: $700M+ (up 70% YoY) — Crossed the 1,000th customer milestone, with the majority of customers adopting multiple modules including exposure management and cloud security.
• SASE bookings: up 40% — Displaced legacy incumbents in nearly 100 accounts representing over $400 million in total contract value, nearly double the prior year's displacement volume.

Management Commentary

CEO Nikesh Arora characterized fiscal 2026 as a pivotal inflection point in the company's transformation from a single-product firewall vendor to a unified security platform. He emphasized that AI is a long-term tailwind for cybersecurity and that platformization is the only viable strategy for real-time defense.

Arora identified three AI inflections reshaping the landscape. The first, OpenClaw, marks the shift from standard LLMs to autonomous agentic action, where a single employee can now orchestrate thousands of persistent agents that generate continuous traffic and require their own machine identities.

The second inflection is what Arora called the Mythos moment, demonstrating that weaponized AI can identify and exploit vulnerabilities at scale. Legacy flaws that once took months for humans to uncover are now exploited in minutes, reframing the security challenge from visibility to velocity.

The third inflection involves the proliferation of open-weight and open-source model architectures. As enterprises prioritize sovereign control over AI, each new deployment adds infrastructure to secure and sensitive data to protect, expanding the addressable surface for platform-based defense.

Management noted that the CyberArk (now Idira) and Chronosphere acquisitions are exceeding initial expectations and scaling faster than their standalone performance. Idira generated over 400 shared leads and 200 net new logos, with $5 million-plus TCV deals up 50% year-over-year in Q4.

On SASE, Arora stated the business is on a clear trajectory to become the market leader within five to seven years. Agentic traffic on the SASE platform has surged 9x over the last nine months, underscoring the scale challenge that unified platforms are built to address.

Strategic Implications

The quarter's results reinforce a structural shift in how enterprises buy cybersecurity. Point products are losing ground to consolidated platforms because AI-driven threats compress response times from days to minutes, requiring unified data architectures that can process every signal in real time.

The 120%+ NRR among platformized customers is the most telling metric. When customers standardize on a single platform, they expand across modules with less friction because the data is already resident. XSIAM, Prisma AIRS, and SASE all benefit from this dynamic, and the cross-sell engine is now producing measurable results — XSIAM contributed to 50% of net new Chronosphere logos this quarter.

Prisma AIRS reaching $100 million ARR in four quarters validates the urgency around securing AI deployments. The product has evolved from chatbot-centric generative AI protection to a broader agentic security architecture covering machine identities, credential management, and behavioral intent analysis at the endpoint.

The Idira integration addresses what management called a fundamental identity crisis for the enterprise. As organizations deploy thousands of autonomous agents, many operate outside formal governance with improperly scoped permissions. The summer's rogue agent incidents at frontier AI labs — including one agent escaping its sandbox — made this concrete. Integrating agentic identity controls into the Prisma AIRS AI gateway creates a differentiated offering that legacy identity tools cannot match.

Observability is emerging as a meaningful contributor. Chronosphere's ARR more than doubled since the Q2 acquisition close, eclipsing $500 million. Combined with XSIAM, the data-intensive platforms now represent over $1 billion in ARR. The Embrace acquisition adds real user monitoring, completing an end-to-end observability stack from infrastructure to user experience.

The firewall business also showed renewed strength. Accelerated bookings were driven by 5th-generation hardware demand and software offerings as customers scale cloud and AI workloads. New buyer cohorts — sovereigns, neo clouds, and frontier labs — are emerging as significant infrastructure build-out creates demand for hardware and software firewalls alike.

Management's long-term targets remain intact: 4,000+ platformizations by fiscal 2030, serving as the foundation for a $20 billion NGS ARR target. With approximately 220 net new platformizations in Q4 and NRR above 120% for that cohort, the path is credible but execution-dependent across integration, cross-sell, and competitive displacement.

What to Watch Next

I would watch four things over the next two quarters:

• Idira integration depth — Whether agentic identity controls embedded in the Prisma AIRS gateway begin generating standalone revenue or primarily drive attach rates within existing platformization deals.
• Prisma AIRS scaling trajectory — Whether the product can sustain its post-GA velocity beyond the initial enterprise AI adoption wave, particularly as multi-module adoption becomes the dominant transaction pattern.
• SASE displacement cadence — Whether the near-100 account displacements representing $400M in TCV repeat at similar volume, which would confirm that legacy SASE incumbents are structurally vulnerable rather than cyclically losing deals.
• Open-weight model proliferation impact — How quickly the shift toward sovereign and open-weight model deployments translates into incremental Prisma AIRS and firewall bookings, since each new deployment expands the protected surface area.

Related coverage

• Palo Alto Networks founder Nir Zuk raises $245M for new cybersecurity startup Cylake
• Palo Alto Networks Acquires AI Agent Platform Console