Palo Alto Networks (PANW)
Integrated cybersecurity platforms spanning networks, cloud, security operations, AI, observability, and identity.
Something off on this page? Send us feedback.
Palo Alto Networks sells the tools big organizations use to keep intruders out of networks, cloud systems and employee accounts. Firewalls and remote-access protection still carry most of the business, while security operations, identity and system monitoring are expanding through new products and large acquisitions. Long contracts make repeat payments the engine, but the enlarged portfolio must prove it can fit together.
Item facts: FY2026 · year ended Jul 31, 2026, from filings, earnings calls and company pages.
Judgment weights, not filed revenue
The band summarizes business focus and direction. ~ marks estimates.
8 in detail · 11 more below
ML-Powered Next-Generation Firewalls and Cloud-Delivered Security Services
Physical and software firewalls inspect traffic, while paid services keep blocking new threats. Hardware alone was about a tenth of company revenue; the larger business is the protection and support attached to it.
Competes with FortiGate NGFW (Fortinet) · Quantum Security Gateways (Check Point)
In plain English
Picture the guarded entrance to a busy warehouse. Palo Alto's firewalls are the checkpoint: physical boxes or software that inspect digital traffic and decide what may enter a company's network. Added services keep their lists of dangerous sites and attacks current.
Businesses and public agencies usually buy through a reseller. They pay for the gate first, then keep paying for threat blocking, updates and help, often under contracts lasting several years. That installed base makes this the dependable core whose repeat payments fund expansion into newer kinds of security.
Prisma SASE
A subscription checkpoint for employees and branch offices reaching company systems from anywhere. Annual subscription value passed $1.6B and grew 40%; the test is turning big contract wins into durable renewals.
Competes with Zero Trust Exchange (Zscaler) · Netskope One SASE (Netskope)
In plain English
A worker can be at headquarters, at home or in a small branch and still need the same safe route to company systems. Prisma SASE moves the checkpoint away from one office building and delivers it through nearby data centers, while also choosing an efficient route for each connection.
Large organizations pay by user, device or the amount of service they need. They keep paying because every remote connection must be checked and slow access frustrates workers. The attraction is replacing several separate access and networking tools with one subscription; service quality depends on having enough well-placed computing capacity.
Platformization Customer Programs
Customers replace separate security tools with several Palo Alto platforms under one larger agreement. Those promised purchases give the company a head start, but renewals and fresh deals must keep refilling the pipeline.
Competes with Sentinel plus Defender for Cloud (Microsoft) · FortiGate plus subscriptions (Fortinet)
In plain English
One broad contract replaces a jumble of separate security purchases. Palo Alto calls this platformization: a company adopts two or more of its main platforms, giving the buyer fewer tools to connect and the seller a larger, harder-to-replace relationship.
The customer commits money under a contract, but Palo Alto collects it over time as products and services are delivered. The amount still scheduled is a strong head start, not cash already earned. Its value depends on successful migrations, smooth cooperation among the products and customers continuing to renew.
Prisma AIRS
Protection for the AI systems companies are starting to build and use. Annual subscription value passed $100M, fast progress from a small base; demand must outlast the first rush to secure AI projects.
Competes with Cisco AI Defense (Cisco) · AI Security Platform (HiddenLayer)
In plain English
The new, small bet. Prisma AIRS checks the computer models behind AI tools, deliberately tests them for weak spots and watches what they do after launch. It also stands between an AI application and the outside model it calls, so risky requests or leaked information can be stopped.
Companies pay for a continuing service because their AI tools and the attacks against them keep changing. Acquired teams Koi and Portkey add checks on AI programs running on employee devices and on the gateways carrying requests. More AI use creates more activity to protect, but this is still tiny beside Palo Alto's firewall business.
Cortex Security Operations
Software that gathers security alarms, investigates them and automates the response. XSIAM's annual subscription value exceeded $700M; its promise rests on finding real attacks quickly without overwhelming security teams.
Competes with Microsoft Sentinel (Microsoft) · Falcon Next-Gen SIEM (CrowdStrike)
In plain English
Security teams can drown in alarms from laptops, servers and cloud systems. Cortex gathers those signals in one place, connects clues that belong to the same incident and can automatically take routine steps such as isolating a compromised machine. It is a sorting room for digital emergencies.
Organizations pay a continuing fee for the software, usually based on the people, devices or computing capacity covered. They keep it because the history of past activity helps investigations and replacing the workflows is disruptive. The system is only as useful as the outside data it can collect promptly and make consistent.
Cortex Cloud
Cloud protection that follows an application from its building plans into daily operation. It is replacing Prisma Cloud, and the customer move was still unfinished; smooth migration matters as much as new sales.
Competes with Wiz Cloud Security Platform (Wiz) · Microsoft Defender for Cloud (Microsoft)
In plain English
Before a company puts new software online, Cortex Cloud looks for unsafe settings and weaknesses in the building instructions. After launch, it watches the running application for attacks and sends problems back to the people who can fix them. Think of one inspector following a building from blueprint review through everyday occupancy.
Companies subscribe because they constantly release software across rented computing systems and need one view of the risks. Palo Alto earns as more applications are covered. The immediate task is moving existing Prisma Cloud customers onto Cortex Cloud without leaving gaps or asking developers to rebuild their routines.
Idira
CyberArk-based controls over who—or what software—may use powerful company accounts and passwords. Management expects about $1.5B of FY2027 revenue; the challenge is joining the acquired identity tools with the wider portfolio.
Competes with Secret Server (Delinea) · Password Safe (BeyondTrust)
In plain English
Every powerful company account is a master key: an administrator, machine or AI helper holding one can reach sensitive systems. Idira discovers those keys, stores important passwords safely, limits when they can be used and records what happens. CyberArk, acquired during the year, forms its center.
Businesses pay subscriptions to manage these high-risk identities because employees, software and automated helpers change constantly. The service becomes harder to remove as it connects to more company directories and applications. Growth depends on those connections working broadly and on Palo Alto fitting the acquired products into its other defenses without disrupting customers.
Chronosphere Observability
Monitoring that shows why an online service is slow or broken while controlling the flood of machine activity records. By September 2026, annual subscription value topped $500M; broader readiness still needed work.
Competes with Datadog Observability Platform (Datadog) · Dynatrace Platform (Dynatrace)
In plain English
When an online service slows down, Chronosphere helps its operator trace the problem through the many computers underneath it. It gathers streams of machine activity, keeps the useful parts and shows engineers where reliability is breaking. The closest everyday picture is a building's control room, watching pressure and temperature across every floor.
Companies subscribe according to the scale of the systems and data they monitor. They keep paying because outages are costly and years of accumulated setup shape how teams work. Palo Alto bought Chronosphere during the year and is connecting it to Cortex; the opportunity is growing quickly, but storing too much activity can make the service expensive.
ML-Powered Next-Generation Firewalls and Cloud-Delivered Security ServicesPhysical and software firewalls inspect traffic, while paid services keep blocking new threats. Hardware alone was about a tenth of company revenue; the larger business is the protection and support attached to it.Physical and software firewalls inspect traffic, while paid services keep blocking new threats. Hardware alone was about a tenth of company revenue; the larger business is the protection and support attached to it.
In plain English
Picture the guarded entrance to a busy warehouse. Palo Alto's firewalls are the checkpoint: physical boxes or software that inspect digital traffic and decide what may enter a company's network. Added services keep their lists of dangerous sites and attacks current.
Businesses and public agencies usually buy through a reseller. They pay for the gate first, then keep paying for threat blocking, updates and help, often under contracts lasting several years. That installed base makes this the dependable core whose repeat payments fund expansion into newer kinds of security.
Competes with FortiGate NGFW (Fortinet) · Quantum Security Gateways (Check Point)
Prisma SASEA subscription checkpoint for employees and branch offices reaching company systems from anywhere. Annual subscription value passed $1.6B and grew 40%; the test is turning big contract wins into durable renewals.A subscription checkpoint for employees and branch offices reaching company systems from anywhere. Annual subscription value passed $1.6B and grew 40%; the test is turning big contract wins into durable renewals.
In plain English
A worker can be at headquarters, at home or in a small branch and still need the same safe route to company systems. Prisma SASE moves the checkpoint away from one office building and delivers it through nearby data centers, while also choosing an efficient route for each connection.
Large organizations pay by user, device or the amount of service they need. They keep paying because every remote connection must be checked and slow access frustrates workers. The attraction is replacing several separate access and networking tools with one subscription; service quality depends on having enough well-placed computing capacity.
Competes with Zero Trust Exchange (Zscaler) · Netskope One SASE (Netskope)
Platformization Customer ProgramsCustomers replace separate security tools with several Palo Alto platforms under one larger agreement. Those promised purchases give the company a head start, but renewals and fresh deals must keep refilling the pipeline.Customers replace separate security tools with several Palo Alto platforms under one larger agreement. Those promised purchases give the company a head start, but renewals and fresh deals must keep refilling the pipeline.
In plain English
One broad contract replaces a jumble of separate security purchases. Palo Alto calls this platformization: a company adopts two or more of its main platforms, giving the buyer fewer tools to connect and the seller a larger, harder-to-replace relationship.
The customer commits money under a contract, but Palo Alto collects it over time as products and services are delivered. The amount still scheduled is a strong head start, not cash already earned. Its value depends on successful migrations, smooth cooperation among the products and customers continuing to renew.
Competes with Sentinel plus Defender for Cloud (Microsoft) · FortiGate plus subscriptions (Fortinet)
Prisma AIRSProtection for the AI systems companies are starting to build and use. Annual subscription value passed $100M, fast progress from a small base; demand must outlast the first rush to secure AI projects.Protection for the AI systems companies are starting to build and use. Annual subscription value passed $100M, fast progress from a small base; demand must outlast the first rush to secure AI projects.
In plain English
The new, small bet. Prisma AIRS checks the computer models behind AI tools, deliberately tests them for weak spots and watches what they do after launch. It also stands between an AI application and the outside model it calls, so risky requests or leaked information can be stopped.
Companies pay for a continuing service because their AI tools and the attacks against them keep changing. Acquired teams Koi and Portkey add checks on AI programs running on employee devices and on the gateways carrying requests. More AI use creates more activity to protect, but this is still tiny beside Palo Alto's firewall business.
Competes with Cisco AI Defense (Cisco) · AI Security Platform (HiddenLayer)
Cortex Security OperationsSoftware that gathers security alarms, investigates them and automates the response. XSIAM's annual subscription value exceeded $700M; its promise rests on finding real attacks quickly without overwhelming security teams.Software that gathers security alarms, investigates them and automates the response. XSIAM's annual subscription value exceeded $700M; its promise rests on finding real attacks quickly without overwhelming security teams.
In plain English
Security teams can drown in alarms from laptops, servers and cloud systems. Cortex gathers those signals in one place, connects clues that belong to the same incident and can automatically take routine steps such as isolating a compromised machine. It is a sorting room for digital emergencies.
Organizations pay a continuing fee for the software, usually based on the people, devices or computing capacity covered. They keep it because the history of past activity helps investigations and replacing the workflows is disruptive. The system is only as useful as the outside data it can collect promptly and make consistent.
Competes with Microsoft Sentinel (Microsoft) · Falcon Next-Gen SIEM (CrowdStrike)
Cortex CloudCloud protection that follows an application from its building plans into daily operation. It is replacing Prisma Cloud, and the customer move was still unfinished; smooth migration matters as much as new sales.Cloud protection that follows an application from its building plans into daily operation. It is replacing Prisma Cloud, and the customer move was still unfinished; smooth migration matters as much as new sales.
In plain English
Before a company puts new software online, Cortex Cloud looks for unsafe settings and weaknesses in the building instructions. After launch, it watches the running application for attacks and sends problems back to the people who can fix them. Think of one inspector following a building from blueprint review through everyday occupancy.
Companies subscribe because they constantly release software across rented computing systems and need one view of the risks. Palo Alto earns as more applications are covered. The immediate task is moving existing Prisma Cloud customers onto Cortex Cloud without leaving gaps or asking developers to rebuild their routines.
Competes with Wiz Cloud Security Platform (Wiz) · Microsoft Defender for Cloud (Microsoft)
IdiraCyberArk-based controls over who—or what software—may use powerful company accounts and passwords. Management expects about $1.5B of FY2027 revenue; the challenge is joining the acquired identity tools with the wider portfolio.CyberArk-based controls over who—or what software—may use powerful company accounts and passwords. Management expects about $1.5B of FY2027 revenue; the challenge is joining the acquired identity tools with the wider portfolio.
In plain English
Every powerful company account is a master key: an administrator, machine or AI helper holding one can reach sensitive systems. Idira discovers those keys, stores important passwords safely, limits when they can be used and records what happens. CyberArk, acquired during the year, forms its center.
Businesses pay subscriptions to manage these high-risk identities because employees, software and automated helpers change constantly. The service becomes harder to remove as it connects to more company directories and applications. Growth depends on those connections working broadly and on Palo Alto fitting the acquired products into its other defenses without disrupting customers.
Competes with Secret Server (Delinea) · Password Safe (BeyondTrust)
Chronosphere ObservabilityMonitoring that shows why an online service is slow or broken while controlling the flood of machine activity records. By September 2026, annual subscription value topped $500M; broader readiness still needed work.Monitoring that shows why an online service is slow or broken while controlling the flood of machine activity records. By September 2026, annual subscription value topped $500M; broader readiness still needed work.
In plain English
When an online service slows down, Chronosphere helps its operator trace the problem through the many computers underneath it. It gathers streams of machine activity, keeps the useful parts and shows engineers where reliability is breaking. The closest everyday picture is a building's control room, watching pressure and temperature across every floor.
Companies subscribe according to the scale of the systems and data they monitor. They keep paying because outages are costly and years of accumulated setup shape how teams work. Palo Alto bought Chronosphere during the year and is connecting it to Cortex; the opportunity is growing quickly, but storing too much activity can make the service expensive.
Competes with Datadog Observability Platform (Datadog) · Dynatrace Platform (Dynatrace)
Named in filings, launches and programs
- Next-Generation Trust SecurityProduct lineCertificate-lifecycle and related trust controls contributed about $85M in FY2026.
- Unit 42ServiceAttack response, threat research and consulting that also improve the warnings built into Palo Alto's products.
- Prisma Access BrowserProduct · RampingA protected work browser inside Prisma SASE, with 11M licenses by FY2026's third quarter.
- Strata Cloud Manager and PanoramaPlatformCentral control rooms for managing physical, software and cloud-based network defenses.
- Koi Agentic Endpoint SecurityBrandAcquired technology that checks AI programs operating on employee devices; now part of the broader AI-security push.
- Portkey AI GatewayBrandAcquired gateway and monitoring technology that watches requests traveling between applications and outside AI models.
- Embrace Real User Monitoring and SyntheticsProduct line · AnnouncedPlanned addition for checking how mobile and web services behave for real users and in automated tests; closing was not established.
- Console Security Data FabricBrandAcquired pipeline that prepares and moves security activity records into Cortex for analysis.
- NextWave Partner ProgramEcosystemReseller network behind nearly every sale; three unnamed distributors handled 44.2% of FY2025 revenue, while no end buyer exceeded one tenth.
- NTT DATA Secure AI Transformation AllianceEcosystemJoint selling and service work aimed at $1B of business by 2029; that target is not guaranteed Palo Alto revenue.
- Google Cloud Strategic Agreement and MarketplaceEcosystemA co-selling route after more than $2B of marketplace sales, paired with Palo Alto's multibillion-dollar cloud-spending commitment.
Next-Generation Trust SecurityProduct line
Certificate-lifecycle and related trust controls contributed about $85M in FY2026.
Unit 42Service
Attack response, threat research and consulting that also improve the warnings built into Palo Alto's products.
Prisma Access BrowserProduct · Ramping
A protected work browser inside Prisma SASE, with 11M licenses by FY2026's third quarter.
Strata Cloud Manager and PanoramaPlatform
Central control rooms for managing physical, software and cloud-based network defenses.
Koi Agentic Endpoint SecurityBrand
Acquired technology that checks AI programs operating on employee devices; now part of the broader AI-security push.
Portkey AI GatewayBrand
Acquired gateway and monitoring technology that watches requests traveling between applications and outside AI models.
Embrace Real User Monitoring and SyntheticsProduct line · Announced
Planned addition for checking how mobile and web services behave for real users and in automated tests; closing was not established.
Console Security Data FabricBrand
Acquired pipeline that prepares and moves security activity records into Cortex for analysis.
NextWave Partner ProgramEcosystem
Reseller network behind nearly every sale; three unnamed distributors handled 44.2% of FY2025 revenue, while no end buyer exceeded one tenth.
NTT DATA Secure AI Transformation AllianceEcosystem
Joint selling and service work aimed at $1B of business by 2029; that target is not guaranteed Palo Alto revenue.
Google Cloud Strategic Agreement and MarketplaceEcosystem
A co-selling route after more than $2B of marketplace sales, paired with Palo Alto's multibillion-dollar cloud-spending commitment.