Palo Alto Networks FY2026 Q4 Earnings: CyberArk on the Balance Sheet and $9.10B of NGS ARR

Palo Alto Networks closed fiscal 2026 with a quarter that only an acquisition year can produce: $3.41 billion of quarterly revenue (+34%) and $9.10 billion of Next-Generation Security ARR (+63%) in the first full quarter after closing CyberArk, while remaining performance obligations grew 34% to $21.2 billion. The income statement still looks like a subscription company. The balance sheet does not — goodwill jumped from $4.57 billion to $22.01 billion, intangibles from $0.76 billion to $7.02 billion, and common stock and APIC from $5.29 billion to $24.77 billion. This post reads the FY2026 10-K and the Q4 IR release through an auditable Beancount ledger so those three stories — ARR, RPO/deferred revenue, and the CyberArk purchase-price allocation — cannot disagree, and so the deferred-revenue peer table lines up with CrowdStrike and Zscaler.

The Headline Numbers​

Q4 is the story investors traded on September 1; the annual is what the ledger models (conventions fold a lone Q4 into the 10-K year). The first table is fiscal 2026 annual — the same totals as the Beancount fence. The second table is the Q4 IR print.

The annual table is the one the ledger's FY2026 income-statement transaction must match exactly: revenue $11,480M, cost of revenue $3,403M, operating expenses that leave $695M of operating income, and $307M of net income after a $159M other-expense line and $229M of tax. Q4's GAAP loss is real — fair-value marks on CyberArk's convertible notes and acquisition amortization hit the quarter hard — but it sits inside a year that still printed positive GAAP net income.

Two deltas matter more than the headline growth rate. First, subscription and support is now 80.1% of annual revenue ($9.20B of $11.48B), so the company is already a recurring-revenue business before CyberArk's identity ARR is fully lapped. Second, NGS ARR grew 63% while total revenue grew 24%: the operating metric is running ahead of recognized revenue because CyberArk's contracted base entered the ARR definition faster than it will amortize through the income statement.

Revenue Deep Dive​

Palo Alto reports product versus subscription and support — not the CrowdStrike-style module cut — so the mix is the thesis:

Subscription and support ($9.20B, +24% annual; $2.67B, +36% in Q4). This is where CyberArk, Chronosphere, and the organic platform land. Chairman and CEO Nikesh Arora's Q4 framing was explicit about the ARR engine: "We delivered a strong Q4 to close out the year, adding nearly $1 billion of Net New NGS ARR in a single quarter." That sentence is a demand signal — robust, broad-based bookings into the Next-Generation Security portfolio — and the ledger confirms the balance-sheet residue of those bookings: current deferred revenue $7,747M and noncurrent deferred revenue $7,009M at July 31, 2026.

Product ($2.28B, +27% annual; $738M, +29% in Q4). Hardware and appliance sales still grow, but they are no longer the company. Product is 19.9% of FY2026 revenue. The strategic language in the FY2026 10-K is about collapsing point products into platforms, not about shipping more boxes: "Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster, and cost-effective outcomes." Platformization is market-expansion language — consolidate the customer's stack, expand wallet share — and the subscription mix is the financial proof that the strategy is already winning the revenue mix even before CyberArk is fully annualized.

What the release does not say. There is no "demand exceeds supply," no "sold out," no sustained ASP increase claim in the Q4 IR release. The bullish wording is ARR, RPO, and platformization — bookings and architecture — not scarcity pricing. That absence matters: this is a software-and-subscription story, not a constrained-hardware cycle.

The Margin Story​

GAAP margins compressed for mechanical reasons the 10-K and non-GAAP bridge both name:

Gross margin fell about three points as subscription cost of revenue absorbed CyberArk-related amortization and cloud delivery costs (subscription and support COR $2,835M versus $2,038M). Operating margin halved because sales and marketing rose to $3,931M, R&D to $2,552M, and G&A to $899M — acquisition integration, replacement awards, and a larger go-to-market footprint. Net margin collapsed further on a $159M other-expense line that includes fair-value changes on convertible notes acquired with CyberArk.

The non-GAAP bridge in the IR release is the company's preferred lens: non-GAAP operating income $3,356M for the year versus GAAP $695M, after adding back $1,712M of share-based compensation, $638M of acquired-intangible amortization, and $295M of acquisition-related costs. That bridge does not invent growth — NGS ARR and RPO are the growth — but it does show how much of the GAAP margin compression is purchase accounting rather than unit economics of the organic franchise.

FY2024's 32.1% net margin was a one-time tax-benefit year ($1.59B tax benefit). Comparing FY2026's 2.7% to that peak is the wrong chart. The honest comparison is FY2025's 12.3% to FY2026's 2.7% under CyberArk's amortization and mark-to-market load.

The One Big Question: What Did CyberArk Do to the Balance Sheet?​

CyberArk closed on February 11, 2026. The FY2026 10-K's business-combinations note is the purchase-price allocation:

The ledger's FY2026 balance assertions are the post-allocation ending balances, not a fixed-ratio sketch:

• Assets:NonCurrent:Goodwill 22,010 MUSD (was 4,567 at FY2025)
• Assets:NonCurrent:IntangibleAssets 7,017 MUSD (was 763)
• Equity:CommonStockAndAPIC 24,772 MUSD (was 5,292) — the $18.5B stock consideration plus other equity activity
• Liabilities:NonCurrent:LongTermDebt 1,774 MUSD — convertible notes, largely the CyberArk notes that survived conversion

Goodwill's year-over-year delta is +$17,443M. The note's acquired goodwill for CyberArk ($14,802M), Chronosphere ($2,364M), and Koi ($169M) sums to $17,335M; the remaining $108M is measurement-period and other acquisition adjustments called out in the ledger banner. Intangibles' delta of +$6,254M is the $6,879M of acquired intangibles across those deals net of FY2026 amortization. If those two reconciliations did not close, the balance sheet would be fiction — they close, so the CyberArk story is in the numbers, not just in the press release.

Funding was overwhelmingly equity, not new cash leverage: $18.5B of the $21.1B consideration was stock. Cash still fell only modestly relative to the deal size because CyberArk brought $743M of cash and $1,217M of investments onto the sheet. The "One Big Question" for FY2027 is whether identity ARR converts into Palo Alto's NGS ARR definition and subscription revenue fast enough to justify a goodwill balance that is now 45% of total assets.

Deferred Revenue and RPO: The Security Peer Set​

Three July 31, 2026 (or nearest reported) prints — the same columns every post in this peer set uses:

Palo Alto's deferred-revenue stock is in a different league: $7.75B current plus $7.01B noncurrent on the FY2026 balance sheet. RPO at $21.2B is what the IR release meant by "Remaining performance obligations grew 34% year over year to $21.2 billion" — contracted backlog, not a non-GAAP invention. Relative to NGS ARR, Palo Alto carries more prepaid and multi-year obligation mass than either peer, which is exactly what a platform-plus-acquisition compounder should show: CyberArk's assumed deferred revenue ($776M in the PPA) plus organic billings piled onto an already large subscription base.

CrowdStrike's $10.7B RPO against $5.84B ARR is the high-growth endpoint-security shape. Zscaler's $7.4B RPO against $3.77B ARR is the pure-play SASE shape. Line for line, Palo Alto is the balance-sheet heavyweight of the trio — and goodwill is why.

Tracking a $48B Balance Sheet in Plain Text​

Double-entry forces every dollar of the CyberArk deal to land somewhere: cash out or stock issued, goodwill and intangibles up, deferred revenue and convert notes assumed. That is why we model every company the same way — see how we model every company. Signs follow Beancount convention (income credits negative, expenses debits positive); the Equity:Adjustments leg absorbs net income so the transaction sums to zero while retained earnings are set by the balance-sheet assertion.

; Check: −11,480 + 3,403 + 2,552 + 4,830 + 159 + 229 + 307 = 0 ✓
2026-07-31 * "Palo Alto Networks, Inc." "FY2026 Income Statement"
  Income:Revenue                         -11480 MUSD
  Expenses:CostOfRevenue                   3403 MUSD
  Expenses:ResearchAndDevelopment          2552 MUSD
  Expenses:SellingGeneralAdministrative    4830 MUSD
  Expenses:OtherNet                         159 MUSD  ; other income (expense), net
  Expenses:IncomeTax                        229 MUSD
  Equity:Adjustments                        307 MUSD  ; net income offset (RE set by balance assertion)

The balance-sheet number that carries the narrative is goodwill: 4,567 → 22,010 MUSD in one fiscal year, with the PPA math in the FY2026 file banner. Deferred revenue's twin lines — current and noncurrent — are the subscription counterweight to that goodwill story.

The Multi-Year Arc​

Five years turned a still-hardware-tinged security vendor into a platform company, then into an identity-plus-network platform via CyberArk. Deferred revenue roughly doubled; goodwill grew eightfold in a single year. Revenue compounding at a mid-teens-to-twenties rate was never the scarce resource — balance-sheet capacity to absorb a $21B identity acquisition was.

The Verdict: Bull vs. Bear​

Bull Case

• NGS ARR at $9.10B (+63%) with nearly $1B of net new NGS ARR in Q4 alone, per Arora's IR quote — the bookings engine is accelerating into FY2027 guidance of $11.075–$11.175B NGS ARR.
• RPO of $21.2B (+34%) and $14.76B of deferred revenue give multi-year visibility that peers cannot match at this scale.
• Platformization is written into the 10-K strategy and already visible in an 80% subscription mix.
• CyberArk was funded primarily with stock ($18.5B of $21.1B), preserving a $7.9B cash-and-investments stack rather than loading the capital structure with acquisition debt.
• Free cash flow of $4.11B ($4.55B operating cash less $440M of purchases) shows the organic franchise still throws off cash while integrating.

Bear Case

• GAAP operating margin at 6.1% and net margin at 2.7% are not yet earning the $22B goodwill balance; the non-GAAP bridge is doing a lot of work.
• Q4's $(282)M GAAP net loss — driven by convertible-note fair-value marks and acquisition amortization — can repeat whenever those marks move.
• The release does not claim pricing power or supply-constrained demand; growth is volume and mix, which is harder to defend if enterprise security budgets slow.
• Goodwill is 45% of total assets — impairment risk is now a permanent footnote if identity synergies disappoint.
• FY2027 revenue guidance ($14.10–$14.20B, +23–24%) decelerates from Q4's 34% print as CyberArk anniversary effects normalize.

Our Take: FY2026 is the year Palo Alto stopped being comparable to a pure-play endpoint or SASE vendor on the balance sheet. The bull case on NGS ARR and RPO is intact and quantified. The bear case on GAAP profitability is equally quantified. Own the stock only if you believe identity ARR compounds inside the NGS definition faster than $14.8B of CyberArk goodwill amortizes through the P&L — the ledger will show which side is winning every July 31.