Palo Alto Networks Q4 FY2026 Earnings — The First FY2027 Guide, and Whether GAAP Profit Survives a Second Full Quarter of CyberArk
The Call
The Q4 FY2026 print itself is close to de-risked — guidance and consensus already converge on both revenue and EPS, and the Street has openly called it 'a formality.' The two things that actually move the stock are (1) whether GAAP operating income crosses back to (barely) positive in the second full quarter absorbing CyberArk integration costs, since management's 'ahead of schedule' framing implies the SBC/amortization/acquisition-cost bridge that produced Q3's -$177M net loss should now be shrinking as a share of a scaling revenue base, and (2) the first-ever FY2027 guide, where the Street's own ~22.1% NGS ARR growth threshold is the line the bull case needs cleared and the bear case needs missed. Both are genuinely open questions this pipeline has no strong prior on: the GAAP bridge has exactly one prior quarter to extrapolate from, and the FY2027 guide has zero precedent quarters at all.
| Metric | Our Estimate | Company Guidance | Consensus | Actual | Error | vs Cons. |
|---|---|---|---|---|---|---|
| RevenueGAAP +13.8% QoQ vs Q3 FY2026's $3,002M. Applies Q3's +2.0% blind guide-beat to the Q4 guide midpoint. | 3417 USD M | 3345-3355 USD M | 3350 USD M | 3410 USD M | +0.21% | 8.6× |
| Gross profitGAAP Revenue x 68.3% GAAP gross margin estimate. | 2334 USD M | — | — | 2304 USD M | +1.30% | — |
| Gross marginGAAP Modest sequential improvement from Q3's 67.56% actual, not a return to the pre-CyberArk ~73-74% level. | 68.3% | — | — | 67.57% | +1.09% | — |
| Operating profitGAAP The single most consequential line in this ladder: non-GAAP operating income estimate ($991M, revenue x 29.0%) less the $965M combined SBC/amortization/acquisition-cost bridge estimate. A swing of roughly +/-$100M in either the non-GAAP margin or the bridge-cost decay assumption flips this line's sign. | 25 USD M | — | — | 172 USD M | -85.47% | — |
| Operating marginGAAP Versus Q3 FY2026's -6.1% actual. A genuine, low-confidence call that GAAP operating income turns (barely) positive for the first time since before the CyberArk close. | 0.7% | — | — | 5.04% | -86.12% | — |
| Net incomeGAAP Operating profit plus an estimated +$5M net other-income/tax effect. | 30 USD M | — | — | -282 USD M | — | — |
| Diluted EPSGAAP Net income / ~835M estimated GAAP diluted shares (dilutive securities return to the count once net income turns positive). Versus Q3 FY2026's -$0.22 actual. See the non-GAAP diluted EPS businessMetric ($1.04 est vs ~$0.977 consensus) for the figure the market actually prices the print against. | 0.04 USD | — | — | -0.35 USD | — | — |
- → Revenue misses the $3,345M guide floor — would break the current beat streak and contradict the sell-side's 'formality' framing of this print.
- → GAAP operating income does not turn positive (i.e., remains clearly negative) — would mean the acquisition-related cost decay this forecast assumes is slower than management's 'ahead of schedule' language implied, and would push the '12-18 month convergence' timeline further out.
- → The combined SBC/amortization/acquisition-cost bridge runs materially above ~$1,000M (versus this forecast's $965M estimate) even if revenue and the non-GAAP margin land in line — this is the line with the least precedent behind it and the most room to be wrong independent of everything else in the ladder.
- → Initial FY2027 NGS ARR growth guide comes in below the Street's ~22.1% consensus threshold — described by sell-side coverage as the single biggest swing factor for the stock's reaction, sitting entirely outside this quarter's own arithmetic.
- → Platform-customer growth, net retention, and the XSIAM 800-customer threshold all fail to clear simultaneously — would validate the bear thesis's re-rate trigger even if the headline P&L beats guidance.
Behaviour model, not arithmetic, and deliberately very low confidence — this is PANW's first-ever post-CyberArk annual guide, so there is no prior 'initial guide vs. actual' pattern for this specific transition to extrapolate from. Two directional priors point the same way: (1) this pipeline's guidance calls have already come in low twice this cycle on other issuers (STX FQ1 FY2027 -9.3%, AMD Q3 2026 -3.1%), both understating management in an up-cycle; (2) PANW's own FY2026 guide has been raised at every checkpoint this fiscal year (cut in March on CyberArk-cost concerns, then raised at both the Q2 and Q3 calls), a demonstrated pattern of setting an initial number and beating it. Both priors argue the initial FY2027 guide should be read as a floor rather than a center. The NGS ARR growth line specifically is the one genuinely open two-sided question: it must decelerate sharply from FY2026's 59-60% simply because CyberArk's inorganic ARR contribution anniversaries out of the growth-rate math, and nothing in the evidence gathered here pins down where in the 20-24% range that deceleration actually lands.
Evidence (11)
Positioning Suggestions
→ The internal thesis's own probability-weighted expected return at the current anchor is negative (-7.2%, ~0.25:1 upside:downside) — the least favorable asymmetry logged for this name all cycle. Absent a clear FY2027 NGS ARR guide above the ~22.1% consensus threshold, this print is a setup to trim into strength rather than add, consistent with the thesis's existing HOLD-and-trim posture.
→ CrowdStrike's same-day beat-and-raise (2026-08-26) and Fortinet's prior beat-and-raise (2026-07-29) both leaned on consumption-bundling motions (Falcon Flex, FortiSASE) that directly compete with PANW's platformization pitch — watch whether PANW's own print shows any deceleration in platform-customer adds or XSIAM growth that would corroborate share loss rather than sector-wide health.
→ Cisco's Security/Splunk segment inflection (2026-08-19, first positive quarter after three quarters of integration drag) is the closest available comp for whether PANW's own CyberArk-drag-then-recovery narrative is plausible on the timeline management claims — if Cisco's drag took roughly a year to resolve, weigh that against PANW's 'ahead of schedule' framing with appropriate skepticism.
→ The China Cybersecurity Review Office review (opened 2026-08-06) remains unresolved and unquantified; size any position with the Micron 2023 precedent in mind as a tail scenario, not a base case, given PANW's bounded ~$1.10B JAPAC exposure.
Predictions
10PANW Q4 FY2026 revenue meets or exceeds the $3,350M guide midpoint
PANW Q4 FY2026 revenue exceeds $3,417M (a beat matching Q3 FY2026's +2.0% guide-beat cadence)
GAAP operating income prints positive for Q4 FY2026 (versus Q3's -$183M actual)
If confirmed, the CyberArk integration-cost drag is fading roughly on the schedule management claimed — supports staying long through the FY2027 guide reaction rather than trimming pre-print.
Non-GAAP diluted EPS meets or exceeds the $0.98 guide top
NGS ARR meets or exceeds the $8.95B guide top
Initial FY2027 NGS ARR growth guide comes in at or above 22% (the FactSet consensus threshold)
This is the single most consequential binary in the whole print — if confirmed above 22%, the bull case for further multiple expansion has fresh evidence; if it misses, expect a swift move toward the bear scenario's re-rate trigger regardless of how the Q4 numbers themselves land.
XSIAM customer count reaches 800 or more (the explicit bull-trigger threshold already logged in this company's monitoring watchlist)
Management quantifies CyberArk identity-ARR cross-sell with a specific dollar figure or percentage on the call (beyond a generic 'ahead of schedule' statement)
Management directly addresses Microsoft Agent 365's identity-bundling threat on the call
PANW stock moves more than 7% in either direction within 2 trading days of the earnings report
Key Questions
- Does GAAP operating income turn (barely) positive for the first time since before the CyberArk close, or does the SBC/amortization/acquisition-cost bridge stay large enough to keep GAAP results in the red?
- What is the initial FY2027 NGS ARR growth guide, and does it clear or miss the Street's ~22.1% consensus threshold?
- What is the initial FY2027 revenue and non-GAAP EPS guide, and does it read as a conservative floor (consistent with PANW's FY2026 raise-at-every-checkpoint pattern) or a genuine deceleration?
- Does management give any concrete update on CyberArk cross-sell attach (the >$500M-in-12-months bull trigger vs. <$200M bear-invalidation threshold), or continue with only qualitative 'ahead of schedule' language?
- Does platform customer count, net retention, and XSIAM customer count (740 as of Q3, 800 the explicit bull trigger) clear the thresholds this company's own thesis has already set?
- Does management address Microsoft Agent 365's identity-bundling threat directly, or continue to let the point pass without specific commentary?
- Is there any update on the China Cybersecurity Review Office review opened 2026-08-06, or does it remain an unresolved, unquantified tail risk?
Monitoring Checklist
Post-Event Results
Actual Outcomes
- • Q4 revenue was $3.410B, 1.79% above the $3.350B guide midpoint and $7M below the forecast. NGS ARR reached $9.10B and RPO $21.2B.
- • GAAP operating income recovered to $172M and a 5.0% margin, well above the forecast's barely-positive $25M/0.7% call. The comparable operating bridge was $836M versus the $965M estimate as acquisition-related costs fell to $68M.
- • GAAP net income still printed a $282M loss and diluted EPS was -$0.35. The apparent contradiction is below the operating line: a $441M other-expense line, principally fair-value movements on CyberArk convertible notes and capped calls, plus tax effects overwhelmed positive operating income.
- • Non-GAAP EPS was $1.02 and non-GAAP operating margin 29.6%. The EPS estimate was closer than consensus, but the model overstated EPS by 2.0% while understating the operating margin.
- • FY2027 guidance was revenue $14.10-14.20B, up 23%-24%; NGS ARR $11.075-11.175B, up 22%-23%; non-GAAP EPS $4.16-4.19; and adjusted FCF margin 38.0%. Revenue was materially above the pre-event range, EPS below it, and the NGS ARR threshold cleared.
- • The presentation reported approximately 2,500 platformizations with >120% net retention, approximately 1,000 XSIAM customers and >2.5x XSIAM ARR, plus >400 shared CyberArk leads and >200 CyberArk new-logo wins from the PANW installed base.
- • No official call transcript was obtainable: investors.paloaltonetworks.com was unreachable and the 8-K index lists only EX-99.1, with no prepared-remarks exhibit. The identity-ARR and Microsoft Agent 365 call-only cards were nonetheless settled on 2026-09-02 from a third-party transcript of unknown provenance, cross-checked against the issuer's own EX-99.1, which contains no occurrence of Microsoft, Agent 365, Entra or bundling. Management quantified CyberArk cross-sell only in counts (>400 shared leads, >200 new logos); the Idira figures given on the call are platform revenue, not identity ARR. PANW closed at $328.48 on 2026-09-02 against $362.09 on 2026-09-01, a 9.28% move that settled the two-day price card on the first of its two days.
Thesis Updates Needed
Trade Recommendations
→ The positive-GAAP-operating-income conditional fired, but it is not a standalone add signal: the FY2027 guide and target re-underwrite now govern position action.
→ The 22% NGS ARR threshold also fired and strengthens the operating bull case. The report does not recommend a fresh position change until the target framework clears its independent convergence gate and a post-print regular-session price exists.
→ All three cards held open for evidence settled on 2026-09-02, and none was scored on absent evidence: the two call-only cards resolved FALSE on transcript text rather than on the transcript's absence.