Palo Alto Networks (NASDAQ:PANW) reported what executives described as a “strong” fiscal second quarter of 2026, citing broad demand for cybersecurity products and continued progress on the company’s platformization strategy. On the earnings call, CEO Nikesh Arora said the quarter was driven by strength across SASE, software firewalls, and XSIAM, alongside early traction in AI security offerings such as Prisma AIRS.
Arora also highlighted improving profitability, noting the company delivered a 30%+ operating margin for the third consecutive quarter. CFO Dipak Golechha said non-GAAP operating margin for the quarter was 30.3%.
Platformization and the AI-driven security thesis
Against that backdrop, Arora said Palo Alto Networks added approximately 110 net new platformizations in Q2, described as a quarterly record outside of the seasonally strong Q4. He said the company’s total platformization count is about 1,550, up 35%, and that net retention among platformized customers stands at 119% with low single-digit churn.
Product highlights: SASE, browser security, software and hardware firewalls
In Network Security, management pointed to continued SASE momentum. Arora said the SASE business surpassed $1.5 billion in ARR and grew approximately 40% year over year. He described a market shift in which early SASE adopters from four to five years ago are reassessing “first-generation point products” in favor of a more unified platform approach.
Executives also emphasized the role of browser security. Arora said the company’s secure browser product (Prisma Browser, following the Talon acquisition) had been adopted by over 1,500 customers as of Q2, with 10% in the Global 2,000. He added that the company sold an additional 2 million browser licenses in Q2, bringing cumulative licenses sold to more than 9 million.
Software firewalls were another area of strength. Arora said Software Firewall ARR grew approximately 25% in Q2, tied to demand for securing “dynamic multi-cloud environments,” particularly as AI workloads scale. On hardware, he said Palo Alto Networks delivered its strongest hardware performance in several quarters, with revenue up nearly 10% driven in part by early adoption of Gen 5 firewalls.
Cortex, XSIAM, and expanding AI security capabilities
Arora said customers continued to modernize security operations using the company’s Cortex platform. He said XSIAM surpassed $500 million in ARR, adding nearly 150 new customers during the quarter, bringing the total base to over 600 customers. Arora said the average ARR per XSIAM customer is nearly $1 million and that more than 60% of deployed customers are achieving mean time remediation of less than 10 minutes.
Arora also discussed Cortex AgentiX, which he described as enabling customers to build “a workforce of autonomous AI agents” that can extend beyond Palo Alto Networks’ ecosystem into first- and third-party infrastructure for automated remediation. He said this capability is already enabled by 200 XSIAM customers.
On AI security, Arora said Prisma AIRS—introduced a few quarters ago—ended Q2 with over 100 customers, with the company more than tripling customer count from Q1 to Q2. He added that bookings doubled over the same period and that a “nine-figure pipeline” has materialized.
Arora announced the company’s intent to acquire Koi, describing it as a pioneer in securing the “agentic endpoint,” addressing threats tied to MCP servers, browser extensions, plugins, and ephemeral code that can evade traditional endpoint tools. He said Palo Alto Networks has been a Koi customer since summer 2025 and that Koi would enhance endpoint capabilities within XDR 2.0 and extend governance to autonomous agents at the device layer.
Acquisitions and integration: Chronosphere and CyberArk
Management emphasized two major transactions: Chronosphere and CyberArk. Arora said Chronosphere provides observability at massive scale and that, after the acquisition closed near the end of Q2, Chronosphere signed a multi-year, nine-figure expansion deal with a leading AI model provider. He said Chronosphere generated approximately $200 million in ARR as of Q2, which he characterized as above expectations, and that over 80% of new logos last year landed with multiple observability products (metrics, logs, and traces).
In Q&A, Arora said Chronosphere’s architecture enables scalability and allows it to deliver capabilities at roughly half the price versus some alternatives, and that it is displacing another vendor at the AI model provider. He said the customer’s transition is expected over the next six to 12 months and that part of Chronosphere’s $200 million ARR is tied to a large LLM vendor.
On identity, Arora said Palo Alto Networks closed its acquisition of CyberArk early in fiscal Q3 and described a plan to build a “next-generation identity security platform” spanning humans, machines, and AI agents. He said the company intends to deliver machine identity and certificate lifecycle management to its 65,000+ firewall customers. Executives said go-to-market alignment was already underway, including account planning and sales incentives, and described early, manual joint-selling efforts as “crawl, walk, run” given different systems.
Chief Product and Technology Officer Lee Klarich said privileged access management has historically been a more sophisticated category but is shifting toward modern approaches such as just-in-time controls and “Zero Standing Privileges,” which can also make systems easier for end users. He said Palo Alto Networks sees opportunities to integrate CyberArk with products like Prisma Browser and views “agentic identity” as combining aspects of machine identity and privileged access, with future integration opportunities alongside Prisma AIRS.
Financial results and outlook
Golechha reported Q2 Next-Generation Security (NGS) ARR grew 33% to $6.33 billion, including a $200 million contribution from Chronosphere. On an organic basis, he said NGS ARR grew 28% year over year, and net new ARR grew 11%. Total revenue was $2.59 billion, up 15%, with Chronosphere’s revenue contribution described as immaterial due to timing. RPO grew 23% to $16.0 billion (including about $150 million from Chronosphere), while current RPO was $7.1 billion, up 18%.
Golechha said product revenue grew 22% and that software form factors represented 45% of product revenue over the trailing 12 months, up from 38% in the comparable period ending Q2 2025. Services revenue grew slightly above 13%. By region, the Americas grew 14%, while EMEA and JAPAC each grew 17%.
Gross margin for the quarter was 76.1%, including product gross margin of 78.2% and services gross margin of 75.6%. Non-GAAP diluted EPS was $1.03, and adjusted free cash flow was $502 million. Cash and cash equivalents were $7.9 billion, reflecting a $2.6 billion cash consideration for Chronosphere; Golechha said the company expects a $2.3 billion cash outlay in Q3 tied to the CyberArk acquisition and that it issued 112 million shares for CyberArk. He also noted Palo Alto Networks guaranteed payment obligations under CyberArk’s convertible senior notes due 2030 and will make an offer to repurchase the notes following a “make-whole fundamental change.”
Guidance for fiscal Q3 2026, inclusive of CyberArk and Chronosphere, called for:
- NGS ARR: $7.94 billion to $7.96 billion (up 56%), including $1.47 billion from M&A
- RPO: $17.85 billion to $17.95 billion (up 32% to 33%), including $1.6 billion from M&A
- Revenue: $2.941 billion to $2.945 billion (up 28% to 29%), including $340 million from M&A
- Non-GAAP EPS: $0.78 to $0.80
For fiscal year 2026, the company guided to NGS ARR of $8.52 billion to $8.62 billion (up 53% to 54%), revenue of $11.28 billion to $11.31 billion (up 22% to 23%), operating margin of 28.5% to 29%, non-GAAP EPS of $3.65 to $3.70, and an adjusted free cash flow margin of 37%.
About Palo Alto Networks (NASDAQ:PANW)
Palo Alto Networks (NASDAQ: PANW) is a cybersecurity company founded in 2005 and headquartered in Santa Clara, California. The firm develops a broad suite of security products and services designed to prevent successful cyberattacks and protect enterprise networks, clouds, and endpoints. Built around a platform strategy, its offerings target threat prevention, detection, response and governance across hybrid and multi-cloud environments.
The company’s product portfolio includes next‑generation firewalls as a core on‑premises capability, alongside cloud‑delivered security services and software for securing public and private clouds.
