Palo Alto Networks reported $3.0 billion in total revenue for the fiscal third quarter of 2026, which is a 31% increase from the same period last year. This total includes $388 million from the CyberArk and Chronosphere acquisitions. Next-Generation Security (NGS) ARR grew 60% year over year to $8.1 billion, and this figure includes $1.6 billion from CyberArk and Chronosphere. Remaining performance obligation (RPO) grew 36% year over year to $18.4 billion, which includes $1.8 billion from CyberArk and Chronosphere. The company reported a GAAP net loss of $177 million, or $0.22 per diluted share, while the third quarter of 2025 saw a GAAP net income of $262 million, or $0.37 per diluted share. Non-GAAP net income for the quarter was $684 million, or $0.85 per diluted share, compared to $561 million, or $0.80 per diluted share, in the prior year. Net cash from operating activities reached $871 million, an increase from $628 million in the third quarter of 2025. Adjusted free cash flow for the quarter was $910 million, up from $578 million in the same period last year. The trailing 12-month adjusted free cash flow margin was 38.5%, an increase of 430 basis points year over year. The company’s quarterly performance shows strong growth despite the significant GAAP losses recorded this quarter.
Unit 42 researchers at Palo Alto Networks say AI acts as a force multiplier for threat actors. AI compresses the attack lifecycle, making tasks that once took days happen in hours. During the third quarter, Unit 42 researchers simulated a ransomware campaign from entry to exfiltration in 25 minutes. This speed contradicts the time most enterprises require to detect a breach. The company expects agentic AI to reach a level of autonomous execution that operates at machine speed without human intervention within a few years. In the third quarter, over 1,200 customers contacted Palo Alto Networks following the Mythos event. The company held 800 meetings in the last six weeks to discuss the shifting AI landscape with these customers. Nikesh Arora told analysts that frontier AI development reached a critical inflection point. He noted that models like Mythos possess the autonomous capability to execute comprehensive attack campaigns from start to finish.
Extortion tactics changed in 2025. Encryption was present in 78% of extortion cases, which is a decrease from the 92% in 2024 and the 89% to 96% levels seen between 2021 and 2024. Data theft was present in 57% of cases in 2025, compared to 60% in 2024. Harassment occurred in 10% of cases in 2025, while it was 13% in 2024. Attackers often use data exposure or direct pressure to create leverage even when victims keep access to their systems. Some groups escalate pressure by contacting employees directly or claiming they will sell customer data to other actors. Many ransomware groups use business-like structures, including affiliate programs and repeatable negotiation playbooks. In 2025, threat actors fulfilled their promises, such as providing decryption keys, in 68% of cases where they made a commitment. The decoupling of encryption and extortion means that visibility and strong data-handling practices are required regardless of whether attackers deploy ransomware.
Palo Alto Networks provides network security, cloud security, and security operations solutions. The company sells hardware or virtual appliances, subscription services, and support contracts.
| Product | Version/Type | Pricing |
|---|---|---|
| NGFW | PA-220 Model | Approximately $1,000 |
| NGFW | PA-7000 Series | Approximately $200,000 |
| Prisma Cloud | Business Edition | $9,000 annually for 100 credits |
| Prisma Cloud | Enterprise Edition | $18,000 annually for 100 credits |
| Cortex XDR | Cortex XDR Pro | Approximately $81 per endpoint |
| Cortex Data Lake | 1 TB Storage | Around $11,000 |
Next-Generation Firewalls (NGFWs) use App-ID to identify applications and User-ID to map IP addresses to users. These firewalls use Content-ID for real-time threat prevention and WildFire to analyze unknown files in a cloud-based sandbox. The products offer scalability for data centers and automation through APIs. The initial setup for the Next-Generation Firewalls is unnecessarily complex. Prisma Cloud provides Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and Cloud Identity and Access Management (IAM). It uses AI-powered risk prioritization and provides code-to-cloud remediation. While the platform has multi-cloud support and automation, it has a steep learning curve and high costs. Cortex XDR uses machine learning to profile user behavior and provides automated response actions. It reduces alert fatigue through unified data integration, but some users report heavy resource utilization and high costs.
Palo Alto Networks focuses on a platformization strategy to consolidate security tools. In the third quarter, the company secured 110 net new platformizations. This number includes 20 from the CyberArk and Chronosphere integrations. The company has 2,280 total platformized customers. These customers show 120% net retention and single-digit churn rates. The company purchased CyberArk for $25 billion within the last year to expand into identity security. It also acquired KOI Security, Chronosphere, and Protect AI. Nikesh Arora said the company is executing ahead of M&A integration plans to improve profitability. The company expects to reach 40% adjusted free cash flow margin in FY28.
Identity weaknesses influenced 90% of Unit 42 investigations. Attackers use stolen credentials and tokens to move laterally. 87% of intrusions involved activity across multiple attack surfaces. Nearly 48% of breaches involved browser-based activity. In the third quarter, researchers identified agentic ransomware that manages multiple stages of an extortion operation. This agentic ransomware operates from end to end across the attack lifecycle. Attackers also use token jacking to exploit exposed credentials for unauthorized access to cloud AI services. This can generate millions of dollars in unauthorized compute charges at the expense of the victim. Nation-state actors use persona-driven infiltration and synthetic identities to maintain persistence. They also exploit software-as-a-service (SaaS) integrations, vendor tools and application dependencies to bypass perimeters.
Ransom demands increased in 2025. Median initial ransom demands rose from $1.25 million in 2024 to $1.5 million in 2025. Median ransom payments rose from $267,500 in 2024 to $500,000 in 2025. These demands represented 0.55% of perceived annual revenue (PAR) in 2025, whereas they were 2% of PAR in 2024. In 2025, negotiators reduced the difference between initial demands and final payments by 61%. About 41% of victims restored systems from backups without paying. However, attackers impacted backups in 26% of extortion cases. Many groups research the ability of victims to pay to calibrate their demands.
Palo Alto Networks expects fourth quarter revenue to be between $3.345 billion and $3.355 billion. This represents 32% growth year over year. For the full year 2026, total revenue guidance is $11.415 billion to $11.425 billion. The company expects Next-Generation Security ARR to reach $8.90 billion to $8.95 billion. How will the company maintain its 40% adjusted free cash flow margin target if AI-driven attacks continue to compress the time available for human intervention? You likely noticed the stock’s volatility following the February guidance.
