Article published Sep 29, 2026. Prices below use latest available snapshots.
PANW Price Structure
Loading timeframes…
Palo Alto Networks is doing well on the tape and in cash flow, not in GAAP profit. The stock is up 92.24% over the past year and on September 28 closed 1.7% below its 52-week high. It fell 9.28% on September 2, the day after an earnings beat, and recovered with the whole security group from September 14. The business changed shape this year. Buying CyberArk and Chronosphere lifted reported quarterly revenue growth from 14.9% to 34.5%. The two acquired businesses ran an operating loss of $797 million. Without them, fiscal 2026 revenue grew about 14%. The call is buy the pullback, not the base top: entry $362–$378, stop $345, first target $425, medium conviction.
Data as of 2026-09-28 close: PANW $392.09, RSI 59.8, +8.3% vs SMA20, +59.2% vs SMA200, 7D +5.47%, 30D +5.52%, 1Y +92.24%, −1.7% from the 52-week high, volume 0.84× average.
Business and financial facts come from Palo Alto's fiscal 2026 10-K and SEC data. Fiscal 2027 guidance, fourth-quarter operating detail and management quotes come from news coverage and X posts (Benzinga, CNBC, The Globe and Mail, @TheTranscript_, @MMatters22596, @jimcramer). They are attributed, not verified: the earnings release text and the call transcript are not on file.
Quick Snapshot (as of 2026-09-28)
| Question | Answer |
|---|---|
| The call | 🟡 Buy the pullback to the 20-day, not the base top. Entry $362–$378 · stop $345 · first target $425 · medium conviction. |
| What it is | A cybersecurity platform vendor. It sells firewalls and cloud-delivered network security (Strata, Prisma), security operations, cloud security and observability (Cortex, Chronosphere) and, since February, identity security (Idira, formed from CyberArk). End customers in more than 180 countries, including almost all of the Fortune 100 (10-K). |
| Why now | Fiscal 2026 (year ended July 31) is the first year with two large deals inside it: Chronosphere ($3.0 billion, closed January 29) and CyberArk ($21.1 billion, closed February 11). The September 1 report beat estimates and guided fiscal 2027 revenue to $14.10–$14.20 billion (Benzinga). The stock sold off, recovered with the group and now sits under the top of a 7.8-week base. |
| Proof | Fourth-quarter revenue $3.41 billion, up 34.5%. Next-Generation Security annualized recurring revenue (NGS ARR: subscriptions and support excluding hardware and legacy attached offerings) $9.1 billion against $5.6 billion a year earlier. Remaining performance obligations $21.2 billion against $15.8 billion. Fiscal 2026 free cash flow $4.11 billion (10-K). |
| Objection | Growth without the two acquisitions was about 14%, and the fiscal 2027 guide implies about 15% on a like-for-like basis (script-computed). GAAP net income turned to losses in the last two quarters. Shares outstanding rose 17% to 818 million since November. The stock trades near 23 times guided fiscal 2027 revenue. Four insiders, including the CFO, sold about $19.9 million of stock in Form 4s filed September 16–28. |
| Stock setup | Up 92.24% on the year and 59.2% above its 200-day average: an intact long trend. Price sits 1.7% under the $398.88 top of a 7.8-week base. The 20- and 50-day averages are $361.94 and $357.19. |
Action Matrix (as of 2026-09-28)
| Signal | If | Then |
|---|---|---|
| 🟢 Buy | A daily close inside $362–$378 that holds above $345 | Entry $362–$378, from the 20-day average up to where the September 25 pullback closed. Buy the pullback, not strength. |
| 🟡 Wait | Price above $378 | Do not chase. A close above $398.88 on above-average volume would clear the base; even then, wait for the first pullback rather than buy the breakout day. |
| 🔴 Out | A daily close below $345 | The stock is back under its 50-day average and has given back more than half of the September 14 jump. The rebound failed; stand aside until a new base forms. |
| 🟠 Target | $425 | Trim or trail. $425 is Cantor Fitzgerald's August 21 target, the highest of the three raised that day. |
| 🔴 Thesis breaks | The fiscal first-quarter report (providers list November 19) cuts the $14.10–$14.20 billion fiscal 2027 revenue guide, or Palo Alto announces another stock-funded acquisition on CyberArk's scale | The deals bought growth that is not compounding, or dilution keeps outrunning it. |
The Story Right Now (as of 2026-09-28)
Palo Alto Networks is doing well: up 92.24% over one year and 233.44% over three, and back within 1.7% of its 52-week high after a post-earnings drop.
The path since the fourth-quarter report. Palo Alto reported after the close on September 1 and beat: Q4 FY26 revenue of $3.41 billion against a $3.35 billion consensus, and adjusted earnings of $1.02 a share against $0.98 (Yahoo Finance consensus). On September 2 the stock fell 9.28% on 2.33 times normal volume, closing at $328.48 that day. CrowdStrike, SentinelOne, Fortinet and Cloudflare fell with it. MarketWatch's headline had the stock falling "despite strong AI cybersecurity demand." No filing or article on file gives a company-specific cause; Zscaler, Ciena and Credo also beat and posted weekly losses that week (September 5 market brief). On September 14 all eleven tracked security names rose, Palo Alto by 13.1% to a $373.94 close; coverage tied the group move to AI leaders warning in public about cybersecurity risk (September 14 market brief). The stock closed at $393.30 on September 23. It pulled back to a $374.74 close on September 25, a day none of the eleven rose, and rose 4.63% on September 28, a day all eleven rose. The September 29 news pull and the event record hold nothing company-specific for September 28, so that day's cause is unknown beyond the group move; the only Palo Alto filings dated September 28 are two insider sales.
The business behind the price changed shape. Palo Alto closed Chronosphere, an observability company, on January 29 for $3.0 billion. It closed CyberArk, the identity-security company, on February 11 for $21.1 billion: $45 in cash plus 2.2005 Palo Alto shares per CyberArk share, 112 million new shares in all (10-K). Reported revenue growth went from 14.9% in the January quarter to 31.1% and then 34.5%. The 10-K puts the two deals' contribution since closing at $930 million of revenue and a $797 million operating loss. Without them, fiscal 2026 revenue grew about 14% at an operating margin of about 14%; with them, 24.5% and 6.1% (script-computed from the 10-K). The fiscal 2027 guide of $14.10–$14.20 billion (Benzinga) is 23–24% above fiscal 2026 as reported. It is only about 15% above the 10-K's unaudited pro forma revenue of $12.31 billion, which counts both companies for the full year (script-computed). Reported growth should fall back toward the mid-teens once CyberArk laps in February.
Cash flow is the strong part; GAAP earnings are not. Operating cash flow was $4.55 billion and free cash flow $4.11 billion in fiscal 2026, 35.8% of revenue (10-K; free cash flow is the company's non-GAAP measure). GAAP net income was $307 million in fiscal 2026, against $1.13 billion in fiscal 2025. The April and July quarters were net losses of $177 million and $282 million. Three things did it: the acquired businesses' operating loss, stock compensation up to $1.77 billion from $1.30 billion, and a fair-value loss on CyberArk's 2030 convertible notes that turned other income into a $159 million expense. Gross margin was 67.6% in both quarters after the acquisitions closed, down from about 74% in the October quarter.
The valuation leaves little room. At $392.09 on September 28 and the 818 million shares on the 10-K cover, the equity is worth about $321 billion. That is about 23 times the fiscal 2027 revenue guide and 78 times fiscal 2026 free cash flow (script-computed). On September 8 @MMatters22596 put it at "80x forward P/E and ~24x sales" (attributed).
The call: buy the pullback, medium conviction. The long trend is intact. The stock is 59.2% above its 200-day average, 76.88 points ahead of the S&P 500 over one year, and in the Momentum Board's tier of names 40–60% above their 200-day. It sits near the top of a 7.8-week base whose ceiling is $398.88. The stock has moved 9% and 13% in single sessions this month, so a buy at the base top can lose its gain in a day. The entry is the flag instead: $362–$378, from the 20-day average up to the September 25 pullback close. The $345 stop sits under the 50-day average ($357.19), 4.7–8.7% below the zone (script-computed), close enough to bound a wrong call. First target $425. Conviction is medium because the weakest link is organic growth near 15% priced at about 23 times revenue.
Three things would move this to high, all at the fiscal first-quarter report (providers list November 19):
- the $14.10–$14.20 billion fiscal 2027 guide holds or rises
- GAAP operating margin recovers from the fourth quarter's 5.0% as integration costs fall
- the share count stops rising
A guide cut, another stock-funded deal on CyberArk's scale, or a close below $345 ends it.
Extended analysis
Summary
Palo Alto Networks built its business on next-generation firewalls, which still drive most product revenue, and now sells three platforms plus a services arm: Network & AI Security (hardware and software firewalls, the Prisma Access SASE service, add-on cloud security subscriptions and the Prisma AIRS AI-security suite), Cortex (security operations, cloud security and, since January, Chronosphere observability), Idira (identity security, formed from CyberArk) and Unit 42 threat intelligence and incident response (10-K). Its strategy is "platformization": replace a customer's separate point products with one integrated stack, sold mostly through distributors and resellers.
The customer problem is sprawl. Large enterprises run dozens of security tools, and AI adds new objects to secure: agents, models, AI-generated code and machine identities. The 10-K pitches Prisma AIRS and Idira at exactly those, and names "AI agents as a new class of identity" as both an opportunity and a risk.
The decisive uncertainty is what the combined company grows at, and at what margin, once the acquisitions lap. The deals doubled the reported growth rate and cut GAAP operating margin to 6.1% for the year. Cash flow stayed strong. The fiscal 2027 guide implies mid-teens growth on a like-for-like basis, and the stock is priced for more.
Why This Moment Is Different
- CyberArk is now inside the numbers. The deal added $14.8 billion of goodwill and $6.3 billion of intangible assets; total goodwill went from $4.57 billion to $22.01 billion in a year (10-K). Palo Alto issued 112 million shares for it, and stockholders' equity rose from $7.8 billion to $27.5 billion.
- The competitive set widened. The 10-K's competitor list includes identity vendors (Okta, SailPoint, Delinea) and observability vendors (Datadog, Dynatrace, Elastic) alongside Check Point, CrowdStrike, Fortinet and Zscaler. A filed risk: "As a result of the CyberArk acquisition, the scope and size of our business have substantially changed."
- AI is demand and competition at once. Another filed risk reads: "Cloud infrastructure providers and advanced AI companies increasingly offer native security and observability capabilities that compete directly with our offerings." Management's pitch runs the other way. In a clip relayed by @TheTranscript_, CEO Nikesh Arora said Palo Alto identified 1,200 potential vulnerabilities when it first tested the Mythos AI model, and needed months of verification and remediation to get back to a steady state (attributed). In April the company launched Unit 42 Frontier AI Defense services (10-K).
- The deal pace continues. After Chronosphere and CyberArk came Koi ($231 million, April 14), Portkey (May 29), Embrace ($325 million, August 27) and Console ($500 million, September 1) (10-K). On the call, management said Console and Embrace will be immaterial to fiscal 2027 (The Globe and Mail's call summary, attributed).
How the Business Makes Money
- Mix. Product revenue was $2.28 billion (19.9% of revenue, up 27%): firewall hardware and software licenses, plus CyberArk's on-premise identity licenses since February. Subscription and support was $9.20 billion (80.1%, up 24%) (10-K).
- Recurring base. NGS ARR was $9.1 billion on July 31 against $5.6 billion a year earlier. Remaining performance obligations were $21.2 billion, of which about $9.3 billion is expected to be recognized over the next twelve months (10-K). Both figures include the acquisitions.
- Customers and channel. "No single end-customer accounted for more than 10% of our total revenue" in fiscal 2024–2026. Sales run mainly through a two-tier channel of distributors and resellers, and "30% of our total revenue was derived from sales to two distributors" in fiscal 2026. Firewalls also sell through the AWS, Azure, Google Cloud and Oracle marketplaces (10-K).
- Infrastructure dependence. Arora said Palo Alto processes 19 petabytes of data a day on Google Cloud (@TheTranscript_, attributed). Purchase commitments for products, components and cloud hosting totaled $8.3 billion at July 31 (10-K).
- Top filed risks (10-K):
- competition, including cloud providers and AI companies with native security
- acquisitions that "may not result in the expected benefits" and "may dilute stockholder value"
- reliance on channel partners and two large distributors
- AI agents as a new identity class, and AI misuse
- hardware supply, including "increased memory, storage, or other component shortages and costs"
- operations and employees in Israel
What the Company Says It Is Becoming
The 10-K's own framing: "A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products." Management's long-term target is $20 billion of NGS ARR by fiscal 2030, restated on the September 1 call (Arora via @TheTranscript_; The Globe and Mail call summary; both attributed). NGS ARR was $9.1 billion on July 31.
The newest product lines point at AI. Prisma AIRS bundles an AI gateway, agent security, AI red-teaming and runtime protection; the Portkey purchase supplied the gateway, generally available since July 16. Idira pitches securing "human, agentic, and machine identities." Arora has also argued the other side of AI's cost: he said frontier-model economics remain unattractive for endpoint security (@TheTranscript_, September 14, attributed), and CNBC reported on July 9 his view that AI pricing needs to fall 90% as token costs rise.
What the Street and the Public Conversation Say
Print coverage was positive; the tape was not, until the group turned.
- The print. CNBC: "beats quarterly estimates on AI demand, continues acquisition spree." MarketWatch: "stock falls despite strong AI cybersecurity demand." The Globe and Mail's summary (Zacks) reported net new NGS ARR of about $970 million, up 98% and the largest quarterly addition, and about 220 net new platformizations (attributed). Palo Alto's own release, per its investor-relations summary, showed GAAP operating income down year over year and non-GAAP operating income of about $1.0 billion.
- Analyst targets. On August 21 BMO raised its target to $415 from $335 (Outperform), UBS to $390 from $300 (Neutral) and Cantor Fitzgerald to $425 from $340 (Overweight), per TheFly. Coverage on September 14 said targets rose again after the print (Timothy Sykes); the new figures are not on file.
- The bear case. @MMatters22596 (September 8): "80x forward P/E and ~24x sales — extremely expensive," "acquisitions contributed 13% of total revenue" in the April quarter, and "key growth rates are clearly normalizing." He expected a pullback to $199–$246 while the stock failed to make new highs (attributed).
- Into the print. @jimcramer (September 1): "PANW up a lot ahead of the print, but a strong q."
- Threat context. Palo Alto gave Semafor details of an AI-powered hack on a European IT company over the summer (September 16).
- A 13F holder. Stanley Druckenmiller's Duquesne Family Office reported a new 116,650-share position, about $39.8 million, in its June-quarter 13F filed August 14: 0.76% of the filing's reported value, 32nd of 95 lines. An X post surfaced it on September 26. The filing is three months old at period end and shows only long equity and listed options; it is context, not a signal. The next one is due around mid-November.
- Source quality. The September 29 social search failed on YouTube and X and returned unrelated Hacker News posts; the September 15 search found only YouTube chart segments. No independent analysis of organic growth or the CyberArk economics is on file.
Insiders (SEC Form 4). Recent sales:
| Filed | Insider | Role | Shares | Value |
|---|---|---|---|---|
| 2026-09-28 | Dipak Golechha | EVP, Chief Financial Officer | 27,500 | $10.77M |
| 2026-09-28 | Aparna Bawa | Director | 260 | $0.10M |
| 2026-09-21 | James J. Goetz | Director | 20,000 | $7.53M |
| 2026-09-16 | John P. Key | Director | 2,500 | $0.94M |
| 2026-09-16 | Aparna Bawa | Director | 1,500 | $0.56M |
| 2026-09-03 | Josh D. Paul | Chief Accounting Officer | 900 | $0.34M |
Whether these sales ran under preset trading plans is not on file. Short-interest data is not on file either.
The Conviction Chain
| Link | Evidence | Confirms | Breaks |
|---|---|---|---|
| Platform demand is real | NGS ARR $9.1B vs $5.6B; RPO $21.2B vs $15.8B (10-K); record net new NGS ARR (attributed) | Net new NGS ARR stays above the year-ago quarter | A guide cut at the November report |
| Organic growth holds mid-teens | About 14% without the two acquisitions in fiscal 2026; guide implies about 15% like-for-like | Growth without acquisitions stays near 15% | Like-for-like growth slides toward 10% |
| CyberArk becomes accretive | Acquired businesses ran a $797M operating loss; gross margin 67.6% after the acquisitions vs about 74% before | GAAP operating margin recovers from 5.0% | Operating margin stays near zero into mid-2027 |
| Cash funds the build | Free cash flow $4.11B, 35.8% of revenue | Free-cash-flow margin holds near 35% | Margin falls as acquired costs stick |
| Dilution stops | Shares outstanding 697M (November 2025) to 818M (August 2026); stock compensation $1.77B | Buybacks from the $1.0B authorization (expires December 31) | Another stock-funded deal |
| The tape confirms | 59.2% above the 200-day; base top $398.88 | A pullback into $362–$378 holds | A close below $345 |
Weakest link: organic growth near 15% priced at about 23 times revenue. The business is strong and the trend is intact, but the multiple leaves no room for a slower like-for-like rate once CyberArk laps.
Financial Proof
Fiscal years (July year-end), from the 10-K:
| Fiscal year | Revenue ($M) | Growth | Gross margin | GAAP operating income ($M) | GAAP operating margin | GAAP net income ($M) | Operating cash flow ($M) | Capex ($M) | Free cash flow ($M) | Stock compensation ($M) | Source |
|---|---|---|---|---|---|---|---|---|---|---|---|
| FY2024 | 8,027 | +16% | 74.3% | 684 | 8.5% | 2,578 | 3,258 | 157 | 3,101 | 1,076 | SEC 10-K |
| FY2025 | 9,221 | +15% | 73.4% | 1,243 | 13.5% | 1,134 | 3,716 | 247 | 3,469 | 1,295 | SEC 10-K |
| FY2026 | 11,480 | +24% | 70.4% | 695 | 6.1% | 307 | 4,553 | 440 | 4,113 | 1,774 | SEC 10-K |
Fiscal 2024 net income includes a $1.59 billion tax benefit from releasing a valuation allowance (10-K).
Quarters (script-computed from SEC XBRL; fourth quarters are the fiscal year less nine months):
| Quarter (period end) | Revenue ($M) | YoY | Gross margin | GAAP operating income ($M) | GAAP operating margin | GAAP net income ($M) | Operating cash flow ($M) | Capex ($M) | Free cash flow ($M) | Stock compensation ($M) | Source |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Q1 FY25 (2024-10-31) | 2,139 | +13.9% | 74.1% | 286 | 13.4% | 351 | 1,510 | 44 | 1,466 | 295 | SEC 10-Q |
| Q2 FY25 (2025-01-31) | 2,257 | +14.3% | 73.5% | 241 | 10.7% | 267 | 557 | 48 | 509 | 320 | SEC 10-Q |
| Q3 FY25 (2025-04-30) | 2,289 | +15.3% | 73.0% | 219 | 9.6% | 262 | 628 | 68 | 560 | 326 | SEC 10-Q; Massive |
| Q4 FY25 (2025-07-31) | 2,536 | +15.9% | 73.2% | 497 | 19.6% | 254 | 1,021 | 87 | 934 | 354 | SEC 10-K less nine months; Massive |
| Q1 FY26 (2025-10-31) | 2,474 | +15.7% | 74.2% | 309 | 12.5% | 334 | 1,771 | 84 | 1,687 | 370 | SEC 10-Q; Massive |
| Q2 FY26 (2026-01-31) | 2,594 | +14.9% | 73.6% | 397 | 15.3% | 432 | 554 | 170 | 384 | 301 | SEC 10-Q; Massive |
| Q3 FY26 (2026-04-30) | 3,002 | +31.1% | 67.6% | −183 | −6.1% | −177 | 871 | 83 | 788 | 643 | SEC 10-Q; Massive |
| Q4 FY26 (2026-07-31) | 3,410 | +34.5% | 67.6% | 172 | 5.0% | −282 | 1,357 | 103 | 1,254 | 460 | SEC 10-K less nine months; Massive |
Revenue and operating income agree between the SEC and Massive for every quarter where Massive reports them. Quarterly cash-flow figures are de-cumulated from year-to-date SEC figures; free cash flow is operating cash flow less purchases of property, equipment and other assets, the company's definition.
The business before the acquisitions was steady, not accelerating. Revenue growth held between 13.9% and 15.9% for six straight quarters before the acquisitions closed. The jump to 31.1% and 34.5% is mostly acquired: the two acquisitions added $930 million of revenue in the roughly six months they were owned (10-K).
The deals cost margin at every line. Gross margin fell about six points after the deals. GAAP operating income swung to a $183 million loss in the April quarter. The CyberArk integration included $49 million of severance (10-K). Stock compensation peaked at $643 million in the April quarter, when CyberArk closed; that deal carried $945 million of replacement equity awards, the unvested part expensed over future service (10-K).
Below the operating line. Other income turned from $353 million of income to a $159 million expense. The 10-K attributes that "primarily" to a loss on the fair value of the 2030 convertible notes assumed from CyberArk, partly offset by gains on the capped calls. Since the acquisition, the notes and capped calls produced about $562 million of net losses. The effective tax rate rose to 42.7% from 28.9%.
Balance sheet (July 31, 2026 vs July 31, 2025, 10-K):
- cash and equivalents $2.51 billion vs $2.27 billion; short-term investments $0.56 billion vs $0.64 billion; long-term investments $4.84 billion vs $5.56 billion
- 2030 convertible notes carried at $1.77 billion fair value, $1.1 billion principal remaining after $153 million was converted for $160 million in cash
- current deferred revenue $7.75 billion vs $6.30 billion
- no borrowings under the $400 million revolving credit facility
- $1.0 billion left on the buyback authorization, which expires December 31, 2026
Stock Setup
Tape (live):
| Measure | PANW |
|---|---|
| As of | 2026-09-29 |
| Price ($) | 388.41 |
| RSI (14, Wilder) | 58.2 |
| 1D (%) | -0.94 |
| 7D (%) | 3.69 |
| 30D (%) | 4.53 |
| 3M (%) | 13.9 |
| 1Y (%) | 90.43 |
| 2Y (%) | 127.27 |
| 3Y (%) | 231.35 |
| 1Y vs S&P 500 (points) | 75.29 |
| 3Y vs S&P 500 (points) | 152.58 |
| vs 20-day (%) | 7.2 |
| vs 50-day (%) | 8.5 |
| vs 200-day (%) | 57.1 |
| Off 52-week high (%) | -2.62 |
| Volume vs average (×) | 0.72 |
Levels (live):
| Level | Price ($) |
|---|---|
| 20-day average | 362.26 |
| 50-day average | 357.99 |
| 200-day average | 247.2 |
| One-year value area, top | 269.23 |
| One-year most-traded price | 166.58 |
| Nearest support shelf | 188.19 |
Security peers (live):
| Name | As of | Price ($) | 1D (%) | 30D (%) | 1Y (%) | vs 200-day (%) | Off 52w high (%) |
|---|---|---|---|---|---|---|---|
| Palo Alto Networks (PANW) | 2026-09-29 | 388.41 | -0.94 | 4.53 | 90.43 | 57.1 | -2.62 |
| Fortinet (FTNT) | 2026-09-29 | 175.96 | -0.21 | 6 | 107.87 | 50.2 | -2.98 |
| CrowdStrike (CRWD) | 2026-09-29 | 262.74 | 1.35 | 20.3 | 115.17 | 73.5 | -1.85 |
| Zscaler (ZS) | 2026-09-29 | 198.36 | -0.52 | 7.67 | -33.19 | 18.8 | -41.14 |
| Okta (OKTA) | 2026-09-29 | 204.88 | 1.34 | 23.25 | 118.28 | 85.7 | -3.59 |
| Cloudflare (NET) | 2026-09-29 | 352.26 | -0.49 | 17.48 | 61.16 | 51.2 | -4.13 |
| SentinelOne (S) | 2026-09-29 | 23.31 | 2.51 | 8.22 | 28.86 | 40.9 | -4.47 |
Horizon read as of September 28. The long trend is intact and strong: up 92.24% on the year and 133.55% over two, 76.88 points ahead of the S&P 500 over one year and 59.2% above its 200-day average. The short-window trend reads strong-up. Among the large security names, Zscaler is the one with a broken year (down 32.84% over one year, negative against the index); Palo Alto is not in that group.
The base. The price has spent 7.8 weeks under a $398.88 ceiling. Inside it came the September 2 drop, the September 14 jump and a shallow September 25 pullback that closed at $374.74. The 20-day ($361.94) and 50-day ($357.19) averages have converged below the price. The one-year value area tops out at $269.23 and the nearest support shelf is $188.19, both far below. Most of the year's volume traded well under today's price, so the supports that matter for a 2026 entry are the averages and the September structure, not the volume profile.
The pattern. This is a pop and flag inside a long uptrend, not a washout. The September 14 jump was the pop; the flag's September 25 pullback closed above the 20-day average. The breakout would be a close above $398.88. The entry grammar is the pullback within the flag.
Catalysts
- Fiscal first-quarter report. Providers list November 19; the company has not confirmed a date on file. It is the first test of the fiscal 2027 guide and of GAAP margin recovery.
- Duquesne's September-quarter 13F. Due around mid-November; it will show whether the June-quarter position was kept.
- Convertible notes. The 2030 notes are not convertible in the calendar quarter ending September 30. If the stock-price condition is met during that quarter, holders could convert in the December calendar quarter; $1.1 billion of principal remains (10-K).
- Buyback authorization. $1.0 billion remains, expiring December 31, 2026.
- More deals. Console and Embrace closed in the past five weeks. Another acquisition, especially one paid in stock, would reset the dilution math.
Risks and Kill Tests
- Guide cut. A reduced fiscal 2027 revenue guide at the November report breaks the thesis.
- Organic slowdown. Like-for-like growth sliding toward 10% would leave a 23-times-revenue multiple unsupported.
- Integration. GAAP operating margin that does not recover from the fourth quarter's 5.0% would mean CyberArk's cost base is sticking.
- Dilution. Shares outstanding rose 17% between November 2025 and August 2026. Another stock-funded deal on CyberArk's scale is a kill test.
- Channel concentration. Two distributors supplied 30% of fiscal 2026 revenue.
- AI competition. Cloud providers and AI companies with native security, a risk the 10-K names directly.
- Insider selling. About $19.9 million sold by four insiders in filings from September 16 to 28, including $10.77 million by the CFO. That is context, not a kill test.
- Price. A close below $345 means the September rebound failed.
Cross-references
- September 22 cybersecurity deep dives (Fortinet, Okta, Zscaler). All three set the same grammar: buy the retest, not the breakout. Fortinet's zone was $166–$174, Okta's $176–$184 and Zscaler's $188–$198. They noted Palo Alto 6.8% below its high on September 21; it has since closed to within 1.7%. This dive applies their rule to Palo Alto.
- July 18 cybersecurity entry note. It set a watch on Palo Alto as the lane's strongest structure: the first pullback holding the then-20-day ($327.50), invalidation a close below the then-50-day ($283.88). That call remains open in the call record. Its moving-average levels have since moved; this dive replaces them with the levels above.
- September 2, 5, 14 and 28 market briefs. The post-print drop and weekly loss, the eleven-for-eleven September 14 rally, and the September 28 reversal. The September 28 brief called Palo Alto "strength with little pullback" and said the group's rise "does not supply an entry level by itself."
- Momentum Board, September 28. In the tier of names 40–60% above their 200-day average. Not on the September 28 washout-turn list.
- Duquesne 13F input (September 26). The filing check behind the 13F note above.
- Watchlists: cybersecurity, AI, tech insider buys, insider universe, cloud ETF holdings.
- Identity note. CyberArk Software Ltd. is now a Palo Alto subsidiary. Its former ticker belongs to an unrelated fund and is not a proxy for CyberArk.
Refresh History
| Date | Price | RSI | vs SMA20 | 30D | What changed |
|---|---|---|---|---|---|
| 2026-09-28 | $392.09 | 59.8 | +8.3% | +5.52% | First dive: fiscal 2026 10-K read; organic vs acquired growth split; buy-the-pullback call at $362–$378, stop $345, target $425 |
Sources
Primary sources:
- Palo Alto Networks 10-K, fiscal year ended 2026-07-31 (filed 2026-09-10)
- Palo Alto Networks 10-Q, quarter ended 2026-04-30 (filed 2026-06-03)
- Palo Alto Networks 8-K, filed 2026-09-01 (fourth-quarter results)
- Palo Alto Networks release: fiscal fourth quarter and fiscal year 2026 results
- Form 4s: Golechha (filed 2026-09-28); Bawa (2026-09-28); Goetz (2026-09-21); Key (2026-09-16); Bawa (2026-09-16); Paul (2026-09-03)
- Duquesne Family Office 13F-HR, period 2026-06-30, filed 2026-08-14, accession 0001536411-26-000006: filing index; information table; prior quarter, Palo Alto absent
News and commentary characterized:
- Benzinga, Palo Alto beats Q4 estimates, announces Console acquisition (2026-09-01)
- CNBC, Palo Alto Networks beats quarterly estimates on AI demand, continues acquisition spree (2026-09-01)
- MarketWatch, Palo Alto Networks' stock falls despite strong AI cybersecurity demand (2026-09-01)
- Reuters, Palo Alto Networks beats quarterly earnings estimates, acquires AI platform (2026-09-01)
- The Globe and Mail (Zacks), PANW Q4 earnings beat estimates on platformization strength; The Globe and Mail, Q4 2026 earnings call transcript summary
- Timothy Sykes, PANW rallies as Wall Street hikes price targets (2026-09-14)
- StockAnalysis relay of TheFly price-target changes (2026-08-21)
- CNBC, Palo Alto CEO Arora says AI pricing needs to fall 90% (2026-07-09)
- Semafor, Anatomy of an AI-powered hack (2026-09-16)
- X: @TheTranscript_, $20B NGS ARR target (2026-09-01); @TheTranscript_, Mythos vulnerabilities (2026-09-11); @TheTranscript_, 19 PB a day on Google Cloud (2026-09-12); @TheTranscript_, frontier-model economics (2026-09-14); @MMatters22596 (2026-09-08); @jimcramer (2026-09-01); @drayinvests, Duquesne new positions (2026-09-26)
Internal receipts:
- Tape (every live cell; prose figures as of 2026-09-28): cybersec. Tier: 2026-09-28-monster-scan; washout check 2026-09-28-washout-scan. Dated closes: 2026-09-02-market-brief ($328.48), 2026-09-05-market-brief (weekly −10.36%), 2026-09-14-market-brief ($373.94), 2026-09-23-cybersec ($393.30), 2026-09-25-cybersec ($374.74), 2026-09-28-market-brief.
- Fundamentals: company-facts, key-financials, 10K-2026-09-10.html, 10Q-2026-06-03.html; massive{income-statements,balance-sheets,cash-flow-statements}.json` (fetched 2026-09-29). Reconciliation 2026-09-29: revenue, revenue growth, operating margin and operating cash flow confirmed across SEC and Massive; capex and free cash flow single-source SEC; the net-income dispute is a window mismatch (SEC fiscal year vs Massive fourth quarter), and both figures are quoted with their windows. Derived figures script-computed.
- Earnings records: 2026-09-01-panw-earnings, 2026-06-02-panw-earnings, 2026-11-19-panw-earnings (provider estimate).
- News: latest (fetched 2026-09-29T20:53Z, ok, not stale; quote-page summaries only); articles.
- Insiders: filing-watch (data date 2026-09-28); 2026-09--panw-4-.
- Captures: 2026-09-26-druckenmiller-duquesne-q2-13f-new-positions; 2026-09-08-MMatters22596-listen-carefully-panw-is-not-a-buy-for-me-at-cur-60501343, 2026-09-01-jimcramer-panw-up-a-lot-ahead-of-the-print-but-a-strong-q-20839985, 2026-09-29-social-search-panw, 2026-09-15-social-search-panw; 2026-09-01-cnbc-palo-alto-networks-beats-quarterly-estimates-on-ai-demand-co-108357231, 2026-09-01-marketwatch-palo-alto-networks-x2019-stock-falls-despite-strong-ai-cyber--mktw-0005211082, 2026-09-01-thebuildout-palo-alto-networks-ceo-nikesh-arora-says-ai-tailwinds-will-d-754d4aa4, 2026-09-11-thebuildout-palo-alto-networks-ceo-nikesh-arora-details-remediation-of-1-953b5319, 2026-09-12-thebuildout-palo-alto-networks-ceo-nikesh-arora-says-company-processes-1-8a6f69f9, 2026-09-14-thebuildout-palo-alto-networks-ceo-nikesh-arora-says-frontier-model-econ-e773f84f, 2026-07-09-cnbc-palo-alto-ceo-arora-says-ai-pricing-needs-to-fall-90-as-toke-108332785, 2026-09-16-semafor-anatomy-of-an-ai-powered-hack--ai-powered-hack.
- Desk context: 2026-09-22-ftnt-deep-dive, 2026-09-22-okta-deep-dive, 2026-09-22-zs-deep-dive; 2026-07-18-cybersec-entry-conditions-written-triggers; desk-calls.