10-K: Palo Alto Networks Reports Strong FY25 Growth, Eyes CyberArk

Palo Alto Networks delivered robust fiscal year 2025 results with significant revenue and free cash flow growth, driven by its platformization strategy and key acquisitions, while announcing a major acquisition of CyberArk.

Summary

• Total revenue for fiscal year 2025 reached $9,221.5 million, marking a 14.9% year-over-year increase.
• Subscription and support revenue grew by 15.5% to $7,419.6 million, representing 80.5% of total revenue.
• Product revenue increased by 12.4% to $1,801.9 million, accounting for 19.5% of total revenue.
• Next-Generation Security Annualized Recurring Revenue (NGS ARR) grew to $5.6 billion as of July 31, 2025, up from $4.2 billion in fiscal 2024.
• Remaining performance obligations (RPO) increased to $15.8 billion as of July 31, 2025, compared to $12.7 billion in fiscal 2024.
• Operating income for fiscal 2025 was $1,242.9 million, with an operating margin of 13.5%.
• Net income for fiscal 2025 was $1,133.9 million, a decrease from $2,577.6 million in fiscal 2024, primarily due to a significant tax benefit recognized in fiscal 2024.
• Cash flow provided by operating activities was $3,716.0 million, and non-GAAP free cash flow was $3,469.8 million for fiscal 2025.
• Completed the acquisition of certain IBM QRadar assets in August 2024 for $1.1 billion, including contingent consideration.
• Acquired Protect AI, Inc. in July 2025 for $634.5 million to enhance AI security capabilities.
• Entered into a definitive agreement in July 2025 to acquire CyberArk Software Ltd. for approximately $25 billion, expected to close in the second half of fiscal 2026.
• The company's board authorized a $4.1 billion share repurchase program, with $1.0 billion remaining as of July 31, 2025, expiring December 31, 2025; no shares were repurchased in fiscal 2025.
• The 0.375% Convertible Senior Notes due 2025 were fully converted or settled by their maturity date of June 1, 2025.

Sentiment

Score: 8

Explanation: The company demonstrates strong operational performance with significant revenue growth, particularly in recurring subscription services, and robust increases in NGS ARR and RPO. Strategic acquisitions like CyberArk are poised to expand market presence and capabilities. While net income shows a decline, this is an accounting artifact from a prior year's tax benefit, not indicative of underlying business weakness. The company is actively investing in innovation and managing its growth effectively, despite facing intense competition and macroeconomic uncertainties.

Positives

• Strong revenue growth of 14.9% year-over-year, reaching $9,221.5 million in fiscal 2025.
• Significant increase in subscription and support revenue (15.5% YOY), indicating strong recurring revenue streams and customer adoption of cloud-based offerings.
• Robust growth in Next-Generation Security Annualized Recurring Revenue (NGS ARR) to $5.6 billion, demonstrating success in the platformization strategy.
• Substantial increase in Remaining Performance Obligations (RPO) to $15.8 billion, providing strong visibility into future revenue.
• Operating income more than doubled to $1,242.9 million, reflecting improved operational efficiency and scaling of the business.
• Healthy free cash flow of $3,469.8 million, indicating strong cash generation after capital expenditures.
• Strategic acquisitions of IBM QRadar assets and Protect AI, Inc. are expected to accelerate growth in Cortex business and enhance AI security platforms.
• The proposed acquisition of CyberArk Software Ltd. is anticipated to expand the business scope and size, leveraging product and customer synergies.
• Continued investment in research and development, leading to the introduction of several new offerings like Prisma Access Browser, Cortex Cloud, Prisma AIRS, and Cortex XSIAM 3.0.

Negatives

• The total revenue growth rate slowed to 14.9% in fiscal 2025 from 16.5% in fiscal 2024 and 25.3% in fiscal 2023.
• Net income decreased from $2,577.6 million in fiscal 2024 to $1,133.9 million in fiscal 2025, primarily due to the absence of a large deferred tax benefit recognized in the prior year.
• Product gross margin decreased from 78.3% in fiscal 2024 to 77.1% in fiscal 2025, attributed to unfavorable hardware product mix and increased inventory excess and obsolete charges.
• Subscription and support gross margin slightly decreased from 73.4% in fiscal 2024 to 72.5% in fiscal 2025, mainly due to increased costs related to cloud-based offerings.
• General and administrative expenses increased significantly in fiscal 2024 due to litigation-related charges, although a partial release of accrual occurred in fiscal 2025.
• No share repurchases were made in fiscal 2025, despite $1.0 billion remaining under the authorization, which expires at the end of 2025.

Risks

• Operating results may be adversely affected by unfavorable economic and market conditions and the uncertain geopolitical environment, including hostilities in Israel and the Russia-Ukraine war.
• Failure to effectively manage future growth or improve systems, processes, and controls could adversely affect operating results.
• Revenue growth rate in recent periods may not be indicative of future performance, and maintaining profitability may be challenging.
• Operating results may vary significantly from period to period, making predictions difficult and potentially causing results to fall short of expectations.
• Seasonality may cause fluctuations in revenue, with strongest sequential growth typically in fiscal second and fourth quarters.
• Inability to sell new and additional product, subscription, and support offerings, especially to large enterprise customers, could harm future revenue.
• Failure to attract new customers could harm future results of operations.
• Reliance on subscription and support offerings means downturns or upturns in sales or renewals are not immediately reflected in full in operating results.
• Sales prices of products, subscriptions, and support offerings may decrease, reducing revenue and gross profits.
• Heavy reliance on channel partners means their failure to perform could limit sales and distribution.
• Exposure to credit and liquidity risk of customers, especially in weakened markets, could result in material losses.
• Sales to government entities are subject to challenges and risks, including competitive bidding, changing requirements, and budgetary impacts.
• Intense competition in the market from large companies, independent vendors, startups, and public cloud providers could impact competitive position.
• Acquisitions (including CyberArk) could subject the company to adverse claims, require significant management attention, disrupt business, and may not result in expected benefits or could dilute stockholder value.
• Failure to complete the CyberArk acquisition within the anticipated timeframe or at all could negatively impact future business and financial results, including potential termination fees.
• The CyberArk acquisition will substantially change the scope and size of the business, leading to incremental risks and increased competition in new product categories.
• Failure to accurately predict and respond to rapidly evolving technological and market developments, including AI, could harm competitive position.
• Issues in the development and deployment of AI may result in reputational harm, legal liability, and increased costs.
• A network or data security incident could allow unauthorized access, harm reputation, create liability, and adversely impact financial results.
• Defects, errors, or vulnerabilities in products, subscriptions, or support offerings, or failure to prevent security breaches, could harm reputation and operating results.
• Ability to sell products is dependent on the quality of technical support services, and failure to offer high-quality support could adversely affect customer satisfaction and sales.
• Claims by others that the company infringes their intellectual property rights could harm the business, leading to substantial costs or inability to offer certain products.
• Proprietary rights may be difficult to enforce or protect, enabling others to copy or use aspects of products without compensation.
• Use of open source software could negatively affect ability to sell products and subject the company to litigation.
• Inability to maintain licenses for third-party technology could harm the business.
• Dependence on manufacturing partners makes the company susceptible to manufacturing and logistics delays and pricing fluctuations.
• Managing the supply of hardware products and components is complex; insufficient supply leads to lost sales, while excess inventory harms gross margins.
• Reliance on limited sources of key components, including outside the U.S., makes the company susceptible to supply shortages and international regulations.
• Inability to attract, retain, and motivate key technical, sales, and management personnel could harm the business.
• Significant revenue from international sales exposes the company to risks associated with international operations, including political/economic uncertainty and regulatory changes.
• Exposure to fluctuations in foreign currency exchange rates could negatively affect financial condition and operating results.
• Operations and employees located in Israel face risks from political instability, civil unrest, and military actions.
• Subject to international trade regulations and governmental export/import controls that could subject the company to liability or impair international competitiveness.
• Increased costs to comply with privacy and data protection laws, and failure to comply, could lead to enforcement actions, litigation, and adverse publicity.
• Exposure to tax liabilities that are greater than anticipated due to complex tax laws and potential challenges by tax authorities.
• If estimates or judgments, including critical accounting policies, prove incorrect, operating results could differ from guidance, leading to stock price decline.
• Failure to maintain proper and effective internal control over financial reporting could adversely affect investor confidence.
• Reputation and/or business could be negatively impacted by corporate responsibility matters or reporting thereof.
• Failure to comply with governmental laws and regulations could harm the business.
• Market price of common stock historically volatile, and investment value could decline.
• Warrant transactions may affect the value of common stock.
• Issuance of additional stock in connection with financings, acquisitions, or incentive plans will dilute existing stockholders.
• Share repurchase program may not be fully consummated or enhance shareholder value, and could affect stock price.
• No intention to pay dividends for the foreseeable future.
• Charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment.
• Business is subject to risks of catastrophic events and man-made problems.
• Failure to raise additional capital or generate significant capital could reduce ability to compete and harm business.

Future Outlook

The company anticipates continued growth in the cybersecurity landscape, driven by its platformization strategy, AI innovation, and strategic partnerships. It expects recurring revenues from an expanding customer base and increased adoption of its products and cloud-delivered security solutions. Future investments are planned for research and development, customer support, and sales force expansion, including global presence. The proposed acquisition of CyberArk is expected to close in the second half of fiscal 2026, bringing significant benefits and synergies. The company expects cash flow from operations and existing cash to be sufficient for foreseeable cash needs, but acknowledges potential needs for additional financing for growth and acquisitions.

Management Comments

• Our vision is a world where each day is safer and more secure than the one before.
• Our mission is to be the cybersecurity partner of choice for enterprises, organizations, service providers, and government entities to protect our digital way of life.
• We believe that the benefits of increased protection of our potential ability to negotiate with an unfriendly or unsolicited acquirer outweigh the disadvantages of discouraging a proposal to acquire us.

Industry Context

The cybersecurity industry is intensely competitive and rapidly evolving, characterized by constant change and innovation, driven by new application, threat, and technology landscapes. The company's platformization strategy aligns with the industry trend of simplifying security architectures by consolidating disparate point products. The increasing adoption of AI and automation is a key driver, with the company actively integrating these into its offerings and operations. The market is seeing increased specialization and consolidation, with large tech companies and independent security vendors competing fiercely. Geopolitical conditions and macroeconomic factors, such as inflation and interest rates, continue to impact customer spending and operational costs across the global market.

Comparison to Industry Standards

• The company believes it generally competes favorably with competitors like Cisco, Microsoft, Alphabet, Check Point, Fortinet, CrowdStrike, Zscaler, and Wiz based on product features, reliability, performance, effectiveness, product line breadth, integration capabilities, price, total cost of ownership, adherence to industry standards, sales/marketing efforts, and brand reputation.
• The company's products and services have been recognized as leading in 25 categories by third-party industry analyst firms, serving as an important measure of validation for customers.

Corporate Governance

Legal Proceedings

• Centripetal Networks, Inc. v. Palo Alto Networks: A jury returned a verdict of non-willful infringement on January 31, 2024, with a lump sum damages amount of $151.5 million. After post-trial motions, a judgment was issued on October 3, 2024, affirming infringement on three patents and reducing damages to $113.6 million plus statutory interest. The company has posted a surety bond and is appealing the judgment. Accrued $145.6 million as of July 31, 2025.
• Finjan, Inc. v. Palo Alto Networks: On March 21, 2025, a judge granted summary judgment of non-infringement on all remaining patents. The plaintiff filed a Notice of Appeal on April 21, 2025. The company is currently unable to reasonably estimate a possible loss.
• Eire OG Innovations. v. Palo Alto Networks: A lawsuit filed on April 3, 2024, asserting infringement of multiple patents. Trial is set for February 17, 2026. The company is currently unable to reasonably estimate a possible loss.

Stakeholder Impact

• Shareholders: Potential for stock dilution due to the CyberArk acquisition, continued share price volatility, and no anticipated dividends in the foreseeable future. The share repurchase program provides some support but no repurchases were made in FY2025.
• Employees: Continued growth and investment in R&D and sales force create opportunities. Focus on AI integration into people programs and a strong corporate culture aims to attract and retain talent. Operations in Israel pose geopolitical risks to employees.
• Customers: Benefit from expanded cybersecurity platforms, new AI-powered offerings, and a platformization strategy aimed at simplifying security architectures. Acquisitions like CyberArk are expected to enhance security capabilities.
• Suppliers/Manufacturing Partners: Reliance on limited sources and manufacturing partners exposes the company to supply chain disruptions, pricing fluctuations, and geopolitical risks, which could impact product delivery and costs.
• Creditors: The company's strong cash flow and liquidity position, along with an undrawn revolving credit facility, indicate a healthy ability to meet financial obligations.

Next Steps

• Continue to invest significantly in research and development to evolve and extend the capabilities of the portfolio.
• Expand global presence and grow sales headcount to increase reach in key growth sectors.
• Complete the acquisition of CyberArk Software Ltd., expected during the second half of fiscal 2026.
• Integrate acquired companies and assets, including IBM QRadar and Protect AI, into existing platforms.
• Develop the 10.4 acres of land adjacent to headquarters to accommodate future expansion, though the speed of this development has slowed.
• Monitor and respond to evolving technological and market developments, including in AI, mobility, virtualization, and cloud computing.
• Address potential legal proceedings, including the ongoing appeals in the Centripetal Networks, Inc. lawsuit and the upcoming trial for Eire OG Innovations.

Key Dates

Recommendation

Palo Alto Networks demonstrates strong underlying business momentum with significant revenue growth, particularly in its high-margin subscription and support segments, and impressive increases in NGS ARR and RPO. The strategic acquisitions of IBM QRadar, Protect AI, and the pending CyberArk deal position the company for expanded market leadership and enhanced platform capabilities in the rapidly growing cybersecurity sector. While net income was impacted by a prior-year tax benefit, operational profitability and free cash flow generation remain robust. The company's focus on AI-powered innovation and platform consolidation addresses critical customer needs and industry trends. Despite competitive pressures and geopolitical risks, the company's strategic direction and financial health warrant a positive outlook for long-term investors.

Keywords

Cybersecurity, Network Security, Cloud Security, AI Security, Security Operations, SASE, Next-Generation Firewall, Cortex, Prisma, Unit 42, CyberArk Acquisition, Software as a Service, Enterprise Security, Threat Intelligence, Risk Management, PANW