How Palo Alto Networks Makes its Money: Revenue Breakdown

Key Takeaways

• Palo Alto Networks generated $8.0 billion in FY2024 revenue — up +14.3% year-over-year — driven by subscription growth (+21%) as the hardware-to-software transition accelerates
• Three platforms, one strategy: Strata (network/NGFW), Prisma (cloud security), and Cortex (AI-powered security operations) form a unified “platformization” play targeting enterprise security consolidation
• Next-Generation Security ARR: $4.2B (+43%) — the key forward-looking metric; covers Prisma Cloud and Cortex cloud subscriptions growing far faster than the overall company
• Gross margin: 68.8%; GAAP operating margin: 11.3% ($0.9B); non-GAAP operating margin: ~27% — the gap is ~$1.4B of stock-based compensation that runs through GAAP expenses
• Net income: $1.3B; Free cash flow: $3.1B (~39% FCF margin) — exceptionally cash-generative for a company still investing heavily in growth
• The platformization strategy — offering free trial access to platform modules to drive consolidation — caused a stock selloff in Feb 2024 but is designed to create deeper, stickier customer relationships and superior long-term economics
• Remaining Performance Obligations: $12.7B (+22%) — future contracted revenue providing multi-year visibility
• CrowdStrike is the most direct competitive threat — also pursuing platform consolidation, but leading from endpoint security rather than network security

How Does Palo Alto Networks Make its Money?

Palo Alto Networks (ticker: PANW) is the world’s largest pure-play cybersecurity company by revenue. It provides enterprise security across three interconnected platforms: Strata (network security, built on its next-generation firewall heritage), Prisma (cloud security), and Cortex (AI-powered security operations). The company’s central strategy is “platformization” — persuading enterprises to consolidate their fragmented security tool stacks onto a single Palo Alto platform, replacing the typical 30–70 point-solution vendors that large enterprises use with an integrated set of Palo Alto products.

Founded in 2005 by Nir Zuk (a veteran of Check Point Software and NetScreen Technologies), Palo Alto invented the next-generation firewall (NGFW) — a breakthrough that allowed firewalls to identify traffic by application and user identity rather than just port and protocol. The NGFW disrupted the firewall market and funded the company’s IPO in 2012. CEO Nikesh Arora (former president of SoftBank and executive at Google) joined in 2018 and transformed the company from a hardware firewall company into a multi-cloud software and AI security platform through a series of aggressive acquisitions.

In FY2024 (fiscal year ending July 31, 2024), Palo Alto generated $8.0 billion in revenue with a 68.8% gross margin and $3.1 billion in free cash flow — establishing itself as one of the most financially formidable pure-play cybersecurity businesses in existence.

Palo Alto Networks (PANW) Business Model

Three Platforms, One P&L

Palo Alto Networks is a SaaS and platform ecosystem business built on an installed base of enterprise security technology. Its three platforms address distinct but interconnected enterprise security challenges:

Strata — Network Security (the Foundation)

Strata is Palo Alto’s legacy NGFW business, now evolved into a comprehensive network security platform. The PA-series hardware appliances (from small branch-office units to large data-center chassis) and VM-series/CN-series (virtualized) firewalls run PAN-OS — Palo Alto’s proprietary operating system. Customers purchase the hardware, then subscribe to add-on services that run in Palo Alto’s cloud:

• Threat Prevention — intrusion prevention (IPS), command-and-control blocking
• URL Filtering — web category and reputation-based access controls
• WildFire — cloud-based sandbox that detonates suspected malware in isolation and generates global threat signatures within minutes of first detection
• DNS Security — blocks domain-generation algorithm (DGA) malware and DNS tunneling
• SD-WAN, IoT Security, OT Security — industry-specific add-ons for operational technology environments

The NGFW installed base is the foundational growth engine: every firewall placed in a customer environment is a multi-year revenue stream of subscription add-ons and support contracts. Strata also includes Prisma SASE (secure access service edge) — cloud-delivered network security for remote and branch workers, combining zero trust network access (ZTNA), secure web gateway, CASB, and SD-WAN.

Prisma — Cloud Security

Prisma Cloud is Palo Alto’s CNAPP (Cloud-Native Application Protection Platform) — software that secures cloud workloads, containers, Kubernetes, serverless functions, and cloud infrastructure configurations across AWS, Amazon, Azure (Microsoft), and Google Cloud environments. It protects the entire “shift-left to shield-right” lifecycle:

• Code security (IaC scanning via Bridgecrew acquisition)
• Cloud security posture management (CSPM) — detecting misconfigurations
• Cloud workload protection — runtime protection for VMs, containers, serverless
• Identity security — cloud infrastructure entitlement management (CIEM)
• Data security — sensitive data discovery across cloud storage

Prisma Cloud was assembled through acquisitions: Twistlock ($410M, 2019, container security), PureSec (serverless, 2019), RedLock (CSPM, 2018), Bridgecrew ($156M, 2021, IaC security), Cider Security ($300M, 2022, software supply chain), and Dig Security (data security, 2023).

Cortex — AI-Powered Security Operations

Cortex is Palo Alto’s AI-driven security operations suite — designed to replace the fragmented combination of SIEM, SOAR, XDR, and threat intelligence tools that most enterprise security operations centers (SOCs) cobble together:

• Cortex XSIAM — “Extended Security Intelligence and Automation Management.” An AI-native SOC platform that ingests telemetry from across the enterprise and applies machine learning to detect threats, automate investigation workflows, and respond at machine speed. Positioned as a replacement for legacy SIEM platforms (notably Splunk, now owned by Cisco). A single XSIAM deployment can replace 15–25 point tools.
• Cortex XDR — Extended detection and response for endpoints, network, and cloud telemetry
• Cortex XSOAR — Security orchestration, automation, and response (acquired from Demisto, $560M, 2019)
• Cortex Xpanse — Attack surface management; discovers internet-exposed assets (acquired from Expanse, ~$800M, 2020)

Unit 42 — Palo Alto’s threat intelligence and incident response consulting arm. Unit 42 researchers produce industry-leading threat intelligence, and the consulting practice responds to major breaches at enterprise customers. This generates services revenue but primarily serves as a brand-building and intelligence-gathering function that feeds product improvement.

The Platformization Strategy

The central insight behind platformization: enterprise security is broken. The average large enterprise uses 50–70 different security tools from 30–40 different vendors. This fragmentation creates alert fatigue (too many disconnected alerts), coverage gaps (the seams between tools), and massive operational overhead (managing dozens of vendor relationships, contracts, and integrations).

Palo Alto’s bet: customers who consolidate onto the Palo Alto platform reduce total cost of ownership, improve security efficacy, and simplify operations — making the platform sticky and enabling Palo Alto to capture more security spend per customer.

In FY2024, Palo Alto accelerated this strategy by offering free access to additional platform modules to customers already using one product — accepting near-term billing headwinds (lower billings growth as free modules delayed revenue recognition) in exchange for faster platform consolidation. The February 2024 earnings call where this was disclosed caused one of the largest single-day stock drops in the company’s history (~$30B market cap erased). The investment thesis: locking a customer into five Palo Alto products is exponentially more valuable than four customers each using one.

Palo Alto Networks (PANW) Competitors

CrowdStrike is Palo Alto’s most strategically important competitor and the only company pursuing a directly comparable platformization strategy from a position of equal enterprise credibility. CrowdStrike leads from endpoint security (its Falcon platform) and is expanding aggressively into cloud security (Falcon Cloud Security), identity, and security operations — the same territory Palo Alto is fighting to own. See the CrowdStrike vs. Palo Alto Networks comparison for a detailed breakdown of where each platform leads.

Fortinet is Palo Alto’s primary competitor in the network security and NGFW market. Fortinet’s FortiGate firewall is the high-volume, lower-ASP alternative to Palo Alto’s PA-series — Fortinet dominates mid-market and price-sensitive enterprise segments with its vertically integrated ASIC-based architecture, which delivers high throughput at lower cost. Fortinet competes less aggressively in cloud security and AI-driven SOC.

Cisco is both a competitor and a reference customer type. Cisco competes in firewall (Cisco Secure Firewall, formerly Firepower), SASE (Umbrella, Duo Security), and now Splunk (acquired for $28B in 2024) — which competes directly with Cortex XSIAM for the SIEM/SOC platform market. Cisco’s security portfolio is large but historically fragmented; the Splunk acquisition is Cisco’s attempt to build a unified security operations platform.

Microsoft is the “surprise” competitor that has grown into one of the largest cybersecurity vendors by leveraging its existing enterprise relationships (Azure, M365). Microsoft Defender for Cloud competes with Prisma Cloud; Microsoft Sentinel competes with Cortex XSIAM; Microsoft Entra competes in identity. Microsoft offers many security capabilities at minimal incremental cost to M365 E5 subscribers — making it a “good enough” alternative that CISOs consider when budget pressure intensifies.

Cloudflare competes specifically in SASE and network security. Cloudflare One (ZTNA, SWG, CASB, FWaaS) competes with Prisma SASE and targets mid-market and developer-centric enterprises. Cloudflare’s network scale and performance differentiate it at the network edge.

IBM (QRadar) competes in the SIEM/SOC market where Cortex XSIAM is targeting. IBM QRadar has a massive installed base of large enterprise and government customers — Palo Alto’s pitch to these customers is that XSIAM delivers superior AI-native threat detection and automation vs. the legacy QRadar architecture.

Zscaler competes directly with Prisma SASE in zero trust network access and secure web gateway. Zscaler was the original cloud-native SASE pioneer and holds a strong position in large enterprise ZTNA deployments — particularly for replacing VPN for remote workers.

Wiz (private, valued at ~$12B) is a cloud security posture management (CSPM) company that has grown rapidly and competes with Prisma Cloud for cloud security budgets. Wiz’s agentless approach and rapid deployment are competitive differentiators vs. Prisma Cloud’s more comprehensive but complex platform.

Revenue Breakdown

All values approximate. Palo Alto Networks’ fiscal year ends July 31.

The revenue table understates growth velocity in the cloud-native businesses because of how Palo Alto accounts for revenue. The more useful forward-looking metrics:

NGS ARR covers Prisma Cloud and Cortex subscriptions — the highest-growth, highest-margin portion of the business. Its 43% growth rate vs. the overall company’s 14% topline growth demonstrates that the platform transition is proceeding: the legacy firewall hardware business is growing slowly while the cloud and AI security platforms are growing rapidly.

Segment Deep-Dives

Strata: Network Security (the Revenue Foundation)

Strata encompasses the NGFW hardware and virtual appliances and all the cloud-delivered subscription services that run on top. Product revenue (hardware, $1.6B, flat YoY) is the seed that plants recurring subscription revenue: a customer who buys a PA-5450 chassis for their data center will subscribe to WildFire, Threat Prevention, and URL Filtering — and renew those subscriptions annually for the 5–7 year life of the hardware. This installed-base dynamic makes product revenue flat in unit terms but highly valuable as a subscription engine.

The SASE extension (Prisma SASE) addresses the structural shift to hybrid work: employees working from home or branch offices can’t rely on backhauling all traffic through the corporate data center firewall. Prisma SASE delivers the same security policy enforcement from Palo Alto’s cloud infrastructure, wherever the user is. This is a high-growth market — enterprises replacing aging MPLS networks and VPNs with cloud-delivered security and networking.

Competitive position: Palo Alto and Fortinet split the large-enterprise NGFW market. Gartner consistently places both as “Leaders” in the Magic Quadrant for Network Firewalls. Palo Alto commands a price premium (reflecting superior software/AI capabilities and broader platform) while Fortinet competes effectively on throughput-per-dollar. In SASE, Zscaler is the most credible pure-play competitor; Cloudflare competes for the cloud-native segment.

Prisma: Cloud Security (High-Growth, Competitive)

Prisma Cloud addresses the fundamental security challenge created by cloud adoption: security teams lost visibility and control when applications moved from on-premises data centers (where the perimeter firewall protected everything) to public cloud environments (where each workload, container, and serverless function is independently exposed). Prisma Cloud provides the unified visibility and control layer across multi-cloud environments.

The CNAPP category is one of the fastest-growing in enterprise security — driven by the explosion of cloud-native development and the proliferation of container and Kubernetes deployments. Prisma Cloud’s breadth (covering code, infrastructure, workload, identity, and data security) is its primary differentiator vs. point solutions. Its challenge: breadth creates complexity, and Wiz’s simpler agentless approach has been winning deals against Prisma’s more comprehensive but harder-to-deploy platform.

Competitive position: Prisma Cloud holds a leadership position but faces intense competition from Microsoft (included in E5 licenses), CrowdStrike (Falcon Cloud Security), and Wiz (fastest-growing private competitor). The market is large enough for multiple winners, but pricing pressure from Microsoft’s bundling is the primary headwind.

Cortex: AI Security Operations (The Strategic Bet)

Cortex XSIAM is Palo Alto’s most ambitious strategic bet — an AI-native platform designed to replace the entire legacy SIEM and SOC tooling stack. The legacy SIEM market is dominated by Splunk (now owned by Cisco) and IBM QRadar. Both platforms were designed for log storage and search; they were not built for AI-driven automated detection and response.

XSIAM’s pitch to enterprise CISOs: replace your SIEM + SOAR + XDR + TIP + UEBA stack (potentially 15–20 tools) with one platform. Ingest telemetry at scale, apply AI to reduce the alert volume 98%+, and automate the response workflows that analysts currently handle manually. Early customer case studies show XSIAM deployments delivering 75–80% reduction in mean time to detect (MTTD) and mean time to respond (MTTR).

The challenge: displacing a SIEM is a 12–18 month enterprise sales and deployment process. XSIAM is a land-and-expand motion that takes time to show up in revenue. NGS ARR growing 43% suggests the motion is working, but the full revenue recognition will lag the bookings momentum.

Palo Alto Networks (PANW) Income Statement

All values approximate. Financial data sourced from Palo Alto Networks SEC Filings.

The most important takeaway from the income statement: the GAAP vs. non-GAAP gap is enormous. Approximately $1.4B in stock-based compensation flows through GAAP operating expenses annually — making the GAAP operating margin (11.3%) appear far lower than the cash economics (non-GAAP: ~27%). For GAAP vs. non-GAAP context, stock-based compensation is a real cost (it dilutes shareholders) but is also a non-cash expense that does not affect cash generation. Free cash flow of $3.1B on $8.0B revenue (39% FCF margin) is the most useful profitability metric — it captures real cash economics without the timing distortions of GAAP accounting for SBC and deferred revenue.

Palo Alto Networks (PANW) Key Financial Metrics

Key Metric Observations

NGS ARR growing 43% vs. total revenue growing 14% is the most important divergence to understand. It means the platform transition is accelerating: Prisma Cloud and Cortex (the cloud-native, high-growth businesses) are growing three times faster than the overall company. As these platforms grow to a larger share of revenue, the total company growth rate should re-accelerate — IF the platformization conversion from free trials to paid happens on schedule.

FCF margin of 39% is exceptional and somewhat counterintuitive for a “growth” company. Palo Alto is simultaneously growing at 14%+, investing heavily in R&D and sales, AND generating 39 cents of free cash flow for every dollar of revenue. This reflects the structural economics of software: after initial R&D investment, each incremental subscription dollar costs very little to deliver. The business generates cash faster than it can deploy it into growth.

RPO of $12.7B (+22%) vs. revenue of $8.0B means 1.6 years of future revenue is already under contract. This is one of the most powerful financial characteristics an enterprise software company can have — it makes near-term revenue highly predictable and reduces the risk of revenue surprise. The 22% RPO growth also confirms that enterprise customers are making longer-term commitments to the platform.

Is Palo Alto Networks (PANW) Profitable?

Yes — both on a GAAP basis (since FY2024) and on a non-GAAP/cash basis for several years prior.

• GAAP net income: $1.3B (16% net margin) — first full year of significant GAAP profitability; net income tripled from $0.4B in FY2023
• Non-GAAP operating margin: ~27% — the cash-economics view, backing out ~$1.4B in non-cash SBC
• Free cash flow: $3.1B (~39% FCF margin) — extraordinary for a company this size in cybersecurity
• GAAP operating margin: 11.3% — low by software standards but expanding rapidly (+420 bps YoY); will continue expanding as revenue scales vs. a partially-fixed opex base

The path to GAAP margin parity with non-GAAP: as revenue grows faster than SBC grants (which are partly fixed and partly tied to headcount growth), the SBC/revenue ratio should decline over time, compressing the GAAP/non-GAAP gap. At 20%+ total revenue growth, this compression would happen meaningfully within 3–4 years.

Where Does Palo Alto Networks Spend its Money?

Cost of Revenue (~$2.5B, 31.2% of revenue)

Covers: cloud infrastructure costs to deliver cloud-based subscription services (WildFire, Prisma Cloud, Cortex XSIAM), hardware manufacturing costs for PA-series appliances, amortization of acquired intangibles (from the many acquisitions — Twistlock, Demisto, Expanse, Bridgecrew, etc.), and professional services costs for implementation and training. The subscription/support COGS are primarily cloud infrastructure and personnel; hardware COGS includes physical components and contract manufacturing.

Research & Development (~$1.9B, ~24% of revenue)

The largest operating expense — covering the engineering teams building Cortex XSIAM, Prisma Cloud new modules, PAN-OS releases, AI/ML model development, and new product categories. R&D at 24% of revenue reflects the multi-platform investment required: maintaining three distinct platform suites (Strata, Prisma, Cortex) simultaneously while competing against CrowdStrike, Microsoft, and Cisco requires significant parallel engineering investment.

Sales & Marketing (~$2.1B, ~26% of revenue)

Enterprise security selling is relationship-intensive and long-cycle. PANW’s sales force covers direct enterprise accounts (named accounts with dedicated reps), channel partners (VARs, MSSPs, distributors), and the partner ecosystem that delivers implementation services. The 26% of revenue on S&M is high but declining as a percentage — reflecting operating leverage as revenue scales.

General & Administrative (~$0.6B, ~7.5% of revenue)

Legal (IP litigation is endemic in enterprise security), finance, HR, executive management, and corporate infrastructure. The $28B Cisco acquisition of Splunk and ongoing M&A activity in cybersecurity require significant legal and strategic advisory activity.

Palo Alto Networks vs. Competitors

Palo Alto is the largest pure-play by revenue but not the fastest-growing — CrowdStrike is growing nearly 3x as fast from a smaller base. Fortinet has the best GAAP margins (its CEO Fortinet Ken Xie controls SBC tightly) and the best price/performance firewall, but limited cloud security depth. Palo Alto’s competitive differentiator is breadth — it is the only company with credible, enterprise-scale platforms in all three categories (network, cloud, SOC) simultaneously.

Palo Alto Networks History and Milestones

Palo Alto Networks (PANW): What to Watch

1. Platformization Conversion: Free Trials to Paid Revenue The most important near-term catalyst. In FY2024, Palo Alto gave away platform module access to hundreds of enterprise customers in exchange for platform commitments. Those free periods are rolling off in FY2025–FY2026, converting to full paid subscriptions. If the conversion rate is high (customers who tried the platform choose to pay for it), total billings and revenue should re-accelerate significantly. If conversion rates disappoint, the FY2024 revenue sacrifice will have been in vain. Quarterly billings growth and NGS ARR acceleration are the metrics to watch.

2. NGS ARR Growth Rate Sustainability NGS ARR grew 43% in FY2024 — an exceptional rate from a $4.2B base. Sustaining 40%+ growth as the base scales is mathematically challenging. The question is where the growth rate settles: if NGS ARR decelerates to 25–30% growth on a larger base, that still represents excellent business performance. A deceleration to below 20% would raise questions about platform adoption pace. Each quarterly earnings call now features intense analyst scrutiny of NGS ARR growth and RPO growth as leading indicators of platform trajectory.

3. Cortex XSIAM Adoption: The SIEM Replacement Opportunity Cortex XSIAM is targeting one of the largest untapped opportunities in enterprise security: the $4–5B SIEM market dominated by legacy platforms from Cisco (Splunk) and IBM (QRadar). Early XSIAM deployments show compelling results, but the sales cycle is long (12–18 months) and displace-a-SIEM decisions require executive-level commitment. The Cisco-Splunk acquisition adds Cisco’s distribution muscle to the competition — but it also validates the thesis that the SIEM market is large enough to fight for. Watch for XSIAM customer count disclosures and any case study evidence of large-scale displacements of legacy SIEM platforms.

4. CrowdStrike Platformization Race CrowdStrike is pursuing an almost identical platformization strategy from its endpoint security beachhead — expanding into cloud security, identity, and security operations. Both companies are competing for the same enterprise consolidation opportunity. The race is not zero-sum (the market is large enough for multiple platforms), but the key question is which platform a CISO chooses as their “primary” when they decide to consolidate. CrowdStrike’s faster revenue growth (+33% vs. PANW’s +14%) reflects momentum; Palo Alto’s larger revenue and greater breadth (stronger in network security and SASE) reflects legacy strength.

5. Microsoft Competition: The “Good Enough” Threat Microsoft is perhaps the most underestimated competitive threat in enterprise security. Microsoft Defender (endpoint), Sentinel (SIEM), Entra (identity), and Defender for Cloud (CNAPP) are included in the M365 E5 license that many enterprises already pay for. When budget pressure forces IT consolidation, a CISO can dramatically simplify their vendor portfolio by going “all-in Microsoft” — accepting potentially inferior security in exchange for cost savings and operational simplicity. This dynamic is most acute in the Prisma Cloud vs. Microsoft Defender for Cloud competition. Monitoring whether PANW’s enterprise customer retention rates and platform expansion within existing accounts hold despite Microsoft’s bundling is critical.

6. Gross Margin Expansion as Hardware Mix Shrinks Product (hardware) revenue at ~20% of total is dragging the blended gross margin — hardware carries ~45% gross margin vs. 75–80%+ for subscription/support. As hardware revenue grows slower than subscriptions (hardware is essentially flat; subscriptions growing 21%), the hardware mix percentage naturally declines. Each percentage point of hardware-to-subscription mix shift adds approximately 30–40 basis points to blended gross margin. If subscriptions grow to 65% of revenue, gross margins could approach 72–74% — creating meaningful incremental profit dollars at scale.

7. GAAP Profitability: SBC Normalization as a Re-Rating Catalyst Stock-based compensation at ~$1.4B (~18% of revenue) is the primary reason Palo Alto’s GAAP operating margin (11%) appears far below its non-GAAP margin (~27%). As revenue scales faster than SBC grants, the ratio should decline — compressing the GAAP/non-GAAP gap. A sustained path toward 15–18% GAAP operating margin would re-rate the stock from a “non-GAAP story” to a company that GAAP-focused institutional investors (pension funds, index-tracking strategies) view as unambiguously profitable. FCF already tells this story ($3.1B), but GAAP EPS matters for valuation.

8. Remaining Performance Obligations Conversion Pace RPO of $12.7B (+22%) means 1.6x annual revenue is under contract for future recognition. The pace at which this converts to recognized revenue — driven by contract duration, ramp schedules, and usage-based components — determines near-term revenue predictability. Any RPO growth deceleration (below 20%) would be a warning sign that new enterprise commitments are slowing. Sustained RPO growth above 20% would signal ongoing demand despite macroeconomic pressure on enterprise IT budgets.

Palo Alto Networks (PANW) Financial Summary

Palo Alto Networks (PANW) is the world’s largest pure-play cybersecurity company by revenue, generating $8.0 billion in FY2024 — up +14.3% year-over-year — with subscription revenue of $4.6B (+21%) leading growth as the business transitions from hardware firewall seller to cloud-delivered SaaS and platform ecosystem provider. Gross margin of 68.8% reflects the subscription mix; free cash flow of $3.1B (~39% FCF margin) makes Palo Alto one of the most cash-generative cybersecurity businesses globally.

The defining strategic bet is platformization — consolidating enterprise security onto three integrated platforms (Strata for network, Prisma for cloud, Cortex for AI security operations) rather than competing as a point solution. Next-Generation Security ARR of $4.2B (+43%) and Remaining Performance Obligations of $12.7B (+22%) demonstrate platform traction. The operating leverage story — opex growing 7% vs. revenue growing 14% — drove GAAP operating income up +80% to $0.9B.

The primary risk is execution: converting the FY2024 platformization free trials to paid subscription revenue on the timeline management projected, while competing against CrowdStrike (fastest-growing), Microsoft (most bundled), and Cisco (now armed with Splunk’s $28B SIEM platform).

Related companies include CrowdStrike, Cloudflare, Fortinet, Cisco, Microsoft, IBM, and Amazon.

Frequently Asked Questions

How does Palo Alto Networks make money? Through subscriptions (58%, $4.6B, +21% YoY), support contracts (22%, $1.8B), and hardware firewall sales (20%, $1.6B, flat). Total FY2024: $8.0B revenue (+14.3%). The cloud-native business (Prisma Cloud + Cortex) — tracked via NGS ARR at $4.2B (+43%) — is growing three times faster than the hardware-based business.

Is Palo Alto Networks profitable? Yes. FY2024: $1.3B GAAP net income (16% margin), $3.1B free cash flow (39% FCF margin), 11.3% GAAP operating margin. Non-GAAP operating margin is ~27% — the gap is ~$1.4B in non-cash stock-based compensation.

What is platformization? Palo Alto’s strategy to convince enterprises to consolidate their 30–70 security tools onto a single Palo Alto platform. In FY2024, PANW gave away free access to additional modules to drive faster adoption, accepting near-term revenue headwinds for long-term platform lock-in and superior economics.

What are PANW’s three platforms? Strata (network security — NGFW hardware and cloud-delivered services), Prisma (cloud security — CNAPP for workload, container, and cloud infrastructure protection), and Cortex (AI-driven security operations — XSIAM, XDR, XSOAR replacing legacy SIEM/SOC tools).

What is Palo Alto’s gross margin? 68.8% in FY2024. Subscription/support carries 75–80%+ margins; hardware ~45%. As hardware shrinks as a revenue share, the blended margin will expand toward 72–74%.

Who are Palo Alto Networks’ biggest competitors? CrowdStrike (closest platformization competitor), Fortinet (NGFW rival), Microsoft (bundled security across Defender/Sentinel/Entra), Cisco (acquired Splunk for SIEM), and Cloudflare (SASE competitor).

What is NGS ARR? Next-Generation Security Annual Recurring Revenue — covers Prisma Cloud and Cortex subscription contracts. FY2024: $4.2B (+43%). This is the primary growth metric because it captures the fastest-growing, highest-margin platform businesses separately from the slower-growing legacy firewall business.

What is Palo Alto’s free cash flow? $3.1B in FY2024 (~39% FCF margin) — exceptional for a high-growth technology company. FCF is the most useful profitability metric for Palo Alto because it strips out non-cash SBC and deferred revenue timing effects that distort GAAP net income.