Palo Alto Networks Closes $25B CyberArk Deal, Completes Chronosphere Acquisition, and Eyes Tel Aviv Listing — All Before Tuesday's Earnings

Palo Alto Networks just closed the largest deal in its history — the $25 billion CyberArk acquisition — adding identity security as a platform pillar and announcing a Tel Aviv dual listing under the 'CYBR' ticker. With Q2 FY2026 earnings dropping Tuesday and NGS ARR expected near $6.1B, Nikesh Arora's platformization bet is entering its execution phase.

PANW · Information Technology · February 14, 2026

S&P 500 Position

The largest pure-play cybersecurity company in the S&P 500. Within Information Technology, it sits in the systems software sub-industry alongside peers like CrowdStrike, Fortinet, and Zscaler — though only PANW and FTNT are S&P 500 members. At ~$135B market cap, it's larger than many traditional IT incumbents. Its closest competitive neighbors are CrowdStrike (~$90B, endpoint/cloud), Fortinet (~$75B, network security), and Zscaler (~$30B, zero trust). Microsoft (~$3T) competes from above with bundled security, and Google/Wiz will compete from the cloud. Palo Alto's platform breadth after CyberArk is unmatched among pure-play security vendors.

Index Weight: ~0.27% | Rank: Approximately #65–75 by market cap in the S&P 500

Company Overview

Palo Alto Networks is executing the most aggressive consolidation strategy in cybersecurity history. In the span of three months, the company completed its $3.35 billion Chronosphere acquisition (closing January 29, 2026), closed the $25 billion CyberArk deal (February 11, 2026), and announced intent to dual-list on the Tel Aviv Stock Exchange. The CyberArk transaction — the largest the company has ever done — makes identity security a core pillar alongside network, cloud, and SecOps, giving Palo Alto coverage across every major attack surface. The TASE listing under the 'CYBR' ticker is a calculated tribute to CyberArk's Israeli heritage that also makes Palo Alto the largest company by market cap on the exchange. The platformization thesis that spooked investors in February 2024 (the stock dropped 28% in a single day when the company lowered billings guidance) has become the company's defining strategic advantage. Over 1,150 of Palo Alto's top 5,000 customers have now platformized, and the number of three-platform customers tripled year-over-year. The core bet: enterprises will consolidate fragmented security stacks onto a single vendor. Palo Alto is making that vendor choice easier by being the only player that can credibly span network firewalls, SASE, cloud-native protection, SIEM replacement (XSIAM), endpoint (XDR), AI security (Prisma AIRS), observability (Chronosphere), and now privileged access management (CyberArk). The technical moat is the shared data layer — when all telemetry flows through one platform, detection fidelity and automation velocity improve structurally. With Q2 FY2026 earnings arriving February 17, the market is watching for early CyberArk integration signals, XSIAM growth trajectory, and whether the company can maintain its 29–30% non-GAAP operating margins while absorbing two large acquisitions simultaneously. Founder Nir Zuk retired in August 2025, passing the CTO torch to longtime product chief Lee Klarich — a transition that has so far proceeded without disruption.

Products & Revenue

Palo Alto operates as a single reportable segment but generates revenue across three lines: Product (hardware appliances and perpetual software licenses), Subscription (cloud-delivered security services, SaaS subscriptions including Prisma Access, Cortex XSIAM, Prisma Cloud), and Support (maintenance and professional services). Subscriptions are the growth engine and dominant revenue contributor, accounting for roughly 54% of FY2025 revenue. The platformization strategy deliberately shifts customers from one-time product purchases to multi-year subscription bundles, compressing near-term billings growth while inflating NGS ARR and RPO. This is the financial architecture behind the company's $15.5 billion remaining performance obligation backlog.

Subscription Services (~54%): Cloud-delivered security subscriptions including Prisma Access (SASE), Prisma Cloud (CNAPP), Cortex XSIAM (AI-driven SOC), Cortex XDR (endpoint), Advanced Threat Prevention, DNS Security, IoT Security, and SaaS Security. This is where NGS ARR lives.

Support Services (~26%): Maintenance, updates, and professional services tied to hardware and software deployments. Includes Unit 42 incident response and consulting. Grows steadily with the installed base.

Product Revenue (~20%): Hardware firewall appliances (PA-Series next-gen firewalls) and perpetual software licenses. Increasingly shifting to software form factors — 56% of product revenue now comes from software. Includes VM-Series and CN-Series virtual firewalls for cloud.

Based on FY2025 10-K (fiscal year ended July 2025) and Q1 FY2026 earnings supplemental data. Subscription was 53.94% of FY2025 revenue per segment breakdown.

Leadership

Nikesh Arora

CEO since 2018. Former Google SVP/Chief Business Officer (2004–2014) and SoftBank President/COO (2014–2016). Holds a B.Tech in EE from IIT BHU, MS in Finance from Boston College, and MBA from Northeastern. Architected the platformization strategy that initially cratered the stock in 2024 but has since become the industry template — he's now executing the largest M&A spree in cybersecurity history with CyberArk ($25B) and Chronosphere ($3.35B).

Lee Klarich, Chief Product & Technology Officer, Board Member: Joined Palo Alto Networks in 2006, one year after founding. Succeeded founder Nir Zuk as CTO in August 2025. Leads all product and engineering organizations and sits on the board — the most technically powerful executive outside Arora.

Dipak Golechha, Chief Financial Officer: Manages the financial integration of two simultaneous large acquisitions (CyberArk and Chronosphere). Guided the company to 'Rule-of-50' status for five consecutive years, balancing growth with free cash flow margin expansion toward 40%.

Gonen Fink, EVP of Products, Cortex: Leads the Cortex product line including XSIAM, AgentiX, and Cortex Cloud — the fastest-growing products in the company's history. The Cortex franchise crossed $1 billion in ARR under his leadership.

Helmut Reisinger, CEO, EMEA & LATAM: Former CEO of Orange Business Services. Leads go-to-market across EMEA and Latin America, regions contributing ~32% of revenue. Holds a Ph.D. from Vienna University for Economics and Business.

The AI Angle

Building the autonomous SOC with Precision AI

Palo Alto's AI strategy is the most technically differentiated in cybersecurity. The company's proprietary system, Precision AI, integrates machine learning, deep learning, and generative AI across all three major platforms. Unlike competitors bolting LLM wrappers onto existing products, Palo Alto's AI is deeply embedded in the data path. Precision AI powers inline threat prevention in next-gen firewalls (detecting zero-day attacks without signatures), drives the analytics engine in XSIAM, and underpins the automated remediation workflows in Cortex Cloud. The company processes security telemetry from 70,000+ customers, creating a data flywheel that improves model accuracy at scale. The most significant AI product shipped is Cortex XSIAM, which first launched in 2022 and reached its 3.0 iteration in 2025. XSIAM replaces legacy SIEMs (Splunk, QRadar, etc.) with an AI-native platform that unifies XDR, SOAR, ASM, and analytics. It surpassed $1 billion in cumulative bookings in FY2025 — the fastest product to hit that mark in company history. Customers report MTTR reductions from days to minutes. In October 2025, Palo Alto launched Cortex AgentiX, an agentic AI platform built on 1.2 billion real-world playbook executions from a decade of SOAR automation. AgentiX deploys autonomous agents that can investigate, contain, and remediate threats across email, endpoint, and cloud without human intervention — with enterprise-grade guardrails and human-in-the-loop approval for high-impact actions. Separately, Prisma AIRS (AI Runtime Security) protects enterprises' own AI applications against prompt injection, data poisoning, and model theft. The build-vs-buy approach is pragmatic. The core Precision AI models are proprietary and trained on Palo Alto's massive security data corpus. AgentiX supports native Model Context Protocol (MCP) for LLM interoperability and 1,000+ pre-built integrations. The Chronosphere acquisition adds observability data into the AI data fabric — the thesis is that you can't secure what you can't see, and observability telemetry makes AI-driven detection more accurate. The Google Cloud partnership (deepened in December 2025) provides infrastructure for AI workloads while Palo Alto provides the security layer. The competitive risk is real. Microsoft bundles security with Office 365 at minimal incremental cost. CrowdStrike's Charlotte AI competes in the agentic SOC space. Google's Wiz acquisition ($32B, approved February 2026) creates a cloud-security juggernaut. But Palo Alto's advantage is breadth: no single competitor spans network, cloud, endpoint, identity, observability, and AI security on a unified data platform. CEO Arora has publicly stated his belief that the cybersecurity industry will converge to a handful of platform players within a decade — and he's spending $28+ billion in M&A to ensure Palo Alto is one of them.

Financial Snapshot

Revenue (TTM): $9.56B — TTM (ending Oct 31, 2025) | Net Income: $1.12B net income (GAAP)

Margins: Gross ~74%, non-GAAP operating ~29.5–30%, net 11.7% (GAAP), adjusted free cash flow margin 38–39%

Palo Alto has maintained 'Rule-of-50' status (revenue growth + FCF margin > 50%) for five consecutive years — a rare feat in enterprise software. The company is guiding FY2026 revenue of $10.50–10.54B (14% growth) with adjusted FCF margins of 38–39%, targeting 40%+ by FY2028. Capital allocation is acquisition-heavy right now: no share repurchases in recent quarters despite $1B remaining authorization. The $25B CyberArk deal (cash + stock) and $3.35B Chronosphere deal will meaningfully alter the balance sheet. Watch for integration cost impacts on operating margins over the next 2–3 quarters.

1-Year Performance

$166.95 current price. Over the past 12 months, PANW has returned approximately -5%, underperforming the S&P 500's ~10% gain over the same period.

The stock hit an all-time closing high of $221.38 on October 28, 2025, then sold off sharply — falling over 25% from peak to recent lows near $144. The decline was driven by broader market rotation out of high-multiple software names, CyberArk deal dilution concerns, and softening enterprise IT spending sentiment. The February 5 NextWave Partner Program announcement saw a 7.2% single-day decline on elevated volume. With earnings Tuesday (Feb 17), options markets are pricing in a significant move — the stock needs strong Q2 results and upbeat CyberArk integration commentary to reverse the downtrend.

Recent News

Fun Fact: Founder Nir Zuk was head of software development in IDF Unit 8200 — Israel's elite signals intelligence unit and the same military program that produced alumni who went on to found Check Point, Waze, and dozens of other Israeli tech companies. Before founding Palo Alto Networks, Zuk was one of the earliest employees at Check Point (where he helped build the stateful inspection firewall) and later an engineer at NetScreen Technologies. His core technical insight at Palo Alto was that firewalls should inspect traffic by application identity rather than port/protocol — a concept that seemed heretical in 2005 but became the foundation of the $9+ billion company. When Zuk retired in August 2025, the CTO baton passed to Lee Klarich, who joined as employee #50-ish in 2006 and has shipped every major product line the company has ever launched.