Palo Alto Networks Earnings Preview: All Eyes on ARR, RPO, and CyberArk Deal as Stock Tests Key Resistance

WATCH: Bitcoin $200K? The math behind the next crypto supercycle.

Palo Alto Networks (NASDAQ:PANW), one of the largest cybersecurity vendors in the world, is set to report fiscal fourth-quarter earnings after the close Monday. The company has evolved far beyond its roots in network firewalls, expanding into cloud security, security operations, and most recently identity protection with its $25 billion acquisition of CyberArk (CYBR). Under CEO Nikesh Arora, Palo Alto has pursued a “platformization” strategy—consolidating multiple security tools into unified platforms—that has helped drive multi-product deals, large enterprise wins, and growing recurring revenue. Yet the stock enters tonight’s print under pressure, trading around $177 and below key moving averages, leaving expectations somewhat tempered. An upside surprise could trigger a rally back toward resistance levels at $181 (20-day moving average) and $187 (200-day moving average), with the potential to fill a gap up to $191 if momentum builds.

Consensus expectations call for adjusted EPS of $0.89 on $2.5 billion in revenue. More than the headline numbers, however, investors will focus on forward guidance for fiscal 2026, remaining performance obligations (RPO), and next-generation security (NGS) annual recurring revenue (ARR). For the quarter, Palo Alto guided NGS ARR to land between $5.52 and $5.57 billion and RPO to come in at $15.3 billion, both key markers of future growth. Analysts at Guggenheim, Cantor, and Roth all flagged these as the central metrics to watch, with some cautioning that Street expectations for FY26 revenue growth and RPO may be too aggressive. Guggenheim in particular expects RPO to be fine near term but sees potential downside risk in the fiscal 2026 guide.

Recent partner checks also show mixed demand signals. Guggenheim reported that one partner exceeded expectations, four were in line, and two fell short, with pipeline commentary skewing cautious. Piper Sandler highlighted that elongated sales cycles and macro uncertainty are weighing on cybersecurity deal flow across the sector, with some peers guiding lower despite headline revenue beats. That makes Palo Alto’s performance on new ARR especially important: after seven consecutive declines last year, easier comparisons should allow FQ4 to show growth in new ARR. If achieved, it could reassure investors that demand momentum is stabilizing.

The CyberArk merger looms as a defining strategic move. Announced earlier this summer, the $25 billion deal brings identity security—a fast-growing segment worth an estimated $29 billion—into Palo Alto’s platform. Arora pitched the acquisition as filling one of the last remaining gaps in Palo Alto’s portfolio, complementing its firewall, SASE, and SecOps businesses. Analysts are split. Cantor and Deutsche Bank praised the transaction, citing synergies and long-term wallet-share expansion, while KeyBanc downgraded the stock, arguing identity is better served by independent specialists and warning about pricing pressure. The deal terms include a $1 billion termination fee if Palo Alto walks away and $750 million if CyberArk exits. Since the announcement, both PANW and CYBR shares are down roughly 8%, underperforming peers, as investors digest integration risk and valuation.

Last quarter’s results underscored the strength of Palo Alto’s broader strategy. Fiscal Q3 revenue grew 15% to $2.29 billion, with product revenue up 16% and subscription revenue up 18%. NGS ARR surged 34% year over year to $5.09 billion, driven by AI-powered XSIAM (security automation) and strong demand for SASE (Prisma Access), which saw ARR up 36%. Management highlighted more than 90 net new platformization deals, including a $90 million contract with a global consulting firm. Free cash flow came in at $578 million, with margins near 38%. The company reiterated its long-term goal of reaching $15 billion in ARR by 2030, underscoring confidence in platformization and AI-led innovation.

For tonight, the Street is also looking for commentary on firewall refresh cycles, which peers like Check Point and Fortinet reported as steady, and early traction in Prisma Access Secure Browser, which secures GenAI applications and browser-based workflows. XSIAM remains the fastest-growing product in company history, with ARR up more than 200% year over year, and investors will want updates on migration opportunities from legacy SIEM providers like IBM QRadar. Meanwhile, the shift to annual billing continues to weigh on short-term reported billings, but management has framed this as a long-term cash flow positive.

The technical setup adds another layer. Shares remain below their 20-day and 200-day moving averages, underscoring investor skepticism post-CyberArk. At the same time, valuations remain elevated, at roughly 28x EV/NTM free cash flow versus peers like Fortinet closer to 20x. That premium is harder to defend without clear evidence of sustained ARR and RPO growth. Still, sentiment is low enough that a solid beat-and-raise could trigger a relief rally, particularly if Palo Alto’s FY26 guide is conservative but not alarming.

In summary, expectations heading into Palo Alto’s report are subdued. Consensus looks achievable, with analysts broadly expecting revenue and NGS ARR in line with guidance. The wild card lies in the FY26 outlook and whether management tempers expectations to reflect tariff-driven cost pressures and longer sales cycles. Investors will also parse every word on the CyberArk merger for signals of strategic clarity and integration risk. With the stock in a technical downtrend but expectations low, Palo Alto has a chance to reset the narrative tonight. A beat on ARR and RPO, paired with steady guidance, could be enough to reclaim momentum and put shares back on track toward key resistance levels.