PANW: Palo Alto Is About to Stop Telling You What's Growing

Palo Alto Networks reported fiscal Q3 this week. The headline numbers were the kind that lift price targets at over twenty firms: revenue +31% year-over-year, next-generation security ARR +60%, an explicit declaration that the demand environment has improved. The market narrative cleaned up quickly — cybersecurity is participating in the AI-infrastructure spending cycle, and Palo Alto's platform is winning consolidation.

Pull the optics apart, and a different picture emerges — one with a real but smaller signal underneath, and a disclosure decision that is about to make that signal harder to track.

The +31% headline is bought

The reported 31% revenue growth includes a partial quarter of CyberArk and Chronosphere. Strip both acquisitions out and the underlying business grew approximately 14% — versus 15-16% in the prior two pre-deals quarters. On recognized-revenue terms, that is a deceleration, not an acceleration.

The "next-gen security ARR +60%" line is constructed the same way. CyberArk alone contributes more than $1.2 billion of ARR at the closing date. The organic next-gen book grew approximately 28% year-over-year — flat with the prior quarter, and below the 30%+ pace it ran a year earlier.

So on what shareholders actually own as recognized revenue today, the business is not accelerating. It is softening at the margin while management commentary leads on the M&A-flattered consolidated numbers.

But there is a real bookings signal underneath

The forensically interesting part is what is happening one layer up the funnel — in the forward-looking, leading-indicator metrics that precede revenue by one to three quarters in this kind of subscription/contract business.

Several of these moved up in the same quarter:

• Organic net-new next-gen security ARR — the metric management itself describes as its single best leading indicator — accelerated to +18% year-over-year, up from +11% in the prior quarter and +12% in fiscal Q4 2025.
• Organic current RPO (the slice of contracted backlog expected to convert to revenue within twelve months) accelerated to ~17%, up from 15-16%.
• Next-generation firewall bookings grew approximately 40% year-over-year — the strongest hardware quarter in a decade, independently corroborated by a competitor's print the following week.
• SASE ARR sustained +40%.
• Prisma AIRS, the AI-security product launched fewer than four quarters ago, tripled customer count from approximately 100 to 300.

A coherent cluster of forward indicators turning up at the same time is a real demand signal — particularly when several of those same indicators were flat or decelerating a year ago. Bookings precede revenue. If these hold, recognized revenue eventually catches up.

So the underlying business may, in fact, be inflecting. Just not at the magnitude or in the line items the headline narrative is selling, and not in the quarter the headline implies.

The disclosure decision that should give you pause

Here is the part that should sit uncomfortably with anyone trying to verify what is actually happening.

Management announced — without leading on it — that it will retire the split between organic and acquired growth in future quarters. Going forward, the company intends to report combined growth rates only. The reasoning given is that as M&A integration matures, the split becomes "less meaningful."

That is a defensible position in isolation. It is also, in this specific quarter, the moment the split has become the most meaningful it has ever been. The acquired contribution this quarter is large enough to flip a decelerating organic recognized-revenue line into a 31% accelerating consolidated headline. Removing the disclosure precisely as it begins doing the heaviest work is a management choice with a directional consequence — for the next four quarters, readers will be unable to back out from any press release whether the organic business is accelerating, holding, or decelerating.

This is the second piece of forensic information. The first was the organic deceleration itself. The second is the change in how that fact will be reported.

The profitability picture went the other way

Worth recording, because it tends to get lost when the topline beats: operating margin contracted approximately 320 basis points sequentially to 27.1%. Non-GAAP EPS declined 17.5% sequentially. The company posted a GAAP net loss. Stock-based compensation ran at roughly 17% of revenue. Approximately 100 million-plus new shares were issued in connection with the transactions.

A real demand inflection that requires materially lower margins and meaningful dilution to capture is a different investment than a real demand inflection at scale leverage. The first quarter of post-deal economics here is consistent with the former.

What I'm watching from here

Three things will update this read over the next two-to-three quarters:

1. Whether organic net-new ARR sustains +18% or above — validating the bookings inflection as durable rather than as a one-quarter, partly price- and datacenter-cycle-driven bump. (Management raised firewall prices ~10% in April; some of the +40% NGFW bookings YoY is that.)
2. Whether next-generation firewall bookings hold the +40% pace through the back half. Datacenter refresh cycles do not run indefinitely, and management itself flagged on the call that the current strength will eventually "come to roost."
3. Whether organic disclosure is reintroduced when results justify it, or quietly retired for the duration. The second outcome will tell you something — about how this company wants to be measured.