✦ XSIAM and the Automated Security Operations CenterNarrow moat

Palo Alto Networks (PANW) — the future bets

XSIAM's ARR rose 70% to more than $700 million, helped by customers bought from IBM.

XSIAM is Palo Alto's attempt to automate the security operations centre, where analysts sift alerts and respond to attacks. It is part of Cortex, and it is growing fast: "XSIAM ended the year with more than $700 million in ARR, up 70%, and exceeded 1,000 customers"1.

XSIAM, fiscal 2026XSIAM ARRmore than 700 million dollars, up 70%XSIAM customersmore than 1,000QRadar SaaS assets bought from IBM1,143 million dollars bookedQ4 FY2026 call via Yahoo Finance; Palo Alto Form 10-K FY2026
The product has not yet caught up with what was paid to feed it.

The business was helped by an acquisition. In fiscal 2025 Palo Alto bought IBM's QRadar SaaS assets for $1,143 million, including $649 million of contingent consideration2, with the stated aim to "help accelerate the growth of our Cortex XSIAM business"3.

The security operations centre is where a security platform earns its stickiness. It holds the data from every other product, and an automated system that learns a customer's environment becomes more valuable the longer it runs. Cortex as a whole had revenue of $1.92 billion in fiscal 20264.

The competition is intense: CrowdStrike, Microsoft and the observability companies all want this position. XSIAM's advantage is that it can ingest data from Palo Alto's firewalls and cloud products natively.

The IBM deal still carries contingent payments tied to it: an undiscounted range of $0.3 billion to $0.5 billion through October 20285, a further cost of the bet that has yet to be paid.

XSIAM is the clearest test of whether Palo Alto can sell software platforms as well as it sells firewalls. Its ARR, above $700 million in fiscal 20266, is the measure; growth below 40% in fiscal 2027 would mean the product is maturing before it reaches the scale of the firewall business.

Moat trajectory: Widening

XSIAM ARR above $700M, +70%; more than 1,000 customers.

The number that tests this moat
Reported
XSIAM ARR
Above $700M, +70% (Q4 FY2026)

The automated security operations bet; growth below 40% would mean it is maturing early.

Source: Q4 FY2026 call highlights (Yahoo Finance) ↗
References
  1. ReportedIt is part of Cortex, and it is growing fast: "XSIAM ended the year with more than $700 million in ARR, up 70%, and exceeded 1,000 customers".
    Yahoo Finance summary of the Palo Alto Networks fourth-quarter fiscal 2026 call - XSIAM, Prisma AIRS and observability ARR, platformizations, Idira deals and hardware share of revenue. — Q4 FY2026 · publ. September 2026 · source ↗
  2. ReportedIn fiscal 2025 Palo Alto bought IBM's QRadar SaaS assets for $1,143 million, including $649 million of contingent consideration, with the stated aim to "help accelerate the growth of our Cortex XSIAM business".
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  3. ReportedIn fiscal 2025 Palo Alto bought IBM's QRadar SaaS assets for $1,143 million, including $649 million of contingent consideration, with the stated aim to "help accelerate the growth of our Cortex XSIAM business".
    Palo Alto Networks Form 10-K for fiscal 2024 - billings for fiscal 2022-2024, remaining performance obligations, free cash flow, distributor concentration and the Dig, Talon and IBM QRadar transactions. — FY2024 · publ. September 2024 · source ↗
  4. ReportedCortex as a whole had revenue of $1.92 billion in fiscal 2026.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  5. ReportedThe IBM deal still carries contingent payments tied to it: an undiscounted range of $0.3 billion to $0.5 billion through October 2028, a further cost of the bet that has yet to be paid.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  6. ReportedIts ARR, above $700 million in fiscal 2026, is the measure; growth below 40% in fiscal 2027 would mean the product is maturing before it reaches the scale of the firewall business.
    Yahoo Finance summary of the Palo Alto Networks fourth-quarter fiscal 2026 call - XSIAM, Prisma AIRS and observability ARR, platformizations, Idira deals and hardware share of revenue. — Q4 FY2026 · publ. September 2026 · source ↗
Sources
Generated September 26, 2026