Buying the Next PlatformNarrow moat

Palo Alto Networks (PANW) — moat facet

Palo Alto buys young security companies and sells their products to its huge installed base, and in 2026 it paid more for one than for all the others combined.

Palo Alto's second moat is its ability to buy companies and sell their products to its installed base. Since fiscal 2019 it has booked about $30.0 billion of acquisitions1, and fiscal 2026 alone added CyberArk for $21,061 million and Chronosphere for $2,951 million2.

Goodwill at fiscal year-end ($M)4,567FY202522,010FY2026Palo Alto Q4 FY2026 release, balance sheet
Goodwill up nearly fivefold in a year.

The model works because of the base. A young security company with a good product needs years to reach large customers; Palo Alto can sell that product to almost all of the Fortune 100 and a majority of the Global 20003 within months. The acquired product is worth more inside Palo Alto than outside it, which lets the company pay a premium and still earn a return.

The evidence is in the platforms. Cortex, built partly on acquisitions including IBM's QRadar customers4, reached $1.92 billion of revenue in fiscal 20265. Idira, the CyberArk business, had $1.26 billion pro forma6. Observability ARR passed $500 million after Chronosphere7.

The cost is on the balance sheet and the income statement. Goodwill rose to $22,010 million from $4,567 million and intangibles to $7,017 million from $763 million8. The two large acquisitions contributed $930 million of revenue and an operating loss of $797 million after closing9. And CyberArk was paid for with 112 million new shares10.

The deals also brought integration costs that the company disclosed separately. CyberArk transaction costs were $56 million, and a workforce plan after the deal had a total estimated cost of $60 million11. Acquisition costs across the year were $295 million12, excluded from the non-GAAP figures the company emphasises.

The market has so far rewarded the buying. The market value at the July fiscal year-end rose from $115,954 million in 2025 to $270,441 million in 202613, more than the value of the shares issued for CyberArk. Investors have treated the acquisitions as adding more than they cost, which is the view the operating results have yet to confirm.

The buying is a skill, but it is not free and it is not a substitute for growth from within. The acquired businesses lost $797 million in fiscal 202614. If they are still losing money in fiscal 2027 after a full year of integration, the platform is being bought at a price the installed base cannot earn back.

Moat trajectory: Holding steady

Goodwill $22.0bn; acquired businesses lost $797M after closing.

The number that tests this moat
Moat Explorer calc
Goodwill and intangibles share of assets
60% (31 July 2026)

How much of the company is purchase price; the share rising further would mean the platform is still being bought.

How it's calculated: Goodwill ($22,010M) plus intangible assets ($7,017M) divided by total assets ($48,460M), Q4 FY2026 release.
Source: Moat Explorer calculation from Palo Alto filings ↗
Aspects of the moat
DIG DEEPER 01
CyberArk: $25 Billion Announced, $21.1 Billion Booked
Palo Alto announced CyberArk at $25 billion and booked it at $21.1 billion, because it paid in shares that had fallen in the meantime.
DIG DEEPER 02
Chronosphere and a Move Into Observability
Palo Alto paid about 18 times ARR for Chronosphere, betting that security and monitoring data will be bought together.
DIG DEEPER 03
Twenty-Two Deals, $30 Billion
Palo Alto has spent about $30 billion on twenty-two acquisitions since 2019, four-fifths of it in the latest year.
DIG DEEPER 04
Israel, Now the Second Home
CyberArk gave Palo Alto its largest research centre outside Silicon Valley, in Israel.
⚠ Threats to the moat
⚠ THREAT 01
Goodwill and Intangibles at 60% of Assets
Sixty percent of Palo Alto's assets are now goodwill and intangibles, and the return on that capital fell to 1.8%.
⚠ THREAT 02
Acquired Revenue, Acquired Losses
CyberArk and Chronosphere added $930 million of revenue to Palo Alto and lost $797 million doing it.
References
  1. Moat Explorer calcSince fiscal 2019 it has booked about $30.0 billion of acquisitions, and fiscal 2026 alone added CyberArk for $21,061 million and Chronosphere for $2,951 million.
    Moat Explorer calculation from Palo Alto Networks' reported figures ($ millions unless stated; fiscal years end 31 July). Growth: revenue FY2026 11,480 / 9,221.5 - 1 = 24.5%; FY2025 9,221.5 / 8,027.5 - 1 = 14.9%; FY2024 8,027.5 / 6,892.7 - 1 = 16.5%; FY2023 25.3%; FY2022 29.3%; FY2021 24.9%; FY2020 17.5%; FY2024 to FY2026 11,480 / 8,027.5 - 1 = 43%; compound FY2015-FY2026 (11,480 / 928.1)^(1/11) - 1 = 25.7%, about 26%. By type FY2026: product 2,280 / 1,801.9 - 1 = 26.5%; subscription 6,239 / 4,974.4 - 1 = 25.4%; support 2,961 / 2,445.2 - 1 = 21.1%. Product FY2025 12.4%, FY2024 1,603.3 / 1,578.4 - 1 = 1.6%, FY2020 1,064.2 / 1,096.2 - 1 = -2.9%. Subscription FY2017 53.7%, FY2019 36.2%, FY2021 35.1%, FY2023 31.4%, FY2024 25.6%, FY2025 18.8%. Support FY2022 29.3%, FY2023 23.7%, FY2024 13.0%, FY2025 9.4%. Compound FY2015-FY2026: subscription (6,239 / 212.7)^(1/11) - 1 = 36.0%; support (2,961 / 222.7)^(1/11) - 1 = 26.5%; product (2,280 / 492.7)^(1/11) - 1 = 14.9%. Product outgrew subscription in FY2026 (26.5% against 25.4%), which it did not in any year FY2016-FY2025. Organic: FY2026 (11,480 - 930) / 9,221 - 1 = 14.4%; Q4 acquisition revenue 930 - 388 = 542; Q4 (3,410 - 542) / 2,536 - 1 = 13.1%, about 13%; pro forma 12,312 / 10,486 - 1 = 17.4%; FY2027 guidance 14.15 / 12.312 - 1 = 14.9%, about 15%. Margins: gross margin FY2026 8,077 / 11,480 = 70.4% (FY2025 6,769.9 / 9,221.5 = 73.4%; FY2024 5,968.3 / 8,027.5 = 74.3%); Q4 GAAP 2,304 / 3,410 = 67.6%. Product gross margin (2,280 - 568) / 2,280 = 75.1% (FY2025 (1,801.9 - 413) / 1,801.9 = 77.1%); subscription and support (9,200 - 2,835) / 9,200 = 69.2% (FY2025 (7,419.6 - 2,038) / 7,419.6 = 72.5%). Operating margin 695 / 11,480 = 6.1% (FY2025 1,242.9 / 9,221.5 = 13.5%); non-GAAP 3,356 / 11,480 = 29.2% (FY2025 2,652 / 9,221.5 = 28.8%); Q4 non-GAAP 1,011 / 3,410 = 29.6%; gap 3,356 - 695 = 2,661. R&D 2,552 / 11,480 = 22.2%; sales and marketing 3,931 / 11,480 = 34.2%; capital expenditure 440 / 11,480 = 3.8%. Tax 229 / (307 + 229 = 536) = 42.7%. Mix: product share 492.7 / 928.1 = 53.1% (FY2015), 2,280 / 11,480 = 19.9% (FY2026); subscription 212.7 / 928.1 = 22.9%, 6,239 / 11,480 = 54.3%; support 222.7 / 928.1 = 24.0%, 2,961 / 11,480 = 25.8%; one point of share 1% x 11,480 = 115. Recurring share 435.4 / 928.1 = 46.9% (FY2015), 1,393.8 / 2,273.6 = 61.3% (FY2018), 3,135.8 / 4,256.1 = 73.7% (FY2021), 6,424.2 / 8,027.5 = 80.0% (FY2024). Subscription and support per dollar of product 435.4 / 492.7 = 0.88 (FY2015), 1,393.8 / 879.8 = 1.58 (FY2018), 3,135.8 / 1,120.3 = 2.80 (FY2021), 6,424.2 / 1,603.3 = 4.01 (FY2024), 9,200 / 2,280 = 4.04 (FY2026). Hardware about 10% x 11,480 = about 1,150, about 50% of product. NGS ARR 9.10 / 11.48 = 79% of revenue. United States 7,108 / 11,480 = 61.9% (FY2016 901.8 / 1,378.5 = 65.4%). Q4 share of year 3,410 / 11,480 = 29.7%, about 30%. Prisma AIRS ARR 100 / 11,480 = under 1%. ARR and RPO: Q3 acquired ARR 1.6 / 8.1 = 20%, about a fifth; Q3 organic 8.1 - 1.6 = 6.5; Q3 acquired RPO 1.8 / 18.4 = 10%; FY2023 NGS ARR 4.2 / 1.43 = about 2.9; FY2025 growth 5.6 / 4.2 - 1 = 33%; Q1 FY2027 net new 9.54 - 9.10 = 0.44 to 9.56 - 9.10 = 0.46 billion; FY2030 target (20 / 9.1)^(1/4) - 1 = 21.8% a year; RPO / revenue 21.2 / 11.48 = 1.85; RPO due in 12 months 1.7 / 3.1 = 55% (FY2019), 2.2 / 4.3 = 51% (FY2020), 3.1 / 5.9 = 53% (FY2021), 4.1 / 8.2 = 50% (FY2022), 5.1 / 10.6 = 48% (FY2023), 5.9 / 12.7 = 46% (FY2024), 7.0 / 15.8 = 44% (FY2025), 9.3 / 21.2 = 44% (FY2026); RPO beyond 12 months 21.2 - 9.3 = 11.9 billion; Idira guidance 1.5 / 1.26 - 1 = 19%; Network and AI Security FY2025 8.35 / 1.17 = about 7.14 billion. Revenue from prior deferred 6.2 / 5.5 - 1 = 13%. Cash, deferred revenue and stock pay: free cash flow margin 4,113 / 11,480 = 35.8%; share-based compensation (cash flow) 1,774 / 11,480 = 15.5%; 1,774 / 1,295 - 1 = 37%; 1,774 / 4,113 = 43%; free cash flow after stock pay 4,113 - 1,774 = 2,339, 2,339 / 11,480 = 20.4%, 2,339 / 306,540 = 0.76%; free cash flow 4,113 / 306,540 = 1.3% and 4,113 / 27,492 = 15%. Stock pay share of revenue FY2016 392.8 / 1,378.5 = 28.5%, FY2020 658.4 / 3,408.4 = 19.3%, FY2024 1,076 / 8,027.5 = 13.4%, FY2025 1,295 / 9,221.5 = 14.0%. 10-K share-based compensation 1,815 / 1,079 - 1 = 68%. Equity plan (26.1 + 24.3) / 818 = 6%. Net cash 2,514 + 557 + 4,835 - 1,774 = 6,132; cash and investments 2,514 + 557 + 4,835 = 7,906, about 7.9 billion. Deferred revenue 1,582.1 + 1,306.6 = 2,888.7 (FY2019); 2,741.9 + 2,282.1 = 5,024.0 (FY2021); 4,674.6 + 4,621.8 = 9,296.4 (FY2023); 6,302.2 + 6,449.7 = 12,751.9 (FY2025); 7,747 + 7,009 = 14,756 (FY2026); 14,756 / 11,480 = 1.29 times; 2,888.7 / 2,899.6 = about one year (FY2019); growth 14,756 / 12,751.9 - 1 = 15.7%; excluding CyberArk (14,756 - 776) / 12,751.9 - 1 = 9.6%. Billings FY2025 9,221.5 + (12,751.9 - 11,480.5) = 10,493, 10,493 / 10,208.1 - 1 = 2.8%; FY2026 11,480 + (14,756 - 12,752) - 776 = about 12,708, 12,708 / 10,493 - 1 = 21%; February 2024 guidance cut 10.7 - 10.1 = 0.6 billion. Acquisitions: fiscal 2019 378.1 + 474.2 + 158.2 + 292.9 + 82.7 + 36.8 + 103.1 = 1,526; fiscal 2020 144.1 + 66.4 = 210.5; fiscal 2021 797.2 + 227.7 + 156.9 + 27.0 = 1,209; fiscal 2024 255.4 + 458.6 = 714; fiscal 2025 1,143 + 635 = 1,778; fiscal 2026 2,951 + 21,061 + 231 + 117 = 24,360, about 24.4 billion; all twenty-two FY2019-FY2026 including Cider 198.3 = 29,996, about 30.0 billion; FY2026 against FY2019-FY2025 24,360 / 5,636 = 4.3 times; after year end 325 + 500 = 825; AI security 635 + 231 + 117 = 983. CyberArk shares 18,488 / 112 = about 165 a share; 25,000 - 21,061 = about 3.9 billion; 112 x 374.74 = about 42.0 billion; 112 / 818 = 14%. Chronosphere 2,951 / 160 = about 18 times ARR. Goodwill and intangibles (22,010 + 7,017) / 48,460 = 60%; other assets 48,460 - 29,027 = 19,433. Headcount 21,921 - 4,223 = 17,698, 17,698 / 16,068 - 1 = 10%. Revenue per employee 928.1 / 2,637 = 0.35; 9,221.5 / 16,068 = 0.57; 11,480 / 21,921 = 0.52. Convertible loss Q1-Q3 562 - 524 = 38. Distributors: FY2019 31.8 + 22.1 + 10.7 + 10.0 = 74.6%; FY2021 33.2 + 12.2 + 10.6 = 56.0%; FY2023 25.0 + 12.8 + 11.9 = 49.7%; FY2024 21.2 + 13.2 + 13.2 + 11.4 = 59.0%; FY2025 18.8 + 14.4 + 11.0 = 44.2%; FY2026 15 + 15 = 30%; largest 34.4% (FY2020) to 15% (FY2026); receivables FY2019 29.9 + 18.9 + 14.2 = 63.0%. Valuation: market value over fiscal revenue at calendar year-end 15.13 / 0.928 = 16.3 (2015), 11.47 / 1.3785 = 8.3 (2016), 42.19 / 5.5015 = 7.7 (2022), 92.98 / 6.8927 = 13.5 (2023), 119.40 / 8.0275 = 14.9 (2024), 128.39 / 9.2215 = 13.9 (2025); 306.54 / 11.48 = 26.7; 306.54 / 0.307 = 998; 374.74 / 3.84 = 97.6; market value against Fortinet 306.54 / 130.12 = 2.4, against CrowdStrike 306.54 / 267.43 = 1.15; analyst target 395.70 / 374.74 - 1 = 6% - valuation, cash flow, stock pay, deferred revenue, billings and acquisitions. — FY2015-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in Palo Alto Networks' Forms 10-K and results releases, the Q4 FY2026 earnings call and market data; operands shown in the source line.
  2. ReportedSince fiscal 2019 it has booked about $30.0 billion of acquisitions, and fiscal 2026 alone added CyberArk for $21,061 million and Chronosphere for $2,951 million.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  3. ReportedA young security company with a good product needs years to reach large customers; Palo Alto can sell that product to almost all of the Fortune 100 and a majority of the Global 2000 within months.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - Item 1 business and Item 7 MD&A: platforms, customers, channels, employees, revenue by type and geography. — FY2026 · publ. 10 September 2026 · source ↗
  4. ReportedCortex, built partly on acquisitions including IBM's QRadar customers, reached $1.92 billion of revenue in fiscal 2026.
    Palo Alto Networks Form 10-K for fiscal 2024 - billings for fiscal 2022-2024, remaining performance obligations, free cash flow, distributor concentration and the Dig, Talon and IBM QRadar transactions. — FY2024 · publ. September 2024 · source ↗
  5. ReportedCortex, built partly on acquisitions including IBM's QRadar customers, reached $1.92 billion of revenue in fiscal 2026.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  6. ReportedIdira, the CyberArk business, had $1.26 billion pro forma.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  7. ReportedObservability ARR passed $500 million after Chronosphere.
    Yahoo Finance summary of the Palo Alto Networks fourth-quarter fiscal 2026 call - XSIAM, Prisma AIRS and observability ARR, platformizations, Idira deals and hardware share of revenue. — Q4 FY2026 · publ. September 2026 · source ↗
  8. ReportedGoodwill rose to $22,010 million from $4,567 million and intangibles to $7,017 million from $763 million.
    Palo Alto Networks fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - income statement, non-GAAP reconciliation, balance sheet, cash flow, Next-Generation Security ARR, remaining performance obligations and fiscal 2027 guidance - balance sheet and cash flow statement. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  9. ReportedThe two large acquisitions contributed $930 million of revenue and an operating loss of $797 million after closing.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  10. ReportedAnd CyberArk was paid for with 112 million new shares.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  11. ReportedCyberArk transaction costs were $56 million, and a workforce plan after the deal had a total estimated cost of $60 million.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  12. ReportedAcquisition costs across the year were $295 million, excluded from the non-GAAP figures the company emphasises.
    Palo Alto Networks fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - income statement, non-GAAP reconciliation, balance sheet, cash flow, Next-Generation Security ARR, remaining performance obligations and fiscal 2027 guidance - fourth-quarter and full-year results, balance sheet and cash flow. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  13. ReportedThe market value at the July fiscal year-end rose from $115,954 million in 2025 to $270,441 million in 2026, more than the value of the shares issued for CyberArk.
    Palo Alto Networks ratios by fiscal year - market capitalisation at fiscal year-end: $49,728M (July 2022), $76,451M (2023), $105,148M (2024), $115,954M (2025), $270,441M (July 2026). — FY2022-FY2026 · publ. September 2026 · source ↗
  14. ReportedThe acquired businesses lost $797 million in fiscal 2026.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
Sources
Generated September 26, 2026