Chronosphere and a Move Into ObservabilityThin moat

Palo Alto Networks (PANW) — moat facet

Palo Alto paid about 18 times ARR for Chronosphere, betting that security and monitoring data will be bought together.

Chronosphere took Palo Alto into a market next to security: observability, the monitoring of software systems and their data. The deal was announced in November 2025 with total consideration of $3.35 billion including replacement awards, for a company with ARR of "over $160 million as of the end of September 2025"1. It closed on 29 January 20262.

Observability ARR ($M)160+Chronosphere, Sep 2025500+Palo Alto observability, Jul 2026Chronosphere announcement; Q4 FY2026 call via Yahoo Finance; booked price 2,951 in the 10-K
ARR tripled on paper; the price was 18 times the start.

Palo Alto booked it at $2,951 million: $2,842 million of cash and $109 million of replacement awards3. That price was about 18 times the ARR disclosed at announcement4.

The logic is that security operations and observability collect the same kind of data, logs and telemetry from every system, and a customer paying two vendors to store it may prefer one. Chronosphere feeds Cortex, the security operations platform.

The early results are strong. Management said observability ARR "more than doubled following the Chronosphere acquisition and exceeded $500 million"5. Part of that came in one step: the fourth quarter included a nine-figure benefit from a large AI model customer moving to Chronosphere from an incumbent vendor6.

The difference between the announced and booked prices was smaller than for CyberArk. Chronosphere was announced at $3.35 billion including replacement awards7 and booked at $2,951 million8, because it was paid mostly in cash rather than in shares whose value moved.

The bet is a genuine extension of the platform, but into a market with established rivals. Observability ARR ended the year above $500 million9. A figure that stops growing once the one-off migration is in the base would mean the fourth-quarter jump was a single customer, not a trend.

Moat trajectory: Widening

Observability ARR above $500M, more than doubled.

The number that tests this moat
Reported
Observability ARR
Above $500M (Q4 FY2026)

The size of the monitoring business; a stall once the one-off migration is in the base would mean one customer, not a trend.

Source: Q4 FY2026 call highlights (Yahoo Finance) ↗
⚠ Threats to the moat
⚠ THREAT 01
Datadog, Dynatrace and Elastic Were There First
Palo Alto's observability business competes with Datadog, Dynatrace and Elastic, and depends heavily on usage that can move.
References
  1. ReportedThe deal was announced in November 2025 with total consideration of $3.35 billion including replacement awards, for a company with ARR of "over $160 million as of the end of September 2025".
    Palo Alto Networks press release announcing the agreement to acquire Chronosphere, Form 8-K exhibit 99.2 - total consideration of $3.35 billion and Chronosphere ARR of over $160 million. — November 2025 · publ. 19 November 2025 · source ↗
  2. ReportedIt closed on 29 January 2026.
    Palo Alto Networks press release on completing the acquisition of Chronosphere, 29 January 2026. — January 2026 · publ. 29 January 2026 · source ↗
  3. ReportedPalo Alto booked it at $2,951 million: $2,842 million of cash and $109 million of replacement awards.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  4. Moat Explorer calcThat price was about 18 times the ARR disclosed at announcement.
    Moat Explorer calculation from Palo Alto Networks' reported figures ($ millions unless stated; fiscal years end 31 July). Growth: revenue FY2026 11,480 / 9,221.5 - 1 = 24.5%; FY2025 9,221.5 / 8,027.5 - 1 = 14.9%; FY2024 8,027.5 / 6,892.7 - 1 = 16.5%; FY2023 25.3%; FY2022 29.3%; FY2021 24.9%; FY2020 17.5%; FY2024 to FY2026 11,480 / 8,027.5 - 1 = 43%; compound FY2015-FY2026 (11,480 / 928.1)^(1/11) - 1 = 25.7%, about 26%. By type FY2026: product 2,280 / 1,801.9 - 1 = 26.5%; subscription 6,239 / 4,974.4 - 1 = 25.4%; support 2,961 / 2,445.2 - 1 = 21.1%. Product FY2025 12.4%, FY2024 1,603.3 / 1,578.4 - 1 = 1.6%, FY2020 1,064.2 / 1,096.2 - 1 = -2.9%. Subscription FY2017 53.7%, FY2019 36.2%, FY2021 35.1%, FY2023 31.4%, FY2024 25.6%, FY2025 18.8%. Support FY2022 29.3%, FY2023 23.7%, FY2024 13.0%, FY2025 9.4%. Compound FY2015-FY2026: subscription (6,239 / 212.7)^(1/11) - 1 = 36.0%; support (2,961 / 222.7)^(1/11) - 1 = 26.5%; product (2,280 / 492.7)^(1/11) - 1 = 14.9%. Product outgrew subscription in FY2026 (26.5% against 25.4%), which it did not in any year FY2016-FY2025. Organic: FY2026 (11,480 - 930) / 9,221 - 1 = 14.4%; Q4 acquisition revenue 930 - 388 = 542; Q4 (3,410 - 542) / 2,536 - 1 = 13.1%, about 13%; pro forma 12,312 / 10,486 - 1 = 17.4%; FY2027 guidance 14.15 / 12.312 - 1 = 14.9%, about 15%. Margins: gross margin FY2026 8,077 / 11,480 = 70.4% (FY2025 6,769.9 / 9,221.5 = 73.4%; FY2024 5,968.3 / 8,027.5 = 74.3%); Q4 GAAP 2,304 / 3,410 = 67.6%. Product gross margin (2,280 - 568) / 2,280 = 75.1% (FY2025 (1,801.9 - 413) / 1,801.9 = 77.1%); subscription and support (9,200 - 2,835) / 9,200 = 69.2% (FY2025 (7,419.6 - 2,038) / 7,419.6 = 72.5%). Operating margin 695 / 11,480 = 6.1% (FY2025 1,242.9 / 9,221.5 = 13.5%); non-GAAP 3,356 / 11,480 = 29.2% (FY2025 2,652 / 9,221.5 = 28.8%); Q4 non-GAAP 1,011 / 3,410 = 29.6%; gap 3,356 - 695 = 2,661. R&D 2,552 / 11,480 = 22.2%; sales and marketing 3,931 / 11,480 = 34.2%; capital expenditure 440 / 11,480 = 3.8%. Tax 229 / (307 + 229 = 536) = 42.7%. Mix: product share 492.7 / 928.1 = 53.1% (FY2015), 2,280 / 11,480 = 19.9% (FY2026); subscription 212.7 / 928.1 = 22.9%, 6,239 / 11,480 = 54.3%; support 222.7 / 928.1 = 24.0%, 2,961 / 11,480 = 25.8%; one point of share 1% x 11,480 = 115. Recurring share 435.4 / 928.1 = 46.9% (FY2015), 1,393.8 / 2,273.6 = 61.3% (FY2018), 3,135.8 / 4,256.1 = 73.7% (FY2021), 6,424.2 / 8,027.5 = 80.0% (FY2024). Subscription and support per dollar of product 435.4 / 492.7 = 0.88 (FY2015), 1,393.8 / 879.8 = 1.58 (FY2018), 3,135.8 / 1,120.3 = 2.80 (FY2021), 6,424.2 / 1,603.3 = 4.01 (FY2024), 9,200 / 2,280 = 4.04 (FY2026). Hardware about 10% x 11,480 = about 1,150, about 50% of product. NGS ARR 9.10 / 11.48 = 79% of revenue. United States 7,108 / 11,480 = 61.9% (FY2016 901.8 / 1,378.5 = 65.4%). Q4 share of year 3,410 / 11,480 = 29.7%, about 30%. Prisma AIRS ARR 100 / 11,480 = under 1%. ARR and RPO: Q3 acquired ARR 1.6 / 8.1 = 20%, about a fifth; Q3 organic 8.1 - 1.6 = 6.5; Q3 acquired RPO 1.8 / 18.4 = 10%; FY2023 NGS ARR 4.2 / 1.43 = about 2.9; FY2025 growth 5.6 / 4.2 - 1 = 33%; Q1 FY2027 net new 9.54 - 9.10 = 0.44 to 9.56 - 9.10 = 0.46 billion; FY2030 target (20 / 9.1)^(1/4) - 1 = 21.8% a year; RPO / revenue 21.2 / 11.48 = 1.85; RPO due in 12 months 1.7 / 3.1 = 55% (FY2019), 2.2 / 4.3 = 51% (FY2020), 3.1 / 5.9 = 53% (FY2021), 4.1 / 8.2 = 50% (FY2022), 5.1 / 10.6 = 48% (FY2023), 5.9 / 12.7 = 46% (FY2024), 7.0 / 15.8 = 44% (FY2025), 9.3 / 21.2 = 44% (FY2026); RPO beyond 12 months 21.2 - 9.3 = 11.9 billion; Idira guidance 1.5 / 1.26 - 1 = 19%; Network and AI Security FY2025 8.35 / 1.17 = about 7.14 billion. Revenue from prior deferred 6.2 / 5.5 - 1 = 13%. Cash, deferred revenue and stock pay: free cash flow margin 4,113 / 11,480 = 35.8%; share-based compensation (cash flow) 1,774 / 11,480 = 15.5%; 1,774 / 1,295 - 1 = 37%; 1,774 / 4,113 = 43%; free cash flow after stock pay 4,113 - 1,774 = 2,339, 2,339 / 11,480 = 20.4%, 2,339 / 306,540 = 0.76%; free cash flow 4,113 / 306,540 = 1.3% and 4,113 / 27,492 = 15%. Stock pay share of revenue FY2016 392.8 / 1,378.5 = 28.5%, FY2020 658.4 / 3,408.4 = 19.3%, FY2024 1,076 / 8,027.5 = 13.4%, FY2025 1,295 / 9,221.5 = 14.0%. 10-K share-based compensation 1,815 / 1,079 - 1 = 68%. Equity plan (26.1 + 24.3) / 818 = 6%. Net cash 2,514 + 557 + 4,835 - 1,774 = 6,132; cash and investments 2,514 + 557 + 4,835 = 7,906, about 7.9 billion. Deferred revenue 1,582.1 + 1,306.6 = 2,888.7 (FY2019); 2,741.9 + 2,282.1 = 5,024.0 (FY2021); 4,674.6 + 4,621.8 = 9,296.4 (FY2023); 6,302.2 + 6,449.7 = 12,751.9 (FY2025); 7,747 + 7,009 = 14,756 (FY2026); 14,756 / 11,480 = 1.29 times; 2,888.7 / 2,899.6 = about one year (FY2019); growth 14,756 / 12,751.9 - 1 = 15.7%; excluding CyberArk (14,756 - 776) / 12,751.9 - 1 = 9.6%. Billings FY2025 9,221.5 + (12,751.9 - 11,480.5) = 10,493, 10,493 / 10,208.1 - 1 = 2.8%; FY2026 11,480 + (14,756 - 12,752) - 776 = about 12,708, 12,708 / 10,493 - 1 = 21%; February 2024 guidance cut 10.7 - 10.1 = 0.6 billion. Acquisitions: fiscal 2019 378.1 + 474.2 + 158.2 + 292.9 + 82.7 + 36.8 + 103.1 = 1,526; fiscal 2020 144.1 + 66.4 = 210.5; fiscal 2021 797.2 + 227.7 + 156.9 + 27.0 = 1,209; fiscal 2024 255.4 + 458.6 = 714; fiscal 2025 1,143 + 635 = 1,778; fiscal 2026 2,951 + 21,061 + 231 + 117 = 24,360, about 24.4 billion; all twenty-two FY2019-FY2026 including Cider 198.3 = 29,996, about 30.0 billion; FY2026 against FY2019-FY2025 24,360 / 5,636 = 4.3 times; after year end 325 + 500 = 825; AI security 635 + 231 + 117 = 983. CyberArk shares 18,488 / 112 = about 165 a share; 25,000 - 21,061 = about 3.9 billion; 112 x 374.74 = about 42.0 billion; 112 / 818 = 14%. Chronosphere 2,951 / 160 = about 18 times ARR. Goodwill and intangibles (22,010 + 7,017) / 48,460 = 60%; other assets 48,460 - 29,027 = 19,433. Headcount 21,921 - 4,223 = 17,698, 17,698 / 16,068 - 1 = 10%. Revenue per employee 928.1 / 2,637 = 0.35; 9,221.5 / 16,068 = 0.57; 11,480 / 21,921 = 0.52. Convertible loss Q1-Q3 562 - 524 = 38. Distributors: FY2019 31.8 + 22.1 + 10.7 + 10.0 = 74.6%; FY2021 33.2 + 12.2 + 10.6 = 56.0%; FY2023 25.0 + 12.8 + 11.9 = 49.7%; FY2024 21.2 + 13.2 + 13.2 + 11.4 = 59.0%; FY2025 18.8 + 14.4 + 11.0 = 44.2%; FY2026 15 + 15 = 30%; largest 34.4% (FY2020) to 15% (FY2026); receivables FY2019 29.9 + 18.9 + 14.2 = 63.0%. Valuation: market value over fiscal revenue at calendar year-end 15.13 / 0.928 = 16.3 (2015), 11.47 / 1.3785 = 8.3 (2016), 42.19 / 5.5015 = 7.7 (2022), 92.98 / 6.8927 = 13.5 (2023), 119.40 / 8.0275 = 14.9 (2024), 128.39 / 9.2215 = 13.9 (2025); 306.54 / 11.48 = 26.7; 306.54 / 0.307 = 998; 374.74 / 3.84 = 97.6; market value against Fortinet 306.54 / 130.12 = 2.4, against CrowdStrike 306.54 / 267.43 = 1.15; analyst target 395.70 / 374.74 - 1 = 6% - valuation, cash flow, stock pay, deferred revenue, billings and acquisitions. — FY2015-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in Palo Alto Networks' Forms 10-K and results releases, the Q4 FY2026 earnings call and market data; operands shown in the source line.
  5. ReportedManagement said observability ARR "more than doubled following the Chronosphere acquisition and exceeded $500 million".
    Yahoo Finance summary of the Palo Alto Networks fourth-quarter fiscal 2026 call - XSIAM, Prisma AIRS and observability ARR, platformizations, Idira deals and hardware share of revenue. — Q4 FY2026 · publ. September 2026 · source ↗
  6. ReportedPart of that came in one step: the fourth quarter included a nine-figure benefit from a large AI model customer moving to Chronosphere from an incumbent vendor.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  7. ReportedChronosphere was announced at $3.35 billion including replacement awards and booked at $2,951 million, because it was paid mostly in cash rather than in shares whose value moved.
    Palo Alto Networks press release announcing the agreement to acquire Chronosphere, Form 8-K exhibit 99.2 - total consideration of $3.35 billion and Chronosphere ARR of over $160 million. — November 2025 · publ. 19 November 2025 · source ↗
  8. ReportedChronosphere was announced at $3.35 billion including replacement awards and booked at $2,951 million, because it was paid mostly in cash rather than in shares whose value moved.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - acquisition notes: CyberArk, Chronosphere and other purchase accounting, and pro forma results. — FY2026 · publ. 10 September 2026 · source ↗
  9. ReportedObservability ARR ended the year above $500 million.
    Yahoo Finance summary of the Palo Alto Networks fourth-quarter fiscal 2026 call - XSIAM, Prisma AIRS and observability ARR, platformizations, Idira deals and hardware share of revenue. — Q4 FY2026 · publ. September 2026 · source ↗
Sources
Generated September 26, 2026