Palo Alto Networks PANW

> TIMING NOTE — read this before anything else. Palo Alto's fiscal year ends 31 July. It ended 2026-07-31, four days before this dive, and no results have been published. The next print is 2026-09-01 — 28 days away, outside the five-day banner window — and it is the fourth-quarter AND full-year fiscal 2026 report. That means the entire May-July 2026 quarter is unobserved: the first full quarter with CyberArk consolidated, historically the largest quarter of Palo Alto's year, and the quarter that sets initial fiscal-2027 guidance.

>

> The most recent hard quarter in this dive is therefore the quarter ended 30 April 2026, from the 10-Q filed 2026-06-03. Every trailing figure in this document — revenue, margin, earnings, cash — is at least three months old and does not include the fiscal fourth quarter. The stock, by contrast, is current to the 2026-08-04 close and has risen 98.5% in three months. The gap between what the price knows and what the filings show is the widest in this batch, and no number here should be read as though the fiscal year were closed.

Reference table

1. What the business is, and how the disclosure actually works

The 10-K opens plainly: "Palo Alto Networks, Inc. is a global cybersecurity provider and our vision is a world where each day is safer and more secure than the one before. We were incorporated in 2005 and are headquartered in Santa Clara, California." Chief executive Nikesh Arora; 16,068 employees at 31 July 2025, up from 15,289 a year earlier. Listed on NASDAQ since 20 July 2012. CUSIP 697435105, ISIN US6974351057.

One reportable segment — and that matters

The 10-K states the company has ONE reportable segment. There is no segment table to reconcile, no vanished division, and no taxonomy dispute. What the vendor's seg_prod block supplies is the 10-K's revenue-by-similar-products-and-services table, which is a revenue disaggregation, not a segment disclosure. Read as segments it would mislead; read as what it is, it reconciles exactly.

Revenue by product grouping (seg_prod, verified line by line against reported revenue):

The sums are exact. $4,974.4M + $2,445.2M + $1,801.9M = $9,221.5M, which is the reported fiscal-2025 revenue to the dollar. Fiscal 2024 sums to $8,027.5M, also exact. No double-counting, nothing missing, no reconciliation problem. This is one of the cleanest vendor-to-filing ties in the batch and it is worth recording as such.

One taxonomy break to flag: the fiscal-2014 to fiscal-2018 rows in seg_prod contain only Subscription and Support and maintenance with no Product line at all, so those years do NOT sum to revenue. The current three-way split begins in fiscal 2019. No figure in this dive uses a pre-2019 seg_prod row.

The mix tells the story of the business model. Subscription plus support was 80.4% of fiscal-2025 revenue and the 10-Q reports it at 80.2% of the April-2026 quarter ($2.4 billion of $3.0 billion), with product revenue at $594 million, 19.8% of the total, growing 31% year on year. Hardware firewalls are now a fifth of the company and shrinking as a share, and the 10-Q notes that product revenue itself now includes CyberArk's on-premise identity software licences — so even the "product" line is becoming software.

Geography (seg_geo, verified line by line):

Again exact. The three theatres sum to reported revenue in every year from fiscal 2019 forward. The mix is remarkably stable — Americas has held 67-69% for three years. The 10-Q's only geographic commentary for the April quarter is that "Revenue from the Americas, EMEA, and APAC increased... with the Americas contributing the highest increase in revenue due to its larger scale." Both seg_prod and seg_geo stop at fiscal 2025 — there is no fiscal-2026 mix anywhere in this file, and CyberArk will change it.

Customer concentration: the risk is in the channel, not the customer

This is the most under-appreciated disclosure in the 10-K and the vendor file cannot express it. Palo Alto sells through a two-tier indirect model — to distributors, who sell to resellers, who sell to end customers. The concentration therefore sits with the distributors:

> "For fiscal 2025, three distributors represented 10% or more of our total revenue, representing 18.8%, 14.4%, and 11.0% respectively. No single end-customer accounted for more than 10% of our total revenue in fiscal 2025, 2024, or 2023."

> "As of July 31, 2025, three distributors individually represented 10% or more of our gross accounts receivable, and in the aggregate represented 44.8% of our gross accounts receivable."

Three intermediaries carry 44.2% of revenue and 44.8% of receivables. The end-customer base is genuinely diversified — the 10-Q says customers in over 180 countries, "almost all of the Fortune 100 companies and a majority of the Global 2000" — so this is a working-capital and channel-relationship concentration rather than a demand concentration. It is still 44% of the company through three counterparties, and it is why trailing days-sales-outstanding is 118.5 days, extraordinarily high for a software business.

Competitors, per the 10-K's own four-category framing

• Large companies embedding security in their products: Cisco Systems, Microsoft, Alphabet.
• Independent security vendors: Check Point, Fortinet, CrowdStrike, Zscaler, Wiz.
• Startups and point-product vendors across various security areas.
• Public cloud vendors and startups offering private, public and hybrid cloud security.

Note what that list implies. Palo Alto's stated competitive threat is not one rival; it is simultaneously the hyperscale platforms bundling security for free and hundreds of venture-funded point vendors undercutting on features. The consolidation thesis in Section 7's knowledge base is a bet that the middle — the independent multi-product platform — wins that squeeze.

The acquisition programme, which is the real story of fiscal 2026

The 10-Q discloses four transactions in the nine months to 30 April 2026, plus a fifth completed after the quarter:

Plus the QRadar assets from IBM, acquired 31 August 2024, with a contingent-consideration liability the 10-Q estimates at $0.3 billion to $0.5 billion undiscounted, payable through the quarter ending October 2028.

CyberArk terms, verbatim: "CyberArk shareholders received $45.00 in cash and 2.2005 shares of our common stock for each CyberArk share." The 10-Q's own summary is unambiguous: "we paid approximately $2.3 billion in cash and issued 112 million shares of our common stock with a fair value of $18.5 billion."

That single sentence is the most important fact in this file that the vendor payload does not contain. It explains the share count, the balance sheet, the gross margin, the operating loss and the amortisation step-up all at once.

2. The single most important thing to understand about these numbers: there are three different companies in this file, and only one of them is priced

Palo Alto's reported numbers cannot be read on a single basis, and the three bases disagree by an order of magnitude.

Basis one — GAAP, as filed. Trailing twelve months to 30 April 2026: revenue $10,606.3M, gross profit $7,630.3M (71.94%), operating income $1,023.2M (9.65%), net income $842.8M (7.95%). On the actual 815 million shares outstanding that is $1.03 of earnings per share, and at $366.34 a P/E of 354.3x.

Basis two — non-GAAP, as the company reports and as consensus is struck. The four quarters in the earnings calendar sum to $3.76 of non-GAAP earnings per share ($0.95 + $0.93 + $1.03 + $0.85). At $366.34 that is 97.4x. The gap between $1.03 and $3.76 is $2.73 a share — roughly $2.2 billion a year of real costs that the non-GAAP figure excludes, principally share-based compensation and amortisation of acquired intangibles.

Basis three — the historical GAAP record, which is corrupted by a one-off and must be repaired before any trend can be read.

This is the defect the brief flagged and it is live. Palo Alto's fiscal-2024 GAAP net income was $2,577.6 million on pre-tax income of $988.3 million — net income 2.6 times larger than pre-tax income, because the tax line was a BENEFIT of $1,589.3 million. The 10-K states why:

> "For the year ended July 31, 2024, our benefit from income taxes was $1.6 billion, primarily due to the release of our valuation allowance on U.S. federal, U.S. states other than California, and United Kingdom ('U.K.') deferred tax assets."

And, confirming the size of the swing:

> "Our provision for income taxes in fiscal 2025 was $461.8 million, a net change of $2.1 billion compared to a benefit from income taxes of $1.6 billion in fiscal 2024, primarily due to the release of our valuation allowance in fiscal 2024."

A valuation-allowance release is an accounting recognition that past losses will now shelter future profits. It is not earnings. It happened once and cannot happen again.

Stripping it. Our arithmetic, labelled as ours: fiscal 2025's effective tax rate was 28.94% ($461.8M on $1,595.7M of pre-tax income). Applying that rate to fiscal 2024's pre-tax income of $988.3 million gives a normalised tax expense of $286.0 million and normalised net income of $702.3 million — against the $2,577.6 million reported. That is a 72.8% overstatement. Normalised diluted earnings per share become $0.99 against the $3.64 reported. Using the 21% US statutory rate instead gives $780.8 million and $1.10 — the conclusion is unchanged either way.

Here is why this matters more than the number itself:

As reported, the series reads as a spike to $3.64 followed by a 56% collapse to $1.60 — which looks like a broken business. Cleaned, it reads −$0.45 → $0.64 → $0.99 → $1.60: a monotone, accelerating climb out of losses. The clean series is the true one, and the correction makes Palo Alto look BETTER, not worse. Anyone screening this company on reported GAAP earnings growth is looking at an artefact.

Applying the same discipline to today. The trailing GAAP figure is depressed rather than inflated, and by things the filing quantifies:

• The acquired businesses lost money. The 10-Q: "the combined net impact of the Chronosphere and CyberArk acquisitions on our condensed consolidated statements of operations was revenue of $388 million and $391 million and operating loss of $523 million and $524 million for the three and nine months ended April 30, 2026, respectively." Strip that and the April quarter's $183 million operating loss becomes roughly $340 million of operating profit on $2,614 million of legacy revenue.
• Amortisation exploded. Quarterly depreciation and amortisation went $89M → $226M → $483M across the three quarters of fiscal 2026. That is the acquired-intangible amortisation switching on, and it is a real economic cost of the deals even though it is non-cash.
• A one-off gain sits inside the loss. The 10-Q discloses "a gain of $110 million for the change in fair value of contingent consideration liability during the three months ended April 30, 2026", recorded in general and administrative expense — i.e. inside operating income. Without it the April operating loss would have been roughly $293 million, not $183 million. A one-off gain flattering an already-negative quarter is exactly the pattern the integrity checklist exists to catch, and we are flagging it in the direction that hurts.
• Share-based compensation accelerated. $177 million of accelerated vesting in the April quarter alone from the CyberArk and Koi deals, and $3.6 billion of unvested compensation remaining, to be amortised over approximately 2.6 years.

So the honest statement of the trailing multiple, on all three bases, is this:

Every one of those is a very large number, and the choice of basis changes the answer by 3.6x but changes the conclusion by nothing. That is the single most important thing to understand about these numbers: there is no accounting treatment under which this stock is cheap on earnings. The bull case has to be made on revenue, on remaining performance obligations, or on a terminal state — never on the current multiple.

3. Growth and margin trajectory — and the deceleration the acquisitions are covering

Annual, from the vendor income series:

Read the growth column and the story is a deceleration: 24.9%, 29.3%, 25.3%, 16.5%, 14.9%. Palo Alto's organic growth rate stepped down into the mid-teens in fiscal 2024 and stayed there. That is not a criticism — mid-teens growth on a $9 billion base with 80% recurring revenue is an excellent business — but it is not the growth rate an 89x forward multiple describes.

Operating margin, by contrast, has improved every single year since fiscal 2021: −7.1% → −3.4% → 5.6% → 8.5% → 13.5%. That is genuine, sustained operating leverage on the GAAP line, and it is the strongest fundamental fact in the annual series. It broke in fiscal 2026 for acquisition reasons, not operating ones.

Quarterly, cross-checked against the earnings calendar:

Four observations, in order of importance.

First, the April quarter's 31.1% growth is not organic and the company says so. The 10-Q discloses $388 million of the quarter's revenue came from Chronosphere and CyberArk. Stripping it leaves $2,614 million, or +14.2% year on year — exactly in line with the 15.7% and 14.9% of the two preceding quarters. The acceleration is entirely purchased. We state this plainly because the headline number is the one that gets quoted.

Second, gross margin fell 540 basis points year on year, to the lowest level in four years. From 72.9% in the April 2025 quarter to 67.6% in April 2026. The 10-Q attributes it precisely: "Product gross margin decreased... primarily due to a decrease in gross margin on our hardware products and higher amortization of intangible assets" and "Subscription and support gross margin decreased... primarily due to higher amortization of intangible assets as a result of our recent acquisitions." It also quantifies the underlying cost lines: cloud hosting costs up $75 million in the quarter and amortisation of intangibles in cost of revenue up $117 million. So roughly two-thirds of the gross-margin damage is amortisation — non-cash, and excluded from the non-GAAP figures — and roughly one-third is real cloud hosting cost inflation, which is not.

Third, the operating loss is disclosed and attributable. Operating income of −$183 million against +$219 million a year earlier, with the acquired businesses' disclosed −$523 million more than explaining the swing. Legacy Palo Alto was profitable; the consolidated entity was not.

Fourth, the non-GAAP beat streak is unbroken and consistent. Five for five in the file, by 2.9%, 7.3%, 4.4%, 9.7% and 7.2%. That is a company that manages its guidance, and it is worth pricing accordingly: a beat on 2026-09-01 is the base case, not the surprise. The surprise would be the fiscal-2027 revenue guide.

Research and development was $1,984.1 million in fiscal 2025, 21.5% of revenue, and $2,276.5 million on a trailing basis, 21.5% of revenue — a constant ratio maintained through the acquisitions. The 10-Q attributes the April quarter's increase to $192 million of additional personnel cost, largely acquired headcount. Sales and marketing was $3,100.2 million in fiscal 2025 — 33.6% of revenue, and the largest single expense line in the company by a wide margin. This is a business that spends a third of every revenue dollar on going to market, which is normal for enterprise software and is the structural reason operating margin is 13.5% on a 73.4% gross margin.

The forward indicators, which matter more here than the income statement

For a subscription business with $12.75 billion of deferred revenue, the income statement is a lagging indicator. The forward indicators are remaining performance obligations, deferred revenue and annualised recurring revenue — and they are prose in the filings, not tables.

Three honest caveats on that table, none of which we will smooth.

One: the $18.4 billion of remaining performance obligations includes CyberArk's acquired backlog. The 10-Q does not split it. A $2.6 billion increase over nine months, of which an unknown but likely large share arrived with a $21.1 billion acquisition, cannot be read as organic bookings growth. We report the number and refuse to annualise it.

Two: deferred revenue at 30 April 2026 is not obtainable from this file. The vendor's only balance sheet is 31 July 2025. The 10-Q's balance sheet was stripped of its numeric tables in extraction. The fiscal-2025 figure — $6,302.2 million current plus $6,449.7 million non-current, $12,751.9 million total — is the most recent we have, and it grew 11.1% against revenue growth of 14.9%, meaning deferred revenue grew slower than revenue in fiscal 2025. That is a mild negative signal and we record it rather than omitting it.

Three: Next-Generation Security annualised recurring revenue — the metric management leads with and the one the performance-share plan is partly measured on — has NO VALUE ANYWHERE IN THIS FILE. The 10-Q defines it at length but the figure itself sits in a table that the current filing-text extraction strips. We will not estimate it. What we can report is the company's own framing of what it is, which we half-weight as management-defined:

> "NGS ARR is an operating metric that we use to assess the strength and trajectory of our business. NGS ARR should be viewed independently of revenue, deferred revenue and remaining performance obligations and does not represent our revenue under U.S. GAAP on an annualized basis, as it is an operating metric that can be impacted by contract start and end dates and renewal rates. NGS ARR is not intended to be a replacement for forecasts of revenue. The scope of products, subscriptions, and support offerings that contribute to NGS ARR will generally increase over time as we introduce or acquire new next-generation products, subscriptions, and support offerings."

Read that last sentence carefully. The company itself discloses that the metric's scope expands when it acquires businesses. A metric whose denominator grows by acquisition is not a clean organic-growth indicator, and the company is honest enough to say so. We half-weight it as management framing, we note that it is the metric the 2026-09-01 print will lead with, and we note that a reader cannot check it against anything in this dive.

4. Balance sheet and the enterprise-value rebuild

This is where the vendor file fails hardest, and the failure is not subtle.

The only balance sheet in the payload is dated 31 July 2025. Since that date Palo Alto has completed four acquisitions totalling roughly $24.5 billion (Chronosphere $3.0B, CyberArk $21.1B, Koi $231M, Portkey $140M), issued 112 million shares, issued 27 million more shares to settle warrants, assumed $1.25 billion of convertible notes, repurchased $1.0 billion of stock and repatriated $3.5 billion of foreign earnings. None of that appears on bal_a[0]. Every book-value, leverage and enterprise-value figure derived from it is describing a company that no longer exists.

Correction 1 — the vendor's totalDebt is 100% operating leases, and the 10-K says so explicitly. totalDebt at fiscal 2025 is $338.2 million, exactly equal to capitalLeaseObligations. The 10-K states: "We did not have any material finance leases in any of the periods presented." So the vendor has taken operating lease liabilities, labelled them capital-lease obligations, and reported them as the company's total debt. This is precisely the pattern the data contract records for Accenture. The truth is that at 31 July 2025 Palo Alto Networks had ZERO financial debt — the 0.375% convertible notes due 2025 had been settled at maturity two months earlier. The vendor reports total debt of $338.2 million; the filing shows no material finance leases and no borrowings; we use zero.

Correction 2 — netDebt ignores $7.19 billion of investments. The vendor's fiscal-2025 netDebt of −$1,930.4 million is total debt ($338.2M) less cash and equivalents ($2,268.6M) only. It omits $634.6 million of short-term investments and $6,557.9 million of long-term investments — $7,192.5 million in total. The filings treat these as one liquidity pool: the 10-Q's liquidity section reads "our total cash, cash equivalents, and investments of $7.0 billion were held for general corporate purposes." The vendor reports net debt of −$1.930B; the correct fiscal-2025 figure is net CASH of $9.461B; the vendor understates net cash by $7.53 billion.

The convertible notes, settled and assumed — the full picture from the filings

The 0.375% 2025 Notes are gone, cleanly. The 10-Q: "In June 2020, we issued $2.0 billion aggregate principal amount of 0.375% Convertible Senior Notes due 2025... The 2025 Notes were converted prior to or settled on the maturity date of June 1, 2025 in accordance with their terms." The associated note hedges expired at maturity.

But the warrants sold alongside them produced 27 million shares in fiscal 2026, and that is a real dilution event most screens will miss. The 10-Q: "we sold warrants (the '2025 Warrants') to acquire 40 million shares of our common stock with a strike price of $68.08 per share... During the nine months ended April 30, 2026, we net settled all of the 2025 Warrants with the issuance of 27 million shares of our common stock with a fair value of $5.6 billion." Twenty-seven million shares — 3.3% of the current count — handed over because the stock rose from a $68.08 strike.

And a new convertible arrived with CyberArk. Palo Alto assumed CyberArk's $1.25 billion of 0.00% Convertible Senior Notes due 15 June 2030, modified so each $1,000 of principal is exchangeable for approximately 4.3161 Palo Alto shares plus $88.2630 of cash — an effective initial conversion price of $211.24 per share, covering 5.4 million shares in total. Holders surrendered $153 million of principal during the make-whole window, settled in cash for $160 million on 7 May 2026, leaving $1.1 billion of principal outstanding, carried at a fair value of $1.2 billion at 30 April 2026 because the company elected fair-value accounting.

Two consequences worth naming. First, at $366.34 the 2030 Notes are deep in the money — the conversion price is $211.24 — but the 10-Q is explicit that "holders of the 2030 Notes will receive cash equal to the aggregate principal amount... and, at our election, cash or a combination of cash and shares", so the dilution is capped at roughly 4.8 million shares (0.6% of the count) and the principal is a cash obligation. Second, because the liability is carried at fair value and the stock has risen sharply since 30 April, the mark-to-market loss on these notes will grow with the share price and will hit GAAP other income — the April quarter already recorded a $37 million loss on this line. The better the stock does, the worse the GAAP earnings look. That is a real and under-appreciated feature of this name.

The revolver is small and untouched: a $400 million unsecured facility maturing 13 April 2028, expandable by $350 million, with no amounts outstanding and all covenants met at 30 April 2026.

The rebuilt enterprise value

Using the filing figures at 30 April 2026, which are the freshest available:

> Market capitalisation $298.567B (815,000,000 shares × $366.34 — the 10-Q cover count)

> + debt: 2030 Notes at fair value $1.20B long-term + $0.16B current = $1.36B

> − total cash, cash equivalents and investments $7.00B (10-Q liquidity section)

> = corrected enterprise value $292.93B, net cash $5.64B

The vendor reports $298.274B. The overstatement is $5.35 billion, or 1.8%. (Note: the $160 million cash settlement on 7 May 2026 reduces cash and debt by the same amount and leaves enterprise value unchanged.)

Correction 3 — the vendor's trailing EBITDA includes non-operating interest income, which is double counting. ratios_ttm.ebitdaMarginTTM of 21.484% implies EBITDA of $2,278.7 million. Our arithmetic shows exactly where that comes from: pre-tax income $1,396.8M + depreciation and amortisation $881.8M = $2,278.6M. In other words the vendor's "EBITDA" is built off pre-tax income, which includes $373.6 million of net interest and other income earned on the cash pile. That cash is already subtracted in the enterprise value; counting the income it produces in the EBITDA denominator credits it twice. We compute EBITDA as operating income $1,023.2M + D&A $881.8M = $1,905.0 million (17.96% margin) and every EV/EBITDA figure here uses it. The correction makes the multiple worse, not better — 153.8x rather than 130.9x — and we report it in that direction because that is what the arithmetic gives.

What the corrected balance sheet actually says. Net cash of $5.64 billion, no term debt, an undrawn revolver and $3.5 billion of free cash flow generation. There is no solvency question here and there will not be one. Working capital is negative (−$1,293 million, current ratio 0.856) but that is deferred revenue — money customers have already paid for services not yet delivered — and it is a source of financing, not a liability that must be repaid in cash. Correctly reported, not a defect. Book-value metrics (priceToBookRatioTTM 9.65x, returnOnEquityTTM 6.30%, returnOnInvestedCapitalTTM 1.67%) are all computed against equity and invested-capital figures whose provenance we cannot establish, on a company whose asset base changed by roughly $25 billion in two quarters. Rejected as lenses.

5. Cash flow and capital returns

Free cash flow is the fairest lens on this business and it is genuinely excellent. A 37-38% free-cash-flow margin, sustained across four years, on capital expenditure of 2.7% of revenue. Cash conversion is helped structurally by the subscription model: customers pay up front, deferred revenue funds the working capital, and the reported incomeQualityTTM of 2.45 (operating cash flow to net income) reflects that.

And the price still fails on it. At a market capitalisation of $298.567 billion:

• Price / FY2025 free cash flow = 86.0x. Free cash flow yield 1.16%.
• On the vendor's trailing free cash flow of $4,293.9M — which we reject below — 69.5x, a yield of 1.44%.
• Adjusted for share-based compensation as the real cost it is: fiscal-2025 free cash flow of $3,469.8M less SBC of $1,295.1M is $2,174.7 million, and the price is 137.3x that. We think this is the most honest single valuation statistic in the dive.

No dividend, and none is coming. lastDividend is 0, dividendYieldTTM is 0, dividendPayoutRatioTTM is 0. Correctly reported.

The buyback is small — and beautifully executed. The 10-Q:

> "During the three and nine months ended April 30, 2026, we repurchased and retired 7 million shares of our common stock under our current repurchase authorization for an aggregate purchase price of $1.0 billion, including transaction costs, at an average price of $147.70 per share."

Seven million shares at an average of $147.70 — against a 52-week low of $141.67 and a closing price today of $366.34. The company bought back stock within 4.3% of the annual low and the shares have since risen 148%. That is the single best capital-allocation decision visible anywhere in this file, and it deserves to be said. The board added another $1.0 billion of authorisation on 10 March 2026, bringing the cumulative programme to $5.1 billion, of which $1.0 billion remained available at 30 April 2026, expiring 31 December 2026. Note that no shares at all were repurchased in the equivalent fiscal-2025 periods.

But total shareholder yield is NEGATIVE, and this matters for the return bridge. The $1.0 billion of repurchases is 0.33% of the market capitalisation. Against it: 112 million shares issued for CyberArk, 27 million for the 2025 Warrants, 2 million of Chronosphere restricted stock, 0.3 million of Koi restricted stock, and $1,295.1 million a year of share-based compensation with $3.6 billion unvested over 2.6 years. Weighted diluted shares were 709.3 million in fiscal 2025; shares outstanding on the 10-Q cover at 26 May 2026 were 815 million — +14.9%. A shareholder in this company is being diluted, not returned to, and the dilution has been running at roughly 15% a year.

6. Valuation — priced in or room?

At $366.34 (market capitalisation $298.567B, 815,000,000 shares, corrected enterprise value $292.93B):

Estimate coverage is good at the front and unusable at the back. Thirty-eight to forty analysts on the fiscal-2026 and fiscal-2027 revenue lines and 29 on fiscal-2026 earnings. The fiscal-2027 EPS line (17 analysts, low $3.862, high $4.588, mean $4.114) is the tightest and most reliable row in the block and every fair value in this dive is anchored on it.

The fiscal-2028 EPS line is NOT reliable and we say so. Twelve analysts, low $2.1169, high $7.23979 — a 3.4x spread around a $4.8394 mean. A dispersion that wide on a single fiscal year almost certainly reflects contributors submitting on different bases (some GAAP, some non-GAAP) rather than genuine disagreement about the business. We use the fiscal-2028 mean only as a cross-check and never as a primary anchor. The fiscal-2029 row rests on two EPS analysts and the fiscal-2030 row on zero — both are excluded from every conclusion.

Per the data contract, est.ebitdaAvg and est.ebitAvg are not used — and on this file they are not merely unreliable, they are synthetic. See Section 8, finding 6, for the arithmetic. In short: ebitdaAvg is exactly 42.9581% of revenueAvg in every year from fiscal 2024 through fiscal 2030, ebitAvg is exactly 41.3095%, and sgaExpenseAvg is exactly 44.3861% — six consecutive years, identical to four decimal places. They are fixed ratios applied to the revenue estimate, not forecasts. All forward valuation here runs on epsAvg and revenueAvg.

Peer context. The vendor peer set is a mixed bag — Accenture, Sony, Amphenol, KLA and Texas Instruments are not comparables for a cybersecurity platform. The two that are: CrowdStrike ($215.1B market capitalisation at $211.22) and Fortinet ($123.5B at $168.29), plus ServiceNow ($122.1B) and Adobe ($102.4B) as enterprise-software reference points. No peer multiples are supplied in the file, so no peer-multiple comparison is drawn. What can be said, and is relevant: the cybersecurity complex as a whole is being paid up right now, which is the context for Palo Alto's 28.2x sales — it is expensive against its own history and expensive in absolute terms, but it is not an outlier within its group. A reader should treat that as a warning about the group, not a comfort about the name.

6a. What today's price assumes (the inversion)

At $366.34 — 97.1x fiscal-2026 consensus non-GAAP earnings, 89.0x fiscal 2027, 21.18x fiscal-2027 enterprise value to sales — the price embeds the following falsifiable claims, each with a number and a date:

• Revenue reaches $13.828 billion in the year to July 2027 (+21.1%) and $15.782 billion by July 2028 (+14.1%). (Consensus-derived; 40 and 35 analysts.) The near check is the 2026-09-01 print and, more importantly, the initial fiscal-2027 guide. Note that a large share of the fiscal-2027 step is the annualisation of CyberArk rather than organic acceleration — organic growth in the April quarter was roughly 14.2% once the disclosed $388 million of acquired revenue is stripped.
• Non-GAAP earnings per share reach $4.114 in fiscal 2027 and $4.839 in fiscal 2028 — growth of only 9.0% and 17.7%. (Consensus-derived; 17 and 12 analysts.) This is the bullet that should stop a reader. The price is 89x forward earnings for a consensus earnings growth rate of nine percent next year. Consensus itself is modelling the CyberArk deal as margin-dilutive in the near term, and the price is not.
• The market keeps paying 75-90x forward non-GAAP earnings at every date between now and fiscal 2028. (Our number.) At 60x fiscal-2028E the stock is $290; at 45x it is $218; at 35x — still a growth-software multiple — it is $169. The multiple, not the earnings, is where essentially all of the variance lives.
• The roughly $2.2 billion a year of costs excluded from non-GAAP earnings never has to be paid for by the multiple. (Our arithmetic, from the $1.03 GAAP versus $3.76 non-GAAP trailing gap on 815 million shares.) This is the most fragile assumption in the price. It comprises $1.3 billion a year of share-based compensation with $3.6 billion unvested over 2.6 years, plus acquired-intangible amortisation now running at roughly $400 million a quarter. Share-based compensation is a genuine transfer of ownership — the count went from 709.3 million weighted diluted shares to 815 million outstanding in under a year — and the market is currently agreeing to ignore it.
• CyberArk integrates on schedule with no impairment. (Our assumption on the direction; the $21.1 billion consideration and the disclosed $523 million quarterly operating loss are filing figures.) Roughly $25 billion of goodwill and acquired intangibles now sits on a balance sheet this file has never seen. The purchase-price allocation is explicitly preliminary and subject to change for up to twelve months from the acquisition date.

6b. The return bridge (why the multiple moves)

Expected return over the next twelve months decomposes as: EPS growth (+17.7%, from FY2027E $4.114 to FY2028E $4.839) + multiple drift (COMPRESSION, from 89.0x to our base 62x on the respective forward year, roughly −30%) + shareholder yield (NEGATIVE, roughly −2% to −3% net: a 0.33% buyback against roughly 15% annual gross dilution partly offset by the acquisition being paid for in kind) ≈ −15% to −30%.

Our base case assumes very substantial multiple COMPRESSION and we should be explicit that this is the whole argument. Today the market pays 89.0x the next fiscal year's estimate. Our base assumes 62x — which is still, by any historical standard, a rich premium software multiple, and higher than the market has paid for this company through most of its history at similar growth rates. The reason we assume compression is not that the business is deteriorating; it is that consensus non-GAAP earnings growth of 9.0% in fiscal 2027 and 17.7% in fiscal 2028 does not support 89x. A multiple appropriate to 30-40% earnings growth is not appropriate to 9%.

Almost none of the expected return is earnings growth, and the multiple is doing all of the work in both directions. If the multiple simply HELD at 89.0x on the fiscal-2028 estimate the price would be $431 (+17.4%); if it compressed to 45x the price would be $218 (−40.5%). That is an 89-point swing in outcome from a variable we do not control and have no edge on — and unlike the KLA setup in this batch, here the compression scenario is the base case rather than the risk case.

The bull case at $430 requires no re-rating at all — it holds today's 89.0x and applies it to the fiscal-2028 consensus mean of $4.8394, giving $430.9. It is deliberately constructed to require only that consensus earnings arrive, with the multiple frozen. It also happens to coincide with the street's own high target of $430, which is a useful independent check that we have not built an implausible ceiling. The bear case at $185 is a de-rating to 45x the fiscal-2027 consensus mean with no estimate cuts at all — the earnings do not have to disappoint.

6c. Variant perception (where we differ, what would surprise)

• On the business we do NOT differ from the street or from our own knowledge base, and we want that stated first. The platform-consolidation thesis is sound, the recurring base is real, the free cash flow is real, and the identity acquisition is strategically coherent. Our disagreement is entirely about price, and it is a large disagreement: our base of $255 is 30.4% below spot and 26.3% below the street's $345.91.
• The street's own median target already agrees with the direction, and this is the most under-reported fact about this name today. The consensus target is $345.91 (−5.6% from spot) and the median is $337.50 (−7.9%) — while 66 of 89 analysts carry a buy rating. A 74% buy-rated stock whose consensus target sits below its price is a stock that has outrun the people recommending it. Either the targets get raised in the next few weeks or the price comes back to them. We are not claiming a variant perception here; we are pointing out that the crowd's own central estimate is beneath the crowd's own price, and refusing to smooth it.
• We differ from the vendor on roughly $25 billion of balance sheet, and from the vendor's earnings basis by a factor of 3.6. Every screen built on this payload is describing a pre-CyberArk company with $338 million of "debt" that is actually operating leases, net debt that ignores $7.19 billion of investments, and a fiscal-2024 earnings figure inflated 72.8% by a one-time deferred-tax release. A reader running any of the standard screens on Palo Alto today is looking at a different company.
• We differ from our own knowledge base in an instructive way. The lane is nine-to-one bullish and contains genuinely good structural reasoning. But not one of its eleven claims is about valuation, and the one that comes closest — the February-2026 principle that after software selloffs you should "buy the expensive fast-grower not the cheap name" — was made when this stock was near its low. A rule that says buy the expensive one is not a rule that says buy it at any price, and the lane provides no support for 89x.
• Positive surprise that would force us to re-rate: the 2026-09-01 print carrying fiscal-2027 revenue guidance materially above $13.828 billion with a disclosed organic growth rate at or above 17%, and Next-Generation Security annualised recurring revenue accelerating, and GAAP operating income back positive. That combination would argue CyberArk is accretive faster than consensus models and would justify a higher terminal multiple. Watchable, dated, and 28 days away.
• Negative surprise that would break the thesis outright: fiscal-2027 revenue guidance below roughly $13.4 billion (the consensus low); any impairment charge against the roughly $25 billion of new goodwill and intangibles; a further gross-margin decline below 67%; or organic growth printing below 12%. Any of these hits a stock at 28.2x sales with a street median target already below the price, and the $185 bear case is what that looks like.

Synthos fair values

All three anchors are multiples of the fiscal-2027 or fiscal-2028 consensus non-GAAP EPS, using the tightest and best-covered rows in the estimate block (FY2027 mean $4.11446, 17 analysts, low $3.86235, high $4.58843; FY2028 mean $4.8394, 12 analysts).

• Bear ~$185 — 45x the FY2027 consensus MEAN of $4.11446 ($185.2). Cross-checks: 38.2x FY2028E; enterprise value of $145.4B on FY2027E revenue of $13.828B is 10.5x sales; a 3.5% free-cash-flow yield on FY2025 free cash flow. The scenario requires no estimate cuts at all — only that the market decides a 9%-growth, 17%-EBITDA-margin GAAP business is worth 45x forward non-GAAP earnings rather than 89x. Add estimate cuts, an impairment or an organic-growth disappointment and it is lower. −49.5%.
• Base ~$255 — 62x the FY2027 consensus MEAN of $4.11446 ($255.1). Cross-checks: 52.7x FY2028E; enterprise value of $202.4B on FY2027E revenue of $13.828B is 14.6x sales; on a FY2027 free-cash-flow margin held at fiscal 2025's 37.6% (our assumption), free cash flow of $5.20B against a $207.8B market capitalisation is a 2.50% yield. Sensitivity, stated openly: 55x gives $226, 70x gives $288. The whole answer lives in a 55-70x band and we claim no more precision than that. Note that 62x is still an extremely rich multiple — we are not marking this business down to a market multiple; we are marking it to a very generous growth-software multiple and it is still 30% below the price. −30.4%.
• Bull ~$430 — today's 89.0x forward multiple, HELD, applied to the FY2028 consensus MEAN of $4.8394 ($430.9). Cross-check: 104.6x FY2027E; 27.3x FY2028E sales. This bull case requires no re-rating whatsoever — only that consensus fiscal-2028 earnings arrive on time and the market's willingness to pay 89x survives two more years. It coincides with the street's own high target of $430, which we take as a useful independent ceiling. +17.4%.

Base is 30.4% BELOW spot; asymmetry from the base case is roughly 1:0.57 against (49.5% down to bear, 17.4% up to bull, from a base already below the price). We are not aware of a construction of these estimates that produces a base case above $366.34 without assuming the current multiple is permanent — and "the current multiple is permanent" is the bull case, not the base case.

7. Knowledge base — eleven claims, nine without a named speaker, and none about the price

Raw hits: 11. Entity matches: 11. Text-only matches: 0. Used as supporting evidence: 11. Used as name-level conviction: 4. Discarded for collision: 0.

The search covered PANW, Palo Alto Networks, Palo Alto, cybersecurity, firewall, CyberArk, Cortex, Prisma and Nikesh Arora across all 51,928 distilled claims. Zero text-only matches were returned — every hit carries the company in its structured entity list, which means the attribution discipline is satisfied on all eleven and there is nothing to discard for collision. The obvious collision risk on this name — "Palo Alto" the city, or unrelated Palo Alto research institutions — did not materialise in a single claim.

The lane, verbatim, ordered by how much weight we give it

Name-level claims — the subject is Palo Alto Networks itself (4 claims):

> 2025-10-02 · bullish · conviction 78 · horizon: principle · entities: Palo Alto Networks · channel: no_priors · NO NAMED SPEAKER

> "Cyber is fragmented with point solutions; ~80% of capability commoditizes into one platform that gradually eats the remaining 20% of feature vendors."

> 2025-10-02 · bullish · conviction 75 · horizon: thesis · entities: Palo Alto Networks · channel: no_priors · NO NAMED SPEAKER

> "You can't stop what you can't see — being present at every sensor/endpoint/control point is essential and that sensor business must stay."

> 2025-10-02 · bullish · conviction 72 · horizon: thesis · entities: Palo Alto Networks · channel: no_priors · NO NAMED SPEAKER

> "Breaches come from the unknown bad; consolidating all enterprise data with context lets ML find what actually happened, unlike stateless point tools."

> 2023-05-23 · neutral · conviction 60 · horizon: thesis · entities: Palo Alto Networks, PANW · channel: business_breakdowns · NO NAMED SPEAKER

> "Palo Alto is best-of-breed in network firewalls but has failed to make headway in endpoint (Traps acquisition underwhelmed)."

Sector, basket and principle claims — Palo Alto appears as a member of a set (7 claims):

> 2026-02-13 · bullish · conviction 75 · horizon: thesis · entities: CRWD, PANW, ZS · channel: anthony_pompliano_show · SPEAKER: Dan Ives · role: independent · attribution: guest

> "The cybersecurity selloff (CrowdStrike, Palo Alto, Zscaler) is dislocated from fundamentals; he'll take the opposite side of the bet that [AI-vendor names redacted per house style] unseat them."

> Verbatim quote as stored, with two AI-vendor names redacted per house style: "if you think that [redacted] or [redacted] or different tools are going to unseat powto or crowd strike or zcaler like I'll take that bet like I'll take the opposite side" — note the stored text is raw speech-to-text and the garbled ticker names are in the source, not introduced by us; only the two AI-vendor names have been removed.

> 2026-04-24 · bullish · conviction 60 · horizon: principle · entities: CDNS, SNPS, CRWD, PANW · channel: compound_and_friends · SPEAKER: Adam Parker

> "In software buy the expensive names (security, Cadence, Synopsys, CrowdStrike, Palo Alto) not cheap ones — cheap means higher disruption risk; fast-growers lead the rebound."

> 2026-04-10 · BEARISH · conviction 65 · horizon: thesis · entities: IGV, Palantir, CrowdStrike, Palo Alto, ServiceNow, Salesforce, Adobe, Oracle · channel: compound_and_friends · NO NAMED SPEAKER

> "Software is in a bloodbath on AI-disruption fear; market ignores record earnings/estimates and prices a much lower terminal value years out."

> 2026-02-24 · bullish · conviction 62 · horizon: principle · entities: Palo Alto Networks, Salesforce · channel: compound_and_friends · NO NAMED SPEAKER

> "After software selloffs, buy the expensive fast-grower not the cheap name — expensive multiples reflect the best growth outlooks, market isn't stupid."

> 2026-01-06 · bullish · conviction 55 · horizon: thesis · entities: CrowdStrike, Palo Alto Networks · channel: compound_and_friends · NO NAMED SPEAKER

> "Cybersecurity software is exempt from the enterprise-software selloff hitting workflow-automation names."

> 2026-05-01 · bullish · conviction 52 · horizon: thesis · entities: CRWD, PANW · channel: all_in · SPEAKER: null

> "AI cyber capability drives a big one-time hardening upgrade cycle — an incredible revenue opportunity for CrowdStrike and Palo Alto Networks, with a line out the door for the product."

> 2025-10-09 · bullish · conviction 80 · horizon: thesis · entities: Palo Alto Networks, ServiceNow, HubSpot, MongoDB · channel: all_in · NO NAMED SPEAKER

> "Founder-led software winners have 10x'd as public companies in the last decade, validating holding great companies well past the IPO."

What this lane is, stated without inflation

This is the deepest and most useful knowledge-base lane in this batch, and it still has four serious sourcing problems that we will not paper over.

Problem one — nine of eleven claims carry NO named speaker. Only Dan Ives (2026-02-13) and Adam Parker (2026-04-24) are attributed to a person. The other nine are attributed only to a channel. Under the 4-lane attribution policy this is the weakest form of sourcing we accept, and it is exactly the failure mode that policy exists to prevent: a channel-level attribution tells you where something was said, not who said it or what their record is. 81.8% of this lane fails that test.

Problem two — three of the eleven are one conversation counted three times. The 2025-10-02 claims share a single doc_id (no_priors-yFHFYFvZcvE), a single date and a single channel. They are not three independent bullish views; they are three propositions extracted from one episode. Counting them as three sources would triple-weight a single source event. We treat them as ONE source with three propositions, which reduces the effective breadth of this lane from 11 claims to roughly 9 source-events across 5 channels.

Problem three — those same three claims read as company-adjacent voice, and we half-weight them accordingly. The framing is first-person operator language: "being present at every sensor/endpoint/control point is essential and that sensor business must stay" is a statement about strategic intent, not an outside analyst's assessment. The trio arrives on a single date, all bullish, all about Palo Alto exclusively with no comparative or valuation content. The file does not record a speaker_role of management, so we cannot prove it — and we say that plainly rather than asserting it. But under the house rule that management voice is excluded from the conviction pool and quoted separately at half weight, the responsible treatment of an unattributed, single-source, uniformly-bullish, strategy-framed trio is to half-weight it and disclose exactly why. That is what we have done, and it is why the conviction rating is Moderate rather than High.

Problem four — one channel supplied four claims and reversed stance twice inside ten weeks. compound_and_friends: 2026-01-06 bullish (cyber is exempt from the software selloff), 2026-02-24 bullish (buy the expensive fast-grower), 2026-04-10 BEARISH (software is in a bloodbath, the market prices a much lower terminal value), 2026-04-24 bullish again (Adam Parker: buy the expensive names). Three of those four have no named speaker, so we cannot tell whether this is one person changing their mind twice or three different people disagreeing on the same programme. That distinction is the entire point of speaker-level attribution and this lane cannot supply it. We note in fairness that the 2026-04-10 claim is tagged bearish but reads as bullish in intent — its argument is that the market is wrong to price a lower terminal value. We report the stance as tagged and the intent as read, and let the reader weigh both.

Two further discounts applied:

• The 2025-10-09 all_in claim about "founder-led software winners" is a poor fit for this company and we down-weight it accordingly. Palo Alto has been led by Nikesh Arora, a hired chief executive, since 2018; it is not founder-led. A basket claim whose organising principle does not describe the constituent is not evidence about the constituent.
• The 2023-05-23 business_breakdowns claim is three years and two months old, and its substance — that Palo Alto failed to make headway in endpoint — is precisely what the Cortex build-out and the CyberArk acquisition are the answer to. We keep it in the lane because it is the only non-bullish name-level claim we have and removing it would flatter the lane, but it should be read as a historical observation, not a current view.

Conclusion, stated as a finding

The knowledge base is net bullish on Palo Alto's BUSINESS with moderate conviction, and it is silent on Palo Alto's PRICE. Nine of eleven claims are bullish, one is neutral and one is tagged bearish; conviction scores run 52 to 80 with a mean of about 66. The structural argument — cyber fragments into point tools, roughly 80% of capability consolidates onto one platform, presence at every control point is the moat — is coherent, is corroborated by the 10-K's own four-category competitive framing, and is exactly what Palo Alto is executing with five acquisitions in twenty months. That is genuine support for the Growth Quality 8 and the Exponential Potential 7.

It is not support for the verdict, because the verdict is about price and this lane contains no valuation claim. The closest is a February-2026 principle — "buy the expensive fast-grower not the cheap name" — struck when this stock was near $150, and a rule that prefers expensive to cheap is not a rule that endorses 89x forward earnings. We are recording that the knowledge base and this dive agree on the company and are simply not in conversation about the price. Conviction Moderate, breadth 5, net conviction positive-moderate — and the lane does not move the fair value by a dollar.

8. Data integrity — what we rejected from the vendor file and why

Twelve findings. Palo Alto's file is one of the more defective in this batch, and the defects are structural rather than cosmetic: the balance sheet is a year old and pre-dates roughly $24.5 billion of acquisitions, the debt figure is entirely operating leases, and the entire non-revenue portion of the estimate block is a fixed ratio applied to revenue.

1. STALE BALANCE SHEET — the largest single defect in this file, and it is severe. bal_a[0] is dated 2025-07-31. Since that date the company has completed four acquisitions totalling roughly $24.5 billion (Chronosphere $3.0B on 2026-01-29; CyberArk $21.1B on 2026-02-11; Koi $231M on 2026-04-14; Portkey $140M on 2026-05-29), issued 112 million shares worth $18.5 billion plus $2.3 billion of cash for CyberArk, issued 27 million further shares to net-settle the 2025 Warrants, assumed $1.25 billion of convertible notes, repurchased $1.0 billion of stock and repatriated $3.5 billion of foreign earnings. The vendor's balance sheet contains none of it. Total assets are shown as $23.576B when the CyberArk consideration alone exceeds that figure by a third. Every leverage, book-value, return-on-equity, return-on-invested-capital and asset-turnover metric in this payload is describing a company that ceased to exist on 11 February 2026, and all of them are REJECTED. The balance-sheet figures used in this dive come from the 10-Q's prose disclosures (total cash, cash equivalents and investments $7.0 billion; 2030 Notes fair value $1.2 billion long-term plus $0.16 billion current; revolver undrawn) and are labelled as such throughout.

2. 8-K SWEEP FOR POST-STATEMENT EVENTS — tested, and it PASSES. All three 8-Ks were read in full. 2026-03-23: a notice that the default settlement method for the assumed 2030 Notes will be combination settlement with a specified dollar amount of $1,000 per $1,000 of principal — an administrative election already reflected in the 10-Q. 2026-04-13 (event 2026-04-08): three lease amendments extending the Santa Clara headquarters leases twelve years to 31 July 2040, at $3.825 per rentable square foot per month with 2% annual increases and a tenant-improvement allowance of up to $72.50 per square foot; the 10-Q quantifies the effect at $469 million of net lease payments and a $262 million increase in right-of-use assets. 2026-06-02: the third-quarter earnings release, with Exhibit 99.1 absent from the extraction. None of the three is an acquisition or a financing that post-dates every statement in the file. The only post-statement corporate event is the Portkey acquisition completed 2026-05-29 for $140 million, which the 10-Q discloses in its subsequent-events note and which is immaterial. Stated because the check was required and it passed.

3. netDebt IGNORES $7.19 BILLION OF INVESTMENTS — REJECTED and rebuilt. The vendor's fiscal-2025 netDebt of −$1,930.4M nets total debt against cash and equivalents only, omitting $634.6M of short-term investments and $6,557.9M of long-term investments. The 10-Q treats these as one pool: "our total cash, cash equivalents, and investments of $7.0 billion were held for general corporate purposes." The vendor reports net debt of −$1.930B; the fiscal-2025 filing shows net cash of $9.461B; the current figure using the April 2026 10-Q is net cash of approximately $5.64B; we use $5.64B. Consequential rejections: enterpriseValueTTM ($298.274B → $292.93B), evToSalesTTM (28.12x → 27.62x), netDebtToEBITDATTM (−0.129x → −2.96x), and every derived enterprise-value multiple.

4. totalDebt IS 100% OPERATING LEASES, AND THE 10-K SAYS THE COMPANY HAS NO FINANCE LEASES — REJECTED. Vendor totalDebt at fiscal 2025 is $338.2 million, exactly equal to capitalLeaseObligations of $338.2 million, with longTermDebt and shortTermDebt both zero. The 10-K states: "We did not have any material finance leases in any of the periods presented." The vendor has taken operating lease liabilities, mislabelled them as capital-lease obligations, and reported them as the company's total debt. This is the Accenture pattern named in the data contract. The truth at 31 July 2025 is that Palo Alto Networks had ZERO financial debt — the 0.375% 2025 convertible notes were settled at maturity on 1 June 2025. The current $1.36 billion of debt is the assumed CyberArk 2030 Notes, which appear on no balance sheet in this payload at all.

5. FISCAL-2024 GAAP EARNINGS INCLUDE A $1.589 BILLION ONE-TIME TAX BENEFIT — STRIPPED, with the clean series published. Reported fiscal-2024 net income of $2,577.6 million on pre-tax income of $988.3 million reflects a tax benefit of $1,589.3 million. The 10-K: "our benefit from income taxes was $1.6 billion, primarily due to the release of our valuation allowance on U.S. federal, U.S. states other than California, and United Kingdom ('U.K.') deferred tax assets." Normalised at fiscal 2025's 28.94% effective rate, fiscal-2024 net income is $702.3 million and diluted earnings per share are $0.99, against the $3.64 reported — a 72.8% overstatement. The clean GAAP diluted series is −$0.45 → $0.64 → $0.99 → $1.60, a monotone climb, rather than the reported −$0.45 → $0.64 → $3.64 → $1.60, which reads as a spike and collapse. No conclusion in this dive uses the reported fiscal-2024 earnings figure. Related: a $110 million gain from remeasuring the QRadar contingent-consideration liability sits inside the April 2026 quarter's general and administrative expense and therefore inside operating income; without it the quarter's operating loss would be roughly $293 million rather than $183 million, and we flag it in the direction that hurts.

6. THE ENTIRE NON-REVENUE PORTION OF est IS A FIXED RATIO APPLIED TO REVENUE — REJECTED, with the arithmetic shown. This is the clearest fabrication signature we have seen in this batch:

Seven consecutive years, identical to four decimal places. These are not forecasts; they are a constant margin assumption multiplied by the revenue estimate. Only the fiscal-2023 row (0.67% and −3.96%), which is an actual, breaks the pattern. Two independent confirmations that the levels are wrong as well as synthetic: first, the fiscal-2025 ebitdaAvg of $3,946.3M is 149% above the actual fiscal-2025 EBITDA of $1,586.3M (operating income $1,242.9M plus D&A $343.4M), and even adding back the entire $1,295.1M of share-based compensation leaves a $1,065 million unexplained residual; for fiscal 2024 the residual is $1,518 million. Second, sgaExpenseAvg at 44.39% of revenue exceeds ebitdaAvg at 42.96% — arithmetically impossible against a 72% gross margin before a single dollar of research and development. ebitdaAvg, ebitAvg and sgaExpenseAvg are REJECTED in full. revenueAvg and epsAvg are verified sound and are the only estimate rows used.

7. est.epsAvg VERIFIED — and it passes cleanly. Fiscal 2026 epsAvg of $3.7734 against the three reported non-GAAP quarters ($0.93 + $1.03 + $0.85 = $2.81) plus the fourth-quarter estimate of $0.976 gives $3.786 — agreement to 0.3%. Fiscal-2025 epsAvg of $3.27381 is consistent with the two reported fiscal-2025 quarters in the earnings calendar. epsAvg is the reliable row, exactly as the data contract states, and all forward valuation in this dive runs on it.

8. est.netIncomeAvg IS INCONSISTENT WITH est.epsAvg — reported, not used, and the direction of the error matters. Dividing netIncomeAvg by epsAvg gives implied share counts of 700.8 million (FY2026), 728.4 million (FY2027), 850.1 million (FY2028) and 709.3 million (FY2029) — four mutually inconsistent denominators, two of them below the 815 million shares actually outstanding on the 10-Q cover at 26 May 2026, and one of them (FY2029) exactly equal to the fiscal-2025 weighted diluted count, which is a copy artefact. We cannot determine from this file whether netIncomeAvg is a GAAP or non-GAAP row — it cannot be GAAP, since $2,644.5M for fiscal 2026 is impossible against $589M of GAAP net income in the first nine months — so we use epsAvg and report the inconsistency. The honest observation for a reader is that if the consensus share denominator is genuinely too low, the true forward multiple is higher than the 89.0x printed here, not lower.

9. est FY2028 EPS DISPERSION IS TOO WIDE TO ANCHOR ON — used only as a cross-check. Twelve analysts, mean $4.8394, low $2.1169, high $7.23979 — a 3.4x spread on a single fiscal year. That range is characteristic of contributors submitting on different accounting bases rather than of genuine business disagreement. Fiscal 2029 rests on TWO EPS analysts and fiscal 2030 on ZERO (epsAvg, epsHigh, epsLow and netIncomeAvg are all exactly 0 in the fiscal-2030 row, a zeroed field). All three years are excluded from every conclusion; the fair values anchor on fiscal 2027.

10. TRAILING EBITDA DOUBLE-COUNTS INTEREST INCOME — REJECTED and recomputed. ratios_ttm.ebitdaMarginTTM of 21.484% implies trailing EBITDA of $2,278.7 million, which our arithmetic shows to be pre-tax income of $1,396.8M plus D&A of $881.8M. That construction includes $373.6 million of net interest and other income earned on a cash pile that enterprise value already subtracts. We use operating income $1,023.2M + D&A $881.8M = $1,905.0 million (17.96% margin), and every EV/EBITDA figure in this dive is computed on it. The correction moves the multiple from 130.9x to 153.8x — against us — and we publish it anyway. Relatedly, ratios_ttm.ebitMarginTTM of 13.170% is identical to pretaxProfitMarginTTM of 13.170%, confirming the vendor's "EBIT" is pre-tax income; the true trailing operating margin is 9.65%.

11. TRAILING CAPITAL EXPENDITURE AND FREE CASH FLOW ARE NOT CREDIBLE — flagged, and the filing figures used instead. capexToRevenueTTM of 0.725% against trailing revenue of $10,606.3M implies trailing capital expenditure of approximately $76.9 million, against $246.2 million in fiscal 2025 alone — a 69% collapse. The 10-Q discloses a single item that exceeds it: "we purchased 14.5 acres of land adjacent to our headquarters in Santa Clara, California, for $91 million." Trailing capital expenditure cannot be $77 million when one disclosed land purchase in the same period was $91 million. The dependent freeCashFlowYieldTTM (1.438%, implying trailing free cash flow of $4,293.9M), evToFreeCashFlowTTM (69.47x) and capexToDepreciationTTM (0.109) are all flagged. All free-cash-flow figures in this dive use the fiscal-2025 cash-flow statement: operating cash flow $3,716.0M, capital expenditure $246.2M, free cash flow $3,469.8M, and the price/free-cash-flow multiple is stated at 86.0x on that basis rather than 69.5x on the vendor's.

12. stockBasedCompensationToRevenueTTM UNDERSTATES A COST THAT DEMONSTRABLY ROSE — flagged. The field reads 9.668%, implying trailing share-based compensation of $1,025.4 million — 20.8% BELOW the $1,295.1 million recorded in fiscal 2025 alone. Share-based compensation did not fall 21% in a year in which the company accelerated $177 million of vesting for the CyberArk and Koi deals, assumed $945 million + $525 million + $61 million of replacement equity awards, and ended the April quarter with $3.6 billion of unvested compensation to be amortised over 2.6 years. We use the fiscal-2025 figure of $1,295.1 million and the 10-Q's forward disclosure, and treat the trailing ratio as unreliable.

13. QUARTERLY EPS DOES NOT RECONCILE FOR THE APRIL 2026 QUARTER — flagged, our own figure used. The vendor reports Q3 FY2026 net income of −$177.0 million on 729 million basic and 744 million diluted weighted shares, with basic earnings per share of −$0.29 and diluted of −$0.28. Neither figure reconciles: −$177.0M ÷ 729M = −$0.24, and −$177.0M ÷ 744M = −$0.238. Two separate problems. First, the printed earnings per share implies a share count of roughly 610 million, which is below every other count in the file. Second, reporting a diluted share count ABOVE basic in a loss period, and therefore a SMALLER loss per diluted share, is not permissible — in a loss period potentially dilutive securities are antidilutive and diluted must equal basic, and the 10-Q confirms this treatment ("Our 2030 Notes and capped calls were also excluded from the calculation of diluted net income (loss) per share as the effect would have been antidilutive"). The same reconciliation passes cleanly for all four preceding quarters (Q4 FY2025 $253.8M ÷ 669.4M = $0.379 against a printed $0.38; Q1 FY2026 $334M ÷ 679M = $0.492 against $0.49; Q2 FY2026 $432M ÷ 713M = $0.606 diluted against $0.60). We use −$0.24 as the April quarter's GAAP loss per share and state that we cannot determine from this file whether the vendor's earnings-per-share figure or its share count is the erroneous one, because the filing's earnings-per-share table was stripped in extraction.

14. quote.yearHigh/yearLow DISAGREE WITH tech.hi52/lo52 — we use tech and say why. The quote block reports a 52-week high of $368.80 and low of $139.57; the computed technical block reports $366.34 and $141.67. The discrepancies are 0.7% and 1.5%. We use the tech figures throughout because they are computed from the same six-year close series that produces the moving averages, drawdown and relative-return figures, and mixing sources within the technical section would make those percentages inconsistent. Note that tech.hi52 of $366.34 is exactly equal to tech.last, and max_dd_from_peak and pct_from_hi are both 0.0 — this is NOT a defect. It is the correct output for a stock that closed at its 252-day maximum on the day of the dive, and it is one of the most important facts in this document.

Not defects, correctly reported and independently confirmed:

• The share count is right and we verified it three ways. Market capitalisation of $298,567,100,000 ÷ $366.34 = exactly 815,000,000 shares, and the 10-Q cover page states "The number of shares outstanding of the registrant's common stock as of May 26, 2026 was 815 million." An exact match. The gap between this and the earnings-per-share denominators (709.3M weighted diluted in fiscal 2025, 729M/744M in the April quarter) is not an error — it is the correct consequence of issuing 112 million shares for CyberArk on 11 February 2026 and 27 million to settle warrants during the year, neither of which is fully reflected in a weighted average. A reader must nonetheless use 815 million, not the weighted average, for any current per-share calculation, and this dive does.
• There has been NO stock split in fiscal 2026. The last was a two-for-one split effected 12 December 2024, disclosed in the fiscal-2025 10-K, with all share and per-share amounts retroactively adjusted. The three 8-Ks contain no split. Checked because the brief required it.
• seg_prod and seg_geo reconcile EXACTLY to reported revenue, line by line, for fiscal 2025 ($4,974.4M + $2,445.2M + $1,801.9M = $9,221.5M; $6,205.1M + $1,917.4M + $1,099.0M = $9,221.5M) and fiscal 2024 ($8,027.5M both ways). No double-counting, no vanished segment, no superseded taxonomy after fiscal 2019. The only caveat is that fiscal-2014 to fiscal-2018 rows omit the Product line entirely and therefore do not sum to revenue; no pre-2019 row is used in this dive. The company has one reportable segment, so seg_prod is a revenue disaggregation rather than a segment table, and is presented as such.
• CURRENCY — tested and clean. inc_a[0].reportedCurrency is USD, profile.currency is USD, and the NASDAQ quote is in USD. No currency mixing; no multiple in this dive required a conversion.
• The Q3 FY2026 effective tax rate ties exactly. The vendor's $21.0M tax expense on −$156.0M of pre-tax income is −13.5%, and the 10-Q states "our provision for income taxes reflected an effective tax rate of negative 13.5%" for the three months and 26.8% for the nine months. An exact match, and it confirms the vendor's April-quarter income statement above the earnings-per-share line.
• Negative working capital and a current ratio of 0.856 are CORRECT and are not a liquidity problem. They are the signature of $12.75 billion of deferred revenue — money already collected for services not yet delivered. Reported as a feature, not a defect.
• The convertible-note history is complete and consistent between vendor and filing. The vendor's shortTermDebt of $1,991.5M (FY2023) and $963.9M (FY2024) falling to $0 (FY2025) correctly traces the 0.375% 2025 Notes down to their settlement at maturity on 1 June 2025, and the fiscal-2025 cash-flow statement's netDebtIssuance of −$965.6M matches the final repayment. Vendor and filing agree.

Non-equity tripwire — checked and passed. PANW is common stock, NASDAQ Global Select, CUSIP 697435105, ISIN US6974351057, one class, no preferred outstanding (preferredStock is $0 on every balance sheet). The price of $366.34 is not par-like; beta is 0.908, far above the sub-0.3 typical of a fixed-income-like instrument; there is no dividend at all, so the fixed-versus-variable distribution test does not arise and the instrument cannot be a preferred or a baby bond; volume was 7.80 million shares (roughly $2.86 billion of turnover); and the 52-week band of $141.67 to $366.34 is a 158.6% range, the opposite of the narrow band a debt-like instrument shows. This is common equity. (One note on the beta: 0.908 for a stock that rose 98.5% in three months and 111.9% in twelve is a low reading, and readers should treat it as a backward-looking regression rather than a current risk measure.)

9. Technicals

• Price $366.34 — which IS the 52-week high. 0.0% from the peak. 0.0% maximum drawdown from peak over the trailing year. Position within the annual range: 100th percentile. +158.6% above the 52-week low of $141.67.
• Moving averages, both far below and both rising: +18.3% above a 50-day average of $309.55; +69.8% above a 200-day average of $215.81. There is no overhead resistance of any kind and no nearby support: the first structural level is the 50-day average, 15.5% below the close.
• RSI 55.9 — and this is the most interesting technical fact in the file. A stock at an all-time high after a 98.5% three-month advance would normally print an RSI in the seventies or eighties. It does not. That indicates the advance has been a series of orderly step-ups with consolidations between them rather than a single vertical move — a healthier chart than the raw return suggests. MACD +8.58, positive and rising.
• Relative performance, which is extraordinary: 3-month +98.5% vs SPY +7.6% and QQQ +7.7% — a 91-point outperformance in a single quarter; 6-month +108.8% vs SPY +11.1% and QQQ +15.7%; 12-month +111.9% vs SPY +24.3% and QQQ +30.8%. Note that the three-month and twelve-month returns are almost identical — 98.5% and 111.9% — which means essentially the entire twelve-month gain was made in the last three months.
• Sentiment, and the contradiction inside it: 66 buy, 21 hold, 2 sell across 89 analysts — a 74% buy-rated name — with a consensus target of $345.91 (−5.6% from spot), a median of $337.50 (−7.9%, BELOW SPOT), a high of $430 (+17.4%) and a low of $209 (−43.0%). The distribution is well-populated and genuinely dispersed, which makes the below-spot median more meaningful, not less.

Today's move and what it does to the entry

PANW closed 2026-08-04 at $366.34, up 5.53% or $19.21 from a previous close of $347.13. It opened at $351.60 — a 1.29% gap — traded a $349.07 to $367.50 range, and closed within 0.32% of the day's high on 7.80 million shares against an average of 7.96 million.

Two readings, and the honest one is the second.

The bullish reading: a close at an all-time high, within a third of a percent of the day's high, with RSI at only 55.9 and MACD positive, both moving averages far below and rising. On the chart alone this is as strong a configuration as exists.

The reading we think is correct: the breakout came on BELOW-average volume. A 5.53% advance to an all-time high on 98% of average volume is participation that did not expand with the price, and it is the one genuine weakness in an otherwise flawless chart. And 2026-08-04 was a broad technology up-day across this entire batch — ARM +17.36%, MRVL +12.81%, INTC +10.92%, LRCX +7.85%, MU +7.62%, AMD +7.00%, KLAC +6.95%, PANW +5.53%, TXN +5.42%, AMAT +5.48%, ASML +4.22%, IBM +3.91%, ANET +3.06%. There is no company-specific news in this file for 2026-08-04. Palo Alto's last corporate event was the 2026-06-02 earnings release, 63 days earlier. We treat the 5.53% as sector beta.

So the gap is not the reason to decline the entry — the valuation is, and the chart makes it worse rather than better. Every one of the technical facts above describes a stock that has already been repriced. A reader is not being offered an entry into an underappreciated asset; they are being offered the 100th percentile of a 158% annual range at 89x forward earnings, four days after a fiscal year ended with no results published, into a print 28 days away.

What we are telling the reader plainly: the setup that would change this is a price near $250-260, or a 2026-09-01 print that resets the earnings base high enough to make 89x defensible. At $255 our base case is fair value and the risk/reward becomes symmetric. That is 30% below today's close — a long way, but it is inside the range this stock traversed in the last three months in the opposite direction.

10. Insiders — eight transactions, and the composition matters more than the total

Three separate things are in this table and conflating them would be a serious misreading.

One — the chief executive's transaction is NOT a stock sale. The 2026-06-30 entry for Nikesh Arora is 865,090 units of PHANTOM STOCK at a price of $0, coded I-Discretionary, which is a discretionary transaction within an employee benefit plan under Rule 16b-3. Phantom stock is a deferred-compensation bookkeeping unit, not common stock; no shares changed hands and no shares reached the market. It is by far the largest number in the table and it carries zero information about the chief executive's view of the share price. Any screen that totals the "shares transacted" column and reports 868,000 shares of insider selling by this management team is wrong by a factor of roughly 300.

Two — one transaction is tax withholding, not a sale. The chief accounting officer's F-InKind of 1,092 shares at $341.02 is shares withheld by the issuer to settle the tax liability on vesting restricted stock. The employee never receives them and never sells them; the company retains them and remits cash to the tax authority. Not a sale.

Three — the actual open-market selling is trivially small. Six S-Sale transactions totalling 2,822 shares — 700 + 900 + 327 + 305 + 290 + 300 — worth approximately $0.97 million at the transaction prices. Against 815 million shares outstanding that is 0.00035% of the company. Two of the six are director sales of a few hundred shares each in indirect accounts at three different prices on two dates, which is the signature of a scheduled 10b5-1 plan rather than a discretionary decision.

What the file contains is therefore: zero open-market purchases and approximately $1 million of open-market sales. That is a neutral signal and it is reported as neutral.

Two observations worth adding, both mild. First, every sale in the file was executed between $284.80 and $348.74 — all of them below today's $366.34. Insiders sold into the advance and none of them caught the top, which is neither a signal nor a criticism, merely an observation about timing. Second, there were no insider purchases at the $141.67 low either — but the company bought, and bought well, repurchasing 7 million shares at an average of $147.70. When a management team declines to buy personally but has the board authorise a $1 billion repurchase within 4.3% of the annual low, the corporate signal is considerably stronger than the personal one. The chief financial officer retains 149,950 shares ($54.9 million at the closing price) and the chief accounting officer 79,644 ($29.2 million).

11. Verdict, kill-criteria and flip conditions

Avoid.

Let us be precise about what that word means here, because it would be easy to misread.

What is genuinely excellent about this company, and none of it is in dispute: revenue compounding 22.0% a year for five years to $9.222 billion in fiscal 2025 and $10.606 billion trailing; 80.2% of revenue subscription and support; $18.4 billion of remaining performance obligations at 30 April 2026 against $15.8 billion nine months earlier, with $8.3 billion scheduled to convert within twelve months; $12.752 billion of deferred revenue; $3.470 billion of free cash flow on $246.2 million of capital expenditure, a 37.6% margin sustained for four years; net cash of roughly $5.64 billion with no term debt and an undrawn revolver; GAAP operating margin that improved every single year from −7.1% to +13.5%; a coherent and independently corroborated platform-consolidation strategy now extending into identity and agentic-AI security; and a board that repurchased $1 billion of stock within 4.3% of the annual low. This is a very good business run by people who have demonstrably allocated capital well.

What we are declining to pay for: 354.3x trailing GAAP earnings. 97.4x trailing non-GAAP earnings. 97.1x fiscal-2026 consensus. 89.0x fiscal 2027 — for consensus earnings growth of 9.0%. 28.2x sales. 153.8x corrected trailing operating EBITDA. 86.0x fiscal-2025 free cash flow, or 137.3x once share-based compensation is charged against it. A base fair value of $255 that is 30.4% below spot and 26.3% below the street's $345.91. A street median target of $337.50 that is itself 7.9% below the closing price while 66 of 89 analysts carry a buy rating. A 98.5% three-month advance into a close exactly at the 252-day high on below-average volume. Roughly $24.5 billion of acquisitions whose combined effect was a $523 million operating loss on $388 million of revenue in the one quarter we can observe. And a fiscal year that ended four days ago with nothing published.

The distinction that matters. We are not saying Palo Alto's business will disappoint. We are saying that at $366.34 the price already contains an outcome better than consensus expects, and that consensus itself models only 9% earnings growth next fiscal year. In the Synthos frame, a name where our base fair value sits 30% below spot, where the street's own median target sits below spot, and where the knowledge base is bullish on the company but silent on the price, is an Avoid by construction. Manufacturing a reason to own it here would be dishonest.

A note for holders, which is a different question from the one this dive answers. Avoid is a verdict on deploying new capital at $366.34. A reader who already owns this from materially lower prices faces a different calculation involving tax, position size and the 2026-09-01 print, and this document does not attempt to answer it.

Pre-registered KILL criteria — what would confirm the Avoid and take this toward a structural short-side view:

• Fiscal-2027 revenue guidance on 2026-09-01 below roughly $13.4 billion (the consensus low of $13.426 billion). At 89x forward earnings there is nothing underneath a guide-down.
• Any impairment charge against the roughly $25 billion of goodwill and acquired intangibles created by the Chronosphere and CyberArk transactions. The purchase-price allocations are explicitly preliminary and open for up to twelve months.
• Organic revenue growth printing below 12%, or the company ceasing to disclose an organic-versus-acquired split at all.
• GAAP gross margin below 67% for a second consecutive quarter, indicating the April quarter's 540-basis-point decline is structural rather than amortisation-driven.
• A second consecutive quarter of GAAP operating losses with no disclosed path back to the 13.5% margin delivered in fiscal 2025.
• Loss of one of the three distributors representing 18.8%, 14.4% and 11.0% of revenue.

Pre-registered FLIP conditions — what would take this to Buy — Tactical:

• Price below approximately $260 (roughly 63x fiscal-2027 consensus, 54x fiscal 2028, 15x fiscal-2027 enterprise value to sales) with no deterioration in the fundamental picture. This is the single most likely path to a Buy and it requires a 29% decline — a large move, but smaller than the move this stock has just made in the other direction inside three months. At $255-260 the base case is fair value and the bull case is +65%.
• A 2026-09-01 print that resets the base high enough to make the multiple defensible: fiscal-2027 revenue guidance materially above $13.828 billion with disclosed organic growth at or above 17% and GAAP operating income back positive and Next-Generation Security annualised recurring revenue accelerating. All four, not any one — this is a high bar deliberately, because the price already assumes three of them.
• Evidence that CyberArk is accretive ahead of schedule — specifically, the acquired businesses' operating loss narrowing from the disclosed $523 million quarterly run-rate materially faster than the amortisation schedule alone would produce.
• A meaningful re-rating of the sell-side targets ABOVE the price on fundamental grounds rather than momentum-chasing, which would tell us the crowd has re-underwritten the name at this level rather than simply been outrun by it.
• Genuine name-level valuation conviction appearing in the knowledge base. At present the lane has eleven claims and not one of them addresses price. A well-sourced, named-speaker claim arguing the terminal value at this multiple would be worth roughly one tier.

Where PANW fits in the Synthos Framework Portfolio. The cybersecurity and enterprise-software sleeve, at 0% today with a 1.5-2% target on a fill near $255-260 or a confirmed 2026-09-01 reset. On the batch overlap question: this is the only cybersecurity name in this batch, so there is no direct substitution problem — but the knowledge base repeatedly pairs Palo Alto with CrowdStrike and Zscaler, and a reader holding CRWD already holds a large share of this thesis. Note also that 2026-08-04 was a broad technology up-day across every name in this batch; anyone sizing a position today is sizing it at the top of a sector-wide move, not just a company-specific one. Logged as a tracked Synthos call (Avoid) as of 2026-08-04 at $366.34.

Single biggest risk: the multiple, and it does not require the business to fail. At 89.0x fiscal-2027 consensus non-GAAP earnings, a de-rating to 45x — still a premium growth-software multiple, and roughly double the market's — is $185, a 49.5% decline, with every consensus estimate left exactly where it is. The entire architecture of the price rests on the market continuing to pay 75-90x forward earnings for a company consensus expects to grow those earnings 9.0% next fiscal year and 17.7% the year after. There is no valuation cushion of any kind: at 28.2x sales and 354x GAAP earnings, a disappointment does not produce a proportional decline, it produces a de-rating on top of it, and that is what the $185 bear case is.

Most fragile assumption in the price: that the roughly $2.2 billion a year of costs excluded from non-GAAP earnings never has to be paid for by the multiple. Every other assumption embedded at $366.34 is a revenue assumption, and revenue is observable quarter by quarter. This one is an accounting-convention assumption. The gap between $1.03 of trailing GAAP earnings per share and $3.76 of trailing non-GAAP is $2.73 a share on 815 million shares — comprising $1.3 billion a year of share-based compensation, with $3.6 billion unvested over 2.6 years, plus acquired-intangible amortisation running at roughly $400 million a quarter. Share-based compensation is not a bookkeeping entry; it is a transfer of ownership, and it has transferred a lot: weighted diluted shares of 709.3 million in fiscal 2025 became 815 million outstanding by 26 May 2026, a 14.9% increase in under a year. The market is currently agreeing to look through all of it. If that convention shifts — and it shifts periodically, usually when growth slows — the applicable multiple is not 89x on $4.11 but something far lower on something far smaller, and that is a repricing this stock has no protection against.

Provenance & disclosures

• Traceability: 11 tagged knowledge-base claims name Palo Alto Networks (raw hits 11, entity matches 11, text-only matches 0, discarded for collision 0; breadth 5, net conviction positive-moderate). Sources: no_priors (3 claims, all 2025-10-02, all bullish, conviction 78/75/72, all from a single doc_id and a single episode, all with NO named speaker — the platform-consolidation, sensor/control-point and unknown-bad claims); compound_and_friends (4 claims: 2026-01-06 bullish 55, 2026-02-24 bullish 62, 2026-04-10 BEARISH 65, all three with no named speaker, and 2026-04-24 bullish 60, speaker Adam Parker); all_in (2 claims: 2025-10-09 bullish 80 and 2026-05-01 bullish 52, both with no named speaker); business_breakdowns (1 claim, 2023-05-23, neutral 60, no named speaker); and anthony_pompliano_show (1 claim, 2026-02-13, bullish 75, speaker Dan Ives, role independent, attribution guest — first-class under house policy, which weights the host's own voice low but treats guests as first-class). NINE of the eleven claims carry no named speaker and are attributed only to a channel — the weakest sourcing the 4-lane attribution policy admits, and it is 81.8% of this lane. THREE of the eleven share a single doc_id, date and channel, so effective breadth is roughly 9 source-events, not 11. Those three are half-weighted as probable company-adjacent voice on the basis of first-person operator framing, disclosed as an inference we cannot prove from the file. One channel reversed stance twice inside ten weeks (2026-01-06 bullish → 2026-02-24 bullish → 2026-04-10 bearish → 2026-04-24 bullish), with three of those four unattributed to a speaker — reported as a per-channel concentration and reversal finding. NOT ONE claim in the lane addresses valuation, which is the only question this dive turns on, and the lane therefore does not move the fair value. All quotes are verbatim from the stored claim text; the Dan Ives claim's stored quote contains raw speech-to-text errors on ticker names and references to AI vendors which are redacted per house style — the redaction is noted inline where it occurs.
• Data as-of: fundamentals — the most recent filing-verified financials are as of 2026-04-30, from the 10-Q filed 2026-06-03; the most recent audited annual statements are fiscal 2025, ended 2025-07-31, from the 10-K filed 2025-08-29 · estimates 2026-08-04 · prices 2026-08-04, quote timestamp 1785873601 = 2026-08-04T20:00:01Z ($366.34, +5.53%; 50-DMA $309.55; 200-DMA $215.81; RSI 55.9; MACD +8.58) · knowledge-base claims 2026-08-04. Fiscal/calendar note: Palo Alto's fiscal year ends 31 July. "FY2025" means the twelve months to 2025-07-31, and "Q3 FY2026" means the quarter ended 2026-04-30. CRITICAL TIMING DISCLOSURE: fiscal 2026 ended 2026-07-31, four days before this dive, and no results have been published. The entire May-July 2026 quarter — the first full quarter with CyberArk consolidated — is absent from every figure in this document. All figures come from the Synthos vendor data file for PANW or from the SEC filings in the PANW archive; no figure comes from memory, recall or external retrieval.
• Filing archive contents and its gaps: 10-K filed 2025-08-29 (fiscal 2025); 10-Q filed 2026-02-18 (January 2026 quarter); 10-Q filed 2026-06-03 (April 2026 quarter); 8-K filed 2026-03-23 (settlement-method election on the assumed 2030 convertible notes); 8-K filed 2026-04-13 (three Santa Clara headquarters lease amendments, event dated 2026-04-08); 8-K filed 2026-06-02 (third-quarter results). The 2026-06-02 8-K is present as the cover document ONLY — Exhibit 99.1, the press release carrying the financials, was not extracted. Known extraction limit, stated rather than estimated around: numeric TABLES are stripped from the current filing-text extraction. The consequence for this name is specific and material — the Next-Generation Security annualised recurring revenue figure, the balance sheet at 30 April 2026, the earnings-per-share computation table, the purchase-price allocations for CyberArk and Chronosphere, and the quarterly deferred-revenue balance are all published by the company in table form and are therefore unavailable here. Where a figure exists only in a table we have said so and refused to estimate it. Balance-sheet figures for 30 April 2026 in this dive come from the 10-Q's PROSE disclosures (total cash, cash equivalents and investments $7.0 billion; 2030 Notes $1.1 billion principal remaining, $1.2 billion fair value long-term plus $0.16 billion current; revolver $400 million undrawn) and are labelled as such.
• Where the filings contradicted or corrected the vendor (detailed in Section 8): the entire balance sheet was rejected as stale — bal_a[0] is dated 2025-07-31 and pre-dates roughly $24.5 billion of acquisitions (CyberArk $21.1B on 2026-02-11, Chronosphere $3.0B on 2026-01-29, Koi $231M, Portkey $140M), 112 million shares issued, 27 million more issued to settle warrants, $1.25 billion of convertible notes assumed and $1.0 billion of stock repurchased; totalDebt of $338.2M identified as 100% OPERATING leases against the 10-K's "We did not have any material finance leases in any of the periods presented", with true financial debt at fiscal-2025 year end of ZERO; net debt rebuilt from −$1.930B to net CASH of $9.461B (fiscal 2025) and approximately $5.64B currently, the vendor omitting $7.19 billion of short- and long-term investments the 10-Q lists as liquidity; enterprise value rebuilt from $298.274B to $292.93B and every enterprise-value multiple recomputed; trailing EBITDA rebuilt from the vendor's $2,278.7M to $1,905.0M after establishing that the vendor's figure is pre-tax income plus D&A and therefore double-counts $373.6 million of interest income against a cash balance already netted in enterprise value — a correction that makes the multiple worse, 153.8x rather than 130.9x, and is published anyway; fiscal-2024 GAAP earnings stripped of a $1,589.3 million one-time deferred-tax valuation-allowance release confirmed verbatim in the 10-K, restating diluted earnings per share from $3.64 to $0.99 and converting the reported GAAP series from a spike-and-collapse into a monotone climb; est.ebitdaAvg, est.ebitAvg and est.sgaExpenseAvg rejected in full as fixed ratios of revenue (42.9581%, 41.3095% and 44.3861% in every year from fiscal 2024 through fiscal 2030, identical to four decimal places), with the fiscal-2025 ebitdaAvg verified at 149% above the actual; trailing capital expenditure of ~$77 million rejected as below a single disclosed $91 million land purchase in the same period, with all free-cash-flow figures reverted to the fiscal-2025 cash-flow statement; stockBasedCompensationToRevenueTTM flagged as implying $1,025.4M against $1,295.1M in fiscal 2025 alone; the April-quarter earnings-per-share figures rejected as unreconcilable (−$177.0M ÷ 729M = −$0.24, not the printed −$0.29, with a diluted share count impermissibly above basic in a loss period); quote.yearHigh/yearLow ($368.80/$139.57) rejected in favour of tech.hi52/lo52 ($366.34/$141.67) for internal consistency. Where vendor and filing AGREED — worth recording, because several of these checks are the ones that most often fail: the share count is exact (market capitalisation $298,567,100,000 ÷ $366.34 = 815,000,000, and the 10-Q cover states "815 million" as of 2026-05-26); seg_prod and seg_geo both sum precisely to reported revenue for fiscal 2025 and fiscal 2024; the Q3 FY2026 effective tax rate of −13.5% matches the 10-Q verbatim; the convertible-note history (shortTermDebt $1,991.5M → $963.9M → $0, with fiscal-2025 netDebtIssuance of −$965.6M) correctly traces the 0.375% 2025 Notes to their 1 June 2025 settlement; reportedCurrency is USD throughout with no currency mixing; and est.epsAvg for fiscal 2026 ($3.7734) reconciles to the three reported non-GAAP quarters plus the fourth-quarter estimate ($3.786) within 0.3%.
• Basis note — the central issue on this name. inc_a and inc_q are GAAP. est and earn_cal are non-GAAP, and we verified it: fiscal-2026 epsAvg of $3.7734 ties to the sum of the reported non-GAAP quarters, while fiscal-2025 epsAvg of $3.27381 is 2.05x the fiscal-2025 GAAP diluted figure of $1.60. The gap is enormous and it is the single most important interpretive fact in this dive: trailing GAAP earnings per share of $1.03 (on 815 million shares) against trailing non-GAAP of $3.76 — a wedge of $2.73 a share, roughly $2.2 billion a year, comprising share-based compensation ($1,295.1 million in fiscal 2025, $3.6 billion unvested over 2.6 years) and amortisation of acquired intangibles (quarterly D&A of $89M → $226M → $483M across fiscal 2026). Forward multiples in this dive use consensus non-GAAP earnings per share and are labelled as such; the trailing multiple is shown on BOTH bases — 354.3x GAAP and 97.4x non-GAAP — and on an intermediate basis with the disclosed acquisition drag stripped (~212x). The conclusion is identical on all three. Fiscal-2024 GAAP earnings are additionally corrected for the $1.589 billion valuation-allowance release before any historical comparison is drawn.
• Estimate coverage: 38-40 analysts on fiscal-2026 and fiscal-2027 revenue; 29 on fiscal-2026 earnings and 17 on fiscal 2027 — the fiscal-2027 EPS row (low $3.86235, mean $4.11446, high $4.58843) is the tightest and best-covered in the block and is the primary fair-value anchor. The fiscal-2028 EPS row rests on 12 analysts with a low of $2.1169 and a high of $7.23979 — a 3.4x dispersion that almost certainly mixes accounting bases — and is used only as a cross-check. The fiscal-2029 row rests on TWO EPS analysts and the fiscal-2030 row on ZERO (all EPS and net-income fields exactly 0). All three are excluded from every conclusion. est.netIncomeAvg implies four mutually inconsistent share denominators (700.8M, 728.4M, 850.1M, 709.3M), two of them below the actual 815 million outstanding; it is reported and not used.
• Peer note: the vendor peer set contains two genuine comparables — CrowdStrike ($215.1B) and Fortinet ($123.5B) — plus two useful enterprise-software reference points, ServiceNow ($122.1B) and Adobe ($102.4B), alongside names that are not comparable at all (Accenture, Amphenol, KLA, Sony, Synopsys, Texas Instruments). No peer multiples are supplied in the file, so no peer-multiple comparison is drawn. The 10-K's own four-category competition framing is used instead: large incumbents embedding security (Cisco, Microsoft, Alphabet); independent security vendors (Check Point, Fortinet, CrowdStrike, Zscaler, Wiz); point-product startups; and public-cloud security providers.
• Fair-value caveat: the $185 / $255 / $430 anchors are multiples of the fiscal-2027 and fiscal-2028 consensus non-GAAP earnings distribution — 45x and 62x the fiscal-2027 mean of $4.11446, and 89.0x (today's forward multiple, held) the fiscal-2028 mean of $4.8394. Stated arithmetic, not a discounted cash flow. The base is deliberately sensitivity-disclosed: 55x gives $226 and 70x gives $288; the whole answer lives in a 55-70x band and no greater precision is claimed. Note that 62x is itself an extremely generous multiple — the base case does not mark this business to a market multiple, it marks it to a rich growth-software multiple, and it is still 30.4% below the price. The bear case assumes a de-rating with NO estimate cuts; the bull case assumes NO re-rating at all, only that consensus fiscal-2028 earnings arrive — and it coincides with the street's own high target of $430, which we take as an independent ceiling check.
• Timing: fiscal 2026 ended 2026-07-31, four days before this dive, with no results published. The next print is 2026-09-01, 28 days away — outside the five-day banner window, so no banner is set, but the timing is an explicit and heavily weighted input to the verdict rather than an aside. It is the fourth-quarter AND full-year report, the first full quarter with CyberArk consolidated, and the print that sets initial fiscal-2027 guidance. The last reported quarter is the three months to 30 April 2026, released 2026-06-02, 63 days before this dive. 2026-08-04 was a broad technology up-day across this entire batch (ARM +17.36%, MRVL +12.81%, INTC +10.92%, LRCX +7.85%, MU +7.62%, AMD +7.00%, KLAC +6.95%, PANW +5.53%, TXN +5.42%, AMAT +5.48%, ASML +4.22%, IBM +3.91%, ANET +3.06%); PANW's 5.53% move carried no company-specific news in this file and is treated as sector beta.
• Accessibility note: no information in this dive is conveyed by colour. All emphasis is carried by bold text, table structure and explicit labelling.
• Not investment advice. Independent research, educational and informational only, never personalised. No recommendation to buy, sell or hold any security is made to any person.
• Version: 2026-08-04-full.