Palo Alto Networks spent fiscal 2026 buying the missing identity and observability layers of a four-platform cybersecurity stack, and the July quarter is the first clean look at whether that bet is converting into recurring demand rather than just a larger balance sheet. Next-generation security annual recurring revenue, the company's preferred measure of software and subscription run-rate excluding hardware and legacy attach, reached $9.1 billion. That print includes nearly $1 billion of net new ARR in a single quarter plus the first full contribution from CyberArk Software, now sold as Idira, and from Chronosphere. The investment debate is no longer whether the firewall franchise can platformize. It is whether identity attach and AI-security products can keep the growth rate from collapsing once the acquired ARR anniversaries next year.
The GAAP income statement tells a different story from the cash and bookings tape. Fourth-quarter operating income fell to $172 million as amortization of acquired intangibles and deal costs landed, and a fair-value charge on convertible notes inherited from CyberArk pushed the quarter to a net loss. Cash from operations still rose to $1.4 billion. Adjusted free cash flow margin for the full year held near 38 percent. The market is paying a software-consolidator multiple for that cash engine, which only works if Idira attach and Prisma AIRS, the AI runtime security product that crossed $100 million of ARR in four quarters, keep compounding after the deal math fades.
Fiscal 2027 guidance is the first official confession that the reported growth rate is about to step down. Management guides next-generation security ARR toward $11.1 billion, a low-twenties increase that is less than half the fourth-quarter rate. Remaining performance obligations, the contracted backlog not yet recognized as revenue, are guided toward $25 billion. The next year resolves whether organic platformization replaces the acquired ARR stack or whether the multiple compresses as the growth rate normalizes.