PANW Q2 FY2026 Earnings: CyberArk Masks 2.7% Organic Growth Behind 28% Headline

When Palo Alto Networks guided Q3 non-GAAP EPS to $0.78–$0.80 — twelve cents below the Street's $0.92 consensus — the stock dropped 5%, erasing a Q2 that cleared both revenue ($2.594 billion, +15% Y/Y) and earnings ($1.03 non-GAAP EPS versus $0.94 estimated) by comfortable margins. The 8-K framed the miss as CyberArk integration costs, even as Q3 revenue guidance of $2.94–$2.95 billion implied 28% year-over-year growth — a seeming contradiction. The 10-Q filed February 18 fills in what the press release left out.

Quarterly thesis: This quarter shows Palo Alto Networks generating headline 73% incremental operating margins and a 10% EPS beat, which means the platformization model appears to be scaling at an impressive clip, but the quarterly filing shows that a $69 million quarter-over-quarter SBC decline explains virtually all the margin expansion and CyberArk's ~$280 million revenue contribution will mask organic sequential growth of just ~2.7% starting Q3 — complicating the outlook for investors trying to separate real operating leverage from accounting optics and acquisition layering.

The distinction matters because PANW trades at roughly 35 times trailing free cash flow. At that multiple, investors are paying for compound organic growth and structural margin expansion — not for a one-quarter SBC timing benefit and inorganic revenue acceleration that obscures the underlying growth trajectory.

CyberArk Revenue Inflection Hides a 2.7% Organic Growth Rate

The headline Q3 revenue guidance of $2.94–$2.95 billion represents 28–29% year-over-year growth — nearly double Q2's 15% organic rate. The acceleration is almost entirely CyberArk. Management completed the $25 billion acquisition on February 11, 2026, ten days after the Q2 quarter ended, meaning Q3 will be the first full quarter with CyberArk revenue consolidated.

CyberArk's last standalone quarter generated approximately $280 million in revenue. Subtracting that from the ~$350 million guided sequential step-up leaves roughly $70 million in organic sequential growth — a 2.7% rate that would represent a deceleration from Q2's 4.9% sequential pace. Neither the 8-K earnings release nor the 10-Q explicitly decomposes organic versus inorganic growth, making this the single most important analytical gap for investors evaluating the platformization thesis.

The same dynamic inflates the NGS ARR trajectory. Q2's $6.3 billion in next-generation security ARR grew 33% year-over-year on an organic basis. Q3 guidance of $7.94–$7.96 billion (+56% Y/Y) folds in CyberArk's ARR base. Without a clean organic-versus-inorganic breakout, investors cannot determine whether the underlying NGS ARR growth rate is accelerating, decelerating, or flat.

On a year-over-year basis, Q2's organic revenue growth of 15% compares to 14% in Q2 FY2025, showing modest acceleration. Product revenue grew 22% Y/Y — outpacing subscription and support at 13% — driven by what the 10-Q attributes to "increased revenue from software licenses and increased demand for our new generation of hardware products." The product mix shift toward software is structurally positive, but investors need the organic Q3 trajectory to assess whether this momentum sustains post-CyberArk.

Palo Alto Networks' Q3 FY2026 revenue guidance of $2.94 billion implies approximately $70 million in organic sequential growth — just 2.7% — with CyberArk contributing roughly 80% of the $350 million revenue step-up, making organic growth decomposition the critical missing disclosure for the next two to three quarters.

73% Incremental Margins or 16%? The SBC Question

The headline operating story looks compelling: operating margin expanded 281 basis points quarter over quarter to 15.3%, with incremental operating margin of 73.3% — meaning $0.73 of every additional revenue dollar dropped to operating income. Year-over-year, operating income surged 64.7% ($397 million versus $241 million), dramatically outpacing the 15% revenue growth and demonstrating the 5.9x operating leverage ratio that platform bulls point to. Except the 10-Q data shows this is primarily an SBC timing artifact.

Stock-based compensation declined $69 million sequentially, from $370 million in Q1 (15.0% of revenue) to $301 million in Q2 (11.6% of revenue). Q1 included elevated SBC from annual grant timing, and Q2's lower figure partly reflects seasonal normalization rather than structural efficiency. Stripping SBC from both quarters reveals a different picture entirely:

The formula is straightforward: non-SBC operating income grew $19 million ($698 million versus $679 million) on $120 million of revenue growth, producing a 15.8% incremental margin — barely above breakeven economics for the incremental revenue dollar. The headline 73.3% versus the ex-SBC 15.8% is the widest gap between reported and underlying operating leverage in the research sample.

"Product gross margin increased for the three and six months ended January 31, 2026 compared to the same periods in 2025 primarily due to continued shift in our product revenue mix toward software, and a decrease in inventory excess and obsolete charges, partially offset by a decrease in gross margin on our hardware products."

The software mix shift is a genuine structural positive — product revenue grew 22% year-over-year versus 13% for subscription and support — and supports the platformization thesis at the gross margin level. But at the operating income level, SBC remains the dominant variable. The GAAP-to-Non-GAAP EPS bridge makes this explicit: GAAP EPS of $0.61 plus $0.42 per share in SBC add-backs equals non-GAAP EPS of $1.03, with all other adjustments netting to approximately negative $1 million. Forty-one percent of reported non-GAAP earnings is stock compensation.

The $2.9 billion in unvested SBC liabilities represents roughly 2.2 times the annual run rate ($301 million times four quarters equals $1.2 billion), signaling two to three years of elevated SBC at current levels. And starting Q3, CyberArk's own stock compensation will be consolidated, likely pushing the SBC-to-revenue ratio back above 14%. The 112 million new CyberArk shares will dilute the per-share impact across a 15.9% larger share base, partially offsetting the higher SBC dollar amount — but the GAAP-to-Non-GAAP gap is set to widen before it narrows.

Palo Alto Networks' Q2 operating margin expansion of 281 basis points is real in accounting terms, but the underlying incremental margin of 15.8% excluding SBC timing suggests the cost structure is growing nearly as fast as revenue — a dynamic that CyberArk integration costs will amplify rather than resolve in Q3.

Cash Flow Volatility and the $6.5 Billion Cloud Lock-In

Operating cash flow swung from $1,771 million in Q1 to $554 million in Q2 — a 68.7% sequential decline that looks alarming in isolation but is almost entirely a working capital timing effect. Accounts receivable increased $758 million in Q2 (billings outpacing collections) versus a $1,622 million AR decline in Q1 (seasonal collection surge). The net working capital swing of $1,636 million in a single quarter — from a $1,098 million tailwind to a negative $538 million headwind — makes quarterly OCF largely meaningless for trend analysis.

"Cash provided by operating activities during the six months ended January 31, 2026 was $2.3 billion, an increase of $258 million compared to the same period in 2025."

The H1 view is the more reliable indicator: $2.3 billion in OCF, up $258 million or 12.6% year-over-year, confirms underlying cash generation strength. Trailing-twelve-month free cash flow of $3.57 billion at a 36% margin puts Palo Alto Networks' Rule of 40 score at approximately 51 (15% revenue growth plus 36% FCF margin) — comfortably above the 40 threshold for healthy software economics. But the TTM OCF-to-net-income ratio of 3.1x — far above the 1.0x equilibrium — signals the cash flow quality conversation will persist.

The balance sheet carries a less-discussed structural commitment. The 10-Q footnotes disclose $6.45 billion in non-cancelable cloud hosting commitments, plus $104 million in additional minimum purchases through September 2027.

"We have entered into various non-cancelable agreements with cloud hosting service providers, under which we are committed to minimum or fixed purchases of certain cloud hosting services."

Total off-balance-sheet exposure reaches $6.79 billion — including $198 million in manufacturing commitments and $145 million in other obligations — representing 65.4% of annualized revenue locked into fixed future cash outflows regardless of business performance. For a company that had zero on-balance-sheet debt prior to CyberArk's closing, these commitments function as quasi-debt that reduces capital allocation flexibility.

Capital expenditures doubled from $84 million in Q1 (3.40% of revenue) to $170 million in Q2 (6.55% of revenue). The capex-to-depreciation ratio of 1.87x (versus 0.94x in Q1) signals PANW is investing well above maintenance levels — likely building infrastructure ahead of CyberArk and Chronosphere integration. Share repurchases remain at zero for all of H1 FY2026 despite $7.9 billion in cash and a $1.0 billion remaining authorization expiring December 2026, as management preserved capital for the $2.3 billion CyberArk cash payment. Post-acquisition, remaining cash and investments of approximately $5.6 billion leave ample liquidity — but the $400 million undrawn credit facility (maturing April 2028) is now the only formal backstop.

Palo Alto Networks' $6.45 billion in non-cancelable cloud hosting commitments equal 65.4% of annualized revenue in fixed future cash outflows, adding structural cost rigidity to a balance sheet simultaneously absorbing the largest cybersecurity acquisition in history.

Four New Risk Factors Transform the Balance Sheet

Prior to Q2 FY2026, Palo Alto Networks had one of the cleanest capital structures in enterprise software: zero debt, $7.9 billion in cash and investments, and a risk factor section focused on competitive dynamics and geopolitical exposure. The CyberArk acquisition fundamentally altered that profile, and the 10-Q introduces four new risk factors tied directly to deal mechanics.

The most consequential is the convertible Notes risk:

"We may not have the ability to raise the funds necessary to settle conversions of the CyberArk Notes, repurchase the CyberArk Notes upon a fundamental change, or repay the CyberArk Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the CyberArk Notes."

The Notes-related and capped call transaction risks are genuinely new in Q2 — they became relevant only upon deal closing on February 11, 2026, and could not have appeared in prior filings. PANW transitioned from a debt-free company to one carrying convertible note obligations with potential dilution or cash settlement triggers. The integration scope risk acknowledges that "the scope and size of our business has substantially changed, which resulted in certain incremental risks, including increased competition" — a candid admission of expanded risk from the identity security market entry. The expanded Israel operations risk reflects CyberArk's Tel Aviv headquarters and planned TASE dual-listing under the CYBR ticker.

The balance sheet impact is already visible. Goodwill surged $2,364 million in Q2 — entirely from the Chronosphere acquisition (closed January 29, within the quarter; CyberArk closed post-quarter on February 11 and will appear in Q3). Goodwill now stands at $6,931 million, or 27.7% of total assets, up from 19.4% just one quarter earlier. Tangible book value collapsed 64% from $3,375 million to $1,213 million ($1.73 per share). And CyberArk's goodwill — estimated at $15–20 billion based on the $25 billion enterprise value minus identifiable intangibles — will push goodwill-to-assets well above 50% in Q3.

On the positive side, distributor concentration improved modestly from 44.2% of FY2025 revenue to 42% in H1 FY2026. The Eire OG patent lawsuit was quietly settled in December 2025 for an immaterial amount, eliminating that risk entirely. The Centripetal Networks accrual of $149 million remains under appeal, with the judgment already reduced to $114 million — capped and declining risk. But these incremental positives are dwarfed by the structural transformation.

Palo Alto Networks' four new CyberArk risk factors and $6,931 million in goodwill at 27.7% of total assets — set to exceed 50% once the $25 billion CyberArk purchase price allocation lands in Q3 — mark the most significant structural shift in the company's risk profile since its 2012 IPO.

Q3 FY2026: The Integration Stress Test

CyberArk's first full quarter of consolidation will force three questions that the Q2 filing left open — and each carries a tipping point where the investment thesis shifts.

The organic growth question is the most consequential. If PANW provides organic versus inorganic revenue breakouts, investors can assess whether the underlying 2.7% sequential growth estimate is accurate. Organic sequential growth above 4% — matching Q2's pace — would suggest CyberArk is additive rather than substitutive. Below 2% signals organic deceleration worse than headline guidance implies and puts the platformization narrative under direct pressure.

SBC trajectory will reveal whether Q2's 11.6% ratio was a seasonal trough or the start of a structural shift. CyberArk's compensation costs will be consolidated starting Q3, with 112 million additional shares in the diluted count. A rebound above 14% confirms the Q2 margin expansion was a one-quarter anomaly driven by grant timing — and that the 4.7% Q/Q underlying cost inflation in non-SBC OpEx is the real trend. Below 13% despite CyberArk absorption would be a genuine positive for GAAP earnings convergence.

The preliminary CyberArk purchase price allocation will set the balance sheet narrative for years. A goodwill allocation above $18 billion pushes goodwill-to-assets past 55%, creating meaningful impairment risk if integration milestones slip. The intangible amortization schedule will directly widen the GAAP-to-Non-GAAP gap from the current $0.42 per share — investors should track the new amortization run rate alongside the goodwill figure.

Beyond those three, watch OCF normalization (H1 was $2.3 billion — Q3 alone should exceed $800 million for the TTM trajectory to hold), whether the $1.0 billion buyback authorization reactivates now that CyberArk is funded, and any conversion activity on the CyberArk Notes.

Frequently Asked Questions

What were Palo Alto Networks' Q2 FY2026 revenue and earnings?

Palo Alto Networks reported Q2 FY2026 revenue of $2.594 billion, up 15% year-over-year and 4.9% sequentially. GAAP diluted EPS was $0.61, up 29.8% from Q1's $0.47, while non-GAAP EPS of $1.03 beat the $0.94 consensus by approximately 10%. The gap between GAAP and non-GAAP EPS — $0.42 per share — is almost entirely stock-based compensation of $301 million. Product revenue grew 22% Y/Y driven by software license acceleration and new-generation hardware demand, while subscription and support revenue grew 13% Y/Y. Source: Palo Alto Networks Q2 FY2026 10-Q and 8-K earnings release.

Why did PANW stock drop 5% despite beating Q2 estimates?

Despite beating on both revenue and EPS, the stock fell approximately 5% after Palo Alto Networks guided Q3 non-GAAP EPS to $0.78–$0.80, significantly below the Street's $0.92 consensus. The below-consensus EPS guidance reflects near-term margin compression from CyberArk integration costs. The $25 billion acquisition — the largest in cybersecurity history — closed February 11, 2026, just ten days after Q2 ended. Investors weighed the earnings dilution more heavily than the Q3 revenue acceleration to $2.94–$2.95 billion (+28–29% Y/Y). Full-year FY2026 revenue guidance was raised to $11.28–$11.31 billion. Source: 8-K earnings release.

What is Palo Alto Networks' organic growth rate excluding CyberArk?

Q3 revenue guidance of $2.94–$2.95 billion implies approximately $350 million of sequential growth from Q2's $2.594 billion. CyberArk's last standalone quarter generated approximately $280 million in revenue. Subtracting CyberArk's contribution implies organic sequential growth of roughly $70 million, or approximately 2.7% — a deceleration from Q2's 4.9% organic sequential pace. The same dynamic affects NGS ARR: Q3 guided at $7.94–$7.96 billion (+56% Y/Y) versus Q2's $6.3 billion (+33% Y/Y), with the acceleration largely attributable to CyberArk's ARR base folding in. Source: 8-K guidance and CyberArk standalone financials.

How much of PANW's non-GAAP earnings are stock-based compensation adjustments?

Stock-based compensation of $301 million ($0.42 per share) accounts for approximately 41% of non-GAAP EPS of $1.03. SBC is the only material non-GAAP adjustment — the residual gap between GAAP net income plus SBC and non-GAAP net income is just negative $1 million. The company's $2.9 billion in unvested SBC liabilities represents roughly 2.2 times the annual run rate, signaling two to three years of future SBC at current levels. SBC-to-revenue of 11.6% was the lowest in four-plus quarters but partly reflects seasonal timing, as Q1's 15.0% included annual grant effects. Source: 10-Q and 8-K.

Why did PANW's operating cash flow decline 69% quarter over quarter?

OCF fell from $1,771 million in Q1 to $554 million in Q2, a 68.7% decline driven by working capital timing — not earnings deterioration. Accounts receivable increased $758 million (billings outpacing collections) versus a $1,622 million AR decline in Q1 when year-end collections inflated cash flow. The net working capital swing was $1,636 million in a single quarter. First-half OCF of $2.3 billion increased $258 million year-over-year, and trailing-twelve-month OCF of $3.97 billion grew 27.8%, both confirming the underlying trend. TTM free cash flow margin of 36.0% is the relevant figure, not the quarterly 14.8%. Source: Palo Alto Networks Q2 FY2026 10-Q.

What are PANW's off-balance-sheet cloud hosting commitments?

The 10-Q discloses $6.45 billion in non-cancelable cloud hosting commitments, plus $104 million in additional minimum purchase obligations through September 2027. Combined with $198 million in manufacturing commitments and $145 million in other obligations, total off-balance-sheet exposure reaches $6.79 billion — equivalent to 65.4% of annualized revenue in fixed future cash outflows. These commitments function as quasi-debt for a company that carried zero on-balance-sheet debt prior to the CyberArk closing. The lack of cancelability means these costs flow through regardless of business trajectory. Source: 10-Q, Commitments Footnote.

What new risk factors did PANW add related to CyberArk?

Four CyberArk-related risk factors were added in the Q2 10-Q: (1) CyberArk Notes conversion risk — the company may lack funds to settle conversions, rated medium-high; (2) integration scope — management acknowledges the business has "substantially changed, which resulted in certain incremental risks, including increased competition"; (3) expanded Israel operations from CyberArk's Tel Aviv presence and planned TASE dual-listing; and (4) capped call transaction risk. The Notes and capped call risks are genuinely new in Q2, tied to deal mechanics that became relevant only upon the February 11 closing. No prior risk factors were removed. Source: 10-Q, Risk Factors.

What should investors watch in PANW's Q3 FY2026 results?

Three metrics define Q3: (1) Organic revenue growth — if management discloses CyberArk's contribution, organic sequential growth above 4% is bullish while below 2% signals deceleration worse than guided. (2) SBC-to-revenue — a rise back above 14% from Q2's 11.6% confirms the margin expansion was a one-quarter anomaly driven by grant timing. (3) CyberArk goodwill allocation — goodwill above $18 billion pushes goodwill-to-assets past 55%, creating impairment risk. Also monitor OCF normalization (Q3 should exceed $800 million), whether the $1.0 billion buyback authorization reactivates, and the CyberArk Notes conversion triggers and pricing. Source: 10-Q and 8-K guidance.

Methodology

Data Sources

This analysis is based on Palo Alto Networks' Q2 FY2026 10-Q filing (filed February 18, 2026, accession 0001327567-26-000005) and 8-K earnings release (filed February 17, 2026), supplemented by MetricDuck's automated financial data pipeline covering income statement, balance sheet, cash flow, and per-share metrics. Filing quotes are sourced verbatim from the 10-Q filing text with section attribution. Analyst consensus estimates are derived from publicly available aggregated forecasts.

Limitations

• The organic growth decomposition (~$70M sequential / ~2.7%) is estimated using CyberArk's standalone revenue run rate; the actual contribution may differ due to deferred revenue purchase accounting adjustments, partial-quarter timing effects, or cross-selling synergies.
• SBC figures for Q1 FY2026 ($370M) are from the MetricDuck pipeline and are not directly quoted in the Q2 10-Q MD&A body text.
• CyberArk goodwill estimate of $15–20 billion is directional based on the $25 billion enterprise value minus estimated identifiable intangibles; the preliminary purchase price allocation in Q3 will determine the actual figure.
• The non-SBC incremental margin (15.8%) uses GAAP operating income plus SBC as a proxy; other non-cash items such as intangible amortization and acquisition-related costs are not stripped from the calculation.
• Risk factor comparisons reference the FY2025 10-K as baseline rather than the Q1 FY2026 10-Q; the integration scope risk may have been flagged in Q1 in the context of the then-pending acquisition announcement.
• Forward-looking SBC estimates assume CyberArk's historical compensation patterns continue post-acquisition; retention packages or accelerated vesting could produce materially different outcomes.

Disclaimer

This analysis is for informational purposes only and does not constitute investment advice. The author does not hold positions in PANW. Past performance and current metrics do not guarantee future results. All data is derived from public SEC filings and may contain errors or omissions from the automated extraction process.