The Platform Delivered. The Backlog Blinked.
The scorecard we froze four days before the print, graded: six cleared, two missed — and what the release changed.
This note is the partner of our pre-event note, The Price Ran Past the Platform (August 28), which set out the company, the framework and the eight questions frozen before the print. It scores those questions, re-runs that note’s model on the release, and re-arms the triggers. Every figure comes from the company’s 8-K, deck and supplemental, the frozen archive, or two corroborated call transcriptions.
What the print changed
Palo Alto Networks reported the best quarter in its history by the measure it asks to be judged on. Adjusted EPS of $1.02 against a $0.96–0.98 guide; revenue of $3.41bn, up 34%; Next-Generation Security ARR (the company’s measure of annualized recurring revenue from its newer products) of $9.10bn, up 63%, with roughly $970m of net new recurring revenue in the quarter, 98% more than a year ago and a record; contracted backlog (remaining performance obligations, RPO) of $21.2bn, up 34%; adjusted free cash flow of $4.41bn for the year, a 38.4% margin. It then guided fiscal 2027 above the street on every line and reaffirmed both long-range promises, a 40%-plus cash margin in fiscal 2028 and $20bn of recurring revenue by fiscal 2030. The market sold it anyway: −9.3% to $328.47 on Wednesday, the fourth straight beat the stock has sold and the largest of the four, a day after a −5.2% session on a broad down day and inside the ±9.4% the options market had priced for the week.
Net new recurring revenue added in a single quarter — 98% more than a year ago, and the company’s record. The strongest fact for the price, from the company’s own deck.
The company’s case, as we set it out before the print in The Price Ran Past the Platform, stands as written, and the deck added to it: about 220 net new platformizations in the quarter, up 44%; net revenue retention above 120% among platformized customers; the identity business bought from CyberArk, now branded Idira, growing 21% pro forma with CyberArk’s contract value up 50%. And the chief executive stated the guidance philosophy plainly on the call: “we are going to be able to exceed your consensus, and that is how we guide.” One claim in that case this update cannot test: that consolidated growth rises toward the 22–23% recurring-revenue rate as that book becomes the whole company. A one-year guide cannot confirm or refute it; our base case fades from the guide, and the claim is carried whole in the $307 maximum case below.
Two of the eight questions we froze resolved against that case. Neither is a stumble in the quarter. Both are about the shape of the growth rather than its size.
The backlog stopped outgrowing revenue. Backlog led revenue by seven to eight points in the two quarters before the CyberArk deal closed, by five in the first quarter with it, and by nothing now: RPO +34.2% against revenue +34.5%, zero within the release’s rounding. Part of the compression is what was bought: the acquired businesses carry less contracted backlog per dollar of revenue than Palo Alto’s own (in the first quarter with them they added about 17 points of revenue growth and 13 of backlog growth), and stripping that out the organic backlog still leads organic revenue by roughly four points. The CFO’s one duration datum on the call cuts the same way twice: “contract durations remained steady year over year,” so the lengthening that built the earlier lead has stopped, and durations are not shortening. The fiscal-2027 guide has backlog growing 19–20% against revenue at 23–24%, four points slower as reported and about four points faster like-for-like once the eight points of non-comparable acquired revenue are stripped from the revenue rate; the first-quarter guide has backlog leading again. The lead halved. It did not vanish, and the acceleration the platform narrative leaned on did not persist into the first full quarter with CyberArk inside.
The cash margin steps back before it steps up. The company guided a 38.0% adjusted free-cash-flow margin for fiscal 2027, below our frozen 38.5% bar and the 38.4% it just delivered, and in the same release reaffirmed 40%-plus for fiscal 2028: two points in one year, after four years inside a one-point band. Against the company’s own post-deal guide of 37.5% for fiscal 2026, 38.0% is half a point up, and the beat cadence that turned 37.5% guided into 38.4% delivered would, repeated, put fiscal 2027 near 39%. The gross-margin line is where the step back shows: 74.8% adjusted, down 100 basis points, which the CFO attributed to “a mix shift towards our faster-growing SaaS offerings, which continue to scale with our platforms and have yet to reach their gross margin maturity.” If that is right the drag reverses with scale, and it is one of three bridges to the fiscal-2028 target, alongside a fast year of operating leverage and a working-capital tailwind from multi-year platform contracts. None of the three was quantified.
Three smaller items for the record. The GAAP net loss of $282m is a $524m non-cash mark on the convertible notes assumed with CyberArk; GAAP operating income was positive $172m, from a $183m loss last quarter. The fiscal-2027 diluted share count is guided at 844–847m against the 832m used this quarter, 1.6% more shares. And two further acquisitions, Console and Embrace, were described by the CFO as “immaterial to our fiscal year 2027 guidance.”
What the guide says the organic engine runs at
This was the first annual guide with CyberArk in the base, and the pre-event note said the argument would turn on one translation: reported growth to organic growth. Reported fiscal-2027 revenue growth is 23–24%. Against fiscal 2026 with the acquisitions owned all year, the $12.33bn pro-forma base, the guide midpoint of $14.15bn is +14.8%, almost exactly the ~14–15% we estimated the company was delivering before the print. The recurring-revenue guide says the same thing from the other side: 22–23% growth in fiscal 2027 on a base that already includes the acquired businesses, the first like-for-like rate the company has given since the deals, against the 63% reported this quarter. In dollars the guide adds about $2.0bn of net new recurring revenue, after a fiscal 2026 that added $3.5bn of which $1.6bn arrived with CyberArk and Chronosphere, leaving roughly $1.9bn organic; the company expects 60–61% of it in the second half. The platform modeling points make the mix explicit: Network & AI Security, nearly three-quarters of revenue, guided to low double digits; Cortex to about 30%; identity to roughly $1.5bn, high-teens to 20% pro forma on the $1.26bn pro-forma base the CFO gave on the call.
The reversal condition we published before the print was an organic guide of 18% or better; the company guided 14.8%. The guide is a floor, by the company’s own description and by five straight beats of the top of its own quarterly guide. It is not a floor near what the price assumes: reverse-engineered at the $328.47 reaction close, the market value still requires organic growth starting near 36% (near 39% at the $362.09 close into the print). On identity, high-teens-to-20% lands between the two tripwires we set for after the February lap (25% toward the upside case, 15% toward the downside), and identity ARR, the number the cross-sell thesis ultimately needs, is still not disclosed.
What the company is worth after this
Our published fair value was $127: a downside case worth $79, a base case worth $126, an upside case worth $176, weighted 25/50/25. We re-ran that model on the release, changing only what the release changed, each input traced in the archived script: the base-case growth start to the company’s 14.8% pro-forma guide from our 16% estimate, the upside case to 17% (the guide’s top plus the beat cadence), the downside case to 12% (a guided floor makes an 11% start less likely), the first-year cash margin to 38.0%, stock compensation to the actual 14.9% of revenue, the share count to 845.5m, net cash to $6.1bn. The cost of equity, the terminal assumptions, the fade rates and the scenario weights are unchanged.
The result: downside $83, base $120, upside $153, a weighted fair value of $119, from $127, inside the $107–133 band we committed to before the print. The whole move is the growth anchor: as the pre-note committed, the base-case start moves with the guide, and the beat is carried in the raised downside start and the upside case rather than counted a third time in the base. Rerun on the published growth starts with only the balance sheet, margin, shares and stock compensation updated, the value is $127, unchanged. The company’s case, priced: a one-point beat on the consolidated line, at 16%, puts the base case back to $126 and the weighted value at $122; holding the upside case at its published 20% start adds $5, to $124; a base case starting at the 18% reversal bar is worth $138; and the maximum-defensible construction, every operating claim granted for a decade, is unchanged at $307. That is the reconciliation between the record quarter and the lower number: the momentum lives in the recurring book, which the company guided to grow 22–23%; the model values consolidated revenue, nearly three-quarters of which is the network business guided to low double digits, and on that line the company’s own number came in a point below the one our base case had assumed.
At Wednesday’s $328.47 reaction close the gap to our estimate is 177%, from 205% into the print, and the price sits 7% above the most generous case we can build: a 9% move that closed about three-fifths of the distance to our maximum-defensible value and about a seventh of the distance to our central one. The price remains the maximum operating case plus a cheaper price of risk than we can defend (the steelman inputs reach $328.47 at a 9.54% cost of equity against our 9.84%, and reached $362.09 at 9.14%), or a durably higher multiple regime. The print moved the operating case slightly toward us and could not touch the other two.
The scorecard, frozen four days before the print — 6 cleared, 2 missed
The pre-event note froze, in public, exactly what we would score: eight questions with pre-written rules for what silence would mean, the market reads we relied on, and a hard bound on the fair-value move. Where later checking found a frozen threshold imperfect, the pre-note’s discrepancy log said in advance how it would be scored; those caveats are applied here in the open, misses first. One of the six that cleared, cleared on a technicality we flagged before the print; one of the two misses was decided at the release’s rounding, a genuine miss the guide confirms, but a rule we should not have let rounding decide.
Rail colors:cleared as frozenmissed as frozenpre-written rule applied (none this time)
6Does contracted backlog still grow faster than revenue?
No. RPO +34.2% against revenue +34.5%, a spread of −0.3 points at the release’s rounding, against +5 last quarter and +7 to +8 before the deal; the frozen rule was “greater than zero” on reported figures. Like-for-like the organic backlog still leads by about four points, and the CFO: contract durations “remained steady year over year.”
7Does the fiscal-2027 cash-margin guide step to 38.5% or better?
No. Guided 38.0%, a step back from 38.4%; the 40%-plus fiscal-2028 target was reaffirmed, so the bridge is two points in one year, unquantified.
1Does the fiscal-2027 revenue guide reach $13.5bn?
Yes — $14.10–14.20bn. Scored as frozen, with the pre-registered caveat: on the pro-forma base the midpoint is +14.8%, confirming scale, not organic acceleration; the 18% bar was not met.
2Does Next-Generation Security ARR clear the $8.95bn guide top, with the organic split shown?
Yes on the total — $9.10bn. The organic/acquired split was not disclosed in the release, the deck, or on the call; as the pre-note said we would, we grade the total. The deck gave the flow instead: ~$970m net new, and a first like-for-like forward rate of 22–23%.
3Does adjusted EPS hold the $0.96 floor of its own guide?
Yes — $1.02, the fifth straight beat of the top of its own guide.
4Is the fiscal-2027 share-count guide at or under 850m?
Yes — 844–847m, 1.6% above the 832m our model carried; applied in the rerun.
5Does the GAAP operating loss narrow from −$183m?
Yes — +$172m. The GAAP net loss is a non-cash convertible mark below the operating line.
8Is any identity metric disclosed as a number?
Yes. Identity revenue $614m for the partial year, 21% pro-forma growth on a $1.26bn pro-forma base, a fiscal-2027 guide of ~$1.5bn, CyberArk contract value +50%. Identity ARR itself remains undisclosed; the gauge asked for a number and should have named the one that matters.
No pre-written silence rule was triggered: gauge 2’s applied in part (the split absent, the total graded); gauge 8’s did not arise.
The market reads, resolved or pending. The options market paid ±9.4% through Friday’s expiry (about ±8.1% for the event) against a ±6.2% median realized move; the reaction delivered −9.3%, at the headline figure and beyond the event-specific one, and down, as after five of the prior eight prints. One draw, entered on the ledger; no claim rests on it. The frozen option-implied density, flagged as unreliable before the print, reads the close at its 12th percentile and is recorded but not relied on. The one prediction-market contract, a beat of $0.98 priced at 94.5%, resolved yes. The peer-implied range for the organic guide was 14–20%; 14.8% sits inside it, at the floor. The sell side reiterated fourteen ratings and moved its mean target up to $385.65 against a −9.3% session; the two reads diverged, and the thirty-day drift grades which one moved. Short interest resolves at the mid-September settlement and insider follow-through over thirty days; both pending. The call, graded from two independent transcriptions, flipped no gauge.
What would change our view
Symmetric and checkable, re-armed as dated triggers. Toward the price: the first-half beat cadence lifting the implied fiscal-2027 organic rate to 18% or better by the February report, the CyberArk lap, where the guide itself is 14.8%; identity growth sustained at 25% or better in the two quarters after the lap; a stated bridge to the fiscal-2028 40% margin (working capital, gross margin or opex) at any point in fiscal 2027; adjusted gross margin recovering above 75.5% while observability scales; or a durable ~150 basis-point fall in the ten-year Treasury, in which case our discount rate, not the company, was the error. Away from the price: backlog growth trailing revenue growth on a like-for-like basis at the November or February report (the November guide implies a positive spread again); identity growth under 15% within two quarters of the lap; the fiscal-2027 cash-margin guide cut below 38.0%, or the fiscal-2028 target withdrawn or deferred; the diluted share count guided above 850m at any quarter; or the fiscal-2027 recurring-revenue guide not raised by the May report, when the second-half-weighted plan is in view.
Recommendation
Fair value $119 (from $127), range $83–$153, maximum-defensible $307, against a $328.47 reaction close, a 177% gap from 205% into the print. We are constructive on the business, which reported a record quarter and guided above expectations on every line, and remain cautious on the equity at nearly three times our estimate of its value, with the two questions the multiple rests on, contract duration and the path to a 40% cash margin, resolved this quarter in the less favorable direction. Nothing here is a trade recommendation. The scorecard above, misses included, is logged for public tracking; the next test arrives with the November report and, for the questions that matter most, the February lap of the CyberArk acquisition.
Sources & Method
Print and guide facts: Palo Alto Networks 8-K EX-99.1 filed 2026-09-01 (accession 0001327567-26-000019; archived data/ex991_q4fy26_release.htm), the Q4 FY2026 earnings presentation and Supplemental Financial Information (text extracted in-browser and archived with provenance at data/tells/ir_deck_q4fy26_extract.md; the IR host refuses non-browser downloads). The pro-forma fiscal-2026 base combines the nine-month pro-forma revenue table in the FQ3 FY2026 10-Q with the fourth quarter as reported; the acquired contributions ($388m revenue, $1.6bn recurring revenue, $1.8bn backlog) are as disclosed in the FQ3 release, archived alongside with the Q1 FY2025–Q3 FY2026 releases that carry the guide-versus-actual chain (data/guide_history.py). Earnings-call quotes are attributed to the speaker and corroborated across two independent full transcriptions (Investing.com and MarketBeat, fetched 2026-09-02; table at data/tells/transcript.md); the company’s own transcript was not yet posted. Street expectations: the $0.98 bar is the top of the company’s guide, the FactSet consensus reported by MT Newswires, and the Polymarket contract’s threshold; the September 1 market-context statement (a broad down day) is from MT Newswires’ market wrap of that date — both newswire passages archived at data/tells/newswire_0901.md.
Prices are official closes via Robinhood ($382.13 on 8/31; $362.09 on 9/1); the 9/2 reaction session (open $345.53, low $321.39, close $328.47) is from regular-session bars aggregated in data/reaction.py, the close being the last regular-session trade, confirmed on this page against the settled close when the feed posts it; after-hours prints are not used for any grade. Valuation: data/model_rerun.py, the pre-note’s archived engine imported unchanged with every input change documented line by line, results at data/model_results.json written before this prose; the fair value of The Price Ran Past the Platform moves $127 → $119 via that rerun and its Signal Ledger row. The scorecard: research/panw-q4-fy26/data/rubric.json (frozen 2026-08-28T21:35:44), scored in data/score_release.py → data/release_facts.json and this note’s data/scorecard.json, with the pre-note’s DISCREPANCY_LOG.md governing the caveats; module reads at freeze in research/panw-q4-fy26/data/; reaction-session graders in data/reaction.json; the short-interest outcome and insider follow-through are inserted here with their own datelines when they resolve. Exhibit data: data/exhibits.py.
Disclosures
Information only. TON618 Capital. This report is for information purposes only. Nothing here is an offer to sell or a solicitation of an offer to buy any security, fund interest, or digital asset, and nothing here is personalized investment advice or a recommendation regarding any instrument.
Publisher’s exclusion. All research is published solely as general, impersonal information of regular circulation. It is not tailored to the objectives or circumstances of any individual and is not issued in connection with compensation from any client. The Fund has no clients and distributes all research free of charge. On that basis it publishes in reliance on the publisher’s exclusion from the definition of “investment adviser” under the Investment Advisers Act of 1940 (§202(a)(11)(D); cf. Lowe v. SEC, 472 U.S. 181 (1985)).
Registration & conflicts. TON618 Capital is not registered as an investment adviser or broker-dealer in any capacity. The Fund is a Bitcoin fund and may hold or transact in the securities or digital assets it discusses; material conflicts are disclosed where they exist. Ownership: the Fund holds no position in PANW as of the report date, and PANW is not a Fund holding or a BTC-correlated instrument; this report also references CyberArk (acquired by PANW) and Microsoft (MSFT); the Fund holds no position, long or short, in any of them. Compensation: the Fund received no compensation from any party in connection with this report and charges nothing for it.
Use of AI. Artificial intelligence is used in the creation of this research. All methodology and data integrity are reviewed and approved before publication by TON618 Capital’s Chief Investment Officer, Keyth Beck; errors may nonetheless occur, and readers should verify independently.
CFA. This report was prepared to align with CFA Institute analytical standards (methodology only). CFA® and Chartered Financial Analyst® are registered trademarks owned by CFA Institute. That reference describes the analytical framework applied; it does not imply the report was prepared, reviewed, or authored by a CFA charterholder, and the report is not issued, reviewed, endorsed, certified, or approved by — nor affiliated with — CFA Institute.
Risk & feedback. Past performance is not indicative of future results. Digital assets and equities are volatile and may result in total loss of capital. Corrections and feedback are welcome — please direct them to CIO Keyth Beck at keyth@ton618capital.com. Version 1.0.