Palo Alto Networks

CrowdStrike's Falcon platform is eating PANW's lunch in endpoint and cloud workload protection. After the Falcon outage last year I thought PANW would capitalize but CrowdStrike's customer retention was surprisingly strong, which tells you something about how entrenched they are at the EDR layer. Palo Alto's Cortex XDR just doesn't have the same brand gravity in security operations centers.

It's interesting that Palo Alto's gross margins have actually held up better than expected even as they push the platformization discounting strategy — operating leverage in the subscription and support segment is doing a lot of heavy lifting. Hardware margins on the appliance side are structurally lower but that's becoming a smaller slice of the revenue mix every quarter.

How is PANW actually positioned against Fortinet in the mid-market firewall segment? Fortinet's FortiGate appliances are everywhere in that space and they've been very aggressive on price.

Platformization is actually working — the number of customers with 4+ products on the Strata, Prisma, or Cortex platforms keeps climbing and that drives massive switching costs. Once an enterprise is running XSIAM for SOC automation alongside Prisma Access for SASE, ripping it out for CrowdStrike or Zscaler becomes a multi-year nightmare. The consolidation story is real and the ARR attached to those platform customers is accelerating.

Palo Alto Networks announced expanded integration between Cortex XSIAM and IBM's QRadar following the acquisition of certain QRadar assets by Palo Alto. This effectively gives them a direct migration path for thousands of legacy IBM SIEM customers who have been looking for a modernization option. The deal accelerates their push into the AI-driven SOC market where Splunk and Microsoft Sentinel are the main competition.

The 'platformization' narrative is carrying a lot of weight but Palo Alto is essentially giving away products for free to lock customers in, and that's what crushed billings guidance back in early 2024. You can't keep offering consolidation incentives and discounts indefinitely without it showing up in margins. The free cash flow looks great until you dig into deferred revenue mechanics.

Nikesh Arora's compensation structure is worth keeping an eye on — it's heavily tied to RPO growth and platform customer milestones, which means management incentives are pretty well aligned with the metrics they're pitching to investors. That's not always the case in enterprise software.

Has anyone done a real comparison of Prisma Cloud versus Wiz for cloud security posture management? Wiz has been winning a lot of press and apparently some serious enterprise logos — curious whether PANW is actually losing deals or if this is mostly noise.

The federal and SLED business is a huge underappreciated tailwind for Palo Alto right now. With zero-trust mandates from CISA and the ongoing push to meet CMMC 2.0 requirements, government agencies are actively being forced to modernize their network security stack. PANW's FedRAMP authorizations across Prisma Cloud and Prisma Access put them in a strong position to capture that spend.