Palo Alto is a cybersecurity company competing across endpoint, cloud and network. It’s pushing to bundle next-gen products into larger deals to differentiate vs. firewall-based competitors like Fortinet and next-gen disruptors. There are three key product pillars to know:

Cortex: Its endpoint security segment is called Cortex. Extended Security Information and Event Management (XSIAM) is the centerpiece of this section. XSIAM brings together Extended Security Orchestration, Automation and Response (XSOAR), Extended Detection and Response (XDR) and Security Information Event Management (SIEM). 

Strata: The network security suite is called Strata. It offers a host of tools tools that prevent unauthorized data access and network abuse such as phishing attacks. It deploys software-defined wide area networks (SD-WANs) within firewall environments. SD-WANs serve as virtual network securers using a software-based approach to protection.

Palo Alto protects networks using a “zero trust” architecture. Zero trust means a bad actor cannot penetrate the most vulnerable part of a digital ecosystem and move freely within it thereafter. Zero trust ensures consistent and complex validation of these permissions at every turn. It ends the game of “everyone within a firewall environment getting perpetual, unconditional access” and greatly limits the potential damage of network breaches. There are two pieces of the network bucket: modern hardware and software. 

Cortex Cloud: The cloud security suite is now called Cortex Cloud. Like XSIAM and SASE are the platformization pillars in endpoint and network, in cloud it’s the Cloud Native Application Protection Platform (CNAPP). CNAPP includes:

Cortex Cloud ties very closely to both Cortex and Strata; cloud, network and endpoint use cases are deeply intertwined. Products like CASB extend cloud security talents to network use cases and are a direct piece of its SASE network offering… Endpoint products like XDR rely heavily on cloud tools as well… etc.

It was good to see net new ARR rise following two consecutive quarters of declines. They think the momentum is a culmination of “significant investments” made over the last few years to push its subscription offerings to the cloud and build compelling product suites across the three core pillars. All of that work is helping the “new market offerings” (software firewalls, XSIAM, SASE) within ARR take up a larger and larger portion of its underlying growth. These products come with longer demand runways and support its goal of reaching $15B in ARR by fiscal year 2030. They reiterated that objective on the call.

Gross margin remains impacted by a manufacturing facility shift to Texas. At the same time, this decision also means it’s paying virtually no tariffs and it does expect to realize margin tailwinds from the large change. It will just take time for the new facility to ramp towards capacity. Contract renegotiations with cloud vendors as it scales helped offset a small part of this GPM decline.

PANW trades for 55x forward EPS. EPS is expected to grow by 16% this year and by 11% next year.

Heightened Focus on AI:

AI is now the dominant theme in conversations with existing and prospective clients. The explosion of this technology has meant a vast acceleration in data scraping, processing and sharing across the web. That heightens the importance of safeguarding that information… as unique data is routinely the backbone of defensible competitive edges.

At the same time, AI also greatly lowered the bar for conducting sophisticated attacks and aggressively accelerated the frequency of those attacks. For context, its threat simulation team can now build a sophisticated ransomware attack in less than 30 minutes with AI. How do you match that ramping rhythm of threats? By deploying cutting-edge technology that can more seamlessly scale right with it. Companies know they need to embrace GenAI and Agentic AI in their product roadmaps… and they know they need to do so safely. Palo Alto is therefore enjoying accelerating demand. Whether it’s securing models, apps, workloads or the data all of these assets utilize, Palo Alto is working hard to build end-to-end AI threat coverage.

“Traditional IT architectures weren't built for the scale, speed or complexity of AI. To truly capitalize on AI's potential, enterprises need modern, cloud-delivered platforms that can ingest vast amounts of data and operate in real-time at scale.” 

CEO Nikesh Arora

Another byproduct of the worsening threat environment is heightened desire to consolidate vendors on one true platform. This makes open data telemetry (sharing) a lot easier, which means better interoperability, communication, cost efficiency and protection efficacy. It “impacts all critical metrics for enterprise software customers and drives market leadership.”

For about a year now, Palo Alto’s buzzword to convey a push to platform-wide customer contracts has been “Platformization.” By this, they simply mean a customer is completely using one or more of its three product pillars. If they’re using all three, it counts as three platformizations. We may need to work on the marketability of that “word,” but the results do look pretty good:

Platformization Progress:

PANW completed 90 more platformizations during the quarter to reach 1,250 of its 5,000 largest customers (+38% Y/Y). That pace was behind the 150 it conducted last quarter, but roughly the same as the two quarters before that. This process is the driving force behind $5M+ NGS ARR customers rising 41% Y/Y and $10M+ NGS ARR customers rising 63% Y/Y. Both Y/Y growth metrics accelerated compared to last quarter.

The company provided three compelling examples from this large enterprise customer cohort. First, it signed a global consulting firm to platformize around its XSIAM offerings. PANW greatly reduced mean time to resolution from days to minutes (per customer interviews), displaced four point solutions and doubled the ARR contribution from this client. It was a $90M deal in total. Last quarter, we heard about IBM enjoying threat containment in 12 fewer days with PANW vs. their own vendors. It’s good to hear more examples like that this quarter; incremental value always drives traction.

PANW also signed two large U.S. financial services companies. One of them platformized on its endpoint and network suites in a $46M deal that displaced 4 vendors. The other platformized on its cloud and network product pillars in a $33M deal that also displaced 4 vendors. While Cortex and Strata have been the main characters in driving platform-wide product adoption, this shows cloud security joining the fold.

Cortex – XSIAM as the Security Operations Center (SOC) Foundation:

XSIAM is the most powerful driver of Cortex’s current success. Trailing 12-month (TTM) bookings for the product crossed $1B just 30 months after launching; ARR rose by more than 200% Y/Y. It’s outgrowing every SIEM competitor, which, as the Palo Alto 101 section laid out, is a vital part of this endpoint-based platform.

“If you go back historically, certain swim lanes reach inflection points where the next set of products are so much better that everybody has to be shaken out of their stupor to replace. I mean you saw that happen in the endpoint market… I think this is the moment of the SIEM market. It's a $40 billion TAM. I think in the next three to five years, it will get replaced by new age players. The legacy players will try their darndest to hang on to it, but the architectures are fundamentally different.”

CEO Nikesh Arora

The combination of endpoint and SIEM makes XSIAM the perfect candidate to be a client’s Security Operations Center (SOC). Being the SOC for a client naturally raises their dependability, retention and spending levels. SOC needs scalable and affordable access to a vast amount of organized, actionable data. That’s how it optimizes threat efficacy, and again, that’s where SIEM shines.

Network Security – Firewalls:

Software firewall ARR rose 20% Y/Y, while 70% of deployments were in the public cloud. That’s important for demand runway here, as the world continues to shift from on-premise to public cloud usage. They’re positioned well for that inevitable trend. Bookings rose by 25% Y/Y for the segment, offering more evidence of strong forward-looking demand. When pairing software firewall strength with slow and stable growth (5%-8% Y/Y) for its hardware, software continues to make up a larger portion of its overall product revenue. Specifically, it’s 38% of total vs. 35% Y/Y and 22% 2 years ago. I find the hardware components of product revenue (and NGS ARR) to be the least compelling pieces of this business. This statistic shows that the lower-value hardware components are steadily diminishing in contribution. That’s what I want to see.

Network Security – SASE:

And speaking of software, SASE customers rose 22% Y/Y while rising engagement levels drove 36% Y/Y ARR growth. Notably, 40% of all SASE customers are brand new to PANW, as this newer offering keeps proliferating as a more meaningful top-of-funnel tool.

Prisma Access Browser (PAB; defined in section a) has been a home run for this company since it bought Talon Security 18 months ago. It sold 3 million licenses vs. 250K Y/Y as 33% of all Prisma Access Platform seats again came from this product. To keep the momentum humming, it will keep focused on extending PAB to GenAI access controls and models.

As leadership explains, in the world of AI, “the browser is becoming the primary interface for accessing data and applications.” PAB is a great candidate to protect these sensitive assets in the browser.

“Prisma Access Browser's native controls and real-time visibility are designed to help ensure that sensitive data remains safe during browsing sessions — regardless of the user's location or the application they're accessing.”

CEO Nikesh Arora

Prisma AI Runtime Security (AIRS) was another network security focus on the call. As Nikesh told investors, this product “discovers AI ecosystems, assesses risk and protects against threats.” It’s an extension of its cloud runtime security tools specifically for AI assets. PANW uses AIRS internally to give it a bird’s-eye-view of all AI assets, with  seamless ability to scan and test them when need be. This creates more efficient operations and proof of concept for customers. AIRS helps with data security and permissions, application security and, generally speaking, makes PANW a better vendor for stopping breaches in the cloud. It’s in this area where PANW can look to create meaningful differentiation over most of the field. Everyone can do cloud configuration analysis… very few can effectively handle runtime security in the cloud.

Cortex Cloud:

“Over the last three months, we have seen strong early customer interest in Cortex Cloud with a nine-figure pipeline, spanning hundreds of customers.”

CFO Dipak Golechha

A Bit on Macro:

April did create some modest demand turbulence for the company. Without the trade war, “the quarter would have been easier to sail through.” Still, it was able to overcome that headwind by drawing from lessons during previous crises like the pandemic. Its supply chain (partially thanks to Texas investments) is in great shape, and that did help weather some of this temporary softness. Q4 so far looks much more normal, as most customers “didn’t change their plans from an overall transformation perspective.” The structural demand picture looks good.

Quick Note on FCF:

As a reminder, platformization means longer-term contracts, more deferred revenue and lower near-term cash collections. That led many to worry about cash flow margins while this go-to-market change unfolds. Just like last quarter, the company again reassured investors that its high-30% FCF margin was sustainable despite the headwind.

Another rock-solid quarter from a rock-solid company with a massive runway and continued cross-selling traction. I think the standout of the report was the Prisma Access Browser. That caught me by delightful surprise, and clearly several analysts on the call felt the same way. Palo Alto is effectively shifting from a stitched-together point solution go-to-market, to a holistic, platform-level selling machine. It’s heartening to see customers embrace this strategic pivot alongside them; it’s perhaps even more heartening to see outperforming growth in customers adopting more than one of its platforms. That’s strong, sticky commitment.

I think Palo Alto has almost the best technology in several facets of cybersecurity. One could argue that SentinelOne and CrowdStrike are a bit better in endpoint; one could argue that Zscaler and Cloudflare are a bit better in network. But? Palo Alto still has high-quality products in both of those areas, a budding cloud security suite and a giant product suite to sell more solutions with. It should continue to find steady growth in this highly attractive sector.

On the other hand, the stock already feels fully priced to me at 55x EPS and with its growth profile. It’s quite expensive from both a P/E and a PEG ratio point of view. Still, it should continue to fetch a valuation premium for quite some time. Maybe not as large of a premium as it currently enjoys… but a premium nonetheless. I personally prefer other names in security, but the preference gap is very small; I consider this my favorite non-holding in the sector.

Data Cloud Foundation:

Snowflake’s overarching platform is called the Data Cloud – a “single foundation to eliminate data silos.” This infrastructure unlocks affordable data storage, organization, querying and learning at gigantic scale. It offers these services with elastic compute capabilities, allowing for flexible scaling up and down of usage. The architecture naturally separates the functions of data storage and consumption, unlike legacy data warehouse solutions. That means data consumption capacity is untethered from public computing resources. In turn, this helps control costs and waste, handle diverse workloads and resolve potential scale bottlenecks.

Under this framework, I can store as much data as I want to without the requirement of immediate processing. In Snowflake’s case, the storage is done in a centralized data repository in the Data Cloud and processed only as needed. Data is utilized virtually, which removes the need for dedicated customer hardware. Snowflake does all of this for clients in a managed fashion, minimizing talent and infrastructure needs. All of this routinely delivers 50% total cost of ownership (TCO) reductions for its customers.

More Products to Know:

The Snowflake Data Warehouse is where structured data is stored and (on command) processed. Structured data is formatted data. It’s utilized for record keeping and report creation. Data can be easily fetched via structured query language (SQL).

Snowflake Data Lake does what the warehouse does for unstructured data. Unstructured data is unformatted and used to uncover new insights and patterns.

“Snowpark” is its developer platform and data-equipped playground to build new things. It enables working with data in any source code language. With it, they can process and visualize data (through Snowpark functions) and build apps (through Snowpark Native Apps). 

GenAI models are voracious data consumers. Snowpark Container Services allow GenAI models to run closer to the data that they require. This enhances performance, expedites model training and diminishes costs. Movement of apps, workloads and developer attention from Apache Spark to Snowflake is a key source of growth here. 

Cortex AI is another important new product. It’s what Snowflake calls its “AI layer” and offers a slew of GenAI-powered tools to (as Snowflake always says) bring AI, application-building and analytics “right to a customer’s data.” That conjoining routinely lowers data transfer and storage costs. Cortex AI offers unstructured text summary, sentiment analysis, helps beginners write SQL etc.

Snowflake Data Sharing is its secure product for, as the name indicates, sharing data among the rest of Snowflake’s participating users. As more opt in, a compelling network effect of relevant data builds and the firm’s value proposition deepens.

Unistore is SNOW’s hybrid table product, which can ingest, store and organize both transactional and analytical workloads. Snowflake has long been an analytical workload specialist within the data warehouse part of the business, and this unlocks transactional workload demand.

Snowflake’s revenue model is consumption-based in nature. This means visibility compared to SaaS business models is not as strong. It also means customers can more easily scale down (or up) usage when times are bad (or good).

Last quarter, Snowflake had two large customers exhaust consumption commitments and continue temporarily consuming through existing contracts, rather than signing new ones. This led to bookings and RPO weakness last quarter. This quarter, both customers signed $100M+ deals as expected, which helped the RPO outperformance.

Considering SNOW is a growth company, I love when compensation is allocated in a way that aligns incentives. At the same time, maybe they can find a way to more evenly balance equity and cash compensation to enable faster GAAP margin progress.

The combination of the product revenue raise, no stated change to professional services expectations and the FCF margin reiteration gives us an implied FCF dollar guidance raise. This makes the quarterly FCF miss entirely unconcerning.

SNOW trades for 157x forward EPS, 110x forward EBITDA and 56x FCF. EPS is expected to grow by 40% this year and by 36% next year. EBITDA is expected to grow by 28% this year and by 41% next year. FCF is expected to grow by 28% this year and by 24% next year. Profit estimates should modestly rise following this report.

Checking in on the Innovation Engine:

A little over a year ago, Snowflake brought in Sridhar Ramaswamy as their new CEO. Ramaswamy is known more for his product and innovation skills than outgoing CEO Frank Slootman was. Snowflake was seen as falling behind competitors like Databricks in key areas, so Ramaswamy was given the reins to catch back up. One year in, and SNOW has made a ton of great progress. As Ramaswamy puts it, “product delivery remains in overdrive,” as pace of new product introductions doubled Y/Y.

One of the most pressing areas where Snowflake was falling behind was with data scientist offerings and preference. Signs of gaining ground can be seen in two intertwined products. First, “Notebooks” offer a secure environment to interoperably write in various source code languages. It’s a popular tool for data scientists to toy with development ideas within a tightly integrated Snowpark environment. Snowpark is the second important product to know here. Together, these tools provide an easier, yet still secure and affordable way to test and tweak projects more frequently. Traction can be seen as gaining popularity within the data scientist community, which leadership thinks it’s enjoying.

Go-to-Market (GTM):

While Ramaswamy is known for his innovation skills, the go-to-market team is also growing into a more pronounced strength. Great leaders are excellent at hiring good people for things they don’t want to specialize in. I think this is evidence of him being a great leader.

Its new chief revenue officer, Mike Gannon, has “renewed focus and rigor across GTM.” Its “AI Ninja” team, which helps its salespeople learn its AI products, is working extremely well. And generally speaking, its drive to train its GTM team on “highest value use cases” is bearing fruit. This is creating a sort of “template” of optimized GTM for specific cohorts of customers; pattern recognition is allowing these sellers to get more confident and efficient. I think this balances scalability (by not approaching every customer differently) and personalization (by not approaching every customer the same) very well.

Data Platform Vendor Consolidator:

Snowflake is executing very well in two data engineering areas that make it a better, more interoperable partner for clients. This interoperability means those clients can do more on SNOW’s platform and allows SNOW to cross-sell more tools, gain the coinciding retention boosts and push towards a true platform play.

The first area is Snowflake Connectors. Simply put, these connectors make it easier for 3rd-party vendors to neatly integrate with the overarching data cloud. It offers access to things like Google Drive, Slack and Workday from a single environment. Connectors enable the creation of powerful data pipelines that can pull information from various areas. 

Connectors make it easier for Snowflake to fill small product gaps without diverting engineering resources to build things for opportunities that are just too small. Thanks to this product, Dentsu cut data costs by 30%.

The second area is Iceberg Tables. As a reminder, Iceberg is an open-source product that provides data storage; Snowflake offers support for this safely from within its platform. While this was thought to put its storage revenue in jeopardy, that didn’t happen. In fact, it experienced no storage headwind, while becoming a more open platform has supported the rest of its products. This quarter, Snowflake integrated its core data sharing, security and performance optimization tools right into its Iceberg offering. That shows us more confidence in it seeing this as a large tailwind for its business… not a headwind. That’s no longer a controversial opinion, but it was just a few quarters ago.

Macro:

Snowflake has seen zero change in customer behavior stemming from the trade war. It does not anticipate any large batch of usage optimizations like it saw following the pandemic shock. That’s partially because its customer base is no longer made up of hyper-growth tech companies with no desire to control costs. It’s also because SNOW has been far more proactive in optimizing spend for its clients as they grow consumption. It doesn’t see non-optimized usage as quality revenue growth, as it knows it will just get cut eventually.

More on Data Analytics Use Cases:

AI Adoption on SNOW’s Platform:

As a reminder, SNOW doesn't separately monetize AI. It tries to enhance the value of its ecosystem by infusing AI into products. and it’s working. It has 5,200 customers using its AI and machine learning tools weekly vs. 4,000 Q/Q. One of those customers is Kraft Heinz, which is using Cortex AI for their new company assistant.

As leadership says, SNOW is the platform that makes a company’s data “AI ready.” No firm can embrace cutting-edge models or apps if they can’t even use their unstructured data. And? No company can rationally process the massive amounts of data needed to make GenAI apps actually useful with archaic data plumbing. Firms need to unleash all of their data without exploding costs, and Snowflake is a great partner to do just that.

“Every Chief Data Officer now realizes that their data strategy, especially one with Snowflake, is a direct unlock for whatever they're going to do with AI both today and several years down the road.”

CEO Sridhar Ramaswamy

Snowflake thinks model choice is another material piece of AI traction. It combines immediate access to Meta, OpenAI and other leading models with its world-class research team to create some exciting value. Specifically, this team is well-versed in driving post-training and inference efficiency gains to make models more valuable and popular.

Finally, like most other companies, SNOW is using AI internally. It’s helping the GTM team optimize customer interactions, automate source code creation and so much more.

Public Sector:

Snowflake created Snowflake Public Sector inc. This is a separate entity within Snowflake with a sole focus on public sector growth. It follows recent Impact Level provisional authorizations that unlock Department of Defense and other highly sensitive contracts.

“There is both an increasing [public sector] awareness of what Snowflake can do and that we have very low operational overhead.”

CEO Sridhar Ramaswamy

Another encouraging quarter from an excellent company. Ramaswamy is clearly a great person to lead this organization in its next phase of product development and growth. He has turned the tide and narrative on Snowflake’s ability to compete in next-gen AI categories. He has done that while putting a great team in place to sharply improve go-to-market momentum. Snowflake is finding strong success with virtually every product it launches and I can’t help but think the new leader deserves most of the credit there. They’re rediscovered their groove.

On the negative side of things, I do find myself wondering when GAAP EBIT leverage will kick in. Stock compensation is aggressive and the valuation multiple is more elevated than nearly any other name I talk about. I find myself becoming more optimistic about the company’s future, but can’t get comfortable with the multiple. I’d rather own other enterprise software names with similar levels of growth and a more modest price tag. I’ll keep closely watching this name to see if a compelling entry surfaces.