PANWPalo Alto Networks, Inc.

“our Q3 performance was well above our initial expectations. As the AI initiatives generate a surge in telemetry, Chronosphere is a purpose-built capability to scale alongside these workloads. Our observability ARR surpassed $300 million this quarter, nearly doubling since our acquisition announcement last autumn. Furthermore, 80% of our net new customer acquisition this year adopted multiple products, reinforcing our platformization momentum. The world's leading AI natives, including 2 of the top 5 frontier labs, have adopted Chronosphere”

“A global consulting leader signed a deal for over $20 million, selecting Prisma AIRS, our AI security platform, to secure its rapidly growing fleet of AI apps and agents, now running more than 2 trillion tokens per month on our platform. This was an existing platformized customer who spent several months working closely with us to secure this entirely new frontier. It is also a record Prisma AIRS win”

“our platform processes more than 17 petabytes of daily telemetry, a volume unmatched by any other pure-play security vendor. We ended the third quarter with more than $600 million in ARR, representing 100% year-to-year increase across a growing base of 740 customers. The most significant metric, however, is the outcome. The majority of our customers are now responding to threats in under 10 minutes.”

“One of our largest Q3 deals was an $80 million transaction with the leading power producer in the United States, an organization in the center of the AI infrastructure expansion. They selected our [ next change firewalls ] and also adopted SASE to secure distributed workforce over 25,000 employees.”

“We surpassed $300 million in ARR for Chronosphere, our next-generation observability platform. That was an over 50% increase from Q2 and far exceeded our expectations, driven by an existing LLM customer increasing consumption as they continue to migrate from the incumbent vendor.”

“Prisma AIRS continues to be our fastest-growing product ever. We have over 300 Prisma AIRS customers as of Q3, up from just 100 at the end of Q2. As AI adoption grows in the enterprise, we believe AIRS is becoming a foundational infrastructure for secure AI deployment.”

“we surpassed $200 million in ARR with a leading frontier AI lab that relies on us for observability across its most depending training and inference clusters. We expect that to continue to grow again next quarter as they complete their migration to Chronosphere.”

“reach over 300 customers in Q3, tripling our Q2 count, and have clear visibility towards $100 million in ARR with the next couple of quarters for a product that was not in the market 1 year ago.”

“Hardware, which is approximately 10% of our total revenue, delivered its best quarter in a decade, fueled by strong demand for our next-generation firewalls. And we saw early AI data center wins, contributing to record Q3 backlog. Our next-generation firewall bookings grew nearly 40% year-over-year in Q3 as we continue to gain share. AI data centers and AI-driven enterprise networking needs are driving a new market opportunity for us, which could potentially be additive to our long-term growth for firewall appliances.”

“leveraging our strategic partnerships with leading frontier labs, we utilize early access to their most advanced models to complete the equivalent of years' worth of [ pen ] testing in less than 3 weeks. This unique vantage point allowed us to introduce [ Unit 42 ] frontier AI defense, enabling our customers to fortify their environments against AI-driven attacks. Market reception has been exceptional. With north of 1,200 customers asking to meet us, we have already completed 800 meetings in the last 6 weeks”

“Our Q3 results featured the strongest hardware performance in a decade, with next-generation firewall booking rising nearly 40% year-over-year. This was supported by our latest Gen 5 appliances and early access and AI data center build-outs. We're seeing early adoption from a new class of buyers, including sovereign infrastructure providers in AI labs, representing a significant new market as deployments move beyond traditional hyperscalers.”

“Our global footprint now exceeds 125 million sensors across network, endpoint and cloud, ingesting over 17 petabytes of daily telemetry. This scale creates a powerful flywheel. Every new sensor makes our entire platform more intelligent, which leads to more deployments, more data and even stronger real-time protection.”

“software firewalls remain a high-growth pillar of our strategy. ARR rose 25% in Q3, accelerating as organizations expanded their capacity to inspect growing traffic between cloud and AI workloads.”

“data collected for the observability use case will be valuable as a sensor to the security use case, meaning XSIAM will start to leverage that data to expand the data can analyze for security purposes. And importantly, vice versa, data collected for the security use case will be valuable to having additional context, broader context for the observability use case. So the first part is the data that is collected for each of these independent use cases start to cross-pollinate to the other. The second part is really related to [ AgentiX ]. And what you're seeing across these spaces is a need for AI-driven automated response. And AgentiX, we believe, is that foundation that will be leveraged across all of our platforms, obviously, starting with Cortex and expanding to Chronosphere.”

“the SOC has to be able to ingest data from all of these different sensors, analyzing real-time, using AI and then apply automation in order to achieve the mean time remediation that Nikesh was talking about earlier in the prepared remarks, where we can't be operating in a model where sort of legacy model of mean time to detection of days when attackers, particularly with these new models, are able to carry out attacks start to finish in tens of minutes. And so they're the -- they feed into XSIAM, the amount of data that XSIAM can ingest, speed of processing, AI, automation and response. That ability to prove to customers of all the rest that have already been deployed that we can achieve MTTR in minutes is a very powerful proof point”

“all of the activity now on the endpoint, I should say, all, but most of it now is becoming Agentic. And so you think about some of these vibe coding tools, think about things like [ Open Clad ] in its brief sort of history, it's not just a new application gets deployed there. It's the application, and it brings a whole ecosystem with it, right? So you look at these vibe coding tools, it's not just a vibe coding application. You have skills and hooks and scripts and MCP servers and all sorts of other stuff that come with it. And so it's almost like you have a whole new endpoint ecosystem on top of the 1 that already existed. And that requires specialized functionality.”

“we did design XSIAM with the idea of pre-analyzing everything before we ingest the data. So XSIAM is turning out to be a great tool in this regard in terms of reducing the median time to detect intermediate for our customers. And it has agents running in it to give you that capability. I think that capability will increase, and we can have a long concession what exactly the agent is. I think there's a lot of deterministic workflows that run to reduce the task of a SOC analyst, a lot of automation that exists in XSIAM. And over time, perhaps our customers will trust those agents to act independently. For now, the customers want to sort of see, observe and approve”

“we launched Idira, our next-generation identity platform for the AI-driven enterprise. For years, the industry operated under the [ IM Fallacy ], the belief that he only needed to secure a handful of privilege administrators. In the era of Agentic AI, that distinction has vanished. Every identity, whether human, machine or software agent, now possesses the potential to access the sensitive systems at machine speed. Idira addresses this shift by democratizing modern TAM controls across all users and extending protection to Agentic entities, which represent the primary attack vector of the future.”

“6 months ago, cybersecurity stocks were doomed because AI was going to protect every 1 of us, and we were all out of a job, right? And suddenly, we're hiring more people, AI is not taking jobs away. And suddenly, you can't execute a cyber protection scenario without using a platform cybersecurity vendor. I mean think about it, I think the part of which you must pay attention to Michael, as I said there's a 25% false positive rate, which means an AI model can say, "Oh my God, I see a vulnerability." And 1 time out of 4, it's not seeing the right vulnerability”

“frontier AI development reached a critical inflection point. We have entered the era of truly cyber capable systems where models like [ Mythos ] possess the autonomous capability to execute comprehensive attack campaigns from start to finish. This represents a fundamental paradigm shift for the cybersecurity industry. The most critical factor in this transition is speed. When weaponized by adversaries, these frontier models can identify and weaponize vulnerabilities in mere minutes, a process that previously required months of manual effort.”

“We believe we are the first in the industry to embrace AI security platformization, yes, AI security platformization capable of securing and monitoring AI end-to-end. We have effectively doubled our capabilities in this space in just over 9 months. Our journey began with securing models and runtime defense. We then integrated identity security to govern agent access and observability to create agent behavior across complex infrastructure. Most recently, we expanded to Agentic endpoint security as AI tools proliferate across the edge.”

“We currently see 2 major structural challenges: First, the prevalence of false positives, with error rates often received reaching 25%, forcing manual intervention that destroys the speed advantage of automation. Second, these models always fail at the last mile of complexity, leaving critical gaps in remediation and vulnerability management.”

“traditional periodic scanning is insufficient when attack time lines are measured in minutes. As a result, we proactively transitioned our cloud portfolio from static post to real-time detection to Cortex Cloud. We're making steady progress and anticipate most Prisma customers will be migrated to Cortex Cloud by the end of the fiscal year.”

“Our recent acquisition of Portkey marks yet another strategic milestone. As a leading AI gateway processing trillions of tokens monthly, Portkey provides a critical enforcement point to monitor every request to apply real-time policy to agent-to-agent interactions at scale.”

“our [ Unit 42 ] research has demonstrated the acceleration by simulating a comprehensive [indiscernible] campaign from initial entry to data exfiltration in just 25 minutes. In contrast, the typical enterprise still requires days to identify a breach.”

“strong interest in our Agentic endpoint security offering since the acquisition of Koi and have already generated interest for over 150 customers. This is critical for securing rising AI coding tools and agents as they proliferate our endpoints.”

“AI creates a massive surge in traffic and connection points requiring real-time inspection. As agents trigger hundreds of secondary actions, network security becomes indispensable foundation for safe AI adoption. Second, countering machines to be adversaries requires real-time automated defense. This is a core mission of XSIAM consolidating data onto a single platform, so AI can respond to threats in minutes rather than days. And third, in an environment populated by both human and agents, [ identity ] serves as a primary defensive layer.”

“the shift towards Agentic AI represents a fundamental change. Unlike simple chat bots, autonomous agents trigger a massive volume of secondary machine-to-machine interactions, consistently accessing tools and data to complete complex workflows. This creates a surge in nonstop high-volume traffic that must be secured at run time. This evolution directly translates into heightened demand for high-throughput hardware, expanded cloud-based software capacity and the necessity for unified policy enforcement across the entire platform.”

“as more traffic traverses networks, more inspection is needed. When more inspection is needed, hardware is the cheapest and fastest throughput mechanism to inspect the data. I think the multiyear tailwind will come from the fact that more and more data needs to be stored both by organizations needs to be used for training all these frontier labs out there. and you can see the explosion of data centers being built, whether it's by hyperscalers, frontier labs or neoclouds out there.”

“we anticipate a 3- to 6-month window before these systems evolve into more sophisticated hacking entities globally. Within a few years, we expect Agentic AI to reach a level of autonomous execution that is truly unprecedented, scanning environments, generating bespoke exploits and orchestrating [ entering ] campaigns at machine speed without human intervention.”

“XSIAM remains our primary response to the emerging frontier model threat. As attack cycles compress to machine speed, organizations can no longer rely on legacy [ co ABS-based ] architectures or manual dashboards. Effectively countering AI necessitates a defensive strategy powered by AI.”

“do I see good demand, yes. To the extent I believe that this demand will continue for longer, yes. To the extent do I expect a windfall next quarter, the following quarter? No, I expect robust growth.”

“surging cybersecurity needs as AI transitions from experimental stages to enterprise-wide production”

“we're using AI to write a whole bunch of new coding capabilities, sales capability.”

“The logic is simple. The more you integrate, the more you see, the more data you unify. The better the AI performs, the more you inspect your run time, the faster you can stop an attack.”