Palo Alto Networks (PANW)

By both methods, the value today (DCF $52 · Multiples $95) is below the market price ($404).

Today — expensive, no margin of safety: at $404 trades ~322.9% above its value discounted to today (~$95); the expected return does not even reach the risk-free rate (4.5%).

At 5 years — Sobrevalorado: the expected total return is negative — the price already discounts a demanding scenario that, if not met, results in a loss.

The bridge: the return at 5 years falls below the risk-free rate (4.5%) — which is why there is not even a discount to today's value. To require a 15% annual return, it would need to be bought at ~$59.

Educational / informational. Does not constitute investment advice.

The inverse approach: instead of projecting growth to obtain the value, the market price ($404) is taken as given and it solves for what annual owner-earnings growth would need to hold for 5 years for the present value —at the method's rate (4.5%, no-growth terminal)— to equal that price. It is the disconfirmation test: the expectations the price already pays for, contrasted against the method's projection.

The price discounts growth (80.4%/year) above our base case (15.0%/year) → it is priced for a demanding scenario and leaves little cushion against a slowdown.

That growth implies ~$16.5 bn of owner earnings in year 5 (vs ~$1.7 bn of our base case). It recalculates if the DCF assumptions are edited.

Year-by-year projection of the selected scenario. From each year, two versions of the flow are derived: growth FCF (operating flow − total capex, the cash surplus) and maintenance FCF (the owner earnings: what the business yields if it only sustains its capacity). The flow is returned almost in full (dividend + buyback) or redeployed into the operation, so that EV stays roughly flat and multiples compress because the metric grows, not because of cash accumulation. The valuation is done on EV/NOPAT. In edit mode, revenue, margins, capex, and exit multiples can be adjusted.

The base year is fiscal 2026, closed 31-Jul-2026 (revenue $11,480M, +24%), which coincides with the fiscal close, so the +1y window is exactly the fiscal 2027 the company guides. Year-0 GAAP operating income is 6.1% of revenue, against 13.5% the prior year: the drop is explained by amortization of intangibles from CyberArk and Chronosphere, which rose from $164M to $638M, and $295M of acquisition-related costs. The margin is normalized by adding back those acquisition-related costs — transitory and documented in the non-GAAP reconciliation of the September 1, 2026 release — but not the amortization of intangibles, which is a recurring cost of a serial-acquisition strategy, nor stock-based compensation ($1,712M, 14.9% of revenue and 42% of free cash flow: always expensed). Year-0 normalized margin stands at 8.6%. The margin path is not eyeballed: it is derived. The non-GAAP margin the company guides for 2027 is 29.5%, and from there stock-based compensation and amortization of intangibles are subtracted, which the 10-K itself schedules fiscal year by fiscal year — $1,081M in 2027, $989M in 2028, $908M in 2029, $892M in 2030 and $667M in 2031. Since that charge hits for a full fiscal year only starting in 2027, the normalized margin still gives ground in year 1 (7.3%) and recovers afterward, to close to 20% by year 5, as the amortization dilutes against growing revenue and operating leverage takes hold. It is a declared trough, not a deceleration: the compression has an expiration date written into the filing. Year-1 revenue anchors on the September 1, 2026 guidance ($14,100 to $14,200M, +23% to 24%), with the adverse scenario at the low end of the range and the favorable at the high end, decelerating smoothly toward 13% by year 5 — consistent with a quality cybersecurity platform that is still penetrating a large addressable market but faces intense competition. Contracted indicators back this up: next-generation ARR grew 63% to $9,100M and remaining performance obligations 34% to $21,200M. The bridge carries a net cash position of $5,972M ($7,906M in cash and investments against $1,934M of debt, almost all in convertible notes); since those notes are subtracted in full, their conversion shares do not enter the denominator, which is the 815 million shares outstanding at close. The company does not pay dividends and redeploys the surplus into complementary acquisitions rather than accumulating it, so the model uses reinvestsExcess.

Today's elevated multiple is the price of growth: if the business grows, the entry point cheapens on its own going forward (the metric grows while EV stays roughly flat). The exit multiple at 3 years is higher than the terminal at 5 years —at 3 years there is more growth still ahead—, so the value curve shows whether value creation is concentrated in the early or the later years. The required return is applied to the base scenario.

They are valued separately, with their own rationale, and are not incorporated into the base or the verdict (they are excess return). When assigning them value — in Editmode —, the total with optionalities updates live, without moving the base.

The verdict, the base CAGR, and the margin of safety are always calculated on the base; optionalities do not alter them (with optionalities at $0 they do not move).

Each card fixes a required annual return and answers: if the business is worth $119 in 5 years, what is the maximum that can be paid today to obtain that return? Since it now trades at $404, the margin of safety is how much cheaper the market is than that maximum. The three thresholds: 4% covers inflation (the floor), 10% is the long-term average return, and 15% is the level of a great investment.

With a target price of $119 in 5 years and a required return of 4.5% annually, the maximum to pay today is $95. Against the current market price ($404), the margin of safety is -322.9% (trades above the maximum → a premium is paid) and the total return at that price would be -21.7% annually.

• Current EV/NOPAT multiple. 459× on trailing-twelve-month net operating profit after tax, depressed by integration costs.
• Current EV/revenue multiple. A historically demanding revenue multiple for this revenue scale.
• Projected compression. The EV/NOPAT multiple compresses toward 89× in the base scenario over 5 years, still well above a reasonable level.
• Not even the favorable scenario closes the gap. Even with optimistic growth and margin, the expected 5-year return is negative in the favorable scenario.
• Business fundamentals. The quality of the business (moat, growth, recurrence) is genuine; the problem is exclusively the price paid today.

Each margin over sales, year by year: historical (solid line) → projection (dotted).

• ✕ ROIC exceeds the cost of capital (~10%)
• ✓ CFROIC backs up the ROIC (186%, cash vs. accruals)
• ✓ Healthy balance sheet (low corporate debt)
• ✓ Durable competitive moat (multiple advantages)

• Cash generation. Operating cash flow of US$4,217 million over the last twelve months, with adjusted FCF margin guided to 37.5% for fiscal year 2026.
• Revenue predictability. The 80.5% recurring share and the contracted RPO give high visibility into future revenue.
• Stock-based compensation. 15.7% of revenue and 44% of free cash flow; it is expensed in the valuation metric (EV/NOPAT).
• Temporary GAAP margin. Compressed to 9.6% over the last twelve months by CyberArk integration costs; normalized to 11.8% in the model's year 0.
• Reinvestment runway. The AI cybersecurity and identity markets expand the total addressable market beyond the original firewall business.

Annual levels from the official filing (10-K); the % over each bar is the year-over-year (YoY) growth vs the prior year.

Palo Alto Networks reports revenue by type (product vs. subscription and support) and by geography, not by distinct operating segments with their own profit — it does not warrant a sum-of-the-parts because it is a single business of homogeneous nature (software/cybersecurity, capital-light, high gross margin). The highest-signal drivers are next-generation ARR and remaining performance obligations (RPO), both leading and contracted indicators of future revenue, which anchor the deceleration path in section 5 with revenue already signed rather than extrapolated trend.

The % are the annual (year-over-year) growth: each year —historical and projected— vs the prior one; the TTM (trailing 12m) vs the TTM of a year ago, to avoid overlapping windows. The historicals are exact figures from the official filings; the projected years come from the year-by-year model (the intermediate years without their own series are interpolated between the anchors). The projected columns (+1y…+5y) are 12-month windows counted from the TTM close (31-jul-2026): the projection starts from the most recently reported data, not the fiscal year. The projected base is realistic and unbiased — the risk discount is applied at the end, via the required return. The rationale for each metric is in the (i).

• Next-generation ARR. Grew 60% year over year in the most recent quarter, including CyberArk and Chronosphere.
• Remaining performance obligations. US$18,400 million, +36% year over year, already-contracted revenue.
• Company guidance. The company guides to 24% revenue growth for the full fiscal year 2026.
• Organic growth. Excluding the contribution from CyberArk and Chronosphere (US$388 million in the quarter), organic growth is around 14%, more moderate than the 31% headline.
• Penetration ceiling. The enterprise cybersecurity market is large but mature in traditional network lines; the higher-quality growth is in identity and cloud.

• Revenue recurrence. 80.5% of revenue is subscription and support with one- to five-year contracts.
• Product diversification. Three platforms (Network, Security Operations, Threats) reduce dependence on a single line.
• Channel concentration. Three distributors account for 44.2% of revenue and 44.8% of receivables.
• Leading indicators. Next-generation ARR +60% and RPO +36% year over year, contracted rather than extrapolated.
• Platform competition. Four simultaneous competitive fronts, some at zero or negative pricing.
• Product vulnerabilities. A PAN-OS security advisory in November 2024 required remediation with customers.

Not all debt is equal: only the structural needs refinancing; the rest is operational (self-liquidating).

Structural debt is what is exposed to the contraction phase of the cycle; operational debt (leases, matched funding) self-liquidates with the business.

• ✓Leverage (net debt / EBITDA)Net cash $6 bn
• ✓Interest coverage (EBIT / interest)417.3x
• ✕Liquidity (current ratio)0.86×
• ✓Cash quality (CFROIC vs ROIC)CFROIC backs 186% of ROIC
• ✕Value creation (ROIC − 10% bar)-7pp
• ✓Malinvestment test (capex vs incremental ROIC)Capex/D&A 0.5x — no over-investment
• ✓Float / working capitalFrees up cash $0.4 bn (float / negative WC)
• ✕Dilution (SBC % of revenue + shares)SBC 15.5% of revenue

A traffic-light interpreted by the method (not generic): float (negative WC) adds up, capex is judged by incremental ROIC (malinvestment test), and a lender is not subjected to corporate solvency. The (i) shows the derivation of each number.

• Net cash. Positive net cash position of US$5,640 million (cash and investments of US$6,990 million against debt of US$1,352 million).
• Debt. Debt consists of convertible notes with a near-zero coupon, with no material short-term maturities.
• Current liquidity. Current assets of US$7,713 million against current liabilities of US$9,006 million, a current ratio of ~0.86× due to the weight of deferred revenue (which is operating funding, not a cash obligation).

• Acquisition strategy. CEO actively executes complementary acquisitions (QRadar, Protect AI, Koi Security, Chronosphere, CyberArk) to expand the platform.
• Integration risk. The CyberArk acquisition (~US$25,000 million) is the largest in the company's history and just closed.
• Capital allocation. Buybacks were paused in fiscal year 2025 to preserve cash for the CyberArk closing; resumed in the most recent quarter.
• Transparency. The company reconciles its non-GAAP metrics in detail and discloses integration costs separately.

• The market pays up front for cybersecurity platform consolidation: the CyberArk purchase (about US$25,000 million, closed in the third fiscal quarter) took goodwill from US$4,567 million to US$21,902 million and added privileged access management to the network, cloud, and operations center suite.
• The company's own guidance projects revenue growing 24% in fiscal year 2026 with CyberArk and Chronosphere already consolidated, a pace that at more than US$10,000 million in annual billings supports part of the multiple on its own.
• The company steers attention to adjusted free cash flow — with a targeted margin of 37.5% — rather than accounting earnings, which stay compressed by amortization of acquired intangibles; the market values the stock on that metric rather than on the result under accounting standards.
• The narrative of AI-assisted security draws flows toward the sector's reference name, with broad analyst coverage and no motivated sellers in sight.

We do not identify a clear source of discount of the missing-buyers or motivated-sellers type: the stock has broad analyst coverage. What explains the price is not a discrepancy between perception and reality but a narrative of AI-driven cybersecurity growth that the market pays for up front, at a revenue multiple that historically is rarely sustained at this revenue scale (more than US$10,000 million annually). No margin of safety: the price already discounts a demanding scenario.

The annual return (CAGR at 5 years) in each scenario, with the total period return below — the margin of safety made visual: upside range wide, downside range narrow.

Even in the bear scenario, the return holds at -30%/year (-84% total): the margin of safety protects the downside. The bull (-15%/year, -56% total) exceeds it comfortably — a favorable asymmetry, with a narrow downside range and a wide upside range.

• CyberArk integration. The largest acquisition in the company's history (~US$25,000 million) just closed; execution risk is material.
• Big Tech competition. Microsoft, Alphabet, and Cisco can bundle security into existing products at zero or negative pricing.
• Well-funded specialists. CrowdStrike, Zscaler, and Wiz compete aggressively in the highest-growth categories (cloud, identity).
• Channel concentration. Three distributors represent 44.2% of revenue and 44.8% of gross receivables.
• Renewal without contractual obligation. Customers are not obligated to renew; a drop in renewals takes time to show up in reported revenue.
• Product vulnerabilities. A security flaw in the product itself (PAN-OS, November 2024) can directly damage customer trust.

Each thinker's analytical framework applied to our data.

• Buffett / Graham Quality + margin of safety

  Fails the quality gate: ROIC 3% does not clear the 10% bar.

• Peter Lynch Growth at a reasonable price (GARP)

  A fast grower growing 15% at a multiple/growth of 30.6 → expensive for its growth.

• Joel Greenblatt Cheap and high-return (Magic Formula)

  Earnings yield 0% (EBIT/EV) + ROIC 3% → falls outside the Magic Formula.

• Howard Marks Perception vs reality + cycle

  The price discounts 80% vs our 15%: priced for perfection, no favorable mispricing.

• Seth Klarman Capital protection (bear scenario)

  Bear-scenario floor -30%/yr over 5y (material loss) → risk of permanent capital loss.

• Pat Dorsey Moat strength (Five Rules)

  A wide moat, stable; sources: switching costs, intangibles, efficient scale, network effects → passes the Five Rules.

• Aswath Damodaran Expectations implied by the price

  The price demands 80% growth, far above our 15% — heroic assumptions.