PANW: See Cyber Spend Inflection & New Segmentation as Catalyst for a Cleaner Story; Adding to 3Q26 Tactical Ideas List

Research evidence excerpt

PANW: See Cyber Spend Inflection & New Segmentation as Catalyst for a Cleaner Story; Adding to 3Q26 Tactical Ideas List

dation. Cortex should show XSIAM

benefiting from SIEM replacement, SOC automation and runtime security. Identity should show

CyberArk benefiting from privileged access, machine identity, and agentic permissioning. The

clearer these drivers become, the easier it is for investors to digest the narrative and model the bull

case.

• Black Hat / AI announcements: We believe AI upside is not meaningfully baked into estimates

because models mostly capture known ARR, not a new security architecture cycle. AI creates new

traffic, new agents, new identities, new runtime risks, new data leakage paths and new observability

needs. That touches SASE, software firewall, AIRS, XSIAM, Cortex Cloud, Chronosphere and

CyberArk. If Black Hat shows PANW has the broadest architecture for securing AI in production,

narrative can improve before numbers are fully visible.

• CyberArk / Chronosphere execution: We believe M&A can raise estimates because the acquired

assets map directly to these secular shifts. CyberArk adds identity controls for users, machines

and agents, which becomes more urgent as AI agents act with permissions. Chronosphere adds

observability for AI-scale infrastructure, where telemetry volumes and cost control are exploding.

PANW can push both through a large enterprise base and attach them to platform deals, creating

cross-sell and margin upside.

Downside Risks

We believe the main risks are that SASE growth slows from competition, software firewall demand

proves more cyclical than secular, XSIAM displacement cycles take longer, AI-security budgets stay

experimental, CyberArk cross-sell is slower, Chronosphere consumption is concentrated, or FY27