Software Firewalls in the Cloud MarketplacesNarrow moat

Palo Alto Networks (PANW) — moat facet

Palo Alto made its firewall portable into the public clouds, so the security rules customers built over years move with them.

Palo Alto's firewall now runs as software inside the public clouds, sold through the clouds' own storefronts. Its VM-Series and Cloud NGFW products are available on the AWS, Microsoft Azure, Google Cloud and Oracle Cloud marketplaces1. A customer can buy them with its existing cloud budget, and Palo Alto reaches it without a reseller.

Where the Palo Alto software firewall is soldAWS MarketplaceVM-Series and Cloud NGFWMicrosoft Azure MarketplaceVM-Series and Cloud NGFWGoogle Cloud MarketplaceVM-SeriesOracle Cloud MarketplaceVM-SeriesSoftware firewall ARR growth29% in Q4 FY2026Palo Alto Form 10-K FY2026; Q4 FY2026 earnings call
Four clouds, one rule set.

The business is growing faster than the hardware it replaces. Management reported "29% ARR growth in Q4" for software firewalls2. The software firewall carries the same rules and management tools as the physical one, so a customer moving workloads to the cloud can keep its Palo Alto security setup rather than start again.

This is how an installed base survives a change in where computing happens. A firewall vendor whose products only lived in data centres would lose customers as workloads moved to the cloud; Palo Alto has made its product portable, and the switching cost moves with the customer.

The arrangement also makes the cloud providers partners of a particular kind: they host Palo Alto's software, sell it in their marketplaces, and take a share of the transaction. The company's own warning about "competition from cloud infrastructure providers offering native security capabilities"3 is the other half of that relationship, taken up in the threat below.

Selling through the marketplaces also changes the channel economics. A marketplace sale can bypass the distributor, and the share of revenue passing through distributors above 10% fell from 44.2% in fiscal 2025 to 30% in fiscal 20264; the filings do not say how much of that shift came from marketplaces.

The software firewall is Palo Alto's answer to the cloud. Its ARR grew 29% in the latest quarter5. Growth below 20% would suggest the clouds' own firewalls are winning the workloads that leave the data centre.

Moat trajectory: Widening

Software firewall ARR +29% in Q4 FY2026.

The number that tests this moat
Reported
Software firewall ARR growth, latest quarter
29% (Q4 FY2026)

Whether the firewall follows workloads into the cloud; growth below 20% would mean native cloud firewalls are winning.

Source: Palo Alto Networks Q4 FY2026 earnings call ↗
⚠ Threats to the moat
⚠ THREAT 01
The Landlord Sells Locks Too
The clouds that sell Palo Alto's firewall in their marketplaces also build security into their own platforms.
References
  1. ReportedIts VM-Series and Cloud NGFW products are available on the AWS, Microsoft Azure, Google Cloud and Oracle Cloud marketplaces.
    Palo Alto Networks Form 10-K for fiscal 2026 (year ended 31 July 2026) - Item 1 business and Item 7 MD&A: platforms, customers, channels, employees, revenue by type and geography. — FY2026 · publ. 10 September 2026 · source ↗
  2. ReportedManagement reported "29% ARR growth in Q4" for software firewalls.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  3. ReportedThe company's own warning about "competition from cloud infrastructure providers offering native security capabilities" is the other half of that relationship, taken up in the threat below.
    Palo Alto Networks fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - income statement, non-GAAP reconciliation, balance sheet, cash flow, Next-Generation Security ARR, remaining performance obligations and fiscal 2027 guidance - fourth-quarter and full-year results, balance sheet and cash flow. — Q4 FY2026 · publ. 1 September 2026 · source ↗
  4. Moat Explorer calcA marketplace sale can bypass the distributor, and the share of revenue passing through distributors above 10% fell from 44.2% in fiscal 2025 to 30% in fiscal 2026; the filings do not say how much of that shift came from marketplaces.
    Moat Explorer calculation from Palo Alto Networks' reported figures ($ millions unless stated; fiscal years end 31 July). Growth: revenue FY2026 11,480 / 9,221.5 - 1 = 24.5%; FY2025 9,221.5 / 8,027.5 - 1 = 14.9%; FY2024 8,027.5 / 6,892.7 - 1 = 16.5%; FY2023 25.3%; FY2022 29.3%; FY2021 24.9%; FY2020 17.5%; FY2024 to FY2026 11,480 / 8,027.5 - 1 = 43%; compound FY2015-FY2026 (11,480 / 928.1)^(1/11) - 1 = 25.7%, about 26%. By type FY2026: product 2,280 / 1,801.9 - 1 = 26.5%; subscription 6,239 / 4,974.4 - 1 = 25.4%; support 2,961 / 2,445.2 - 1 = 21.1%. Product FY2025 12.4%, FY2024 1,603.3 / 1,578.4 - 1 = 1.6%, FY2020 1,064.2 / 1,096.2 - 1 = -2.9%. Subscription FY2017 53.7%, FY2019 36.2%, FY2021 35.1%, FY2023 31.4%, FY2024 25.6%, FY2025 18.8%. Support FY2022 29.3%, FY2023 23.7%, FY2024 13.0%, FY2025 9.4%. Compound FY2015-FY2026: subscription (6,239 / 212.7)^(1/11) - 1 = 36.0%; support (2,961 / 222.7)^(1/11) - 1 = 26.5%; product (2,280 / 492.7)^(1/11) - 1 = 14.9%. Product outgrew subscription in FY2026 (26.5% against 25.4%), which it did not in any year FY2016-FY2025. Organic: FY2026 (11,480 - 930) / 9,221 - 1 = 14.4%; Q4 acquisition revenue 930 - 388 = 542; Q4 (3,410 - 542) / 2,536 - 1 = 13.1%, about 13%; pro forma 12,312 / 10,486 - 1 = 17.4%; FY2027 guidance 14.15 / 12.312 - 1 = 14.9%, about 15%. Margins: gross margin FY2026 8,077 / 11,480 = 70.4% (FY2025 6,769.9 / 9,221.5 = 73.4%; FY2024 5,968.3 / 8,027.5 = 74.3%); Q4 GAAP 2,304 / 3,410 = 67.6%. Product gross margin (2,280 - 568) / 2,280 = 75.1% (FY2025 (1,801.9 - 413) / 1,801.9 = 77.1%); subscription and support (9,200 - 2,835) / 9,200 = 69.2% (FY2025 (7,419.6 - 2,038) / 7,419.6 = 72.5%). Operating margin 695 / 11,480 = 6.1% (FY2025 1,242.9 / 9,221.5 = 13.5%); non-GAAP 3,356 / 11,480 = 29.2% (FY2025 2,652 / 9,221.5 = 28.8%); Q4 non-GAAP 1,011 / 3,410 = 29.6%; gap 3,356 - 695 = 2,661. R&D 2,552 / 11,480 = 22.2%; sales and marketing 3,931 / 11,480 = 34.2%; capital expenditure 440 / 11,480 = 3.8%. Tax 229 / (307 + 229 = 536) = 42.7%. Mix: product share 492.7 / 928.1 = 53.1% (FY2015), 2,280 / 11,480 = 19.9% (FY2026); subscription 212.7 / 928.1 = 22.9%, 6,239 / 11,480 = 54.3%; support 222.7 / 928.1 = 24.0%, 2,961 / 11,480 = 25.8%; one point of share 1% x 11,480 = 115. Recurring share 435.4 / 928.1 = 46.9% (FY2015), 1,393.8 / 2,273.6 = 61.3% (FY2018), 3,135.8 / 4,256.1 = 73.7% (FY2021), 6,424.2 / 8,027.5 = 80.0% (FY2024). Subscription and support per dollar of product 435.4 / 492.7 = 0.88 (FY2015), 1,393.8 / 879.8 = 1.58 (FY2018), 3,135.8 / 1,120.3 = 2.80 (FY2021), 6,424.2 / 1,603.3 = 4.01 (FY2024), 9,200 / 2,280 = 4.04 (FY2026). Hardware about 10% x 11,480 = about 1,150, about 50% of product. NGS ARR 9.10 / 11.48 = 79% of revenue. United States 7,108 / 11,480 = 61.9% (FY2016 901.8 / 1,378.5 = 65.4%). Q4 share of year 3,410 / 11,480 = 29.7%, about 30%. Prisma AIRS ARR 100 / 11,480 = under 1%. ARR and RPO: Q3 acquired ARR 1.6 / 8.1 = 20%, about a fifth; Q3 organic 8.1 - 1.6 = 6.5; Q3 acquired RPO 1.8 / 18.4 = 10%; FY2023 NGS ARR 4.2 / 1.43 = about 2.9; FY2025 growth 5.6 / 4.2 - 1 = 33%; Q1 FY2027 net new 9.54 - 9.10 = 0.44 to 9.56 - 9.10 = 0.46 billion; FY2030 target (20 / 9.1)^(1/4) - 1 = 21.8% a year; RPO / revenue 21.2 / 11.48 = 1.85; RPO due in 12 months 1.7 / 3.1 = 55% (FY2019), 2.2 / 4.3 = 51% (FY2020), 3.1 / 5.9 = 53% (FY2021), 4.1 / 8.2 = 50% (FY2022), 5.1 / 10.6 = 48% (FY2023), 5.9 / 12.7 = 46% (FY2024), 7.0 / 15.8 = 44% (FY2025), 9.3 / 21.2 = 44% (FY2026); RPO beyond 12 months 21.2 - 9.3 = 11.9 billion; Idira guidance 1.5 / 1.26 - 1 = 19%; Network and AI Security FY2025 8.35 / 1.17 = about 7.14 billion. Revenue from prior deferred 6.2 / 5.5 - 1 = 13%. Cash, deferred revenue and stock pay: free cash flow margin 4,113 / 11,480 = 35.8%; share-based compensation (cash flow) 1,774 / 11,480 = 15.5%; 1,774 / 1,295 - 1 = 37%; 1,774 / 4,113 = 43%; free cash flow after stock pay 4,113 - 1,774 = 2,339, 2,339 / 11,480 = 20.4%, 2,339 / 306,540 = 0.76%; free cash flow 4,113 / 306,540 = 1.3% and 4,113 / 27,492 = 15%. Stock pay share of revenue FY2016 392.8 / 1,378.5 = 28.5%, FY2020 658.4 / 3,408.4 = 19.3%, FY2024 1,076 / 8,027.5 = 13.4%, FY2025 1,295 / 9,221.5 = 14.0%. 10-K share-based compensation 1,815 / 1,079 - 1 = 68%. Equity plan (26.1 + 24.3) / 818 = 6%. Net cash 2,514 + 557 + 4,835 - 1,774 = 6,132; cash and investments 2,514 + 557 + 4,835 = 7,906, about 7.9 billion. Deferred revenue 1,582.1 + 1,306.6 = 2,888.7 (FY2019); 2,741.9 + 2,282.1 = 5,024.0 (FY2021); 4,674.6 + 4,621.8 = 9,296.4 (FY2023); 6,302.2 + 6,449.7 = 12,751.9 (FY2025); 7,747 + 7,009 = 14,756 (FY2026); 14,756 / 11,480 = 1.29 times; 2,888.7 / 2,899.6 = about one year (FY2019); growth 14,756 / 12,751.9 - 1 = 15.7%; excluding CyberArk (14,756 - 776) / 12,751.9 - 1 = 9.6%. Billings FY2025 9,221.5 + (12,751.9 - 11,480.5) = 10,493, 10,493 / 10,208.1 - 1 = 2.8%; FY2026 11,480 + (14,756 - 12,752) - 776 = about 12,708, 12,708 / 10,493 - 1 = 21%; February 2024 guidance cut 10.7 - 10.1 = 0.6 billion. Acquisitions: fiscal 2019 378.1 + 474.2 + 158.2 + 292.9 + 82.7 + 36.8 + 103.1 = 1,526; fiscal 2020 144.1 + 66.4 = 210.5; fiscal 2021 797.2 + 227.7 + 156.9 + 27.0 = 1,209; fiscal 2024 255.4 + 458.6 = 714; fiscal 2025 1,143 + 635 = 1,778; fiscal 2026 2,951 + 21,061 + 231 + 117 = 24,360, about 24.4 billion; all twenty-two FY2019-FY2026 including Cider 198.3 = 29,996, about 30.0 billion; FY2026 against FY2019-FY2025 24,360 / 5,636 = 4.3 times; after year end 325 + 500 = 825; AI security 635 + 231 + 117 = 983. CyberArk shares 18,488 / 112 = about 165 a share; 25,000 - 21,061 = about 3.9 billion; 112 x 374.74 = about 42.0 billion; 112 / 818 = 14%. Chronosphere 2,951 / 160 = about 18 times ARR. Goodwill and intangibles (22,010 + 7,017) / 48,460 = 60%; other assets 48,460 - 29,027 = 19,433. Headcount 21,921 - 4,223 = 17,698, 17,698 / 16,068 - 1 = 10%. Revenue per employee 928.1 / 2,637 = 0.35; 9,221.5 / 16,068 = 0.57; 11,480 / 21,921 = 0.52. Convertible loss Q1-Q3 562 - 524 = 38. Distributors: FY2019 31.8 + 22.1 + 10.7 + 10.0 = 74.6%; FY2021 33.2 + 12.2 + 10.6 = 56.0%; FY2023 25.0 + 12.8 + 11.9 = 49.7%; FY2024 21.2 + 13.2 + 13.2 + 11.4 = 59.0%; FY2025 18.8 + 14.4 + 11.0 = 44.2%; FY2026 15 + 15 = 30%; largest 34.4% (FY2020) to 15% (FY2026); receivables FY2019 29.9 + 18.9 + 14.2 = 63.0%. Valuation: market value over fiscal revenue at calendar year-end 15.13 / 0.928 = 16.3 (2015), 11.47 / 1.3785 = 8.3 (2016), 42.19 / 5.5015 = 7.7 (2022), 92.98 / 6.8927 = 13.5 (2023), 119.40 / 8.0275 = 14.9 (2024), 128.39 / 9.2215 = 13.9 (2025); 306.54 / 11.48 = 26.7; 306.54 / 0.307 = 998; 374.74 / 3.84 = 97.6; market value against Fortinet 306.54 / 130.12 = 2.4, against CrowdStrike 306.54 / 267.43 = 1.15; analyst target 395.70 / 374.74 - 1 = 6% - revenue mix, concentration and geography. — FY2015-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in Palo Alto Networks' Forms 10-K and results releases, the Q4 FY2026 earnings call and market data; operands shown in the source line.
  5. ReportedIts ARR grew 29% in the latest quarter.
    Palo Alto Networks fourth-quarter fiscal 2026 earnings call transcript (Motley Fool) - platform revenue, platformized cohort retention, large deals and fiscal 2027 modelling points. — Q4 FY2026 · publ. 1 September 2026 · source ↗
Sources
Generated September 26, 2026