Palo Alto Networks: Downside Risk Remains Elevated (NASDAQ:PANW)

Palo Alto Networks’ (NASDAQ:PANW) (NEOE:PANW:CA) share price has remained resilient in recent months, despite the business facing headwinds that may take longer to reverse than many expect. Palo Alto’s NGS portfolio continues to perform well though, with the company’s large existing customer base providing an enormous cross-sell opportunity. Palo Alto is a strong company, meaning the stock will likely do well longer term. Its valuation is currently fairly extreme, though, given the deterioration in growth and soft demand environment.

I previously suggested that Palo Alto’s problems were underappreciated and that the company’s platformization strategy was in response to weakness, not at an attempt to capitalize on the large market opportunity. Data supports this, although Palo Alto can continue to pull levers to support financial performance in the short term.

Market Conditions

Palo Alto has suggested that market conditions are stable, with a dynamic threat landscape continuing to drive demand for next-gen solutions, despite elevated interest rates and an uncertain macro environment creating caution amongst customers. Palo Alto also believes that AI is contributing to a resurgence of cloud migrations, driving demand for cloud security.

Demand varies considerably across product type, though, with hardware under pressure due to the exhaustion of pandemic related backlogs. Fortinet’s (FTNT) firewall sales are weak, although the company expects customer inventory levels to normalize by the end of the year. Fortinet has suggested it will offer deals throughout 2024 to encourage sales, contributing to pricing pressure in the market.

While CrowdStrike’s (CRWD) financial performance remains strong, the company has stated that market conditions are still challenging. CrowdStrike’s commentary also continues to be dismissive of Palo Alto’s approach, suggesting that stitching solutions together is an inferior approach. A viewpoint shared by Fortinet.

Palo Alto Business Updates

Palo Alto’s SASE solution has now been deployed with over 4,000 customers, and at any point in time there are over 15 million endpoints using the product, with another 50 million using Palo Alto’s VPN product. While competition is increasing, Palo Alto remains well positioned in the SASE market. SASE is the fastest growing part of Palo Alto’s business, with Prisma SASE generating 50% YoY growth in the third quarter.

Adoption of zero-trust within governments should also be a tailwind for Palo Alto in coming years. Palo Alto has been working on project Thunderdome for 1.5-2 years, trying to sell SASE to the federal government. Thunderdome refers to the Defense Information System Agency’s zero-trust network architecture. While this remains a large opportunity that Palo Alto is still positive about, it is now likely to happen over a period of time rather than all at once. A large single-digit percent of Palo Alto’s business already comes from the federal government.

Palo Alto believes that its cloud security business is roughly 50% larger than the next biggest player in the market, although competition is increasing. For example, Fortinet is acquiring Laceworks, which should significantly strengthen its cloud security offering. While Laceworks has fallen from grace, the company still has a solid solution. Palo Alto believes that the hygiene part of cloud security is becoming commoditized, and that the importance of real-time protection is increasing, which potentially plays to the strength of companies like CrowdStrike.

Despite weak firewall growth at the moment, Palo Alto believes that the market will ultimately return to pre-COVID trend growth (0-5% annual growth). Cloud migrations are putting a damper of hardware demand, though, with spend shifting to software. Palo Alto’s software firewall growth is around 3x that of its hardware firewall growth.

XSIAM is also an area of strength at the moment, with Palo Alto achieving 400 million USD of TCV in the first 15 months of the product. In addition, XSIAM is elevating the profile of Cortex in the market. XDR demand is reportedly steady, and Palo Alto now has over 5,800 XDR customers.

The Cortex business should also be supported by a recent partnership with IBM, where IBM customers will migrate from QRadar to XSIAM. IBM will deliver industry-specific capabilities on XSIAM using watsonx. Palo Alto will be IBM’s preferred cybersecurity partner across network, cloud, and SOC. The companies will also co-develop solutions for cloud security. As part of the partnership, Palo Alto is acquiring IBM’s QRadar SaaS assets, certain QRadar IP and IBM’s on-premises QRadar customer list. Total consideration is 500 million USD plus earn-out considerations.

Platformization

Palo Alto’s customers are still purchasing in excess of 20-30 cybersecurity products, even though cybersecurity only constitutes something like 6-10% of the IT budget of most companies. It can be complex to shift between solutions though and systems integration work is often required. As a result, Palo Alto is making channel partners more of a focus.

Palo Alto is also using incentives to encourage customers to standardize on its platform. Palo Alto’s platform strategy has been positioned as an offensive move designed to accelerate consolidation. Palo Alto plans on using incentives to encourage customers to standardize on its platform, including legacy trade-ins and no-cost introductory offers. This is important as Palo Alto has suggested the lifetime value of a customer using two of its solutions is 5x that of a customer using only one. This figure rises to 40x for a customer using all three solutions. This is because platform adoption increases spend and tends to decrease churn.

Palo Alto has achieved approximately 900 platformizations so far, with a target of 2,500-3,500 by FY2030. While this suggests a reasonable degree of success, CrowdStrike remains fairly dismissive of Palo Alto’s approach:

We’re not reclassifying, recounting, or repositioning existing business to concoct perceived platform value. When a platform delivers real value, you don’t have to give it away. – CrowdStrike CEO George Kurtz

Financial Analysis

Palo Alto generated 1.98 billion USD revenue in the third quarter, a 15.3% YoY increase. Service revenue increased 20% driven by subscriptions, while product revenue was fairly flat YoY. Billings growth was weak, although Palo Alto doesn’t believe that billings are a good indicator of the strength of its business. Billings are currently being impacted by customers preferring annual billing plans.

While Palo Alto’s revenue growth is still reasonably healthy, growth has been moderating and there appears to have been a notable drop in revenue quality. Palo Alto is offering a range of incentives, like discounting, trial periods, deferred payment terms and financing to support demand. This can be clearly seen from the company’s financing receivables, which were up 34% sequentially.

Palo Alto expects 2.15-2.17 billion USD revenue in Q1, an increase of 10-11% YoY. NGS ARR is expected to be between 4.05 and 4.10 billion USD, an increase of 37-39%. Palo Alto is targeting 15 billion USD next-gen security ARR by FY2030, implying that growth remains strong in coming years.

The number of job openings mentioning Palo Alto Networks in the job requirements remains soft, which is indicative of the headwinds facing the business at the moment. The number of job openings at Palo Alto also suggests ongoing weakness.

Palo Alto’s margins continue to improve as the business scales, and this has been aided by an end to COVID related supply chain issues. While Palo Alto’s margins are likely to continue improving, it is worth noting that the company’s cash flows are being pressured by the incentives provided to customers. It is also worth noting that Palo Alto’s heavy use of acquisitions means that it has had to invest less in R&D than many peers.

Conclusion

Palo Alto is a strong company, but I tend to think that most of this strength comes from its sales force and existing customer base. Competition is increasing, and some of Palo Alto’s competitors have compelling solutions. While some of Palo Alto’s difficulties are due to the macro environment, I also think that competition is having an impact.

Palo Alto’s stock will probably perform ok longer term, but the company’s high valuation and weak performance creates a risky setup in the short run. There will likely need to be a catalyst to cause the share price to drop, though.

Palo Alto’s share price appears to be more the result of flows than fundamentals at the moment, with the company being added to the S&P500 in the middle of 2023. This is probably being aided by buybacks, with Palo Alto repurchasing 500 million USD of stock in the third quarter.