Palo Alto Networks, which sells firewalls and a widening stack of subscription security services to large enterprises and governments, closed its purchase of CyberArk in February for $21.1bn — the biggest deal in its history, and one aimed squarely at privileged access and machine identity. Chief executive Nikesh Arora calls the strategy "platformization": persuade a customer to buy six products instead of one. The permanent objection is that this is discounting dressed as strategy — deals pulled forward, revenue booked once, margin surrendered permanently.

The fiscal third-quarter numbers argue otherwise, and the test is not revenue. Revenue of $3.002bn included $388m from CyberArk and Chronosphere, an observability company acquired alongside it, leaving organic growth near 14%. But next-generation security annual recurring revenue reached $8.13bn, up 60%, of which $1.63bn was acquired — roughly 28% organic. Remaining performance obligations, the contracted revenue not yet recognized, grew 36% to $18.4bn; net of $1.8bn acquired, about 23%. Obligations running at double the organic revenue rate is what a company looks like when it is signing longer contracts, not cheaper ones. Management said on the earnings call that CyberArk synergy capture is running three to six months ahead of schedule. Reported gross margin fell to 67.6% from 74.2% two quarters earlier, but that is purchase accounting flowing through cost of revenue — the same distortion that makes the 302x trailing price-to-earnings ratio meaningless here.

What actually moved the prices

Almost none of it was Palo Alto. Over the 30 sessions to 19 August the seven largest listed cybersecurity names averaged about +7.7%, but that average is two stocks: Rubrik, which sells backup and recovery software repositioned as ransomware recovery, up 27.8%, and Zscaler, whose cloud gateway replaces corporate network security appliances, up 24.3%. The other five — Cloudflare +7.1%, Palo Alto +3.2%, CrowdStrike +1.1%, Fortinet -4.5%, Okta -4.9% — average +0.4%.

Nor was it drift. Two clusters did the work. On 3-4 August a broad enterprise-software bid ignited by Palantir's results lifted the entire group. Then on 10 August, after the Black Hat conference, CrowdStrike and Palo Alto hit record highs as BTIG told clients that AI agents had "fundamentally changed the threat landscape," citing a 2.5-fold rise in agent-triggered detection leads. All seven names peaked on 13 August. In the four sessions since they have given back 7.8% on average against a 1% decline in the S&P 500, as money moved back toward AI hardware — the software-and-services index fell 2.8% on 17 August while the semiconductor index rose 1.6%.

Three billing models, three different answers

Cloudflare is not really a security vendor. It runs a global edge network — 335-plus points of presence interconnecting with roughly 13,000 carriers — and bills by consumption, selling firewalls and Zero Trust access alongside content delivery and its Workers developer platform. Its growth is accelerating: second-quarter revenue of $696.1m, up 36%, after 33.5% and 33.6% in the prior two quarters. Dollar-based net retention reached 120%, six points better than a year ago; customers spending above $100,000 rose 27% to 4,698. Non-GAAP gross margin ticked up to 73.1%, its first sequential gain in eight quarters, while capitalized network spending runs at a guided 14-15% of revenue. Matthew Prince told investors more than half of network traffic is now AI agents rather than humans — for a company billing by the request, that is added units, not lost seats.

Okta is the mirror image. It sells single sign-on and identity governance priced per user, which is precisely the unit that AI-driven headcount restraint erodes. Revenue growth has slowed for four straight quarters, to 11.2%, and management guided the quarter reporting after the close on 26 August to $790-794m, about 9%. Current remaining performance obligations grew 12% last quarter and net retention has stabilized at 107%, but margins, not growth, are doing the work: operating margin reached 7.3%. Its biggest threat is Microsoft's Entra ID, bundled into enterprise Office subscriptions at roughly $6-9 per user a month — and Palo Alto now owns CyberArk's machine-identity depth.

Among the rest, CrowdStrike, the endpoint-detection platform, reports the same evening as Okta and fell 5.3% on 19 August into it; Fortinet, the appliance-led firewall vendor serving mid-market buyers, is the only name down over the month; Zscaler and Rubrik are diverging upward on momentum rather than on any disclosed change in their contracted backlog.

The price of being right

Every one of these businesses is more expensive than in the spring, measured against gross profit — the fairest lens when Cloudflare is loss-making and Palo Alto's earnings are wrecked by acquisition accounting. Palo Alto has gone from 20.2x trailing gross profit on 3 May to 38.4x, a near-doubling in fifteen weeks, and sits at 29.5x forward. Cloudflare moved from 45.4x to 56.8x, or 49.8x forward against consensus revenue growth near 29% in 2027. Okta went from 6.0x to 10.1x while its growth rate fell — the widest gap between business and price of the three. Cloudflare's shares have held an uptrend since 5 May, roughly 71 sessions with the 50-day average above the 200-day; CrowdStrike's turned decisively down on 6 August. The group is not moving as one.

The setup

Where it stands — Palo Alto's obligations are outgrowing its organic revenue by nine points, but its multiple of gross profit has nearly doubled since May. Would confirm — Fiscal fourth-quarter next-generation security ARR landing at or above the guided $8.90-8.95bn on 1 September. Would invalidate — Full-year remaining performance obligation guidance of $20.9-21.0bn cut, or organic ARR growth slipping below the mid-20s. Watch next — Okta and CrowdStrike both report after the close on 26 August; Palo Alto follows on 1 September. Valuation — Palo Alto at 38.4x trailing and 29.5x forward gross profit, against 20.2x on 3 May.