Palo Alto Networks's platform leap only works if NGS can outgrow firewall drag—its latest ARR + RPO trajectory says “maybe,” but the attach-rate story is still the missing piece

CrowdStrike and Okta’s recent repricing put a clear investor bet on the table: AI makes threats move faster, so customers pay more for security that can “keep up,” regardless of whether it’s a point product. PANW’s playbook is different: consolidate onto its Unified Security Platform and then scale Next-Generation Security (NGS) attachments over time.

The hard part is that PANW’s earnings disclosures (at least in the primary release pages reviewed here) provide strong NGS ARR and RPO trajectory, but they do not directly quantify the specific “NGS attach” mechanism versus firewall-cycle carryover that your question hinges on. That means the platform thesis looks directionally supported by backlog and ARR growth—while the key micro-relationship (attach speed vs. firewall drag) remains not disclosed in the primary chunks opened.

Across PANW’s fiscal Q2 and Q3 releases, the company repeatedly ties its platform motion to AI-era “platformizations,” while the numerical output to watch is NGS ARR (what customers committed to) and RPO (what’s yet to be recognized as revenue). If consolidation were merely shifting spend at the margin, you’d expect ARR growth to plateau and RPO to flatten; instead, the disclosures point to continued upward pressure.

However, your specific comparison—whether PANW can grow at the rates point-tool vendors just received—requires that the platform attach rate be durable. In the primary release content reviewed here, the attach-rate mechanics versus firewall carryover are not broken out as a single metric.

Investors reading your question will want an operational “yes/no” on whether platform consolidation can outgrow point-tool growth. A clean way to proxy for attach durability is to ask: is the company growing the committed backlog in NGS (RPO) faster than it’s just carrying forward legacy firewall commitments?

From the disclosures opened here, PANW’s RPO grew +23% YoY in Q2 FY2026 to $16.0B, and then +36% YoY in Q3 FY2026 to $18.4B. That pattern is consistent with more-than-mix-driven demand, because RPO is the company’s future revenue recognition pipeline, not just current-period revenue. Still, because the release pages reviewed here did not expose “firewall drag” metrics or NGS attach rate, the test is necessarily indirect.

Your angle calls out Microsoft’s “agentic tollbooth” concern: if enterprise security becomes more integrated into agentic workflows, the distribution channel and packaging power shift toward hyperscalers and workflow platforms. The Microsoft content opened here focused on the agentic SOC operating model and not on specific, attributable pricing/packaging changes that would directly validate a tollbooth mechanism for PANW’s bundling economics.

So the correct investor stance from the evidence gathered so far is: Microsoft agentic security is directionally a consolidation tailwind (it pressures tool sprawl), but the specific claim that it reduces PANW platform pricing power cannot be evidenced from the primary Microsoft page opened here.

The investor question isn’t whether NGS ARR and RPO are growing; the primary question is whether that growth translates into a stable operating and net earnings trajectory that justifies the platform premium. In the financial statements pulled for PANW, FY2025 shows $9.22B revenue with $1.13B net income, while FY2026 shows revenue of $4.81B and a net loss of about $0.16B on the income statement dataset used.

Because the NGS numbers come from quarterly earnings releases and the profitability figures come from financial statement datasets, this section should be read as a directional constraint: growth needs to convert into earnings durability, not only ARR.