PANW 10-K & 10-Q changes, risk factors and insider trading

•Our business and operations have experienced growth in recent periods, and if we do not effectively manage anyour future growth or are unable to improve our systems, processes, and controls, our business and operating results could be adversely affected.

•Our operating results may vary significantly from period to period, including due to seasonality, which makes our results difficult to predict and could cause our results to fall short of expectations, and such results may not be indicative of future performance.expectations.

•If we are unable to sell new and additional product,products, subscription,subscriptions, and support offerings to ourexisting end-customers,end-customers or attract new customers, especially to large enterprise customers, our future revenue and operating results will be harmed.

•We rely on our channel partners to sell substantiallya allsubstantial portion of our products, including subscriptions and support, and if these channel partners fail to perform, our ability to sell and distribute our products and subscriptions will be limited and our operating results will be harmed.

•We face intense competition in our market and we may lack sufficient financial or other resources to maintain or improve our competitive position.

•We have acquired and may in the future acquire other businesses (including CyberArk),businesses, which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

•As a result of the CyberArk acquisition, we anticipate that the scope and size of our business willhave substantially changechanged, andwhich resultresulted in certain incremental risks, including increased competition.

•Issues in the developmentdevelopment, anddeployment, deploymentor use of AI may result in reputational harm andharm, legal liabilityliability, and could adversely affect our resultsbusiness ofand operations.operating results.

•A significant network or data security incident may allowmaterially unauthorized access to our network or data, harmimpact our reputation, createfinancial additional liability,condition, and adversely impact our financialoperating results.

•Because weWe depend on manufacturing partners to build and shiplimited sources of supply for our hardware products, wemaking areus susceptible to manufacturing anddelays, logisticssupply delaysshortages, pricing fluctuations, and pricinginternational fluctuationstrade risks that could prevent ustimely fromshipment shippingof customer orders on time, if at all, or on a cost-effective basis, which mayand result in the loss of sales and end-customers.

•We generate a significant amount of revenue from sales to distributors, resellers, and end-customers outside of the United States, and we are therefore subject to a number of risks associated with international sales and operations.operations, including export and import controls that could subject us to liability or impair our ability to compete in international markets.

•We may incur increasedsignificant costs to comply with privacy and data protection laws and other requirements, and, if we fail to comply, we could be subject to government enforcement actions, private litigationlitigation, and adverse publicity.publicity, which could materially adversely affect our business, financial condition, and operating results.

•If ourOur estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that may change or prove to be incorrect,incorrect and, as a result, our operating results may differ from our publicly announced guidance or the expectations of securities analysts and investors, resultingwhich may result in a decline in the market price of our common stock.

•The issuance of additional common stock in connection with financings, acquisitions, investments, our stock incentive plans, exerciseconvertible of the 2025 Warrants,notes, or otherwise will dilute the stock held by all other stockholders.

We operate globally, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. The instabilityInstability in the global credit markets, inflation, changes in public policiespolicies, suchchanges asin domestic and international legislation or regulations, changes in enforcement and administration policies, taxes, any increases in interest rates, fluctuations in foreign currency exchange rates,rate orfluctuations, trade regulations and tariffs, international trade agreements, international trade disputes, trade regulations, tariffsdisputes and agreements, changes in tariffs,tax laws, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions. Military actions or armed conflict, including the hostilities in Israel and the surrounding region, the Russia-Ukraine war and any related political or economic responses and counter-responses,responses, and uncertainty about, or changes in, government and trade relationships, policies, and treatiesrelationships could alsofurther lead to worseningworsen economic and market conditions and the geopolitical environment. InFor example, in response to Russia’s invasion of Ukraine, the United States, along with the European Union (the “E.U.”), has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens (“Sanctions on Russia”).citizens. We are subject to these governmental sanctions and export controls, which may subject us to liability if we are not in full compliance with applicable laws. In addition, government-mandated restrictions on technology access, including export controls, import restrictions, or requirements that certain technologies not be made available in particular countries or regions, could limit our ability to sell or support our products and subscriptions in affected markets, require us to modify or discontinue certain products or features, or require us to exit certain markets. Any continued or further uncertainty, weaknessuncertainty or deterioration in economic and market conditions or the geopolitical environmentenvironment, or any expansion or imposition of government-mandated technology restrictions, could have a material and adverse impact on our business, financial condition, and resultsoperating of operations,results, including reductions in sales of our products and subscriptions,sales, longer sales cycles, reductions in subscription or contract duration and value, slower adoption of new technologies, alterationschanges in the spending patterns or priorities of current and prospective customers (including delaying purchasing decisions),customers, increased costscomponent, formemory theor chipscompute and components to manufacture our products,costs, and increased price competition.

Our business and operations have experienced growth in recent periods, and if we do not effectively manage anyour future growth or are unable to improve our systems, processes, and controls, our business and operating results could be adversely affected.

We have experienced growth and increased demand for our products and subscriptions over the last fewrecent years. As a result, our employee headcount has increased, and we expect it to continue to grow over the next year. For example, from the end of fiscal 20242025 to the end of fiscal 2025,2026, our headcount increased from 15,28916,068 to 16,06821,921 employees.employees, including approximately 4,223 additional headcount as a result of the CyberArk acquisition. In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers. The growth and expansion of our business and product,products, subscription,subscriptions, and support offerings places a significant strain on our management, operational, and financial resources. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

We may not be able to successfully implement, scale, or manage improvements to our systems, processes, and controls in an efficient or timely manner, which could result in material disruptions of our operations and business. In addition, our existing systems, processes, and controls may not prevent or detect all errors, omissions, or fraud. We may also experience difficulties in managing improvements to our systems, processes, and controls, or in connection with third-party software licensed to help us with such improvements. Any future growth would add complexity to our organization and require effective coordination throughout our organization.coordination. Failure to manage any future growth effectively could result in increased costs, disruptdisruption our existingto end-customer relationships, reducereduced demand for or limit us to smaller deployments of our products, or materiallymaterial harm to our business performance and operating results.

In addition, we have incurred losses in fiscal years prior to fiscal 2023. We anticipate that our operating expenses will continue to increase in the foreseeable future as we continue to grow our business.business grows. Our growth efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenues sufficiently, or at all,sufficiently to offset increasing expenses. Revenue growth may slow or revenue may decline for a number of possible reasons,decline, including due to slowing demand for our products or subscriptions,declining demand, increasing competition, amarket decrease in the growth of, or a demand shift in, our overall market,shifts, or a failure to capitalize on growth opportunities. We have also entered into a substantial amount of capital commitments for operating lease obligations and other purchase commitments. Any failure to increase our revenue as we grow our business could prevent us from maintaining profitability or maintaining or increasing cash flow on a consistent basis, or satisfying our capital commitments. If we are unable to navigateincrease our revenue sufficiently to offset these challengescosts asand we encounter them,commitments, our business,profitability, cash flow, financial condition, and operating results may suffer.

Our operating results may vary significantly from period to period, including due to seasonality, which makes our results difficult to predict and could cause our results to fall short of expectations, and such results may not be indicative of future performance.expectations.

Our operating results have fluctuated in the past, and will likely continue to fluctuate in the future, as a result of a number of factors, many of which are outside of our control and may be difficult to predict,control, including those factors described in this Risk FactorFactors section. For example, we have historically received a substantial portion of sales orders and generated a substantial portion of revenue during the last few weeks of each fiscal quarter. If expected revenue at the end of any fiscal quarter is delayed for any reason, including thefailed purchase orders, logistics delays, inventory management issues, trade compliance requirements (and changes to such requirements), or failure of anticipated purchase orders to materialize (particularly for large enterprise end-customers with lengthy sales cycles), our logistics partners’ inability to ship products prior to fiscal quarter-end to fulfill purchase orders received near the end of a fiscal quarter, our failure to manage inventory to meet demand, any failure of our systems related to order review and processing, or any delays in shipments based on trade compliance requirements (including new compliance requirements imposed by new or renegotiated trade agreements), our revenue could fall below our expectations and the estimates of analysts for that quarter. In addition, seasonal factors may cause our second and fourth fiscal quarters to record greater revenue sequentially than our first and third fiscal quarters, driven primarily by end-customer budget cycles, our annual sales compensation structure, and the timing of calendar-year budget planning. As we grow, these seasonal and cyclical variations may become more pronounced. Due to these fluctuations, comparing our revenue, margins, or other operating results on a period-to-period basis may not be meaningful, and our past results should not be relied on as an indication of our future performance.

If we are unable to sell new and additional product,products, subscription,subscriptions, and support offerings to ourexisting end-customers,end-customers or attract new customers, especially to large enterprise customers, our future revenue and operating results will be harmed.

Our future success depends, in part, on our ability to expand the deployment of our portfolio and new offerings with existing end-customers, especially large enterprise customers, including through our platformization strategy,and go-to-market strategies, and createto demand for ourattract new offerings.customers. The rate at which ourexisting end-customers purchase additional products, subscriptions, and support dependsofferings, and our ability to win new customers, depend on a number of factors, including the perceived need for additional security products, including related subscription and support offerings, general economic conditions, switching costs from incumbent vendors, and the time and resources required to deploy our solutions. We are engaging in costly marketing and sales efforts to accelerate our strategies, including platformization, which may not be as wellsuccessful as intended. Any deterioration in general economic conditions.conditions, including as a result of the geopolitical or economic environment, may cause current and prospective customers to delay or cut their overall security and IT spending. If our efforts to sell additional products and subscriptions to ourexisting end-customers or attract new customers are not successful, our revenues may grow more slowly than expected or decline.

Sales to large enterprise end-customers, which is part of our growth strategy,end-customers involve risks that may not be present, or that aretypically present to a lesser extent, with sales to smaller entities, such as (a)including longer sales cycles andcycles, the associated risk that substantial time and resources may be spent on a potential end-customer that electsdoes not toultimately purchase our products, subscriptions, and support,support offerings, and (b) increased purchasing power and leverage held by large end-customers in negotiating contractual arrangements. Deployments for large enterprise end-customers are also more complex, require greater product functionality,functionality and scalability, and a broader range of services, and are more time-consuming and resource-consuming. All of these factors add further risk to business conducted with these end-customers.resource-intensive. Failure to realize sales from large enterprise end-customers could materially and adversely affect our business, operatingfinancial results,condition, and financialoperating condition.results.

Subscription and support revenue accounts for a significant portion of our revenue, comprising 80.5%80% of total revenue in fiscal 2025,2026, 80.0% of total revenue81% in fiscal 2024,2025, and 77.1% of total revenue80% in fiscal 2023.2024. Sales and renewals of subscription and support contracts may decline and fluctuate as a result of a number of factors, including end-customers’ level ofend-customer satisfaction levels with our products and subscriptions, the frequency and severity of subscription outages, our product uptime or latency, the prices of our products and subscriptions,pricing, and reductions in our end-customers’ spending levels. Existing end-customers have no contractual obligation to, and may not,to renew their subscription and support contracts after the completion of their initial contract period.period Additionally, our end-customersand may renew their subscription and support agreements for shorter contract lengthsterms or on other terms that are less economically beneficial to us.us, or not at all. If our sales of new or renewal subscription and support contracts decline, our total revenue and revenue growth rate may decline,decline. and our business will suffer. In addition, becauseBecause we recognize subscription and support revenue over the term of the relevant service period, which isperiod typically one to five years, a decline in subscription or support contracts in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscalquarter’s quarterrevenue but will negatively affect our revenue in future fiscal quarters.

•Results of Operations. A discussion of the nature and trends in our financial results and an analysis of our financial results comparing fiscal 20252026 to fiscal 2024.2025. For discussion and analysis related to our financial results comparing fiscal 20242025 to 2023,2024, refer to Part II, Item 7.7 Management’s Discussion and Analysis of Financial Condition and Results of Operations in our Annual Report on Form 10-K for fiscal 2024,2025, which was filed with the Securities and Exchange Commission on SeptemberAugust 6,29, 2024.2025.

Our mission is to be the cybersecurity partner of choicechoice, for enterprises, organizations, service providers, and government entities to protectprotecting our digital way of life. Our cybersecurity platforms and services help secure enterprise users, networks, clouds, endpoints, AI apps and endpointsagents, and identities by delivering comprehensive cybersecurity backed by artificial intelligence (“AI”) and automation.automation, and provide real-time visibility and monitoring across cloud infrastructure, applications and AI workloads. A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products. We execute on this strategy by developing our capabilities and packaging our offerings into platformsplatforms, which are able to cover many of our customers’ needs in the markets in which we operate. Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster, and cost-effective outcomes.

Network & AI Security

Our networkNetwork security& AI Security platform is designed to deliver complete zero trust solutions to our customers. The platform includes:

•Secure Access Service Edge (“SASE”).Edge. Prisma® Access, when combined with Prisma SD-WAN, provides a comprehensive single-vendorAI-powered SASE offeringsolution that issecures usedusers, tobranches, securedata, remoteAI workforcesapps and cloud-deliveredagents branchfrom offices.the most evasive threats in the new AI landscape. Our Prisma Access Browser™ further extends SASEzero-trust security and data protection to the endbrowser, userwhere device,the majority of work is done today, providing workersusers with the freedom to access business applicationswork securely using our secure browser from any device.

•Next-Generation Firewalls. Our hardware ML-Powered Next-Generation Firewalls (“NGFWs”) secure on-premises environments including campus locations and data centers. Our software NGFWs secure virtual and cloud networks.

•Cloud-Delivered Security Services (“CDSS”).Services. Our network security platform integrates a suite of CDSSPrecision AI powered security capabilities that complements our SASE and FirewallNGFW solutions. These include Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, Advanced DNS Security, IoT/OTDevice Security, Quantum Security, NGTS, GlobalProtect®, Prisma Access Agent, Enterprise DataDLP, Loss Prevention (“Enterprise DLP”), AI for IT Operations (“AIOps”), Software as a Service (“SaaS”) Security, and AI Access Security.Security™. Through these add-on services, our customers are able to secure their content, applications, users, devices, and devicesconnection across their entire organization.

Our AI-powered Cortex® platform transforms end-to-end security operations and observability with unified data, AI, and automation for more secure, faster, and cost effective outcomes. We have consolidated our industry-leading Security Operations and Cloud Security capabilities on a single comprehensive platform to provide centralized visibility, proactive protection, real-time prevention, AI-driven insights, and automated remediation across enterprise and cloud.

•Security Operations. We deliver the next generation of security operations capabilities that unifies standalone Security Information and Event Management (“SIEM”) tools, endpoint security, security automation, cloud detection and response (“CDR”),CDR, as well as attack surface management (“ASM”) capabilities on our Cortex® platform. These include Cortex XSIAM®, for AI-powered security operations replacing traditional SIEM tools,tools; Cortex XDR®, for the prevention, detection, and response to complex cybersecurity attacks,attacks; Cortex XSOAR®, for security orchestration, automation, and response (“SOAR”), and; Cortex Xpanse®, for ASM.ASM; and Koi Agentic Endpoint Security. Additionally, Cortex XSIAM integrates with the Chronosphere Telemetry Pipeline to ingest and optimize massive data volumes, promoting cost-effective scaling of autonomous operations.

•Cloud Security. We deliver comprehensive security across the cloud application development lifecycle through Cortex Cloud,Cloud®, delivered as a scalable SaaS offering. As a comprehensive Cloud Native Application Protection Platform (“CNAPP”) combined with CDR, Cortex Cloud secures multi- and hybrid-cloud environments for applications, data, generative AI (“GenAI”) ecosystem, and the cloud native technology stack across the full development lifecycle, from code to cloud to security operations. As part of the Cortex Cloud platform, customers can expand from Cortex Cloud to our security operations offerings available on a single user experience and unified agent. We also offer our VM-Series and CN-Series virtual firewalls for inline network security on multi- and hybrid-cloud environments.

•Unit 42® brings together world-renowned expertise across threat research, incident response, and security consulting to deliver intelligence-driven, response-ready outcomes that help customers reduce cyber risk. Our elite consultants serve as trusted advisors to our customers by assessing and testing their security controls against sophisticated threats, including Frontier AI, transforming their security strategy with a threat-informed approach, and responding to security incidents on behalf of our clients. Additionally, Unit 42 offers managed detection and response (“MDR”) and managed threat hunting services. In April 2026, we launched a new suite of Unit 42 Frontier AI Defense services to help customers proactively discover and neutralize threats introduced by next-generation AI models.

For fiscal 20252026 and 2024,2025, total revenue was $9.2$11.5 billion and $8.0$9.2 billion, respectively, representing year-over-year growth of 14.9%.24%. Our growth reflects the increased adoption of our portfolio, which consists of product, subscriptions, and support.support, and the contributions from our acquisitions in our current fiscal year. We believe our portfolio will enable us to benefit from recurring revenues and new revenues as we continue to grow our end-customer base. As of July 31, 2025,2026, we had end-customers in over 180 countries. Our end-customers represent a broad range of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications, and include almost all of the Fortune 100 companies and a majority of the Global 2000 companies. We maintain a field sales force that works closely with our channel partners in developing sales opportunities. We primarily use a two-tiered, indirect fulfillment model whereby we sell our products, subscriptions, and support to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers.

Our product revenue grew to $1.8$2.3 billionbillion, or 19.5%19.9% of total revenue for fiscal 2025,2026, representing year-over-year growth of 12.4%.27%. Product revenue is derived from sales of hardware products, primarily our ML-Powered Next-Generation Firewall,NGFW, and software licenses, including SD-WAN, the VM-Series, and Panorama®. In connection with the acquisition of CyberArk in February 2026, our product revenue also includes on-premise software licenses of certain identity security offerings. Our ML-Powered Next-Generation FirewallNGFW incorporates our PAN-OS® operating system, which provides a consistent set of capabilities across our entire network security product line. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. Our products are designed for different performance requirements throughout an organization, ranging from our PA-400, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7500, which is designed for large-scale data centers and service provider use. The same firewall functionality that is delivered in our hardware products is also available in our VM-Series virtual firewalls, which secure virtualized and cloud-based computing environments, and in our CN-Series container firewalls, which secure container environments and traffic.

Our subscription and support revenue grew to $7.4$9.2 billionbillion, or 80.5%80.1% of total revenue for fiscal 2025,2026, representing year-over-year growth of 15.5%.24%. Our subscriptions provide our end-customers with near real-time access to the latest intrusion prevention, web security, modern malware prevention, data loss prevention, CASBcloud security access broker, and AI security capabilities across the network, endpoints, and the cloud. Our subscriptions also include security operations, which enable customers to leverage the AI-powered Cortex platform for advanced capabilities such as security information and event management, next-generation antivirus, endpoint detection and response, extended detection and response, identity threat detection and response, cloud detection and response, SOAR, ASM, and CNAPP for comprehensive cloud security. In connection with our acquisition of Chronosphere in January 2026, our subscriptions also include a next-generation observability platform for cloud-native infrastructure and applications as well as telemetry pipeline management that is designed to handle vast cloud data volumes with cost-efficiency and reliability. With the acquisition of CyberArk, our subscriptions include a next-generation identity security platform designed to secure human, AI, and machine identity across the enterprise with intelligent privilege controls and continuous threat prevention. Additionally, we offer MDR for Cortex subscriptions, powered by Unit 42’s elite expertise. When customers purchase our physical, virtual, or container firewalls, or certain cloud offerings, they typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs. In addition to the subscriptions purchased with these firewalls, customers may also purchase other subscriptions on a per-user, per-endpoint, or capacity-based basis. We also offer professional services, including incident response, risk management, and digital forensic services.services, and technical account management.

We continue to invest in innovation as we evolve and further extend the capabilities of our portfolio, as we believe that innovation and timely development ofof, and investment in, new features and products are essential to meeting the needs of our end-customers and improving our competitive position. During fiscal 2025,2026, we introduced several upgrades and new offerings, including: PAN-OS 12.1 Orion, Prisma AccessAIRS Browser,2.0, newNGTS, capabilitiesand Prisma AIRS 3.0. Additionally, we evaluate opportunities to acquire complementary businesses, technologies, services, and intellectual property to complement our organic innovation and research and development efforts, advance the development of our platforms, and enable further investment in our OTkey Securitypriority solution,areas. CortexFor Cloud,example, Prismaon AIRS,January and29, Cortex XSIAM 3.0. Additionally, in August 2024,2026, we completed the acquisition of certainChronosphere, IBM QRadar assets, which we expect will help accelerate the growth offorming our Cortexobservability business.platform; Additionally,on inFebruary July11, 2025,2026, we completed the acquisition of ProtectCyberArk, AI,forming our next-generation identity security platform; on April 14, 2026, we completed the acquisition of Koi, adding agentic endpoint security capabilities to our security operations platform and enhancing Prisma AIRS; on May 29, 2026, we completed the acquisition of Portkey, enhancing our Prisma AIRS capabilities; on August 27, 2026, we completed the acquisition of Embrace, which we expect will enhanceadd RUM capabilities to our observability platform; and on September 1, 2026, we completed the capabilitiesacquisition of Console, which we expect will deepen our agentic capabilities in Cortex. On July 16, 2026, we announced the general availability of Prisma AIRS Gateway, which incorporates AI securitygateway platform.capabilities Inacquired Julythrough 2025, we also enteredPortkey into aPrisma definitive agreement to acquire Software Ltd. (“CyberArk”), an identity security company, which acquisition is expected to close during the second half of our fiscal 2026.AIRS.

Our overall performance depends in part on worldwide economic and geopolitical conditions and their impact on customer behavior. Changes in legislation or regulations and actions by regulators, including changes in enforcement and administration policies, may have an impact on our resultsfinancial of operationscondition and financialoperating condition.results. Significant changes in U.S. or global trade policy, including further expansion of U.S. export/imports controls and tariffs, as well as retaliatory actions by other countries, may materially and adversely affect our business. Further, economic conditions, including inflation, high interest rates, slow growth, fluctuations in foreign exchange rates, supply chain disruptions, including increased memory, storage, or other component shortages and costs, impacts of trade regulations or international trade disputes, and other conditions, may materially and adversely affect our resultsfinancial of operationscondition and financialoperating performance.results.

The hostilities in IsraelIsrael, Iran, and the surrounding region have continued to result in economic and political uncertainty. While we have business operations in Israel, and intend to continue growing our presence in Israel, we currently do not expect significant business disruption. We are actively monitoring, evaluating, and responding to the situation.

We are also monitoring the impact of inflationary pressures and the tensions between China and Taiwan, and between the U.S. and China, which have increased our costs and could have an adverse impact on our business or results of operations in future periods.

•Next-Generation Security Annualized Recurring Revenue (“NGS ARR”). Our NGS ARR represents the annualized allocated revenue of all active contracts as of the final day of the reporting period related to all product, subscriptionsubscription, and support offerings, excluding revenue from hardware products, and legacy attached subscriptions, support offeringsofferings, and professional services. NGS ARR is an operating metric that we use to assess the strength and trajectory of our business. NGS ARR should be viewed independently of revenue, deferred revenuerevenue, and remaining performance obligations and does not represent our revenue under U.S. GAAP on an annualized basis, as it is an operating metric that can be impacted by contract start and end dates and renewal rates. NGS ARR is not intended to be a replacement for forecasts of revenue. The scope of products, subscriptions, and support offerings that contribute to NGS ARR will generally increase over time as we introduce or acquire new next-generation products, subscriptions, and support offerings.

•Net Cash Flow Provided by Operating Activities. We monitor net cash flow provided by operating activities as a measure of our overall business performance. Our net cash flow provided by operating activities is driven in large part by sales of our products and from up-front payments for subscription and support offerings. Monitoring net cash flow provided by operating activities enables us to analyze our financial performance without the non-cash effects of certain items such as share-based compensation costs, depreciation, and amortization, thereby allowing us to better understand and manage the cash needs of our business.

•Free Cash Flow (non-GAAP). We define free cash flow, a non-GAAP financial measure, as net cash provided by operating activities less purchases of property, equipment, and other assets. We consider free cash flow to be an operating metric as well as a profitability and liquidity measure that provides useful information to management and investors about the amount of cash generated by the business after necessary capital expenditures. A limitation of the utility of free cash flow as a measure of our financial performance and liquidity is that it does not represent the total increase or decrease in our cash balance for the period. In addition, it is important to note that other companies, including companies in our industry, may not use free cash flow, may calculate free cash flow in a different manner than we do, or may use other financial measures to evaluate their performance,liquidity, all of which could reduce the usefulness of free cash flow as a comparative measure. A reconciliation of free cash flow to net cash flow provided by operating activities, the most directly comparable financial measure calculated and presented in accordance with U.S. GAAP, is provided below:

Our revenue consists of product revenue and subscription and support revenue. Revenue is recognized upon transfer of control of the corresponding promised products and subscriptions and support to our customers in an amount that reflects the consideration we expect to be entitled to in exchange for those products and subscriptions and support. We expect our revenue to vary from quarter to quarter based on seasonal and cyclical factors.factors and business acquisitions.

Product revenue is derived from sales of hardware products, primarily our ML-Powered Next-Generation Firewall, andNGFW, software licenses, including SD-WAN, theVM-Series, VM-Series,Panorama, and Panorama.certain identity security offerings. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. We recognize product revenue at the time of hardware shipment or delivery of software license. As a percentage of product revenue, we expect our revenue from software licenses to vary from quarter to quarter and increase over the long term as we improve features and capabilities of our on-premise software, renew our software license contracts, and expand our installed end-customer base.

Product revenue increased for fiscal 20252026 compared to fiscal 20242025 driven by anincreased increaserevenue in price of, and allocation to, on-premisefrom software licenseslicenses, dueincluding tofrom enhancedour featuresCyberArk acquisition, and capabilities beginning in the second quarter of fiscal 2025, and an increased demand for our new generation of hardware products and accessories, partially offset by decreased demand for our prior generation of hardware products.

Subscription and support revenue increased for fiscal 20252026 compared to fiscal 20242025 due to increased demand for our subscription and support offerings from our end-customers.end-customers, including from our CyberArk and Chronosphere acquisitions. The mix between subscription revenue and support revenue will fluctuate over time, depending on the introduction of new subscription offerings, renewals of support services, and our ability to increase sales to new and existing end-customers.

Cost of product revenue primarily includes costs paid to our manufacturing partners for procuring components and manufacturing our products. Our cost of product revenue also includes personnel costs, which consist of salaries, benefits, bonuses, share-based compensation, and travel associated with our operations organization, inventory excess and obsolete charges, shipping and tariff costs, amortization of intellectualintangible property licenses,assets, product testing costs, and shared costs. Shared costs consist of certain facilities, depreciation, benefits, recruiting, and information technology costs that we allocate based on headcount. We expect our cost of product revenue to fluctuate with our revenue from hardware products.

Cost of subscription and support revenue includes personnel costs for our global customer support and technical operations organizations, data center and cloud hosting service costs, third-party professional services costs, amortization of acquired intangible assets and capitalized software development costs, customer support and repair costs, and shared costs. We expect our cost of subscription and support revenue to increase as our installed end-customer base grows and adoption of our cloud-based subscription offerings increases.

Cost of subscription and support revenue increased for fiscal 20252026 compared to fiscal 20242025, primarily due to increasedhigher cloud hosting costs to support the growth of our subscriptioncloud-based offerings, amortization of intangible assets from acquisitions in fiscal 2026, and support offerings. Cloud hosting service costs, which support our cloud-based subscription offerings, increased $189.5 million for fiscal 2025 compared to fiscal 2024. Personnelpersonnel costs grew $52.9 million for fiscal 2025 compared to fiscal 2024, primarily due to headcount growth. The increase in cost of subscription and support revenue was further driven by increasedheadcount professionalgrowth, servicesincluding expense.from our acquisitions.

Gross margin has been and will continue to be affected by a variety of factors, including the introduction of new products, manufacturing costs, the average sales price of our products, cloud hosting service costs, personnel costs, the mix of products sold, and the mix of revenue between product and subscription and support offerings. Our higher-end firewall products generally have higher gross margins than our lower-end firewall products within each product series. We expect our gross margins to vary over time depending on the factors described above.

Subscription and supportProduct gross margin decreased for fiscal 20252026 compared to fiscal 20242025 primarily due to ana increasedecrease in costsgross relatedmargin toon our cloud-basedhardware offerings,products, including the impact from supply chain challenges, and higher amortization of intangible assets, partially offset by increasedan leverageincrease ofin software license revenue from our globalCyberArk customeracquisition serviceand organization.decrease in inventory excess and obsolete charges.

Research and development expense consists primarily of personnel costs. Research and development expense also includes prototype-relatedcloud expenseshosting and shared costs. We expect research and development expense to increase in absolute dollars as we continue to invest in our future products and services, although our research and development expense may fluctuate as a percentage of total revenue.

Research and development expense increased for fiscal 20252026 compared to fiscal 20242025 primarily due to increased personnel costs, which grewincreased $123.4by $429 million for fiscal 20252026 compared to fiscal 2024,2025, largely due to headcount growth.growth, Theincluding increasefrom inour research and development expense was further driven by increased shared costs.acquisitions.

Sales and marketing expense consists primarily of personnel costs, including commission expense. Sales and marketing expense also includes costs for market development programs, promotional and other marketing costs, professional services, amortization of intangible assets, and shared costs. We continue to strategically invest in headcount and have grown our sales presence. We expect sales and marketing expense to continue to increase in absolute dollars as we increase the size of our sales and marketing organizations to grow our customer base, increase touch points with end-customers, and expand our global presence, although our sales and marketing expense may fluctuate as a percentage of total revenue.

Sales and marketing expense increased for fiscal 20252026 compared to fiscal 20242025 primarily due to increased personnel costs, which grewincreased $263.6by $584 million for fiscal 20252026 compared to fiscal 2024,2025, largely due to headcount growth.growth, including from our acquisitions. The increase was further driven by higher amortization of purchased intangible assets as a result of our acquisitions in fiscal 2026.

General and administrative expense consists primarily of personnel costs and shared costs for our executive, finance, human resources, information technology, and legal organizations, and professional services costs, which consist primarily of legal, auditing, accounting, and other consulting costs. General and administrative expense also includes change in fair value of contingent consideration liability. WeExcluding the near-term impact of our acquisitions in our current fiscal year, we expect general and administrative expense to increase in absolute dollars over time as we increase the size of our general and administrative organizations and incur additional costs to support our business growth, although our general and administrative expense may fluctuate as a percentage of total revenue.

General and administrative expensesexpense decreasedincreased for fiscal 20252026 compared to fiscal 20242025 primarily due to litigation-relatedincreased chargespersonnel costs, which grew $253 million for fiscal 2026 compared to fiscal 2025, primarily due to accelerated vesting of $204.4certain millionequity awards in connection with our acquisitions in fiscal 2024year 2026, employee severance charges in connection with our CyberArk acquisition, and aheadcount partialgrowth, release of litigation-related accrual of $38.8 million in fiscal 2025. We also recorded a gain of $135.3 million in fiscal 2025 for the change in fair value of the contingent consideration liabilityincluding from our acquisition of certain IBM QRadar assets.acquisitions. The decreaseincrease in general and administrative expense was partiallyfurther offsetdriven by increasedan personnelincrease costs,in whichacquisition-related grew $153.2 million, largely due to increased share-based compensation.costs.

•Issues in the development anddevelopment, deployment or use of AI may result in reputational harm andharm, legal liability and could adversely affect our business and results of operations.

•We may not have the ability to raise the funds necessary to settle conversions of the CyberArk2030 Notes, repurchase the CyberArk2030 Notes upon a fundamental change, or repay the CyberArk2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the CyberArk2030 Notes.

•The capped call transactionscalls may affect the value of the CyberArk2030 Notes and our common stock.

We have experienced growth and increased demand for our products and subscriptions over recent years. As a result, our employee headcount has increased, and we expect it to continue to grow over the next year. For example, from the end of fiscal 2025 to the end of the secondthird quarter of fiscal 2026, our headcount increased from 16,068 to 17,02721,491 employees.employees, including approximately 4,166 additional headcount as a result of the CyberArk acquisition. In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers. The growth and expansion of our business and product, subscription, and support offerings places a significant strain on our management, operational, and financial resources. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner.

We have experienced revenue growth rates of 15%21% and 14%15% for the sixnine months ended JanuaryApril 31,30, 2026 and 2025, respectively. Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period. If we are unable to maintain consistent or increasing revenue or revenue growth, the market price of our common stock could be volatile, and it may be difficult for us to maintain profitability or maintain or increase cash flow on a consistent basis.

We believe there are significant seasonal factors that may cause our second and fourth fiscal quarters to record greater revenue sequentially than our first and third fiscal quarters. We believe that this seasonality results from a number of factors, including:

Subscription and support revenue accounts for a significant portion of our revenue, comprising 81.3%80.9% of total revenue in the sixnine months ended JanuaryApril 31,30, 2026 and 82.4%81.6% of total revenue in the sixnine months ended JanuaryApril 31,30, 2025. Sales and renewals of subscription and support contracts may decline and fluctuate as a result of a number of factors, including end-customers’ level of satisfaction with our products and subscriptions, the frequency and severity of subscription outages, our product uptime or latency, the prices of our products and subscriptions, and reductions in our end-customers’ spending levels. Existing end-customers have no contractual obligation to, and may not, renew their subscription and support contracts after the completion of their initial contract period. Additionally, our end-customers may renew their subscription and support agreements for shorter contract lengths or on other terms that are less economically beneficial to us. If our sales of new or renewal subscription and support contracts decline, our total revenue and revenue growth rate may decline, and our business will suffer. In addition, because we recognize subscription and support revenue over the term of the relevant service period, which is typically one to five years, a decline in subscription or support contracts in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter but will negatively affect our revenue in future fiscal quarters.

Substantially all of our revenue is generated by sales through our channel partners, including distributors and resellers. For the sixnine months ended JanuaryApril 31,30, 2026, threetwo distributors individually represented 10% or more of our total revenue and in the aggregate represented 42%31% of our total revenue. As of JanuaryApril 31,30, 2026, threetwo distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 46%29% of our gross accounts receivable.

•independent vendors that may offer a mix of security products, such as CheckPoint, Crowdstrike, Delinea, Fortinet, Okta, SailPoint, Wiz, and Zscaler, vendors that may offer a mix of observability products, such as DataDog, Dynatrace, and Elastic, or vendors that may offer a mix of security and observability products;

Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to artificial intelligence (“AI”), partnering, acquisitions or strategic investments by our competitors, or continuing market consolidation. Our competitors and potential competitors may be able to develop new or disruptive technologies, products, or services, and leverage new business models that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do. In addition, new and enhanced technologies, including AI and machine learning, continue to increase our competition.competition, and our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. To compete successfully, we must accurately anticipate technology developments and deliver innovative, relevant, and useful products, services, and technologies in a timely manner. Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to new technologies and end-customer needs. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or product or service offerings.

Issues in the development anddevelopment, deployment or use of AI may result in reputational harm andharm, legal liability and could adversely affect our business and results of operations.

We have incorporated, and are continuing to develop and deploy, AI into many of our products and solutions, including services that support our products and solutions. We are also incorporating AI into the operations of our business. AI presents challengeschallenges, risks, and riskspotentially unintended consequences that could affect our products and solutions, and the operations of our business. For example, AI algorithms may have flaws, and datasets used to train AI models may be insufficient or contain biased information. The AI that is being incorporated into our products, solutions, and business operation tools may not be successful or beneficial, and instead may cause technical, legal or ethical problems or result in increased costs. The investments that we are making across our business in AI reflect our ongoing efforts to innovate and provide products and services that are useful to our customers, as well as provide efficiencies in our business. Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities. These efforts could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U. and laws and regulations being considered in other jurisdictions, or brand or reputational harm.

The rapid evolution of AI, including potential government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations. The rules and regulations adopted by policymakers over time may require us to make changes to our business practices.practices, and our efforts and investments regarding AI could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U. and laws and regulations being considered in other jurisdictions, or brand or reputational harm. Developing, testing, and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis. In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process. Incidences of cyberattacks and other cybersecurity breaches and incidents have increased and are likely to continue to increase. We and our third-party service providers face security threats and attacks from a variety of sources. Despite our efforts and processes to prevent breaches of our internal networks, systems, and websites, our data, corporate systems, and security measures, as well as those of our third-party service providers, are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, or other types of attacks from outside parties, or breaches due to employee error, malfeasance, or some combination of these. In addition, the adoption of AI poses risks. AI can be exploited by malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities, including potentially identifying weaknesses in our systems before we become aware of or can remediate them. We cannot guarantee that the measures we have taken to protect our networks, systems, and websites will provide adequate security. Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks. The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia.

Further, we do not have volume purchase contracts with any of our component suppliers, and they could cease selling to us at any time. If we are unable to obtain a sufficient quantity of these components in a timely manner for any reason, sales of our hardware products could be delayed or halted, or we could be forced to expedite shipment of such components or our hardware products at dramatically increased costs. Our component suppliers also change their selling prices frequently in response to market trends, including industry-wide increases in demand, such as the recent increased demand for memory-related components, which changes could adversely impact our business or results of operations, including by resulting in lower gross margins. For example, there is currently a global shortage of memory-related components, which are a component in certain of our products. Accordingly, there are, and may continue to be, constraints on the availability of memory-related components, which may lead to delays in the production and delivery of certain of our products and increased costs to source available memory chips and other components. Because we do not have, for the most part, volume purchase contracts with our component suppliers, we are susceptible to price fluctuations related to raw materials and components and may not be able to adjust our prices accordingly. Additionally, poor quality in any of the sole-sourced components in our products could result in lost sales or sales opportunities.

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures. As of JanuaryApril 31,30, 2026, the total notional amount of our outstanding foreign currency forward contracts was $1.1$1.2 billion. For more information on our hedging transactions, refer to Note 6. Derivative Instruments in Part I, Item 1 of this Quarterly Report on Form 10-Q. The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

We have business operations in Israel, which meaningfully expanded as a result of the acquisition of CyberArk, and we intend to continue growing our presence in Israel. Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region. The future of peace efforts between Israel and its Arab neighbors remains uncertain. The effects of hostilities and violence on the Israeli economy and our operations in Israel are unclear, and we cannot predict the effect on us of further increases in these hostilities or future armed conflict, political instability, or violence in the region. Current or future tensions and conflicts in the Middle East could adversely affect our business, operating results, financial condition, and cash flows. For example, the recent military conflict involving Iran could escalate in the future and adversely affect our business and operations in Israel.

In addition, the U.K. government enacted the U.K. Data (Use and Access) Act 20252025, enacted on June 19, 2025, which includes changes to the U.K.’s data protection regime that cause it to deviate from the GDPR. This creates new compliance challenges and uncertainty, including with respect to the European Commission’s adequacy determination for the U.K.’s data protection regime.

We are also subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). The CCPA requires, among other things, covered businesses to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security. The effects of the CCPA have been significant, requiring us to modify our data processing practices and policies and to incur substantial costs and expenses for compliance. Moreover, other U.S. states have enacted laws relating to privacy and security that are potentially relevant to us. These include laws enacted in at least 2022 U.S. states, a portion of which are expected to come into effect over the course of our fiscal 2026.states. The U.S. Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern. Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so.

We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards. Additionally, the Federal Trade Commission and many state attorneys general are more regularly bringing enforcement actions in connection with federal and state consumer protection laws for false or deceptive acts or practices in relation to the online collection, use, dissemination, and security of personal data. Internationally, data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country.

New legislation affecting the scope of personal data and personal information where we or our customers and partners have operations, especially relating to classification of Internet Protocol (“IP”) addresses, machine identification, AI and machine learning, location data, and other information, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing or uses of data, and may require significant expenditures and efforts in order to comply. Internationally, data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, which may require us to restructure our cloud infrastructure at significant cost. Notably, public perception of potential privacy, data protection, or information security concerns—whether or not valid—may harm our reputation and inhibit adoption of our products and subscriptions by current and future end-customers. Each of these laws and regulations, and any changes to these laws and regulations, or new laws and regulations, could impose significant limitations, or require changes to our business model or practices or growth strategy, which may increase our compliance expenses and make our business more costly or less efficient to conduct.

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025. In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the “2030 Notes”) and the fair value of the capped calls we acquired in connection with the CyberArk acquisition. If our future tax obligations or effective tax rates increase as a result of these or other factors, it could have an adverse effect on our financial condition and operating results.

There is an increasingevolving and varied focus from regulators, certaininvestors, investors,customers, and other stakeholders concerning corporate responsibility matters, both in the United States and internationally. We communicate certain corporate responsibility-related initiatives, goals, and/or commitments regarding sustainability matters, inclusion, responsible sourcingsourcing, andcommunity social investments,impact, and other matters in our annual Corporate Responsibility Report, on our website, in our filings with the SEC, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement.implement Weand couldwe may fail to achieve, or be perceived to fail to achieve,achieve our corporate responsibility-related initiatives, goals, or commitments.them. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about corporate responsibility matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures. Our actual or perceived failure to achieve our corporate responsibility-related initiatives, goals, or commitments could negatively impact our reputation, result in corporate responsibility-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

In addition, we are or may become subject to various newnew, proposed and proposedevolving sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive. Additional regulation may require us to incur significant additional costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines or litigation, which could negatively impact our business, operating results or financial condition.

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into or exchangeable for shares of our common stock from time to time in connection with a financing or other capital raising, acquisition, investment, our stock incentive plans, the settlement of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes duethe 2030 (the “CyberArk Notes”),Notes, or otherwise. Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

As of JanuaryApril 31,30, 2026, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2026 and may be suspended or discontinued at any time without prior notice. Although our board of directors has authorized a share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares under the program. The share repurchase program could affect the price of our common stock, increase volatility, and diminish our cash reserves. In addition, the program may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

We may not have the ability to raise the funds necessary to settle conversions of the CyberArk2030 Notes, repurchase the CyberArk2030 Notes upon a fundamental change, or repay the CyberArk2030 Notes in cash at their maturity, and our other debt may contain limitations on our ability to pay cash upon conversion or repurchase of the CyberArk2030 Notes.

In connection with the consummation of the CyberArk acquisition, we entered into the Firsta Supplementalsupplemental Indentureindenture (the “Supplemental Indenture”) to the Indenture, dated as of June 10, 2025 (as supplemented by the Supplemental Indenture, the “Indenture”), governing the CyberArk2030 Notes, and in the Supplemental Indenture we agreed to guarantee the CyberArk2030 Notes.

Accordingly, we or CyberArk will need to make cash payments (a) if holders of the CyberArk2030 Notes require CyberArk to repurchase all, or a portion of, the CyberArk2030 Notes upon the occurrence of a fundamental change before the maturity date, (b) upon conversion of the CyberArk2030 Notes, or (c) to repay the CyberArk2030 Notes in cash at their maturity, unless earlier converted or repurchased.

In addition, our ability to repurchase or to pay cash upon conversion of the CyberArk2030 Notes may be limited by law, regulatory authority, or agreements governing our other indebtedness. Our failure to repurchase the CyberArk2030 Notes at a time when the repurchase is required by the indenture governing the CyberArk2030 Notes, or to pay any cash amount due upon their maturity or conversion when required by the Indenture would constitute a default under the Indenture. A default under the Indenture could also lead to a default under agreements governing our other indebtedness. If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to satisfy all amounts due under the other indebtedness and the CyberArk2030 Notes.

The capped call transactionscalls may affect the value of the CyberArk2030 Notes and our common stock.

In connection with the issuance of the CyberArk2030 Notes, CyberArk had previously entered into a number of capped call transactions (each, a “Capped Call”), each with a financial institution (each, together with its affiliates, a “Dealer”). In connection with the CyberArk acquisition, we entered into substantially identical amended and restated letter agreements with respect to the Capped Calls, under which the Capped Calls were assigned to us and now reference our common stock. The Capped Calls are generally expected to reduce the potential dilution to our common stock upon conversion of the CyberArk2030 Notes and/or offset any potential cash payments we are required to make in excess of the principal amount of converted CyberArk2030 Notes, with such reduction and/or offset subject to a cap.

Any Dealer may modify or unwind its hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the CyberArk2030 Notes (and is likely to do so following any conversion of the CyberArk2030 Notes, any repurchase of the CyberArk2030 Notes by us on any fundamental change repurchase date, any redemption date, or any other date on which the CyberArk2030 Notes are retired by us, in each case, if we exercise the relevant election under the Capped Calls and in connection with any negotiated unwind or modification of the Capped Calls). This activity could cause or prevent an increase or a decrease in the market price of our common stock or the CyberArk2030 Notes, which could affect a note holder’s ability to convert its CyberArk2030 Notes and, to the extent the activity occurs during any observation period related to a conversion of the CyberArk2030 Notes, it could affect the amount and value of the consideration that the note holder would receive upon conversion of the CyberArk2030 Notes.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the CyberArk2030 Notes or our common stock. In addition, we do not make any representation that any Dealer has engaged with or will engage in these transactions or that these transactions, if commenced, have not been or will not be discontinued without notice.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q. This Quarterly Report on Form 10-Q, including, without limitation, the following discussion and analysis, contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. Forward-looking statements generally can be identified by words such as “anticipate,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “potentially,” “projects,” “will,” “will be,” “will continue,” “will likely result,” “would” and similar expressions that convey uncertainty of future events or outcomes. These forward-looking statements include, but are not limited to, statements concerning the following: expectations regarding the cybersecurity landscape; expectations regarding our platformization strategy and related progress and opportunities; expectations regarding annual recurring revenue, remaining performance obligations, and product development strategy; expectations regarding artificial intelligence; expectations regarding our strategic partnerships; expectations regarding drivers of and factors affecting growth in our business; statements regarding expected profitability, trends in annual recurring revenue, trends in remaining performance obligations, our mix of product and subscription and support revenue, cost of revenue, gross margin, cash flows, operating expenses, including future share-based compensation expense, income taxes, investment plans, and liquidity; expected recurring revenues resulting from growth in our end-customers and increased adoption of our products and cloud-delivered security solutions; the performance advantages of our products and subscription and support offerings and the potential benefits to our customers; expectations regarding future investments in research and development and product development, customer support, in our employees and in our sales force, including expectations regarding growth in our sales headcount; expectations that we will continue to expand our global presence; expectations regarding our revenues, including the seasonality and cyclicality from quarter to quarter; expectations relating to our customer financing activities; the sufficiency of our cash flow from operations with existing cash, cash equivalents, and investments to meet our cash needs for the foreseeable future; our ability to successfully acquire and integrate companies and assets and expectations and intentions with respect to the assets, products and technologies that we acquire,acquire; expectations regarding the benefits and synergies from our acquisition and integration of companies, assets and technology, including with respect to our acquisition of CyberArk Software Ltd. and our expectations regarding the benefits and synergies of the acquisition; expectations regarding contingent consideration obligations; expectations regarding the change in the fair value of our convertible senior notes and capped call transactions and its impact on us and our financial results; statements regarding our competition, including the expanded scope of our competitors as a result of acquisitionsentering into new product and service categories; the timing and amount of capital expenditures and share repurchases; the effects of worldwide economic and geopolitical conditions, including but not limited to hostilities in IsraelIsrael, Iran, and the surrounding regions, inflation, interest rate levels, public or administration policies, trade regulations, trade policy, growth rates and other conditions, on our operating and financial results and performance; the manufacture, delivery and cost of certain of our products; the effects of litigation or regulatory developments involving us or affecting our industry; our or our subsidiaries’ debt repayment obligations; and other statements regarding our future operations, financial condition and prospects, and business strategies. These forward-looking statements are based on current expectations and assumptions that are subject to risks and uncertainties, which could cause our actual results to differ materially from those anticipated or implied by any forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Quarterly Report on Form 10-Q and, in particular, the risks discussed under the caption “Risk Factors” in Part II, Item 1A of this report and those discussed in other documents we file with the Securities and Exchange Commission (“SEC”) from time to time. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law. Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements.

•Results of Operations. A discussion of the nature and trends in our financial results and an analysis of our financial results comparing the three and sixnine months ended JanuaryApril 31,30, 2026 to the three and sixnine months ended JanuaryApril 31,30, 2025.

Our mission is to be the cybersecurity partner of choice for enterprises, organizations, service providers, and government entities to protect our digital way of life. Our cybersecurity platforms and services help secure enterprise users, networks, clouds, endpoints, and endpointsidentities by delivering comprehensive cybersecurity backed by artificial intelligence (“AI”) and automation. A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products. We execute on this strategy by developing our capabilities and packaging our offerings into platforms which are able to cover many of our customers’ needs in the markets in which we operate. Our platformization strategy combines various products and services into a tightly integrated architecture for more secure, faster and cost-effective outcomes.

•Secure Access Service Edge (“SASE”). Prisma® Access, when combined with Prisma SD-WAN, provides a comprehensive SASE offering that secures users working from anywhere and on any device, and pioneers the modernization of branch offices. Prisma Browser further extends zero-trust security and data protection to the browser, where the majority of work is done today, providing users with the freedom to work securely using our secure browser from any device.

•Prisma AIRS. Prisma AIRS™ is a comprehensive AI security platform that has been designed to protect customers’ entire AI ecosystem by providing AI Model Security, AI Posture Management, AI Red Teaming, AI Runtime Security, and AI Agent Security.

•Security Operations. We deliver the next generation of security operations capabilities that unifies standalone Security Information and Event Management (“SIEM”) tools, endpoint security, security automation, cloud detection and response (“CDR”), as well as attack surface management (“ASM”) capabilities on our Cortex® platform. These include Cortex XSIAM®, for AI-powered security operations replacing traditional SIEM tools; Cortex XDR®, for the prevention, detection, and response to complex cybersecurity attacks; Cortex XSOAR®, for security orchestration, automation, and response (“SOAR”); and Cortex Xpanse®, for ASM.ASM; and our recent acquisition of Koi Security Ltd. (“Koi”) for agentic endpoint security. Additionally, Cortex XSIAM integrates with the Chronosphere Telemetry Pipeline to ingest and optimize massive data volumes, promoting cost-effective scaling of autonomous operations.

•Unit 42 brings together world-renowned expertise across threat research, incident response, and security consulting to deliver intelligence-driven, response-ready outcomes that help customers reduce cyber risk. Our elite consultants serve as trusted advisors to our customers by assessing and testing their security controls against sophisticated threats, transforming their security strategy with a threat-informed approach, and responding to security incidents on behalf of our clients. Additionally, Unit 42 offers managed detection and response (“MDR”) and managed threat hunting services. In April 2026, we launched a new suite of Unit 42 Frontier AI Defense services to help customers proactively discover and neutralize threats introduced by next-generation AI models.

For the secondthird quarter of fiscal 2026 and 2025, total revenue was $2.6$3.0 billion and $2.3 billion, respectively, representing year-over-year growth of 15%.31%. Our growth reflects the increased adoption of our portfolio, which consists of product, subscriptions, and support.support, and our recent acquisitions. We believe our portfolio will enable us to benefit from recurring revenues and new revenues as we continue to grow our end-customer base. As of JanuaryApril 31,30, 2026, we had end-customers in over 180 countries. Our end-customers represent a broad range of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications, and include almost all of the Fortune 100 companies and a majority of the Global 2000 companies. We maintain a field sales force that works closely with our channel partners in developing sales opportunities. We primarily use a two-tiered, indirect fulfillment model whereby we sell our products, subscriptions, and support to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers.

Our product revenue grew to $514$594 million, or 19.8% of total revenue, for the secondthird quarter of fiscal 2026, representing year-over-year growth of 22%.31%. Product revenue is derived from sales of hardware products, primarily our ML-Powered Next-Generation Firewall and software licenses, including SD-WAN, VM-Series, and Panorama®. In connection with the acquisition of CyberArk Software Ltd. (“CyberArk”) in February 2026, our product revenue also includes on-premise software licenses of certain identity security offerings. Our ML-Powered Next-Generation Firewall incorporates our PAN-OS operating system, which provides a consistent set of capabilities across our entire network security product line. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. Our products are designed for different performance requirements throughout an organization, ranging from our PA-400, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7500, which is designed for large-scale data centers and service provider use. The same firewall functionality that is delivered in our hardware products is also available in our VM-Series virtual firewalls, which secure virtualized and cloud-based computing environments, and in our CN-Series container firewalls, which secure container environments and traffic.

Our subscription and support revenue grew to $2.1$2.4 billion, or 80.2% of total revenue, for the secondthird quarter of fiscal 2026, representing year-over-year growth of 13%.31%. Our subscriptions provide our end-customers with near real-time access to the latest intrusion prevention, web security, modern malware prevention, data loss prevention, cloud security access broker and AI security capabilities across the network, endpoints, and the cloud. Our subscriptions also include security operations, which enable customers to leverage the AI-powered Cortex platform for advanced capabilities such as security information and event management, next-generation antivirus, endpoint detection and response, extended detection and response, identity threat detection and response, cloud detection and response, SOAR, ASM, and CNAPP for comprehensive cloud security. In connection with our acquisition of Chronosphere, Inc. (“Chronosphere”) in January 2026, our subscriptions also include a next-generation observability platform for cloud-native infrastructure and applications as well as telemetry pipeline management that is designed to handle vast cloud data volumes with cost-efficiency and reliability. With the acquisition of CyberArk, our subscriptions include a next-generation identity security platform designed to secure human, AI, and machine identity across the enterprise with intelligent privilege controls and continuous threat prevention. Additionally, we offer MDR for Cortex subscriptions, powered by Unit 42’s elite expertise. When customers purchase our physical, virtual, or container firewalls, or certain cloud offerings, they typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs. In addition to the subscriptions purchased with these firewalls, customers may also purchase other subscriptions on a per-user, per-endpoint, or capacity-based basis. We also offer professional services, including incident response, risk management, and digital forensic services.services, and technical account management.

We continue to invest in innovation as we evolve and further extend the capabilities of our portfolio, as we believe that innovation and timely development of and investment in new features and products are essential to meeting the needs of our end-customers and improving our competitive position. For example, we launched Next-Generation Trust Security that unifies certificate lifecycle management and Prisma AIRS 3.0 that discovers, assesses, and protects agentic AI. On February 11, 2026, we completed the acquisition of CyberArk Software Ltd. (“CyberArk”),CyberArk, forming our next-generation identity security platform. Additionally, on JanuaryApril 14, 2026, we completed the acquisition of Koi, to add agentic endpoint security capabilities to our security operations platform and enhance Prisma AIRS. On May 29, 2026, we completed the acquisition of Chronosphere,Portkey, formingInc., a privately-held AI Gateway company, to enhance our next-generationPrisma observabilityAIRS platform.capabilities.

Our overall performance depends in part on worldwide economic and geopolitical conditions and their impact on customer behavior. Changes in legislation or regulations and actions by regulators, including changes in enforcement and administration policies, may have an impact on our results of operations and financial condition. Significant changes in U.S. or global trade policy, including further expansion of U.S. export/imports controls and tariffs, as well as retaliatory actions by other countries, may materially and adversely affect our business. Further, economic conditions, including inflation, high interest rates, slow growth, fluctuations in foreign exchange rates, supply chain disruptions, suchincluding asincreased amemory, memorystorage or other component shortage,shortages, impacts of trade regulations or international trade disputes, and other conditions, may adversely affect our results of operations and financial performance.

The hostilities in IsraelIsrael, Iran and the surrounding region have continued to result in economic and political uncertainty. While we have business operations in Israel, and intend to continue growing our presence in Israel, we currently do not expect significant business disruption. We are actively monitoring, evaluating, and responding to the situation.

We monitor the key financial metrics set forth in the tables below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts, and assess operational efficiencies. We discuss revenue, gross margin, and the components of operating income (loss) and margin below under “Results of Operations.”

Our revenue consists of product revenue and subscription and support revenue. Revenue is recognized upon transfer of control of the corresponding promised products and subscriptions and support to our customers in an amount that reflects the consideration we expect to be entitled to in exchange for those products and subscriptions and support. We expect our revenue to vary from quarter to quarter based on seasonal and cyclical factors.factors and business acquisitions.

Product revenue is derived from sales of hardware products, primarily our ML-Powered Next-Generation Firewall, and software licenses, including SD-WAN, VM-Series, Panorama, and Panorama.certain identity security offerings. Our hardware products and software licenses include a broad set of built-in networking and security features and functionalities. We recognize product revenue at the time of hardware shipment or delivery of software license. As a percentage of product revenue, we expect our revenue from software licenses to vary from quarter to quarter and increase over the long term as we improve features and capabilities of our on-premise software, renew our software license contracts, and expand our installed end-customer base.

Product revenue increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025, driven by increased revenue from software licenses and increased demand for our new generation of hardware products. The increase in product revenue for the three and nine months ended April 30, 2026 was also driven by increased software licenses revenue from our CyberArk acquisition closed in February 2026.

Subscription and support revenue increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 due to increased demand for our subscription and support offerings from our end-customers.end-customers and our recent acquisitions. The mix between subscription revenue and support revenue will fluctuate over time, depending on the introduction of new subscription offerings, renewals of support services, and our ability to increase sales to new and existing end-customers.

Revenue from the Americas, EMEA, and APAC increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 as we continued to increase investment in our global sales force in order to support our growth and innovation, with the Americas contributing the highest increase in revenue due to its larger scale.

Cost of product revenue primarily includes costs paid to our manufacturing partners for procuring components and manufacturing our products. Our cost of product revenue also includes personnel costs, which consist of salaries, benefits, bonuses, share-based compensation, and travel associated with our operations organization, inventory excess and obsolete charges, shipping and tariff costs, amortization of intellectualintangible property licenses,assets, product testing costs, and shared costs. Shared costs consist of certain facilities, depreciation, benefits, recruiting, and information technology costs that we allocate based on headcount. We expect our cost of product revenue to fluctuate with our revenue from hardware products.

Cost of product revenue increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 primarily due to higher amortization of intangible assets as a result of our CyberArk acquisition, increased demand for our hardware products and higher tariff costs, partially offset by a decrease in inventory excess and obsolete charges.

Cost of subscription and support revenue includes personnel costs for our global customer support and technical operations organizations, data center and cloud hosting service costs, third-party professional services costs, amortization of acquired intangible assets and capitalized software development costs, customer support and repair costs, and shared costs. We expect our cost of subscription and support revenue to increase as our installed end-customer base grows and adoption of our cloud-based subscription offerings increases.

Cost of subscription and support revenue increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 primarily due to increased costs to support the growth of our subscription and support offerings. Cloud hosting service costs, which support our cloud-based subscription offerings, increased $48$75 million and $97$171 million for the three and sixnine months ended JanuaryApril 31,30, 2026, respectively, compared to the same periods in 2025. PersonnelAmortization costsof grewintangible $11assets increased $117 million and $25$109 million for the three and sixnine months ended JanuaryApril 31,30, 2026, respectively, compared to the same periods in 2025 as a result of our recent acquisitions. Personnel costs grew $71 million and $97 million for the three and nine months ended April 30, 2026, respectively, compared to the same periods in 2025, primarily due to headcount growth.growth, including headcount from our recent acquisitions.

Product gross margin increaseddecreased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 primarily due to a decrease in gross margin on our hardware products and higher amortization of intangible assets, partially offset by increased software licenses revenue from our CyberArk acquisition. The decrease in product gross margin for the nine months ended April 30, 2026 was further offset by continued shift in our product revenue mix toward software,software and a decrease in inventory excess and obsolete charges, partially offset by a decrease in gross margin on our hardware products.charges.

Subscription and support gross margin were flatdecreased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025.2025 primarily due to higher amortization of intangible assets as a result of our recent acquisitions.

Our operating expenses consist of research and development, sales and marketing, and general and administrative expenses. Personnel costs are the most significant component of operating expenses and consist of salaries, benefits, bonuses, share-based compensation, travel and entertainment, and with regard to sales and marketing expense, sales commissions. Our operating expenses also include shared costs, which consist of certain facilities, depreciation, benefits, recruiting, and information technology costs that we allocate based on headcount to each department. We expect operating expenses generally to increase in absolute dollars and to decrease over the long term as a percentage of revenue as we continue to scale our business. As of JanuaryApril 31,30, 2026, we expect to recognize approximately $2.9$3.6 billion of share-based compensation expense over a weighted-average period of approximately 2.6 years, excluding additional share-based compensation expense related to any future grants of share-based awards. Share-based compensation expense is generally recognized on a straight-line basis over the requisite service periods of the awards.

Research and development expense was relatively flat for the three months ended January 31, 2026 compared to the same period in 2025. Research and development expense increased for the sixthree and nine months ended JanuaryApril 31,30, 2026 compared to the same periodperiods in 2025 primarily due to increased personnel costs, which grew $41$192 million and $233 million for the sixthree and nine months ended JanuaryApril 31,30, 2026 compared to the same periodperiods in 2025, largely due to headcount growth.growth, including headcount from our recent acquisitions.

Sales and marketing expense consists primarily of personnel costs, including commission expense. Sales and marketing expense also includes costs for market development programs, promotional and other marketing costs, professional services, amortization of intangible assets, and shared costs. We continue to strategically invest in headcount and have grown our sales presence. We expect sales and marketing expense to continue to increase in absolute dollars as we increase the size of our sales and marketing organizations to grow our customer base, increase touch points with end-customers, and expand our global presence, although our sales and marketing expense may fluctuate as a percentage of total revenue.

Sales and marketing expense increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 primarily due to increased personnel costs, which grew $69$254 million and $154$408 million for the three and sixnine months ended JanuaryApril 31,30, 2026, respectively, compared to the same periods in 2025, largely due to headcount growth.growth, including headcount from our recent acquisitions. The increase in sales and marketing expense in both periods were further driven by higher amortization of intangible assets as a result of our recent acquisitions.

General and administrative expense consists primarily of personnel costs and shared costs for our executive, finance, human resources, information technology, and legal organizations, and professional services costs, which consist primarily of legal, auditing, accounting, and other consulting costs. General and administrative expense also includes change in fair value of contingent consideration liability. WeExcluding the near-term impact of our recent acquisitions, we expect general and administrative expense to increase in absolute dollars over time as we increase the size of our general and administrative organizations and incur additional costs to support our business growth, although our general and administrative expense may fluctuate as a percentage of total revenue.

Interest expense decreased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periods in 2025 due to the maturity of our 2025 Notes in June 2025. Refer to Note 9. Debt in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information on the Notes.

Other income, net includes interest income earned on our cash, cash equivalents, and investments, and gains and losses from foreign currency remeasurement and foreign currency transactions.transactions, and change in fair value of convertible senior notes and capped calls.

Other income, net decreased for the three months ended April 30, 2026 compared to the same period in 2025 primarily due to a loss from change in fair value of our convertible senior notes and lower interest income as a result of lower average cash, cash equivalent and investment balances for the three months ended April 30, 2026 compared to the same period in 2025. Other income, net increased for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periodsperiod in 2025 primarily due to increased gains on sales of our investments to fund acquisitions and higher interest income as a result of higher average cash, cash equivalents,equivalent and investment balances for the three and sixnine months ended JanuaryApril 31,30, 2026 compared to the same periodsperiod in 2025.2025, Thepartially increase was further drivenoffset by increaseda gainsloss onfrom saleschange in fair value of our investmentsconvertible tosenior fund recent acquisitions.notes.

Provision for income taxes consists primarily of U.S. and foreign income taxes. Our effective tax rate during the three and sixnine months ended JanuaryApril 31,30, 2026 wasdiffered lower thanfrom our statutory tax rate primarily due to our CyberArk acquisition and excess tax benefits from share-based compensation. We may continue to see fluctuations in our effective tax rate as we further integrate CyberArk into our corporate structure and intercompany relationships. We continue to maintain a valuation allowance for our California deferred tax assets due to the uncertainty regarding realizability of these deferred tax assets as they have not met the “more likely than not” realization criterion. We expect future research and development tax credit generation in California to exceed our ability to use the existing tax credits.

Our provisioneffective fortax incomerate taxesvaried for the three and sixnine months ended JanuaryApril 31, 2026 was primarily due to U.S. and foreign income taxes. Our effective tax rate increased for the three and six months ended January 31,30, 2026 compared to the same periods in 2025 primarily due to our CyberArk acquisition and decreased excess tax benefits from share-based compensation relative to our increased business profits.compensation. Refer to Note 13.14. Income Taxes in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information.

In April 2023, we entered into a credit agreement (the “Credit Agreement”) that provides for a $400 million unsecured revolving credit facility (the “Credit Facility”), with an option to increase the amount of the Credit Facility by up to an additional $350 million, subject to certain conditions. The interest rates and commitment fees are also subject to upward and downward adjustments based on our progress towards the achievement of certain sustainability goals. As of JanuaryApril 31,30, 2026, there were no amounts outstanding, and we were in compliance with all covenants under the Credit Agreement. Refer to Note 9. Debt in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information on the Credit Agreement.

In February 2019, our board of directors authorized a $1.0 billion share repurchase program. Our board of directors subsequently authorized additional increases to this share repurchase program, bringing the total authorization to $4.1$5.1 billion. Repurchases will be funded from available working capital and may be made at management’s discretion from time to time. As of JanuaryApril 31,30, 2026, $1.0 billion remained available for future share repurchases under this repurchase program. The repurchase authorization will expire on December 31, 2026, and may be suspended or discontinued at any time without prior notice. Refer to Note 11.12. Stockholders’ Equity in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information on this repurchase program.

We have entered into various non-cancelable operating leases, primarily for our offices and data centers, with lease terms expiring through fiscal 2036.2040, with the most significant leases relating to our corporate headquarters in Santa Clara, California. As of JanuaryApril 31,30, 2026, we have total operating lease obligations of $459$778 million recorded on our condensed consolidated balance sheet.

As of JanuaryApril 31,30, 2026, our commitments to purchase products, components, cloud hosting and other services totaled $6.9$8.6 billion. Refer to Note 10.11. Commitments and Contingencies in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information on these commitments.

Our acquisition of certain QRadar assets from International Business Machines Corporation (“IBM”) on August 31, 2024 included contingent consideration that requires potential future payments through the fiscal quarter ending October 2028. As of JanuaryApril 31,30, 2026, we have total contingent consideration obligation of $369$240 million recorded on our condensed consolidated balance sheet. Refer to Note 3. Fair Value Measurements in Part I, Item 1 of this Quarterly Report on Form 10-Q for more information on our contingent consideration obligation.

The following table summarizes our cash flows for the sixnine months ended JanuaryApril 31,30, 2026 and 2025:

Cash provided by operating activities during the sixnine months ended JanuaryApril 31,30, 2026 was $2.3$3.2 billion, an increase of $258$501 million compared to the same period in 2025. The increase was primarily due to growth of our business as reflected by increases in collections during the sixnine months ended JanuaryApril 31,30, 2026, partially offset by higher cash expenditure to support our business growth.