Public Company Earnings — Cyber Signals
Cybersecurity-relevant content only, extracted from the most recent public earnings calls (2026). For each name: the cyber metric that matters, plus the AI/strategy/M&A signal. Figures are as reported. Sources at the bottom.
An additional earnings signal comes from breach victims outside the security sector. On its fiscal-Q1 2026 call in late May 2026, toy manufacturer Hasbro disclosed that a March 2026 network intrusion would delay roughly $40–60M of Consumer Products revenue to the back half of the year and carry about $20M of one-time remediation operating expense in 2026 — a quantified example, per Wall Street research, of a cyber event's material impact on a non-technology public company.
Big Tech with significant cyber assets
| Company |
Cyber-relevant signal (2026) |
| Microsoft |
Security is among the largest franchises in the industry (>$20B as last officially disclosed, FY2022; ~$37B cited in 2026 commentary, est.). Bundling Security Copilot into all E5; Security Copilot customers 2x YoY; a dozen new Copilot agents across Defender, Entra, Intune, Purview; 24B Copilot interactions audited by Purview (+9x YoY); data-security triage agents handled 2M+ alerts in a quarter. Framing: "the physics of cybersecurity has changed" as AI compresses vuln-to-exploit; Microsoft sim-ships Defender protections for AI-discovered vulns. (Aggregation in action — see 03.) |
| Alphabet / Google |
Q1 2026 Google Cloud $20.0B, +63% YoY. Wiz acquisition ($32B, largest in Alphabet history) closed March 2026, "exceeding expectations," reporting within Google Cloud (low-single-digit-pt margin headwind for 2026). New Gemini-powered "Agentic Defense" agents for threat detection, continuous red teaming, automated remediation. Cloud RPO ~$460B (~6 years of revenue). |
| Cisco |
Q4 FY26 (quarter ended Jul 25 2026, rep. Aug 12 2026): record total revenue $17.3B (+18% YoY), above the top of guidance. Security revenue $2.2B, +14% YoY — the first double-digit security print since the Splunk acquisition, with growth attributed to Splunk, network security and SASE; observability (which carries Splunk) $275M, +6%; networking $9.8B, +28% remained the growth leader. In-quarter demand markers: 1,500+ customers bought new security products including Secure Access and Hypershield, firewall orders +30%, and Splunk added 280+ new logos, passing its 1,000-logo annual target. CEO Chuck Robbins tied the demand to the agentic threat surface: "the rise of agentic AI is expanding the threat landscape, driving demand for our security and observability solutions to help monitor agent behavior." Prior quarter for contrast — Q3 FY26 (rep. May 13 2026): revenue $15.8B (+12%) with security ~flat YoY at ~$2.0B as the Splunk on-prem→cloud transition dragged the reported line (Cisco had underwritten roughly a 50/50 cloud/on-prem split and landed nearer ~2/3 cloud), even as security orders ex-Splunk grew double digits. The two prints together date the drag: roughly 28 months from the $28B Splunk close (Mar 18 2024) to a security line growing double digits again — see Ch. 18 "Why Most Acquisitions Fail." |
| Company |
Cyber-relevant signal (2026) |
| Palo Alto Networks |
Q3 FY26 (rep. Jun 2, 2026): revenue $3.0B, +31%; NGS ARR $8.1B, +60% — but ~$1.6B of that ARR (and $388M of revenue) was acquired (CyberArk + Chronosphere), so much of the "platform" growth is bought, not organic; RPO $18.4B, +36%; ~2,280 platformized customers at ~120% NRR; Prisma AIRS the fastest-scaling product in company history; "you need AI to defend against AI" / "AI must fight AI." FY26 guide raised to $11.415–11.425B (+24%). Completed CyberArk ($25B) Feb 2026. Notably, stock fell on a beat-and-raise — the valuation reset in action. (The platform grows by buying point products and reselling into an owned base — see Book Ch. 6 & 33.) |
| CrowdStrike |
Q1 FY27 (rep. Jun 3, 2026): revenue $1.39B, +26% (acceleration for a 4th straight quarter); record Q1 net new ARR $256M, +32%; ending ARR $5.51B, +24%; record FCF $468M (34% of revenue), op income $326M (24% margin, +62%), Rule of 40 = 59. Raised FY27 net-new-ARR growth guide +520bps at the midpoint; board approved a 4-for-1 stock split (record date Jun 25 2026; additional shares distributed after close Jul 1 2026; split-adjusted trading expected to begin Jul 2 2026). Charlotte AI = agentic SOC analyst, autonomous triage/response at machine speed ("flattening the hiring curve"); NextGen SIEM displacing legacy SIEM (8-figure Falcon Flex expansions). Module-adoption (demand-side consolidation, as of Apr 30 2026): 51% / 35% / 25% of customers run 6+ / 7+ / 8+ modules — a quarter of the base has voluntarily standardized 8+ functions on one platform (the buyer-pull proof; see Book Ch 03). Kurtz: "best positioned… for the AI age." (The post-outage recovery is complete on the numbers — a clean platform compounder; reinforces the valuation two-tier where durable AI-SOC leaders hold premium multiples.) |
| Zscaler |
Q3 FY26 (ended Apr 30 2026, reported May 26 2026): revenue $850.5M (+25%); ARR $3,525M (+25%, +21% ex-Red Canary MDR tuck-in), net new ARR $166M in-quarter; non-GAAP operating margin an all-time-high 23%; FCF $136M (+14%). FY26 guide: revenue $3.33–3.34B (~24.6%), ARR $3.74–3.75B (~24%). Three pillars: AI Security, Zero Trust Everywhere, Data Security; momentum in AI Protect; partnered with OpenAI. Chaudhry: Zero Trust SASE "never more essential" against frontier-model/agent threats. |
| Fortinet |
Q1 2026 (rep. May 6 2026): revenue $1.85B (+20% YoY), product revenue $645M (+41%); billings +31% YoY to $2.09B; non-GAAP operating margin 36% (GAAP 31%), record adjusted FCF $1.07B (+27%, ~57.6% margin — seasonally FCF-heavy Q1); Rule of 40 ≈ 56 (growth + op margin). Unified SASE = 25% of billings, +31% (vs. ~18% market CAGR; $79B TAM) as customers move off perimeter firewalls to zero trust. FortiOS 8.0 adds AI-driven security + quantum-safe. FY26 revenue guide raised to ~15% growth. Riding the firewall refresh + SASE pivot. |
| SentinelOne |
Q1 FY27 (ended Apr 30 2026, reported May 28 2026): revenue $276.7M (+21% YoY); ending ARR $1,163M (+23%), record net-new-ARR growth; $100k+ ARR customers 1,702 (+17%); non-GAAP EPS $0.04 (beat); FY27 revenue guide $1.195–1.205B, non-GAAP op income raised to $115–125M. Emerging solutions (Purple AI, cloud, data) reached ~half of total ARR; AI Security ARR nearly doubled. Persistent takeover speculation given AI differentiation + sub-scale-vs-platforms position. |
Identity
| Company |
Cyber-relevant signal (2026) |
| Okta |
ARR $3.0B, +~12%; newer products (Identity Governance, Privileged Access, AI agent security) ≈25% of bookings — "agentic identity" positioning; Identity Governance the strongest new product. Slower-growth, profitable identity incumbent. |
| CyberArk |
Pre-close Q3 2025 revenue $342.8M, +43% (subscription-led); flagged securing agentic AI as a "tremendous opportunity." Acquired by Palo Alto ($25B), closed Feb 11, 2026 — the identity-inflection deal. |
Exposure management
| Company |
Cyber-relevant signal (2026) |
| Tenable |
Q1 2026 revenue $262.1M, +9.6%; non-GAAP op margin 23.6%; FY guide ~$1.07B. The exposure-management pivot showing traction (stock +45% in 2026). |
| Qualys |
Tenable's most direct vuln/exposure-management rival; steady, profitable, slower-growth — a consolidation/roll-up watch item. |
| Rapid7 |
Q2 2026 (quarter ended Jun 30, reported Aug 2026) revenue $210.9M, −1.5%; ARR $824.0M, −2.0% — the ARR line is contracting. Non-GAAP op income $28.9M; FCF $31.9M; cash and securities $702.6M. Board approved a 2026 Restructuring Plan cutting ~12% of the workforce (Aug 7), $10–11M of charges, targeting a 20% non-GAAP operating margin in Q4 2026. FY26 guide: revenue $837–841M, ARR ~$812M at (3)%, non-GAAP op income $129–133M, FCF ~$130M. A growth-to-margin conversion at a vuln-management incumbent long cited as a take-private candidate — see 03k. |
Network, web & data resilience
| Company |
Cyber-relevant signal (2026) |
| Cloudflare |
Q1 2026 revenue +34%; 332k+ paying customers; agent-driven traffic doubled early 2026; launched Cloudflare Mesh to secure the AI-agent lifecycle. Security + AI-agent infrastructure convergence. |
| Check Point |
Q1 2026 revenue $668.4M, +5% (slight miss); security subscriptions +11% to $323.2M (high-margin recurring); Infinity platform; achieved GovRAMP. Mature, profitable, slower-growth. |
| Rubrik |
Subscription ARR $1.46B, +34% (FY26); Q1 FY27 $1.57B, +32%. Positioning as "agentic cyber resilience — data, identity, and AI in one architecture" + an AI-governance push. Backup/recovery re-cast as cyber resilience. |
| Varonis |
Total SaaS ARR $683.2M, +69% (29% ex-conversions) amid on-prem→SaaS transition; FY26 guide $814–845M SaaS ARR; launched Atlas AI security platform. Data-security incumbent re-rating on AI. |
Consumer cyber safety
| Company |
Cyber-relevant signal (2026) |
| Gen Digital (Norton, Avast, LifeLock) |
FY26 revenue $5.0B, growth accelerating to double digits (Q4 +27% to $1.28B); 79M paid customers (+11M YoY); launched Norton Neo AI browser security. Consumer cyber + the MoneyLion fintech adjacency. |
Cross-read — what the calls say together
- AI security is the universal growth vector. Every name is monetizing AI security (Prisma AIRS, Charlotte AI, Purple AI, Zscaler AI Protect, Gemini Agentic Defense, Microsoft Security Copilot, Varonis Atlas) — confirming AI Security as the migrating profit pool.
- Platform NRR is the compounding engine — and the ~120% proof line is demanding. Where disclosed, platform/land-and-expand retention is what the market pays for, but even the leaders press against the ~120% second-product threshold rather than clearing it easily. Most-recently-reported net retention: PANW (NGS) ~120% (Q3 FY26) · CrowdStrike DBNR ~119% (Q1 FY27) · Zscaler DBNRR ~114% (Q3 FY26) · SentinelOne ~110% ($100K+ cohort) · Okta ~107% (Q1 FY27) — periods ended ~Apr 30 2026; definitions vary by vendor. Sustained >120% = "land-and-expand works" (a real second-product engine); a platform story at ~107% has not yet built one (Unit Economics, Valuation; see Book Ch. 19).
- Legacy is being displaced — but the incumbent SIEM franchise is not draining as fast as the flat quarters implied. SIEM is the battlefield: CrowdStrike/Microsoft/Google displacing Splunk/QRadar. Cisco's own security revenue ran ~flat YoY through Q3 FY26 (down 4% two quarters earlier) mid-transition, then returned to +14% in Q4 FY26 with Splunk named as a growth contributor — evidence that the model-change drag on an acquired SIEM is a multi-year transition cost rather than, on this record, a permanent loss of the pool (Sub-Segment Deep Dives, Economics, SecOps & SIEM; see Ch. 4).
- The reset is real even for winners. PANW fell on a beat-and-raise; multiples re-rated despite ~14% sector growth (12, 03).
- M&A signal: the labs/hyperscalers (Microsoft, Google+Wiz) are aggregating; sub-scale AI-differentiated pure-plays (SentinelOne takeover talk) are origination; identity (CyberArk) and cyber-resilience/data (Rubrik, Varonis) are re-rating. Feeds Deals.
- Rule of 40 is a scale phenomenon. Stack growth + non-GAAP operating margin for the spring-2026 prints and the scaled leaders cluster half again above the line — PANW ~58 (+31%/27%) · Fortinet ~56 (+20%/36%) · CrowdStrike 50 (+26%/24%) · Zscaler ~48 (+25%/23%) — while the smallest, least platform-complete pure-play sits below it: SentinelOne ~25 (+21%/4%), its margin only now turning positive. The premium (Valuation) is paid to the cluster above the line, not the category in the abstract. (Charted as the Rule-of-40 scoreboard in Book Ch. 5 — Unit Economics of Defense; see also Unit Economics.)
Sources
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.