Public Company Earnings — Cyber Signals

Cybersecurity-relevant content only, extracted from the most recent public earnings calls (2026). For each name: the cyber metric that matters, plus the AI/strategy/M&A signal. Figures are as reported. Sources at the bottom.

An additional earnings signal comes from breach victims outside the security sector. On its fiscal-Q1 2026 call in late May 2026, toy manufacturer Hasbro disclosed that a March 2026 network intrusion would delay roughly $40–60M of Consumer Products revenue to the back half of the year and carry about $20M of one-time remediation operating expense in 2026 — a quantified example, per Wall Street research, of a cyber event's material impact on a non-technology public company.

Big Tech with significant cyber assets

Company	Cyber-relevant signal (2026)
Microsoft	Security is among the largest franchises in the industry (>$20B as last officially disclosed, FY2022; ~$37B cited in 2026 commentary, est.). Bundling Security Copilot into all E5; Security Copilot customers 2x YoY; a dozen new Copilot agents across Defender, Entra, Intune, Purview; 24B Copilot interactions audited by Purview (+9x YoY); data-security triage agents handled 2M+ alerts in a quarter. Framing: "the physics of cybersecurity has changed" as AI compresses vuln-to-exploit; Microsoft sim-ships Defender protections for AI-discovered vulns. (Aggregation in action — see 03.)
Alphabet / Google	Q1 2026 Google Cloud $20.0B, +63% YoY. Wiz acquisition ($32B, largest in Alphabet history) closed March 2026, "exceeding expectations," reporting within Google Cloud (low-single-digit-pt margin headwind for 2026). New Gemini-powered "Agentic Defense" agents for threat detection, continuous red teaming, automated remediation. Cloud RPO ~$460B (~6 years of revenue).
Cisco	Q4 FY26 (quarter ended Jul 25 2026, rep. Aug 12 2026): record total revenue $17.3B (+18% YoY), above the top of guidance. Security revenue $2.2B, +14% YoY — the first double-digit security print since the Splunk acquisition, with growth attributed to Splunk, network security and SASE; observability (which carries Splunk) $275M, +6%; networking $9.8B, +28% remained the growth leader. In-quarter demand markers: 1,500+ customers bought new security products including Secure Access and Hypershield, firewall orders +30%, and Splunk added 280+ new logos, passing its 1,000-logo annual target. CEO Chuck Robbins tied the demand to the agentic threat surface: "the rise of agentic AI is expanding the threat landscape, driving demand for our security and observability solutions to help monitor agent behavior." Prior quarter for contrast — Q3 FY26 (rep. May 13 2026): revenue $15.8B (+12%) with security ~flat YoY at ~$2.0B as the Splunk on-prem→cloud transition dragged the reported line (Cisco had underwritten roughly a 50/50 cloud/on-prem split and landed nearer ~2/3 cloud), even as security orders ex-Splunk grew double digits. The two prints together date the drag: roughly 28 months from the $28B Splunk close (Mar 18 2024) to a security line growing double digits again — see Ch. 18 "Why Most Acquisitions Fail."

Platform pure-plays

Company	Cyber-relevant signal (2026)
Palo Alto Networks	Q3 FY26 (rep. Jun 2, 2026): revenue $3.0B, +31%; NGS ARR $8.1B, +60% — but ~$1.6B of that ARR (and $388M of revenue) was acquired (CyberArk + Chronosphere), so much of the "platform" growth is bought, not organic; RPO $18.4B, +36%; ~2,280 platformized customers at ~120% NRR; Prisma AIRS the fastest-scaling product in company history; "you need AI to defend against AI" / "AI must fight AI." FY26 guide raised to $11.415–11.425B (+24%). Completed CyberArk ($25B) Feb 2026. Notably, stock fell on a beat-and-raise — the valuation reset in action. Q4 FY26 (quarter ended Jul 31 2026, rep. Sep 1 2026): revenue $3.41B, +34%; NGS ARR $9.10B, +63%, roughly $150M above the top of the $8.90–8.95B guide; RPO $21.2B, +34%; non-GAAP EPS $1.02 against $0.95; adjusted free cash flow $1.29B. Full-year FY26 revenue $11.48B, +24.5%, at a 38.4% adjusted-FCF margin and a 29.2% non-GAAP operating margin. GAAP swung the other way: a net loss of $282M ($(0.35) per diluted share) against $254M of net income a year earlier, with non-GAAP operating income of $1,011M reconciling to $172M of GAAP operating income across $839M of add-backs. Announced alongside the print: the acquisition of Console, an AI-native agentic-workflow platform, terms undisclosed (11). The acquired-versus-organic test resolves, and it resolves twice in the same release. The headline 63% implies a prior-year NGS ARR base of $5.58B; holding the ~$1.6B of acquired ARR disclosed at Q3 constant leaves an organic base of $7.50B, or ~34% — a little over half the headline rate. The company's own FY27 guidance is the second reading of the same quantity: NGS ARR of $11.075–11.175B, +22–23%, against +63% just reported. Q1 FY27 is separately guided to $9.54–9.56B, +63%, because that quarter's prior-year comparison still predates the CyberArk close. Nothing in the business changes between the two figures — the difference is the acquisition passing out of the addition and into the base. FY26 added $3.52B of net new NGS ARR; FY27 is guided to $2.03B, about 58% as much. The balance sheet carries the same event: goodwill rose from $4.57B to $22.01B and acquired intangibles from $0.76B to $7.02B, together $29.0B, or 59.9% of $48.46B of total assets, and quarterly amortization of acquired intangibles rose from $37M to $281M. The $20B FY30 target restated in the same release carries no cushion for deceleration, which is what makes it a statement about M&A appetite. From the FY27 midpoint of $11.125B, reaching $20B by FY30 requires a 21.6% CAGR over three fiscal years. FY27 NGS ARR is guided to grow 22–23%. The target therefore requires no acceleration — only that the currently guided rate hold for three more years, and on the company's own numbers it is met with no acquisitions at all if that happens. What it does not carry is room for the deceleration that is normal at this scale. Each decay path prices out, and PANW's own revealed acquisition price is the right multiple to price it at: ($25B CyberArk + $3.35B Chronosphere) ÷ $1.6B of acquired NGS ARR = ~17.7× ARR, the acquired figure being the company's Q3 FY26 disclosure.

Company

Cyber-relevant signal (2026)

Palo Alto Networks

Q3 FY26 (rep. Jun 2, 2026): revenue $3.0B, +31%; NGS ARR $8.1B, +60% — but ~$1.6B of that ARR (and $388M of revenue) was acquired (CyberArk + Chronosphere), so much of the "platform" growth is bought, not organic; RPO $18.4B, +36%; ~2,280 platformized customers at ~120% NRR; Prisma AIRS the fastest-scaling product in company history; "you need AI to defend against AI" / "AI must fight AI." FY26 guide raised to $11.415–11.425B (+24%). Completed CyberArk ($25B) Feb 2026. Notably, stock fell on a beat-and-raise — the valuation reset in action.

Q4 FY26 (quarter ended Jul 31 2026, rep. Sep 1 2026): revenue $3.41B, +34%; NGS ARR $9.10B, +63%, roughly $150M above the top of the $8.90–8.95B guide; RPO $21.2B, +34%; non-GAAP EPS $1.02 against $0.95; adjusted free cash flow $1.29B. Full-year FY26 revenue $11.48B, +24.5%, at a 38.4% adjusted-FCF margin and a 29.2% non-GAAP operating margin. GAAP swung the other way: a net loss of $282M ($(0.35) per diluted share) against $254M of net income a year earlier, with non-GAAP operating income of $1,011M reconciling to $172M of GAAP operating income across $839M of add-backs. Announced alongside the print: the acquisition of Console, an AI-native agentic-workflow platform, terms undisclosed (11).

The acquired-versus-organic test resolves, and it resolves twice in the same release. The headline 63% implies a prior-year NGS ARR base of $5.58B; holding the ~$1.6B of acquired ARR disclosed at Q3 constant leaves an organic base of $7.50B, or ~34% — a little over half the headline rate. The company's own FY27 guidance is the second reading of the same quantity: NGS ARR of $11.075–11.175B, +22–23%, against +63% just reported. Q1 FY27 is separately guided to $9.54–9.56B, +63%, because that quarter's prior-year comparison still predates the CyberArk close. Nothing in the business changes between the two figures — the difference is the acquisition passing out of the addition and into the base. FY26 added $3.52B of net new NGS ARR; FY27 is guided to $2.03B, about 58% as much. The balance sheet carries the same event: goodwill rose from $4.57B to $22.01B and acquired intangibles from $0.76B to $7.02B, together $29.0B, or 59.9% of $48.46B of total assets, and quarterly amortization of acquired intangibles rose from $37M to $281M.

The $20B FY30 target restated in the same release carries no cushion for deceleration, which is what makes it a statement about M&A appetite. From the FY27 midpoint of $11.125B, reaching $20B by FY30 requires a 21.6% CAGR over three fiscal years. FY27 NGS ARR is guided to grow 22–23%. The target therefore requires no acceleration — only that the currently guided rate hold for three more years, and on the company's own numbers it is met with no acquisitions at all if that happens. What it does not carry is room for the deceleration that is normal at this scale. Each decay path prices out, and PANW's own revealed acquisition price is the right multiple to price it at: ($25B CyberArk + $3.35B Chronosphere) ÷ $1.6B of acquired NGS ARR = ~17.7× ARR, the acquired figure being the company's Q3 FY26 disclosure.

FY28–FY30 growth path	FY30 NGS ARR	Gap to $20B	Implied M&A at ~17.7× ARR
No deceleration (22% held)	$20.2B	—	none required
Mild decay (22 / 20 / 18%)	$19.2B	$0.78B	~$14B
Normal decay (22 / 19 / 16%)	$18.7B	$1.26B	~$22B
Faster decay (22 / 18 / 14%)	$18.3B	$1.74B	~$31B
Net-new ARR dollars held flat	$17.2B	$2.80B	~$50B

The bottom row is a scenario, not an implication — holding net-new dollars flat is itself a decay assumption (22% → 18% → 15%) and is not what the company has guided. The separate observation that stands on its own is that net-new NGS ARR from growth rather than purchase is guided up only about 6% — ~$1.92B in FY26 (net-new $3.52B less the $1.6B acquired step-up) against $2.03B guided for FY27 — while the base it is generated from is 63% larger. Net-new per dollar of opening base falls from 34% to 22% on that arithmetic. (Cross-reference for buyer sizing: 11b.) (The platform grows by buying point products and reselling into an owned base — see Book Ch. 6, 33 and the growth-adjustment rule on 12a.) | | CrowdStrike | Q2 FY27 (ended Jul 31 2026, reported Aug 26 2026): revenue $1,470.9M (+26%), subscription $1,400.3M (+27%); ending ARR $5.84B (+25%); net new ARR $332.8M — a company record, and +51% YoY, which is the quarter's most important number because net-new leads reported revenue by roughly four quarters. Falcon Flex ending ARR $2.29B, +101%. Non-GAAP operating income $371.6M (25% margin) against a GAAP operating loss of $(33.2)M; GAAP net income $5.3M ($0.01 diluted); non-GAAP diluted EPS $0.31; operating cash flow $530.3M and free cash flow $377.4M (26% margin), both Q2 records; non-GAAP subscription gross margin 81%. Module adoption at Jul 31: 51% / 35% / 26% of subscription customers on 6+ / 7+ / 8+ modules. FY27 guidance raised: revenue $5,991–6,011M, non-GAAP EPS $1.25–1.26, ARR $6,603–6,612M, and net-new-ARR growth lifted 630bps to ~34% at the midpoint. Announced an agreement to acquire the IP of XM Cyber (attack-path visualization; see 11) and a Cerebras inference collaboration. All share figures reflect the 4-for-1 split effected after close Jul 1 2026. Dollar-based retention rates were not disclosed numerically, and there is no ARR disclosure for Charlotte AI or Next-Gen SIEM — Falcon Flex is the only product-level ARR the release gives, so any Charlotte/NG-SIEM ARR figure in circulation is an estimate. Panel role: the growth outlier that is genuinely organic — net new ARR of $332.8M is 5.9x SentinelOne's $56M off an ARR base only 4.8x larger, so CrowdStrike is compounding faster per dollar of base as well as in absolute terms (12a). Prior: Q1 FY27 (rep. Jun 3, 2026): revenue $1.39B, +26% (acceleration for a 4th straight quarter); record Q1 net new ARR $256M, +32%; ending ARR $5.51B, +24%; record FCF $468M (34% of revenue), op income $326M (24% margin, +62%), Rule of 40 = 59. Raised FY27 net-new-ARR growth guide +520bps at the midpoint; board approved a 4-for-1 stock split (record date Jun 25 2026; additional shares distributed after close Jul 1 2026; split-adjusted trading expected to begin Jul 2 2026). Charlotte AI = agentic SOC analyst, autonomous triage/response at machine speed ("flattening the hiring curve"); NextGen SIEM displacing legacy SIEM (8-figure Falcon Flex expansions). Module-adoption (demand-side consolidation, as of Apr 30 2026): 51% / 35% / 25% of customers run 6+ / 7+ / 8+ modules — a quarter of the base has voluntarily standardized 8+ functions on one platform (the buyer-pull proof; see Book Ch 03). Kurtz: "best positioned… for the AI age." (The post-outage recovery is complete on the numbers — a clean platform compounder; reinforces the valuation two-tier where durable AI-SOC leaders hold premium multiples.) | | Zscaler | Q4 FY26 (quarter ended Jul 31 2026, reported Sep 3 2026): revenue $898.2M, +25%; ARR $3,771M, +25%, of which $246M was net new ARR in the quarter, net new growing 24%. Non-GAAP income from operations $218.4M, a record 24% of revenue, against a GAAP operating loss of $(15.5)M; GAAP net loss $(3.4)M ($(0.02) per diluted share) against non-GAAP net income of $198.2M ($1.19); deferred revenue $2,926M, +19%. Full-year FY26 revenue $3,353M, +25%, non-GAAP operating margin 23%, free cash flow $779M at a 23% margin. FY27 guidance: ARR $4.396–4.426B (+16.6–17.4%), revenue $3.908–3.938B (+16.6–17.5%), non-GAAP operating income $924–932M (+21%), non-GAAP EPS $4.86–4.90, free-cash-flow margin 23.0–23.5%; Q1 FY27 revenue $935–939M, about +19%.

This is the second instance of the acquired-versus-organic test on this page, and the only one where the company published the adjustment itself. Zscaler disclosed that Red Canary contributed $141M of ARR, and that excluding it ARR grew 20% to $3,630M with net new ARR up 17% rather than 24%; the same adjustment on the full year takes revenue growth from 25% to 20% ($3,209M). Palo Alto disclosed the acquired ARR but left the adjusted growth rate to be derived; Zscaler printed both numbers. The adjustment changes how the FY27 guide reads. Against the reported 25%, guided ARR growth of about 17% at the midpoint is a ~8 point deceleration. Against the 20.3% the company itself calls organic, it is ~3 points. The guide is a step down either way, but most of the apparent severity is the Red Canary contribution leaving the growth rate and entering the base — the same mechanism, on a much smaller scale, that moves Palo Alto from +63% to a guided +22–23%.

The quarter's least-discussed number is the cash flow, and it is an AI-infrastructure number. Free cash flow fell to $60.8M, a 7% margin, from $171.9M and 24% a year earlier — not on weaker operations (cash from operations rose to $279.3M) but on capex and capitalized internal-use software of $218.5M against $78.7M. Purchases of property and equipment alone ran $199.8M in the quarter against $60.0M. Across the full year capex rose 69%, from $164.3M to $277.3M, while FY27 free-cash-flow margin is guided to hold at 23.0–23.5%. A security vendor whose model has always been that someone else owns the datacenter is now carrying the AI build in its own investing line, and the guide says it expects to absorb it without giving up cash margin. Balance-sheet effect of the FY26 acquisitions: goodwill $418M → $1,218M and acquired intangibles $47M → $214M, against $918M of cash paid for acquisitions net of cash acquired. (Panel placement and the organic comparison across all four names: 12a.)

Prior: Q3 FY26 (ended Apr 30 2026, reported May 26 2026): revenue $850.5M (+25%); ARR $3,525M (+25%, +21% ex-Red Canary MDR tuck-in), net new ARR $166M in-quarter; non-GAAP operating margin an all-time-high 23%; FCF $136M (+14%). FY26 guide: revenue $3.33–3.34B (~24.6%), ARR $3.74–3.75B (~24%). Three pillars: AI Security, Zero Trust Everywhere, Data Security; momentum in AI Protect; partnered with OpenAI. Chaudhry: Zero Trust SASE "never more essential" against frontier-model/agent threats. | | Fortinet | Q2 2026 (quarter ended Jun 30, reported Jul 29 2026): revenue $2,047.9M (+26%), with product revenue $773.0M (+52%) and service revenue $1,274.9M (+13.7%, derived); billings $2,372.1M (+33%); non-GAAP operating margin 38.0% (GAAP 33.7%), up ~490bps; free cash flow $965.6M (adjusted $995.9M) against $284.1M a year earlier; non-GAAP diluted EPS $0.90 (+41%). Rule of 40 ≈ 64 — the highest in the reporting cohort, and it is carried by the firewall refresh rather than by SASE: product revenue growing at twice the total rate is a hardware-cycle signature. FY26 guide raised to revenue $8.02–8.18B, billings $9.35–9.55B, non-GAAP EPS $3.41–3.47. Announced a strategic collaboration with Intel to co-develop the SP6 security processor — supply-chain diversification on the silicon that differentiates the appliance line — plus FortiSOC, the FortiGate 1200G/FortiSASE Outpost "SASE firewall" positioning, and formal participation in Anthropic's Project Glasswing and OpenAI's Project Daybreak. Segment disclosure caution: Unified SASE and SecOps ARR/growth are NOT in the release and appear only on the call, so segment figures should not be sourced to the primary document. Prior: Q1 2026 (rep. May 6 2026): revenue $1.85B (+20% YoY), product revenue $645M (+41%); billings +31% YoY to $2.09B; non-GAAP operating margin 36% (GAAP 31%), record adjusted FCF $1.07B (+27%, ~57.6% margin — seasonally FCF-heavy Q1); Rule of 40 ≈ 56 (growth + op margin). Unified SASE = 25% of billings, +31% (vs. ~18% market CAGR; $79B TAM) as customers move off perimeter firewalls to zero trust. FortiOS 8.0 adds AI-driven security + quantum-safe. FY26 revenue guide raised to ~15% growth. Riding the firewall refresh + SASE pivot. | | SentinelOne | Q2 FY27 (ended Jul 31 2026, reported Aug 27 2026): revenue $292M (+21% YoY), above the top of guidance; ending ARR $1,218M (+22%) — the company through $1.2B; net new ARR $56M, a second-quarter record and a fifth consecutive quarter of positive net-new growth, but +4% YoY; RPO $1.7B (+45%) on longer durations and seven- and eight-figure commitments; $100k+ ARR customers 1,715 (+13%); record profitability, and the FY27 revenue outlook raised to $1.202–1.207B (~20% at the midpoint). Prior: Q1 FY27 revenue $276.7M (+21%), ARR $1,163M (+23%), $100k+ customers 1,702 (+17%). The cohort line is where the deceleration is visible: the $100k+ count added 13 customers sequentially against a 17%→13% growth step, while RPO accelerated to +45% — expansion within existing large accounts is carrying the quarter more than new large-logo capture. Emerging solutions (Purple AI, cloud, data) at ~half of ARR; persistent takeover speculation given AI differentiation and a sub-scale-versus-platforms position. Panel role: the clean organic control — no acquisition inside the comparison window, so the 22% is directly comparable to Palo Alto's derived ~34% organic rather than to its 63% reported (12a). |

Identity

Company	Cyber-relevant signal (2026)
Okta	Q2 FY27 (quarter ended Jul 31 2026, reported Aug 26 2026): revenue $805M, +11%; subscription revenue $793M, +12% (98.5% of total); RPO $4.86B, +17%, cRPO $2.59B, +14% (cRPO is 53% of RPO); GAAP operating income $107M (13.3% margin), more than double the year-ago figure; GAAP net income $116M, or $0.65 per diluted share, against $67M and $0.37; non-GAAP EPS $1.05 against $0.91; operating cash flow $234M and free cash flow $227M, both +40% year over year (FCF 28.2% of revenue). FY27 guide raised to $3.216–3.226B (+10–11%) from the $3.185–3.205B (+9–10%) given at Q1 — a midpoint move of about 0.8%, from $3.195B to $3.221B. Shares closed the session at $134.42 and traded above $160 after hours, roughly +19%. Demand is attributed to securing AI agents and other non-human identities, through Okta for AI Agents and Auth0 for AI Agents; the Permiso Security acquisition (agreed Jul 30 2026) closed alongside the print, adding runtime identity threat detection and the P0 Labs research team. Panel role: a transaction inside the calendar but outside the accounts. Permiso was agreed one day before the quarter ended and closed after it, so no acquired contribution enters the reported figure and the +11% is organic as reported; the contribution begins in Q3 FY27. Okta is also the one name in the quarter-ended-Jul-31 panel that publishes no ARR, so it joins that comparison on revenue rather than on ARR (12a). The scaled, cash-generative, low-growth end of identity, now re-rating on agentic-identity demand — see 03a, 11. Prior quarter for trend: Q1 FY27 (ended Apr 30 2026) revenue $765M, +11%; RPO $4.719B, +16%; cRPO $2.499B, +12%; non-GAAP operating margin 25.0%; free cash flow $271M.
SailPoint	Q2 FY27 (quarter ended Jul 31 2026, reported Sep 9 2026): ARR $1,231M, +25%; SaaS ARR $847M, +36% (68.8% of total ARR); revenue $308.8M, +16.8%, subscription $295.2M, +19.1%. Inside subscription the mix is doing all the work: SaaS revenue $193.9M, +33.9% (62.8% of total revenue), against maintenance and support −8% and term subscriptions −3%, which together are $91.7M, or 29.7% of revenue, and shrinking. RPO $1.9B, +30% and cRPO $931M, +27%, both growing faster than revenue. GAAP operating loss $(59.0)M, (19.1)% of revenue, widened from $(40.8)M; adjusted income from operations $62.8M, a 20.3% margin against 20.4% a year earlier; adjusted gross margin 77.4%; free cash flow $37.4M, 12.1% of revenue and down 18.6% year over year while revenue grew 16.8%. SaaS customer count +16%, with ARR per SaaS customer above $400,000, +17%. Guidance: Q3 ARR $1,288–1,292M (+24%), revenue $326–330M (+16–17%); FY27 ARR $1,375–1,385M (+22–23%), revenue $1,265–1,275M (+18–19%), adjusted operating margin 18.7–19.3%, adjusted EPS $0.30–0.34. The disclosure that matters is a new one: AI-driven ARR. SailPoint put it above $70M — 5.7% of total ARR — and reiterated an FY29 target of at least $800M of AI-driven ARR against at least $2.1B of total ARR, or 38.1%. Reaching it requires the AI line to multiply 11.4× while total ARR grows about 1.7× from here, so almost all incremental ARR over three years is assumed to carry an AI component. Three figures support the pricing half of that: AI-driven solutions were more than 30% of net new ARR in the quarter, existing customers who adopted one increased annual spend by more than 60%, and more than two-thirds of migrations included an AI solution. The counterweight is in the same release — ARR grew 25% while revenue grew 16.8%, a gap of 8.2 points, so the AI attach is visible in bookings and not yet in the income statement, and free cash flow fell. ARR growth is also decelerating on the company's own numbers: +26% at Q1, +25% at Q2, +24% guided at Q3, +22–23% guided for the year. Consideration for the Entro Security purchase appears in this filing at $122.6M, against roughly $200M reported at announcement (11). See 03a.
CyberArk	Pre-close Q3 2025 revenue $342.8M, +43% (subscription-led); flagged securing agentic AI as a "tremendous opportunity." Acquired by Palo Alto ($25B), closed Feb 11, 2026 — the identity-inflection deal.

Exposure management

Company	Cyber-relevant signal (2026)
Tenable	Q2 2026 (quarter ended Jun 30, reported Jul 29 2026): revenue $268.5M, +8.6%; GAAP income from operations $12.4M (4.6% margin, from a $7.4M loss); non-GAAP operating margin 24.7%, up 540bps; non-GAAP EPS $0.51 (from $0.34); unlevered FCF $45.3M; 381 new enterprise platform customers and 32 net-new six-figure customers; repurchased 5.2M shares for $100.0M. Tenable One at 50% of new business. FY26 guide raised to $1.075–1.081B revenue and $258–264M non-GAAP operating income. The scaled pure-play: high-single-digit growth funding a fast margin build.
Qualys	Q2 2026 (reported Aug 4 2026): revenue $182.2M, +11.0%; GAAP operating margin 34%, non-GAAP operating margin 44.7%; adjusted EBITDA $83.8M (46%); operating cash flow $59.6M, +77%; non-GAAP EPS $1.98 (from $1.68). Channel now 54% of revenue (from 49%), channel revenue +22% while direct was roughly flat. FY26 guide raised to $732–738M (+9–10%). The most profitable of the three exposure pure-plays and, on this quarter, also the fastest-growing — see 03k.
Rapid7	Q2 2026 (quarter ended Jun 30, reported Aug 2026) revenue $210.9M, −1.5%; ARR $824.0M, −2.0% — the ARR line is contracting. Non-GAAP op income $28.9M; FCF $31.9M; cash and securities $702.6M. Board approved a 2026 Restructuring Plan cutting ~12% of the workforce (Aug 7), $10–11M of charges, targeting a 20% non-GAAP operating margin in Q4 2026. FY26 guide: revenue $837–841M, ARR ~$812M at (3)%, non-GAAP op income $129–133M, FCF ~$130M. A growth-to-margin conversion at a vuln-management incumbent long cited as a take-private candidate — see 03k.

Network, web & data resilience

Company	Cyber-relevant signal (2026)
Cloudflare	Q1 2026 revenue +34%; 332k+ paying customers; agent-driven traffic doubled early 2026; launched Cloudflare Mesh to secure the AI-agent lifecycle. Security + AI-agent infrastructure convergence.
Check Point	Q2 2026 (quarter ended Jun 30, reported Jul 30 2026): revenue $674M, +1% — the slowest growth rate in the cohort by a wide margin; security subscription revenue $333M, +12%; RPO $2.6B, +7%; non-GAAP operating margin 39% (GAAP 27%); adjusted free cash flow $161M (24% of revenue) on operating cash flow of $170M, down from $262M; non-GAAP EPS $2.55 (+8%). The margin carries a one-off that must be stripped before it is compared: a $28M reduction in R&D expense under Israel's R&D tax-incentive law enacted Mar 30 2026, worth about 4.2 points of revenue — so the run-rate non-GAAP margin is nearer 35% and the Rule of 40 nearer 36 than the headline 40. Cash and securities $4,203M against $2,913M a year earlier, after $1.8B net proceeds from a $2B convertible note; $325M repurchased in the quarter against a $2B buyback expansion authorized May 11 2026. Positioning on an "AI Network Firewall" and an "AI Defense plane" under Nadav Zafrir. No guidance is given in the release — Check Point publishes ranges only on the call — and neither billings nor ARR is disclosed. The profile is a mature, cash-generative franchise buying back stock into a flat top line, which is the balance-sheet signature that precedes either a strategic repositioning or an approach. Prior: Q1 2026 revenue $668.4M, +5% (slight miss); security subscriptions +11% to $323.2M (high-margin recurring); Infinity platform; achieved GovRAMP. Mature, profitable, slower-growth.
Rubrik	Q2 FY27 (ended Jul 31 2026, reported Aug 27 2026): revenue $427.3M, +38% (+43% normalized for material rights) — the fastest top-line growth in the cohort; subscription revenue $407.2M, +37%; Subscription ARR $1,660.9M, +33%, with Cloud ARR $1.48B, +39%; subscription-ARR contribution margin 14.0% from 9.4%; non-GAAP operating income $33.5M (~7.8% margin, derived) against a $(4.4)M loss; free cash flow $65.7M (15% margin); non-GAAP diluted EPS $0.20 against a GAAP loss of $(0.30); 3,084 customers above $100k Subscription ARR, +23%. FY27 guide: Subscription ARR $1,880–1,885M, revenue $1,685–1,693M, FCF $323–333M, non-GAAP EPS $0.47–0.53. Launched Rubrik AI and Rubrik Agent Cloud for Anthropic's Claude Code; identity capabilities built on the Strata.io acquisition; a £375M UK investment with London as EMEA headquarters. Net retention was NOT disclosed — the release defines the metric and publishes no value, so any figure quoted for it is an estimate. The growth is real but the margin is the thinnest in the cohort, which is the cyber-resilience trade: category expansion bought with operating leverage deferred. Panel role: the name the acquired-versus-organic adjustment cannot reach. The Strata acquisition (announced Jun 9 2026, terms undisclosed — 11) falls inside the comparison window and no revenue or ARR contribution was disclosed, so the 33% cannot be separated into acquired and organic. With net retention also undisclosed, the two substitute measures the comparison would fall back on reduce to one — margin — where this is the lowest of the six names reporting the quarter (12a). Prior: Subscription ARR $1.46B, +34% (FY26); Q1 FY27 $1.57B, +32%. Positioning as "agentic cyber resilience — data, identity, and AI in one architecture" + an AI-governance push. Backup/recovery re-cast as cyber resilience.
Varonis	Q2 2026 (quarter ended Jun 30, reported Jul 28 2026): revenue $180.0M, +18.3% (derived); SaaS ARR $726.0M, +52% headline but +25% excluding conversions — and the ex-conversions figure is the comparable one, which is also the basis management guides on. SaaS revenue $171.7M against $105.9M; term license down to $4.2M from $32.4M and maintenance to $4.1M from $13.9M, both explicitly attributed to conversion, so the SaaS transition is effectively complete and the headline ARR growth is largely conversion mechanics rather than new demand. Non-GAAP operating income $3.7M (~2.1% margin, derived) from a $(1.9)M loss, against a GAAP operating loss of $(40.6)M; non-GAAP diluted EPS $0.04 against a GAAP $(0.41). First-half free cash flow fell to $69.1M from $82.7M despite the ARR growth, which is the tension on this name. FY26 guide: SaaS ARR $819–850M (+28–33%, or +20–21% ex-conversions), revenue $735–739M, non-GAAP operating income $11–13M. Atlas AI Security Platform, Interceptor and Database Activity Monitoring cited as drivers, with deepened Anthropic Claude integrations and Cursor support. The cash-flow statement shows $113.6M paid for acquisitions in 1H26 with goodwill up ~$80M, and the release does not name the target — an open item. Prior: Total SaaS ARR $683.2M, +69% (29% ex-conversions) amid on-prem→SaaS transition; FY26 guide $814–845M SaaS ARR; launched Atlas AI security platform. Data-security incumbent re-rating on AI.

Consumer cyber safety

Company	Cyber-relevant signal (2026)
Gen Digital (Norton, Avast, LifeLock)	FY26 revenue $5.0B, growth accelerating to double digits (Q4 +27% to $1.28B); 79M paid customers (+11M YoY); launched Norton Neo AI browser security. Consumer cyber + the MoneyLion fintech adjacency.

Cross-read — what the calls say together

AI security is the universal growth vector. Every name is monetizing AI security (Prisma AIRS, Charlotte AI, Purple AI, Zscaler AI Protect, Gemini Agentic Defense, Microsoft Security Copilot, Varonis Atlas, Okta for AI Agents / Auth0 for AI Agents) — confirming AI Security as the migrating profit pool. Okta's Q2 FY27 print (Aug 26 2026) is the clearest case of the theme moving the equity rather than the narrative: an 11%-growth business, guidance raised by roughly 0.8% at the midpoint, and the shares up about 19% after hours on agentic-identity demand.
Platform NRR is the compounding engine — and the ~120% proof line is demanding. Where disclosed, platform/land-and-expand retention is what the market pays for, but even the leaders press against the ~120% second-product threshold rather than clearing it easily. Most-recently-reported net retention: PANW (NGS) ~120% (Q3 FY26) · CrowdStrike DBNR ~119% (Q1 FY27) · Zscaler DBNRR ~114% (Q3 FY26) · SentinelOne ~110% ($100K+ cohort) · Okta ~107% (Q1 FY27) — periods ended ~Apr 30 2026; definitions vary by vendor. Sustained >120% = "land-and-expand works" (a real second-product engine); a platform story at ~107% has not yet built one (Unit Economics, Valuation; see Book Ch. 19).
Legacy is being displaced — but the incumbent SIEM franchise is not draining as fast as the flat quarters implied. SIEM is the battlefield: CrowdStrike/Microsoft/Google displacing Splunk/QRadar. Cisco's own security revenue ran ~flat YoY through Q3 FY26 (down 4% two quarters earlier) mid-transition, then returned to +14% in Q4 FY26 with Splunk named as a growth contributor — evidence that the model-change drag on an acquired SIEM is a multi-year transition cost rather than, on this record, a permanent loss of the pool (Sub-Segment Deep Dives, Economics, SecOps & SIEM; see Ch. 4).
The reset is real even for winners. PANW fell on a beat-and-raise; multiples re-rated despite ~14% sector growth (12, 03).
M&A signal: the labs/hyperscalers (Microsoft, Google+Wiz) are aggregating; sub-scale AI-differentiated pure-plays (SentinelOne takeover talk) are origination; identity (CyberArk) and cyber-resilience/data (Rubrik, Varonis) are re-rating. Feeds Deals.
Rule of 40 is a scale phenomenon. Stack growth + non-GAAP operating margin for the spring-2026 prints and the scaled leaders cluster half again above the line — PANW ~58 (+31%/27%) · Fortinet ~56 (+20%/36%) · CrowdStrike 50 (+26%/24%) · Zscaler ~48 (+25%/23%) — while the smallest, least platform-complete pure-play sits below it: SentinelOne ~25 (+21%/4%), its margin only now turning positive. The premium (Valuation) is paid to the cluster above the line, not the category in the abstract. (Charted as the Rule-of-40 scoreboard in Book Ch. 5 — Unit Economics of Defense; see also Unit Economics.)
An acquired growth rate has a term, and the term is four quarters. A large acquisition raises the reported growth rate for exactly as long as the prior-year comparison predates the close; after that the acquired revenue sits in both halves of the comparison and stops contributing to the rate. Palo Alto's FY26 close is the sector's cleanest instance because both readings appear in one release: NGS ARR +63% reported, +22–23% guided for FY27, with Q1 FY27 still guided to +63% because that quarter alone still laps a pre-CyberArk base. The implication for the comp table is that a growth rate is only comparable across names once the acquired contribution is stripped — on that basis Palo Alto grew NGS ARR ~34%, not 63% (Public Trading Comps). The mirror case is on this page already: Cisco's security line ran flat for several quarters after Splunk while the transition was absorbed, then returned to +14%. Acquisition flatters the rate first and burdens it later, and neither movement is evidence about the underlying business.

Sources

Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.