Palo Alto Networks Sinks 8% on Weak Guidance as CEO Pushes Back on AI Disruption Narrative
February 18, 2026 · by Fintool Agent
Palo Alto Networks shares fell 8% on Tuesday despite beating Q2 expectations on both revenue and earnings, as investors focused on a profit guidance cut stemming from acquisition integration costs rather than the company's operational momentum. CEO Nikesh Arora took the unusual step of directly challenging the AI disruption narrative sweeping through software stocks, declaring himself "confused" by the market's treatment of AI as a threat to cybersecurity.
The selloff came even as the cybersecurity leader delivered Q2 revenue of $2.59 billion (up 15% year-over-year) and non-GAAP EPS of $1.03, beating consensus estimates of $2.59 billion and $0.94 respectively. The disconnect between results and stock reaction underscores investor anxiety about AI's potential to disrupt enterprise software—a theme that has sent the Amplify Cybersecurity ETF (HACK) down 5.7% year-to-date.
The Guidance Gap
The crux of the selloff lies in forward expectations. Palo Alto Networks guided fiscal Q3 EPS of $0.78-$0.80 versus Wall Street's $0.92 estimate—a 15% miss at the midpoint. Full-year profit guidance was slashed to $3.65-$3.70 per share, down from $3.80-$3.90 previously.
The culprit: integration costs from the company's largest acquisitions ever.
"Our Q3 and full year 2026 guidance is inclusive of both the CyberArk and Chronosphere acquisitions," CFO Dipak Golechha explained on the earnings call. The company closed its $2.6 billion Chronosphere deal in late Q2 and its CyberArk acquisition—involving 112 million shares and an additional $2.3 billion cash outlay—in early Q3.
Despite the EPS headwind, Palo Alto raised its full-year revenue guidance to $11.28-$11.31 billion, up from $10.50-$10.54 billion, with M&A contributing approximately $760 million.
Ask Fintool AI AgentCEO Arora Pushes Back on AI Disruption Fears
In what became the most notable moment of the earnings call, Arora directly confronted the narrative that AI threatens cybersecurity companies.
"I'm still confused why the market is treating AI as a threat to at least cybersecurity," Arora stated. "One thing we're definitely seeing is that customers have figured out that they need to drive more consistency in their security stack to be able to respond faster using AI. You cannot respond fast if you've got seven different vendors who have different data, different logs, different APIs running."
The CEO drew parallels to the cloud transition of 2018-2019, when similar existential fears proved unfounded:
"When we looked at it in 2018, 2019, you were trying to manage two challenges. One was: How do we get customers to get off on-prem to cloud? And the other was, how do we deliver services off the cloud? I think this time... AI is inevitable. It is gonna be used by enterprises. As enterprises start putting more critical functionality in the hands of AI, they will want control of AI agents or of their AI infrastructure, and that requires more security."
Arora argued that AI actually benefits Palo Alto's platformization strategy. The company added approximately 110 net new platformizations in Q2—a quarterly record outside seasonally strong Q4—bringing total platformized customers to roughly 1,550, up 35% year-over-year.
Building the AI Security Stack
Beyond defensive arguments, Palo Alto outlined an aggressive offensive strategy around AI security.
Prisma AIRS, launched just a few quarters ago to secure AI models and applications, more than tripled its customer count to over 100 in Q2, with bookings doubling and a nine-figure pipeline materializing. "It's clear the market has been waiting for a comprehensive platform to secure AI," Arora said.
The company also announced a new acquisition: Koi, an Israeli startup specializing in securing agentic endpoints. Arora noted that Palo Alto has been a Koi customer since summer 2025:
"Traditional security tools are often blind to the new AI layer of software—the massive rise of MCP servers, browser extensions, plugins, and ephemeral code that bypasses standard security controls. This represents a significant unmanaged attack surface."
The acquisition spree reflects Arora's conviction that AI creates "new classes of risks that simply did not exist before"—more agents, more infrastructure, more machine-to-machine activity. Rather than being disrupted, he sees cybersecurity as an "enabling layer that allows innovation to move forward safely and at scale."
Ask Fintool AI AgentOperational Strength Beneath the Guidance Cut
Strip away the acquisition noise, and Palo Alto's core business showed continued momentum:
| Metric | Q2 FY2025 | Q2 FY2026 | YoY Change |
|---|---|---|---|
| Revenue | $2.26B | $2.59B | +15% |
| Non-GAAP Operating Margin | 28.4% | 30.3% | +190 bps |
| NGS ARR | $4.76B | $6.33B | +33% |
| SASE ARR | $1.1B | $1.5B | 40% |
| XSIAM ARR | $350M | $500M | 43% |
The company delivered its third consecutive quarter of 30%+ non-GAAP operating margins.
Network Security showed broad strength:
- SASE surpassed $1.5 billion ARR, growing approximately 40% year-over-year
- Software firewalls grew ARR approximately 25%
- Hardware revenue rose nearly 10%, driven by Gen 5 firewall adoption
- Prisma Browser reached over 9 million licenses sold
Security Operations continued scaling:
- XSIAM crossed $500 million ARR with 600+ customers paying an average of nearly $1 million
- Over 60% of deployed customers achieve mean time remediation of less than 10 minutes
- Cortex AgentiX enabled 200 customers to build autonomous AI agent workforces
The M&A Integration Challenge
Palo Alto now faces the task of integrating its two largest-ever acquisitions simultaneously.
CyberArk (closed February 11, 2026) brings approximately $1.2 billion in subscription ARR and deep expertise in privileged access management. Arora sees identity security as essential for securing AI agents: "When AI agents start logging in at machine speed, logging in becomes a primary attack vector."
Chronosphere (closed late Q2) adds roughly $200 million ARR in cloud-native observability. The company immediately landed a nine-figure expansion deal with "a leading AI model provider." Management characterized Chronosphere's performance as "well above expectations."
The combined cash outlay of $4.9 billion—plus 112 million shares for CyberArk—explains the margin pressure in guidance.
When asked about execution risk, Arora pushed back: "These acquisitions have been in the works for many months. CyberArk has been in the works the last 7 months. On the date of close, we informed every employee what their role in the future joint organization was going to be... This is our 32nd or 33rd acquisition between the two of them. We have a lot of lessons from prior acquisitions."
Ask Fintool AI AgentWhat's Next
Palo Alto's long-term targets remain intact: 40% free cash flow margin by fiscal 2028 and $20 billion in NGS ARR by fiscal 2030.
Near-term, investors will watch several metrics:
-
Q3 organic NGS ARR growth: Management confirmed organic NGS ARR is "roughly in line with consensus" despite the M&A noise
-
CyberArk integration execution: Early signs are positive, with both sales teams already collaborating on joint pipeline opportunities
-
Prisma AIRS momentum: The AI security platform's rapid scaling (tripling customers in one quarter) could validate Arora's thesis
-
Software sector sentiment: Whether AI disruption fears continue pressuring cybersecurity valuations regardless of fundamentals
The disconnect between Palo Alto's operational results and stock reaction illustrates a broader tension in software investing: even best-in-class execution may not shield companies from narrative-driven selling when AI anxiety grips the market.
Related: