# Key Metrics in Palo Alto Networks Earnings: NGS ARR vs Billings

Source: https://cluenex.com/learn/fundamental-analysis/metrics-matter-most-palo-alto-networks/
Publisher: Cluenex (https://cluenex.com)
Updated: 2026-11-03

## Short answer

In Palo Alto Networks earnings, Next-Generation Security ARR and Remaining Performance Obligations matter far more than headline billings. Billings are distorted by multi-year contract discounting and deferred payment terms used to win platform consolidation deals. Tracking annualized recurring revenue growth alongside net new platform customers shows the real pace of adoption.

## Key takeaways

- Next-Generation Security (NGS) ARR measures the annualized value of active modern cloud and software contracts, filtering out erratic multi-year invoice timing.
- Headline billings became an unreliable growth gauge when Palo Alto Networks started offering deferred invoicing to entice enterprises off rival tools.
- Remaining Performance Obligations (RPO) show total contracted revenue waiting to be recognized over future quarters.
- Platformization deals trade lower cash collection upfront for higher contract value and lower customer churn over three to five years.
- Ahead of earnings on November 12, 2026, Palo Alto Networks trades at $351.72, up 90.9% year-to-date compared to 10.2% for the S&P 500.

## Why billings mislead in cybersecurity earnings

Headline billings do not show the underlying health of modern cybersecurity companies because multi-year contract structures and payment terms distort the cash received in any single quarter.

For years, Wall Street judged security software companies by billings, calculated as revenue plus the net change in deferred revenue. If a company signed a three-year contract for $300,000 and collected the entire amount on day one, billings showed $300,000 immediately, even though GAAP accounting required spreading the recognized revenue across thirty-six months. In an era where customers paid multi-year software bills upfront, billings served as a practical proxy for commercial bookings.

That dynamic changed when Palo Alto Networks shifted its go-to-market model toward platform consolidation. To persuade enterprise clients to abandon competitors like CrowdStrike or Zscaler before existing licenses expired, Palo Alto Networks offered extended onboarding periods, platform credits, and deferred invoicing schedules. Instead of paying three years upfront, customers could commit to a multi-year deal while delaying invoices until older competitor software was phased out.

When a customer signs a massive contract but pays annually or defers payment for six months, headline billings show little to no cash upfront. An investor relying strictly on quarterly billings might conclude that demand is collapsing, even if total contract commitments reached all-time highs. This discrepancy makes traditional billings one of the most misleading numbers on the earnings release.

## What is Next-Generation Security ARR?

Next-Generation Security Annualized Recurring Revenue, or NGS ARR, measures the annualized run rate of all active cloud, software, and subscription contracts as of the final day of the quarter.

NGS ARR strips away noisy payment schedules to reveal pure product adoption. Palo Alto Networks defines this metric to include its modern product suites: Prisma Cloud, Prisma SASE, Cortex detection and automation, and modern software firewalls. It deliberately excludes legacy hardware appliance sales, traditional attached hardware support, and one-time professional service engagements.

To calculate NGS ARR, the company takes the total contract value of all active modern software subscriptions and annualizes the recurring run rate. If an enterprise signs a contract utilizing Cortex XSIAM and Prisma SASE worth $1.2 million per year, that contract contributes exactly $1.2 million to NGS ARR, regardless of whether the customer pays monthly, annually, or through deferred financing.

By tracking NGS ARR from quarter to quarter, investors can see whether cybersecurity teams are actually turning on Palo Alto Networks cloud tools. The metric provides an apples-to-apples comparison across subscription cycles, removing the lumpiness caused by billing concessions.

| Metric | What It Measures | Why It Can Mislead |
| :--- | :--- | :--- |
| **Headline Billings** | Revenue plus the change in deferred revenue during the quarter | Distorted by payment terms, multi-year discounting, and deferred invoices |
| **GAAP Revenue** | Value of software and services delivered in the current quarter | Lagging indicator that amortizes multi-year software contracts over time |
| **NGS ARR** | Annualized run rate of active modern cloud and software contracts | Excludes legacy hardware and one-time service fees |
| **Remaining Performance Obligations (RPO)** | Total committed contract value scheduled for recognition in future quarters | Long-dated contracts can inflate headline numbers without near-term revenue |

## How platformization changes the numbers

Platformization is a corporate sales strategy where an enterprise replaces fragmented point solutions by bundling network, cloud, identity, and security operations under a single vendor architecture.

Palo Alto Networks introduced this approach because large enterprises previously managed dozens of separate security vendors. A company might have used one vendor for endpoint protection, another for firewalls, and a third for identity verification. In our guide on [why CrowdStrike and Palo Alto trade at high valuations](/learn/fundamental-analysis/crowdstrike-palo-alto-have-such-high/), we examined how software moats expand as enterprises standardize their workflows onto unified platforms.

To win these platform deals, Palo Alto Networks often offers financial incentives. Management may grant an enterprise free software credits for six months while the customer burns down an existing contract with a rival. The financial effects ripple through the financial statements:

1. **Near-term revenue growth moderates:** Because early platform months may carry discounted or free promotional terms, recognized revenue does not immediately spike.
2. **Operating margins face initial pressure:** Sales and engineering teams work to deploy the tools before full-rate billing begins.
3. **Long-term contract value surges:** Once the customer unifies operations on the platform, customer retention typically exceeds 115% to 120%, because ripping out an entire security architecture is technically disruptive.

Investors evaluating earnings should look at the number of net new platformizations added each quarter. When net platformizations climb, future high-margin subscription cash flow is being locked in, even if current-quarter GAAP revenue appears stable.

## Remaining Performance Obligations: The backlog indicator

Remaining Performance Obligations, or RPO, represents the total contracted future revenue that Palo Alto Networks has secured but not yet recognized on its income statement.

RPO is an audited GAAP disclosure found in quarterly SEC filings. It includes both deferred revenue (amounts already billed to customers but waiting to be recognized as software is delivered) and unbilled backlog (signed contracts that will be billed and recognized in upcoming quarters).

When evaluating RPO, divide the figure into two parts:

- **Current RPO (cRPO):** The portion of contracted backlog that the company expects to recognize as revenue over the next twelve months. This is the most reliable predictor of near-term revenue.
- **Long-term RPO:** Contract commitments scheduled for delivery two, three, or five years out.

If current RPO grows faster than total GAAP revenue, future revenue growth is set to accelerate as those contracts mature into billings. Conversely, if total RPO expands while cRPO slows down, customers may be signing longer contracts but delaying implementation. You can learn more about how contract timing impacts forward guidance in our guide on [what revenue guidance is and why stocks react](/learn/fundamental-analysis/revenue-guidance/).

## Recent PANW earnings results and market performance

Palo Alto Networks reports its next quarterly financial results on November 12, 2026. The company enters this report following four consecutive quarters of adjusted earnings beats.

In its fiscal period ended September 30, 2026, Palo Alto Networks reported diluted non-GAAP earnings per share of $1.02, beating Wall Street consensus estimates of $0.9959 by 2.42%. For the period ended June 30, 2026, EPS reached $0.85 against an expected $0.8112 (a 4.78% surprise). In the March 31, 2026 quarter, EPS was $1.03 versus $0.9605 (a 7.24% beat), and for the period ended December 31, 2025, EPS came in at $0.93 compared to $0.9081 (a 2.41% beat). Across the broader market, US companies beat earnings estimates at a healthy pace, as shown by the 74% (Cluenex data, https://cluenex.com/learn/data/earnings-beat-rate/) tracked in Cluenex Data.

As of November 2, 2026, Palo Alto Networks stock trades at $351.72. The stock has experienced short-term consolidation, falling 9.9% over the past week and 12.8% over the past month, while recording a 1.3% gain over three months. Over longer horizons, performance remains strong: PANW is up 90.9% year-to-date and 59.7% over the past twelve months. The stock trades 16.2% below its 52-week high of $419.91, well above its 52-week low of $141.67.

By comparison, the broader market has seen steady, moderate returns. As of November 2, 2026, the S&P 500 index stands at 7,541.40, having dropped 1.8% over the past week, 2.3% over the month, and 0.8% over three months. Year-to-date, the S&P 500 is up 10.2%, and it has gained 10.3% over the trailing twelve months, sitting 3.5% below its 52-week high of 7,818.93.

Among the 39 Wall Street analysts covering Palo Alto Networks, sentiment leans positive, with 31 buy ratings, 8 hold ratings, and 0 sell ratings. The average 12-month analyst price target is $414.03, ranging from a low of $300.00 to a high of $525.00. To understand how to weigh these estimates, read our primer on [what an analyst price target is and should you trust it](/learn/fundamental-analysis/analyst-price-targets-explained/). You can inspect the stock's full valuation history and business quality breakdown on its free [Palo Alto Networks public research page](/stocks/panw/).

## Where the metrics fail: Risks and limits

While NGS ARR and RPO provide clearer insight than headline billings, neither metric is immune to accounting limits or commercial friction.

First, acquisitions can artificially boost ARR. When a company acquires a target, it folds the acquired business's recurring revenue into its own reporting. Organic NGS ARR growth, which isolates internal product adoption from buyouts, must be separated from headline ARR additions. If organic expansion stalls while total ARR rises solely via mergers, core market demand may be softening.

Second, aggressive discounting can lower future contract profitability. By giving away promotional credits to win platformization deals, Palo Alto Networks secures high RPO at the expense of early cash conversion. If enterprise customers decide not to renew secondary platform modules once full pricing kicks in, the expected lifetime value of those contracts drops.

Third, large enterprise software companies carry valuation multiples that require sustained double-digit expansion. In the tech sector, companies frequently trade at elevated price-to-earnings multiples compared to traditional industries. For context, the technology sector maintains an average revenue growth rate of 13.0% (Cluenex data, https://cluenex.com/learn/data/sector-benchmarks/), making any sudden deceleration in annualized subscriptions an immediate trigger for multiple contraction. In our overview of [how to read an earnings report](/learn/technical-analysis/earnings-report/), we detail how mismatches between bookings and expectations can produce sharp price swings.

## What this means for you

For an investor managing their own portfolio through an individual brokerage account, earnings releases require a clear reading order.

Start by ignoring the first headline alert on your news app. Instant alerts focus almost exclusively on headline revenue and billings against consensus estimates, which often miss contract nuances. When Palo Alto Networks releases its report on November 12, open the investor presentation and review these specific checkpoints:

1. **Check the NGS ARR number:** Look for total NGS ARR and its year-over-year percentage growth. Note how much net new ARR was added during the quarter relative to management's full-year outlook.
2. **Inspect Current RPO (cRPO):** Check whether cRPO growth matches or exceeds headline revenue growth. A widening gap in favor of cRPO signals expanding future billings.
3. **Count the platformizations:** Track the net additions to the platform customer count. Increasing multi-platform customers confirms that clients are consolidating multiple tools onto Palo Alto Networks rather than using single point products.
4. **Review free cash flow margin:** Ensure that operating cash flow conversion remains healthy despite deferred billing terms, verifying that customers are paying their invoices over time.

Cluenex rates business quality on a scale of 0 to 10 across profitability, moat, growth, and balance sheet health, updating nightly from official SEC filings. Reviewing these underlying operational drivers keeps your focus on commercial competitive advantage rather than short-term headline noise.

## Questions people ask

### Why did Palo Alto Networks de-emphasize billings as a primary metric?

The company shifted focus because its platformization sales model includes deferred invoicing and transitional contract credits. These incentives lower near-term upfront cash collection without reducing the total committed contract value, making quarterly billings an inaccurate measure of underlying customer demand.

### What is the difference between NGS ARR and GAAP revenue?

GAAP revenue measures the value of products and services delivered during the current three-month quarter according to standardized accounting rules. NGS ARR measures the annualized contract value of all active next-generation cloud and software subscriptions running at the end of the quarter, providing a forward-looking run rate.

### What does a platformization mean for an enterprise customer?

A platformization occurs when an organization consolidates several disparate cybersecurity tools onto Palo Alto Networks across network, cloud, identity, or security operations. Customers typically agree to multi-year contracts across multiple product families in exchange for volume discounts and simplified vendor management.

### How does RPO predict future software sales?

Remaining Performance Obligations represent total contracted revenue that has not yet been earned. The current portion of RPO (cRPO) represents revenue legally committed to be recognized within the next twelve months, providing clear visibility into future baseline revenue.

## Sources

- [Palo Alto Networks, Inc. Form 10-K for Fiscal Year Ended July 31, 2026](https://www.sec.gov/edgar/browse/?CIK=0001327567)
- [What Is Cybersecurity Platformization?](https://www.paloaltonetworks.com/cyberpedia/what-is-cybersecurity-platformization)

Cite as: Cluenex. "Key Metrics in Palo Alto Networks Earnings: NGS ARR vs Billings." Cluenex Learn, updated Nov 3, 2026. https://cluenex.com/learn/fundamental-analysis/metrics-matter-most-palo-alto-networks/