Palo Alto Networks (PANW) Risk Factor Changes

We rely on data center facilities operated by third-party cloud service providers to host and operate our cloud-based products and services.

Our future success depends, in part, on our ability to continue to attract, retain, and motivate the members of our management team and other key employees.

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of the 2030 Notes or our common stock.

The Capped Calls may affect the value of the 2030 Notes and our common stock.

As of July 31, 2026, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2026 and may be suspended or discontinued at any time without prior notice.

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our bo…

The issuance of additional common stock in connection with financings, acquisitions, investments, our stock incentive plans, convertible notes, or otherwise will dilute the stock held by all other stockholders.

Securities class action litigation has often been brought against companies that experience periods of volatility in the market price of such company’s securities.

•major catastrophic events and geopolitical or economic uncertainty around the world; or

•regulatory developments in the United States or other jurisdictions;

•litigation involving us or our industry, and actions instituted by activist shareholders or others;

•news or events affecting investor perception of our industry, including reports of significant cyberattacks;

•inaccurate or unfavorable research reports about our business and industry, or reduced analyst coverage of our company;

•actual or anticipated changes in analyst or investor expectations, including as a result of our forward-looking statements or our failure to meet such expectations;

•actual or anticipated changes or fluctuations in our operating results, and whether our operating and/or financial results meet the expectations of securities analysts or investors;

•issuances or sales of our common stock, or of debt or securities convertible into or exchangeable for our common stock, including in capital-raising transactions or as consideration in connection with acquisitions;

•fluctuations in the trading volume of our shares or the size of our public float, including sales or repurchases of large blocks of our common stock and future sales by our directors, executive officers, employees, o…

•broader price and volume fluctuations in the stock market, and in particular the trading prices and volumes of technology companies and companies in our industry;

•announcements by us or our competitors of new products, subscriptions, technologies, commercial relationships, strategic partnerships, acquisitions, or similar events;

Our business is subject to regulation by various federal, state, local, and foreign governmental agencies, including agencies responsible for employment and labor laws, workplace safety, product safety, environmental…

Governmental authorities, certain investors, and other stakeholders continue to focus on, set and revise, expectations relating to corporate responsibility matters, both in the United States and internationally.

Our reputation and business could be negatively impacted by corporate responsibility matters, including our reporting of such matters.

Our estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that may change or prove to be incorrect and, as a result, our operating results may differ from our p…

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the oth…

Moreover, new legislation affecting the scope of personal data and information, especially relating to IP addresses, machine identification, AI and machine learning, location data, health information, and other inform…

We and our customers could face risk of regulatory investigations, enforcement actions, private litigation (including class action litigation), and adverse publicity, including reputational damage and loss of customer…

We are also subject to obligations relating to personal data and data protection by contract and self-regulatory and industry standards.

The GDPR restricts transfers of personal data outside of the European Economic Area (“EEA”) (or, in the case of the U.K.

A wide variety of laws, regulations, industry standards, contractual requirements, and other obligations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data…

We may incur significant costs to comply with privacy and data protection laws and other requirements, and, if we fail to comply, we could be subject to government enforcement actions, private litigation, and adverse…

Many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency circumstances, which has occurred as a result of reg…

We have business operations in Israel, which meaningfully expanded as a result of the acquisition of CyberArk, and we intend to continue growing our presence in Israel.

Our operating expenses incurred outside the United States and denominated in foreign currencies are generally increasing and are subject to fluctuations due to changes in exchange rates.

Our sales contracts are primarily denominated in U.S.

•political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics, macroeconomic challenges, terrorist activities, the Russia-Ukraine war, tensions between China and Taiwan, t…

Our ability to successfully grow our business will depend to a significant extent on our ability to expand our operations and customer base worldwide.

We generate a significant amount of revenue from sales to distributors, resellers, and end-customers outside of the United States, and we are therefore subject to a number of risks associated with international sales…

We depend on manufacturing partners, primarily our EMS provider, Flex, to manufacture our hardware product lines.

In addition, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title.

The terms of many open source licenses have not been interpreted by United States courts, and these licenses could be construed in a way that imposes unanticipated conditions or restrictions on our ability to commerci…

Our competitors and others may have significantly larger and more mature patent portfolios than we have, and litigation has involved and will likely continue to involve patent-holding companies or owners who have no r…

Companies in the enterprise security industry own large numbers of patents, copyrights, trademarks, domain names, and trade secrets and frequently enter into litigation based on allegations of infringement, misappropr…

After our products and subscriptions are deployed, our end-customers depend on our technical support services and those of our channel partners.

In addition, our classifications of application type, virus, spyware, vulnerability exploits, data, or URL categories may falsely detect and act on threats that do not actually exist.

The limitation of liability provisions in our standard terms and conditions may not fully or effectively protect us from claims as a result of applicable laws or unfavorable judicial decisions.

Our products and subscriptions may be misused by end-customers or third parties.

Defects or errors in our products or software, or migrations or updates, could result in a failure to effectively update end-customers’ hardware, software, and products or otherwise cause problems in our customers’ ha…

Because our products and subscriptions are complex, they have contained and may contain design or manufacturing defects, vulnerabilities, or errors that are not detected until after deployment.

A significant security breach or incident suffered by us or our third-party service providers could materially impact the confidentiality, integrity, or availability of our networks and products, or networks secured b…

A significant network or data security incident may materially impact our reputation, financial condition, and operating results.

The rapid evolution of AI, including current and future government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets ev…

We have incorporated, and are continuing to develop and deploy, AI into many of our products, solutions, and business operations.

Issues in the development, deployment, or use of AI may result in reputational harm, legal liability, and could adversely affect our business and operating results.

Furthermore, we may require additional funds to respond to business challenges, including the need to develop new features to enhance our portfolio, improve our operating infrastructure, or acquire complementary busin…

In addition, we expect that the CyberArk acquisition will result in increased competition, including as a result of our entry into a new product category.

Our success, including with respect to realizing the anticipated benefits and synergies from the CyberArk acquisition, will depend, in part, on our ability to manage our expansion, which poses numerous risks and uncer…

Our recent CyberArk acquisition has expanded the scope and size of our business by adding substantial assets and operations to our existing business.

As a result of the CyberArk acquisition, the scope and size of our business have substantially changed, which resulted in certain incremental risks, including increased competition.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, each of which could adversely affect our financial condition or the market price of our common stock…

If we are unsuccessful at integrating past or future acquisitions in a timely manner or at all, our revenue and operating results could be adversely affected.

Some of our competitors have or may attain greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

•independent vendors that may offer a mix of security products, such as Check Point Software Technologies Ltd., CrowdStrike Holdings, Inc., Delinea, Inc., Fortinet, Inc., Okta, Inc., SailPoint Technologies, Inc., and…

•large companies that incorporate security or observability features in their products, such as Alphabet Inc., Cisco Systems, Inc., and Microsoft Corporation, or those that have acquired, or may acquire, security vend…

The industry for enterprise security products and the other spaces in which we have offerings is intensely competitive, and we expect competition to increase in the future from established competitors and new market e…

We face intense competition and we may lack sufficient financial or other resources to maintain or improve our competitive position.

Sales to government entities are subject to a number of risks.

Most of our sales are made on an open credit basis, and we have also experienced demands for customer financing and deferred payments due to, among other things, macro-economic conditions.

Training and programs provided to our channel partners to assist them in selling our products, subscriptions, and support offerings may not be effective or utilized.

A substantial portion of our revenue is generated by sales through our channel partners, including distributors and resellers.

We rely on our channel partners to sell a substantial portion of our products, including subscriptions and support, and if these channel partners fail to perform, our ability to sell and distribute our products and su…

The sales prices for our products, subscriptions, and support offerings may decline for a variety of reasons, including competitive pricing pressures, discounts, changes in our product mix, anticipation of new offerin…

Subscription and support revenue accounts for a significant portion of our revenue, comprising 80% of total revenue in fiscal 2026, 81% in fiscal 2025, and 80% in fiscal 2024.

Sales to large enterprise end-customers involve risks not typically present with smaller entities, including longer sales cycles, the risk that substantial resources may be spent on a potential end-customer that does…

Our future success depends, in part, on our ability to expand the deployment of our portfolio and new offerings with existing end-customers, especially large enterprise customers, including through our platformization…

If we are unable to sell new and additional products, subscriptions, and support offerings to existing end-customers or attract new customers, especially large enterprise customers, our future revenue and operating re…

Our operating results have fluctuated in the past, and will likely continue to fluctuate in the future, as a result of a number of factors, many of which are outside of our control, including those described in this R…

Our operating results may vary significantly from period to period, including due to seasonality, which makes our results difficult to predict and could cause our results to fall short of expectations.

In addition, we anticipate that our operating expenses will continue to increase as our business grows.

We have experienced revenue growth rates of 24% and 15% in fiscal 2026 and fiscal 2025, respectively.

We may not be able to successfully implement, scale, or manage improvements to our systems, processes, and controls in an efficient or timely manner, and our existing systems, processes, and controls may not prevent o…

We have experienced growth and increased demand for our products and subscriptions over recent years.

We operate globally, and our business and revenues are impacted by global economic and geopolitical conditions.

•The Capped Calls may affect the value of the 2030 Notes and our common stock.

•The issuance of additional common stock in connection with financings, acquisitions, investments, our stock incentive plans, convertible notes, or otherwise will dilute the stock held by all other stockholders.

•Our estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that may change or prove to be incorrect and, as a result, our operating results may differ from our…

•We may incur significant costs to comply with privacy and data protection laws and other requirements, and, if we fail to comply, we could be subject to government enforcement actions, private litigation, and adverse…

•We generate a significant amount of revenue from sales to distributors, resellers, and end-customers outside of the United States, and we are therefore subject to a number of risks associated with international sales…

•A significant network or data security incident may materially impact our reputation, financial condition, and operating results.

•Issues in the development, deployment, or use of AI may result in reputational harm, legal liability, and could adversely affect our business and operating results.

•As a result of the CyberArk acquisition, the scope and size of our business have substantially changed, which resulted in certain incremental risks, including increased competition.

•We face intense competition and we may lack sufficient financial or other resources to maintain or improve our competitive position.

•We rely on our channel partners to sell a substantial portion of our products, including subscriptions and support, and if these channel partners fail to perform, our ability to sell and distribute our products and s…

•If we are unable to sell new and additional products, subscriptions, and support offerings to existing end-customers or attract new customers, especially large enterprise customers, our future revenue and operating r…

•Our operating results may vary significantly from period to period, including due to seasonality, which makes our results difficult to predict and could cause our results to fall short of expectations.

Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products and subscriptions could reduce our ability to compete and could harm our business.

Our business is subject to the risks of earthquakes, fire, power outages, floods, health risks, and other catastrophic events, and to interruption by man-made problems, such as terrorism.

Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

We do not intend to pay dividends for the foreseeable future.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance shareholder value, and share repurchases could affect the price of our common stock.