A doubling with no news behind it

Palo Alto Networks, which sells firewalls and a wide stack of security subscriptions to large enterprises, service providers and governments, has not published a financial result since late April. Its fiscal fourth quarter and full-year figures are scheduled for 1 September. Everything the market has done to the shares since — a rise of about 141% from 20 February to 21 August — rests on that April print and on what investors expect to follow it.

Measure the price against what the company keeps on each dollar of sales. Trailing four-quarter gross profit rose from $7.27bn to $7.63bn over those six months, a gain of 4.9%. The price paid for each dollar of that gross profit went from roughly 16.7x in February to 28.3x in May and 38.2x now. The business grew by a twentieth; the price attached to it grew by more than half again.

The April quarter itself is harder to read than the headline suggests. Revenue of $3.00bn was up 31.1%, and next-generation security annual recurring revenue (ARR) grew 60% to $8.1bn — but roughly $388m of revenue and $1.63bn of that ARR arrived with the CyberArk and Chronosphere acquisitions, leaving organic growth near 14% and organic ARR near 28%. CyberArk, an identity-security specialist bought for $21.1bn in February with 112m newly issued shares, also pushed purchase accounting through cost of revenue: gross margin fell to 67.6% from 74.2% two quarters earlier, and the company posted an operating loss of $183m. Diluted shares rose 4.9% in a single quarter. Management trimmed fiscal 2026 adjusted earnings guidance to $3.65–3.70 a share from $3.80–3.90 to absorb the deal.

The platform story underneath is real but young. Palo Alto added 110 net new platformized customers in the quarter, reaching about 2,280, and guided the June quarter to next-generation security ARR of $8.90–8.95bn. Prisma AIRS, its dedicated product for securing AI systems, ended the quarter with more than 300 customers, up from 100, with management targeting $100m of ARR within a couple of quarters — about 1.2% of the current base. The AI-security line is a rounding error on today's revenue and the entire justification for tomorrow's multiple.

Cloudflare's numbers agree; its disclosure does not

Cloudflare runs a global network that sits between the public internet and its customers' sites, selling denial-of-service protection, bot mitigation, content delivery and a serverless developer platform on one fabric. Its June quarter is the cleaner result of the two. Revenue of $696.1m grew 35.9%, the fourth consecutive acceleration. Dollar-based net retention reached 120%, up six points on the year. Customers spending more than $100,000 annually rose 27% to 4,698. Non-GAAP gross margin ticked up to 73.1%, the first sequential gain in eight quarters, after a long slide management blames on free-traffic mix. Free cash flow of $56.4m was up 69%, and diluted shares grew just 2.0%.

What is missing is the money. Cloudflare added roughly 2 million developers to its Workers platform in the quarter and says more than half the traffic crossing its network now comes from AI agents rather than people. It discloses no revenue figure for Workers AI, its AI gateway, or pay-per-crawl, the mechanism that makes Cloudflare the merchant of record when an AI crawler pays for a page. It has told AI companies to separate search crawlers from training crawlers by 15 September or be blocked by default on ad-bearing pages — a strong negotiating position with no invoice attached to it yet. Meanwhile network capex, 7% of revenue in the quarter, is guided to 14–15% for the full year as graphics-processor capacity lands at the edge. At 57.0x trailing gross profit against 38.5x in February, the shares already carry the outcome.

The leaders became the laggards

Cloudflare has traded above both its 50-day and 200-day averages, with the shorter above the longer, on every session since 5 May; Palo Alto since 26 May. Those are the longest such runs among the large security and enterprise-software names. Yet over the 30 sessions to 21 August, when that group gained roughly 14%, the two were at the bottom: Cloudflare up 7.7% and Palo Alto up 4.6%, against Zscaler's 21.1%. Both peaked on 13 August and have since given back 11.4% and 9.6%.

The apparent laggards deserve a correction. Zscaler, which sells cloud-delivered secure access, is only cheap-looking because it fell 31.5% in one session on 27 May — the largest single-day move in the group — on a leadership change and soft guidance; its recovery is what powered the last month. CrowdStrike, the endpoint-security vendor, looks broken only because of a four-for-one stock split effective 2 July; adjusted for it, the shares are up roughly 96% over six months. It reports on 26 August.

Nor is this a rate trade. On 18 August, when the 30-year Treasury yield hit a 19-year high, both names fell. They rose on 21 August when Jerome Powell opened the door to a September cut, but no faster than the Nasdaq. For Cloudflare, five sessions supplied more than three times its entire net gain for the month. That is a market repricing an idea, session by session, well ahead of the disclosure that would settle it.

The setup

Where it stands — Both shares carry AI-era multiples; only Cloudflare's reported growth has accelerated to match, and neither discloses AI revenue in dollars. Would confirm — Palo Alto's initial fiscal 2027 next-generation security ARR guidance above $11bn, implying organic growth holding near 30%. Would invalidate — Cloudflare's non-GAAP gross margin falling back below 72% as second-half capex lands, or net retention slipping from 120%. Watch next — Palo Alto reports fiscal fourth quarter on 1 September; CrowdStrike reports 26 August. Valuation — Palo Alto at 38.2x trailing gross profit and 29.3x forward, against 16.7x in February; Cloudflare at 57.0x and 50.0x, against 38.5x.