Palo Alto is executing well, but the stock still assumes more AI proof than exists today
Palo Alto Networks is not struggling for relevance. The business is growing, the platform strategy has real traction, and customers are consolidating spend. The issue is valuation: the stock still trades as if AI leadership has been fully proven, when the financial proof is still emerging.
The core numbers are solid
In fiscal Q2, revenue rose 15% year over year to $2.6 billion, next-gen security ARR jumped 33% to $6.3 billion, and RPO increased 23% to $16.0 billion. Those are strong figures for a company of this size. They suggest customers are buying more than a single tool and are committing more budget to the broader platform.
Palo Alto also serves over 80,000 customers and posted the highest revenue growth among sector peers. That does not guarantee AI dominance, but it does show the company has real product traction and scale.
The AI story has real proof points, but not yet broad financial proof
Management has highlighted AI native cyber defense offerings, and Unit 42 Managed XSIAM is being used by Intrado to protect mission-critical 9-1-1 and emergency response operations. That matters because it moves the story beyond slides and into a live, high-stakes environment.
The bear case is not that the company is weak. It is that shares have already run 43.1% year to date. That leaves less room for a narrative that still needs more quarters of confirmation.
Cortex XSIAM is gaining traction, but AI security still needs to scale
The key question is not whether Palo Alto has a credible product motion. It does. The harder question is whether AI-linked offerings are becoming a major revenue engine or are still mostly a promising early motion.
Customers are buying a platform, not just a label
Cortex XSIAM had about 470 customers in Q1 FY26, with average spend above $1 million ARR. That points to demand from large enterprises, not casual adoption. Palo Alto also said customers are choosing XSIAM to replace older security tools, which matters because consolidation is easier to sell when it simplifies a stack.
Just as important, platform deals linked to Cortex XSIAM more than doubled from a year earlier. That suggests the product is helping pull customers deeper into the broader platform, which is usually a stronger signal than a one-product win.
The measurable win is faster response, even if the AI revenue story is still early
More than 60% of customers cut median response time from days or weeks to minutes. That is a practical outcome security teams can verify. Palo Alto's own site also claims a 98% reduction in MTTR, but the stronger, cleaner evidence is the customer-level improvement already documented in deployment reports.
And this is not just shelfware. Unit 42 Managed XSIAM is being used by Intrado to protect mission-critical 9-1-1 and emergency response operations. That is a credible real-world validation of product utility.
Flagpole deals are encouraging, but they are not the same as proven scale
The $85 million telecom contract is an important win, but it is still a single flagpole deal. Palo Alto is also expanding its AI security footprint through moves such as the Portkey acquisition and the Koi acquisition. Those steps make strategic sense, but they still look more like optionality than established revenue drivers.
What would turn the AI narrative into a stronger investment case?
This is still a show-me setup. The business has already passed the basic test, with strong fiscal Q2 results and a platform motion that is pulling customers deeper after Cortex XSIAM deployments. But after shares up 43.1% year to date, investors need to see whether AI-linked products are becoming a durable revenue engine rather than just a more expensive story.
The next few quarters need to connect strategy to wallet share
Management has already framed identity as the new perimeter and positioned observability as foundational to resilience at scale. That makes the next earnings cycle important: investors need evidence that these strategic pillars are producing measurable cross-sell and sustained demand, not just a stronger narrative.
Watch for: - Whether Cortex XSIAM keeps growing strongly. - Whether wins are broadening beyond a small number of mega-deals and showing up across more customers. - Whether identity and observability produce repeatable cross-sell inside existing accounts.
The valuation risk is about timing, not business quality
Bears are not arguing that Palo Alto is weak. They are arguing that the stock can still compress if growth remains merely good while AI product launches keep multiplying without clear incremental revenue. Management is pushing hard on Agentic Remediation, and recent launches keep the AI narrative active. But until those efforts show up more clearly in customer spending and platform retention, the stock still looks like it is trading partly on expectation rather than fully earned proof.