Palo Alto Networks (PANW) Risk Analysis

We believe there are seasonal factors that may cause our second and fourth fiscal quarters to record greater revenue sequentially than our first and third fiscal quarters. We believe that this seasonality results from a number of factors, including: - end-customers with a December 31 fiscal year-end choosing to spend remaining unused portions of their discretionary budgets before their fiscal year-end, which potentially results in a positive impact on our revenue in our second fiscal quarter;- our sales compensation plans, which are typically structured around annual quotas and commission rate accelerators, which potentially results in a positive impact on our revenue in our fourth fiscal quarter; and - the timing of end-customer budget planning at the beginning of the calendar year, which can result in a delay in spending at the beginning of the calendar year, potentially resulting in a negative impact on our revenue in our third fiscal quarter. As we continue to grow, seasonal or cyclical variations in our operations may become more pronounced, and our business, operating results, and financial position may be adversely affected.

The enterprise security industry has grown quickly and continues to evolve rapidly. Moreover, many of our end-customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems, and networking protocols. If we fail to effectively anticipate, identify, and respond to rapidly evolving technological and market developments in a timely manner, our business will be harmed. In order to anticipate and respond effectively to rapid technological changes and market developments, as well as evolving security threats, we must invest effectively in research and development to increase the reliability, availability, and scalability of our existing products and subscriptions and introduce new products and subscriptions. Our investments in research and development, including investments in AI, may not result in design or performance improvements, marketable products, subscriptions, or features, or may not achieve the cost savings or additional revenue that we expect. In addition, new and evolving products and services, including those that use AI, require significant investment and raise ethical, technological, legal, regulatory, and other challenges, which may negatively affect our brands and demand for our products and services. Because all of these investment areas are inherently risky, no assurance can be given that such strategies and offerings will be successful or will not harm our reputation, financial condition, and operating results. In addition, we must continually change our products and expand our business strategy in response to changes in network infrastructure requirements, including the expanding use of cloud computing. For example, organizations are moving portions of their data to be managed by third parties, primarily infrastructure, platform, and application service providers, and may rely on such providers' internal security measures. While we have historically been successful in developing, acquiring, and marketing new products and product enhancements that respond to technological change and evolving industry standards, we may not be able to continue to do so, and there can be no assurance that our new or future offerings will be successful or will achieve widespread market acceptance. If we fail to accurately predict and address end-customers' changing needs and emerging technological trends in the enterprise security industry, including in the areas of AI, mobility, virtualization, cloud computing, and software-defined networks, our business could be harmed. The technology in our portfolio is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, while minimizing the impact on network performance. Additionally, some of our new features and related enhancements may require us to develop new hardware architectures that involve complex, expensive, and time-consuming research and development processes. The development of our portfolio is difficult and the timetable for commercial release and availability is uncertain as there can be long time periods between releases and availability of new features. If we experience unanticipated delays in the availability of new products, features, and subscriptions, and fail to meet customer expectations for such availability, our competitive position and business prospects will be harmed. The success of new features depends on several factors, including appropriate new product definition, differentiation of new products, subscriptions, and features from those of our competitors, and market acceptance of these products, services, and features. Moreover, successful new product introduction and transition depends on a number of factors, including our ability to manage the risks associated with new product production ramp-up issues, the availability of application software for new products, the effective management of purchase commitments and inventory, the availability of products in appropriate quantities and costs to meet anticipated demand, and the risk that new products may have quality or other defects or deficiencies, especially in the early stages of introduction. There can be no assurance that we will successfully identify opportunities for new products and subscriptions, develop and bring new products and subscriptions to market in a timely manner, achieve market acceptance of our products and subscriptions, or that products, subscriptions, and technologies developed by others will not render our products, subscriptions, and technologies obsolete or noncompetitive.

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis. In addition to traditional computer "hackers," malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process. Incidences of cyberattacks and other cybersecurity breaches and incidents have increased and are likely to continue to increase. We and our third-party service providers face security threats and attacks from a variety of sources. Despite our efforts and processes to prevent breaches of our internal networks, systems, and websites, our data, corporate systems, and security measures, as well as those of our third-party service providers, are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, or other types of attacks from outside parties, or breaches due to employee error, malfeasance, or some combination of these. In addition, the adoption of AI poses risks. AI can be exploited by malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities, including potentially identifying weaknesses in our systems before we become aware of or can remediate them. We cannot guarantee that the measures we have taken to protect our networks, systems, and websites will provide adequate security. Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks. The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia. A security breach or incident, or an attack against our service availability suffered by us, or our third-party service providers, could impact our networks or networks secured by our products and subscriptions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our products. In addition, the information stored or otherwise processed on our networks, or those of our third-party service providers, has previously been, and could in the future be, accessed, publicly disclosed, altered, lost, stolen, rendered unavailable, or otherwise used or processed without authorization, which could subject us to liability and cause us financial harm. Any actual or perceived breach of security in our systems or networks, or any other actual or perceived data security incident we or our third-party service providers suffer, could result in significant damage to our reputation, negative publicity, loss of channel partners, end-customers, and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, demands, costly litigation, and other liability. In addition, we may incur significant costs and operational consequences of investigating, remediating, eliminating, and putting in place additional tools, devices, and other measures designed to prevent actual or perceived security breaches and other security incidents, as well as the costs to comply with any notification obligations resulting from any security incidents. Any of these negative outcomes could adversely impact the market perception of our products and subscriptions and end-customer and investor confidence in our company and could seriously harm our business or operating results.

There is an evolving and varied focus from regulators, investors, customers, and other stakeholders concerning corporate responsibility matters, both in the United States and internationally. We communicate certain corporate responsibility-related initiatives, goals, and/or commitments regarding sustainability matters, inclusion, responsible sourcing, community impact, and other matters in our annual Corporate Responsibility Report, on our website, in our filings with the SEC, and elsewhere. These initiatives, goals, or commitments could be difficult to achieve and costly to implement and we may fail to achieve, or be perceived to fail to achieve them. In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them. To the extent that our required and voluntary disclosures about corporate responsibility matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures. Our actual or perceived failure to achieve our corporate responsibility-related initiatives, goals, or commitments could negatively impact our reputation, result in corporate responsibility-focused investors not purchasing and holding our stock, or otherwise materially harm our business. In addition, we are or may become subject to various new, proposed and evolving sustainability-related laws and regulations, including, for example, the E.U.'s Corporate Sustainability Reporting Directive. Additional regulation may require us to incur significant costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines or litigation, which could negatively impact our business, operating results or financial condition.

Our income tax obligations are based in part on our corporate structure and intercompany arrangements, including the manner in which we develop, value, and use our intellectual property and the valuations of our intercompany transactions. The tax laws applicable to our business, including the laws of the United States and various other jurisdictions, are subject to interpretation and certain jurisdictions may aggressively interpret their laws, regulations, and policies, including in an effort to raise additional tax revenue. The tax authorities of the jurisdictions in which we operate may challenge our methodologies for valuing developed or acquired technology or determining the proper charges for intercompany arrangements, which could increase our worldwide effective tax rate, harm our financial position and operating results, and have a negative effect on our cash flow. Some tax authorities of jurisdictions other than the United States may seek to assert extraterritorial taxing rights on our transactions or operations. It is possible that domestic or international tax authorities may subject us to tax examinations, or audits, and such tax authorities may disagree with certain positions we have taken, and any adverse outcome of such an examination, review or audit could result in additional tax liabilities and penalties and otherwise have a negative effect on our financial position, operating results, and cash flow. Further, the determination of our worldwide provision for income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded on our consolidated financial statements and may materially affect our financial results in the period or periods for which such determination is made. In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025. In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk's $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the "2030 Notes") and the fair value of the capped calls we acquired in connection with the CyberArk acquisition. If our future tax obligations or effective tax rates increase as a result of these or other factors, it could have an adverse effect on our financial condition and operating results.

A wide variety of laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data in jurisdictions where we and our customers operate. Compliance with these laws and regulations is difficult and costly. These laws and regulations are also subject to frequent, inconsistent and unexpected changes; new, modified or additional laws or regulations may be adopted; and rulings that invalidate prior laws, regulations, or interpretations of such laws or regulations may be issued. For example, we are subject to the E.U. General Data Protection Regulation ("E.U. GDPR") and the U.K. General Data Protection Regulation ("U.K. GDPR," and collectively the "GDPR"), each of which imposes stringent data protection requirements, provides for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U. GDPR or £17.5 million under the U.K. GDPR, and (b) 4% of annual worldwide turnover), and confers the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations. The GDPR imposes restrictions, among other things, on the transfer of personal data outside of the European Economic Area ("EEA") (or, in the case of the U.K. GDPR, the U.K.) to non-EEA countries, such as the United States, unless adequate safeguards are implemented or a derogation applies. In practice, we rely on standard contractual clauses approved under the GDPR to carry out such transfers and to receive personal data subject to the GDPR (directly or indirectly) in the United States. In addition, with respect to the personal data that we process on behalf of our customers, we self-certified to the E.U.-U.S. Data Privacy Framework ("E.U.-U.S. DPF"), the UK Extension to the E.U.-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (collectively, the "DPF"), as set forth by the U.S. Department of Commerce, regarding transfers of certain personal data from the E.U., the U.K., and Switzerland to the United States. The DPF has been recognized as adequate under applicable law to allow transfers of personal data from the E.U., U.K., and Switzerland, as the case may be, to companies in the U.S. that have self-certified to the framework. However, the DPF may be subject to legal challenges, which could invalidate its use, disrupt our ability to rely on such data transfer mechanisms, and otherwise cause the legal requirements for such data transfers to be uncertain. In addition, the U.K. Data (Use and Access) Act 2025, enacted on June 19, 2025, includes changes to the U.K.'s data protection regime that cause it to deviate from the GDPR. This creates new compliance challenges and uncertainty, including with respect to the European Commission's adequacy determination for the U.K.'s data protection regime. Among other effects of these developments, we may experience additional costs associated with increased compliance burdens, reduced demand for our offerings from current or prospective customers in the EEA, Switzerland, and the U.K. (collectively, "Europe") to use our products, on account of the risks identified in the Schrems II decision or other developments relating to cross-border data transfers, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents. The regulatory environment applicable to the handling of European residents' personal data and cross-border data transfers, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs. Moreover, much like with Schrems II, we anticipate future legal challenges to the approved data transfer mechanisms between Europe and the United States, including a challenge to the E.U.-U.S. DPF. Such legal challenges could result in additional legal and regulatory risk, compliance costs, and in our business, operating results, and financial condition being harmed. We are also subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"). The CCPA requires, among other things, covered businesses to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security. The effects of the CCPA have been significant, requiring us to modify our data processing practices and policies and to incur substantial costs and expenses for compliance. Moreover, other U.S. states have enacted laws relating to privacy and security that are potentially relevant to us. These include laws enacted in at least 22 U.S. states. The U.S. Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern. Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so. In addition, we are subject to federal privacy and security standards regarding the protection of individually identifiable health information under the Health Insurance Portability and Accountability Act as amended by the Health Information Technology for Economic and Clinical Health Act ("HIPPA") and these carry significant enforcement penalties for non-compliance. Failure to comply with HIPAA can result in an injunction, regulatory action, civil monetary penalties, or in certain circumstances, criminal penalties with fines and/or imprisonment. We operate as a HIPAA business associate for certain of our customers and, therefore, must comply with applicable administrative, technical, and physical safeguards required by HIPAA. If we are unable to comply with our obligations as a HIPAA business associate, in addition to potential regulatory enforcement actions, we also could face contractual liability under applicable business associate agreements. We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards. Additionally, the Federal Trade Commission and many state attorneys general are more regularly bringing enforcement actions in connection with federal and state consumer protection laws for false or deceptive acts or practices in relation to the online collection, use, dissemination, and security of personal data. We and our customers may face risk of enforcement actions by regulators or data protection authorities, private litigation and adverse publicity including reputational damage and loss of customer confidence for alleged violations of any of the foregoing obligations. Any such claims could result in substantial costs, ongoing remedial, audit and reporting obligations, and diversion of resources, and distract management and technical personnel. These potential liabilities and enforcement actions could also have an overall negative effect on our business, operating results, and financial condition. The amount and scope of insurance we maintain may not cover all types of claims that may arise. New legislation affecting the scope of personal data and personal information where we or our customers and partners have operations, especially relating to classification of Internet Protocol ("IP") addresses, machine identification, AI and machine learning, location data, and other information, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing or uses of data, and may require significant expenditures and efforts in order to comply. Internationally, data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, which may require us to restructure our cloud infrastructure at significant cost. Notably, public perception of potential privacy, data protection, or information security concerns-whether or not valid-may harm our reputation and inhibit adoption of our products and subscriptions by current and future end-customers. Each of these laws and regulations, and any changes to these laws and regulations, or new laws and regulations, could impose significant limitations, or require changes to our business model or practices or growth strategy, which may increase our compliance expenses and make our business more costly or less efficient to conduct.

We operate globally, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. The instability in the global credit markets, inflation, changes in public policies such as domestic and international legislation or regulations, changes in enforcement and administration policies, taxes, any increases in interest rates, fluctuations in foreign currency exchange rates, or international trade agreements, international trade disputes, trade regulations, tariffs and changes in tariffs, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions. Military actions or armed conflict, including the hostilities in Israel and the surrounding region, the Russia-Ukraine war and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment. In response to Russia's invasion of Ukraine, the United States, along with the European Union (the "E.U."), has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens ("Sanctions on Russia"). We are subject to these governmental sanctions and export controls, which may subject us to liability if we are not in full compliance with applicable laws. Any continued or further uncertainty, weakness or deterioration in economic and market conditions or the geopolitical environment could have a material and adverse impact on our business, financial condition, and results of operations, including reductions in sales of our products and subscriptions, longer sales cycles, reductions in subscription or contract duration and value, slower adoption of new technologies, alterations in the spending patterns or priorities of current and prospective customers (including delaying purchasing decisions), increased costs for the chips and components to manufacture our products, and increased price competition.

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity. In addition, other natural disasters, such as fire or floods, a significant power outage, telecommunications failure, terrorism, an armed conflict, cyberattacks, epidemics and pandemics, or other geopolitical unrest could affect our supply chain, manufacturers, logistics providers, channel partners, end-customers, or the economy as a whole, and such disruption could impact our shipments and sales. These risks may be further increased if the disaster recovery plans for us and our suppliers prove to be inadequate. To the extent that any of the above should result in delays or cancellations of customer orders, the loss of customers, or the delay in the manufacture, deployment, or shipment of our products, our business, financial condition, and operating results would be adversely affected.

Our sales contracts are primarily denominated in U.S. dollars, and therefore, a predominant amount of our revenue is not subject to foreign currency risk. However, in the event of a strengthening of the U.S. dollar against foreign currencies in which we conduct business, the cost of our products to our end-customers outside of the United States would increase, which could adversely affect our financial condition and operating results. In addition, increased international sales in the future, including through our channel partners and other partnerships or as a result of our acquisitions, may result in increased foreign currency denominated sales, increasing our foreign currency risk. Our operating expenses incurred outside the United States and denominated in foreign currencies are generally increasing and are subject to fluctuations due to changes in foreign currency exchange rates. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected. We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures. As of April 30, 2026, the total notional amount of our outstanding foreign currency forward contracts was $1.2 billion. For more information on our hedging transactions, refer to Note 6. Derivative Instruments in Part I, Item 1 of this Quarterly Report on Form 10-Q. The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

Our future success depends, in part, on our ability to continue to attract, retain, and motivate the members of our management team and other key employees. For example, we are substantially dependent on the continued service of our engineering personnel because of the complexity of our offerings. Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel. In addition, the industry in which we operate generally experiences high employee attrition. Our future performance depends on the continuing services and contributions of our senior management to execute on our business plan and to identify and pursue new opportunities and product innovations. If we are unable to hire, integrate, train, or retain the qualified and highly skilled personnel required to fulfill our current or future needs, our business, financial condition, and operating results could be harmed. Further, we believe that a critical contributor to our success and our ability to retain highly skilled personnel has been our corporate culture, which we believe fosters innovation, inclusion, teamwork, passion for end-customers, focus on execution, and the facilitation of critical knowledge transfer and knowledge sharing. As we grow and change, we may find it difficult to maintain these important aspects of our corporate culture. While we are taking steps to develop a more inclusive workforce, there is no guarantee that we will be able to do so. Any failure to preserve our culture as we grow could limit our ability to innovate and could negatively affect our ability to retain and recruit personnel, continue to perform at current levels or execute on our business strategy.