Palo Alto Networks (PANW) Risk Analysis

The enterprise security industry has grown quickly and continues to evolve rapidly. Moreover, many of our end-customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems, and networking protocols. If we fail to effectively anticipate, identify, and respond to rapidly evolving technological and market developments in a timely manner, our business will be harmed. In order to anticipate and respond effectively to rapid technological changes and market developments, as well as evolving security threats, we must invest effectively in research and development to increase the reliability, availability, and scalability of our existing products and subscriptions and introduce new products and subscriptions. Our investments in research and development, including investments in AI, may not result in design or performance improvements, marketable products, subscriptions, or features, or may not achieve the cost savings or additional revenue that we expect. In addition, new and evolving products and services, including those that use AI, require significant investment and raise ethical, technological, legal, regulatory, and other challenges, which may negatively affect our brands and demand for our products and services. Because all of these investment areas are inherently risky, no assurance can be given that such strategies and offerings will be successful or will not harm our reputation, financial condition, and operating results. We must also continually adapt our products and strategy in response to changes in network infrastructure requirements, including the expanding use of cloud computing and third-party service providers. While we have historically been successful in developing or acquiring and marketing new products and product enhancements that respond to technological and industry changes, we cannot assure that our new or future offerings will achieve widespread market acceptance or be successful. If we fail to accurately predict and address end-customers' changing needs and emerging technological trends, including in the areas of AI, mobility, virtualization, cloud computing, and software-defined networks, our business could be harmed. The technology in our portfolio is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack while minimizing the impact on network performance. Some of our new features and enhancements may require us to develop new hardware architectures involving complex, expensive, and time-consuming research and development processes, and the timetable for commercial availability is uncertain. The success of new products depends on several factors, including appropriate product definition, differentiation from competitors, market acceptance, management of production ramp-up issues, availability of application software, effective management of purchase commitments and inventory, and the risk that new products may have quality defects in the early stages of introduction. If we fail to identify opportunities for new products and subscriptions, experience unanticipated delays in the availability of new products and subscriptions, or fail to meet customer expectations, our competitive position and business prospects will be harmed. Furthermore, we may require additional funds to respond to business challenges, including the need to develop new features to enhance our portfolio, improve our operating infrastructure, or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financings to secure additional funds, which may contain terms that, among other things, restrict our ability to incur additional indebtedness. In addition, we may be required to take other actions that would otherwise be in the interests of the debt holders and would require us to maintain specified liquidity or other ratios, any of which could harm our business, financial condition, and operating results. If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Governmental authorities, certain investors, and other stakeholders continue to focus on, set and revise, expectations relating to corporate responsibility matters, both in the United States and internationally. Such expectations are evolving and may be contradictory. We communicate corporate responsibility initiatives, goals, and commitments regarding sustainability, inclusion, responsible sourcing, and community impact in our annual Corporate Responsibility Report, on our website, in our SEC filings, and elsewhere. These initiatives may be difficult to achieve and costly to implement. We could be criticized for their scope, nature, timing, or any revisions to them, and for the accuracy or completeness of our disclosures. Our actual or perceived failure to undertake these initiatives and achieve these goals, or the fact that we are undertaking these initiatives, could negatively impact our reputation or otherwise materially harm our business. In addition, we are or may become subject to various new, proposed, and evolving sustainability-related laws and regulations, including, for example, the E.U.'s Corporate Sustainability Reporting Directive. Additional regulation may require us to incur significant costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines, or litigation, which could negatively impact our business, financial condition, and operating results.

Our income tax obligations are based in part on our corporate structure and intercompany arrangements, including the manner in which we develop, value, and use our intellectual property and the valuations of our intercompany transactions. The tax laws applicable to our business, including the laws of the United States and various other jurisdictions, are subject to interpretation and certain jurisdictions may aggressively interpret their laws, regulations, and policies, including in an effort to raise additional tax revenue. The tax authorities of the jurisdictions in which we operate may challenge our methodologies for valuing developed or acquired technology or determining the proper charges for intercompany arrangements, which could increase our worldwide effective tax rate, harm our financial position and operating results, and have a negative effect on our cash flow. Some tax authorities of jurisdictions other than the United States may seek to assert extraterritorial taxing rights on our transactions or operations. It is possible that domestic or international tax authorities may subject us to tax examinations or audits, and such tax authorities may disagree with certain positions we have taken, and any adverse outcome of such an examination, review, or audit could result in additional tax liabilities and penalties and otherwise have a negative effect on our financial condition, operating results, and cash flow. Further, the determination of our worldwide provision for income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded on our consolidated financial statements and may materially affect our financial results in the period or periods for which such determination is made. In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025. In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk's $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the "2030 Notes") and the fair value of the capped call transactions (the "Capped Calls") we acquired in connection with the CyberArk acquisition. If our future tax obligations or effective tax rates increase as a result of these or other factors, it could have an adverse effect on our financial condition and operating results. Moreover, in October 2021, the Organization for Economic Co-operation and Development ("OECD") issued model rules for a new global minimum tax framework, commonly referred to as "Pillar Two," which included the introduction of a 15% global minimum tax effective beginning January 1, 2024. To date, approximately 140 countries have tentatively signed a framework agreeing in principle to this initiative. A number of countries in which we do business have implemented or may implement Pillar Two proposals into local tax legislation. On January 5, 2026, the OECD released a "side-by-side" package (the "SbS Package") that generally establishes an exemption for U.S. multinationals from the 15% global minimum tax. However, the implementation of the SbS Package depends on domestic legislation and regulation in OECD member countries and is subject to subsequent review. Details around the proposals are still uncertain as the OECD and local jurisdictions continue to issue the technical guidance. Our effective tax rate and cash tax payments could increase in future years as a result of these changes.

A wide variety of laws, regulations, industry standards, contractual requirements, and other obligations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data in jurisdictions where we and our customers operate. Compliance with these laws and other obligations is difficult and costly, and they are subject to frequent and unexpected changes. For example, we are subject to the E.U. General Data Protection Regulation ("E.U. GDPR") and the U.K. General Data Protection Regulation ("U.K. GDPR," and collectively the "GDPR"), each of which imposes stringent data protection requirements and provides for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U. GDPR or £17.5 million under the U.K. GDPR, and (b) 4% of annual worldwide turnover), and confers the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations. The GDPR restricts transfers of personal data outside of the European Economic Area ("EEA") (or, in the case of the U.K. GDPR, the U.K.) to non-EEA countries, such as the United States, unless adequate safeguards are implemented or a derogation applies. We rely on standard contractual clauses approved under the GDPR to carry out such transfers and to receive personal data subject to the GDPR (directly or indirectly) in the United States. In addition, with respect to the personal data that we process on behalf of our customers, we self-certified to the E.U.-U.S. Data Privacy Framework ("E.U.-U.S. DPF"), the UK Extension to the E.U.-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (collectively, the "DPF") as set forth by the U.S. Department of Commerce for such transfers. However, the DPF may be subject to legal challenges that could invalidate its use. In addition, the U.K. Data (Use and Access) Act 2025 includes changes to the U.K.'s data protection regime that deviate from the GDPR, creating new compliance challenges. We anticipate future legal challenges and developments to approved data transfer mechanisms, including to the E.U.-U.S. DPF, which could result in additional compliance costs and harm our business. Among other effects of these developments, we may also experience reduced demand for our products and subscriptions from current or prospective customers in the EEA, Switzerland, and the U.K. (collectively, "Europe") on account of the risks identified in the Schrems II decision or other developments relating to cross-border data transfers, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents. The regulatory environment applicable to the handling of European residents' personal data and cross-border data transfers, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs. We are also subject to U.S. privacy and data protection laws, including the California Consumer Privacy Act (the "CCPA"), which, among other requirements, requires enhanced disclosures, affords California residents with certain rights regarding their personal data, and creates a private right of action for data breaches caused by a lack of reasonable security. Over twenty other U.S. states have enacted similar privacy laws. Additionally, the U.S. Department of Justice has issued rules regarding access to or transfer of certain bulk sensitive personal data by countries of concern or covered persons, and we are subject to the Health Insurance Portability and Accountability Act ("HIPAA"), both of which carry significant enforcement penalties for non-compliance. These and other increasingly complex federal and state privacy laws and their enforcement may also require us to modify our data practices and incur additional substantial compliance costs. We are also subject to obligations relating to personal data and data protection by contract and self-regulatory and industry standards. Additionally, the Federal Trade Commission and state attorneys general are more regularly bringing enforcement actions for deceptive practices related to the collection and security of personal data. We and our customers could face risk of regulatory investigations, enforcement actions, private litigation (including class action litigation), and adverse publicity, including reputational damage and loss of customer confidence, for actual or perceived violations of any of the foregoing data protection obligations. Any such claims could result in substantial costs, remedial and reporting obligations, distraction of management, and diversion of resources. Our insurance may not cover all types of claims that may arise, and we cannot guarantee that applicable insurance will be available to us in the future on economically reasonable terms or at all. If any of the foregoing were to occur, our business, results of operations, and financial condition could be materially adversely affected. Moreover, new legislation affecting the scope of personal data and information, especially relating to IP addresses, machine identification, AI and machine learning, location data, health information, and other information, may limit or inhibit our ability to operate or expand our business and may require significant additional expenditures to comply. Data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, potentially requiring costly restructuring of our cloud infrastructure. Public perception of privacy or information security concerns, whether or not valid, may harm our reputation and inhibit adoption of our products and subscriptions. Additionally, existing laws and regulations, and any changes to them, or new laws and regulations, could impose significant limitations or require changes to our business model, which may increase our compliance costs. We are also subject to federal, state, provincial, and foreign laws regarding cybersecurity and the protection of our systems and confidential information. Many jurisdictions have enacted laws, such as the GDPR and the E.U. Network and Information Systems Directive II, requiring companies to adopt cybersecurity risk management measures and notify regulators (and individuals) of data breaches or cybersecurity incidents. If our data security measures fail to adequately protect our systems or confidential information, we could be liable to both our customers and their users for any related losses. Additionally, we could face regulatory action or face litigation, and our customers could terminate or materially change their relationships with us, any of which could harm our business, financial condition, or operating results.

We operate globally, and our business and revenues are impacted by global economic and geopolitical conditions. Instability in global credit markets, inflation, changes in public policies, changes in domestic and international regulations, changes in interest rates, foreign currency exchange rate fluctuations, trade regulations and tariffs, international trade disputes and agreements, changes in tax laws, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions. Military actions or armed conflict, including the hostilities in Israel and the surrounding region, the Russia-Ukraine war and related political or economic responses, and uncertainty about, or changes in, government and trade relationships could further worsen economic and market conditions and the geopolitical environment. For example, in response to Russia's invasion of Ukraine, the United States, along with the European Union (the "E.U."), has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens. We are subject to these governmental sanctions and export controls, which may subject us to liability if we are not in full compliance with applicable laws. In addition, government-mandated restrictions on technology access, including export controls, import restrictions, or requirements that certain technologies not be made available in particular countries or regions, could limit our ability to sell or support our products and subscriptions in affected markets, require us to modify or discontinue certain products or features, or require us to exit certain markets. Any continued or further uncertainty or deterioration in economic and market conditions or the geopolitical environment, or any expansion or imposition of government-mandated technology restrictions, could have a material and adverse impact on our business, financial condition, and operating results, including reductions in sales, longer sales cycles, reductions in subscription or contract duration and value, slower adoption of new technologies, changes in spending patterns or priorities of current and prospective customers, increased component, memory or compute costs, and increased price competition.

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity. In addition, climate-related events, including drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise, may increase in frequency and intensity and could disrupt our business operations and damage our facilities. In addition, the data centers and cloud infrastructure we and our third-party providers use to deliver our products, subscriptions, and support offerings are subject to risks from extreme weather events and power disruptions associated with climate change. Other natural disasters, a significant power outage, telecommunications failure, terrorism, an armed conflict, cyberattacks, epidemics and pandemics, or other geopolitical unrest could affect our supply chain, manufacturers, logistics providers, channel partners, end-customers, or the economy as a whole, and such disruption could impact our shipments and sales. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, increase compliance costs, and require additional investment in our operations and disclosures. These risks may be further increased if the disaster recovery plans for us and our suppliers prove to be inadequate. To the extent that any of the above should result in delays or cancellations of customer orders, the loss of customers, or the delay in the manufacture, deployment, or shipment of our products, our business, financial condition, and operating results would be adversely affected.

Our sales contracts are primarily denominated in U.S. dollars, and therefore, a predominant amount of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar could increase the cost of our products to end-customers outside the United States. Increased international sales in the future may result in greater foreign currency denominated sales, increasing our foreign currency risk. Our operating expenses incurred outside the United States and denominated in foreign currencies are generally increasing and are subject to fluctuations due to changes in exchange rates. We have entered into forward contracts to reduce our foreign currency exchange exposure. As of July 31, 2026, the total notional amount of our outstanding foreign currency forward contracts was $2.2 billion. For more information, refer to Note 6. Derivative Instruments in Part II, Item 8 of this Annual Report on Form 10-K. The effectiveness of our hedging transactions may be limited, and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

Our future success depends, in part, on our ability to continue to attract, retain, and motivate the members of our management team and other key employees. For example, we are substantially dependent on the continued service of our engineering personnel because of the complexity of our offerings. Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel. In addition, the industry in which we operate generally experiences high employee attrition. Our future performance depends on the continuing services and contributions of our senior management to execute on our business plan and to identify and pursue new opportunities and product innovations. If we are unable to hire, integrate, train, or retain the qualified and highly skilled personnel required to fulfill our current or future needs, our business, financial condition, and operating results could be harmed. Moreover, our hybrid work environment may also create operational, security, and workplace culture challenges that could hinder execution of our business objectives and our ability to attract and retain qualified and highly skilled personnel. Further, we believe that a critical contributor to our success and our ability to retain highly skilled personnel has been our corporate culture, which we believe fosters innovation, inclusion, teamwork, passion for end-customers, focus on execution, and the facilitation of critical knowledge transfer and knowledge sharing. As we grow and change, and as we acquire and integrate other businesses, we may find it difficult to maintain these important aspects of our corporate culture. While we are taking steps to develop a more inclusive workforce, there is no guarantee that we will be able to do so. Any failure to preserve our culture as we grow could limit our ability to innovate and could negatively affect our ability to retain and recruit personnel, continue to perform at current levels, or execute on our business strategy.

We depend on manufacturing partners, primarily our EMS provider, Flex, to manufacture our hardware product lines. Our substantial reliance on Flex or other manufacturing partners subjects us to concentration risks, such as reduced control over the manufacturing process, quality assurance, product costs and supply, and timing. Our hardware products are manufactured primarily in the United States, but some components are sourced outside the United States, subjecting us to geopolitical risks, trade regulations, tariffs, logistical risks, and foreign compliance requirements. Changes to international trade agreements, tariffs, or trade regulations could lead to sourcing or logistics disruptions and increased costs. For example, U.S. and Chinese import tariffs have impacted some of our components, increasing our costs and potentially requiring us to further raise prices on our hardware products. In the past, we experienced supply chain disruption and have incurred increased costs resulting from inflationary pressures and changes in U.S. trade policy. For example, we experienced supply chain disruption and inflationary pressures during our fourth quarter of fiscal 2026, resulting in increased costs for memory and other components, which have negatively affected our gross margin and could continue to affect our gross margin. Our manufacturing partners typically fulfill supply requirements on individual purchase orders without long-term capacity or pricing guarantees. Our contract with Flex permits termination for convenience, subject to prior notice requirements. Our manufacturing partners procure components and build products based on our forecasts, and from time to time, we issue non-cancelable, non-returnable forecasts. If we are required to change manufacturing partners, or if our forecasting and inventory management systems prove inadequate, our ability to meet scheduled deliveries could be adversely affected. If our forecasts overestimate demand, we may be obligated to purchase excess inventory that we cannot sell, resulting in write-downs, increased carrying costs, and lower gross margins. Conversely, if our forecasts underestimate demand, we may experience insufficient supply, leading to product shortages, delayed deliveries, lost sales opportunities, and potential damage to customer relationships. Any production interruptions, whether from natural disasters, epidemics or pandemics, capacity shortages, or quality problems, would negatively affect sales and our business and operating results. Our hardware products rely on key components, including integrated circuit components, purchased from a limited number of suppliers, including sole source providers. The manufacturing operations of some suppliers are geographically concentrated in Asia, making our supply chain vulnerable to regional disruptions and international regulations, including tariffs, sanctions, and export controls. We are also monitoring the tensions between China and Taiwan, and between the U.S. and China, which have increased our costs and could have an adverse impact on our business or results of operations in future periods. We do not have volume purchase contracts with our component suppliers, and they could cease selling to us or change prices at any time. For example, there is currently a global shortage of memory-related components, and certain of our hardware appliances require higher memory content, which has led to and may continue to lead to increased production costs. If we are unable to obtain sufficient components on commercially reasonable terms, we could be forced to redesign our products and qualify new suppliers, resulting in lost sales opportunities and damage to customer relationships.