Item 1. BUSINESS

General

We were incorporated in 2005 as Palo Alto Networks, Inc., a Delaware corporation. Our corporate headquarters are located in Santa Clara, California.

We have pioneered the next generation of security through our innovative platform that empowers enterprises, service providers, and government entities to secure their organizations by safely enabling applications and data running in their networks, on their endpoints, and in the cloud, and by preventing breaches that stem from targeted cyberattacks. Our platform uses an innovative traffic classification engine that identifies network traffic by application, user, and content and provides consistent security across the network, endpoint, and cloud. Accordingly, our platform enables our end-customers to pursue transformative digital initiatives, like public cloud and mobility, that grow their business, while maintaining the visibility and control needed to protect their valued data and critical control systems. We believe the architecture of our platform offers superior performance compared to legacy approaches and reduces the total cost of ownership for organizations by simplifying their security operations and infrastructure and eliminating the need for multiple, stand-alone hardware and software security products, and consists of three primary areas of security capabilities.

Secure the Enterprise:

•

Secure the network through our Next-Generation Firewalls, available as physical appliances, virtual appliances called VM-Series, or a cloud-delivered service called Prisma Access (formerly GlobalProtect cloud service), and Panorama management delivered as an appliance or as a virtual machine for the public or private cloud. This also includes security services such as WildFire, Threat Prevention, URL Filtering, GlobalProtect, and DNS Security that are delivered as SaaS subscriptions to our Next-Generation Firewalls.

•	Secure the endpoints through our Traps advanced endpoint protection software, delivered as a light-weight software agent with cloud or on-premise management capabilities.

Secure the Cloud:

•

Secure the cloud through our Prisma cloud security offerings, such as Prisma Public Cloud (formerly RedLock) for security and compliance in public clouds, Prisma Access (formerly GlobalProtect cloud service) for securing user access, Prisma SaaS (formerly Aperture) for protecting SaaS applications, VM-Series for in-line network security in public and private clouds, Traps for host-based public cloud infrastructure protection, and Twistlock for protecting containers in public and private clouds, as well as PureSec for protecting serverless functions in public clouds.

Secure the Future:

•

Secure the future of security operations through our Cortex platform, which includes Cortex XDR (formerly Magnifier) for detection and response, Cortex Data Lake (formerly Logging Service) to collect and integrate security data for analytics, Demisto for security orchestration, automation, and response (“SOAR”), and AutoFocus for threat intelligence. These products are delivered as software or SaaS subscriptions.

Product, Subscription, and Support Offerings

Our platform is available in the form of the product, subscription, and support offerings described below.

Firewall Appliances and Software. All of our firewall appliances and software incorporate our PAN-OS operating system and come with the same rich set of features ensuring consistent operation across our entire product line. These features include: App-ID, User-ID, site-to-site virtual private network (“VPN”), remote access Secure Sockets Layer (“SSL”) VPN, and Quality-of-Service (“QoS”). Our appliances and software are designed for different performance requirements throughout an organization and are classified based on throughput, ranging from our PA-220, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7080, which is designed for large scale data centers and service provider use. Our firewall appliances come in a physical form factor as well as in a virtual form factor, called VM-Series, that is available for virtualization and cloud environments from companies such as VMware, Inc. (“VMware”), Microsoft Corporation (“Microsoft”), Amazon.com, Inc. (“Amazon”), and Google, Inc. (“Google”), and in Kernel-based Virtual Machine (“KVM”)/OpenStack environments.

Panorama. Panorama is our centralized security management solution for global control of all of our firewall appliances and software deployed on an end-customer’s network as well as in their instances in public or private cloud environments as a virtual

- 4 -

appliance or a physical appliance. Panorama is used for centralized policy management, device management, software licensing and updates, centralized logging and reporting, and log storage. Panorama controls the security, network address translation (“NAT”), QoS, policy-based forwarding, decryption, application override, captive portal, and distributed denial of service/denial of service (“DDoS/DoS”) protection aspects of the appliances, software, and virtual systems under management. Panorama centrally manages device software and associated updates, including SSL-VPN clients, GlobalProtect clients, dynamic content updates, and software licenses. Panorama offers the ability to view logs and run reports from all managed appliances and software without the need to forward the logs and to report on aggregate user activity for all users, including mobile users. Panorama reliably expands the log storage for long-term event investigation and analysis through high-availability features for central management.

Virtual System Upgrades. Virtual System Upgrades are available as extensions to the Virtual System capacity that ships with our physical appliances. Virtual Systems provide a mechanism to support multiple distinct security policies and administrative access for tenants on the same hardware device, which is applicable to our large enterprise and service provider end-customers.

Subscription Offerings. We offer a number of subscriptions as part of our platform. Of these subscription offerings, Threat Prevention Subscription, URL Filtering Subscription, WildFire Subscription, GlobalProtect Subscription, and DNS Security Subscription are sold as options to our firewall appliances and software, whereas VM-Series, Traps, AutoFocus, Prisma Access (formerly GlobalProtect cloud service), Prisma Public Cloud (formerly RedLock), Prisma SaaS (formerly Aperture), Cortex XDR (formerly Magnifier), Cortex Data Lake (formerly Logging Service), and Demisto are sold on a per-user, per-endpoint, or capacity-based basis. Our subscription offerings include:

•

Threat Prevention Subscription. This subscription provides the intrusion detection and prevention capabilities of our platform. Our threat prevention engine blocks vulnerability exploits, viruses, spyware, buffer overflows, denial-of-service attacks, and port scans from compromising and damaging enterprise information resources. It includes mechanisms such as protocol decoder-based analysis, protocol anomaly-based protection, stateful pattern matching, statistical anomaly detection, heuristic-based analysis, custom vulnerability, and spyware “phone home” signatures.

•

URL Filtering Subscription. This subscription provides the uniform resource locator (“URL”) filtering capabilities of our platform. The URL filtering database consists of millions of URLs across many categories and is designed to monitor and control employee web surfing activities. The on-appliance URL database can be augmented to suit the traffic patterns of the local user community with a custom URL database. URLs that are not categorized by the local URL database can be pulled into a separate, cache-based URL database from a very extensive, cloud-based URL database.

•

WildFire Subscription. This cloud-based or appliance-based subscription provides protection against targeted malware and advanced persistent threats, and provides a near real-time analysis engine for detecting previously unseen malware. The core component of this subscription is a sandbox environment that can operate on an end-customers’ private cloud or our public cloud where files can be run and monitored for more than 100 behavioral characteristics that identify the file as malware. Once identified, preventive measures are automatically generated and delivered to all subscribed devices. By providing this as a cloud-based subscription, all of our end-customers benefit from malware found on any network.

•

GlobalProtect Subscription. This appliance-based subscription provides protection for mobile users of both traditional laptop devices and mobile devices. It expands the boundaries of the physical network, effectively establishing a logical perimeter that encompasses remote laptop and mobile device users irrespective of their location. When a remote user logs into the device, GlobalProtect automatically determines the closest gateway available to the roaming device and establishes a secure connection. Windows and Apple laptops as well as mobile devices, such as Android phones and tablets and Apple iPhones and iPads, will stay connected to the corporate network whenever they are on a network of any kind. As a result, they are protected as if they never left the corporate campus. GlobalProtect ensures that the same secure application enablement policies that protect users at the corporate site are enforced for all users, independent of their location.

•

VM-Series Subscription. VM-Series, the software form factor of our Next-Generation Firewall, is offered as both a perpetual license as well as a term-based subscription. The VM-Series provides all of the same security capabilities of our hardware appliances, but is delivered as a software package that can be deployed on VMware’s NSX and ESXi, Microsoft’s Hyper-V, and Red Hat KVM hypervisors, as well as natively in Amazon Web Services (“AWS”) cloud, Microsoft Azure cloud (“Azure”), and Google Cloud Platform (“GCP”).

•

Traps Endpoint Protection Subscription. This subscription provides protection for endpoints against cyberattacks that aim to run malicious code or exploit software vulnerabilities. It prevents known and previously unknown attacks through its unique capability of stopping the underlying exploit techniques and can prevent cyberattacks without relying on prior knowledge of the attack. Through its local machine learning engine, it can prevent cyberattacks that rely on malware, including continuously learning via its integration with WildFire. Traps offers the unique Behavioral Threat Protection engine intended to stop the most sophisticated attacks by examining multiple behaviors together to uncover and stop threats.

- 5 -

•

AutoFocus Subscription. This cloud-based subscription provides threat intelligence capabilities to our end-customers’ security operations teams. Indicators of compromise and anomalies that occur on an end-customer’s network can be correlated with similar data that has been centrally collected from among all our participating end-customers. This offers our end-customers priority alerts, deep attack context, and high-fidelity threat intelligence across millions of malware samples and tens of billions of file artifacts.

•	DNS Security Service Subscription. This cloud-based subscription uses machine learning to proactively block malicious domains and stops attacks in progress. It offers firewalls with access to DNS signatures generated using advanced predictive analysis and machine learning using malicious domain data from a growing threat intelligence sharing community.

•

Prisma Access (formerly GlobalProtect Cloud Service) Subscription. This cloud-based subscription enables our end-customers to utilize the preventive capabilities of our Security Operating Platform to secure remote offices and mobile users, providing consistent protection across globally distributed network and cloud environments without the need for firewall appliances or software in the remote locations. With this offering, our end-customers can quickly and easily add or remove remote locations and users, and establish and adjust security policies as needed, using a multi-tenant, cloud-based security infrastructure that we operate on their behalf.

•	Prisma Public Cloud (formerly RedLock) Subscription. This cloud-based subscription provides comprehensive visibility and threat detection across our end-customers’ public cloud environments.

•	Prisma SaaS (formerly Aperture) Subscription. This cloud-based subscription provides content control for IT-sanctioned SaaS applications. It offers end-customers the capability to safely use these SaaS applications and avert risks associated with improper sharing of confidential data and risks associated with sharing of malicious content.

•	Cortex Data Lake (formerly Logging Service) Subscription. This cloud-based subscription allows our end-customers to collect large amounts of context-rich data generated by our security offerings, including those of our Next-Generation Firewalls, Prisma Access (formerly GlobalProtect cloud service) subscription, and Traps, without needing to plan for local processing power and storage.

•	Cortex XDR (formerly Magnifier) Subscription. This cloud-based subscription enables organizations to identify and stop the most sophisticated attacks by applying AI and machine learning to rich network, endpoint, and cloud data.

•

Demisto. Available as a cloud-based subscription or on-premises appliance, Demisto is a comprehensive SOAR platform that combines playbook orchestration, incident management, and real-time collaboration to serve security teams across the incident lifecycle. With Demisto, security teams can standardize processes, automate repeatable tasks and manage incidents across their security product stack to improve response time and analyst productivity.

Support. We offer Standard Support, Premium Support, and four-hour Premium Support to our end-customers and channel partners. Our channel partners that operate a Palo Alto Networks Authorized Support Center (“ASC”) typically deliver level-one and level-two support. We provide level-three support 24 hours a day, seven days a week through regional support centers that are located worldwide. We also offer an annual subscription-based Service Account Management (“SAM”) service that provides support for end-customers with unique or complex support requirements. We offer our end-customers ongoing support for both hardware and software in order to receive ongoing security updates, PAN-OS upgrades, bug fixes, and repair. End-customers typically purchase these services for a one-year or longer term at the time of the initial product sale and typically renew for successive one-year or longer periods. Additionally, we provide expedited replacement for any defective hardware. We use a third-party logistics provider to manage our worldwide deployment of spare appliances and other accessories.

Professional Services. Professional services are delivered directly and through our authorized channel partners and include on-location and remote, hands-on experts who plan, design, and deploy effective security solutions tailored to our end-customers’ specific requirements. These services include architecture design and planning, configuration, and firewall migrations, as well as Prisma and Cortex deployments. Our education services provide online and classroom-style training and are also primarily delivered through our authorized training partners.

Technology

We combine our proprietary hardware and software architecture to provide a comprehensive security platform. Our Next-Generation Firewall integrates application visibility and control and is comprised of three identification technologies: App-ID, User-ID, and Content-ID. These technologies allow organizations to enable the secure use of applications while managing the inherent risks of doing so. These fine-grained policy management and enforcement capabilities are delivered at low latency, multi-gigabit performance through our innovative single-pass, parallel processing (“SP3”) architecture.

App-ID. App-ID is our application classification engine that uses multiple identification techniques to determine the exact identity of applications traversing the network. App-ID is the foundational classification engine that provides the core traffic classification to all other functions in our platform. The App-ID classification is used to invoke other security functions.

- 6 -

App-ID uses a series of classification techniques to accurately identify an application. When traffic first enters the network, App-ID applies an initial policy check based on Internet Protocol (“IP”) and port. Signatures are then applied to the traffic to identify the application based on application properties and related transaction characteristics. If the traffic is encrypted and a decryption policy is in place, the application is first decrypted, then application signatures are applied. Additional context-based signature analysis is then performed to identify known protocols that may be hiding other applications. Encrypted traffic that was decrypted is then re-encrypted before being sent back into the network. For evasive applications that cannot be identified through advanced signature and protocol analysis, heuristics or behavioral analysis are used to determine the identity of the application. When an application is accurately identified during this series of successive techniques, the policy check determines how to treat the application and associated functions. The policy check can block the application, allow it and scan for threats, inspect it for unauthorized file transfer and data patterns, or shape its use of network resources by applying a quality-of-service policy.

App-ID consistently classifies all network traffic, including business applications, consumer applications, and network protocols, across all ports. Consequently, there is no need to perform a series of signature checks to look for an application that is thought to be on the network. App-ID continually monitors the state of the application to determine if the application changes. Our platform allows only those applications within the policy to enter the network, while all other applications are blocked.

Internally developed or custom applications can be managed using either an application override or custom App-IDs. End-customers can use either of these mechanisms to apply the same level of control over their internal or custom applications that they apply to common applications. Because the application landscape is constantly changing, our research teams are constantly updating our App-ID classification engine. We deliver updated App-IDs automatically to our end-customers through our weekly update service.

User-ID. User-ID integrates our platform with a wide range of enterprise user directories and technologies, including Active Directory, eDirectory, Open LDAP, Citrix Terminal Server, Microsoft Exchange, Microsoft Terminal Server, and ZENworks. A network-based, User-ID agent communicates with the domain controllers, directories, or supported enterprise applications, mapping information such as user, role, and current IP address to the firewall, making the policy integration transparent. In cases where user repository information does not include the current IP address of the user, a transparent, captive portal authentication or challenge/response mechanism can be used to tie users into the security policy. In cases where a user repository or application is in place that already has knowledge of users and their current IP address, a standards-based application programming interface (“API”) can be used to tie the repository to our platform.

Content-ID. Content-ID is a collection of technologies that enables many of our subscription offerings. Content-ID combines a real-time threat prevention engine, a cloud-based analysis service, and a comprehensive URL categorization database to limit unauthorized data and file transfers, detect and block a wide range of threats, and control non-work related web surfing.

The threat prevention engine blocks several common types of attacks, including vulnerability exploits, buffer overflows, and port scans from compromising and damaging enterprise information resources. It includes mechanisms such as protocol decoder-based analysis, protocol anomaly-based protection, stateful pattern matching, statistical anomaly detection, heuristic-based analysis, custom vulnerability, and spyware “phone home” signatures.

Our cloud-based threat analysis service, WildFire, provides a near real-time analysis engine for detecting previously unseen targeted malware. The core component of WildFire is a sandbox environment that can be deployed in a customer’s private cloud or on our cloud where files can be run and monitored for more than 100 behavioral characteristics that identify the file as malware. Once identified, signatures are automatically generated and delivered to all end-customers that subscribe to the WildFire service. By providing WildFire as a cloud-based service, all of our end-customers benefit from malware found on any network or endpoint. Refer to the “WildFire” section below for a more detailed discussion of our WildFire technology.

Our URL filtering database consists of millions of URLs across many categories and is designed to monitor and control employee web surfing activities. The on-appliance URL database can be augmented to suit the traffic patterns of the local user community with a custom URL database. URLs that are not categorized by the local URL database can be pulled into an on-appliance data cache from a very extensive, cloud-based URL database. The data filtering features in our platform enable policies that reduce the risks associated with the transfer of unauthorized files and data. This can be achieved by blocking files by type, by controlling sensitive data, such as credit card and social security numbers in application content or attachments, and by controlling file transfers within applications.

SP3. SP3 is our proprietary software and hardware architecture that is comprised of two elements: single-pass software and parallel processing hardware.

Our single-pass software accomplishes two key functions in our platform. First, it performs operations once per packet. As a packet is processed, the networking functions, the policy lookup, the application identification and decoding, and the signature matching for any and all threats and content are all performed simultaneously. This significantly reduces the amount of processing required to perform multiple functions in one security device. Second, the content scanning step is stream-based and uses uniform signature matching to detect and block threats. Instead of using multiple scanning passes and file proxies, which require download prior to scanning, our single-pass software scans content once in a stream-based fashion to minimize latency. This results in very high

- 7 -

throughput and low latency, even with all security functions active. It also offers a single, fully integrated policy, thus enabling easier management of security.

Our parallel processing hardware is designed to optimize single-pass software performance through the use of separate data and control planes, which means that heavy utilization of one does not negatively impact the performance of the other. Our hardware also uses discrete, specialized processing groups to perform critical functions. On the data plane, this includes functions such as networking, policy enforcement, encryption and decryption, decompression, and content scanning. On the control plane, this includes configuration management, logging, and reporting.

We believe that the combination of single-pass software and parallel processing hardware is unique in the enterprise security industry and allows our platform to safely enable applications and prevent cyberthreats at very high levels of performance and throughput.

PAN-OS Operating System. Our PAN-OS operating system provides the foundation for our security platform and contains App-ID, User-ID, and Content-ID. PAN-OS performs the core functions of our platform while also providing the networking, security, and management functions needed for implementation. The PAN-OS networking functions include dynamic routing, switching, high availability, and VPN support, which enables deployment into a broad range of networking environments.

We have the ability to enable a series of virtual firewall instances or virtual systems. Each virtual system is an independent (virtual) firewall within the device that is managed separately and cannot be accessed or viewed by any other administrator of any other virtual system. This capability allows enterprises and service providers to separate firewall instances in departmental and multi-tenant managed services scenarios.

The security functions in PAN-OS are implemented in a single security policy and include application, application function, user, group, port, and service-based elements. Policy responses can range from open (allow but monitor for activity), to moderate (enabling certain applications or functions), to closed (deny). The tight integration of application control, users, and groups, and the ability to scan the allowed traffic for a wide range of threats minimizes the number of policies.

PAN-OS also includes attack protection capabilities, such as blocking invalid or malformed packets, IP defragmentation, Transmission Control Protocol (“TCP”) reassembly, and network traffic normalization. PAN-OS eliminates invalid and malformed packets, while TCP reassembly and IP defragmentation is performed to ensure the utmost accuracy and protection despite any attack evasion techniques.

WildFire. WildFire is our cloud-based malware analysis environment that offers a completely new approach to cybersecurity. Through native integration with our Next-Generation Firewall, the service brings advanced threat detection and prevention to every system deployed throughout the network, automatically sharing protections with all WildFire subscribers globally.

The service offers a unified, hybrid cloud architecture deployed via either a Palo Alto Networks run cloud, a private cloud appliance that maintains all data on the local network, or a combination of the two. This allows us to perform dynamic analysis of suspicious content in a cloud-based virtual environment to discover unknown threats, automatic creation and enforcement of best-in-class, content-based malware protections, and link detection in email, proactively blocking access to malicious websites.

Advanced attacks are not point-in-time events. Adversaries deliver attacks persistently, often using non-standard ports, protocols or encryption for subsequent attack stages. Like our Next-Generation Firewall, WildFire provides complete visibility into unknown threats within all traffic across thousands of applications, including Web traffic, email protocols (SMTP, IMAP, POP), and FTP, regardless of ports or encryption (SSL).

Once WildFire discovers a new threat, the service automatically generates protections across the attack lifecycle, blocking malicious files and command-and-control traffic. Uniquely, many of these protections are content-based, not relying on easily changed attributes such as hash, filename or URL, allowing the service to block the initial malware and future variants without any additional action or analysis. WildFire informs the protection of our other security services, blocking threats in-line through Threat Prevention (anti-malware, DNS, command-and-control), Web Security (malicious URLs in PAN-DB), and GlobalProtect (anti-malware for mobile devices).

Traps. Traps is our Advanced Endpoint Protection product that prevents advanced attacks originating from either exploits or malicious executables before any malicious activity can successfully run, regardless of software patches in place. If an attack attempt is made, Traps will immediately block the technique or techniques, terminate the process, and notify both the user and the administrator that an attack was thwarted. Whenever a block does occur, Traps will collect detailed forensics, including the offending process, the memory state when it was prevented, and many other details that are reported to the Endpoint Security Manager (“ESM”).

The Traps agent injects itself into each process as it is started. When an attacker attempts to exploit a software vulnerability, the Traps protection modules cause the exploit attempt to fail because Traps has already made the process impervious to those techniques. When the attempt is prevented, the Traps agent kills the process and reports all of the details to the ESM.

Traps policy is configured to protect over 100 processes - each one with dozens of proprietary exploit prevention modules (“EPMs”). However, unlike other products, Traps is not limited to protecting only those processes or applications. Our end-customers

- 8 -

use Traps to protect all manner of processes and applications by simply adding them to the policy configuration. Processes that have been run on the endpoint automatically show up in the ESM console, making it easy to protect those processes with the click of a button. This is especially useful for those end-customers running industry-specific applications. In addition to protecting workstations, laptops, and servers, Traps can protect point-of-sale (“POS”) systems, automated teller machines (“ATMs”), supervisory control and data acquisition (“SCADA”), and any other applications from exploitation.

Certifications. Many of our products have been awarded Federal Information Processing Standard (“FIPS”) 140-2 Level 2, Common Criteria/National Information Assurance Partnership (“NIAP”) Evaluation Assurance Level (“EAL”) 2, Common Criteria/NIAP EAL4+, Network Equipment-Building System (“NEBS”), and ICSA Firewall certifications.

Research and Development

Our research and development effort is focused on developing new hardware and software and on enhancing and improving our existing product and subscription offerings. We believe that hardware and software are both critical to expanding our leadership in the enterprise security market. Our engineering team has deep networking, endpoint, and security expertise and works closely with end-customers to identify their current and future needs. In addition to our focus on hardware and software, our research and development team is focused on research into applications and threats, which allows us to respond to the rapidly changing application and threat landscape. We supplement our own research and development effort with technologies and products that we license from third parties. We test our products thoroughly to certify and ensure interoperability with third-party hardware and software products.

We believe that innovation and timely development of new features and products is essential to meeting the needs of our end-customers and improving our competitive position. During fiscal 2019, we introduced several new offerings, including: PAN-OS 9.0, with over 60 new features; our DNS Security Service and Cortex XDR subscriptions; and Prisma, our cloud security suite that secures public cloud environments, SaaS applications, internet access, mobile users, and remote locations through a cloud-based architecture. Additionally, we acquired RedLock Inc. (“RedLock”), which expanded our security capabilities for the public cloud with the addition of RedLock’s cloud security analytics technology, Demisto, Inc. (“Demisto”), which expanded the functionality of our platform with the addition of Demisto’s SOAR product, and PureSec Ltd. (“PureSec”) and Twistlock Ltd. (“Twistlock”), which extend our Prisma cloud security strategy with the addition of PureSec’s security for serverless applications and Twistlock’s container security capabilities.

We plan to continue to significantly invest in our research and development effort as we evolve and extend the capabilities of our platform.

Intellectual Property

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other intellectual property rights. In particular, leading companies in the enterprise security industry have extensive patent portfolios and are regularly involved in both offensive and defensive litigation. We continue to grow our patent portfolio and own intellectual property and related intellectual property rights around the world that relate to our products, services, research and development, and other activities, and our success depends in part upon our ability to protect our core technology and intellectual property. We file patent applications to protect our intellectual property and believe that the duration of our issued patents is sufficient when considering the expected lives of our products.

We actively seek to protect our global intellectual property rights and to deter unauthorized use of our intellectual property by controlling access to and use of our proprietary software and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, end-customers and partners, and our software is protected by U.S. and international copyright laws. Despite our efforts to protect our intellectual property rights, our rights may not be successfully asserted in the future or may be invalidated, circumvented or challenged. In addition, the laws of various foreign countries where our offerings are distributed may not protect our intellectual property rights to the same extent as laws in the United States. See “Risk Factors-Claims by others that we infringe their proprietary technology or other rights could harm our business,” “Risk Factors-Our proprietary rights may be difficult to enforce or protect, which could enable others to copy or use aspects of our products or subscriptions without compensating us,” and “Legal Proceedings” below for additional information.

Competition

We operate in the intensely competitive enterprise security market that is characterized by constant change and innovation. Changes in the application, threat, and technology landscape result in evolving customer requirements for the protection from threats and the safe enablement of applications. Our main competitors fall into three categories:

•	large companies that incorporate security features in their products, such as Cisco Systems, Inc. (“Cisco”) and Juniper Networks, Inc. (“Juniper”), or those that have acquired, or may acquire, large network and endpoint security vendors and have the technical and financial resources to bring competitive solutions to the market;

- 9 -

•	independent security vendors such as Symantec Corporation (“Symantec”), Check Point Software Technologies Ltd. (“Check Point”), Fortinet, Inc. (“Fortinet”), and FireEye, Inc. (“FireEye”) that offer a mix of network and endpoint security products; and

•	small and large companies that offer point solutions and/or cloud security services that compete with some of the features present in our platform.

As our market grows, it will attract more highly specialized vendors as well as larger vendors that may continue to acquire or bundle their products more effectively.

The principal competitive factors in our market include:

•	product features, reliability, performance, and effectiveness;

•	product line breadth, diversity, and applicability;

•	product extensibility and ability to integrate with other technology infrastructures;

•	price and total cost of ownership;

•	adherence to industry standards and certifications;

•	strength of sales and marketing efforts; and

•	brand awareness and reputation.

We believe we generally compete favorably with our competitors on the basis of these factors as a result of the features and performance of our platform, the ease of integration of our products with technological infrastructures, and the relatively low total cost of ownership of our products. However, many of our competitors have substantially greater financial, technical, and other resources, greater name recognition, larger sales and marketing budgets, broader distribution, more diversified product lines, and larger and more mature intellectual property portfolios.

Sales, Customer Support and Marketing

Customers. Our end-customers are predominantly medium to large enterprises, service providers, and government entities. Our end-customers operate in a variety of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications. Our end-customers deploy our platform for a variety of security functions across a variety of deployment scenarios. Typical deployment scenarios include the enterprise perimeter, the enterprise data center, and the distributed enterprise perimeter. Our end-customer deployments typically involve at least one pair of our products along with one or more of our subscriptions, depending on size, security needs and requirements, and network complexity. No single end-customer accounted for more than 10% of our total revenue in fiscal 2019, 2018, or 2017.

Distribution. We primarily sell our products and subscription and support offerings to end-customers through our channel partners utilizing a two-tier, indirect fulfillment model whereby we sell our products and subscription and support offerings to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers. Sales are generally subject to our standard, non-exclusive distributor agreement, which provides for an initial term of one year, one-year renewal terms, termination by us with 30-90 days written notice prior to the renewal date, and payment to us from the channel partner within 30-45 calendar days of the date we issue an invoice for such sales. For fiscal 2019, 74.6% of our total revenue was derived from sales to four distributors.

We also sell our VM-Series virtual firewalls directly to end-customers through Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, and Google’s Cloud Platform Marketplace under a usage-based licensing model.

Sales. Our sales organization is responsible for large-account acquisition and overall market development, which includes the management of the relationships with our channel partners, working with our channel partners in winning and supporting end-customers through a direct-touch approach, and acting as the liaison between our end-customers and our marketing and product development organizations. We expect to continue to grow our sales headcount in all of our principal markets and expand our presence into countries where we currently do not have a direct sales presence.

Our sales organization is supported by sales engineers with responsibility for pre-sales technical support, solutions engineering for our end-customers, and technical training for our channel partners.

Channel Program. Our NextWave Channel Partner program is focused on building in-depth relationships with solutions-oriented distributors and resellers that have strong security expertise. The program rewards these partners based on a number of attainment goals, as well as provides them access to marketing funds, technical and sales training, and support. To ensure optimal productivity, we operate a formal accreditation program for our channel partners’ sales and technical professionals. As of July 31, 2019, we had more than 5,200 channel partners.

Customer Support. Our customer support organization is responsible for delivering support, professional, and educational services directly to our channel partners and to end-customers. We leverage the capabilities of our channel partners and train them in

- 10 -

the delivery of support, professional, and educational services to ensure these services are locally delivered. We believe that a broad range of support services is essential to the successful customer deployment and ongoing support of our products, and we have hired support engineers with proven experience to provide those services.

Marketing. Our marketing is focused on building our brand reputation and the market awareness of our platform and driving pipeline and end-customer demand. Our marketing team consists primarily of product marketing, brand, demand, field, communications, including analyst relations and public relations, digital and analytics functions. Marketing activities include pipeline development through demand generation, social media and advertising programs, managing the corporate web site and partner portal, trade shows and conferences, press, analyst, and customer relations, and customer awareness. Every year we organize our end-customer conference “Ignite.” We also publish major market research papers such as the “Application Usage and Threat Report” and the “Cloud Threat Forecast Report,” which are based on the application and cyberthreat landscape of our end-customers. These activities and tools benefit both our direct and indirect channels and are available at no cost to our channel partners.

Backlog. Orders for subscription and support offerings for multiple years are generally billed upfront shortly after fulfillment of an order and are included in deferred revenue. Timing of revenue recognition for subscription and support offerings may vary depending on the contractual period or when the subscription and support offerings are rendered. Products are shipped and billed shortly after receipt of an order. The majority of our product revenue comes from orders that are received and shipped in the same quarter. As such, we do not believe that our product backlog at any particular time is meaningful and it is not necessarily indicative of our future operating results.

Seasonality. Our business is affected by seasonal fluctuations in customer spending patterns. We have begun to see seasonal patterns in our business, which we expect to become more pronounced as we continue to grow, with our strongest sequential revenue growth occurring in our fiscal second and fourth quarters.

Manufacturing

We outsource the manufacturing of our security products to various manufacturing partners, which include our electronics manufacturing services provider (“EMS provider”) and original design manufacturers. This approach allows us to reduce our costs as it reduces our manufacturing overhead and inventory and also allows us to adjust more quickly to changing end-customer demand. Our EMS provider is Flextronics International, Ltd. (“Flex”), who assembles our products using design specifications, quality assurance programs, and standards that we establish, and procures components and assembles our products based on our demand forecasts. These forecasts represent our estimates of future demand for our products based upon historical trends and analysis from our sales and product management functions as adjusted for overall market conditions.

The component parts within our products are either sourced by our manufacturing partners or by various component suppliers. We do not have any long-term manufacturing contracts that guarantee us any fixed capacity or pricing, which could increase our exposure to supply shortages or price fluctuations related to raw materials.

Employees

As of July 31, 2019, we had 7,014 employees. Competition for qualified personnel in our industry is intense, and we believe that our future success depends in part on our continued ability to hire, motivate, and retain such personnel.

Available Information

Our website is located at www.paloaltonetworks.com, and our investor relations website is located at investors.paloaltonetworks.com. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available free of charge on the Investors portion of our web site as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (“SEC”). We also provide a link to the section of the SEC’s website at www.sec.gov that has all of our public filings, including Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, all amendments to those reports, our Proxy Statements, and other ownership related filings.

We also use our investor relations website as a channel of distribution for important company information. For example, webcasts of our earnings calls and certain events we participate in or host with members of the investment community are on our investor relations website. Additionally, we announce investor information, including news and commentary about our business and financial performance, SEC filings, notices of investor events, and our press and earnings releases, on our investor relations website. Investors and others can receive notifications of new information posted on our investor relations website in real time by signing up for email alerts and RSS feeds. Further corporate governance information, including our corporate governance guidelines, board committee charters, and code of conduct, is also available on our investor relations website under the heading “Governance.” The contents of our websites are not incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

- 11 -