Palo Alto Networks 10-K 2020-07-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended July 31, 2020

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from to

Commission File Number 001-35594

Palo Alto Networks, Inc.

(Exact name of registrant as specified in its charter)

3000 Tannery Way

Santa Clara, California 95054

(Address of principal executive offices, including zip code)

(408) 753-4000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of voting stock held by non-affiliates of the registrant was $22,950,644,677 as of January 31, 2020, the last business day of the registrant’s most recently completed second fiscal quarter (based on the closing sales price for the common stock on the New York Stock Exchange on such date). Shares of common stock held by each executive officer, director, and holder of 5% or more of the outstanding common stock have been excluded in that such persons may be deemed to be affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

On August 21, 2020, 96,373,294 shares of the registrant’s common stock, $0.0001 par value, were outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the information called for by Part III of this Annual Report on Form 10-K is hereby incorporated by reference from the definitive proxy statement for the registrant’s 2020 annual meeting of stockholders, which will be filed with the Securities and Exchange Commission not later than 120 days after the registrant’s fiscal year ended July 31, 2020.

TABLE OF CONTENTS

- 2 -

PART I

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K, including the sections entitled “Business,” “Risk Factors,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “plan,” “expect,” and similar expressions that convey uncertainty of future events or outcomes are intended to identify forward-looking statements.

These forward-looking statements include, but are not limited to, statements concerning the following:

• our expectations regarding the impacts on our business, the business of our customers, suppliers and partners, and the economy as a result of the global COVID-19 pandemic and related public health measures;

• expectations regarding drivers of and factors affecting growth in our business;

• the performance advantages of our products and subscription and support offerings and the potential benefits to our customers;

• trends in and expectations regarding billings, revenue (including our revenue mix), costs of revenue, gross margin, cash flows, interest expense, operating expenses (including future share-based compensation expense), income taxes, investment plans and liquidity;

• our ability to and expectation that we will continue to grow our installed end-customer base;

• expected recurring revenues resulting from expected growth in our installed base and increased adoption of our products and cloud-based subscription services;

• our expectations regarding future investments in research and development, customer support, in our employees and in our sales force, including expectations regarding growth in our sales headcount;

• our ability to develop or acquire new product, subscription, and support offerings, improve our existing product, subscription, and support offerings, and increase the value of our product, subscription, and support offerings, including through deployment of new capabilities via security applications developed by third parties;

• our expectation that we will continue to expand internationally;

• our expectation that we will continue to renew existing contracts and increase sales to our existing customer base;

• seasonal trends in our results of operations;

• expected impact of the adoption of certain recent accounting pronouncements and the anticipated timing of adopting such standards;

• our expectation that we will expand our facilities or add new facilities as we add employees and enter new geographic markets and expectations related to charges incurred in connection with exiting our former headquarter facilities;

• our expectation that we will increase our customer financing activities;

• the sufficiency of our cash flow from operations with existing cash and cash equivalents to meet our cash needs for the foreseeable future;

• future investments in product development, subscriptions, or technologies, and any related delays in the development or release of new product and subscription offerings;

• our ability to successfully acquire and integrate companies and assets, including closing The Crypsis Group acquisition;

• expectations and intentions with respect to the products and technologies that we acquire and introduce;

• the timing and amount of capital expenditures and share repurchases; and

• other statements regarding our future operations, financial condition and prospects, and business strategies.

These forward-looking statements are subject to a number of risks, uncertainties, and assumptions, including those described in “Risk Factors” included in Part I, Item 1A and elsewhere in this Annual Report on Form 10-K. Moreover, we operate in a very competitive and rapidly changing environment, and new risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties, and assumptions, the forward-looking events and circumstances discussed in this Annual Report on Form

- 3 -

10-K may not occur, and actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements. We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law. Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements.

General

Palo Alto Networks, Inc. is a global cybersecurity provider with a vision of a world where each day is safer and more secure than the one before. We were incorporated in 2005 and are headquartered in Santa Clara, California.

We empower enterprises, service providers, and government entities to secure all users, applications, data, networks and devices with comprehensive visibility and context continuously across all locations. We deliver cybersecurity products covering a broad range of use cases, enabling our end-customers to secure their networks, remote workforce, access to the service edge, branch locations, public and private clouds, and to advance their Security Operations Centers (“SOC”). We believe our portfolio offers advanced prevention and security, while reducing the total cost of ownership for organizations by improving operational efficiency and eliminating the need for siloed point products. We do this with solutions focused on delivering value in three fundamental areas:

Secure the Enterprise:

• Secure the network through our ML-powered Next-Generation Firewalls, available in a number of form factors, including physical, virtual and containerized appliances, as well as a cloud-delivered service, with Panorama management available as an appliance or as a virtual machine for the public or private cloud. This also includes security services such as Threat Prevention, WildFire, URL Filtering, DNS Security, IoT Security, GlobalProtect, SD-WAN and Data Loss Prevention that are delivered as SaaS subscriptions to our ML-powered Next-Generation Firewalls.

Secure the Cloud:

• Secure the cloud through our Prisma security offerings, such as Prisma Cloud, the industry’s most comprehensive Cloud Native Security Platform (“CNSP”), protecting applications, data and the entire cloud native technology stack, throughout the full development lifecycle and across multi- and hybrid- cloud environments, Prisma SaaS for protecting SaaS applications, Prisma Access, a comprehensive Secure Access Service Edge (“SASE”) offering, that, together with CloudGenix SD-WAN, securing SD-WAN to enable the cloud delivered branch, and VM-Series and CN-Series for in-line network security in multi- and hybrid- cloud environments.

Secure the Future:

• Secure the future of security operations through our Cortex security offerings, which includes Cortex XDR for prevention, detection and response, Cortex XSOAR for security orchestration, automation and response (“SOAR”), AutoFocus for threat intelligence, and Cortex Data Lake to collect and integrate security data for analytics. These products are delivered as software or SaaS subscriptions.

Impact of COVID-19 on our Business

We are actively monitoring, evaluating and responding to developments relating to COVID-19, which has and is expected to result in continued significant global social and business disruption. While we instituted a global work-from-home policy beginning in March 2020, we did not incur significant disruptions in our work operations during fiscal 2020. We are conducting business as usual with restrictions to employee travel and transitioning of in-person marketing events to virtual formats, among other modifications. These changes will substantially remain in effect in the first quarter of fiscal 2021 and are likely to extend to future quarters. We will continue to actively monitor the situation and will make further changes to our business operations as may be required by federal, state or local authorities or that we determine are in the best interests of our employees, end-customers, partners, suppliers and stockholders. Our focus remains on the safety of our employees, striving to protect the health and well-being of the communities in which we operate, and providing technology to our employees, end-customers and partners to help them do their best work while remote.

Although some end-customers adopted Prisma Access as their secure work-from-home solution for the longer term, COVID-19 may curtail our end-customers' spending and could lead them to delay or defer purchasing decisions, and lengthen sales cycles and payment terms, which could materially adversely impact our business, results of operations and overall financial performance. Also, certain of our end-customers or partners may be or may become credit or cash constrained making it difficult for them to fulfill their payment obligations to us. The extent of the impact of COVID-19 on our operational and financial performance will depend on developments, including the duration and spread of the virus, impact on our end-customers’ spending, volume of sales and length of our sales cycles, impact on our partners, suppliers and employees, actions that may be taken by governmental authorities and other factors identified in Part I, Item 1A "Risk Factors" in this Form 10-K. Given the dynamic nature of these circumstances, the full impact of COVID-19 on our ongoing business, results of operations and overall financial performance cannot be reasonably estimated at this time.

- 4 -

Product, Subscription, and Support Offerings

Our products are available in the form of the product, subscription, and support offerings described below.

Firewall Appliances and Software. All of our firewall appliances and software incorporate our PAN-OS operating system and come with the same rich set of features ensuring consistent operation across our entire product line. These features include: App-ID, User-ID, Content-ID, site-to-site virtual private network (“VPN”), remote access Secure Sockets Layer (“SSL”) VPN, and Quality-of-Service (“QoS”). Our appliances and software are designed for different performance requirements throughout an organization and are classified based on throughput, ranging from our PA-220, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7080, which is designed for large scale data centers and service provider use. Our firewall appliances come in a physical form factor, in a virtual form factor, called VM-Series, that is available for virtualization and cloud environments from companies such as VMware, Inc. (“VMware”), Microsoft Corporation (“Microsoft”), Amazon.com, Inc. (“Amazon”), and Google, Inc. (“Google”), and in Kernel-based Virtual Machine (“KVM”)/OpenStack environments, as well as in a containerized form factor, called CN-Series.

Panorama. Panorama is our centralized security management solution for global control of all of our firewall appliances and software deployed on an end-customer’s network, as well as in their instances in public or private cloud environments as a virtual appliance or a physical appliance. Panorama is used for centralized policy management, device management, software licensing and updates, centralized logging and reporting, and log storage. Panorama controls the security, network address translation (“NAT”), QoS, policy-based forwarding, decryption, application override, captive portal, and distributed denial of service/denial of service (“DDoS/DoS”) protection aspects of the appliances, software, virtual and containerized systems under management. Panorama centrally manages device software and associated updates, including SSL-VPN clients, SD-WAN, dynamic content updates, and software licenses. Panorama offers network security monitoring through the ability to view logs and run reports from all managed appliances and software in one location without the need to forward the logs and reliably expands log storage for long-term event investigation and analysis.

Virtual System Upgrades**.** Virtual System Upgrades are available as extensions to the Virtual System capacity that ships with our physical appliances. Virtual Systems provide a mechanism to support multiple distinct security policies and administrative access for tenants on the same hardware device, which is applicable to our large enterprise and service provider end-customers.

Subscription Offerings**.** We offer a number of subscriptions as part of our portfolio. Of these subscription offerings, Threat Prevention, WildFire, URL Filtering, DNS Security, IoT Security, GlobalProtect, SD-WAN and Data Loss Prevention are sold as options to our firewall appliances and software, whereas AutoFocus, Prisma Access (formerly GlobalProtect cloud service), CloudGenix SD-WAN, Prisma Cloud (formerly Redlock Inc. (“RedLock”), Twistlock LTD. (“Twistlock”), PureSec Ltd. (“PureSec”) and Aporeto Inc. (“Aporeto”)), Prisma SaaS (formerly Aperture), Cortex Data Lake (formerly Logging Service), Cortex XDR (formerly Cortex XDR and Traps) and Cortex XSOAR (formerly Demisto Inc. (“Demisto”)) are sold on a per-user, per-endpoint, or capacity-based basis. Our subscription offerings include:

Secure the Enterprise:

• Threat Prevention.** This subscription provides intrusion detection and prevention capabilities and blocks vulnerability exploits, viruses, spyware, buffer overflows, denial-of-service attacks, and port scans from compromising and damaging enterprise information resources. It includes mechanisms such as protocol decoder-based analysis, protocol anomaly-based protection, stateful pattern matching, statistical anomaly detection, heuristic-based analysis, custom vulnerability and spyware “phone home” signatures, and workflows to manage popular open-source signature formats to extend our leading coverage.

• WildFire.** This cloud-based or appliance-based subscription provides protection against targeted malware and advanced persistent threats and provides a near real-time analysis engine for detecting previously unseen malware while resisting attacker evasion techniques. The core component of this subscription is a sandbox environment that can operate on an end-customers’ private cloud or our public cloud, where files can be run and monitored for more than 100 behavioral characteristics that identify the file as malware. A machine learning module derived from the cloud sandbox environment is now delivered in-line on the ML-powered Next-Generation Firewalls to identify the majority of unknown threats without cloud connectivity. Once identified, whether in the cloud or in-line, preventive measures are automatically generated and delivered to all subscribed devices in seconds or less. By providing this as a cloud-based subscription, all of our end-customers benefit from malware found on any of our end-customer’s networks.

• URL Filtering.** This subscription provides the uniform resource locator (“URL”) filtering capabilities of our portfolio. Our cloud-based URL filtering database consists of millions of URLs across many categories and is designed to analyze web traffic and prevent web-based threats such as phishing, malware, and command-and-control. The curated on-appliance URL database can be augmented to suit the traffic patterns of the local user community with a custom URL database. Our cloud-delivered service features network-based phishing protection, including a machine learning module delivered inline on our ML-powered Next-Generation Firewalls. These machine learning techniques can detect and stop never before seen threats and evasive phishing before they reach users or endpoints. Native integration with our ML-

- 5 -

powered Next-Generation Firewalls eliminates the need for customers to deploy and manage their web security separately from network security.

• DNS Security.** This cloud-based subscription uses machine learning to proactively block malicious domains and stops attacks in progress. Unlike other solutions, it does not require endpoint routing configurations to be maintained and therefore cannot be by-passed. It allows firewalls access to DNS signatures that are generated using advanced predictive analysis, machine learning, and malicious domain data from a growing threat intelligence sharing community of which we are a part. Expanded categorization of DNS traffic and comprehensive analytics allow deep insights into threats, empowering security personnel with the context to optimize their security posture.

• IoT Security.** IoT Security is a new subscription on our ML-powered Next-Generation Firewalls with backward compatibility to older versions of PAN-OS. Using machine learning and our App-ID technology, it can accurately identify and classify various IoT and operational technology (“OT”) devices including never-been-seen-before devices, mission critical OT devices and unmanaged legacy systems. It uses machine learning to baseline normal behavior, identify anomalous activity, assess risk, and provide policy recommendations to allow trusted behavior with a new Device-ID policy construct on our ML-powered Next-Generation Firewalls. Our existing subscription-based security services have also been enhanced with IoT context to prevent threats on various devices, including IoT and OT devices.

• GlobalProtect.** This appliance-based subscription provides protection for users of both traditional laptop and mobile devices. It expands the boundaries of the end-users’ physical network, effectively establishing a logical perimeter that encompasses remote laptop and mobile device users irrespective of their location. When a remote user logs into the device, GlobalProtect automatically determines the closest gateway available to the roaming device and establishes a secure connection. Regardless of the operating systems, laptops, tablets and phones will stay connected to the corporate network when they are on a network of any kind and as a result, are protected as if they never left the corporate campus. GlobalProtect ensures that the same secure application enablement policies that protect users at the corporate site are enforced for all users, independent of their location.

• SD-WAN.** Our SD-WAN subscription is now integrated with PAN-OS, so that our end-customers can get the security features of our PAN-OS ML-powered Next Generation Firewall together with SD-WAN functionality. The SD-WAN overlay supports dynamic, intelligent path selection based on the applications, services and conditions of the links that each application or service is allowed to use, allowing applications to be prioritized based on criteria such as whether the application is mission-critical, latency-sensitive, or meets certain health criteria.

• Data Loss Prevention.** Our Enterprise Data Loss Prevention service is a cloud service that provides consistent, reliable protection of sensitive data, such as personally identifiable information (PII) and intellectual property, for all traffic types, applications, and users. Native integration with our products makes it simple to deploy, and advanced machine learning minimizes management complexity. Enterprise DLP allows organizations to consistently discover, classify, monitor, and protect sensitive data, wherever it may reside. It helps minimize the risk of a data breach both on-premises and in the cloud—such as in Office/Microsoft 365™, Salesforce®, and Box—and assists in meeting stringent data privacy and compliance regulations, including GDPR, CCPA, PCI DSS, HIPAA, and others.

Secure the Cloud:

• Prisma Cloud.** Prisma Cloud is the industry’s most comprehensive CNSP, securing public clouds and cloud native applications. Prisma Cloud delivers cloud security posture management and a cloud workload protection platform that provides comprehensive visibility and threat detection across an organization's hybrid, multi-cloud infrastructure.

• Prisma SaaS.** Prisma SaaS is a multi-mode, cloud access security broker service that helps govern sanctioned SaaS application usage across all users and helps prevent breaches and non-compliance. Specifically, the service enables the discovery and classification of data stored across the supported SaaS applications, protects sensitive data from accidental exposure, identifies and protects against known and unknown malware, and performs user activity monitoring to identify potential misuse or data exfiltration. It delivers complete visibility and granular enforcement across all user, folder, and file activity within sanctioned SaaS applications.

• Prisma Access.** This cloud-based subscription enables our end-customers to utilize the preventive capabilities of our portfolio to secure remote offices and mobile users, providing consistent protection across globally distributed network and cloud environments without the need for firewall appliances or software in the remote locations. With this offering, our end-customers can quickly and easily add or remove remote locations and users, and establish and adjust security policies as needed, using a multi-tenant, cloud-based security infrastructure that we operate on their behalf.

• CloudGenix SD-WAN**. Our CloudGenix SD-WAN solution is a next-generation SD-WAN solution that makes the secure cloud-delivered branch possible. Unlike legacy SD-WAN solutions that introduce cost and complexity, Our CloudGenix

- 6 -

SD-WAN ensures exceptional user experience with app defined policies and simplifies network and security operations using machine learning and automation.

Secure the Future:

• Cortex XDR.** This cloud-based subscription enables organizations to identify and stop the most sophisticated attacks by applying AI and machine learning to context rich network, endpoint, and cloud data, to quickly find and stop targeted attacks, insider abuse, and compromised endpoints. Cortex XDR is comprised of XDR Prevent and XDR Pro. XDR Prevent delivers enterprise class endpoint security focused on preventing attacks. XDR Pro encompasses endpoint detection and response (“EDR”) and cross-data source analytics including network and identity data. These capabilities build on each other, such that a customer can start with XDR Prevent, then upgrade to XDR Pro for EDR and then upgrade to XDR Pro for cross-data source analytics.

• Cortex XSOAR.** Available as a cloud-based subscription or an on-premises appliance, Cortex XSOAR is the industry’s first extended SOAR offering that unifies playbook automation, case management, real-time collaboration, and threat intelligence management to serve security teams across the incident lifecycle. With Cortex XSOAR, security teams can standardize processes, automate repeatable tasks and manage incidents across their security product stack to improve response time and analyst productivity. Cortex XSOAR is powered by our machine learning bot, DBot, which ingests information about indicators to determine if they are malicious. It learns from the real-life analyst interactions and past investigations to help SOC teams with analyst assignment suggestions, playbook enhancements, and best next steps for investigations.

• AutoFocus.** This cloud-based subscription provides threat intelligence capabilities to our end-customers’ security operations teams. Indicators of compromise and anomalies that occur on an end-customer’s network can be correlated with similar data that has been centrally collected from all our participating end-customers. This offers our end-customers priority alerts, deep attack context, and high-fidelity threat intelligence across millions of malware samples and tens of billions of file artifacts. This includes a direct pipeline to actionable intelligence from Unit 42, our threat research team. AutoFocus can inform users if adversaries and campaigns discovered by Unit 42 have targeted the end-user’s network, or similar networks.

• Cortex Data Lake.** This cloud-based subscription allows our customers to collect large amounts of context-rich enhanced network logs generated by our security offerings, including those of our ML-powered Next-Generation Firewalls, Prisma Access subscription, and Cortex XDR subscription, without needing to plan for local data storage.

Support. We offer Standard Support, Premium Support, four-hour Premium Support and Platinum Support to our end-customers and channel partners. Our channel partners that operate a Palo Alto Networks Authorized Support Center (“ASC”) typically deliver level-one and level-two support. We provide level-three support 24 hours a day, seven days a week through regional support centers that are located worldwide. We also offer an annual subscription-based Service Account Management (“SAM”) service that provides support for end-customers with unique or complex support requirements. We offer our end-customers ongoing support for both hardware and software in order to receive ongoing security updates, PAN-OS upgrades, bug fixes, and repair. End-customers typically purchase these services for a one-year or longer term at the time of the initial product sale and typically renew for successive one-year or longer periods. Additionally, we provide expedited replacement for any defective hardware. We use a third-party logistics provider to manage our worldwide deployment of spare appliances and other accessories.

Professional Services. Professional services are delivered directly by us and through our authorized channel partners to our end-customers and include on-location and remote, hands-on experts who plan, design, and deploy effective security solutions tailored to our end-customers’ specific requirements. These services include architecture design and planning, configuration, and firewall migrations, as well as Prisma and Cortex deployments. Our education services provide online and in-classroom training and are also primarily delivered through our authorized training partners.

Technology

We provide comprehensive and integrated cybersecurity solutions with a portfolio that eliminates the need for siloed security products.

ML-powered Next-Generation Firewall. Our ML-powered Next-Generation Firewalls embed machine learning in the core of the firewall, empowering our customers to stay ahead of new emerging threats, see and secure their entire enterprise, including IoT, and support speed and error reduction with automatic policy recommendations. Our ML-Powered Next-Generation Firewalls extend visibility and security to all devices connecting to an end-user’s network, including unmanaged IoT devices without the need to deploy additional sensors. Our ML-powered Next-Generation Firewalls inspect all traffic defined by the end-users policies, including all applications, threats, and content, and tie that traffic to the user, regardless of location or device type. The user, application, devices and content—the elements that run a business—become integral components of an enterprise's security policy via our User-ID, App-ID, Device-ID and Content-ID technology. As a result, security aligns with business policies as well as write rules that are easy to understand and maintain. Our ML-powered Next-Generation Firewalls can be deployed in multiple form factors, including hardware, software and cloud service, all managed centrally.

- 7 -

Prisma Access. Prisma Access is a SASE technology that helps organizations deliver consistent security to remote networks and mobile users. Located in more than 100 locations around the world in 76 countries, Prisma Access consistently inspects all traffic across all ports and provides bidirectional networking to enable branch-to-branch and branch-to-headquarter traffic.

Delivering protection at scale, Prisma Access provides global coverage so teams do not have to worry about sizing and deploying hardware firewalls at the branch. Prisma Access uses Cortex Data Lake for centralized analysis, reporting, and forensics.

CloudGenix SD-WAN**.** CloudGenix SD-WAN provides deep application visibility, with Layer 7 intelligence for network policy creation and traffic engineering, ensuring exceptional user experience by enabling network teams to deliver Service Level Agreements (“SLA”s) for all apps including Cloud, SaaS and Unified communication as a Service (“UCaaS”). Machine learning and data science methodologies automate operations and problems avoidance to simplify network operations and reduce network trouble tickets.

Prisma Cloud. Prisma Cloud is a unified CNSP with broad security and compliance coverage for the entire cloud across hybrid and multi-cloud environments. Prisma Cloud protects cloud native applications and data spanning hosts, containers, serverless deployments, storage, and other platform as a Service (“PaaS”) offerings across cloud platforms. It dynamically discovers resources as they are deployed and correlates data cloud services (resource configurations, flow logs, audit logs, host and container logs, etc.) to provide security and compliance insights for cloud applications. It uses machine learning to profile user, workload, and app behaviors to prevent advanced threats.

Prisma Cloud integrates with continuous integration and continuous development (“CI/CD”) tool chains to provide full lifecycle vulnerability management, infrastructure-as-code scanning, runtime defense, and cloud native firewalling. With a comprehensive library of compliance frameworks, it vastly simplifies the task of maintaining compliance. Prisma Cloud provides this through deep context-sharing that spans infrastructure, PaaS, users, development platforms, data, and application workloads. Seamless integration with security orchestration tools ensures rapid remediation of vulnerabilities.

Prisma SaaS. Prisma SaaS enables safe cloud adoption by providing visibility, compliance controls, and security for cloud applications and sensitive data. It helps minimize the use of shadow IT, secure access to corporate SaaS applications and mitigate the risk of a data breach in the cloud.

Cortex XDR. Cortex XDR is an industry recognized extended detection and response offering that integrates endpoint, network, and cloud data to stop sophisticated attacks. Going beyond EDR, Cortex XDR detects the most complex threats using analytics across key data sources and reveals the root cause, reducing investigation time eighty eight percent compared to manual processes.

Cortex XSOAR. Cortex XSOAR improves SOC efficiency with an industry recognized extended SOAR offering. Security leaders can transform every aspect of their operations with a comprehensive, unified approach to case management, automation, real-time collaboration, and threat intelligence management. Cortex XSOAR enables security teams to manage alerts across all sources, standardize any processes with playbooks, take action on threat intelligence, and automate response for every security use case, and use of which has resulted, for many of our customers, in significantly faster SOC response times and a significant reduction in alerts to the SOC which require human intervention.

Certifications. Many of our products have been awarded Federal Information Processing Standard (“FIPS”) 140-2 Level 2, Common Criteria/National Information Assurance Partnership (“NIAP”) Evaluation Assurance Level **(“**EAL”) 2, Common Criteria/NIAP EAL4+, Network Equipment-Building System (“NEBS”), and ICSA Firewall certifications.

Research and Development

Our research and development efforts are focused on developing new hardware and software and on enhancing and improving our existing product and subscription offerings. We believe that hardware and software are both critical to expanding our leadership in the enterprise security market. Our engineering team has deep networking, endpoint, and security expertise and works closely with end-customers to identify their current and future needs. In addition to our focus on hardware and software, our research and development team is focused on research into applications and threats, which allows us to respond to the rapidly changing application and threat landscape. We supplement our own research and development efforts with technologies and products that we license from third parties. We test our products thoroughly to certify and ensure interoperability with third-party hardware and software products.

We believe that innovation and timely development of new features and products is essential to meeting the needs of our end-customers and improving our competitive position. During fiscal 2020, we introduced several new offerings, including: PAN-OS 10.0 with over 70 new features; our new ML-powered Next-Generation Firewalls; and our Cortex XSOAR solution that redefines security orchestration and automation with integrated threat intelligence management. Additionally, we acquired productive investments that fit well within our long-term strategy. For example, we acquired Zingbox, Inc. (“Zingbox”), which we believe will accelerate our delivery of IoT security through our ML-powered Next-Generation Firewall and Cortex products, Aporeto, which we believe will strengthen our cloud-native security platform capabilities delivered by Prisma Cloud and CloudGenix Inc. (“CloudGenix”), which we believe will strengthen our SASE offering.

We plan to continue to significantly invest in our research and development effort as we evolve and extend the capabilities of our portfolio.

- 8 -

Intellectual Property

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other intellectual property rights. In particular, leading companies in the enterprise security industry have extensive patent portfolios and are regularly involved in both offensive and defensive litigation. We continue to grow our patent portfolio and own intellectual property and related intellectual property rights around the world that relate to our products, services, research and development, and other activities, and our success depends in part upon our ability to protect our core technology and intellectual property. We file patent applications to protect our intellectual property and believe that the duration of our issued patents is sufficient when considering the expected lives of our products.

We actively seek to protect our global intellectual property rights and to deter unauthorized use of our intellectual property by controlling access to and use of our proprietary software and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, end-customers and partners, and our software is protected by U.S. and international copyright laws. Despite our efforts to protect our intellectual property rights, our rights may not be successfully asserted in the future or may be invalidated, circumvented or challenged. In addition, the laws of various foreign countries where our offerings are distributed may not protect our intellectual property rights to the same extent as laws in the United States. See “Risk Factors-Claims by others that we infringe their proprietary technology or other rights could harm our business,” “Risk Factors-Our proprietary rights may be difficult to enforce or protect, which could enable others to copy or use aspects of our products or subscriptions without compensating us,” and “Legal Proceedings” below for additional information.

Competition

We operate in the intensely competitive enterprise security market that is characterized by constant change and innovation. Changes in the application, threat, and technology landscape result in evolving customer requirements for the protection from threats and the safe enablement of applications. Our main competitors fall into five categories:

• large companies that incorporate security features in their products, such as Cisco Systems, Inc. (“Cisco”) or those that have acquired, or may acquire, large network and endpoint security vendors and have the technical and financial resources to bring competitive solutions to the market;

• independent security vendors such as Check Point Software Technologies Ltd. (“Check Point”), Fortinet, Inc. (“Fortinet”), and Zscaler, Inc. (“Zscaler”) that offer a mix of network and endpoint security products;

• startups and single-vertical vendors that offer independent or emerging solutions in network;

• public cloud vendors and startups that offer solutions for cloud security (private, public and hybrid cloud); and

• large and small companies, such as Crowdstrike, Inc (“Crowdstrike”) that offer solutions for security operations and endpoint security.

As our market grows, it will attract more highly specialized vendors as well as larger vendors that may continue to acquire or bundle their products more effectively.

The principal competitive factors in our market include:

• product features, reliability, performance, and effectiveness;

• product line breadth, diversity, and applicability;

• product extensibility and ability to integrate with other technology infrastructures;

• price and total cost of ownership;

• adherence to industry standards and certifications;

• strength of sales and marketing efforts; and

• brand awareness and reputation.

We believe we generally compete favorably with our competitors on the basis of these factors as a result of the features and performance of our portfolio, the ease of integration of our products with technological infrastructures, and the relatively low total cost of ownership of our products. However, many of our competitors have substantially greater financial, technical, and other resources, greater name recognition, larger sales and marketing budgets, broader distribution, more diversified product lines, and larger and more mature intellectual property portfolios.

Sales, Customer Support and Marketing

Customers. Our end-customers are predominantly medium to large enterprises, service providers, and government entities. Our end-customers operate in a variety of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications. Our end-customers deploy our portfolio of products for a

- 9 -

variety of security functions across a variety of deployment scenarios. Typical deployment scenarios include the enterprise perimeter, the enterprise data center, and the distributed enterprise perimeter. Our end-customer deployments typically involve at least one pair of our products along with one or more of our subscriptions, depending on size, security needs and requirements, and network complexity. No single end-customer accounted for more than 10% of our total revenue in fiscal 2020, 2019, or 2018.

Distribution. We primarily sell our products and subscription and support offerings to end-customers through our channel partners utilizing a two-tier, indirect fulfillment model whereby we sell our products and subscription and support offerings to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers. Sales are generally subject to our standard, non-exclusive distributor agreement, which provides for an initial term of one year, one-year renewal terms, termination by us with 30-90 days written notice prior to the renewal date, and payment to us from the channel partner within 30-45 calendar days of the date we issue an invoice for such sales. For fiscal 2020, 68.8% of our total revenue was derived from sales to four distributors.

We also sell our VM-Series virtual firewalls directly to end-customers through Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, and Google’s Cloud Platform Marketplace under a usage-based licensing model.

Sales. Our sales organization is responsible for large-account acquisition and overall market development, which includes the management of the relationships with our channel partners, working with our channel partners in winning and supporting end-customers through a direct-touch approach, and acting as the liaison between our end-customers and our marketing and product development organizations. We expect to continue to grow our sales headcount in all of our principal markets and expand our presence into countries where we currently do not have a direct sales presence.

Our sales organization is supported by sales engineers with responsibility for pre-sales technical support, solutions engineering for our end-customers, and technical training for our channel partners.

Channel Program. Our NextWave Channel Partner program is focused on building in-depth relationships with solutions-oriented distributors and resellers that have strong security expertise. The program rewards these partners based on a number of attainment goals, as well as provides them access to marketing funds, technical and sales training, and support. To ensure optimal productivity, we operate a formal accreditation program for our channel partners’ sales and technical professionals. As of July 31, 2020, we had more than 5,600 channel partners.

Customer Support. Our customer support organization is responsible for delivering support, professional, and educational services directly to our channel partners and to end-customers. We leverage the capabilities of our channel partners and train them in the delivery of support, professional, and educational services to ensure these services are locally delivered. We believe that a broad range of support services is essential to the successful customer deployment and ongoing support of our products, and we have hired support engineers with proven experience to provide those services.

Marketing. Our marketing is focused on building our brand reputation and the market awareness of our portfolio and driving pipeline and end-customer demand. Our marketing team consists primarily of product marketing, brand, demand, field, communications, including analyst relations and digital and analytics functions. Marketing activities include pipeline development through demand generation, social media and advertising programs, managing the corporate web site and partner portal, trade shows and conferences, analyst relationships, customer advocacy, and customer awareness. Every year we organize our end-customer conference “Ignite.” We also publish threat intelligence research such as the Unit 42 Cloud Threat Report and the Unit 42 IoT Threat Report, which are based on data from our global threat intelligence team, Unit 42. These activities and tools benefit both our direct and indirect channels and are available at no cost to our channel partners.

Backlog. Orders for subscription and support offerings for multiple years are generally billed upfront shortly after fulfillment of an order and are included in deferred revenue. Timing of revenue recognition for subscription and support offerings may vary depending on the contractual period or when the subscription and support offerings are rendered. Products are shipped and billed shortly after receipt of an order. The majority of our product revenue comes from orders that are received and shipped in the same quarter. As such, we do not believe that our product backlog at any particular time is meaningful and it is not necessarily indicative of our future operating results.

Seasonality. Our business is affected by seasonal fluctuations in customer spending patterns. We have begun to see seasonal patterns in our business, which we expect to become more pronounced as we continue to grow, with our strongest sequential revenue growth occurring in our fiscal second and fourth quarters.

Manufacturing

We outsource the manufacturing of our security products to various manufacturing partners, which include our electronics manufacturing services provider (“EMS provider”) and original design manufacturers. This approach allows us to reduce our costs as it reduces our manufacturing overhead and inventory and also allows us to adjust more quickly to changing end-customer demand. Our EMS provider is Flextronics International, Ltd. (“Flex”), who assembles our products using design specifications, quality assurance programs, and standards that we establish, and procures components and assembles our products based on our demand forecasts. These forecasts represent our estimates of future demand for our products based upon historical trends and analysis from our sales and product management functions as adjusted for overall market conditions.

- 10 -

The component parts within our products are either sourced by our manufacturing partners or by various component suppliers. We do not have any long-term manufacturing contracts that guarantee us any fixed capacity or pricing, which could increase our exposure to supply shortages or price fluctuations related to raw materials.

Employees

As of July 31, 2020, we had 8,014 employees. Competition for qualified personnel in our industry is intense, and we believe that our future success depends in part on our continued ability to hire, motivate, and retain such personnel.

Available Information

Our website is located at www.paloaltonetworks.com, and our investor relations website is located at investors.paloaltonetworks.com. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available free of charge on the Investors portion of our web site as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (“SEC”). We also provide a link to the section of the SEC’s website at www.sec.gov that has all of our public filings, including Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, all amendments to those reports, our Proxy Statements, and other ownership related filings.

We also use our investor relations website as a channel of distribution for important company information. For example, webcasts of our earnings calls and certain events we participate in or host with members of the investment community are on our investor relations website. Additionally, we announce investor information, including news and commentary about our business and financial performance, SEC filings, notices of investor events, and our press and earnings releases, on our investor relations website. Investors and others can receive notifications of new information posted on our investor relations website in real time by signing up for email alerts and RSS feeds. Further corporate governance information, including our corporate governance guidelines, board committee charters, and code of conduct, is also available on our investor relations website under the heading “Governance.” The contents of our websites are not incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

- 11 -

Our operations and financial results are subject to various risks and uncertainties including those described below. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks or others not specified below materialize, our business, financial condition, and operating results could be materially adversely affected, and the market price of our common stock could decline. In addition, the impacts of COVID-19 and any worsening of the economic environment may exacerbate the risks described below, any of which could have a material impact on us. This situation is changing rapidly, and additional impacts may arise that we are not currently aware of.

Risks Related to Our Business and Our Industry

The recent global COVID-19 outbreak could harm our business and results of operations.

The novel strain of COVID-19 identified in late 2019 has spread globally, including within the United States, and has resulted in government authorities implementing numerous measures to try to contain the virus, such as travel bans and restrictions, quarantines, shelter in place orders, and shutdowns. This outbreak has negatively impacted and will likely continue to have a negative impact on, worldwide economic activity and financial markets and has impacted, and will further impact, our workforce and operations, the operations of our end-customers, and those of our respective channel partners, vendors and suppliers. In light of the uncertain and rapidly evolving situation relating to the spread of this virus and various government restrictions and guidelines, we have taken measures intended to mitigate the spread of the virus and minimize the risk to our employees, channel partners, end-customers, and the communities in which we operate. These measures include transitioning our employee population to work remotely from home beginning in March 2020, which is planned to continue through the first quarter of fiscal 2021 and is likely to expand into future quarters. Although we continue to monitor the situation and may adjust our current policies as more information and public health guidance become available, these precautionary measures that we have adopted could negatively affect our customer success efforts, sales and marketing efforts, delay and lengthen our sales cycles, and create operational or other challenges, any of which could harm our business and results of operations. In addition, COVID-19 may disrupt the operations of our end-customers and channel partners for an indefinite period of time, including as a result of travel restrictions and/or business shutdowns, all of which could negatively impact our business and results of operations, including cash flows.

The impact of COVID-19 is fluid and uncertain, but it has caused and may continue to cause various negative effects, including an inability to meet with our actual or potential end-customers; our end-customers deciding to delay or abandon their planned purchases; increased requests for delayed payment terms or product discounts by our end-customers and channel partners; us delaying, canceling, or withdrawing from user and industry conferences and other marketing events, including some of our own; changes in the demand of our products, which has caused us to reprioritize our engineering and research and development efforts and make changes to our original offering roadmap; and delays or possible disruptions in our supply chain. As a result, we may experience extended sales cycles; our demand generation activities, and our ability to close transactions with end-customers and partners may be negatively impacted; our ability to provide 24x7 worldwide support and/or replacement parts to our end-customers may be adversely affected; and it has been and, until the COVID-19 outbreak is contained and global economic activity stabilizes, will continue to be more difficult for us to forecast our operating results.

More generally, the outbreak has not only significantly and adversely increased economic and demand uncertainty, but it has caused a global economic slowdown, and it is likely that it will cause a global recession which could likely decrease technology spending and adversely affect demand for our offerings and harm our business and results of operations.

Our business and operations have experienced growth in recent periods, and if we do not effectively manage any future growth or are unable to improve our systems, processes, and controls, our operating results could be adversely affected.

We have experienced growth and increased demand for our products and subscriptions over the last few years. As a result, our employee headcount has increased significantly, and we expect it to continue to grow over the next year. For example, from the end of fiscal 2019 to the end of fiscal 2020, our headcount increased from 7,014 to 8,014 employees. In addition, as we have grown, our number of end-customers has also increased significantly, and we have increasingly managed more complex deployments of our products and subscriptions with larger end-customers. The growth and expansion of our business and product, subscription, and support offerings places a significant strain on our management, operational, and financial resources. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner, all of which may be more difficult to accomplish the longer that our employees must work remotely from home.

We may not be able to successfully implement or scale improvements to our systems, processes, and controls in an efficient or timely manner. In addition, our existing systems, processes, and controls may not prevent or detect all errors, omissions, or fraud. We may also experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software licensed to help us with such improvements. Any future growth would add complexity to our organization and require effective coordination throughout our organization. Failure to manage any future growth effectively could result in increased costs,

- 12 -

disrupt our existing end-customer relationships, reduce demand for or limit us to smaller deployments of our products, or harm our business performance and operating results.

Our operating results may vary significantly from period to period and be unpredictable, which could cause the market price of our common stock to decline.

Our operating results, in particular, our revenues, gross margins, operating margins, and operating expenses, have historically varied from period to period, and even though we have experienced growth, we expect variation to continue as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

• our ability to attract and retain new end-customers or sell additional products and subscriptions to our existing end-customers;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of our end-customers, including the likely slowdown in technology spending due to the recent global economic downturn;

• changes in end-customer, distributor or reseller requirements, or market needs;

• price competition;

• the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of our industry, including consolidation among our competitors or end-customers and strategic partnerships entered into by and between our competitors;

• changes in the mix of our products, subscriptions, and support,

Showing the first 8K of 138K characters. Open the full section

Not applicable.

Our corporate headquarters is located in Santa Clara, California where we lease approximately 941,000 square feet of space under three lease agreements that expire in July 2028, with options to extend the lease terms through July 2046. We also lease space for personnel in Israel. In addition, we provide our cloud-based subscription offerings through data centers operated under co-location arrangements in the United States, Europe, and Asia. Refer to Note 11. Leases in Part II, Item 8 of this Annual Report on Form 10-K for more information on our operating leases. Additionally, we own 5.8 acres of land adjacent to our headquarters in Santa Clara, California, which we intend to develop to accommodate future expansion, the speed of which development has been slowed due to the current environment.

We believe that our current facilities are adequate to meet our current needs. We intend to expand our facilities or add new facilities as we add employees and enter new geographic markets, and we believe that suitable additional or alternative space will be available as needed to accommodate ongoing operations and any such growth. However, we expect to incur additional expenses in connection with such new or expanded facilities.

The information set forth under the “Litigation” subheading in Note 12. Commitments and Contingencies in Part II, Item 8 of this Annual Report on Form 10-K is incorporated herein by reference.

Not applicable.

- 34 -

PART II

Market Information

Our common stock, $0.0001 par value per share, began trading on the NYSE on July 20, 2012, where its prices are quoted under the symbol “PANW.”

Holders of Record

As of August 21, 2020, there were 151 holders of record of our common stock. Because many of our shares of common stock are held by brokers and other institutions on behalf of stockholders, we are unable to estimate the total number of stockholders represented by these record holders.

Securities Authorized for Issuance under Equity Compensation Plans

See Part III, Item 12 “Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters” of this Annual Report on Form 10-K for more information regarding securities authorized for issuance.

Recent Sale of Unregistered Securities

During fiscal 2020, we issued a total of 22,724 shares of our unregistered common stock in connection with the acquisition of Zingbox (“Zingbox Transaction”) and a total of 11,983 shares of our unregistered common stock in connection with the acquisition of Aporeto (“Aporeto Transaction”).

None of the Zingbox Transaction or Aporeto Transaction involved any underwriters, any underwriting discounts or commissions, or any public offering. We believe the offers, sales, and issuances of the securities pursuant to the Zingbox Transaction, were exempt from registration under the Securities Act of 1933, as amended (the “Act”) by virtue of Section 4(a)(2) of the Act and Rule 506 of Regulation D promulgated thereunder, because the issuance of securities to the recipients did not involve a public offering. The recipients of the securities in the Zingbox Transaction represented their intentions to acquire the securities for investment only and not with a view to or for sale in connection with any distribution thereof, and appropriate legends were placed upon the stock certificates issued in these transactions. All recipients had adequate access, through their relationships with us or otherwise, to information about us. The issuances of these securities were made without any general solicitation or advertising.

During fiscal 2020, we also issued 2.0 million shares of our common stock to certain financial counterparties that were holders of warrants that we issued in connection with the issuance of our 2019 Notes. The shares of common stock issued upon exercise of these warrants were issued in reliance on an exemption from registration provided by Section 3(a)(9) of the Securities Act of 1933, as amended.

Purchases of Equity Securities by the Issuer and Affiliated Purchasers

The following table summarizes stock repurchases during the three months ended July 31, 2020 (in millions, except per share amounts):

(1) On February 26, 2019, we announced that our board of directors authorized a $1.0 billion share repurchase program which will be funded from available working capital. Repurchases may be made at management’s discretion from time to time on the open market, through privately negotiated transactions, transactions structured through investment banking institutions, block purchase techniques, 10b5-1 trading plans, or a combination of the foregoing. The repurchase authorization will expire on December 31, 2020 and may be suspended or discontinued at any time. On February 24, 2020, we announced that our board of directors approved the repurchase of $1.0 billion of our common stock through an accelerated share repurchase (“ASR”) transaction, which was completed in fiscal 2020. This ASR was in addition to our above-mentioned share repurchase authorization.

- 35 -

(2) Includes shares of restricted common stock delivered by certain employees upon vesting of equity awards to satisfy tax withholding requirements. The number of shares delivered by these employees to satisfy tax withholding requirements during the period was not significant.

(3) Includes repurchases under our ASR transaction. During the three months ended July 31, 2020, we purchased approximately 1.0 million shares out of the 5.2 million shares of our common stock purchased under the ASR transaction, to conclude the program.

Stock Price Performance Graph

This performance graph shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or incorporated by reference into any filing of Palo Alto Networks, Inc. under the Securities Act of 1933, as amended, or the Exchange Act, except as shall be expressly set forth by specific reference in such filing.

This performance graph compares the cumulative total return on our common stock with that of the NYSE Composite Index and the NYSE Arca Tech 100 Index for the five years ended July 31, 2020. This performance graph assumes $100 was invested on July 31, 2015, in each of the common stock of Palo Alto Networks, Inc., the NYSE Composite Index, and the NYSE Arca Tech 100 Index, and assumes the reinvestment of any dividends. The stock price performance on this performance graph is not necessarily indicative of future stock price performance.

- 36 -

The selected consolidated statement of operations data for fiscal 2020, 2019, and 2018 and consolidated balance sheet data as of July 31, 2020 and 2019 are derived from our audited consolidated financial statements included elsewhere in this Annual Report on Form 10-K. The selected consolidated statement of operations data for fiscal 2017 and 2016 and consolidated balance sheet data as of July 31, 2018, 2017, and 2016 are derived from audited financial statements not included in this Annual Report on Form 10-K. Our historical results are not necessarily indicative of the results that may be expected in the future. The selected consolidated financial data below should be read in conjunction with the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included in Part II, Item 7 of this Annual Report on Form 10-K and our consolidated financial statements and related notes included in Part II, Item 8 of this Annual Report on Form 10-K.

(1)The amounts for fiscal 2018 and 2017 have been adjusted due to our adoption of the new revenue recognition standard. Fiscal year 2016 has not been adjusted.

(2)The net carrying amount of the 2019 Notes was classified as a current liability in our consolidated balance sheets as of July 31, 2018 and was classified as a long-term liability for all other prior periods presented. The net carrying amounts of the 2023 Notes and 2025 Notes were classified as a long-term liability in the periods they were presented. Refer to Note 10. Debt in Part II, Item 8 of this Annual Report on Form 10-K for more information on the Notes.

(3)We adopted the new lease accounting standard effective August 1, 2019 on a modified retrospective basis, under which financial results reported in periods prior to fiscal 2020 were not adjusted.

- 37 -

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. The following discussion and analysis contains forward-looking statements based on current expectations and assumptions that are subject to risks and uncertainties, which could cause our actual results to differ materially from those anticipated or implied by any forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Annual Report on Form 10-K, and in particular, the risks discussed under the caption “Risk Factors” in Part I, Item 1A of this report.

Our Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) is organized as follows:

• Overview.** A discussion of our business and overall analysis of financial and other highlights in order to provide context for the remainder of MD&A.

• Key Financial Metrics.** A summary of our GAAP and non-GAAP key financial metrics, which management monitors to evaluate our performance.

• Results of Operations.** A discussion of the nature and trends in our financial results and an analysis of our financial results comparing fiscal 2020 to 2019. For discussion and analysis related to our financial results comparing fiscal 2019 to 2018, refer to Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations in our Annual Report on Form 10-K for fiscal 2019, which was filed with the Securities and Exchange Commission on September 9, 2019.

• Liquidity and Capital Resources.** An analysis of changes in our balance sheets and cash flows, and a discussion of our financial condition and our ability to meet cash needs.

• Contractual Obligations and Commitments.** An overview of our contractual obligations, contingent liabilities, commitments, and off-balance sheet arrangements outstanding as of July 31, 2020, including expected payment schedules.

• Critical Accounting Estimates.** A discussion of our accounting policies that require critical estimates, assumptions, and judgments.

• Recent Accounting Pronouncements.** A discussion of expected impacts of impending accounting changes on financial information to be reported in the future.

Overview

We empower enterprises, service providers, and government entities to secure all users, applications, data, networks and devices with comprehensive visibility and context continuously across all locations. We deliver cybersecurity products covering a broad range of use cases, enabling our end-customers to secure their networks, remote workforce, access to the service edge, branch locations, public and private clouds, and to advance their Security Operations Centers (“SOC”). We believe our portfolio offers advanced prevention and security, while reducing the total cost of ownership for organizations by improving operational efficiency and eliminating the need for siloed point products. We do this with solutions focused on delivering value in three fundamental areas:

Secure the Enterprise:

• Secure the network through our ML-powered Next-Generation Firewalls, available in a number of form factors, including physical, virtual and containerized appliances, as well as a cloud-delivered service, with Panorama management available as an appliance or as a virtual machine for the public or private cloud. This also includes security services such as Threat Prevention, WildFire, URL Filtering, DNS Security, IoT Security, GlobalProtect, SD-WAN and Data Loss Prevention that are delivered as SaaS subscriptions to our ML-powered Next-Generation Firewalls.

Secure the Cloud:

• Secure the cloud through our Prisma security offerings, such as Prisma Cloud, the industry’s most comprehensive Cloud Native Security Platform (“CNSP”), protecting applications, data and the entire cloud native technology stack, throughout the full development lifecycle and across multi- and hybrid- cloud environments, Prisma SaaS for protecting SaaS applications, Prisma Access, a comprehensive Secure Access Service Edge (“SASE”) offering, that, together with CloudGenix SD-WAN, securing SD-WAN to enable the cloud delivered branch, and VM-Series and CN-Series for in-line network security in multi- and hybrid- cloud environments. CloudGenix SD-WAN autonomous networking and integrated security is available as a combination of physical, virtual and cloud-delivered appliances and services.

Secure the Future:

• Secure the future of security operations through our Cortex security offerings, which includes Cortex XDR for prevention, detection and response, Cortex XSOAR for security orchestration, automation and response (“SOAR”),

- 38 -

AutoFocus for threat intelligence, and Cortex Data Lake to collect and integrate security data for analytics. These products are delivered as software or SaaS subscriptions.

For fiscal 2020 and 2019, total revenue was $3.4 billion and $2.9 billion, respectively, representing year-over-year growth of 17.5%. Our growth reflects the increased adoption of our portfolio, which consists of product, subscriptions, and support. We believe our portfolio will enable us to benefit from recurring revenues as we continue to grow our installed end-customer base. As of July 31, 2020, we had end-customers in over 170 countries. Our end-customers represent a broad range of industries including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications, and include some of the largest Fortune 100 and Global 2000 companies in the world. We maintain a field sales force that works closely with our channel partners in developing sales opportunities. We use a two-tiered, indirect fulfillment model whereby we sell our products, subscriptions, and support to our distributors, which, in turn, sell to our resellers, which then sell to our end-customers.

Our product revenue was $1.1 billion or 31.2% of total revenue for fiscal 2020, representing a slight decrease year-over-year of 2.9%. Product revenue is generated from sales of our appliances, primarily our ML-powered Next-Generation Firewall, which is available in a number of form factors, including as physical, virtual and containerized appliances. Our ML-powered Next-Generation Firewall incorporates our PAN-OS operating system, which provides a consistent set of capabilities across our entire product line. Our products are designed for different performance requirements throughout an organization, ranging from our PA-220, which is designed for small organizations and remote or branch offices, to our top-of-the-line PA-7080, which is designed for large scale data centers and service provider use. The same firewall functionality that is delivered in our physical appliances is also available in our VM-Series virtual firewalls, which secure virtualized and cloud-based computing environments and in our CN-Series container firewalls, which secures container environments and traffic.

Our subscription and support revenue grew to $2.3 billion or 68.8% of total revenue for fiscal 2020, representing year-over-year growth of 30.0%. Our subscriptions provide our end-customers with near real-time access to the latest antivirus, intrusion prevention, web filtering, and modern malware prevention capabilities across the network, endpoints, and the cloud. When end-customers purchase our physical, virtual or container firewall appliances, they typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs. In addition to the subscriptions purchased with these appliances, end-customers may also purchase other subscriptions on a per-user, per-endpoint, or capacity-based basis.

We continue to invest in innovation and acquire businesses as we evo

Showing the first 8K of 103K characters. Open the full section

Foreign Currency Exchange Risk

Our sales contracts are primarily denominated in U.S. dollars. A portion of our operating expenses are incurred outside of the United States and are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the euro, British pound, Singapore dollar, Israeli shekel and Japanese yen. Additionally, fluctuations in foreign currency exchange rates may cause us to recognize transaction gains and losses in our statement of operations. The effect of an immediate 10% adverse change in foreign exchange rates on monetary assets and liabilities at July 31, 2020 would not be material to our financial condition or results of operations. As of July 31, 2020, foreign currency transaction gains and losses and exchange rate fluctuations have not been material to our financial statements. We enter into foreign currency derivative contracts with maturities of 15 months or less which we designate as cash flow hedges to manage the foreign currency exchange rate risk associated with our foreign currency denominated expenditures. The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited, and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results. Refer to Note 5. Derivative Instruments in Part II, Item 8 of this Annual Report on Form 10-K for more information.

As our international operations grow, our risks associated with fluctuation in currency rates will become greater, and we will continue to reassess our approach to managing this risk. In addition, a weakening U.S. dollar can increase the costs of our international

- 52 -

expansion and a strengthening U.S. dollar can increase the real cost of our products to our end-customers outside of the United States, leading to delays in the purchase of our products and services. For additional information, see the risk factor entitled “We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and operating results” in Part 1, Item 1A of this Annual Report on Form 10-K.

Interest Rate Risk

The primary objectives of our investment activities are to preserve principal, provide liquidity, and maximize income without significantly increasing risk. Some of the securities we invest in are subject to interest risk. To minimize this risk, we maintain our portfolio of cash, cash equivalents, and short-term investments in a variety of securities, including commercial paper, money market funds, U.S. government and agency securities, and corporate debt securities. Due to the short duration and conservative nature of our investment portfolio, a movement of 10% in market interest rates would not have a material impact on our operating results and the total value of the portfolio. The effect of an immediate 10% change in interest rates at July 31, 2020 would not have been material to our operating results and the total value of the portfolio assuming consistent investment levels.

Market Risk and Market Interest Risk

In July 2018, we issued $1.7 billion aggregate principal amount of 0.75% Convertible Senior Notes due 2023 (the “2023 Notes”) and in June 2020, we issued $2.0 billion aggregate principal amount of 0.375% Convertible Senior Notes due 2025 (the "2025 Notes"). We carry these instruments at face value less unamortized discount and unamortized issuance costs on our consolidated balance sheets. As these instruments have a fixed annual interest rate, we have no financial and economic interest exposure associated with changes in interest rates. However, the fair value of fixed rate instruments fluctuates when interest rates change, and additionally, in the case of either series of Notes, when the market price of our common stock fluctuates.

- 53 -

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

- 54 -

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

To the Stockholders and the Board of Directors of Palo Alto Networks, Inc.

Opinion on the Financial Statements

We have audited the accompanying consolidated balance sheets of Palo Alto Networks, Inc. (the Company) as of July 31, 2020 and 2019, the related consolidated statements of operations, comprehensive loss, stockholders’ equity and cash flows for each of the three years in the period ended July 31, 2020, and the related notes (collectively referred to as the “consolidated financial statements”). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company at July 31, 2020 and 2019, and the results of its operations and its cash flows for each of the three years in the period ended July 31, 2020, in conformity with U.S. generally accepted accounting principles.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company’s internal control over financial reporting as of July 31, 2020, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) and our report dated September 4, 2020 expressed an unqualified opinion thereon.

Basis for Opinion

These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on the Company’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

Critical Audit Matters

The critical audit matters communicated below are matters arising from the current period audit of the financial statements that were communicated or required to be communicated to the audit committee and that: (1) relate to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matters below, providing separate opinions on the critical audit matters or on the accounts or disclosures to which they relate.

- 55 -

Showing the first 8K of 227K characters. Open the full section

Not applicable.

- 98 -

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our chief executive officer and chief financial officer, evaluated the effectiveness of our disclosure controls and procedures pursuant to Rule 13a-15 under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs.

Based on our evaluation, our chief executive officer and chief financial officer concluded that, as of July 31, 2020, our disclosure controls and procedures are designed at a reasonable assurance level and are effective to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in Securities and Exchange Commission (“SEC”) rules and forms, and that such information is accumulated and communicated to our management, including our chief executive officer and chief financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control over Financial Reporting

For “Management’s Annual Report on Internal Control Over Financial Reporting” see the report under Part II, Item 8 of this Annual Report on Form 10-K, which report is incorporated herein by reference.

For the “Report of Independent Registered Public Accounting Firm,” see the report under Part II, Item 8 of this Annual Report on Form 10-K, which report is incorporated herein by reference.

Changes in Internal Control over Financial Reporting

As a result of COVID-19, most of our workforce has been working from home since March 2020. However there were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended July 31, 2020 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Not applicable.

- 99 -

PART III

The information required by this item will be contained in our definitive proxy statement to be filed with the SEC in connection with our 2020 annual meeting of stockholders (the “Proxy Statement”), which is expected to be filed not later than 120 days after the end of our fiscal year ended July 31, 2020, and is incorporated in this report by reference.

The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.

The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.

The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.

The information required by this item will be set forth in the Proxy Statement and is incorporated herein by reference.

- 100 -

PART IV

Documents filed as part of this Annual Report on Form 10-K are as follows:

1.Consolidated Financial Statements

Our Consolidated Financial Statements are listed in the “Index to Consolidated Financial Statements” under Part II, Item 8 of this Annual Report on Form 10-K.

2.Financial Statement Schedules

Financial statement schedules have been omitted because they are not required, not applicable, not present in amounts sufficient to require submission of the schedule, or the required information is shown in the Consolidated Financial Statements or the notes thereto.

3.Exhibits

The following documents are incorporated by reference or are filed with this Annual Report on Form 10-K, in each case as indicated therein (numbered in accordance with Item 601 of Regulation S-K).

EXHIBIT INDEX

- 101 -

- 102 -