Palo Alto Networks (PANW) 10-K risk factor changes: FY2024 vs FY2023

- Issues in the development and deployment of [removed: Artificial Intelligence (“AI”)] [added: AI] may result in reputational harm and legal liability and could adversely affect our results of operations.

- We may have exposure to [added: tax liabilities that are] greater than [removed: anticipated tax liabilities.][added: anticipated.]

- Our reputation and/or business could be negatively impacted by [removed: environmental, social, and governance (“ESG”)] [added: ESG] matters and/or our reporting of such matters.

Military actions or armed conflict, including [added: the hostilities in Israel and the surrounding region,] Russia’s invasion of Ukraine and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment.

In response to Russia’s invasion of Ukraine, the United States, along with the European [removed: Union,] [added: Union (the “E.U.”)] has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens (“Sanctions on Russia”).

For example, from the end of fiscal [removed: 2022] [added: 2023] to the end of fiscal [removed: 2023,] [added: 2024,] our headcount increased from [removed: 12,561 to] 13,948 [added: to 15,289] employees.

We have experienced revenue growth rates of [removed: 25.3%] [added: 16.5%] and [removed: 29.3%] [added: 25.3%] in fiscal [removed: 2023] [added: 2024] and fiscal [removed: 2022,] [added: 2023,] respectively.

In addition, we have incurred losses in fiscal years prior to fiscal [removed: 2023 and, as a result, we had an accumulated deficit of $1.2 billion as of July 31,] 2023.

Our future success depends, in part, on our ability to expand the deployment of our portfolio with existing end-customers, especially large enterprise customers, [added: including through our platformization strategy,] and create demand for our new offerings, The rate at which our end-customers purchase additional products, subscriptions, and support depends on a number of factors, including the perceived need for additional security products, including subscription and support offerings, as well as general economic conditions.

Subscription and support revenue accounts for a significant portion of our revenue, comprising [removed: 77.1%] [added: 80.0%] of total revenue in fiscal [removed: 2023, 75.2%] [added: 2024, 77.1%] of total revenue in fiscal [removed: 2022,] [added: 2023,] and [removed: 73.7%] [added: 75.2%] of total revenue in fiscal [removed: 2021.][added: 2022.]

For fiscal [removed: 2023, three] [added: 2024, four] distributors individually represented 10% or more of our total revenue and in the aggregate represented [removed: 49.7%] [added: 59.0%] of our total revenue.

As of July 31, [removed: 2023,] [added: 2024,] two distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented [removed: 37.6%] [added: 31.5%] of our gross accounts receivable.

- large companies that incorporate security features in their products, such as Cisco, Microsoft, [added: Alphabet] or those that have acquired, or may acquire, security vendors and have the technical and financial resources to bring competitive solutions to the market;

- independent security vendors, such as Check Point, Fortinet, [removed: Crowdstrike, and] [added: CrowdStrike,] Zscaler, [added: and Wiz,] that offer a mix of security products;

If we are unsuccessful at integrating past or future acquisitions in a timely manner, or the [removed: technologies and] [added: technologies, products, or] operations associated with such acquisitions, into our company, our revenue and operating results could be adversely affected.

We may not successfully evaluate or utilize the acquired [removed: technology] [added: technology, products,] or personnel, realize anticipated synergies from the acquisition, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges and any potential impairment of goodwill and intangible assets recognized in connection with such acquisitions.

AI presents challenges and risks that could affect our products and solutions, and [removed: therefore] [added: the operations of] our business.

These [removed: potential issues] [added: efforts] could subject us to regulatory risk, legal liability, including under new proposed legislation regulating AI in jurisdictions such as the [removed: EU] [added: E.U.] and regulations being considered in other jurisdictions, [removed: and] [added: or] brand or reputational harm.

Additionally, defects [added: or vulnerabilities] may cause our products or subscriptions to [added: become temporarily unavailable, to] be vulnerable to security attacks, cause them to fail to help secure networks, or temporarily interrupt end-customers’ networking [removed: traffic.][added: traffic, or the availability of other information technology infrastructure or systems.]

Furthermore, defects or errors in [removed: our subscription updates] [added: products] or [removed: our] [added: software or updates to those] products [added: or software] could result in a failure to effectively update end-customers’ hardware and cloud-based [removed: products.][added: products or otherwise cause problems in our customers hardware, networks or information technology infrastructure or systems.]

[removed: Our] [added: The] data [removed: centers] [added: centers, networks,] and [removed: networks] [added: cloud infrastructure that we use to deliver our products and services] may experience technical failures and downtime or may fail to meet the increased requirements of a growing installed end-customer base, any of which could temporarily or permanently expose our end-customers’ networks, leaving their networks unprotected against the latest security threats.

Valid patents may not issue from our pending applications, and the claims eventually allowed on any patents may not be sufficiently broad to [added: comprehensively] protect our technology or products and subscriptions.

Although we [added: take reasonable steps to] monitor our use of open source software to avoid subjecting our products and subscriptions to conditions we do not intend, the terms of many open source licenses have not been interpreted by United States courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products and subscriptions.

Our [added: substantial] reliance on [removed: these] [added: Flex, as well as other] manufacturing partners [removed: reduces our control over the manufacturing process and exposes] [added: subjects] us to [added: potential concentration] risks, [removed: including] [added: such as] reduced control over [added: the manufacturing process,] quality assurance, product costs, product supply, [removed: timing,] and [removed: transportation risk.][added: timing.]

As a result, our costs have increased and we have raised, and may be required to further raise, prices on our hardware [removed: products, all of which could severely impair our ability to fulfill orders.][added: products.]

In [removed: addition,] [added: the past,] we [removed: continue to experience] [added: experienced] supply chain disruption and have incurred increased costs resulting from inflationary pressures.

- political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics like COVID-19, macroeconomic [removed: challenges in Europe,] [added: challenges,] terrorist activities, Russia’s invasion of Ukraine, tensions between China and Taiwan, [added: the hostilities in Israel] and [added: the surrounding region, and] continued hostilities in the Middle East;

- non-compliance with U.S. and foreign laws, including antitrust regulations, anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the [removed: U.K.] [added: United Kingdom (“U.K.”)] Bribery Act, U.S. or foreign sanctions regimes and export or import control laws, and any trade regulations ensuring fair trade practices.

In addition, increased international sales in the future, including through our channel partners and other [removed: partnerships,] [added: partnerships or as a result of our acquisitions,] may result in foreign currency denominated sales, increasing our foreign currency risk.

As of July 31, [removed: 2023,] [added: 2024,] the total notional amount of our outstanding foreign currency forward contracts was [removed: $957.5 million.][added: $1.2 billion.]

The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be [removed: limited,] [added: limited] and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and operating results.

In addition, many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency [removed: circumstances.][added: circumstances, which has occurred as a result of hostilities in Israel and the surrounding region.]

These laws and regulations are also subject to [removed: frequent] [added: frequent, inconsistent] and unexpected [removed: changes, new] [added: changes; new, modified] or additional laws or regulations may be [removed: adopted,] [added: adopted;] and rulings that invalidate prior [added: laws, regulations, or interpretations of such] laws or regulations may be issued.

For example, we are subject to the E.U. General Data Protection Regulation (“E.U. GDPR”) and the U.K. General Data Protection Regulation [removed: (‘U.K.] [added: (“U.K.] GDPR,” and collectively the “GDPR”), both of which impose stringent data protection requirements, provide for costly penalties for noncompliance (up to the greater of (a) €20 million under the “E.U. GDPR” or £17.5 million under the “U.K. GDPR,” and (b) 4% of annual worldwide turnover), and confer the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

The regulatory environment applicable to the handling of European residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional [removed: costs, including in the event we self-certify to the EU-U.S. DPF.][added: costs.]

Moreover, much like with Schrems II, we anticipate future legal challenges to the approved data transfer mechanisms between Europe and the United States, including a challenge to the [removed: EU-U.S.] [added: E.U.-U.S.] DPF.

Any such [removed: enforcement actions] [added: claims] could result in substantial [removed: costs] [added: costs, ongoing remedial, audit] and [added: reporting obligations, and] diversion of resources, and distract management and technical personnel.

These potential liabilities and enforcement actions could also have an overall negative [removed: affect] [added: effect] on our business, operating results, and financial condition.

New legislation affecting the scope of personal data and personal information where we or our customers and partners have operations, especially relating to classification of Internet Protocol (“IP”) addresses, machine identification, [removed: AI,] [added: AI and machine learning,] location data, and other information, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing or uses of data, and may require significant expenditures and efforts in order to comply.

We may have exposure to [added: tax liabilities that are] greater than [removed: anticipated tax liabilities.][added: anticipated.]

- If we are unable to attract new customers, our future results of operations could be harmed.

- We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply, we could be subject to government enforcement actions, private litigation and adverse publicity.

If we are unable to attract new customers, our future results of operations could be harmed.

To increase our revenue and maintain profitability, we must add new customers.

To do so, we must successfully convince prospective customers of the value of adopting our solutions.

We are engaging in costly marketing and sales efforts to accelerate platformization and attract new customers, which may fail or may not be as successful as intended or at all.

Additionally, prospective customers’ decisions to purchase our solutions depend on a variety of factors, many of which are out of our control.

These factors significantly impact our ability to add new customers and increase the time, resources and sophistication required to do so.

For example, prospective customers may face real or perceived switching costs when switching to our solutions from legacy security vendors and products.

Deployment of our solutions may require a significant commitment of resources from our customers.

Any deterioration in general economic conditions, including as a result of the geopolitical environment or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past caused, and may in the future cause, our current and prospective customers to delay or cut their overall security and IT operations spending.

If our efforts to attract new customers are not successful, our sales may not grow as quickly as anticipated, or at all, and our business, operating results, and financial condition will be harmed.

We are also incorporating AI into the operations of our business.

The AI that is being incorporated into our products, solutions, and business operation tools may not be successful or beneficial, and instead may cause technical, legal or ethical problems or result in increased costs.

The investments that we are making across our business in AI reflect our ongoing efforts to innovate and provide products and services that are useful to our customers, as well as provide efficiencies in our business.

Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities.

For example, in April 2024, we became aware of a command injection vulnerability in the GlobalProtect feature of certain versions of our PAN-OS software.

To remediate the matter, we published a security advisory to advise customers, provided software updates for affected PAN-OS versions, and are actively engaged in customer outreach, support and remediation efforts for potentially impacted customers.

Any such technical failure, downtime or failures in general may temporarily or permanently disable our end-customers’ networks, information technology infrastructure or other systems, or expose our end-customers’ networks to attacks from security threats.

For example, on January 31, 2024, in the Centripetal Networks, Inc. lawsuit against us, a jury returned a verdict of non-willful infringement with a lump sum amount of $151.5 million, plus statutory interest, for which we have accrued $184.4 million for the verdict amount and estimated interest as of July 31, 2024.

Additional examples of patent infringement cases have been disclosed in Note 12.

Commitments and Contingencies in Part II, Item 8 of this Annual Report on Form 10-K.

We have business operations in Israel and intend to continue growing our presence in Israel.

Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region.

We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply, we could be subject to government enforcement actions, private litigation and adverse publicity.

In addition, with respect to the personal data that we process on behalf of our customers, we self-certified to the E.U.-U.S. Data Privacy Framework (“E.U.-U.S. DPF”), which has been approved for transfers of personal data subject to the GDPR to the United States.

The E.U.-U.S. DPF has been recognized as adequate under the E.U. law to allow transfers of personal data from the E.U. to companies in the U.S. that have self-certified to the framework.

However, the E.U.-U.S. DPF may be subject to legal challenge, which could cause the legal requirements for data transfers from the E.U. to be uncertain.

These include laws enacted in at least 19 states, and six other states have active privacy bills pending in state legislative processes.

We and our customers may face risk of enforcement actions by regulators or data protection authorities, private litigation and adverse publicity including reputational damage and loss of customer confidence for alleged violations of any of the foregoing obligations.

The amount and scope of insurance we maintain may not cover all types of claims that may arise.

For example, beginning in fiscal 2023, we were required to capitalize and amortize research and development expenses as required by the Tax Cuts and Jobs Act.

As a result of this change and our increased profitability, we have paid significantly more U.S. cash taxes during fiscal 2024 and we expect our cash tax payments to increase in future periods.

In addition, we are or may become subject to various new and proposed climate-related and other sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive.

Additional regulation may require us to incur significant additional costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts.

Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, fines or litigation, which could negatively impact our business, operating results or financial condition.

On August 15, 2024, our board of directors authorized a $500.0 million increase to our share repurchase program, bringing the total remaining authorization for future share repurchases to $1.0 billion.

\- 35 \-

\- 14 \-

- Our actual or perceived failure to adequately protect personal data could have a material adverse effect on our business.

- Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products and subscriptions could reduce our ability to compete and could harm our business.

To respond to this demand, our customer financing activities have increased and will likely continue to increase in the future.

As a result of various of our acquisitions, including Cider, Cyber Secdo Ltd. (“Secdo”), PureSec Ltd. (“PureSec”), and Twistlock Ltd. (“Twistlock”), we have offices and employees located in Israel.

Accordingly, political, economic, and military conditions in Israel directly affect our operations, including the recent political unrest in Israel.

Our actual or perceived failure to adequately protect personal data could have a material adverse effect on our business.

In the future, we may self-certify to the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), which has been approved for transfers of personal data subject to the GDPR to the United States and requires public disclosures of adherence to data protection principles and the submission of jurisdiction to European regulatory authorities.

Following the “Schrems II” decision by the Court of Justice of the European Union, transfers of personal data to recipients in third countries are also subject to additional assessments and safeguards beyond the implementation of approved transfer mechanisms.

The decision imposed a requirement for companies to carry out an assessment of the laws and practices governing access to personal data in the third country to ensure an essentially equivalent level of data protection to that afforded in the E.U.

Additionally, we and our customers may face risk of enforcement actions by data protection authorities in Europe relating to personal data transfers to us and by us from Europe.

These include laws enacted in at least ten states, which all go into effect by January 1, 2026.

In addition, we also entered into warrant transactions in connection with our 2023 Notes (together with the 2025 Warrants, the “Warrants”).

- Results of Operations. A discussion of the nature and trends in our financial results and an analysis of our financial results comparing fiscal [removed: 2023] [added: 2024] to fiscal [removed: 2022.][added: 2023.]

For discussion and analysis related to our financial results comparing fiscal [removed: 2022] [added: 2023] to [removed: 2021,] [added: 2022,] refer to Part II, Item 7.

Management’s Discussion and Analysis of Financial Condition and Results of Operations in our Annual Report on Form 10-K for fiscal [removed: 2022,] [added: 2023,] which was filed with the Securities and Exchange Commission on September [removed: 6, 2022.][added: 1, 2023.]

Our cybersecurity platforms and services help secure enterprise users, networks, clouds, and endpoints by delivering comprehensive cybersecurity backed by [removed: industry-leading artificial intelligence] [added: AI] and automation.

- Our network security platform, designed to deliver complete zero trust solutions to our customers, includes our hardware and software ML-Powered Next-Generation Firewalls, [added: AI Runtime Security,] as well as a cloud-delivered [removed: Secure Access Service Edge (“SASE”).][added: SASE.]

Prisma® Access, our [removed: Security Services Edge (“SSE”)] [added: SSE] solution, when combined with Prisma SD-WAN, provides a comprehensive single-vendor SASE offering that is used to secure remote workforces and [added: securely] enable the cloud-delivered branch.

Our network security platform also includes our cloud-delivered security services, such as Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, [added: Advanced] DNS Security, IoT/OT Security, GlobalProtect®, Enterprise [removed: Data Loss Prevention (“Enterprise DLP”), Artificial Intelligence for Operations (“AIOps”),] [added: DLP, AIOps,] SaaS [removed: Security API,] [added: Security,] and [removed: SaaS Security Inline.][added: AI Access Security.]

[removed: Panorama®,] [added: Strata Cloud Manager,] our network security management solution, can centrally manage our network security platform irrespective of form factor, location, or scale.

As a comprehensive [removed: Cloud Native Application Protection Platform (“CNAPP”),] [added: CNAPP,] Prisma Cloud secures multi- and hybrid-cloud environments for applications, data, [added: GenAI ecosystem,] and the entire cloud native technology stack across the full development [removed: lifecycle;] [added: lifecycle,] from code to [removed: runtime.][added: cloud.]

[removed: For] [added: We also offer our VM-Series and CN-Series virtual firewalls for] inline network security on multi- and hybrid-cloud [removed: environments, we also offer our VM-Series and CN-Series Firewall offerings.][added: environments.]

- We deliver the next generation of security [removed: automation,] [added: operations capabilities that combine] security analytics, endpoint security, [added: automation,] and [removed: attack surface management] [added: ASM] solutions through our Cortex [removed: portfolio.][added: platform.]

These include Cortex XSIAM, our [removed: AI] [added: AI-driven] security [removed: automation] [added: operations] platform, Cortex XDR® for the prevention, detection, and response to complex cybersecurity [removed: attacks on the endpoint,] [added: attacks,] Cortex XSOAR® for [removed: security orchestration, automation, and response (“SOAR”),] [added: SOAR,] and Cortex XpanseTM for [removed: attack surface management (“ASM”).][added: ASM.]

Threat Intelligence and [removed: Security Consulting] [added: Advisory Services] (Unit 42):

- Unit 42 brings together world-renowned threat researchers with an elite team of incident responders and security consultants to create an intelligence-driven, response-ready organization to help customers [removed: proactively] manage cyber risk.

For fiscal [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] total revenue was [removed: $6.9] [added: $8.0] billion and [removed: $5.5] [added: $6.9] billion, respectively, representing year-over-year growth of [removed: 25.3%.][added: 16.5%.]

As of July 31, [removed: 2023,] [added: 2024,] we had end-customers in over 180 countries.

Our product revenue grew to $1.6 billion or [removed: 22.9%] [added: 20.0%] of total revenue for fiscal [removed: 2023,] [added: 2024,] representing year-over-year growth of [removed: 15.8%.][added: 1.6%.]

Product revenue also includes revenue derived from software licenses of [removed: Panorama,] [added: Panorama®,] SD-WAN, and the VM-Series.

Our products are designed for different performance requirements throughout an organization, ranging from our PA-410, which is designed for small organizations and remote or branch offices, to our top-of-the-line [removed: PA-7080,] [added: PA-7500,] which is designed for large-scale data centers and service provider use.

Our subscription and support revenue grew to [removed: $5.3] [added: $6.4] billion or [removed: 77.1%] [added: 80.0%] of total revenue for fiscal [removed: 2023,] [added: 2024,] representing year-over-year growth of [removed: 28.4%.][added: 20.9%.]

Our subscriptions provide our end-customers with near real-time access to the latest antivirus, intrusion prevention, web filtering, modern malware prevention, data loss prevention, [added: CASB] and [removed: cloud access] [added: AI] security [removed: broker] capabilities across the network, endpoints, and the cloud.

When [removed: end-customers] [added: customers] purchase our physical, virtual, or container firewall appliances, or certain cloud offerings, they typically purchase support in order to receive ongoing security updates, upgrades, bug fixes, and repairs.

In addition to the subscriptions purchased with these appliances, [removed: end-customers] [added: customers] may also purchase other subscriptions on a per-user, per-endpoint, or capacity-based basis.

We believe that the growth of our business and our short-term and long-term success are dependent upon many factors, including our ability to extend our technology leadership, grow our base of end-customers, expand deployment of our portfolio and support offerings within existing end-customers, [removed: and] focus on end-customer [removed: satisfaction.][added: satisfaction, and address any product vulnerabilities.]

Worsening economic conditions, including inflation, higher interest rates, slower growth, fluctuations in foreign exchange rates, [added: supply chain disruptions,] and other conditions, may adversely affect our results of operations and financial performance.

We are [added: also] monitoring the [added: impact of inflationary pressures and the] tensions between China and Taiwan, and between the U.S. and China, which could have an adverse impact on our business or results of operations in future periods.

| | | | [added: 2024 | | | | | |] 2023 | | | | | | 2022 | | |

| Total deferred revenue | | | $ | [removed: 9,296.4] [added: 11,480.5] | | | | | $ | [removed: 6,994.0] [added: 9,296.4] | |

| Cash, cash equivalents, and investments | | | $ | [removed: 5,437.9] [added: 6,752.0] | | | | | $ | [removed: 4,686.4] [added: 5,437.9] | |

| | | | [removed: 2023] [added: 2024] | | | | | | [removed: 2022] [added: 2023] | | | | | | [removed: 2021] [added: 2022] | | |

| Total revenue | | | $ | [removed: 6,892.7] [added: 8,027.5] | | | | | $ | [removed: 5,501.5] [added: 6,892.7] | | | | | $ | [removed: 4,256.1] [added: 5,501.5] | |

| Total revenue year-over-year percentage increase | | | [removed: 25.3] [added: 16.5] | | % | | | | [removed: 29.3] [added: 25.3] | | % | | | | [removed: 24.9] [added: 29.3] | | % |

| Gross margin | | | [removed: 72.3] [added: 74.3] | | % | | | | [removed: 68.8] [added: 72.3] | | % | | | | [removed: 70.0] [added: 68.8] | | % |

| Operating income (loss) | | | $ | [removed: 387.3] [added: 683.9] | | | | | $ | [removed: (188.8)] [added: 387.3] | | | | | $ | [removed: (304.1)] [added: (188.8)] | |

| Operating margin | | | [removed: 5.6] [added: 8.5] | | % | | | | [removed: (3.4)] [added: 5.6] | | % | | | | [removed: (7.1)] [added: (3.4)] | | % |

| Billings | | | $ | [removed: 9,194.4] [added: 10,208.1] | | | | | $ | [removed: 7,471.5] [added: 9,194.4] | | | | | $ | [removed: 5,452.2] [added: 7,471.5] | |

| Billings year-over-year percentage increase | | | [removed: 23.1] [added: 11.0] | | % | | | | [removed: 37.0] [added: 23.1] | | % | | | | [removed: 26.7] [added: 37.0] | | % |

| Cash flow provided by operating activities | | | $ | [removed: 2,777.5] [added: 3,257.6] | | | | | $ | [removed: 1,984.7] [added: 2,777.5] | | | | | $ | [removed: 1,503.0] [added: 1,984.7] | |

| Free cash flow (non-GAAP) | | | $ | [removed: 2,631.2] [added: 3,100.8] | | | | | $ | [removed: 1,791.9] [added: 2,631.2] | | | | | $ | [removed: 1,387.0] [added: 1,791.9] | |

We [removed: consider] [added: have considered] billings to be a key metric used by management to manage our business.

- Recent Accounting Pronouncements. A discussion of expected impacts of impending accounting changes on financial information to be reported in the future.

A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products.

We execute on this strategy by developing our capabilities and packaging our offerings into platforms which are able to cover many of our customers’ needs in the markets in which we operate.

Our platformization strategy combines various products and services into a tightly integrated architecture and makes security faster, less complex, and more cost-effective.

We focus on delivering value in four sectors of the cybersecurity industry:

Strata Cloud Manager includes the Strata Copilot which provides a natural language interface to simplify and accelerate platform management.

- We deliver scalable and comprehensive security across the cloud application development lifecycle through our Code to CloudTM platform, Prisma Cloud.

Additionally, Unit 42 offers managed detection and response and managed threat hunting services.

During fiscal 2024, we introduced several new offerings, including: Prisma Cloud Darwin release with newly integrated Code to Cloud intelligence capabilities, PAN-OS 11.2 Quasar, Cortex XSIAM 2.0, new Cortex XSIAM features, Prisma SASE 3.0, and Precision AITM.

For example, in December 2023, we acquired Dig, which we expect will enhance our Prisma Cloud capabilities with a DSPM solution that is intended to provide customers with visibility into, and secure data stored across, their multi-cloud environments; and we acquired Talon, which will support Prisma SASE’s approach to provide secure access to business applications for unmanaged and personal devices with an enterprise browser.

In May 2024, we announced an expanded partnership with International Business Machines Corporation (“IBM”) to deliver AI-powered security outcomes for customers, as part of which we agreed to acquire IBM's QRadar SaaS assets, including QRadar intellectual property rights, customer relationships and customer contracts.

On August 31, 2024, we completed the acquisition of IBM’s QRadar SaaS assets and we expect the acquisition will help accelerate the growth of our Cortex XSIAM business.

The hostilities in Israel and the surrounding region have increased the levels of economic and political uncertainty.

While we have business operations in Israel, and intend to continue growing our presence in Israel, we currently do not expect significant business disruption.

We are actively monitoring, evaluating, and responding to the developing situation.

| | | | 2024 | | | | | | 2023 | | |

There are inherent limitations in using billings to evaluate our operating results as the variability in payment terms may cause fluctuation in billings.

Beginning in the first fiscal quarter of 2025, billings will no longer be a key financial metric and will no longer be reported.

| Total revenue | | | $ | 8,027.5 | | | | | $ | 6,892.7 | | | | | $ | 5,501.5 | |

| Billings | | | $ | 10,208.1 | | | | | $ | 9,194.4 | | | | | $ | 7,471.5 | |

| Free cash flow (non-GAAP) | | | $ | 3,100.8 | | | | | $ | 2,631.2 | | | | | $ | 1,791.9 | |

| | | | 2024 | | | | | | 2023 | | | | | | 2022 | | |

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

| Europe, the Middle East, and Africa (“EMEA”) | | | 1,602.0 | | | | | | 1,359.6 | | | | | | 242.4 | | | | | | 17.8 | | % | | | | 1,359.6 | | | | | | 1,055.8 | | | | | | 303.8 | | | | | | 28.8 | | % |

| Asia Pacific and Japan (“APAC”) | | | 942.6 | | | | | | 813.2 | | | | | | 129.4 | | | | | | 15.9 | | % | | | | 813.2 | | | | | | 643.1 | | | | | | 170.1 | | | | | | 26.5 | | % |

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

Cost of product revenue decreased for fiscal 2024 compared to fiscal 2023 primarily due to decreased demand for our prior generation of hardware products and lower costs largely driven by an easing of supply chain challenges, partially offset by a change in mix shift within our new generation hardware products.

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

| | | | 2024 | | | | | | | | | | | | 2023 | | | | | | | | | | | | 2022 | | | | | | | | |

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

The remaining increase in research and development expense was further driven by increased shared costs.

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

General and administrative expenses increased for fiscal 2024 compared to fiscal 2023 primarily due to litigation-related charges of $204.4 million in fiscal 2024.

Commitments and Contingencies in Part II, Item 8 of this Annual Report on Form 10-K for more information.

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

Interest expense decreased for fiscal 2024 compared to fiscal 2023 primarily due to maturity of our 2023 Notes in July 2023 and early conversion of our 2025 Notes in fiscal 2024.

\- 51 \-

| | | | 2024 | | | | | | 2023 | | | | | | Change | | | | | | | | | | | | 2023 | | | | | | 2022 | | | | | | Change | | | | | | | | |

We are a leading provider of zero trust solutions, starting with next-generation zero trust network access to secure today’s remote hybrid workforces and extending to securing all users, applications, and infrastructure with zero trust principles.

Our security solutions are designed to reduce customers’ total cost of ownership by improving operational efficiency and eliminating the need for siloed point products.

Our company focuses on delivering value in four fundamental areas:

We have been recognized as a leader in network firewalls, SSE, and SD-WAN.

- We enable cloud-native security through our Prisma Cloud platform.

\- 38 \-

During fiscal 2023, we introduced several new offerings, including: Cortex XSIAM 1.0, major updates to Prisma Cloud (including three new security modules), Prisma Access 4.0, PAN-OS 11.0, Cloud NGFW for AWS, and Cloud NGFW for Azure.

For example, in December 2022, we acquired Cider, which we expect will support our Prisma Cloud’s platform approach to securing the entire application security lifecycle from code to cloud.

\- 39 \-

We continue to experience supply chain disruption and incur increased costs resulting from inflationary pressures.

We believe billings provides investors with an important indicator of the health and visibility of our business because it includes subscription and support revenue, which is recognized ratably over the contractual service period, and product revenue, which is recognized at the time of hardware shipment or delivery of software license, provided that all other conditions for revenue recognition have been met.

We consider billings to be a useful metric for management and investors, particularly if we continue to experience increased sales of subscriptions and strong renewal rates for subscription and support offerings, and as we monitor our near-term cash flows.

While we believe that billings provides useful information to investors and others in understanding and evaluating our operating results in the same manner as our management, it is important to note that other companies, including companies in our industry, may not use billings, may calculate billings differently, may have different billing frequencies, or may use other financial measures to evaluate their performance, all of which could reduce the usefulness of billings as a comparative measure.

\- 40 \-

\- 41 \-

\- 42 \-

| EMEA | | | 1,359.6 | | | | | | 1,055.8 | | | | | | 303.8 | | | | | | 28.8 | | % | | | | 1,055.8 | | | | | | 817.3 | | | | | | 238.5 | | | | | | 29.2 | | % |

| APAC | | | 813.2 | | | | | | 643.1 | | | | | | 170.1 | | | | | | 26.5 | | % | | | | 643.1 | | | | | | 501.3 | | | | | | 141.8 | | | | | | 28.3 | | % |

Cost of product revenue decreased for fiscal 2023 compared to fiscal 2022 due to a favorable hardware product mix.

General and administrative expenses increased for fiscal 2023 compared to fiscal 2022 primarily due to increased personnel costs, which grew $23.2 million, largely due to share-based compensation related to our recent acquisitions and headcount growth.

The increase in general and administrative expense was further driven by slightly higher reserves due to increased receivables as a result of our business growth.

Interest expense remained relatively flat for fiscal 2023 compared to fiscal 2022.

Our valuation allowance has caused, and may continue to cause, disproportionate relationships between our overall effective tax rate and other jurisdictional measures.

We regularly evaluate the need for a valuation allowance.

Due to recent profitability, a reversal of our valuation allowance in certain jurisdictions in the foreseeable future is reasonably possible.

Our provision for income taxes for fiscal 2023 was primarily due to U.S. federal and state income taxes, withholding taxes, and foreign income taxes.

Our effective tax rate varied for fiscal 2023 compared to fiscal 2022, primarily due to our profitability in fiscal 2023 and an increase in U.S. taxes driven by capitalization of research and development expenditures with no offsetting deferred benefit due to our valuation allowance.

This increase was offset by releases of uncertain tax positions during fiscal 2023 resulting from tax settlements.

In July 2018, we issued the 2023 Notes with an aggregate principal amount of $1.7 billion.

The 2023 Notes were converted prior to or settled on the maturity date of July 1, 2023.

The expiration date of this repurchase authorization was extended to December 31, 2023, and our repurchase program may be suspended or discontinued at any time.

We have entered into various non-cancelable operating leases primarily for our facilities with original lease periods expiring through the year ending July 31, 2033, with the most significant leases relating to our corporate headquarters in Santa Clara, California.

[removed: The effect of an immediate] [added: A hypothetical] 10% [removed: adverse] change in foreign exchange rates on monetary assets and liabilities [removed: at July 31, 2023] would not be material to our financial condition or results of [removed: operations.][added: operations after taking into consideration the effect of foreign currency forward contracts in place as of July 31, 2024.]

[removed: As of July 31, 2023,] [added: Foreign currency remeasurement gains and losses and] foreign currency transaction gains and losses [removed: and exchange rate fluctuations] have not [removed: been material] [added: had a significant impact] to our consolidated financial statements.

The effectiveness of our existing hedging transactions and the availability and effectiveness of any hedging transactions we may decide to enter into in the future may be limited, and we may not be able to successfully hedge our exposure, which could adversely affect our financial condition and [removed: operating results.][added: results of operations.]

Based on investment positions as of July 31, [removed: 2023,] [added: 2024,] a hypothetical 100 basis point increase in interest rates across all maturities would result in a [removed: $55.5] [added: $97.8] million decline in the fair market value of the portfolio.

Conversely, a hypothetical 100 basis point decrease in interest rates would lead to a [removed: $55.5] [added: $97.8] million increase in the fair market value of the portfolio.

In June 2020, we issued $2.0 billion aggregate principal amount of [removed: 0.375% Convertible Senior Notes due] [added: the] 2025 [removed: (the “2025 Notes”).][added: Notes.]

We also enter into foreign currency derivative contracts that are not designated as hedging instruments to hedge a portion of our outstanding monetary assets and liabilities denominated in foreign currencies.

These foreign currency derivative contracts reduce but do not entirely eliminate the effect of foreign exchange rate fluctuations.

\- 57 \-

\- 51 \-

Our cybersecurity platforms and services help secure enterprise users, networks, clouds, and endpoints by delivering comprehensive cybersecurity backed by [removed: industry-leading] artificial intelligence [added: (“AI”)] and automation.

- Our network security platform, designed to deliver complete zero trust solutions to our customers, includes our hardware and software ML-Powered Next-Generation Firewalls, [added: AI Runtime Security,] as well as a cloud-delivered Secure Access Service Edge (“SASE”).

Prisma® Access, our Security Services Edge (“SSE”) solution, when combined with Prisma SD-WAN, provides a comprehensive single-vendor SASE offering that is used to secure remote workforces and [added: securely] enable the cloud-delivered branch.

Our network security platform also includes our cloud-delivered security services, such as Advanced Threat Prevention, Advanced WildFire®, Advanced URL Filtering, [added: Advanced] DNS Security, IoT/OT Security, GlobalProtect®, Enterprise Data Loss Prevention (“Enterprise DLP”), [removed: Artificial Intelligence] [added: AI] for [added: IT] Operations (“AIOps”), SaaS [removed: Security API,] [added: Security,] and [removed: SaaS Security Inline.][added: AI Access Security.]

[removed: Panorama®,] [added: Strata Cloud Manager,] our network security management solution, can centrally manage our network security platform irrespective of form factor, location, or scale.

As a comprehensive Cloud Native Application Protection Platform (“CNAPP”), Prisma Cloud secures multi- and hybrid-cloud environments for applications, data, [added: generative AI (“GenAI”) ecosystem,] and the entire cloud native technology stack across the full development [removed: lifecycle;] [added: lifecycle,] from code to [removed: runtime.][added: cloud.]

[removed: For] [added: We also offer our VM-Series and CN-Series virtual firewalls for] inline network security on multi- and hybrid-cloud [removed: environments, we also offer our VM-Series and CN-Series Firewall offerings.][added: environments.]

- We deliver the next generation of security [removed: automation,] [added: operations capabilities that combine] security analytics, endpoint security, [added: automation,] and attack surface management [added: (“ASM”)] solutions through our [removed: Cortex portfolio.][added: Cortex® platform.]

These include Cortex [removed: XSIAM,] [added: XSIAM®,] our [removed: AI] [added: AI-driven] security [removed: automation] [added: operations] platform, Cortex XDR® for the prevention, detection, and response to complex cybersecurity [removed: attacks on the endpoint,] [added: attacks,] Cortex XSOAR® for security orchestration, automation, and response (“SOAR”), and Cortex [removed: XpanseTM] [added: Xpanse®] for [removed: attack surface management (“ASM”).][added: ASM.]

These products are delivered as [removed: SaaS] [added: software as a service (“SaaS”)] or software subscriptions.

Threat Intelligence and [removed: Security Consulting] [added: Advisory Services] (Unit 42):

- Unit [removed: 42] [added: 42®] brings together world-renowned threat researchers with an elite team of incident responders and security consultants to create an intelligence-driven, response-ready organization to help customers [removed: proactively] manage cyber risk.

Hardware and software firewalls. Our ML-Powered Next Generation Firewalls embed machine learning in the core of the firewall and employ inline deep learning in the cloud, empowering our customers to stop zero-day threats in real time, see and secure their entire enterprise including [removed: IoT,] [added: Internet of Things (“IoT”),] and reduce errors with automatic policy recommendations.

In addition to these components, key features include site-to-site virtual private network (“VPN”), remote access Secure Sockets Layer (“SSL”) VPN, and [removed: Quality-of-Service (“QoS”).][added: Quality-of-Service.]

Our appliances and software are designed for different performance requirements throughout an organization and are classified based on throughput, ranging from our PA-410, which is designed for small organizations and branch offices, to our top-of-the-line [removed: PA-7080,] [added: PA-7500 Series,] which is designed for large-scale data centers and service [removed: provider use.][added: providers.]

Our firewalls come in a hardware form factor, a containerized form factor, called CN-Series, as well as a virtual form factor, called VM-Series, that is available for virtualization and cloud environments from companies such as [removed: VMware, Inc. (“VMware”),] [added: Broadcom Inc.,] Microsoft Corporation (“Microsoft”), Amazon.com, Inc. (“Amazon”), and [removed: Google,] [added: Alphabet] Inc. [removed: (“Google”),] [added: (“Alphabet”),] and in Kernel-based Virtual Machine [removed: (“KVM”)/OpenStack] [added: /OpenStack] environments.

Of these subscription offerings, cloud-delivered security services, such as Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, [added: Advanced] DNS Security, IoT/OT Security, SaaS Security Inline, GlobalProtect, Enterprise DLP, [removed: and] AIOps, [added: and AI Runtime Security] are sold as options to our hardware and software firewalls, whereas SaaS Security API, [added: AI Access Security,] Prisma Access, Prisma SD-WAN, [added: Strata Cloud Manager,] Prisma Cloud, Cortex XSIAM, Cortex XDR, Cortex XSOAR, and Cortex Xpanse are sold on a per-user, per-endpoint, or capacity-based [removed: basis.][added: basis—and they can be activated by customers with or without our firewalls.]

Advanced Threat Prevention is the first offering to protect [removed: patient zero] [added: the enterprise] from unknown command and control in real-time.

- [removed: DNS] [added: Advanced DNS] Security. This cloud-delivered security service uses machine learning to proactively block malicious domains and stop attacks in progress.

It allows our network security platform access to [removed: DNS] [added: Domain Name System (“DNS”)] signatures that are generated using advanced predictive analysis, machine learning, and malicious domain data from a growing threat intelligence sharing community of which we are a part.

It offers comprehensive DNS attack coverage and includes industry-first protections against multiple emerging DNS-based network [removed: attacks.][added: attacks, including real-time analysis of DNS response to prevent DNS hijacking.]

[removed: *•*Enterprise] [added: - Enterprise] DLP. This cloud-delivered security service provides consistent, reliable protection of sensitive data, such as personally identifiable information [removed: (“PII”)] and intellectual property, for all traffic types, applications, and users.

It helps minimize the risk of a data breach both on-premises and in the cloud—such as in Office/Microsoft 365™, Salesforce®, and Box—and assists in meeting stringent data privacy and compliance regulations, including [removed: GDPR, CCPA, PCI DSS, HIPAA,] [added: the E.U. General Data Protection Regulation, the California Consumer Privacy Act, the Payment Card Industry Data Security Standard , HIPAA (Health Insurance Portability] and [added: Accountability Act) requirements, and] others.

AIOps provides continuous best practice recommendations powered by machine learning [removed: (“ML”)] based on industry standards, security policy context, and advanced telemetry data collected from our network security customers to improve security posture.

Prisma SD-WAN enables organizations to replace traditional Multiprotocol Label Switching [removed: (“MPLS”)] based WAN architectures with affordable broadband and internet transport types that promote improved bandwidth availability, redundancy and performance at a reduced cost.

- Prisma Cloud. Prisma Cloud is a comprehensive [removed: Cloud-Native Application Protection Platform (“CNAPP”),] [added: CNAPP,] securing both cloud-native and lift-and-shift applications across multi- and hybrid-cloud environments.

The platform helps developers prevent risks as they code and build the application, secures the software supply chain and the continuous integration and continuous development (“CI/CD”) pipeline, and provides complete visibility and real-time protection for applications [added: running] in the cloud.

With its code-to-cloud security capabilities, Prisma Cloud [removed: uniquely stitches together] [added: creates] a complete security picture by tracing back thousands of cloud risks and vulnerabilities that occur in the application runtime to their origin in the code-and-build phase of the application.

[removed: Including the recently launched CI/CD security module,] Prisma Cloud’s code-to-cloud CNAPP delivers comprehensive protection for applications and their code, infrastructure (workloads, network, and storage), data, APIs, and associated identities.

[removed: *•*Cortex] [added: - Cortex] XSIAM. This cloud-based [removed: subscription is the AI] [added: AI-driven] security [removed: automation] [added: operations] platform for the modern [removed: SOC, harnessing] [added: SOC harnesses] the power of AI to radically improve security outcomes and transform security operations.

Cortex XSIAM customers can consolidate multiple products into a single unified [removed: platform, including EDR, XDR, SOAR, ASM, user behavior analytics (“UBA”), threat intelligence] platform [removed: (“TIP”), and] [added: that delivers] security information and event [added: management, extended detection and response (“XDR”), SOAR, network traffic analysis, ASM, threat intelligence] management [removed: (“SIEM”).][added: (“TIM”), identity threat detection and response, and CDR.]

[removed: Using a security-specific data model and applying AI,] Cortex XSIAM automates data integration, analysis, and triage to respond to most alerts, enabling analysts to focus on only the incidents that require human intervention.

XDR Pro extends endpoint detection and response (“EDR”) to include cross-data [removed: analytics, including] [added: analytics for] network, cloud, and identity data.

- Cortex XSOAR. Available as a [added: stand-alone] cloud-based [removed: subscription or] [added: subscription,] an on-premises appliance, [added: or delivered natively through] Cortex [added: XSIAM, Cortex] XSOAR is a comprehensive [removed: security orchestration automation and response (“SOAR”)] [added: SOAR] offering that unifies playbook automation, case management, real-time collaboration, and [removed: threat intelligence management] [added: TIM] to serve security teams across the incident lifecycle.

[removed: It] [added: Cortex XSOAR] learns from the real-life analyst interactions and past investigations to help SOC teams with analyst assignment suggestions, playbook enhancements, and best next steps for investigations.

- Cortex Xpanse. [removed: This] [added: Available as a stand-alone] cloud-based subscription [added: and a cloud-based subscription module within Cortex XSIAM, Cortex Xpanse] provides [removed: attack surface management (“ASM”),] [added: ASM,] which is the ability for an organization to identify what an attacker would see among all of its sanctioned and unsanctioned Internet-facing assets.

Our channel partners that operate a Palo Alto Networks Authorized Support Center [removed: (“ASC”)] typically deliver level-one and level-two support.

We also offer a service offering called Focused Services that includes Customer Success Managers [removed: (“CSM”)] to provide support for end-customers with unique or complex support requirements.

Our security consultants serve as trusted partners with state-of-the-art cyber risk expertise and incident response capabilities, helping customers [removed: focus on their business before, during,] [added: build effective security programs, uncover critical exposures to prevent incidents, and, should incidents occur, respond to them with speed] and [removed: after a breach.][added: confidence.]

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation [removed: regarding] [added: based on allegations of] patent [removed: and] [added: infringement or] other [added: violations of] intellectual property rights.

A key element of our strategy is to help our customers simplify their security architectures through consolidating disparate point products.

We execute on this strategy by developing our capabilities and packaging our offerings into platforms which are able to cover many of our customers’ needs in the markets in which we operate.

Our platformization strategy combines various products and services into a tightly integrated architecture and makes security faster, less complex, and more cost-effective.

We focus on delivering value in four sectors of the cybersecurity industry:

Strata Cloud Manager includes the Strata Copilot which provides a natural language interface to simplify and accelerate platform management.

- We deliver scalable and comprehensive security across the cloud application development lifecycle through our Code to CloudTM platform, Prisma Cloud.

Additionally, Unit 42 offers managed detection and response and managed threat hunting services.

Many of our existing deployments continue using Panorama as the security management solution, while new deployments benefit from using Strata Cloud Manager instead for managing network security estate—including our Next-Generation Firewalls and SASE—with a cloud-based, unified management interface.

- AI Access Security. GenAI applications can inadvertently expose sensitive company data, such as intellectual property, trade secrets, source code, financial records and customer information, leading to significant business and compliance risks.

In addition, public GenAI tools can be exploited to spread malware and compromise cybersecurity defenses.

AI Access Security classifies and prioritizes GenAI applications to assess risk, detect anomalies and visualize insights across multiple GenAI-specific attributes.

It prevents sensitive data loss and defends against malicious responses, ensuring safe and effective AI adoption.

With native SASE integration, Prisma Access Browser extends Zero Trust to any device—managed or unmanaged—in minutes.

Prisma Access delivers exceptional user experience with a combination of application acceleration—up to 5x faster than direct-to-internet—and Autonomous Digital Experience Management.

With these capabilities, Prisma Access delivers an optimized digital experience and application performance to end users.

AI Runtime Security:

- AI applications and large language model (“LLM”) models challenge traditional security.

Increasingly sophisticated attacks on AI ecosystems require protection from AI applications, models and datasets.

AI Runtime Security continuously monitors AI applications, models and datasets for potential threats and anomalies.

It quickly adjusts to evolving attack techniques and detects suspicious activities in real time.

It shields customers’ AI application ecosystem from AI-specific and conventional network attacks by leveraging real-time, AI-powered security.

Strata Cloud Manager:

- Strata Cloud Manager enables our customers to easily manage their Palo Alto Networks’ Network Security infrastructure—including NGFWs and SASE environment—from the cloud, via one unified management interface.

In addition to getting complete visibility, with Strata Cloud Manager, customers can predict and prevent network health issues, strengthen security, and configure and manage their entire network security estate.

Strata Copilot, a part of Strata Cloud Manager, helps security teams quickly and easily find, understand and address threats leveraging the power and simplicity of natural language.

Prisma Cloud does this by consolidating multiple code and cloud security technologies such as Software Composition Analysis, Infrastructure as Code security, CI/CD security, secrets scanning, Cloud Security Posture Management, Cloud Identity and Entitlements Management, API security, Vulnerability Management, Cloud Workload Protection, Web Application and API Security, Cloud Network Security, and Cloud Discovery and Exposure Management into a single unified platform.

Further, the Code to Cloud Platform is positioned to secure AI-powered applications for enterprises.

In March 2024, we announced limited general availability of data security posture management (“DSPM”) capabilities and in May 2024, we released the early preview of AI security posture management (“AI-SPM”) capabilities to our customers.

These features were made available to all customers in our August 2024 software release.

Prisma Cloud customers can activate them within the platform to discover, classify, protect, and govern AI-powered applications.

DSPM and AI-SPM together provide visibility into the entire GenAI ecosystem, identify LLM vulnerabilities, prioritize misconfiguration risks, reduce the risk of data exposure, and surface compliance violations.

The native integration of Prisma Cloud with Cortex XSIAM is further expanded with the recent addition of cloud detection and response (“CDR”) capabilities, providing a broader context to protect, detect, and respond to advanced cloud threats.

It also brings together cloud security and security operations teams, fostering strong collaboration.

CDR is the latest addition to Cortex XSIAM and XDR that addresses the growing need for security teams to respond to cloud threats with purpose-built SOC tools that seamlessly integrate with their security programs.

Cortex XSIAM integrates these capabilities into a single, converged platform built for security operations, enabling organizations to simplify operations, stop threats at scale, and accelerate incident remediation.

Our engineering team has deep networking security, cloud security, endpoint security, security operations, and incident response expertise as well as expertise in AI and machine learning capabilities that are applied across these areas.

During fiscal 2024, we introduced several new offerings, including: Prisma Cloud Darwin release with newly integrated Code to Cloud intelligence capabilities, PAN-OS 11.2 Quasar, Cortex XSIAM 2.0, new Cortex XSIAM features, Prisma SASE 3.0, and Precision AITM.

For example, in December 2023, we acquired Dig Security Solutions Ltd. ("Dig"), which we expect will enhance our Prisma Cloud capabilities with a DSPM solution; and we acquired Talon Cyber Security Ltd. (“Talon”), which will support Prisma SASE’s approach to provide secure access to business applications for unmanaged and personal devices with an enterprise browser.

We believe that our intellectual property rights are valuable and important to our business, and that our success depends, in part, on our ability to protect and use our core technology and intellectual property rights.

We rely on a combination of trademarks, patents, copyrights, trade secrets, license agreements, intellectual property assignment agreements, confidentiality procedures, non-disclosure agreements, and employee non-disclosure and invention assignment agreements to establish, protect and control the use of our proprietary technology and intellectual property rights.

We are a leading provider of zero trust solutions, starting with next-generation zero trust network access to secure today’s remote hybrid workforces and extending to securing all users, applications, and infrastructure with zero trust principles.

Our security solutions are designed to reduce customers’ total cost of ownership by improving operational efficiency and eliminating the need for siloed point products.

Our company focuses on delivering value in four fundamental areas:

We have been recognized as a leader in network firewalls, SSE, and SD-WAN.

- We enable cloud-native security through our Prisma Cloud platform.

Panorama controls the security, network address translation (“NAT”), QoS, policy-based forwarding, decryption, application override, captive portal, and distributed denial of service/denial of service (“DDoS/DoS”) protection aspects of the network security systems under management.

Panorama centrally manages device software and associated updates, including SSL-VPN clients, SD-WAN, dynamic content updates, and software licenses.

Panorama offers network security monitoring through the ability to view logs and run reports for our network security platform in one location without the need to forward the logs and reliably expands log storage for long-term event investigation and analysis.

A machine learning module derived from the cloud sandbox environment is now delivered inline on the ML-Powered Next-Generation Firewalls to identify the majority of unknown threats without cloud connectivity.

Our engineering team has deep networking, endpoint, and security expertise and works closely with end-customers to identify their current and future needs.

During fiscal 2023, we introduced several new offerings, including: Cortex XSIAM 1.0, major updates to Prisma Cloud (including three new security modules), Prisma Access 4.0, PAN-OS 11.0, Cloud NGFW for AWS, and Cloud NGFW for Azure.

For example, we acquired Cider Security Ltd. (“Cider”), which we expect will support our Prisma Cloud’s platform approach to securing the entire application security lifecycle from code to cloud.

In particular, leading companies in the enterprise security industry have extensive patent portfolios and are regularly involved in both offensive and defensive litigation.

We continue to grow our patent portfolio and own intellectual property and related intellectual property rights around the world that relate to our products, services, research and development, and other activities, and our success depends in part upon our ability to protect our core technology and intellectual property.

We actively seek to protect our global intellectual property rights and to deter unauthorized use of our intellectual property by controlling access to, and use of, our proprietary software and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, end-customers, and partners, and our software is protected by U.S. and international copyright laws.

In addition, the laws of various foreign countries where our offerings are distributed may not protect our intellectual property rights to the same extent as laws in the United States.

See “Risk Factors-*Claims by others that we infringe their intellectual property rights could harm our business*,” “Risk Factors-*Our proprietary rights may be difficult to enforce or protect, which could enable others to copy or use aspects of our products or subscriptions without compensating us*,” and “Legal Proceedings” below for additional information.

Source & Hire. Sourcing diverse talent who possess the skills and capabilities to execute and add value to our culture form the cornerstone of our comprehensive approach to talent acquisition—a philosophy we call “The Way We Hire.” We utilize an array of methods to identify subject matter experts in their respective fields, emphasizing sourcing channels that connect us with underrepresented talents.

In an effort to foster career growth within Palo Alto Networks, we prioritize internal mobility.

This allows current employees to progress either through a traditional career path or by exploring roles across various business functions, often culminating in promotions.

We encourage existing employees to refer qualified individuals for our open positions, thus leveraging the collective networks of our team to attract a diverse range of expertise and perspectives.

We have made strides to understand job requirements and implement structured interviewing practices to identify candidates of the highest quality.

By conducting thorough job analyses and creating success profiles, we have developed a deeper understanding of what is required for success in critical roles.

We equip our hiring managers with essential training to identify and mitigate potential unconscious biases.

This commitment extends to conducting interviews with diverse panelists and providing a balanced evaluation and quality interview experience for a diverse slate of candidates.

We remain steadfast in our commitment to fairness, bias reduction, and equal opportunities for all potential hires.

A key to our hiring process is the Global Hiring Committees, introduced in fiscal 2023.

These committees play a significant role in elevating our hiring standards by promoting shared understanding, reducing biases, enhancing objectivity, and ensuring the recruitment of diverse talent.

The Committees foster effective collaboration using a common language and consensus-driven decision-making.

Our development initiatives are delivered to employees through a comprehensive platform, FLEXLearn.

Development information about core business elements, working in a distributed hybrid environment, as well as required company-wide compliance training, such as Code of Conduct, privacy and security, anti-discrimination, anti-harassment, and anti-bribery training, is also deployed through the FLEXLearn platform for all employees.

In addition, FLEXLearn provides employees with events and activities that motivate and spark critical thinking, on topics ranging from inclusion to well-being and collaboration.

Our comprehensive communication and listening strategy utilizes in-person and technology-enabled channels.

We share and collect information through corporate and functional “All Hands” meetings, including several meetings specifically focused on employee-centered topics in an “Ask Me Anything” format.

Digital Displays across our sites, our intranet platform, monthly and weekly email communications, and an active Slack platform provide a regular flow of information to and between employees and leadership.

In addition to these channels that reach large audiences, we conduct regular executive listening sessions, including small group convenings with our CEO and other C-suite leaders, and ad-hoc pulse surveys to better understand employee engagement, sentiment, well-being, and the ability to transition to a hybrid work model.

Employee sentiment is also collected from external sources, such as web platforms that crowdsource feedback.

Employees provide commentary to platforms such as Glassdoor, Comparably, and others and insights from those platforms are used to measure engagement.

We deeply believe that true diversity exists when we have representation of all ethnicities, genders, orientations and identities, and cultures in our workforce.

These principles are the foundation of our approach to I&D, which we call P.U.L.S.E.

For the fiscal year ended July 31, [removed: 2023][added: 2024]

The aggregate market value of voting stock held by non-affiliates of the registrant was [removed: $47,351,509,692] [added: approximately $108.1 billion] as of January 31, [removed: 2023,] [added: 2024,] the last business day of the registrant’s most recently completed second fiscal quarter (based on the closing sales price for the common stock on the Nasdaq Global Select Market on such date).

On August [removed: 18, 2023, 308,594,604] [added: 19, 2024, 325.6 million] shares of the registrant’s common stock, $0.0001 par value, were outstanding.

Portions of the information called for by Part III of this Annual Report on Form 10-K is hereby incorporated by reference from the definitive proxy statement for the registrant’s [removed: 2023] [added: 2024] annual meeting of stockholders, which will be filed with the Securities and Exchange Commission not later than 120 days after the registrant’s fiscal year ended July 31, [removed: 2023.][added: 2024.]

| Item 1. | | | [removed: [Business](#i8a1fb889ef014ec6885c8e58d3d08420_13)] [added: [Business](#id0a9ebb26d9d4578997f123b627a595a_13)] | | | [removed: [4](#i8a1fb889ef014ec6885c8e58d3d08420_13)] [added: [4](#id0a9ebb26d9d4578997f123b627a595a_13)] | | |

| Item 1A. | | | [Risk [removed: Factors](#i8a1fb889ef014ec6885c8e58d3d08420_52)] [added: Factors](#id0a9ebb26d9d4578997f123b627a595a_46)] | | | [removed: [14](#i8a1fb889ef014ec6885c8e58d3d08420_52)] [added: [15](#id0a9ebb26d9d4578997f123b627a595a_46)] | | |

| Item 1B. | | | [Unresolved Staff [removed: Comments](#i8a1fb889ef014ec6885c8e58d3d08420_55)] [added: Comments](#id0a9ebb26d9d4578997f123b627a595a_79)] | | | [removed: [35](#i8a1fb889ef014ec6885c8e58d3d08420_55)] [added: [36](#id0a9ebb26d9d4578997f123b627a595a_79)] | | |

| Item 2. | | | [removed: [Properties](#i8a1fb889ef014ec6885c8e58d3d08420_58)] [added: [Properties](#id0a9ebb26d9d4578997f123b627a595a_85)] | | | [removed: [35](#i8a1fb889ef014ec6885c8e58d3d08420_58)] [added: [39](#id0a9ebb26d9d4578997f123b627a595a_85)] | | |

| Item 3. | | | [Legal [removed: Proceedings](#i8a1fb889ef014ec6885c8e58d3d08420_61)] [added: Proceedings](#id0a9ebb26d9d4578997f123b627a595a_88)] | | | [removed: [35](#i8a1fb889ef014ec6885c8e58d3d08420_61)] [added: [39](#id0a9ebb26d9d4578997f123b627a595a_88)] | | |

| Item 4. | | | [Mine Safety [removed: Disclosures](#i8a1fb889ef014ec6885c8e58d3d08420_64)] [added: Disclosures](#id0a9ebb26d9d4578997f123b627a595a_91)] | | | [removed: [35](#i8a1fb889ef014ec6885c8e58d3d08420_64)] [added: [39](#id0a9ebb26d9d4578997f123b627a595a_91)] | | |

| Item 5. | | | [Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity [removed: Securities](#i8a1fb889ef014ec6885c8e58d3d08420_70)] [added: Securities](#id0a9ebb26d9d4578997f123b627a595a_97)] | | | [removed: [36](#i8a1fb889ef014ec6885c8e58d3d08420_70)] [added: [40](#id0a9ebb26d9d4578997f123b627a595a_97)] | | |

| Item 6. | | | [removed: [\[Reserved\]](#i8a1fb889ef014ec6885c8e58d3d08420_73)] [added: [\[Reserved\]](#id0a9ebb26d9d4578997f123b627a595a_103)] | | | [removed: [37](#i8a1fb889ef014ec6885c8e58d3d08420_73)] [added: [42](#id0a9ebb26d9d4578997f123b627a595a_103)] | | |

| Item 7. | | | [Management’s Discussion and Analysis of Financial Condition and Results of [removed: Operations](#i8a1fb889ef014ec6885c8e58d3d08420_76)] [added: Operations](#id0a9ebb26d9d4578997f123b627a595a_106)] | | | [removed: [38](#i8a1fb889ef014ec6885c8e58d3d08420_76)] [added: [43](#id0a9ebb26d9d4578997f123b627a595a_106)] | | |

| Item 7A. | | | [Quantitative and Qualitative Disclosures About Market [removed: Risk](#i8a1fb889ef014ec6885c8e58d3d08420_160)] [added: Risk](#id0a9ebb26d9d4578997f123b627a595a_190)] | | | [removed: [51](#i8a1fb889ef014ec6885c8e58d3d08420_160)] [added: [57](#id0a9ebb26d9d4578997f123b627a595a_190)] | | |

| Item 8. | | | [Financial Statements and Supplementary [removed: Data](#i8a1fb889ef014ec6885c8e58d3d08420_163)] [added: Data](#id0a9ebb26d9d4578997f123b627a595a_193)] | | | [removed: [52](#i8a1fb889ef014ec6885c8e58d3d08420_163)] [added: [58](#id0a9ebb26d9d4578997f123b627a595a_193)] | | |

| Item 9. | | | [Changes in and Disagreements with Accountants on Accounting and Financial [removed: Disclosure](#i8a1fb889ef014ec6885c8e58d3d08420_289)] [added: Disclosure](#id0a9ebb26d9d4578997f123b627a595a_337)] | | | [removed: [92](#i8a1fb889ef014ec6885c8e58d3d08420_289)] [added: [96](#id0a9ebb26d9d4578997f123b627a595a_337)] | | |

| Item 9A. | | | [Controls and [removed: Procedures](#i8a1fb889ef014ec6885c8e58d3d08420_292)] [added: Procedures](#id0a9ebb26d9d4578997f123b627a595a_340)] | | | [removed: [92](#i8a1fb889ef014ec6885c8e58d3d08420_292)] [added: [96](#id0a9ebb26d9d4578997f123b627a595a_340)] | | |

| Item 9B. | | | [Other [removed: Information](#i8a1fb889ef014ec6885c8e58d3d08420_298)] [added: Information](#id0a9ebb26d9d4578997f123b627a595a_346)] | | | [removed: [93](#i8a1fb889ef014ec6885c8e58d3d08420_298)] [added: [97](#id0a9ebb26d9d4578997f123b627a595a_346)] | | |

| Item 9C. | | | [Disclosure Regarding Foreign Jurisdictions That Prevent [removed: Inspections](#i8a1fb889ef014ec6885c8e58d3d08420_301)] [added: Inspections](#id0a9ebb26d9d4578997f123b627a595a_349)] | | | [removed: [93](#i8a1fb889ef014ec6885c8e58d3d08420_301)] [added: [97](#id0a9ebb26d9d4578997f123b627a595a_349)] | | |

| Item 10. | | | [Directors, Executive [removed: Officers](#i8a1fb889ef014ec6885c8e58d3d08420_307) [and] [added: Officers and] Corporate [removed: Governance](#i8a1fb889ef014ec6885c8e58d3d08420_307)] [added: Governance](#id0a9ebb26d9d4578997f123b627a595a_355)] | | | [removed: [94](#i8a1fb889ef014ec6885c8e58d3d08420_307)] [added: [98](#id0a9ebb26d9d4578997f123b627a595a_355)] | | |

| Item 11. | | | [Executive [removed: Compensation](#i8a1fb889ef014ec6885c8e58d3d08420_310)] [added: Compensation](#id0a9ebb26d9d4578997f123b627a595a_358)] | | | [removed: [94](#i8a1fb889ef014ec6885c8e58d3d08420_310)] [added: [98](#id0a9ebb26d9d4578997f123b627a595a_358)] | | |

| Item 12. | | | [Security Ownership of Certain Beneficial Owners and Management and Related [removed: Stockholder](#i8a1fb889ef014ec6885c8e58d3d08420_313) [](#i8a1fb889ef014ec6885c8e58d3d08420_313)[Matters](#i8a1fb889ef014ec6885c8e58d3d08420_313)] [added: Stockholder Matters](#id0a9ebb26d9d4578997f123b627a595a_361)] | | | [removed: [94](#i8a1fb889ef014ec6885c8e58d3d08420_313)] [added: [98](#id0a9ebb26d9d4578997f123b627a595a_361)] | | |

| Item 13. | | | [Certain Relationships and Related Transactions, and Director [removed: Independence](#i8a1fb889ef014ec6885c8e58d3d08420_316)] [added: Independence](#id0a9ebb26d9d4578997f123b627a595a_364)] | | | [removed: [94](#i8a1fb889ef014ec6885c8e58d3d08420_316)] [added: [98](#id0a9ebb26d9d4578997f123b627a595a_364)] | | |

| Item 14. | | | [Principal Accountant Fees and [removed: Services](#i8a1fb889ef014ec6885c8e58d3d08420_319)] [added: Services](#id0a9ebb26d9d4578997f123b627a595a_367)] | | | [removed: [94](#i8a1fb889ef014ec6885c8e58d3d08420_319)] [added: [98](#id0a9ebb26d9d4578997f123b627a595a_367)] | | |

| Item 15. | | | [Exhibits and Financial Statement [removed: Schedules](#i8a1fb889ef014ec6885c8e58d3d08420_325)] [added: Schedules](#id0a9ebb26d9d4578997f123b627a595a_373)] | | | [removed: [95](#i8a1fb889ef014ec6885c8e58d3d08420_325)] [added: [99](#id0a9ebb26d9d4578997f123b627a595a_373)] | | |

| Item 16. | | | [Form 10-K [removed: Summary](#i8a1fb889ef014ec6885c8e58d3d08420_3258)] [added: Summary](#id0a9ebb26d9d4578997f123b627a595a_376)] | | | [removed: [99](#i8a1fb889ef014ec6885c8e58d3d08420_3258)] [added: [103](#id0a9ebb26d9d4578997f123b627a595a_376)] | | |

This Annual Report on Form 10-K, [removed: including] [added: including, without limitation,] the sections entitled “Business,” “Risk Factors,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934.

[removed: The] [added: Forward-looking statements generally can be identified by] words [added: such as “anticipate,”] “believe,” [removed: “may,” “will,” “potentially,” “estimate,”] “continue,” [removed: “anticipate,” “intend,”] “could,” [removed: “would,” “project,” “plan,”] [added: “estimate,”] “expect,” [added: “intend,” “may,” “plan,” “potentially,” “projects,” “will,” “will be,” “will continue,” “will likely result,” “would,”] and similar expressions that convey uncertainty of future events or [removed: outcomes are intended to identify forward-looking statements.][added: outcomes.]

- statements regarding [removed: trends in billings,] [added: expected profitability,] our mix of product and subscription and support revenue, cost of revenue, gross margin, cash flows, operating expenses, including future share-based compensation expense, income taxes, investment plans, and liquidity;

- [removed: our] expectations regarding future investments in research and development and product development, customer support, in our employees and in our sales force, including expectations regarding growth in our sales headcount;

- [removed: our expectation] [added: expectations] that we will continue to expand our global presence;

- the timing and amount of capital expenditures and share repurchases; [removed: and]

| Item 1C. | | | [Cybersecurity](#id0a9ebb26d9d4578997f123b627a595a_82) | | | [37](#id0a9ebb26d9d4578997f123b627a595a_82) | | |

| | | | [Signatures](#id0a9ebb26d9d4578997f123b627a595a_379) | | | [104](#id0a9ebb26d9d4578997f123b627a595a_379) | | |

- expectations regarding the cybersecurity landscape;

- expectations regarding our platformization strategy and related progress and opportunities;

- expectations regarding annual recurring revenue and product development strategy;

- expectations regarding artificial intelligence;

- expectations regarding our strategic partnerships;

- the performance advantages of our products and subscription and support offerings and the potential benefits to our customers;

- the effects of worldwide economic and geopolitical conditions, including but not limited to hostilities in Israel and the surrounding region, inflation, interest rate levels, growth rates and other conditions, on our operating and financial results and performance;

- the effects of litigation or regulatory developments involving us or affecting our industry; and

| | | | [Signatures](#i8a1fb889ef014ec6885c8e58d3d08420_328) | | | [100](#i8a1fb889ef014ec6885c8e58d3d08420_328) | | |

- our expectation that we will expand our facilities or add new facilities as we add employees and enter new geographic markets;

- our expectation that we will increase our customer financing activities;

\- 36 \-

As a global cybersecurity provider, cybersecurity risk management is an integral part of our overall enterprise risk management program.

We recognize the critical importance that a strong cybersecurity risk management program plays in maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees.

We have established processes and procedures for identifying, evaluating, and responding to risks from cybersecurity threats, including any potential unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems, data, or information assets.

Cybersecurity Risk Management and Strategy

Our cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents.

Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following:

- Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems, data, and information assets.

The organizational, administrative and technical measures we implement are based on recognized security frameworks established by the National Institute of Standards and Technology, security measures aligned with the ISO/IEC 27000 series of standards, and other generally recognized industry standards.

The program is assessed regularly and in light of new and emerging cybersecurity risks.

- Technical Safeguards and Product Security. We deploy and maintain a variety of technologies to prevent and detect cybersecurity threats across the network, endpoint and cloud.

We also apply security-by-design principles in our software development lifecycle, track vulnerabilities of open-source software, and run internal and external network scans at least weekly and after any meaningful change in our network configuration.

We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data.

We also employ tooling in certain areas to help prevent deviations from policy.

- Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps.

We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications and accounting, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition.

This allows for prompt direction of appropriate personnel and resources for incident management and response, and internal notification to appropriate members of management, which may include our chief executive officer, chief product officer, chief information security officer, general counsel, chief financial officer, and/or chief accounting officer, and the security committee of our board of directors (the “Security Committee”).

The protocols also establish steps designed to publicly report and/or alert external stakeholders as and when required by applicable law or otherwise determined appropriate.

- Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by certain third parties, including vendors, service providers, suppliers, operations parties, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

This includes a security process to conduct due diligence prior to engaging contractors and vendors and assess the security capabilities of subcontractors and vendors on a periodic basis.

- Risk and Readiness Assessments. We engage in at least quarterly assessments and testing of the effectiveness of our cybersecurity risk management program and incident response protocols that are designed to identify and evaluate vulnerabilities and weaknesses, address cybersecurity threats and test our readiness to respond to cybersecurity incidents.

These efforts include, but are not limited to, threat modeling, vulnerability scans, penetration testing, audits, and tabletop exercises.

We regularly engage third parties to perform assessments on our cybersecurity measures, such as audits and independent reviews of our compliance with various security compliance standards, including those established by the American Institute of Certified Public Accountants, operating effectiveness and penetration tests.

The results of such assessments are reported to management and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

- Awareness and Training. We provide regular training for educating employees about corporate policies and procedures and information security designed to provide our employees with knowledge of best practices and effective tools for safeguarding our data and assets and reducing security risks based on the human threat vector.

Our information security compliance training, data protection training, and code of conduct training is mandatory for all employees.

\- 37 \-

- Governance. As discussed in more detail below under the heading, “Cybersecurity Governance,” our board of directors’ has delegated oversight of enterprise security risk management, including, but not limited to, cybersecurity risk management to the Security Committee.

As part of our cybersecurity risk management procedures, senior members of management and the Security Committee are informed regarding security events based on established reporting thresholds, and are provided ongoing updates regarding any such meaningful threat or incident.

We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition, to date.

However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions.

For additional information regarding these risks, please refer to Part I, Item 1A, “Risk Factors,” in this Form 10-K, including, but not limited to, the risk factor entitled “*A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results.*”

Cybersecurity Governance

The Security Committee, which is composed of all of our independent directors, facilitates our board of directors’ responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks.

The Security Committee reports regularly to the Board following meetings of the Security Committee with respect to its review and assessment of security matters and other matters that are relevant to the Security Committee’s discharge of its responsibilities.

The Security Committee meets quarterly to review with our chief information security officer and other members of management, which may include our chief executive officer, chief product officer, chief financial officer, and general counsel, our cybersecurity programs, cybersecurity risks, mitigation or remediation strategies, and other matters impacting the committee’s responsibilities.

Management is responsible for day-to-day risk management activities, including identifying, assessing and managing our exposure to cybersecurity risks, establishing processes and procedures to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures as needed, and maintaining cybersecurity risk management programs.

Our chief information security officer is responsible for defining, overseeing, managing, implementing, and reviewing compliance with the information security programs described above under the heading “Cybersecurity Risk Management and Strategy.” Our chief information security officer receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks.

In addition, as described in further detail above under the heading “Cybersecurity Risk Management and Strategy,” a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.

Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties.

In particular, our chief information security officer has extensive experience in the management of cybersecurity risk management programs, having served in various roles in information technology and security for over 20 years, including having previously served as the chief security officer of two other publicly traded technology companies.

\- 39 \-

\- 35 \-

Our common stock, $0.0001 par value per share, is traded on the Nasdaq Global Select Market under the symbol “PANW.” Prior to October 22, 2021, our common stock traded on the New York Stock Exchange [removed: (“NYSE”)] under the symbol “PANW.”

As of August [removed: 18, 2023,] [added: 19, 2024,] there were [removed: 414] [added: 502] holders of record of our common stock.

[removed: During] [added: Additionally, during] the three months ended July 31, [removed: 2023,] [added: 2024,] we issued a total of [removed: 3,569] [added: 12,841] shares of our unregistered common stock in connection with certain of our acquisitions (the [removed: “Transactions”).][added: “Transactions”).The Transactions did not involve any underwriters, any underwriting discounts or commissions, or any public offering.]

The issuances of the securities pursuant to the Transactions were exempt from registration under the Securities Act [removed: of 1933, as amended (the “Act”)] by virtue of Section 4(a)(2) of the Act and Rule 506 of Regulation D promulgated thereunder.

In December 2020, August 2021, [removed: and] August 2022, [added: and November 2023,] we announced additional $700.0 million, $676.1 million, [removed: and] $915.0 [added: million, and $316.7] million increases to this share repurchase program, respectively, bringing the total authorization to [removed: $3.3] [added: $3.6] billion, with [removed: $750.0] [added: $500.0] million remaining as of July 31, [removed: 2023.][added: 2024.]

The expiration date of this repurchase authorization was extended to December 31, [removed: 2023,] [added: 2024,] and our repurchase program may be suspended or discontinued at any time.

During the three months ended July 31, [removed: 2023,] [added: 2024,] we did not repurchase any shares pursuant to our share repurchase program.

Between [added: May 1, 2024 and May 31, 2024,] June 1, [removed: 2023] [added: 2024] and June 30, [removed: 2023] [added: 2024,] and July 1, [removed: 2023] [added: 2024] and July 31, [removed: 2023,] [added: 2024,] shares of restricted stock were delivered by certain employees upon vesting of equity awards to satisfy tax withholding requirements.

The average value of shares delivered to satisfy tax withholding requirements during these periods were [removed: $246.53] [added: $308.10] per [removed: share] [added: share, $317.02 per share,] and [removed: $243.33] [added: $330.89] per share, respectively.

This performance graph compares the cumulative total return on our common stock with that of the Nasdaq 100 Index, the Standard & Poor’s 500 Index, and the Standard & Poor’s 500 Information Technology Index for the five years ended July 31, [removed: 2023.][added: 2024.]

This performance graph assumes $100 was invested on July 31, [removed: 2018,] [added: 2019,] in each of the common stock of Palo Alto Networks, Inc., the Nasdaq 100 Index, the Standard & Poor’s 500 Index, and the Standard & Poor’s 500 Information Technology Index, and assumes the reinvestment of any dividends.

[removed: ][added: ]

| Company/Index | | | | | | [removed: 7/31/2018] [added: 7/31/2019] | | | | | | [removed: 7/31/2019] [added: 7/31/2020] | | | | | | [removed: 7/31/2020] [added: 7/31/2021] | | | | | | [removed: 7/31/2021] [added: 7/31/2022] | | | | | | [removed: 7/31/2022] [added: 7/31/2023] | | | | | | [removed: 7/31/2023] [added: 7/31/2024] | | |

During the three months ended July 31, 2024, holders of the 2025 Notes converted $199.6 million in aggregate principal amount of the 2025 Notes, which we repaid in cash.

We also issued 1.3 million shares of our unregistered common stock to the holders of the 2025 Notes for the conversion value in excess of the principal amount.

These shares of our common stock were issued in reliance on the exemption from registration provided by Section 3(a)(9) of the Securities Act of 1933, as amended (the “Securities Act”).

\- 40 \-

\- 41 \-

| Palo Alto Networks, Inc. | | | | | | $ | 100.00 | | | | | $ | 112.97 | | | | | $ | 176.15 | | | | | $ | 220.31 | | | | | $ | 331.01 | | | | | $ | 430.03 | |

| Nasdaq 100 Index | | | | | | $ | 100.00 | | | | | $ | 140.37 | | | | | $ | 193.97 | | | | | $ | 169.14 | | | | | $ | 207.66 | | | | | $ | 257.35 | |

| S&P 500 Index | | | | | | $ | 100.00 | | | | | $ | 111.96 | | | | | $ | 152.76 | | | | | $ | 145.67 | | | | | $ | 164.63 | | | | | $ | 201.10 | |

| S&P 500 Information Technology Index | | | | | | $ | 100.00 | | | | | $ | 138.91 | | | | | $ | 194.51 | | | | | $ | 183.79 | | | | | $ | 233.14 | | | | | $ | 315.19 | |

The Transactions did not involve any underwriters, any underwriting discounts or commissions, or any public offering.

\- 36 \-

| Palo Alto Networks, Inc. | | | | | | $ | 100.00 | | | | | $ | 114.26 | | | | | $ | 129.08 | | | | | $ | 201.28 | | | | | $ | 251.74 | | | | | $ | 378.23 | |

| Nasdaq 100 Index | | | | | | $ | 100.00 | | | | | $ | 109.74 | | | | | $ | 154.04 | | | | | $ | 212.86 | | | | | $ | 185.61 | | | | | $ | 227.88 | |

| S&P 500 Index | | | | | | $ | 100.00 | | | | | $ | 107.99 | | | | | $ | 120.90 | | | | | $ | 164.96 | | | | | $ | 157.31 | | | | | $ | 177.78 | |

| S&P 500 Information Technology Index | | | | | | $ | 100.00 | | | | | $ | 115.72 | | | | | $ | 160.75 | | | | | $ | 225.10 | | | | | $ | 212.69 | | | | | $ | 269.79 | |

\- 42 \-

\- 37 \-

| [Reports of Independent Registered Public Accounting [removed: Firm](#i8a1fb889ef014ec6885c8e58d3d08420_166)] [added: Firm](#id0a9ebb26d9d4578997f123b627a595a_196)] (PCAOB ID: 42) | | | [removed: [53](#i8a1fb889ef014ec6885c8e58d3d08420_166)] [added: [59](#id0a9ebb26d9d4578997f123b627a595a_196)] | | |

| [Consolidated Balance [removed: Sheets](#i8a1fb889ef014ec6885c8e58d3d08420_175)] [added: Sheets](#id0a9ebb26d9d4578997f123b627a595a_205)] | | | [removed: [56](#i8a1fb889ef014ec6885c8e58d3d08420_175)] [added: [62](#id0a9ebb26d9d4578997f123b627a595a_205)] | | |

| [Consolidated Statements of [removed: Operations](#i8a1fb889ef014ec6885c8e58d3d08420_178)] [added: Operations](#id0a9ebb26d9d4578997f123b627a595a_208)] | | | [removed: [57](#i8a1fb889ef014ec6885c8e58d3d08420_178)] [added: [63](#id0a9ebb26d9d4578997f123b627a595a_208)] | | |

| [Consolidated Statements of Comprehensive Income [removed: (Loss)](#i8a1fb889ef014ec6885c8e58d3d08420_181)] [added: (Loss)](#id0a9ebb26d9d4578997f123b627a595a_211)] | | | [removed: [58](#i8a1fb889ef014ec6885c8e58d3d08420_181)] [added: [64](#id0a9ebb26d9d4578997f123b627a595a_211)] | | |

| [Consolidated Statements of Stockholders’ [removed: Equity](#i8a1fb889ef014ec6885c8e58d3d08420_184)] [added: Equity](#id0a9ebb26d9d4578997f123b627a595a_223)] | | | [removed: [59](#i8a1fb889ef014ec6885c8e58d3d08420_184)] [added: [65](#id0a9ebb26d9d4578997f123b627a595a_223)] | | |

| [Consolidated Statements of Cash [removed: Flows](#i8a1fb889ef014ec6885c8e58d3d08420_187)] [added: Flows](#id0a9ebb26d9d4578997f123b627a595a_226)] | | | [removed: [60](#i8a1fb889ef014ec6885c8e58d3d08420_187)] [added: [66](#id0a9ebb26d9d4578997f123b627a595a_226)] | | |

| [Notes to Consolidated Financial [removed: Statements](#i8a1fb889ef014ec6885c8e58d3d08420_190)] [added: Statements](#id0a9ebb26d9d4578997f123b627a595a_229)] | | | [removed: [62](#i8a1fb889ef014ec6885c8e58d3d08420_190)] [added: [67](#id0a9ebb26d9d4578997f123b627a595a_229)] | | |

We have audited the accompanying consolidated balance sheets of Palo Alto Networks, Inc. (the Company) as of July 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] the related consolidated statements of operations, comprehensive income (loss), stockholders’ equity and cash flows for each of the three years in the period ended July 31, [removed: 2023,] [added: 2024,] and the related notes (collectively referred to as the “consolidated financial statements”).

In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company at July 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] and the results of its operations and its cash flows for each of the three years in the period ended July 31, [removed: 2023,] [added: 2024,] in conformity with U.S. generally accepted accounting principles.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company’s internal control over financial reporting as of July 31, [removed: 2023,] [added: 2024,] based on criteria established in Internal [removed: Control-Integrated] [added: Control—Integrated] Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 [removed: framework)] [added: framework),] and our report dated September [removed: 1, 2023] [added: 6, 2024] expressed an unqualified opinion thereon.

| *Description* *of the Matter* | | | As described in Note 1 to the consolidated financial statements, the Company’s contracts with customers sometimes contain multiple performance obligations, which are accounted for separately if they are distinct. In such cases, the transaction price is then allocated to the distinct performance obligations on a relative standalone selling price basis, and revenue is recognized when control of the distinct performance obligation is transferred. For example, product revenue is recognized at the time of hardware shipment or delivery of software license, and subscription and support revenue is recognized over time as the services are performed. Auditing the Company’s revenue recognition was complex, including the identification and determination of distinct performance obligations and the timing of revenue recognition. For example, there were [added: certain customer arrangements with] nonstandard terms and conditions that required judgment to determine the distinct performance obligations and the impact on the timing of revenue recognition. | | |

San [removed: Jose,] [added: Mateo,] California

We have audited Palo Alto Networks, Inc.’s internal control over financial reporting as of July 31, [removed: 2023,] [added: 2024,] based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria).

In our opinion, Palo Alto Networks, Inc. (the Company) maintained, in all material respects, effective internal control over financial reporting as of July 31, [removed: 2023,] [added: 2024,] based on the COSO criteria.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of July 31, [removed: 2023] [added: 2024] and [removed: 2022,] [added: 2023,] the related consolidated statements of operations, comprehensive income (loss), stockholders’ equity and cash flows for each of the three years in the period ended July 31, [removed: 2023,] [added: 2024,] and the related notes and our report dated September [removed: 1, 2023] [added: 6, 2024] expressed an unqualified opinion thereon.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s [added: Annual] Report on Internal Control over Financial Reporting.

| | | | [added: 2024 | | | | | |] 2023 | | | | | | 2022 | | |

| Cash and cash equivalents | | | $ | [added: 1,535.2 | | | | | $ |] 1,135.3 | | | | | $ | 2,118.5 | |

| Short-term investments | | | [removed: 1,254.7] [added: 1,043.6] | | | | | | [removed: 1,516.0] [added: 1,254.7] | | |

| Accounts receivable, net of allowance for credit losses of [removed: $7.8] [added: $7.5] and [removed: $8.9 at] [added: $7.8 as of] July 31, [removed: 2023] [added: 2024] and July 31, [removed: 2022,] [added: 2023,] respectively | | | [removed: 2,463.2] [added: 2,618.6] | | | | | | [removed: 2,142.5] [added: 2,463.2] | | |

| Short-term financing receivables, net | | | [removed: 388.8] [added: 725.9] | | | | | | [removed: 111.3] [added: 388.8] | | |

| Short-term deferred contract costs | | | [removed: 339.2] [added: 369.0] | | | | | | [removed: 317.7] [added: 339.2] | | |

| Prepaid expenses and other current assets | | | [removed: 466.8] [added: 557.4] | | | | | | [removed: 208.9] [added: 466.8] | | |

| Total current assets | | | [removed: 6,048.0] [added: 6,849.7] | | | | | | [removed: 6,414.9] [added: 6,048.0] | | |

| Property and equipment, net | | | [removed: 354.5] [added: 361.1] | | | | | | [removed: 357.8] [added: 354.5] | | |

| Operating lease right-of-use assets | | | [removed: 263.3] [added: 385.9] | | | | | | [removed: 242.0] [added: 263.3] | | |

| Long-term investments | | | [removed: 3,047.9] [added: 4,173.2] | | | | | | [removed: 1,051.9] [added: 3,047.9] | | |

| Long-term financing receivables, net | | | [removed: 653.3] [added: 1,182.1] | | | | | | [removed: 192.1] [added: 653.3] | | |

| Long-term deferred contract costs | | | [removed: 547.1] [added: 562.0] | | | | | | [removed: 550.1] [added: 547.1] | | |

| Goodwill | | | [removed: 2,926.8] [added: 3,350.1] | | | | | | [removed: 2,747.7] [added: 2,926.8] | | |

| Intangible assets, net | | | [removed: 315.4] [added: 374.9] | | | | | | [removed: 384.5] [added: 315.4] | | |

| Total assets | | | $ | [removed: 14,501.1] [added: 19,990.9] | | | | | $ | [removed: 12,253.6] [added: 14,501.1] | |

| Accounts payable | | | $ | [removed: 132.3] [added: 116.3] | | | | | $ | [removed: 128.0] [added: 132.3] | |

| Accrued compensation | | | [removed: 548.3] [added: 554.7] | | | | | | [removed: 461.1] [added: 548.3] | | |

| Accrued and other liabilities | | | [removed: 390.8] [added: 506.7] | | | | | | [removed: 399.2] [added: 390.8] | | |

| Deferred revenue | | | [removed: 4,674.6] [added: 5,541.1] | | | | | | [removed: 3,641.2] [added: 4,674.6] | | |

| Convertible senior notes, net | | | [removed: 1,991.5] [added: 963.9] | | | | | | [removed: 3,676.8] [added: 1,991.5] | | |

| Total current liabilities | | | [removed: 7,737.5] [added: 7,682.7] | | | | | | [removed: 8,306.3] [added: 7,737.5] | | |

| Long-term deferred revenue | | | [removed: 4,621.8] [added: 5,939.4] | | | | | | [removed: 3,352.8] [added: 4,621.8] | | |

| Long-term operating lease liabilities | | | [removed: 279.2] [added: 380.5] | | | | | | [removed: 276.1] [added: 279.2] | | |

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

September 6, 2024

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

San Mateo, California

September 6, 2024

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| | | | 2024 | | | | | | 2023 | | |

| Deferred tax assets | | | 2,399.0 | | | | | | 23.1 | | |

| Other assets | | | 352.9 | | | | | | 321.7 | | |

| Deferred tax liabilities | | | 387.7 | | | | | | 28.1 | | |

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| Net income (loss) | | | $ | 2,577.6 | | | | | $ | 439.7 | | | | | $ | (267.0) | |

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| Net income | | | — | | | | | | — | | | | | | — | | | | | | 2,577.6 | | | | | | 2,577.6 | | |

| Other comprehensive income | | | — | | | | | | — | | | | | | 41.6 | | | | | | — | | | | | | 41.6 | | |

| Settlement of convertible notes | | | 7.0 | | | | | | (2.6) | | | | | | — | | | | | | — | | | | | | (2.6) | | |

| Settlement of note hedges | | | (7.0) | | | | | | — | | | | | | — | | | | | | — | | | | | | — | | |

| Settlement of warrants | | | 9.0 | | | | | | — | | | | | | — | | | | | | — | | | | | | — | | |

| Balance as of July 31, 2024 | | | 325.1 | | | | | | $ | 3,821.1 | | | | | $ | (1.6) | | | | | $ | 1,350.2 | | | | | $ | 5,169.7 | |

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| Net income (loss) | | | $ | 2,577.6 | | | | | $ | 439.7 | | | | | $ | (267.0) | |

| Deferred income taxes | | | (2,033.7) | | | | | | 12.5 | | | | | | (3.1) | | |

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

Certain certificates of deposit, time deposits, and overnight sweep accounts recorded in cash and cash equivalents and short-term investments are stated at their carrying amounts, which approximate fair value due to their short maturities.

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

In the event the underlying hedged transactions do not occur, or it becomes probable that they will not occur within the defined hedge period, the gains or losses on these related cash flow hedges are recognized in other income, net on our consolidated statements of operations.

We also enter into foreign currency derivative contracts to hedge a portion of our outstanding monetary assets and liabilities denominated in foreign currencies.

These derivatives are not designated as hedging instruments for accounting purposes, and the related gains and losses are recorded in other income, net on our consolidated statements of operations.

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

We adopted the new debt guidance using the modified-retrospective approach.

The adoption of this standard resulted in an increase to convertible senior notes, net of $444.3 million, a decrease to accumulated deficit of $266.7 million, a decrease to additional paid-in capital of $581.9 million, and a decrease to temporary equity of $129.1 million on August 1, 2021.

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

Recently Issued Accounting Pronouncements

*Segment Reporting*

In November 2023, the Financial Accounting Standards Board (“FASB”) issued authoritative guidance that expands annual and interim disclosure requirements for reportable segments, primarily through enhanced disclosures about significant segment expenses.

| | | | | | |

| --- | --- | --- | --- | --- | --- |

\- 52 \-

\- 53 \-

September 1, 2023

\- 54 \-

\- 55 \-

| | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Other assets | | | 344.8 | | | | | | 312.6 | | |

\- 56 \-

\- 57 \-

| Balance as of July 31, 2020 | | | 288.8 | | | | | | $ | 2,259.2 | | | | | $ | 10.5 | | | | | $ | (1,167.9) | | | | | $ | 1,101.8 | |

| Net loss | | | — | | | | | | — | | | | | | — | | | | | | (498.9) | | | | | | (498.9) | | |

| Other comprehensive loss | | | — | | | | | | — | | | | | | (20.4) | | | | | | — | | | | | | (20.4) | | |

| Issuance of common and restricted common stock in connection with acquisitions | | | 4.0 | | | | | | 340.7 | | | | | | — | | | | | | — | | | | | | 340.7 | | |

| Temporary equity reclassification | | | — | | | | | | (129.1) | | | | | | — | | | | | | — | | | | | | (129.1) | | |

| CONSOLIDATED STATEMENTS OF CASH FLOWS (In millions) | | | | | | | | | | | | | | | | | |

| Repayments of convertible senior notes attributable to debt discount | | | — | | | | | | — | | | | | | (0.1) | | |

| Payments for debt issuance costs | | | — | | | | | | — | | | | | | (0.2) | | |

| Restricted cash included in other assets | | | — | | | | | | — | | | | | | 0.5 | | |

Gains or losses related to non-designated derivative instruments are recognized in other income, net on our consolidated statements of operations for each period until the instrument matures, is terminated, is re-designated as a qualified cash flow hedge, or is sold.

| | | | July 31, 2022 | | | | | | | | | | | | | | | | | | | | |

| Certificates of deposit | | | $ | 155.3 | | | | | $ | — | | | | | $ | — | | | | | $ | 155.3 | |

| Certificates of deposit | | | $ | 116.5 | | | | | $ | — | | | | | $ | (0.1) | | | | | $ | 116.4 | |

| Corporate debt securities | | | 1,276.8 | | | | | | 1.3 | | | | | | (11.9) | | | | | | 1,266.2 | | |

| U.S. government and agency securities | | | 928.1 | | | | | | 0.1 | | | | | | (11.8) | | | | | | 916.4 | | |

| Non-U.S. government and agency securities | | | 17.6 | | | | | | — | | | | | | (0.2) | | | | | | 17.4 | | |

| Asset-backed securities | | | 173.4 | | | | | | 0.2 | | | | | | (1.1) | | | | | | 172.5 | | |

| Total available-for-sale investments | | | $ | 2,591.5 | | | | | $ | 1.6 | | | | | $ | (25.2) | | | | | $ | 2,567.9 | |

| Total | | | $ | 4,490.5 | | | | | $ | 4,454.0 | |

Our financing receivables portfolio primarily consists of high-quality investment-grade receivables as of July 31, 2023 and 2022.

| | | | Amount | | |

The remaining fair value was allocated to future services and will be expensed over the remaining service periods as share-based compensation.

| | | | Fair Value | | | | | | Estimated Useful Life | | |

Fiscal 2021

*Bridgecrew Inc.*

We expect the acquisition will expand our Prisma Cloud offering to deliver security across the full application lifecycle.

| Cash | | | $ | 155.9 | |

| Total | | | $ | 156.9 | |

Our management, with the participation of our chief executive officer and chief financial officer, evaluated the effectiveness of our disclosure controls and procedures pursuant to Rule [removed: 13a-15] [added: 13a-15(e)] under the Securities Exchange Act of 1934, as amended (the “Exchange Act”).

Based on our evaluation, our chief executive officer and chief financial officer concluded that, as of July 31, [removed: 2023,] [added: 2024,] our disclosure controls and procedures are designed at a reasonable assurance level and are effective to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in Securities and Exchange Commission (“SEC”) rules and forms, and that such information is accumulated and communicated to our management, including our chief executive officer and chief financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Our management assessed the effectiveness of our internal control over financial reporting as of July 31, [removed: 2023,] [added: 2024,] based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control - Integrated Framework (2013 framework).

Based on that assessment, management concluded that, as of July 31, [removed: 2023,] [added: 2024,] our internal control over financial reporting was effective.

The effectiveness of our internal control over financial reporting as of July 31, [removed: 2023] [added: 2024] has been audited by Ernst & Young LLP, the independent registered public accounting firm that audits our consolidated financial statements, as stated in their report which is included in Part II, Item 8 of this Annual Report on Form 10-K.

There were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended July 31, [removed: 2023] [added: 2024] that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

\- 96 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 92 \-

[removed: Set forth below is certain information regarding] [added: No directors or officers, as defined in] Rule [added: 16a-1(f), adopted, modified and/or terminated a “Rule] 10b5-1 trading [removed: plans adopted by our directors and officers (as] [added: arrangement” or a “non-Rule 10b5-1 trading arrangement,” as] defined in [removed: Rule 16a-1(f))] [added: Regulation S-K Item 408,] during the fourth quarter of fiscal [removed: 2023.][added: 2024.]

The Rule 10b5-1 trading plans listed below are each intended to satisfy the affirmative defense of Rule 10b5-1(c).

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Name | | | | | | Title | | | | | | Date Plan Was Adopted | | | | | | Expiration Date | | | | | | Total Amount of Common Stock to be Sold Under the Plan | | |

| Nikesh Arora | | | | | | Chairman and Chief Executive Officer | | | | | | June 8, 2023 | | | | | | August 30, 2024 or when all shares have been sold | | | | | | 2,000,000 | | |

| William “BJ” Jenkins, Jr. | | | | | | President | | | | | | May 26, 2023 | | | | | | June 29, 2024 or when all shares have been sold | | | | | | 13,000 | | |

No other officers or directors, as defined in Rule 16a-1(f), adopted, modified and/or terminated a “Rule 10b5-1 trading arrangement” or a “non-Rule 10b5-1 trading arrangement,” as defined in Regulation S-K Item 408, during the fourth quarter of fiscal 2023.

\- 97 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 93 \-

The information required by this item will be contained in our definitive proxy statement to be filed with the SEC in connection with our [removed: 2023] [added: 2024] annual meeting of stockholders (the “Proxy Statement”), which is expected to be filed not later than 120 days after the end of our fiscal year ended July 31, [removed: 2023] [added: 2024] and is incorporated herein by reference.

\- 98 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 94 \-

| [removed: [3.1](http://www.sec.gov/Archives/edgar/data/1327567/000119312512415530/d405168dex31.htm)] [added: [3.1](https://www.sec.gov/Archives/edgar/data/1327567/000119312512415530/d405168dex31.htm)] | | | | | | Restated Certificate of Incorporation of the Registrant. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 3.1 | | | | | | October 4, 2012 | | | | | | | | |

| [removed: [3.2](http://www.sec.gov/Archives/edgar/data/1327567/000119312522157474/d274773dex31.htm)] [added: [3.2](https://www.sec.gov/Archives/edgar/data/1327567/000119312522157474/d274773dex31.htm)] | | | | | | Amended and Restated Bylaws of the Registrant. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 3.1 | | | | | | May 23, 2022 | | | | | | | | |

| [removed: [3.3](http://www.sec.gov/Archives/edgar/data/1327567/000132756716000057/ex31certificateofchangeofr.htm)] [added: [3.3](https://www.sec.gov/Archives/edgar/data/1327567/000132756716000057/ex31certificateofchangeofr.htm)] | | | | | | Certificate of Change of Location of Registered Agent and/or Registered Office. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 3.1 | | | | | | August 30, 2016 | | | | | | | | |

| [removed: [4.](http://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)[1](http://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)] [added: [4.1](https://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)] | | | | | | Indenture between the Registrant and U.S. Bank National Association, dated as of June 8, 2020. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 4.1 | | | | | | June 8, 2020 | | | | | | | | |

| [removed: [4.](http://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)[2](http://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)] [added: [4.2](https://www.sec.gov/Archives/edgar/data/0001327567/000119312520163579/d936599dex41.htm)] | | | | | | Form of Global 0.375% Convertible Senior Note due 2025 (included in Exhibit 4.1). | | | | | | 8-K | | | | | | 001-35594 | | | | | | 4.2 | | | | | | June 8, 2020 | | | | | | | | |

| [removed: [4](https://www.sec.gov/Archives/edgar/data/1327567/000132756723000024/panwex43q423.htm)[.3](https://www.sec.gov/Archives/edgar/data/1327567/000132756723000024/panwex43q423.htm)] [added: [4.3](https://www.sec.gov/Archives/edgar/data/1327567/000132756723000024/panwex43q423.htm)] | | | | | | Description of Registrant’s Securities. | | | | | | [added: 10-K] | | | | | | [added: 001-35594] | | | | | | [added: 4.3] | | | | | | [added: September 1, 2023] | | | | | | | | |

| [removed: [10.1](http://www.sec.gov/Archives/edgar/data/1327567/000119312512296699/d318373dex101.htm)*] [added: [10.1](https://www.sec.gov/Archives/edgar/data/1327567/000119312512296699/d318373dex101.htm)*] | | | | | | Form of Indemnification Agreement between the Registrant and its directors and officers. | | | | | | S-1/A | | | | | | 333-180620 | | | | | | 10.1 | | | | | | July 9, 2012 | | | | | | | | |

| [removed: [10.2](http://www.sec.gov/Archives/edgar/data/0001327567/000132756719000038/panwex102q1202012eip.htm)*] [added: [10.2](https://www.sec.gov/Archives/edgar/data/0001327567/000132756719000038/panwex102q1202012eip.htm)*] | | | | | | 2012 Equity Incentive Plan and related form agreements. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.2 | | | | | | November 26, 2019 | | | | | | | | |

| [removed: [10.4](https://www.sec.gov/Archives/edgar/data/1327567/000119312521359246/d170141dex991.htm)*] [added: [10.13](https://www.sec.gov/Archives/edgar/data/1327567/000119312522310112/d424580dex991.htm)*] | | | | | | [removed: 2021] [added: Cider Security Ltd. 2020] Equity Incentive Plan. | | | | | | S-8 | | | | | | [removed: 333-268930] [added: 333-268931] | | | | | | 99.1 | | | | | | December 21, 2022 | | | | | | | | |

| [removed: [10.5](http://www.sec.gov/Archives/edgar/data/1327567/000119312521359246/d170141dex992.htm)*] [added: [10.5](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex1052021eipoption.htm)*] | | | | | | Form of 2021 Equity Incentive Plan Global Stock Option Award Agreement. | | | | | | [removed: S-8] | | | | | | [removed: 333-261697] | | | | | | [removed: 99.2] | | | | | | [removed: December 16, 2021] | | | | | | | | |

| [removed: [10.6](https://www.sec.gov/Archives/edgar/data/1327567/000119312521359246/d170141dex993.htm)*] [added: [10.6](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex1062021eiprsu.htm)*] | | | | | | Form of 2021 Equity Incentive Plan Global Restricted Stock Unit Award Agreement. | | | | | | [removed: S-8] | | | | | | [removed: 333-261697] | | | | | | [removed: 99.3] | | | | | | [removed: December 16, 2021] | | | | | | | | |

| [removed: [10.7](http://www.sec.gov/Archives/edgar/data/1327567/000132756722000028/panwex107q422espp.htm)*] [added: [10.7](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex1072012employeestock.htm)*] | | | | | | 2012 Employee Stock Purchase Plan, as amended and restated, and related form agreements. | | | | | | [removed: 10-K] | | | | | | [removed: 001-35594] | | | | | | [removed: 10.7] | | | | | | [removed: September 6, 2022] | | | | | | | | |

| [removed: [10.8](http://www.sec.gov/Archives/edgar/data/1327567/000119312518303084/d634580dex991.htm)*] [added: [10.8](https://www.sec.gov/Archives/edgar/data/1327567/000119312518303084/d634580dex991.htm)*] | | | | | | RedLock Inc. 2015 Stock Plan, as amended, and related form agreements under RedLock Inc. 2015 Stock Plan, as amended. | | | | | | S-8 | | | | | | 333-227901 | | | | | | 99.1 | | | | | | October 19, 2018 | | | | | | | | |

| [removed: [10.12](http://www.sec.gov/Archives/edgar/data/1327567/000119312520320091/d23873dex991.htm)*] [added: [10.9](https://www.sec.gov/Archives/edgar/data/1327567/000119312520320091/d23873dex991.htm)*] | | | | | | Sinefa Group, Inc. 2020 Stock Plan. | | | | | | S-8 | | | | | | 333-251423 | | | | | | 99.1 | | | | | | December 17, 2020 | | | | | | | | |

| [removed: [10.1](http://www.sec.gov/Archives/edgar/data/1327567/000119312520320099/d35944dex991.htm)[3](http://www.sec.gov/Archives/edgar/data/1327567/000119312520320099/d35944dex991.htm)*] [added: [10.10](https://www.sec.gov/Archives/edgar/data/1327567/000119312520320099/d35944dex991.htm)*] | | | | | | Expanse Holding Company, Inc. Amended and Restated 2012 Stock Incentive Plan | | | | | | S-8 | | | | | | 333-251425 | | | | | | 99.1 | | | | | | December 17, 2020 | | | | | | | | |

| [removed: [10.1](https://www.sec.gov/Archives/edgar/data/0001327567/000119312521265618/d214080dex991.htm)[4](https://www.sec.gov/Archives/edgar/data/0001327567/000119312521265618/d214080dex991.htm)*] [added: [10.11](https://www.sec.gov/Archives/edgar/data/0001327567/000119312521265618/d214080dex991.htm)*] | | | | | | Gamma Networks, Inc. 2018 Stock Option and Grant Plan. | | | | | | S-8 | | | | | | 333-259327 | | | | | | 99.1 | | | | | | September 3, 2021 | | | | | | | | |

| [removed: [10.15](http://www.sec.gov/Archives/edgar/data/1327567/000119312521074955/d51651dex991.htm)*] [added: [10.12](https://www.sec.gov/Archives/edgar/data/1327567/000119312521074955/d51651dex991.htm)*] | | | | | | Bridgecrew, Inc. 2019 Stock Incentive Plan. | | | | | | S-8 | | | | | | 333-254042 | | | | | | 99.1 | | | | | | March 9, 2021 | | | | | | | | |

| [removed: [10.1](http://www.sec.gov/Archives/edgar/data/1327567/000119312522310112/d424580dex991.htm)[6](http://www.sec.gov/Archives/edgar/data/1327567/000119312522310112/d424580dex991.htm)*] [added: [10.14](https://www.sec.gov/Archives/edgar/data/1327567/000119312522310112/d424580dex992.htm)*] | | | | | | [added: US Sub-Plan to] Cider Security Ltd. 2020 Equity Incentive Plan. | | | | | | S-8 | | | | | | 333-268931 | | | | | | [removed: 99.1] [added: 99.2] | | | | | | December 21, 2022 | | | | | | | | |

| [removed: [10.18](http://www.sec.gov/Archives/edgar/data/1327567/000132756714000043/panwex102q115.htm)*] [added: [10.15](https://www.sec.gov/Archives/edgar/data/1327567/000132756714000043/panwex102q115.htm)*] | | | | | | Employee Incentive Compensation Plan, as amended and restated. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.2 | | | | | | November 25, 2014 | | | | | | | | |

| [removed: [10.2](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000008/panw-ex104q222.htm)[0](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000008/panw-ex104q222.htm)*] [added: [10.17](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000008/panw-ex104q222.htm)*] | | | | | | Amended and Restated Outside Director Compensation Policy (last amended February 16, 2022). | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.4 | | | | | | February 23, 2022 | | | | | | | | |

| [removed: [10.2](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000016/panw-ex103q322.htm)[1](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000016/panw-ex103q322.htm)*] [added: [10.21](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000016/panw-ex103q322.htm)*] | | | | | | Continued Service Policy. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.3 | | | | | | May 20, 2022 | | | | | | | | |

| [removed: [10.22](http://www.sec.gov/Archives/edgar/data/1327567/000132756722000028/panwex1023q422deferredcomp.htm)*] [added: [10.22](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000028/panwex1023q422deferredcomp.htm)*] | | | | | | Palo Alto Networks, Inc. Deferred Compensation Plan effective June 1, 2022 | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.23 | | | | | | September 6, 2022 | | | | | | | | |

| [removed: [10.2](https://www.sec.gov/Archives/edgar/data/0001327567/000132756720000041/panwex101q121.htm)[3](https://www.sec.gov/Archives/edgar/data/0001327567/000132756720000041/panwex101q121.htm)*] [added: [10.23](https://www.sec.gov/Archives/edgar/data/0001327567/000132756720000041/panwex101q121.htm)*] | | | | | | Employment Agreement between Palo Alto Networks (Israel Analytics) Ltd. and Nir Zuk, dated August 18, 2020. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.1 | | | | | | November 19, 2020 | | | | | | | | |

| [removed: [10.2](http://www.sec.gov/Archives/edgar/data/1327567/000132756718000011/ex102offerletternarora.htm)[4](http://www.sec.gov/Archives/edgar/data/1327567/000132756718000011/ex102offerletternarora.htm)*] [added: [10.24](https://www.sec.gov/Archives/edgar/data/1327567/000132756718000011/ex102offerletternarora.htm)*] | | | | | | Offer Letter between the Registrant and Nikesh Arora, dated May 30, 2018. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 10.2 | | | | | | June 4, 2018 | | | | | | | | |

| [removed: [10.2](https://www.sec.gov/Archives/edgar/data/1327567/000119312521267862/d200133dex101.htm)[5](https://www.sec.gov/Archives/edgar/data/1327567/000119312521267862/d200133dex101.htm)*] [added: [10.25](https://www.sec.gov/Archives/edgar/data/1327567/000119312521267862/d200133dex101.htm)*] | | | | | | Offer Letter between the Registrant and Josh Paul, dated August 5, 2021. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 10.1 | | | | | | September 8, 2021 | | | | | | | | |

| [removed: [10.27](http://www.sec.gov/Archives/edgar/data/0001327567/000119312521087516/d160663dex101.htm)*] [added: [10.27](https://www.sec.gov/Archives/edgar/data/0001327567/000119312521087516/d160663dex101.htm)*] | | | | | | Addendum to Employment Offer Letter by and between the Registrant and Dipak Golechha, dated March 17, 2021. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 10.1 | | | | | | March 19, 2021 | | | | | | | | |

| [removed: [10.28](http://www.sec.gov/Archives/edgar/data/1327567/000132756722000016/panw-ex101q322.htm)*] [added: [10.28](https://www.sec.gov/Archives/edgar/data/1327567/000132756722000016/panw-ex101q322.htm)*] | | | | | | Addendum to Employment Offer Letter by and between the Registrant and Dipak Golechha, dated February 18, 2022. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.1 | | | | | | May 20, 2022 | | | | | | | | |

| [removed: [10.3](https://www.sec.gov/Archives/edgar/data/1327567/000132756721000029/panwex1027q421directoroffe.htm)[1](https://www.sec.gov/Archives/edgar/data/1327567/000132756721000029/panwex1027q421directoroffe.htm)*] [added: [10.31](https://www.sec.gov/Archives/edgar/data/1327567/000132756721000029/panwex1027q421directoroffe.htm)*] | | | | | | Form of Offer Letter between the Registrant and its directors. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.27 | | | | | | September 3, 2021 | | | | | | | | |

| [removed: [10.3](http://www.sec.gov/Archives/edgar/data/1327567/000132756719000016/panwex101q319.htm)[2](http://www.sec.gov/Archives/edgar/data/1327567/000132756719000016/panwex101q319.htm)] [added: [10.32](https://www.sec.gov/Archives/edgar/data/1327567/000132756719000016/panwex101q319.htm)] | | | | | | Amended and Restated Flextronics Manufacturing Services Agreement, by and between the Registrant and Flextronics Telecom Systems Ltd., dated April 1, 2019. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.1 | | | | | | May 30, 2019 | | | | | | | | |

| [removed: [10.33](http://www.sec.gov/Archives/edgar/data/1327567/000132756721000029/panwex1029q421supplieragre.htm)] [added: [10.33](https://www.sec.gov/Archives/edgar/data/1327567/000132756721000029/panwex1029q421supplieragre.htm)] | | | | | | Vendor Information Security Terms between the Registrant and Flextronics Telecom Systems Ltd., dated July 23, 2021. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.29 | | | | | | September 3, 2021 | | | | | | | | |

| [removed: [10.34](http://www.sec.gov/Archives/edgar/data/1327567/000119312520163579/d936599dex102.htm)] [added: [10.34](https://www.sec.gov/Archives/edgar/data/1327567/000119312520163579/d936599dex102.htm)] | | | | | | Form of Convertible Note Hedge Confirmation. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 10.2 | | | | | | June 8, 2020 | | | | | | | | |

| [removed: [10.35](http://www.sec.gov/Archives/edgar/data/1327567/000119312520163579/d936599dex103.htm)] [added: [10.35](https://www.sec.gov/Archives/edgar/data/1327567/000119312520163579/d936599dex103.htm)] | | | | | | Form of Warrant Confirmation. | | | | | | 8-K | | | | | | 001-35594 | | | | | | 10.3 | | | | | | June 8, 2020 | | | | | | | | |

| [removed: [10.36](http://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1029q415buildinge.htm)] [added: [10.36](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1029q415buildinge.htm)] | | | | | | Lease between the Registrant and Santa Clara Campus Property Owner I LLC, dated May 28, 2015. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.29 | | | | | | September 17, 2015 | | | | | | | | |

| [removed: [10.37](http://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1030q415buidlingf.htm)] [added: [10.37](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1030q415buidlingf.htm)] | | | | | | Lease between the Registrant and Santa Clara Campus Property Owner I LLC, dated May 28, 2015. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.30 | | | | | | September 17, 2015 | | | | | | | | |

| [removed: [10.38](http://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1031q415buildingb.htm)] [added: [10.38](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000027/panwex1031q415buildingb.htm)] | | | | | | Lease between the Registrant and Santa Clara Campus Property Owner I LLC, dated May 28, 2015. | | | | | | 10-K | | | | | | 001-35594 | | | | | | 10.31 | | | | | | September 17, 2015 | | | | | | | | |

| [removed: [10.39](http://www.sec.gov/Archives/edgar/data/1327567/000119312515347005/d59912dex101.htm)] [added: [10.39](https://www.sec.gov/Archives/edgar/data/1327567/000119312515347005/d59912dex101.htm)] | | | | | | Lease by and between the Registrant and Santa Clara Campus Property Owner I LLC, dated October 7, 2015. | | | | | | 8-K/A | | | | | | 001-35594 | | | | | | 10.1 | | | | | | October 19, 2015 | | | | | | | | |

| [removed: [10.40](http://www.sec.gov/Archives/edgar/data/1327567/000132756715000036/amendmentno1topaloaltonetw.htm)] [added: [10.4](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000036/amendmentno1topaloaltonetw.htm)[0](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000036/amendmentno1topaloaltonetw.htm)] | | | | | | Amendment No. 1 to Lease by and between the Registrant and Santa Clara Phase I Property LLC, dated November 9, 2015. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.2 | | | | | | November 24, 2015 | | | | | | | | |

| [removed: [10.41](http://www.sec.gov/Archives/edgar/data/1327567/000132756715000036/amendmenno1topaloaltonetwo.htm)] [added: [10.41](https://www.sec.gov/Archives/edgar/data/1327567/000132756715000036/amendmenno1topaloaltonetwo.htm)] | | | | | | Amendment No. 1 to Lease by and between the Registrant and Santa Clara Campus Property Owner I LLC, dated November 9, 2015. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.3 | | | | | | November 24, 2015 | | | | | | | | |

| [removed: [10.42](http://www.sec.gov/Archives/edgar/data/1327567/000132756716000073/panwex101q117_amendmentno1.htm)] [added: [10.42](https://www.sec.gov/Archives/edgar/data/1327567/000132756716000073/panwex101q117_amendmentno1.htm)] | | | | | | Amendment No. 1 to Lease by and between the Registrant and Santa Clara Campus Property Owner I LLC, dated September 16, 2016. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.1 | | | | | | November 22, 2016 | | | | | | | | |

| [removed: [10.43](http://www.sec.gov/Archives/edgar/data/1327567/000132756716000073/panwex102q117_amendmentno1.htm)] [added: [10.43](https://www.sec.gov/Archives/edgar/data/1327567/000132756716000073/panwex102q117_amendmentno1.htm)] | | | | | | Amendment No. 1 to Lease by and between the Registrant and Santa Clara Campus Property Owner I LLC, dated September 16, 2016. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.2 | | | | | | November 22, 2016 | | | | | | | | |

| [10.4](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex1042021equityincenti.htm)* | | | | | | 2021 Equity Incentive Plan, as amended and restated on December 12, 2023. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

\- 99 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| [10.16](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex1016amendedclawbackp.htm) | | | | | | Clawback Policy, adopted as of August 29, 2017, amended August 14, 2024. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

\- 100 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 101 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| [1](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex191insidertradingpol.htm)[9.1](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex191insidertradingpol.htm) | | | | | | Insider Trading Policy and Requirements for Trading Plans | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| [97.1](https://www.sec.gov/Archives/edgar/data/1327567/000132756724000029/panwex971compensationrecov.htm) | | | | | | Compensation Recovery Policy | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

\- 102 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

\- 95 \-

| [10.](http://www.sec.gov/Archives/edgar/data/1327567/000119312520003856/d850020dex991.htm)[9](http://www.sec.gov/Archives/edgar/data/1327567/000119312520003856/d850020dex991.htm)* | | | | | | Aporeto, Inc. Amended and Restated 2015 Stock Option and Grant Plan. | | | | | | S-8 | | | | | | 333-235854 | | | | | | 99.1 | | | | | | January 8, 2020 | | | | | | | | |

| [10.1](http://www.sec.gov/Archives/edgar/data/1327567/000119312520133786/d849861dex991.htm)[0](http://www.sec.gov/Archives/edgar/data/1327567/000119312520133786/d849861dex991.htm)* | | | | | | CloudGenix Inc. 2013 Equity Incentive Plan. | | | | | | S-8 | | | | | | 333-238014 | | | | | | 99.1 | | | | | | May 5, 2020 | | | | | | | | |

| [10.11](http://www.sec.gov/Archives/edgar/data/1327567/000119312520266352/d99009dex991.htm)* | | | | | | Crypsis Group Holdings, LLC 2017 Equity Incentive Plan. | | | | | | S-8 | | | | | | 333-249387 | | | | | | 99.1 | | | | | | October 8, 2020 | | | | | | | | |

| [10.17](http://www.sec.gov/Archives/edgar/data/1327567/000119312522310112/d424580dex992.htm)* | | | | | | US Sub-Plan to Cider Security Ltd. 2020 Equity Incentive Plan. | | | | | | S-8 | | | | | | 333-268931 | | | | | | 99.2 | | | | | | December 21, 2022 | | | | | | | | |

| [10.19](http://www.sec.gov/Archives/edgar/data/1327567/000132756717000035/panwex103q118_clawbackpoli.htm)* | | | | | | Clawback Policy, adopted as of August 29, 2017. | | | | | | 10-Q | | | | | | 001-35594 | | | | | | 10.3 | | | | | | November 21, 2017 | | | | | | | | |

\- 96 \-

\- 97 \-

\- 98 \-

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, on September [removed: 1, 2023.][added: 6, 2024.]

| /s/ NIKESH ARORA | | | | | | Chairman, Chief Executive Officer and Director (Principal Executive Officer) | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ DIPAK GOLECHHA | | | | | | Chief Financial Officer (Duly Authorized Officer and Principal Financial Officer) | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ JOSH PAUL | | | | | | Chief Accounting Officer (Duly Authorized Officer and Principal Accounting Officer) | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ NIR ZUK | | | | | | Chief Technology Officer and Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ APARNA BAWA | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ JOHN M. DONOVAN | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ CARL ESCHENBACH | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ DR. HELENE D. GAYLE | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ JAMES J. GOETZ | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ RT HON SIR JOHN KEY | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ MARY PAT MCCARTHY | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

| /s/ LORRAINE TWOHILL | | | | | | Director | | | | | | September [removed: 1, 2023] [added: 6, 2024] | | |

\- 103 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 104 \-

[Table of](#id0a9ebb26d9d4578997f123b627a595a_7) [Contents](#id0a9ebb26d9d4578997f123b627a595a_7)

\- 105 \-

\- 99 \-

\- 100 \-

\- 101 \-