Title: Cybersecurity's AI Moment — Palo Alto & CrowdStrike make their AI pitch
Show: App Economy Insights (How They Make Money)
Author: Bertrand Hartman
Date: 2026-06-05
URL: https://www.appeconomyinsights.com/p/cybersecuritys-ai-moment
Note: Written Substack post (free edition), saved verbatim. Prose article — no (mm:ss) timestamps. Body reproduced as published.

---

Beat. Raise. Sell. — Palo Alto Networks and CrowdStrike are the two largest pure-play cybersecurity companies in the world; they reported a day apart with almost the same script: strong results, higher guidance, and a stock that fell anyway. Both had rallied more than 50% into earnings as investors embraced the thesis that AI is becoming a tailwind for cybersecurity. The trigger was Anthropic's Mythos, the model judged too dangerous to release widely, which sent enterprises scrambling to reassess defenses. The numbers suggest the AI security thesis is real. The problem is investors already knew it.

1. Palo Alto: Buying the AI Security Era — Strong quarter, messy headline. Revenue +31% Y/Y (14% organic) to $3.0B ($60M beat); non-GAAP EPS $0.85 ($0.05 beat). An unusual $183M operating loss, mostly deal-related noise from the $25B CyberArk acquisition and the Chronosphere deal (new acquisitions added ~$280M intangible amortization + $198M deal costs this quarter). Cash flow cleaner: operating cash flow +39% to $871M; adjusted FCF a record $910M (+57%); TTM FCF margin 38.5% (+4.3pp). Management leaned into the early-2026 SaaSpocalypse selloff, spending $1B on 6.8M shares at ~$148 (nearly half today's price) — "when you're that sure the panic is wrong, you buy" (App Economy built a larger PANW position then). Organic: NGS ARR $8.1B (+28% organic); RPO $18.4B (+22% organic) — the CyberArk deal did not mask a slowdown. CEO Nikesh Arora framed AI as a "forcing function": frontier models make companies rethink defenses, especially as AI agents gain access to credentials/data/systems. ~1,000 companies reached out in two months; the new Unit 42 Frontier AI Defense generated 800+ meetings in six weeks; with early model access, Palo Alto says it can compress a year of penetration testing into under three weeks. But "AI still makes mistakes" — frontier models can hit ~25% error rates and fail at the last mile; attackers only need to win once, so customers still need a trusted platform. Platformization: 110 net-new platformizations (total ~2,280); 120% net retention, single-digit churn; firewall bookings up across appliances (+40%, best hardware quarter in a decade) and software (+25%); 46% of TTM product revenue now recurring software (from 22% three years ago). Built for the agent era: CyberArk → rebranded Idira (identity for humans, machines, AI agents); Cortex XSIAM crossed $600M ARR (~100% Y/Y, 740+ customers, displacing legacy SIEM); Prisma AIRS topped 300 customers (tripling sequentially, a $20M+ deal signed). Guidance raised 3rd straight quarter: FY26 revenue to $11.42B ($60M raise), EPS $3.77–3.79; still expects 40% FCF margin by FY28 and $20B NGS ARR by FY30; CFO flagged rising memory/storage costs (10% hardware price increase baked in). Risk: ~62x forward EBITDA after a ~50% rally — pricing a clean integration.

2. CrowdStrike: The Mythos Moment — The cleanest validation yet: Q1-record net-new ARR and higher guidance on every line. After surging 60%+ into the print, a merely excellent report wasn't enough — stock fell 10%+. Revenue +26% Y/Y to $1.4B ($30M beat), 4th straight quarter of acceleration; non-GAAP EPS $1.10 ($0.03 beat); operating loss narrowed to $31M (from $125M). Record FCF $468M (34% margin), Rule of 40 = 59; SBC remains 21% of revenue. Ending ARR +24% to $5.51B (past halfway to the $10B target). Net new ARR a Q1-record $256M (+32%) — Q1 is seasonally weakest. CEO George Kurtz's thesis is now the customer's: enterprises treat CrowdStrike as AI security infrastructure; post-Mythos executive inquiries surged; stood up Project QuiltWorks; created a Chief AI and Autonomous Systems Officer role, poaching Bartley Richardson from NVIDIA. Falcon Flex flywheel: 300+ Flex accounts added; Flex ARR nearly doubled to $1.9B (>1/3 of total); 480 ReFlex customers (~25% of Flex) lifted ARR +26% avg; 130+ reflexed more than once (+51% avg uplift). AIDR (AI Detection and Response): ending ARR +250% sequentially, Q2 pipeline >$50M — Kurtz called it the fastest ramp of his career, a market potentially larger than endpoint itself; Next-Gen SIEM ARR >$600M (with cloud+identity >$2B); FalconShield ARR nearly quadrupled. Raised the full year on every line; FY27 ARR now expected +25%; net-new ARR guide raised >$50M ("the AI tailwind in action"); Q2 guide just in-line. Takeaway: AI is turning cybersecurity from a defensive budget line into a strategic priority. The thesis is working; the stocks are the hard part — after massive rallies, valuations leave little room for error.

Disclosure: the author owns PANW and CRWD.