PRIMARYPANW
Palo Alto Networks
NASDAQ: PANW · Santa Clara · triple MQ Leader (HMF/SASE/EPP) · NGS ARR $6.3B +33% · ~2,280 platformized at 120% NRR · non-leader in SIEM
7edges
4sources
1flags
5
Key Judgments
thesis-level
9
Entities
resolved
12
Relationships
graph edges
15
Sources
graded
4
Uncertainties
collection gaps
A1
Top Admiralty
reliability / credibility
MOD
Confidence
differentiator thesis
Bottom line up front
Installed-base depth and the switching costs it creates almost certainly determine autonomous SOC category leadership through 2027–28; platform penetration produces retention that outlasts feature-comparison cycles.[B2] Palo Alto Networks holds the only triple-Magic-Quadrant-Leader position in the industry (hybrid mesh firewall, SASE, endpoint) and posts 120% net retention with single-digit churn across roughly 2,280 platformized customers — the empirical signature of the moat.[A2] PANW remains a non-leader in SIEM, the decisive category, against an entrenched Microsoft/Splunk duopoly.[B1] Hyperscaler bundling carries the highest weighted-inconsistency score in the matrix: CrowdStrike, the best-performing vendor by ARR growth, achieves record results without it.[A2] Identity governance for non-human and agentic identities is the runner-up thesis likely to become co-primary if the CyberArk integration puts PAM controls inside the AgentiX action pipeline.[A1]
4 Key Judgments
KJ-01
Installed-base depth and the switching costs it creates almost certainly determine autonomous SOC leadership through 2027–28; 120% net retention and single-digit churn are the moat's empirical signature, and they survive feature-comparison cycles.
Confidence: HighSources: A2 · B2, convergent
KJ-02
Hyperscaler bundling is likely not the primary structural differentiator: CrowdStrike achieves superior platform growth without it, and Microsoft's E5 Security Copilot inclusion carries throttling and governance-maturity prerequisites that limit reach to well-governed tenants.
Confidence: HighSources: A2, two SEC filings
KJ-03
Identity governance for agentic and non-human identities likely becomes co-primary in 2027–28 if agent deployments accelerate as forecast; the non-human-identity access market grows from ~$11B (2025) to $27B (2033) and 51% of organizations lack clear AI identity ownership.
Confidence: ModerateSources: B2, prospective
KJ-04
Proprietary telemetry scale is unlikely to be the standalone primary differentiator; PANW's CEO disclosed persistent 25% AI error rates despite enormous data corpora, and Morningstar cites switching costs — not data gravity — as the primary structural protection.
Confidence: ModerateSources: B2, two inconsistencies
4 Competing Hypotheses
click evidence to test diagnosticity| Evidence · click to toggle | H5Installed-base moat | H3Identity governance | H4Hyperscaler bundling | H1Telemetry / data gravity |
|---|---|---|---|---|
| CRWD wins at scale without enterprise bundling (ARR $5.25B, 97% gross retention) — SEC 8-K | + | · | −− | + |
| Morningstar frames PANW moat as switching costs first, network effect second — not data gravity — B2 | + | · | · | – |
| PANW Q3 FY26: 2,280 platformized customers, 120% NRR, 'architectural commitments' — earnings | + | · | · | + |
| MS E5 Security Copilot bundled, but throttles at SCU cap and requires governance maturity — B3 | + | + | – | · |
| NHI market $11B→$27B; 51% lack AI identity ownership; 60%+ F500 run an agent — CSA B2 | + | + | – | · |
| CISO consolidation: 75% converge on one XDR + 2–3 add-ons; $96B sec M&A in 2025 — B2 | + | · | + | + |
| Inconsistency score | 0 SURVIVES | 0 SURVIVES | 4 | 1 |
+Consistent–Inconsistent−−Strongly inconsistent·Neutral
Result: H5 and H3 survive with the fewest inconsistencies (0). Toggle evidence to test how each item discriminates between hypotheses.
6 Entities of Interest
9 resolved · showing 6 by centralityCOMPETITORCRWD
CrowdStrike
NASDAQ: CRWD · Austin · ARR $5.25B +24% · 97% gross retention · AgentWorks ecosystem (Anthropic/OpenAI/NVIDIA) wins without bundling
3edges
2sources
2flags
COMPETITORE5 BUNDLE
Microsoft Security
NASDAQ: MSFT · Redmond · SIEM Leader · Security Copilot bundled in M365 E5 (400 SCUs/1,000 users) · ~83% of F500 already on E5
3edges
2sources
2flags
COMPETITORHYPERSCALER
Google · Wiz
Alphabet · Mountain View · $32B Wiz close (Mar 2026, largest ever) · CNAPP + Mandiant + SecOps + Red/Blue/Green agents in one cloud bill
2edges
1sources
1flags
ACQUIREDIDENTITY
CyberArk · Cortex AgentiX
$25B close (11 Feb 2026) · human/machine/agentic identity · PAM gating AgentiX privileges · XSIAM ~$600M ARR >100% YoY
3edges
2sources
1flags
CATEGORYSIEM
SIEM / SecOps battleground
Oct 2025 MQ: Microsoft + Splunk lead · PANW & CrowdStrike debut outside Leaders · the decisive autonomous-SOC category
4edges
2sources
1flags
Platform Signals
retention is the moat's signatureNet revenue retention
120PANW
115CrowdStrike
% · platform stickiness
Annual recurring revenue
6.3PANW NGS
5.25CRWD
$B · platform scale
Agentic adoption proof
50%+S1 Purple AI attach
$600MXSIAM ARR
% / $M · independent signals
Relationship Graph
⌘/Ctrl-scroll to zoom · drag to panPrimary subjectCompetitor orgProduct / infraCategory / pressurePerson
Chronology
indications & warning · hover a marker, click to jump05 Jun 2026
PANW Q3 FY26: 2,280 platformized customers, 120% NRR, XSIAM ~$600M ARR +100% YoY
ANALYSTS / US / PANW earnings / Morningstar · graded B2
25 Mar 2026
CrowdStrike Charlotte AI AgentWorks ecosystem — Anthropic/OpenAI/NVIDIA/AWS/Salesforce partners
AGENTIC / US / BusinessWire · graded B2
11 Feb 2026
PANW closes CyberArk ($25B) — identity security as fifth platform pillar
M&A / US-EU-IL / SEC 8-K Ex-99.1 · graded A1
01 Jan 2026
Microsoft Security Copilot effective in M365 E5 at no added cost (400 SCUs/1,000 users)
AGENTIC / US / MS Product Terms · graded B2
28 Oct 2025
PANW launches Cortex AgentiX (autonomous agents, GA in Cortex Cloud + XSIAM) at Ignite
PRODUCT / US / PANW investor release · graded B3
08 Oct 2025
Gartner SIEM MQ: Microsoft/Splunk lead; PANW and CrowdStrike debut as non-leaders
ANALYSTS / US / Gartner doc 7040298 · graded B1
12 Sep 2025
CrowdStrike acquires Onum ($252.7M) for real-time telemetry pipeline management
M&A / US / CRWD 10-Q (SEC) · graded A2
30 Jul 2025
PANW–CyberArk definitive agreement ($25B cash-and-stock) announced
M&A / US-IL / PANW press release · graded B3
Evidence Register
8 sources · graded| Source | Details | Type | Admiralty | Date |
|---|---|---|---|---|
| SEC 8-K Ex-99.1 — CyberArk close↗ | PANW completion; identity as fifth pillar; human/machine/agentic scope | SEC filing | A1 | Feb 2026 |
| SEC 8-K Ex-99.1 — Chronosphere close↗ | $3.35B observability MQ Leader; >$160M ARR triple-digit growth | SEC filing | A1 | Jan 2026 |
| CrowdStrike 8-K Q4 FY26↗ | ARR $5.25B +24%; NRR 115%; gross retention 97%; Falcon Flex +120% | SEC filing | A2 | Jun 2026 |
| PANW Q2 FY26 earnings release↗ | NGS ARR $6.3B +33%; RPO $16.0B +23%; XSIAM $500M+ ARR | Primary · IR | A2 | Feb 2026 |
| Morningstar — PANW wide-moat analysis↗ | Moat primarily switching costs, secondarily network effect — not data gravity | Tier-1 analyst | B2 | Jan 2026 |
| Microsoft Product Terms — E5 Copilot↗ | Security Copilot included in M365 E5 from Jan 2026; 400 SCUs/1,000 users | Primary · trade | B2 | Jan 2026 |
| CSA — NHI / agentic governance whitepaper↗ | 51% of orgs lack AI identity ownership; NHI market $11B→$27B | Research org | B2 | 2026 |
| Gartner SIEM MQ doc 7040298↗ | PANW and CrowdStrike debut outside Leaders; Microsoft + Splunk lead | Tier-1 analyst | B1 | Oct 2025 |