Palo Alto (PANW) Stock Is Not Expensive, Buy While You Still Can

Investment Thesis

Palo Alto Networks, Inc. (PANW) is a leading cybersecurity player that has expanded its TAM from its hardware network security (firewall) focus. Its Cortex extended detection and response (XDR) module leads its endpoint security strategy. Furthermore, it's also expanding its zero-trust strategy through its suite of products, building on the SASE model in developing a "single pane of glass" for its customers.

Nevertheless, PANW is also facing intense competition from the next-gen cybersecurity leaders. Notably, CrowdStrike (CRWD) is the leading endpoint security leader, which has also launched what it believes will be the industry-leading XDR module. Furthermore, Zscaler (ZS) has often been critical of PANW's firewall-based architecture in its approach towards its zero-trust strategy.

Despite that, Palo Alto has continued to execute well with its transformation and telegraphed an ambitious long-term operating model. Its stock is also much less expensive, and the company has demonstrated solid operating metrics.

We discuss why PANW stock can be a foundational cybersecurity stock for investors who want exposure to the space but aren't sure which sub-segment they should focus on.

PANW Stock Key Metrics

Readers can refer to the above charts and quickly glean that PANW stock doesn't seem expensive compared to CRWD stock and ZS stock. PANW stock is trading at an NTM revenue multiple of 8.5x. It's way below CRWD stock's 19.8x and ZS stock's 32.3x. Therefore, Palo Alto stock's more "defensive" valuation could also be a less aggressive way for new cybersecurity investors to get exposure to this critical space.

Citi also weighed in on PANW stock's opportunities. It added (edited): "Citi is positive about the company's valuation and growth potential. In addition, PANW stock offers defensive exposure as software investors continue to rotate out of high multiple software assets."

Furthermore, PANW stock's NTM free cash flow (FCF) yield also lends credence to Citi's observation. PANW stock trades at an NTM FCF yield of 3.8%, lower than its 3Y mean of 4.5%. Nonetheless, its relatively robust FCF yield is much more attractive than CRWD stock's 1.4% and ZS stock's 0.67%. Therefore, PANW stock's "defensive" qualities through its relatively impressive FCF generation could appeal to investors who are less aggressive and prefer less volatility when investing in a forward-looking cybersecurity leader.

Palo Alto's Key Operating Metrics Show its Execution Capabilities

Readers can glean that Palo Alto's revenue growth has remained relatively consistent over the last three years. It registered revenue of $1.25B in its previous quarter (FQ1'22), up 31.9%. Therefore, any rumblings from its competitors about PANW's "weak" offerings are lost in Palo Alto's solid execution. Furthermore, its gross margins have remained robust as it continues to revamp its business model. Therefore, it demonstrates that Palo Alto has a highly resilient business model with remarkable pricing leadership.

Nonetheless, the company has consistently reported GAAP EBIT losses. But, we need to emphasize that the critical operating metric that management focuses on is its free cash flow (FCF) margins. Investors can observe that while its last-twelve-months (LTM) FCF margins have fallen since CY2017, it's still highly respectable at 31.5% in its previous quarter.

Management's medium-term guidance through FY24 is also remarkable. It guided revenue CAGR of 23% from FY21-24 and FCF margin of 35% through FY24. Therefore, we believe that management expects Palo Alto to continue benefiting from the secular tailwinds underpinning the cybersecurity leaders.

Furthermore, we can also glean from its billings growth to observe the strength in its deferred revenue expansion. So it's also a key operating metric that management closely monitors. Investors can also observe that billings growth remains robust, and Palo Alto is also confident of a 22% CAGR through FY24.

In addition, Palo Alto is a critical security player for the largest enterprise customers. It highlighted in its 10-Q that it had "end-customers in over 170 countries. Our end customers represent a broad range of industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications, and include almost all of the Fortune 100 companies and a majority of the Global 2000 companies in the world."

We can also observe from the second chart above that its largest customers ($1M+ revenue) have continued to grow as they adopt its zero-trust security posture. Palo Alto is banking on the criticality of the push towards zero-trust to empower its next growth phase. Palo Alto emphasized: "We believe our portfolio offers the ability to achieve a zero-trust enterprise through advanced security capabilities while reducing the total cost of ownership for organizations by improving operational efficiency and eliminating the need for siloed point products."

What CrowdStrike and Zscaler Suggested

Nevertheless, the Next-Gen cloud-native security leaders CrowdStrike, and Zscaler have also been "vociferous" about Palo Alto's push towards XDR and zero-trust. Both companies have also been recognized as the leading best-of-breed cybersecurity leaders in their respective fields. We have also covered both companies recently, and you can refer to our articles here and here.

While not referring to Palo Alto specifically, CrowdStrike CEO George Kurtz offered a "scathing" assessment of the current hype in XDR. He emphasized (edited):

XDR is not about simply integrating data into a single console. This is doubling down on the failed promise of SIEM. Security teams have a hard enough job as it is, and this approach makes it even tougher. XDR is not a rebranding effort. Many vendors have jumped on the hype cycle and repackaged existing products to boost their valuation or try to make them fit into the various and differing analyst definitions of XDR. Calling an old product by a different name doesn’t magically change what it is. You need to do something with the data. XDR doesn’t just consolidate existing alerts — it generates new ones. (CrowdStrike)

Forrester also alluded to the complexity in Palo Alto's approach while praising CrowdStrike's approach with its formidable CrowdXDR alliance. It added (edited):

CrowdStrike offers superior endpoint security with a cloud-native architecture. Customers continue to praise CrowdStrike’s automatic detection and response features and overall effectiveness, especially as the company progresses with an XDR strategy while pulling data in from a growing ecosystem of sensors. Palo Alto Networks integrates endpoint threat prevention with extended detection. The company replaced its legacy on-premises endpoint security platform with Cortex XDR, showing improvements in areas including automatic behavioral protection and threat analysis. This growing portfolio of capabilities and consoles comes at the expense of simplicity, with buyers rating the deployment and operation of the product as above average in difficulty. Agent performance issues have been reported when deployed on endpoints with less-than-standard performance specs. (The Forrester Wave Endpoint Security Software As a Service Q2'2021)

Furthermore, Zscaler has also been critical of Palo Alto's network-based (firewall) approach. Co-founder and CEO Jay Chaudhry emphasized (edited):

Legacy companies have hijacked the term. With Zscaler’s platform, your applications are hidden behind us. This is totally the opposite of firewalls and VPN and network security. Either you’re zero-trust or you’re network security. You don’t do both. Your firewall is designed as a network device. The architecture has to be opposite from zero trust. There’s no such thing as a 'zero-trust firewall'–they don’t go together. (VentureBeat)

Gartner also suggested that Palo Alto's use cases could be limited beyond its current customer base. It added (edited):

Palo Alto Networks’ SSE product strategy builds on acquired functionality and the use of firewall rules. For example, its ZTNA functionality draws on the GlobalProtect agent and uses object-based firewall rules for user-to-application segmentation. Client feedback indicates that this approach appeals primarily to Palo Alto Networks’ existing customer base and that it has limited appeal elsewhere. Client feedback also indicates that it is expensive and confusing to achieve full SSE functionality with Palo Alto Networks. (Gartner Magic Quadrant for Security Service Edge)

However, we also presented earlier that Palo Alto has amassed a growing number of the largest enterprise customers. Therefore, if Palo Alto can continue maintaining its platform stickiness, it should serve as a critical competitive moat against its next-gen security rivals.

Is PANW Stock a Buy, Sell, or Hold?

PANW stock is trading above its NTM EBITDA 3Y mean by about 25%. Therefore, its valuation still seems elevated compared to historical metrics. However, we believe that the company has continued to demonstrate its ability to execute well. Furthermore, its largest customers base has continued to expand rapidly.

In addition, it's also trading below its most pessimistic price targets (PT) as seen above. Note that its most pessimistic PTs have been an excellent support zone over the last three years.

Therefore, we believe that PANW stock is still a reasonably priced cybersecurity leader exposed to all the critical secular trends in its space. We also think that new investors in the cybersecurity space can consider adding PANW stock as a starter stock.

As such, we rate PANW stock at Buy.

Comments are closed.