Welcome to the Free edition of How They Make Money.
Over 300,000 subscribers turn to us for business and investment insights
In case you missed it:
Software Strikes Back: Part Deux
For the past two years, software investors have worried that AI would eat into seats, pricing, and eventually the software model itself.
This week, Palo Alto Networks and Snowflake showed the other side of that trade.
Palo Alto is seeing AI create more identities, traffic, and attack surfaces to secure. Snowflake is seeing AI workloads drive more consumption across the data platform.
In both cases, AI is driving more usage across the software stack.
Today at a glance:
☁️ Palo Alto: AI Security Comes Together
❄️ Snowflake: AI Fuels Consumption
1. ☁️ Palo Alto: AI Security Comes Together
Palo Alto closed Q4 FY26 (ending in July) with revenue up 34% Y/Y to $3.4 billion ($60 million beat), while non-GAAP EPS reached $1.02 ($0.04 beat).
Acquisitions still make the headline growth rate messy, but the underlying demand indicators were strong. Palo Alto added a record $970 million of net new Next-Gen Security ARR, while landing roughly 220 net new platformizations, up 44% and twice the Q3 pace. If you recall, platformization is the fancy word for multi-product adoption.
Palo Alto finished FY26 with a 38% adjusted free cash flow margin, essentially preserving its high-30s profitability while absorbing two major acquisitions (CyberArk and Chronosphere).
The GAAP numbers weren’t as pretty. Palo Alto swung to a $282 million net loss, but this was mostly accounting noise driven by one-off acquisition adjustments. The quarter notably included a $524 million mark-to-market charge related to CyberArk convertible notes, along with $281 million of acquired intangible amortization and $487 million of stock-based compensation.
FY27 revenue guidance of $14.1–$14.2 billion implies 23%–24% growth and came in above consensus, while management expects NGS ARR to grow 22%–23% to reach ~$11.1 billion and maintained its 38% adjusted FCF margin target.
Management also reaffirmed its 40%+ adjusted free cash flow margin target for FY28 and $20 billion NGS ARR target for FY30.
The central question for investors is whether this M&A spree creates genuine platform synergies. Early cross-sell data suggests it is.
Platformization Accelerates
Next-Gen Security ARR reached $9.1 billion, up 63% Y/Y, while remaining performance obligations climbed 34% to a record $21.2 billion. Those growth rates still benefit heavily from CyberArk and Chronosphere, so they shouldn’t be read as organic growth.
But Palo Alto provided another useful lens for FY26:
Network & AI Security revenue: +17% Y/Y.
Cortex revenue: +25%.
Idira (CyberArk rebranding) revenue: +21% on a pro forma basis.
In other words, each major platform is growing at a healthy double-digit rate.
More importantly, customers are consolidating more spending with Palo Alto. Net retention among platformized customers remained above 120%. More than 65% of NGS ARR now comes from platformized customers.
Palo Alto’s customers spending more than $5 million in NGS ARR rose 45% Y/Y to 223, while customers above $10 million increased 50% to 78. One Q4 telecom deal alone was worth $126 million and combined firewalls, SASE, Idira, and Cortex XSIAM.
AI security stack comes together
AI agents generate machine-to-machine traffic, access credentials, query internal data, and increasingly take actions autonomously. Palo Alto says agentic traffic across SASE has increased more than 9x in nine months. That makes AI both a new attack surface and a catalyst for upgrading legacy security infrastructure.
Palo Alto is building around three main layers:
Prisma AIRS: Secure the AI. ARR reached roughly $120 million only one year after launch, making it Palo Alto’s fastest-scaling product. Customers jumped from more than 300 in Q3 to more than 800 in Q4. AIRS now spans runtime security, agent identities, red teaming, observability, and agent gateways.
Cortex: Detect and respond. XSIAM ARR surpassed $700 million, up roughly 70% Y/Y, with close to 1,000 customers. Chronosphere’s observability ARR also crossed $500 million, more than 2.5x its level just two quarters ago. Half of Chronosphere’s Q4 net-new logos included an XSIAM cross-sell, showing Palo Alto is already plugging the acquisition into the broader platform.
Idira: Control identity and access. The $25 billion CyberArk acquisition gives Palo Alto control over the credentials and permissions used by humans, machines, and AI agents. Early cross-selling is encouraging: CyberArk ACV grew 27% Y/Y, Palo Alto generated more than 200 CyberArk new-logo wins from its existing installed base, and shared leads between the two sales organizations have increased by roughly 50% since May.
That creates a fairly simple architecture: AIRS secures AI applications and agents, Cortex detects and responds when something goes wrong, and Idira controls what they can access.
But wait! There’s one more layer: autonomous action. Alongside earnings, Palo Alto announced the acquisition of Console, an AI-native platform that lets users build agentic workflows using natural language. The goal is to move Cortex beyond surfacing security issues toward agents that can investigate and remediate them automatically.
In CEO Nikesh Arora’s words, this is the shift toward “software-as-an-agent.”
Takeaway: Palo Alto is starting to show that its acquisition spree is creating something bigger than the individual parts. Platformization is accelerating, AIRS is scaling rapidly, and CyberArk and Chronosphere are already cross-selling into the broader platform. AI is becoming both a demand catalyst and a real revenue stream. The main challenge ahead is justifying a much richer valuation. The stock has roughly doubled since we last added to our PANW position in App Economy Portfolio in March.
2. ❄️ Snowflake: AI Fuels Consumption
Snowflake’s growth acceleration is no longer looking like a one-quarter blip.
Product revenue surged 37% Y/Y to $1.49 billion, up from +34% Y/Y last quarter and +30% two quarters ago. Total revenue rose +35% Y/Y to $1.55 billion ($70 million beat), while non-GAAP EPS was $0.62 ($0.17 beat).
Management also raised FY27 product revenue guidance by $230 million to $6.07 billion, lifting expected Y/Y growth to 36%.
So if we zoom out, the FY27 product revenue growth outlook has moved from 27% to 31% to 36% in the past six months. And there might be more acceleration ahead. Q3 guidance calls for 37%–38% product revenue growth, slightly faster than Q2.
CEO Sridhar Ramaswamy revealed on the call that AI products directly explain roughly half of Snowflake’s recent growth acceleration. But AI’s true impact may be larger because it is also accelerating migrations and increasing consumption across the core data platform.
The quarter in numbers
Net revenue retention: 126% (+1pp Y/Y).
$1M+ customers: 828 (+27% Y/Y).
Remaining performance obligations: $9.0 billion (+30% Y/Y).
Non-GAAP operating margin: 15% (+4pp Y/Y).
GAAP operating margin: -17% (+13pp Y/Y).
RPO remains the softer metric, dipping sequentially from $9.2 billion to $9.0 billion despite 30% Y/Y growth. Some of that reflects Q2 renewal seasonality and faster burn-down as customers consume ahead of contractual schedules. In a consumption model, actual platform usage and product revenue remain cleaner indicators of business health.
The gap between GAAP and adjusted margins remains enormous because Snowflake still relies heavily on stock-based compensation, which accounted for 27% of revenue. Still, that ratio is down 12 percentage points Y/Y. The absolute level remains high, but the direction is clearly improving.
AI fuels the core business
Cortex Code (CoCo) surpassed 9,100 accounts, adding more than 2,000 during the quarter, while CoWork expanded to 5,800 accounts.
These products enable direct AI consumption, but the bigger opportunity lies in the second-order effect.
Customers need more governed data available to their AI applications. More users can interact with that data through conversational interfaces. Agents can increasingly retrieve information, analyze it, and take actions. Each additional workload increases Snowflake consumption.
AI is also helping Snowflake bring workloads onto the platform faster. Coding models can automate parts of legacy migrations that historically required large teams and months or years of manual rewriting.
So AI creates new workloads, but also makes it easier to move onto Snowflake in the first place. That helps explain why the core business is accelerating alongside the AI portfolio rather than being cannibalized by it.
The customer data supports the same story. Snowflake added 692 net new customers, up 32% Y/Y, indicating strong momentum.
A total of 65 customers now generate more than $10 million in trailing annual product revenue, up from 45 a year ago. In a consumption model, that expansion matters. Snowflake needs customers to keep discovering new ways to use their data. AI is giving them just that.
The gross margin tradeoff
Snowflake lowered its FY27 non-GAAP product gross-margin outlook from 75% to 74%, partly because AI products carry additional model and inference costs. But operating-margin guidance moved in the opposite direction, rising from 13.5% to 14.5%. This confirms continued operating leverage alongside accelerating top-line growth.
In other words, Snowflake is choosing to absorb some near-term AI costs while the broader platform scales.
Takeaway: Snowflake’s AI thesis is moving from defense to offense. This quarter showed that AI can make that governed data layer more valuable. Product growth has accelerated from 30% to 37% in two quarters, and operating margins are expanding at the same time. So far, Snowflake looks increasingly like one of the software companies where AI expands consumption rather than cannibalizing it.
That’s it for today!
Happy investing!
Want to sponsor this newsletter? Get in touch here.
Thanks to Fiscal.ai for being our official data partner. Create your own charts and pull key metrics from 50,000+ companies directly on Fiscal.ai. Save 15% with this link.
Disclosure: I own PANW and CRWD in App Economy Portfolio. I share my ratings (BUY, SELL, or HOLD) with App Economy Portfolio members.
Author's Note (Bertrand here 👋🏼): The views and opinions expressed in this newsletter are solely my own and should not be considered financial advice or any other organization's views.
It feeds good deeds