CrowdStrike vs. Palo Alto Networks: how they make money

• Organizations subscribing to Falcon · 94.9% of revenueBusinesses and government bodies paying for the platform and its modules: $4,564.7 million, 94.9% of FY2026 revenue, and $1,400.3 million in Q2 FY2027.
• Organizations buying professional services · 5.1% of revenueBreach response, forensics, consulting and training: $247.3 million, 5.1% of FY2026 revenue.

• Organizations paying for subscriptions · 54.3% of revenueYearly fees for cloud-delivered security, security operations, cloud security and, since 2026, identity security and observability: $6,239 million, 54.3% of FY2026 revenue.
• Organizations paying for support · 25.8% of revenueSecurity updates, upgrades, bug fixes and repairs, usually bought with firewalls: $2,961 million, 25.8% of FY2026 revenue.
• Organizations buying products · 19.9% of revenueFirewall hardware and software licenses: $2,280 million, 19.9% of FY2026 revenue.

Not on the CrowdStrike page.

Not on the Palo Alto Networks page.

Debt

$746M

Cash and investments

$5.0B

On Jul 31, 2026.

At Jul 31, 2026 CrowdStrike held $5,013.8 million of cash against $746.2 million of debt, so cash exceeded debt by $4,267.6 million.

Debt

$1.8B

Cash and investments

$7.9B

On Jul 31, 2026.

At Jul 31, 2026 Palo Alto Networks held $7,906 million of cash and investments against $1,774 million of convertible notes, so cash exceeded debt by $6,132 million.

• One class of shares.
• Officers and directors as a group: 1.7% of shares (as of Apr 3, 2026).
• Vanguard Capital Management: 7.3% (as of Mar 31, 2026).
• BlackRock, Inc.: 6.7% (as of Dec 31, 2023).

• One class of shares.
• Officers and directors as a group: 0.6% of shares (as of Sep 18, 2026).
• Vanguard Capital Management: 7.4% (as of Apr 30, 2026).
• BlackRock, Inc.: 6.0% (as of Jan 26, 2024).

• DOJ and SEC information requests (regulation)The DOJ and SEC have asked for information on revenue recognition and ARR reporting for transactions with certain customers, the July 19 Incident and related matters. CrowdStrike says it is cooperating.
• Stock-based pay behind the GAAP losses (other)Stock-based pay was $1,096.7 million in FY2026, 22.8% of revenue, and is the main gap between GAAP losses and non-GAAP profits. Diluted shares rose from 227.1 million in FY2022 to 250.6 million in FY2026, before the split.
• Customer packages after the July 19 Incident (pricing)After the incident CrowdStrike offered discounts, extra modules, professional services, flexible payment terms or longer subscriptions. Its 10-K says these packages have resulted, and are expected to keep resulting, in more contraction (customers renewing for smaller amounts) because of longer subscription terms, and in smaller upsell amounts.
• Net income leans on interest income (other)FY2024's $72.2 million net income came after a $19.1 million operating loss, with $148.9 million of interest income. In FY2026 interest income was $195.0 million. It depends on cash balances and interest rates.

• Two distributors handle 30% of revenue (customer or supplier concentration)Two unnamed distributors each accounted for 15% of FY2026 revenue, and one was 19% of gross accounts receivable. The 10-K lists reliance on channel partners as a risk.
• Convertible notes at fair value (debt)The 2030 notes, about $1.1 billion of principal, are carried at fair value, $1,774 million at Jul 31, 2026. Changes in that value go through net income: a $562 million net loss with the capped calls in FY2026.
• Stock-based pay and dilution (other)Stock-based pay was $1,774 million in FY2026, 15.5% of revenue and 5.8 times net income. Diluted shares rose from 709 million in FY2025 to 764 million in FY2026; about 112 million shares were issued for CyberArk in February 2026.
• Operations in Israel (other)Palo Alto Networks has employees and research work in Israel, more of them since CyberArk, and the 10-K lists conditions there as a risk.