Zero Day Advantage
In this edition of the Smart Investor newsletter, we spotlight a cybersecurity powerhouse fortifying the digital frontier. But first, let’s review the latest Smart Portfolio developments.
1
Investor Note on War-Driven Volatility
Markets are under pressure, torn in different directions by conflicting headlines. The first trading day after the U.S. and Israeli strikes on Iran’s Islamist regime opened deep in the red, as uncertainty engulfed the markets. However, the Nasdaq and the S&P 500 closed that day with modest gains as tech stocks – perceived as the least affected by the oil-price spike – recovered from earlier weakness.
Tuesday saw a similar pattern, with stocks opening sharply lower on worrying headlines regarding Hormuz risk, an Iranian drone attack on Cyprus (i.e., Europe), a fire at a major oil-trading hub in the UAE, a shutdown at the world’s largest LNG plant in Qatar, and other alarming developments signaling ongoing escalation. Although markets reversed course in the last two hours of trading, regaining some ground after President Donald Trump pledged safe oil transit in the Hormuz Strait, that’s only one part of the complexities threatening the markets – and the situation is developing.
Actual and possible disruptions sent oil and gas prices skyrocketing, instantly sending a negative signal regarding stocks in various sectors – from energy-guzzling heavy industry to consumer cyclicals, which face demand erosion if higher fuel costs squeeze consumer spending. It isn’t just energy, though – the fallout from the war is already showing up in aluminum, grains, and other commodities. If the situation escalates, it may pressure other sectors, particularly those with thin and/or input-price-dependent margins – from grocery stores to building materials to automakers. But the buck doesn’t stop there – unfortunately, no one is safe, and the AI data-center economy is also at near-term risk from higher electricity and input prices.
The risk of a prolonged oil supply shock is raising fears of a comeback of higher inflation, and traders are dialing back their expectations for Fed cuts this year, even as the economy is apparently slowing. The situation may become much more difficult, though, for regions far more dependent on energy imports than the U.S., such as Europe, South Korea, India, and others potentially facing crises from sustained high prices.
While U.S. Defense Secretary Pete Hegseth has rejected the idea of an “endless” war, there is – and could not be at this point – any fixed timeline. We at Smart Investor are currently working under the assumption that this war has just begun, and it may take several weeks to gain an understanding of when and how it may end. Meanwhile, we are flying blind like everyone else, trying to keep our gaze on the long-term financial and economic data and estimates.
1
1
Portfolio News and Updates
❖❖ APi Group (APG) delivered outstanding Q4 2025 results, beating analyst estimates across the board. Q4 net revenues rose 13.8% year-over-year to a quarterly record of $2.1 billion, while adjusted EPS jumped 29.4% to $0.44. Fourth-quarter adjusted EBITDA of $295 million rose 22%, with margin expansion of 90 basis points to 13.9%.
Full-year 2025 results were also impressive, with net revenues of $7.9 billion, up 12.7% from 2024 and adjusted EPS jumping by 20.3% to $1.48. Adjusted EBITDA increased by 16.6% – driven by strong revenue growth and gross margin expansion – with adjusted EBITDA margin rising 50 basis points to a full-year record of 13.2%. Adjusted free cash flow of $836 million also notched a company record, with 80% conversion. APi’s net leverage remains moderate at 1.6x, allowing it the flexibility to pursue attractive M&A after closing 14 accretive bolt-on acquisitions in 2025.
Data center exposure expanded from 5% of revenue in 2024 to 8% in 2025 and is expected to reach approximately 10% in 2026, providing strong margin opportunities due to technical complexity and limited competition in this space. This should support APi’s new long-term financial targets, including $10 billion in net revenues by 2028.
The company’s Q1 guidance calls for net revenue growth of 9-15% year-over-year to $1.88-1.98 billion, above consensus at midpoint, and adjusted EBITDA of $225-235 million, representing 17-22% expansion. Full-year 2026 guidance envisions net revenues of $8.4-8.6 billion (6-9% growth), adjusted EBITDA of $1.14-1.2 billion (10-15% growth), and adjusted free cash flow conversion at or above 115% of adjusted net income (approximately 75% of EBITDA).
Analysts largely view 2026 guidance as conservative, suggesting management is establishing cautious benchmarks to limit speculative growth bets. The Street is very supportive, with at least half a dozen price-target upgrades post earnings, and the new average PT implying a 18% upside from current levels. While the company’s exposure to long-cycle infrastructure projects and data center construction keeps its stock performance tied to industrial sentiment, which is currently under pressure, the longer-term outlook is overwhelmingly positive.
1
❖❖ Sterling Infrastructure (STRL) surpassed analyst projections by a wide margin in Q4 2025. Revenue (after accounting for the deconsolidation of the RHB joint venture) surged 69% year-over-year to $755.6 million, while adjusted EPS soared 78% to $3.08, a quarterly record. Gross profit margins of 22% marked a new high for Sterling, while Adjusted EBITDA grew 70% year-over-year and margins expanded over 200 basis points to reach 18.8%.
Full-year 2025 results were also outstanding. The company clocked in revenue growth of 32% (which came in at $2.49 billion) and adjusted diluted EPS growth of 53%, marking the fifth consecutive year of 35%+ adjusted EPS growth, and arriving at a new high of $10.88. Full-year gross margins reached a record of 23%, and adjusted EBITDA margins exceeded 20% for the first time in company history, expanding by 400 basis points. STRL’s E-Infrastructure Solutions segment revenue grew 123% in Q4 and 59% for the full year, driven by data-center demand. The company ended 2025 with a backlog of $3 billion (up 78% year-over-year), unsigned awards of $301 million, and future-phase opportunities exceeding $1 billion, providing visibility into approximately $4.5 billion of work, with mission-critical projects representing 84% of infrastructure-signed backlog.
Sterling’s 2026 guidance calls for revenue of $3.05-3.2 billion, adjusted EPS of $13.45-14.05, and adjusted EBITDA of $626-659 million, representing growth of 25-28% across all key metrics at the midpoint. Management expects E‑Infrastructure revenue growth of 40% or higher. The company said it sees a multi-year runway for growth, driven by data-center expansion into Texas and the Pacific Northwest, upcoming semiconductor fabrication facilities expected in the next couple of years, and plans to significantly increase capacity at high-margin businesses, as well as by accretive acquisitions.
Cantor Fitzgerald and D.A. Davidson significantly raised their price targets on STRL post earnings on durable mission-critical demand and growing visibility from the combined backlog and high-probability future phases.
1
❖❖ EMCOR Group (EME) reported record-filled quarter and full-year results. In Q4, revenues totaled $4.51 billion, up 19.7% year-over-year, while adjusted EPS increased 13.8% to $7.19 – both well above the consensus and representing quarterly records. Operating income surged 47.7% year-over-year to a record high of $440 million, while margin expanded by 240 basis points to 12.7%.
Full year 2025 also saw record annual revenues ($16.99 billion, up 16.6% from 2024), operating income ($1.7 billion, up 27.4%), operating margin (9.4%, up 20 bps), and adjusted EPS ($25.87, up 20.2%). EMCOR’s RPOs grew to $13.25 billion at year-end, driven by contracts in the Network & Communications segment that saw RPOs expand by 57% year-over-year, and by Hospitality & Entertainment, up 45%. The surge in RPOs reflected strong demand visibility for the next 2-3 years with no signs of slowing down.
EMCOR completed the Miller Electric acquisition, the largest in its history, and nine other acquisitions totaling over $1 billion were deployed in 2025, while returning approximately $600 million to shareholders through buybacks and by increasing the quarterly dividend to $0.40 per share, demonstrating a balanced capital allocation strategy.
The company initiated its 2026 outlook, guiding for revenues between $17.75-18.5 billion, diluted EPS of $27.25-29.25, and an operating margin of 9-9.4%. While investors initially saw these ranges as too conservative due to expectations for stronger margin expansion and higher growth amid data-center tailwinds, analysts were supportive, with at least four notable price-target upgrades arriving post-earnings. Analysts highlighted the management’s stated confidence in executing on targets at the midpoint, while citing strong potential upside to the high end of the provided ranges from strong backlog, execution, and sectors like data centers.
1
❖❖ MasTec (MTZ) saw a slate of analyst price-target upgrades following blowout Q4 and full-year 2025 results that exceeded guidance in virtually all respects, and strong guidance. The fourth quarter revenue increased 16% year-over-year to a record $3.94 billion, while adjusted EPS soared 44% to $2.07, both well above estimates. Adjusted EBITDA jumped 25% year-over-year to $338.2 million.
For the full year, MTZ reported record revenue of $14.3 billion (up 16% year-over-year), adjusted EPS of $6.55 (up 66%), and record adjusted EBITDA of $1.15 billion (up 14%). The company reported a record 18-month backlog of $19.0 billion, up 33% year-over-year, driven by double-digit growth contribution from all four operating segments and specifically strengthened by nearly $1 billion of data center-related work awarded in Q4.
For 2026, MasTec guided for $17 billion in revenue (19% growth year-over-year), $1.45 billion adjusted EBITDA (8.5% margin, representing 26% profit growth and 50 basis points of margin expansion), and adjusted EPS of $8.40 (nearly 30% increase). Double-digit revenue growth is seen across segments once more, with management emphasizing strong demand in data centers, renewables, and infrastructure, with multi-year visibility from backlog. The company expects to generate over $1 billion in operating cash flow with approximately 70% EBITDA conversion, allowing for investment and M&A flexibility. MTZ guides for about $200 million of net capex in 2026 and assumes that acquisitions will add roughly $500 million of revenue at high‑single-digit EBITDA margins.
1
❖❖ Meta Platforms has signed a multi-billion dollar deal to lease Google’s (GOOGL) AI semiconductors, known as TPUs (tensor processing units), via Google Cloud to train and develop new AI models. The deal aims to diversify Meta AI chip suppliers beyond Nvidia and AMD, further strengthening Google’s TPUs as a prominent alternative to Nvidia’s dominant GPUs in the AI chip market. According to media reports, Meta is also in talks with Google to buy the TPUs for its data centers as early as next year, though the status of those discussions could not be determined. This follows Google’s formation of a joint venture with an undisclosed investment firm to lease TPUs to external clients, with Meta as an early adopter. This JV structure is designed to scale Google’s TPU business beyond its traditional internal use and standard Google Cloud rentals, essentially creating a more financed, expanded leasing model for AI hyperscalers and other clients. These moves correspond to Google’s aggressive strategy to grow TPU revenue, aiming for tens of billions in additional hardware income.
1
❖ The news confirming Google’s AI leadership keeps piling up. A couple of months ago, Apple revealed it had chosen the Gemini AI model to power the next generation of Siri. Now, the iPhone maker is reportedly asking Google to explore running the upcoming AI-enhanced Siri on Google’s servers. For Apple, this is a part of their strategy to keep AI and cloud investments to a minimum, although it deepens the company’s dependence on rivals for critical AI infrastructure. For Google, this would be another badge of approval for Geminy AI – and also a step further in embedding itself across various ecosystems, adding to its already great operating and competitive leverage.
1
❖ The past year has been a real turnaround for Google’s AI efforts, with the momentum noticeably shifting in its favor. The company’s unmatched distribution, vertical integration, and AI prowess create a formidable moat, threatening rivals’ market positioning. This appears to be one of the key reasons behind Amazon (AMZN), SoftBank, and Nvidia teaming up to invest in OpenAI in its latest funding round, as well as for a flurry of other deals between AI leaders.
OpenAI raised $110 billion, resulting in an approximately $840 billion post-money valuation, SoftBank shelling out with $30 billion, and Nvidia $30 billion. Amazon said it will invest a total of $50 billion, with $15 billion paid upfront and the remaining amount to follow based on progress on OpenAI’s IPO plans as well as technological advancement towards AGI. The round remains open, with additional investors – such as sovereign wealth funds, other companies, or existing partners like Microsoft (MSFT), which has an option to participate – expected to join as it progresses.
1
❖ Meanwhile, although Microsoft has yet to join, it issued a joint statement with OpenAI. The companies reaffirmed that their core partnership remains unchanged – with Microsoft Azure still the exclusive cloud provider for OpenAI’s APIs and models – with nothing in the new deals altering that relationship. Microsoft retains its exclusive IP license, revenue-sharing (which includes a cut from OpenAI’s other partnerships), and core hosting for first-party OpenAI products in many cases. Moreover, MSFT is already benefitting from OpenAI’s valuation jump without even participating in this round, as its prior investment in ChatGPT maker is now worth far more on paper.
1
❖ Amazon (AMZN), on the other hand, penciled in much more for OpenAI than it has ever invested in any other company. Beyond AMZN’s financial commitment, the two companies have significantly expanded their multi-year strategic partnership, which gave the ChatGPT maker full access to AWS infrastructure and thousands of state-of-the-art Nvidia GPUs. OpenAI’s AWS use will be complementary and specialized, focusing on next-gen, enterprise-grade, and agentic workloads. These include co-development of a new Stateful Runtime Environment (SRE) natively hosted on Amazon Bedrock, as well as AWS’s position as the exclusive third-party cloud distribution provider for Frontier, OpenAI’s enterprise platform for building, deploying, governing, and managing teams of AI agents.
The latest deal adds $100 billion in OpenAI commitments to AWS for a total cloud spend trajectory exceeding $138 billion over eight years. OpenAI has committed to using 2 gigawatts of compute capacity powered by Amazon’s proprietary Trainium processors. The deal validates Trainium as a viable alternative to Nvidia GPUs for OpenAI’s needs, and, more broadly, strengthens AMZN hardware’s competitiveness against Google’s TPUs.
1
❖❖ Pfizer (PFE) has notched several important operational and regulatory milestones, making significant progress in broadening its post-COVID growth story with fresh moves across obesity, metabolic, oncology, and vaccines.
The pharma giant has begun dosing in a Phase 1 trial of PF-08653944, a subcutaneous weight management shot for adults with overweight or obesity. While still in early stages, this could support Pfizer’s long-range revenue mix if efficacy later proves competitive. Earlier, PFE signed a strategic commercialization agreement with Hangzhou-based Sciwind Biosciences for ecnoglutide, a new-generation injectable GLP-1 receptor agonist (a class of drugs similar to the existing treatments like Zepbound and Wegovy). Under the deal, Pfizer gains exclusive commercialization rights for ecnoglutide in mainland China, one of the fastest-growing end markets where obesity affects ~14% of adults and is a government priority under the “Healthy China” initiative. Ecnoglutide has already been approved in China for diabetes, with obesity-treatment approval expected soon, as it showed strong results in trials.
In parallel, the company is setting up a Phase 2, double-blind mRNA flu vaccine study in adults, pitting six experimental candidates against a standard flu shot as it seeks to build a durable mRNA franchise beyond COVID and challenge incumbents in this area.
Meanwhile, the FDA granted full approval for Pfizer’s BRAFTOVI combination therapy in BRAF V600E-mutant metastatic colorectal cancer, converting accelerated approval based on Phase 3 BREAKWATER trial data showing a 51% reduction in death risk. The approval positioned BRAFTOVI as the only targeted combination therapy to significantly improve outcomes in this patient population, reinforcing Pfizer’s oncology pipeline momentum.
Argus Research upgraded Pfizer from Hold to Buy with a price target of $35, implying an upside of over 26% from current levels. The firm is positive on PFE’s prospects based on its accelerated R&D, successful launch of new products, and bolt-on business development.
1
1
Portfolio Stocks Under Review
❖ We are keeping CrowdStrike (CRWD) under review following its fiscal Q4 and full-year 2026 results. The report confirmed the company’s leadership position in cybersecurity and reinforced the strength of its long-term outlook, but in the current environment, we believe it is prudent to remain patient.
Operationally, CrowdStrike delivered another exceptional quarter. Net new annual recurring revenue reached $331 million, up 47% year-over-year, pushing total ARR to $5.25 billion and making CRWD the fastest pure-play cybersecurity company in the world to surpass the $5 billion ARR milestone. Revenue grew 23% year-over-year to $1.31 billion, while the company generated $376 million in quarterly free cash flow and $1.24 billion for the full year. At the same time, profitability continues to scale impressively, with fiscal 2026 operating income surpassing $1 billion.
Demand across the platform remains robust. The Falcon Flex subscription model continues to drive adoption, with more than 1,600 customers now using the program and ARR from these accounts growing more than 120% year-over-year to $1.69 billion. Expansion across key growth engines is also accelerating. Cloud security ARR exceeded $800 million, next-generation SIEM ARR surpassed $585 million after growing more than 75% year-over-year, and identity protection ARR reached more than $520 million. These trends confirm that CrowdStrike’s platform consolidation strategy is gaining traction among large enterprises.
Importantly, the company’s results reinforce what we believe is a structural reality: the rise of artificial intelligence is driving even faster expansion of the cybersecurity market than before the tech’s advance. AI already significantly increases the need for cyber protection, and this trend will only accelerate as threat actors deploy increasingly sophisticated tools. CrowdStrike itself highlighted that more than 1,800 AI applications are now running across enterprise endpoints monitored by its sensors, illustrating how quickly the attack surface is expanding. In that environment, cybersecurity platforms like Falcon become even more mission-critical infrastructure.
Guidance also points to continued momentum. CrowdStrike expects fiscal 2027 ARR of $6.47-6.52 billion and revenue of $5.87-5.93 billion, representing growth of roughly 23% and 22%, respectively. While this reflects some natural moderation as the company scales, the outlook remains strong for a business that has already reached a significant size.
At the same time, the market reaction highlights why we are not rushing to act. The stock has already declined roughly 30% from its November peak, which removed some of the speculative froth that had built into the valuation during the roughly 470% surge from January 2023’s lows. At those highs, the market was effectively pricing in perpetual revenue growth above 30%, an unrealistic expectation for a company of CRWD’s scale. Some analysts who lowered price targets before and after the report are simply acknowledging that normalization.
The more immediate issue is macro uncertainty. Escalating geopolitical tensions amid the ongoing war with Iran’s regime have injected a new layer of volatility into global markets. While cybersecurity companies are not directly exposed to higher oil prices or supply shocks, broad risk-off sentiment can negatively affect all stocks that are not perceived as safe havens. Even companies with strong fundamentals and growth metrics can struggle to maintain gains in such an environment.
In addition, while CrowdStrike’s guidance was solid, it was not the type of dramatic upside surprise that would immediately reset sentiment. The outlook confirms strong and durable growth, but it may not be sufficient on its own to drive a sharp rebound if market volatility intensifies again. With the stock still trading at a premium multiple relative to most peers, valuation sensitivity remains a factor.
For these reasons, we believe patience is warranted. CrowdStrike has once again demonstrated that it sits at the center of the global cybersecurity ecosystem and is well-positioned to capitalize on the rise of AI. However, with geopolitical tensions high and broader market sentiment fragile, we prefer to monitor how the stock behaves in the coming weeks before making a definitive portfolio decision.
1
❖ We are keeping Oracle (ORCL) in our “Under Review” bracket as we head toward its March 9 earnings report. Our long-term conviction in Oracle’s strategic positioning remains intact, but the near-term setup is now defined less by funding uncertainty and more by capital intensity, free cash flow pressure, and legal and sentiment overhangs tied to its AI buildout.
Oracle has outlined a roughly $45-50 billion capital raise for calendar 2026, split between debt and equity or equity-linked securities, to fund OCI expansion for large AI customers. Investor demand for the debt portion was extremely strong – roughly $125 billion of orders for a ~$25 billion issuance – but that figure reflects orderbook demand, not the amount being raised. Management has stated it does not expect to issue additional bonds in 2026 beyond this transaction, signaling that near-term liquidity risk is largely addressed.
The real debate now shifts to 2027. Free cash flow has turned deeply negative in recent quarters as capex ramps toward ~$50 billion, overwhelming otherwise solid operating cash flow, with OCI capacity being built ahead of revenue conversion. Oracle has modestly increased its fiscal 2027 revenue outlook, citing faster RPO conversion, but investors remain focused on whether backlog – now exceeding $500 billion – can translate into meaningful FCF inflection next year. If utilization ramps as planned, 2027 could mark stabilization. If not, additional funding pressure beyond 2026 becomes the key risk.
Litigation headlines have added noise. A new securities class action alleges that Oracle underplayed the near-term impact of AI-related capex on free cash flow and leverage. These suits are common following sharp stock declines, but they reinforce scrutiny around disclosure, capital intensity, and execution timing.
On the other hand, counterparty fears tied to OpenAI exposure appear to be easing, as ChatGPT maker’s latest funding round has already amounted to $110 billion (it remains open, with more participants likely to join). That materially strengthens the funding profile of one of ORCL’s largest AI customers and reduces immediate concerns about contract durability.
At the same time, demand signals remain tangible. Oracle continues to secure meaningful U.S. government awards, including over $1 billion in federal payments over the past year and a new $88 million Air Force Cloud One task order supporting classified workloads through 2028. In the applications layer, Oracle has expanded its AI footprint with dozens of embedded agents across supply chain, finance, and customer experience workflows, reinforcing that its AI strategy extends beyond GPU-heavy infrastructure. Even at the data-center level, the company is emphasizing engineering efficiency, including closed-loop cooling systems designed to minimize water usage – addressing growing environmental optics around large-scale AI infrastructure. This, alongside Oracle’s role as a joint-venture operator of TikTok U.S., which locks in a significant OCI client while offering upside through an equity stake, underscores that Oracle’s revenue base is more diversified than OpenAI-centric fears suggest.
The Street’s tone remains constructive but cautious. Despite a slate of price-target reductions driven by stock declines, there has been only one rating downgrade (from Buy to Hold) by Melius Research – countered by D.A. Davidson’s upgrade from Hold to Buy on the same day, as analysts grew more confident in OpenAI’s ability to meet its huge cloud infrastructure spending commitments, including the massive Oracle deal. Oppenheimer added a dose of positivity last week, upgrading Oracle to Buy as it sees a favorable risk/reward setup at current prices and forecasts strong long-term EPS growth from cloud and AI investments.
ORCL’s long-term AI and cloud opportunity is intact, yet heavy capex, negative free cash flow, and sector-wide de-risking in AI infrastructure (not to mention the recent flare-up in the Middle East) are all capping multiples. This is why the March report will be critical in assessing OCI growth durability, capex discipline, and early signs of backlog monetization. Funding clarity has improved; execution clarity is what investors now require.
1
1
Portfolio Earnings and Dividend Calendar
❖ The earnings season is well past its peak, but several Smart Portfolio holdings are yet to report their quarterly results. Broadcom (AVGO) is slated to release its fiscal Q1 2026 earnings today, and Oracle (ORCL) is scheduled to report its fiscal Q3 2026 on March 9.
❖ The ex-dividend date for GE Aerospace (GE) and Alphabet (GOOGL) is March 9.
w
1
New Buy: Palo Alto Networks (PANW)
Palo Alto Networks, Inc. is one of the largest and most influential pure-play cybersecurity platforms in the world, serving as a strategic security partner to enterprises, governments, and service providers across industries. The company’s portfolio spans network security, cloud security, and security operations, delivering integrated protection across data centers, hybrid environments, multi-cloud infrastructure, and distributed workforces. Its platform architecture is designed to consolidate what were once fragmented point solutions into a unified system that can prevent, detect, and respond to threats in real time. As cyber risk has evolved from an IT issue into a board-level priority, Palo Alto has positioned itself at the center of enterprise security transformation – combining firewall leadership, cloud-native protection, AI-driven threat detection, and automation into a broad, subscription-based ecosystem that underpins modern digital infrastructure.
1
Code, Cloud, Control
Palo Alto Networks was founded in 2005 by former Check Point engineer Nir Zuk with a clear premise – traditional firewalls were no longer sufficient for a world increasingly defined by applications, users, and evolving threats. The company’s early breakthrough was the next-generation firewall, which classified traffic by application and user identity rather than by port alone. That architectural shift disrupted legacy vendors and established Palo Alto as a serious force in enterprise security.
Following its 2012 IPO, the company used both capital and equity strategically, expanding beyond network appliances into adjacent security categories. Through the 2010s, it steadily added cloud security, endpoint protection, threat intelligence, and automation capabilities through targeted acquisitions, building the foundation for what would become a multi-pillar platform.
The past five years reshaped the company’s trajectory. As enterprises accelerated cloud migration and hybrid work adoption, PANW moved decisively from product expansion to platform consolidation. Acquisitions such as Bridgecrew in 2021 and Cider Security in 2022 strengthened its position in cloud-native and software supply chain security. In 2023, Talon Cyber Security and Dig Security deals extended PANW’s reach into secure enterprise browsers and data security posture management – both increasingly critical in distributed, cloud-first environments.
In early 2026, the company made its most transformative moves yet. In January, PANW completed the acquisition of Chronosphere, adding cloud-native observability to its stack and reinforcing its push to unify observability and security in AI-driven environments. In February, it completed the approximately $25 billion acquisition of CyberArk – one of the largest deals in cybersecurity history – establishing identity security and privileged access management as a core pillar of its platform. Days later, Palo Alto announced its intent to acquire Israeli startup Koi Security, adding agentic endpoint protection designed to secure AI-native ecosystems and autonomous systems. Following these transactions, Palo Alto announced plans to pursue a dual listing on the Tel Aviv Stock Exchange, further deepening its ties to Israel’s cybersecurity ecosystem and its expanding R&D footprint there.
From a firewall disruptor to a platform consolidator spanning network, cloud, identity, observability, and AI security, Palo Alto’s rise reflects a deliberate strategy – acquire critical technologies early, integrate them tightly, and position itself at the center of the enterprise security stack.
1
Platform at the Perimeter
Palo Alto Networks operates as the control layer of modern enterprise infrastructure – the company that secures the network, the cloud, the endpoint, the browser, and now identity and observability, as those layers converge under AI. What began as a next-generation firewall provider has evolved into a multi-pillar cybersecurity platform designed to replace fragmented point products with a unified architecture that operates in real time at critical control points.
The business today spans three major engines. Network Security remains the largest segment, contributing roughly half of total revenue. Within it, SASE1 has surpassed $1.5 billion in annual recurring revenue and is growing at roughly 40% year-over-year, reflecting enterprise demand for unified protection across hybrid workforces. Software Firewalls – growing around 25% year-over-year – are increasingly deployed to secure dynamic multi-cloud and AI workloads, while hardware continues to anchor large enterprise and critical infrastructure environments.
Security Operations, centered on Cortex2 and XSIAM,3 has become the second growth pillar. XSIAM has exceeded $500 million in annual recurring revenue (ARR) with more than 600 customers, many deploying at nearly $1 million per year. The value proposition is automation – shrinking response times from days to minutes through AI-driven detection and remediation. As cyber threats accelerate, speed becomes a structural advantage.
Cloud and AI security represent the newest frontier. Prisma AIRS4 has surpassed 100 customers only a few quarters after launch, securing AI models, applications, and agents across their lifecycle. With agentic AI expanding the attack surface rather than compressing budgets, identity and runtime governance become foundational. The acquisition of CyberArk adds approximately $1.2 billion in ARR and establishes identity as a core control layer, while Chronosphere contributes roughly $200 million in ARR and embeds observability into the stack – giving Palo Alto visibility into how AI systems behave before automating remediation.
To accelerate this consolidation, the company is actively deploying deferred billing structures and “platformization credits,” helping customers exit legacy point-product contracts early. The strategy can temper near-term billings optics, but it deepens long-term ecosystem integration and increases lifetime value per account.
Growth is increasingly cross-sectoral. Telecom partnerships embed security into 5G infrastructure. Collaborations with Nvidia and industrial players extend protection into factories, pipelines, and power grids. Government modernization and geopolitical cyber conflict reinforce cybersecurity as infrastructure, not discretionary spend.
The trajectory is clear – consolidate the stack, secure AI at scale, and expand deeper into critical infrastructure and identity-driven control. As enterprises shift from experimentation to deployment of autonomous systems, Palo Alto is positioning itself not just as a security vendor, but as the architectural backbone of the AI-era enterprise.
—
1 – SASE (Secure Access Service Edge) integrates networking and security into a unified cloud-delivered architecture that protects users, applications, and data across hybrid and remote environments.
2 – Cortex is Palo Alto Networks’ security operations platform, combining detection, response, automation, and analytics across endpoints, cloud, and network telemetry.
3 – XSIAM (Extended Security Intelligence and Automation Management) is an AI-driven security operations platform that automates threat detection and remediation across enterprise environments.
4 – Prisma AIRS (AI Runtime Security) secures artificial intelligence models, applications, and autonomous agents across their lifecycle – from development and testing to deployment and runtime governance.
—
1
Compound Control
Palo Alto Networks closed the first half of fiscal 2026 with scale, momentum, and a balance sheet built to fund expansion. In FQ2, revenue rose 15% year-over-year to $2.59 billion, landing at the high end of guidance and extending a streak of at least eight consecutive quarterly revenue beats. Non-GAAP diluted EPS reached $1.03, well above consensus estimates, extending the long track record of adjusted EPS outperformance. Operating leverage continued to improve – non-GAAP operating margin expanded 190 basis points year-over-year to 30.3%, the third straight quarter above the 30% threshold.
Growth remains diversified across the portfolio. Product revenue increased 22% year-over-year, driven by Software Firewalls and SASE momentum, while subscription and support revenue grew 13%, reflecting the company’s expanding recurring base. Next-Generation Security (NGS) ARR reached $6.33 billion, up 33% year-over-year and 28% organically. Remaining performance obligations (RPOs) – the forward revenue pipeline – climbed 23% to $16.0 billion, outpacing revenue growth and signaling durable demand visibility.
Profitability is not coming at the expense of reinvestment. Gross margin held at 76.1%, with product gross margin up 150 basis points year-over-year due to a higher software mix. Services gross margin declined modestly by 100 basis points as newer SaaS offerings scale, a mix shift that prioritizes long-term recurring expansion. Trailing twelve-month adjusted free cash flow reached $3.75 billion, representing a 37.9% margin. Q2 alone generated $502 million in adjusted free cash flow, reinforcing the company’s capital flexibility.
Following the strong H1, management raised full-year fiscal 2026 guidance. Revenue is projected at $11.28-11.31 billion, representing 22-23% year-over-year growth and ahead of prior consensus expectations. NGS ARR is expected to reach $8.52-8.62 billion, up 53-54%, including contributions from recent acquisitions. RPOs are forecast to rise to approximately $20.2-20.3 billion, up roughly 28%. For fiscal Q3 2026, revenue guidance of $2.941-2.945 billion implies 28-29% year-over-year growth, comfortably ahead of consensus, while non-GAAP EPS is guided to $0.78-0.80.
The temporary step-down in FQ3 earnings is largely driven by acquisition timing effects, integration costs, and a higher share count following the CyberArk transaction. In other words, the near-term EPS moderation is largely mechanical and transaction-related rather than demand-driven. Core demand trends – as reflected in ARR and backlog growth – remain intact.
Cash and investments totaled roughly $7.5 billion at quarter’s end, providing ample capacity even after approximately $4.9 billion in combined cash outlays for Chronosphere and CyberArk. Despite absorbing two large acquisitions, the company continues to generate cash at scale while maintaining operating margins near 30%.
The through-line is consistency – double-digit revenue growth, expanding ARR, strong free cash flow conversion, and disciplined cost control. As the platform broadens and the recurring mix deepens, the financial profile reflects a business scaling with control rather than chasing growth at the expense of durability.
1
Privileged Access
Palo Alto Networks’ best comps are a concentrated group of large-cap U.S.-listed cybersecurity leaders that share scale, enterprise exposure, and platform ambitions. CrowdStrike represents the closest strategic peer – another security consolidator competing for platform primacy across endpoint, cloud, and identity. Fortinet provides the network-security and margin benchmark, with deep firewall roots and strong cash-flow discipline. Zscaler serves as the cloud-native zero-trust specialist, offering a purer read on SASE demand and growth multiples. Check Point anchors the mature end of the spectrum, illustrating how durable profitability and scale translate into steadier valuation frameworks. Together, these four define the competitive and valuation band within which PANW operates.
Cybersecurity stocks surged into November 2025, driven by accelerating AI narratives, platform consolidation momentum, and premium growth expectations across the sector. Multiples expanded as investors treated the group as structural beneficiaries of the AI build-out and rising cyber threats. Since that peak, however, the entire cohort has retraced sharply, pointing to a sector-wide valuation reset. Palo Alto Networks, Fortinet, Zscaler, and Check Point are all down double digits over the past year, while CrowdStrike has held roughly flat but remains well below its high. November marked the start of a pullback from stretched multiples, January’s software-wide AI panic dragged the group down with the broader SaaS complex, and February’s Claude Code Security announcement gave the selloff a cybersecurity-specific headline – even though most analysts see the actual competitive impact as limited.
As the sector stocks have begun to stabilize following their rerating – and with the flare-up in Middle East tensions once again underscoring cyber risk – valuations remain far below their historic levels. Although cyber stocks (with the exception of Check Point, which has long traded as a valuation outlier) are still trading at multiples above the tech sector medians, those are now much more connected to reality as reflected by order books, ARRs, and revenue growth rates. Following the November–February selloff, PANW is trading at a ~30% discount to its long-term average P/E ratio.
The comparison to peers has also become easier. While PANW’s valuations looked starkly rich just a few months ago, now they appear justified by the company’s strong fundamentals, wide reach, platform economics, and long-term expansion outlook – while becoming far more accessible relative to peers. The stock trades at roughly 40x forward and TTM earnings – well below CrowdStrike’s triple-digit multiples and just modestly above Zscaler’s forward P/E ratios. Palo Alto’s stock is valued at around 10x sales, just above half of CrowdStrike’s level and only a moderate premium to Fortinet and Zscaler, despite broader platform exposure and comparable ARR growth. Arguably, its margins justify that positioning. Operating margins near 30% and free cash flow margins around 38% place PANW closer to Fortinet and Check Point on profitability, while maintaining stronger growth characteristics.
Overall, PANW is no longer priced for perfection; if execution on AI security and identity integration continues, the current multiple leaves room for gradual re-expansion. Moreover, while the company’s recent focus has shifted toward high-impact M&A and prudent debt management, the existing $1 billion share repurchase authorization provides both a capital return option and a potential buffer during periods of market dislocation.
1
Investing Takeaway
Palo Alto Networks sits at the center of an expanding digital battlefield, where identity, cloud workloads, and autonomous systems increasingly define the attack surface. The company has moved far beyond its firewall roots into a scaled security architecture built to consolidate tools, automate response, and embed protection across enterprise environments. Recent volatility reset expectations, not fundamentals. As geopolitical tensions and AI-driven threats raise the stakes, security spend becomes less discretionary and more structural. With platform breadth, strong cash generation, and deeper positioning in identity and AI security, PANW is equipped to capture that shift. For long-term investors, it represents durable leadership in a sector where relevance compounds and digital defense remains mission-critical.
1
1
New Sell 1: Vistra Corp. (VST)
We are exiting our position in Vistra. This is not a loss of confidence in the business. On the contrary, VST remains one of the most strategically positioned integrated power platforms in the U.S., with a modern gas fleet, meaningful nuclear exposure, and long-term data-center contracts that materially enhance earnings visibility. The issue is timing and valuation.
Over the past year, the stock has rallied roughly 30%, and much of the structural upside tied to the data-center power cycle appears priced in. The nuclear PPAs with AWS and Meta, the Lotus acquisition, the pending Cogentrix transaction, and the company’s disciplined buyback framework have driven a sharp rerating. That optimism leaves less room for execution friction or macro volatility. When expectations are elevated, even solid results can disappoint – and recent underperformance relative to those expectations has increased pressure on the shares.
The immediate catalyst was the latest earnings report, which fell short of elevated market expectations despite solid operational delivery. Revenue and EPS misses, while not thesis-breaking, reinforced the sense that the stock had run ahead of fundamentals. The subsequent escalation in the Middle East only exacerbated the sell-off, amplifying market-wide fears and accelerating risk-off positioning across equities.
The war on Iran’s regime has introduced a new layer of uncertainty into global energy markets. Oil and gas prices have spiked, forward curves are volatile, and inflation risks are rising again. Vistra is heavily hedged – approximately 100% of expected generation volumes for 2026 – which provides meaningful near-term protection. However, sudden fuel price spikes can still impact unhedged exposures, margin requirements, and sentiment toward merchant power names.
At the same time, utilities and power generators are sensitive to interest rate expectations. If energy-driven inflation delays anticipated Federal Reserve rate cuts, the valuation support from a lower-rate environment becomes less certain. In volatile markets, capital often rotates toward defensive safe havens rather than growth-oriented utilities with significant merchant exposure.
Importantly, none of this alters the long-term thesis. The company’s acquisitions, particularly in natural gas and nuclear, should enhance earnings power over time. The contracted nuclear capacity meaningfully improves visibility, and sustained higher power prices could ultimately benefit merchant generation economics. We believe those investments will pay off. However, in the current environment, the risk/reward no longer justifies staying invested. With geopolitical uncertainty elevated and valuation reflecting much of the structural upside, we prefer to step aside and preserve capital flexibility.
This is a disciplined pause, not a structural rejection of the story. Vistra remains a high-quality platform, and we are open to revisiting the name once volatility subsides, expectations reset, and the geopolitical picture becomes clearer.
1
1
New Sell 2: Credo Technology (CRDO)
Credo Technology remains a standout operator in AI connectivity. The company just delivered another extraordinary quarter – revenue surged more than 200% year-over-year, margins stayed above 68%, and guidance calls for continued growth. From a fundamental standpoint, very little – if anything – is going wrong. And yet, we are choosing to step aside.
The stock had already been under pressure prior to earnings as investors began questioning customer concentration and debating valuation. With roughly 90% of revenue tied to three hyperscalers, the dependency narrative gained traction, even though demand trends remained strong. At the same time, broader AI sentiment softened, and momentum across the theme began to weaken.
What ultimately shifted our view was the market’s reaction to an objectively excellent report. Revenue and earnings beat expectations, guidance remained solid, and the long-term roadmap expanded – yet the stock fell sharply, and analysts trimmed price targets. When a blowout quarter cannot support the shares, it signals a change in risk appetite that we don’t wish to fight.
The escalation in the Middle East only intensified that shift. As geopolitical uncertainty sparks a broad sell-off, capital rotates out of areas perceived as high-beta. In a more stable macro environment, this quarter likely would have driven CRDO higher. Instead, it becomes an excuse for investors to de-risk.
Importantly, valuation does not appear stretched, and the long-term thesis remains intact. Credo’s leadership in AECs, its expanding optical portfolio, and its deep hyperscaler relationships position the company well for sustained growth. We believe the strategic trajectory is sound.
This is therefore a timing decision, not a verdict on quality. With sentiment toward AI infrastructure fragile and geopolitical risks elevated, we prefer to reduce exposure and wait for conditions to stabilize. We fully intend to revisit this superb company once volatility subsides and we feel more comfortable adding higher-risk growth exposure back into the portfolio.
1
1
Smart Investor’s Winners Club
The Winners Club represents stocks from the Smart Investor Portfolio that have risen at least 30% since their purchase dates.
Markets were hit by a geopolitical missile, but our Club fared better than feared, still retaining 19 stocks: GE, AVGO, HWM, TSM, EME, ANET, APH, PH, IBKR, VRT, MTZ, ORCL, GOOGL, KEYS, RTX, ATI, ASX, BK, and CSCO.
Stocks that were displaced from the ranks by turbulence are now first in line to return. They are: MS with a 28.96% gain since purchase, STRL with 28.20%, and JBL with 25.48%. Will they return to the Club, or will another stock outrun them to the finish line?
1
1
|
