Can Palo Alto Networks' SASE Push Help It Challenge FTNT and ZS?

Palo Alto Networks' fiscal 2026 SASE bookings rose 40%, with nearly 100 legacy-vendor displacements worth more than $400 million in contract value—almost double the prior year—supporting its challenge to Fortinet and Zscaler. A global telecom customer signed a $126 million firewall and Prisma Access SASE expansion, while agentic AI traffic on PANW's SASE platform increased 9x over nine months. The growth outlook is tempered by PANW's 21.31x forward sales multiple versus a 19.13x industry average and mixed near-term estimate revisions.

Analysis

The relevant read-through is not headline share capture but the economics of consolidation: PANW can bundle network security, access and SD-WAN into an installed-base renewal, lowering procurement friction and raising switching costs. That supports larger multi-product commitments and better lifetime value, but it can also defer near-term revenue recognition while customers migrate. The more exposed incumbents are point-product vendors and legacy proxy providers; FTNT is relatively insulated because its appliance footprint and sovereign/on-premises positioning address workloads where a cloud-only architecture is less viable.

For ZS, competitive wins on both sides imply that the category is expanding faster than any single vendor is taking share. Its pure-play zero-trust posture remains advantaged in greenfield cloud transformations, while PANW's advantage is strongest where firewall customers want one commercial relationship. Investors should therefore focus on net retention, large-deal mix, remaining performance obligations and sales-cycle duration—not isolated displacement announcements—over the next 1-3 quarters.

PANW's premium valuation leaves limited tolerance for a bookings-to-revenue conversion slowdown or weaker FY27 margin progression. The contrarian view is that broad security-stock strength has already capitalized much of the AI-security narrative: higher machine traffic may increase inspection volumes, but enterprises can respond with policy automation and vendor rationalization rather than proportionate spend growth. A meaningful deceleration in platformization metrics, or FTNT/ZS reporting accelerating SASE billings and large-enterprise wins, would falsify a PANW-share-gain thesis.

Near term, this is more useful as a relative-value setup than a directional cybersecurity beta trade. PANW must demonstrate sustained large-platform deal conversion to earn further multiple expansion; FTNT offers a cleaner upside surprise if enterprise refresh spending normalizes, while ZS offers the most direct upside to zero-trust demand but carries greater execution sensitivity.

Key Decisions for Investors

• Maintain a market-neutral long FTNT / short PANW pair over the next 1-3 months, sized modestly. Rationale: FTNT's integrated architecture can compete effectively while PANW has greater valuation sensitivity; cover the PANW short if it delivers accelerating remaining-performance-obligation growth plus raised FY27 billings guidance.
• Do not chase PANW on this item alone. Add only after the next earnings release confirms that SASE/platform bookings are translating into durable total RPO, next-generation security ARR and operating-margin upside; otherwise premium-sales-multiple compression is the dominant risk.
• Use ZS as an event-driven watch rather than a fresh position: initiate long exposure only if its next quarterly large-deal commentary and net-retention trajectory show cloud zero-trust wins converting to reaccelerating ARR. A guide-down in billings or material sales-cycle elongation invalidates the setup.
• Monitor ETF HACK/BUG versus PANW over 6-18 months: sustained vendor consolidation should favor platform vendors, but a broad cybersecurity multiple reset from enterprise IT-budget pressure would overwhelm company-specific share gains.