Palo Alto Networks (PANW): Cortex XSIAM ARR Passes $700 Million

On September 1, 2026, Palo Alto Networks (PANW) said on its earnings call that Cortex XSIAM, its AI-driven security operations platform, closed the year with more than $700 million in annual recurring revenue and passed 1,000 customers. The same disclosure did not say how many of those customers had pushed incident response times under 10 minutes [1].

What Cortex XSIAM is and who buys it

Palo Alto Networks is a US cybersecurity company organized around three product lines: firewalls, cloud and network security services, and security operations. Most of its revenue comes from subscription and support contracts billed annually. Cortex XSIAM sits in the security operations line, and its buyers are the security operations centers inside enterprises — the teams that watch alerts, investigate incidents and shut attacks down.

An enterprise network, endpoints, accounts, cloud, email and browsers generate an enormous volume of alerts every day. Analysts used to log into several tools and compare findings by hand to decide which alert was a real attack. The platform pulls that data into a single data lake, uses AI to connect signals, filter false positives and rank incidents by priority, then blocks and isolates automatically along preset workflows. The analyst's job shifts from paging through multiple dashboards to reviewing judgments the platform has already made [1]. This product line sits in the company's core business.

Three years of disclosure, from one deployment to a thousand customers

On November 15, 2023, the company had only a single-deployment example to show: its largest customer to date ran the platform across more than 300,000 endpoints, and the security benefit was described qualitatively as a significant reduction in detection and remediation time [2].

August 19, 2024 brought the first checkable customer outcome. The company closed its fiscal year with more than 100 deployed customers, and more than half of them had cut the median time to resolve a security incident from days to under 10 minutes. More than 30 customers by then carried over $1 million in annual recurring revenue on the platform [3].

By February 17, 2026, customer count had passed 600 and annual recurring revenue had crossed $500 million. The share of deployed customers hitting the under-10-minute mark rose above 60% and then stopped advancing, and management shifted its emphasis to the fact that the models are trained on the company's own attack data [4].

On September 1, 2026, customer count passed 1,000, the platform was ingesting 19 petabytes of telemetry per day, and most customers were using several modules at once, including exposure management and cloud security [1].

Scale numbers are accelerating; outcome numbers are not

Annual recurring revenue above $700 million, up 70% year over year, with more than 1,000 customers, is the strongest set of scale readings this platform has produced in three years [1]. The customer-outcome reading — response times compressed under 10 minutes — has not moved forward since it first appeared in 2024 [3].

The measurement basis also changed. Both earlier disclosures attached the share of customers clearing the bar: more than 50%, then more than 60% [3][4]. This time the company said only that customers standardizing on the platform bring response time under 10 minutes, without stating how many customers reach it or how it is calculated [1]. These times are measured by the customers themselves. And the fact that most customers use several modules says they are buying more on top of the same data set; it cannot be read as evidence that security outcomes improved again [1].

How this would reach the income statement, and what is still unproven

The path from this application to reported results runs through subscription and support revenue, specifically the Cortex platform revenue line the company broke out separately this period. Customers replace scattered security operations tools with this one platform, then add data volume and modules year after year, which builds toward roughly $1 million of annual recurring revenue per customer. Customer count and revenue per customer rise together, lifting recurring revenue, which is then recognized across the contract term [4].

The direction fits, but it is not yet confirmed. The company discloses only the application's annual recurring revenue and customer count; it has never broken out its revenue, gross profit or dollar contribution. Annual recurring revenue is a contracted run rate, not revenue recognized in the period. And the newly separated platform revenue line also contains an acquired observability business, so that line's growth cannot be allocated to this application [1].

What can be confirmed today

The operating change that can be confirmed is commercial scale: the platform went from a single customer deployment to standard equipment at more than a thousand enterprises, with annual recurring revenue past $700 million, driven by displacing incumbent tools and by module add-ons [1]. What remains unquantified is its own financial contribution, which requires the company to separate this application's revenue or gross profit from the acquired observability business sharing the same platform revenue line. The customer-side security benefit likewise cannot be judged until a fresh attainment rate is disclosed [1].

Application assessment

• Cortex XSIAM AI-Driven Security Operations | Business position: core business | Adoption stage: limited production | Scope: single business unit | Value type: revenue growth

Sources

[1] Drillr - Palo Alto Networks, Inc. (PANW) - 2026-09-01 - earnings call

"In the fourth quarter, XIM maintained its exceptional momentum, concluding the year with over $700 million in ARR, up 70%, while surpassing the 1,000th customer milestone on the platform."

[2] Drillr - Palo Alto Networks, Inc. (PANW) - 2023-11-15 - earnings call

"in Q1, our largest XSIAM customer to date was deployed with over 300,000 endpoints"

[3] Drillr - Palo Alto Networks, Inc. (PANW) - 2024-08-19 - earnings call

"Having closed out fiscal year 2024 with well north of 100 XSIAM customers, we have seen some amazing outcomes with deployed customers. More than 50% have achieved a median time resolution for security incidents of under 10 minutes, coming from days. After the first quarter deployment, these customers have then seen an additional 2x improvement in their median time to remediate."

[4] Drillr - Palo Alto Networks, Inc. (PANW) - 2026-02-17 - earnings call

"Over 60% of our deployed customers are now achieving meantime remediation of less than 10 minutes, a profound shift from the days or weeks they measured before."